Understanding the Role of Social Media Data in Digital Executive Protection (DEP)

In my previous blog, we covered the importance of a comprehensive strategy for Digital Executive Protection (DEP) that goes beyond Personally Identifiable Information (PII) removal. In this second blog in the series, I want to address the role of social media data in DEP and how a comprehensive DEP strategy must include social media review, removal and education about best practices.

Digital executive protection (DEP) is often seen as the sister of physical executive protection (EP). DEP provides a massive amount of wealth to traditional EP teams by highlighting vulnerabilities that would otherwise be unknown. Through a solid DEP strategy, Chief Security Officers and other responsible for the safety and security can fill in any digital risks that could impact the executive through their online presence. But its beyond just their Personally Identifiable Information (PII). Finding digital breadcrumbs (and removing them) is where the investigator mindset really gets to flourish.

Physical threat is typically the common reason why people take part in DEP. This is done so proactively and reactively; however, we would always love to be ahead of and possibly prevent any potential issues in this area. But that's not always the case.

Steps to Helping Executives Feel "Normal" Through Digital Executive Protection

Let's say an executive's PII was mitigated from being disclosed. That's great, until you realized it isn't. Again, PII from third party data brokers is step one, and removing it from any other available source is step two. When we are talking physical threats, especially for those individuals that feel the need to have an executive protection team, a threat actor doesn't need to know where someone lives. Knowing where they are going to be is just as good. Below are a few very common occurrences.

• You or your spouse/significant other are involved in local/community organizations

• You or your spouse/significant other hunt, fish, are in a local boat club, ski club, play bar league, softball (you get the idea here)

• You or your spouse have local business entities or ventures

• You have children. Those children are in sports, dance, clubs, or scouts. It doesn't matter if they are 8 or 18 years old, organizations and schools post about their participants all the time on their websites and social media. College? Same thing, even more of an issue if they are pledging Greek life or in rush week. Most of the houses require pledges to promote their house on social media.

I think you understand the point I’m trying to make here. You don't need to find someone at their home. Finding where someone is going to be is as simple as finding an organization or group that posts about or references you or your children. Their schedule of where they (and you most likely) are going to be is handed up on a digital silver platter. Sports schedules, dance recitals, troop meetings are all things that cannot be hidden.

Social Media's Impact on Digital Executive Protection

Let's nerd out slightly on the social media side of DEP. As part of the process at Hetherington Group, we look for any and all social media profiles for everyone that is part of our Digital Vulnerability Program. We do so in a public capacity in order to see what is out there. What can a random person who wants to do harm see about the person through the social media account? We flag any posts that may allude to where someone lives, what kind of car they drive, and anything else that could show where someone resides or what they drive. We also look for forecasting where someone MIGHT be and also if they divulge where they dine, shop, vacation. This type of online information is an absolute need to know for EP teams. As part of the executive level of service Hg provides is guidance on what to do about these posts and profiles, however the onus is on the program participant to take any type of action to reduce this exposure.

Remember, 15 years in OSINT, an investigator mindset, you get the idea here. A light bulb went off not so long ago when the team was talking about up-and-coming vulnerabilities, attack surface, and exposures. In past articles I've written about network analysis, I never thought about its use as a way to exploit vulnerabilities to find someone. After some conversations with other experts, I don't think this industry has either. Even if the main enrollee in our Digital Vulnerability Program doesn't have social media, their significant other and kids probably do.

That exact scenario is what you will see below. This is a real-world example where an enrollee (business executive) had zero social media. ZERO. His wife and three children did however, and this is a treasure trove of information. It doesn't matter one bit if they have 100,000 posts combined that gave absolutely nothing away about where they live, where they might be, where they go to school, etc., because who they all collectively follow tells me plenty about them and the executive.

• All four family members follow a local clothing store, a local school and club volleyball coach, another family member, and the boyfriend of one of the children.

• All three children follow 29 of the same accounts, most of which are local individuals or people that are in their social circle.

• The various combinations of Mrs. Executive and two of the children are a local NPO, the COO of Mrs. Executives own company, and more local individuals.

This right here is what we mean by an Executive level of protection. Getting this deep, this granular, this detailed, is what separates PII removal companies from those that provide real DEP. This type of insight allows those enrolled in the digital executive protection program to have in-depth information at hand and hopefully make some changes as a result. In the event they do not however, telling a teenage kid to make their socials private or stop posting can be a losing battle! But this level of detail in the hands of an EP team is equally as valuable.