Avoiding the internet seems impossible, even those who try to avoid having an online presence will inevitably have a trace. Social media, HM Land Registry, electoral roll, online shopping, online banking and gaming all leave a trace of the individual using them. Some of these are more protected than others, but it doesn’t always require an individual to input their own information for it to be publicly available. There are ways in which an individual’s exposure can be limited and protected, but to remove all trace would require high-level specialist skills, equipment and permissions.
Online Vulnerability Assessment (OVA)
An Online Vulnerability Assessment (OVA) is a way of identifying how much of an online presence an individual has. A range of information regarding an individual can be found throughout publicly available information (PAI) including:
- Name/ Alias
- DOB
- Contact details: Address – current and past, Phone numbers, email addresses
- Photos
- Awards: sport, academic, honours, promotions, etc,
- Vehicle details
- Social Media: Friends/ Family, Hobbies
Risk vs. Threat
An OVA will allow an individual to attempt to minimise their risk against numerous threats from their online presence. In this context, risk refers to the likelihood of harm occurring whereas threats are the events, or entities that can cause harm. Threats cannot be reduced; they are present regardless of the actions of an individual. However, risks of an online presence can be reduced through the actions of the individual when setting up accounts, having an awareness of their personal cyber security and requesting removal of information directly from the source.
Ethics and the Law
Individuals are able to reduce their online presence through the use of Freedom of Information Requests, Data Act (2025), and the Right to be forgotten via the UK General Data Protection Regulation (UK GDPR), amongst other laws and policies. These laws are in place to protect the public and their right to privacy. As well as law to protect those wishing to minimise their risk, there are laws and ethical considerations when collecting open-source information regarding an individual. If an investigation, conducted by a public body, into an individual’s online presence (carrying out an OVA) is covert, persistent, and information is recorded then Regulatory Investigative Powers Act (RIPA) 2000 should be applied. RIPA must be adhered to as this is designed to ensure that surveillance activities are carried out lawfully, respecting individuals’ rights to privacy, protecting the subject of the investigation, others within their personal sphere and the investigator.
When carrying out an OVA the subject’s permission must be sought where possible (and safe to do so). Collateral intrusion (information on individuals within the sphere of the subject) should be limited to maintain the privacy of those individuals which are not the focus of the investigation. Where necessary for the information other individuals to be collected, as part of the collection plan, this should be kept to a minimum and redacted within reports to maintain ethical and legal standards.
Open-source Methodologies
To effectively conduct an OVA using open-sources (PAI) it is vital that the investigator is flexible and persistent in their approach, using a range of methodologies and tools. One thing to consider when making a plan is: “What tools will an adversary have?” with the aim of being ahead of an adversary and ensuring all bases are covered. The volume of data within open-sources can be overwhelming, a clear aim and plan can aid in not getting lost within unnecessary information which distracts from the main subject.
Having a knowledge and awareness of how an adversary would collect PAI, will support the security of your own online footprint. A few areas to consider are:
- Is your social media secure and set to friends only? Are you aware of all the individuals that follow you or have access to your profile including professional profiles?
- Is your registration on the electoral roll made public?
- If you have a company – is the address on companies house your personal address or that of an office/ PO box?
- What images of you are available online using a reverse image search?
- Has any of your data been breached and now available on the dark web (eg: email, phone number, bank details and passwords)?
- Does your employer advertise your information including your role, employment history and family details?
- Are the pictures of your house available on estate agent websites?
It is a valuable exercise to carry out an OVA on yourself and see how much information can be identified from simple searches on the surface web to further details on the deep web.
Summary
Why would you need to be aware of your current and historical online presence? Having an OVA carried out would be of value to a range of individuals including: High Net Worth Individuals (HNWI), those applying for a new job, and students applying for a university.
OVAs can also help to minimise the risk from a variety of threats online and keep an individual and their family safer.
- Historical posting or reposting of extreme views can have an impact on a new job or university course and can be found even if you think you have deleted it from your account.
- Posting seemingly innocent photos of your child’s first day at school or your new car can give adversaries enough information to locate you.
- Advertising you are away on holiday with a photo of an airport drink can advertise you are away from your house, combined with other open-source information, increases the risk to your property.
- Information held on the electoral roll or companies house can give opportunities to locate you and your family and may not have been deliberately added by you.
Employers and academic institutions may check your online presence to assess your suitability and with numerous real case studies whereby employment or university places have been lost – don’t let this be you. Know how to manage your online presence, control the information available about yourself and protect yourself and your family.
For more information or to hear more about IMSL’s services, get in touch.
