Person & Social OSINT#

The same techniques that profile a person will show you what the internet already knows about you. Learn both halves — and practise only on yourself.

⏱ ~10 min read · ~25 min hands-on 🔗 needs: OSINT — Infrastructure & Records · Legal & Ethical Scraping

Week 6 scoped OSINT to domains, certificates, and corporate records. This page covers the part aimed at people — because you cannot defend against a technique you don’t understand, and because as a data scientist you will be handed personal datasets and asked what’s safe to publish.

⚖️ Read this before anything else on the page.

• Every exercise here targets you. Your own accounts, your own photos, your own footprint. Not a classmate, not an ex, not a public figure, not “just to see if it works.”
• Aggregation is the harm. Each fact may be public; assembling them into a dossier creates a capability that didn’t exist before. Courts and regulators treat the compilation, not the components.
• Profiling a person without a lawful basis breaches GDPR and India’s DPDP Act — and stalking/harassment laws apply regardless of how public the data was. Clearview’s €20M fines came from scraping public photos.
• This is not a graded assignment on real people. If work requires it, you need a written brief, a defined question, and your instructor’s sign-off.

Try it in 25 minutes — a self-OSINT audit#

Do exactly what an investigator would do, with yourself as the target. Most students find something they’d rather remove.

1. Username reach. Pick a handle you’ve used for years. WhatsMyName checks it across hundreds of sites. Reused handles are the single strongest link between otherwise-separate identities.

2. Email exposure. Check your addresses on Have I Been Pwned. Each breach reveals which services you hold accounts with — and old breaches often carry passwords you may still be reusing.

3. Your own photo metadata. Phone photos frequently embed GPS coordinates:

# /// script
# requires-python = ">=3.12"
# dependencies = ["pillow>=10.0"]
# ///
"""Show what your own photos reveal. Run it on a photo from your phone.

Run:  uv run my_exif.py photo.jpg
"""

import sys

from PIL import Image, ExifTags

img = Image.open(sys.argv[1] if len(sys.argv) > 1 else "photo.jpg")
exif = img.getexif()

for tag_id, value in exif.items():
    print(f"{ExifTags.TAGS.get(tag_id, tag_id):25} {value}")

gps = exif.get_ifd(ExifTags.IFD.GPSInfo)
if gps:
    print("\n⚠️  GPS DATA PRESENT:")
    for tag_id, value in gps.items():
        print(f"  {ExifTags.GPSTAGS.get(tag_id, tag_id):22} {value}")
    print("  → These are coordinates. Strip them before you post.")
else:
    print("\n✅ No GPS in EXIF.")

4. Search yourself. "Your Name" site:linkedin.com, your name + your city, your phone number in quotes. Note what a stranger could assemble in ten minutes.

✅ You now have your own exposure report — and a to-do list.

The technique categories#

The lesson underneath: correlation is the attack. No single item is sensitive. Handle + breach + a geotagged photo + an employer is a complete picture of a person’s life.

flowchart LR
    U["Reused username"] --> C["Correlate accounts"]
    E["Email in a breach"] --> C
    P["Geotagged photo"] --> C
    S["Public social graph"] --> C
    C --> D["Aggregated profile<br/>— the actual harm"]
    D -.->|"Defences: unique handles, EXIF stripping,<br/>locked graphs, broker opt-outs"| X["Much weaker picture"]

What this means for your data work#

You will be handed datasets containing people. Carry three habits across:

• Data minimisation. Collect only fields your defined question needs. “It might be useful later” is how leaks happen.
• Re-identification is easier than it looks. Removing names isn’t anonymisation; a handful of quasi-identifiers (postcode, birth date, gender) frequently re-identifies individuals. Aggregate, generalise, or don’t publish.
• Redact before sharing. Strip personal columns from notebooks, screenshots, and sample data before they go in a repo or a slide.

When it fails#

Your turn (≈25 min)#

1. Complete the four self-audit steps above.
2. Write an exposure report on yourself: what’s findable, how it correlates, and your confidence in each item.
3. Take three concrete actions — strip EXIF from a photo you posted, change a reused handle, enable HIBP alerts, or file one broker opt-out.
4. Write one paragraph: if you were handed a scraped dataset of 10,000 real people, what would you check before doing anything with it?
5. Delete anything you gathered when you’re done.

Checklist#

• I understand that aggregation — not any single fact — is the harm.
• I audited my own footprint and reduced it.
• I know EXIF can carry GPS, and I strip it before posting.
• I corroborate identity claims across independent sources and state confidence.
• I apply data minimisation and know pseudonymisation ≠ anonymisation.
• I never run these techniques against another person without a written, lawful basis.

Go deeper#

• Have I Been Pwned — breach exposure and alerts for your addresses.
• WhatsMyName — username enumeration, and a lesson in handle reuse.
• OSINT Framework — a map of the tooling landscape.
• India’s DPDP Act and GDPR — the rules that govern all of the above.