I can not recall if another person initially got here up with this saying or if I stated it in some off-the-cuff remark and it simply propagated, however because it’s usually attributed again to me, I will relay it right here regardless:
Making an attempt to delete your self from the web is like making an attempt to take piss out of a swimming pool
Relying on the publication, I will tailor the saying to be both extra broadly palatable or extra, uh, “Australian”, however the sentiment would not change: as soon as information spreads on the web, you’ll be able to by no means put a lid on it. That is necessary within the context of information breaches as a result of it speaks to the immutability of our uncovered private info. It additionally speaks to the restricted practicality of providers that promise to erase your information from the web, and it is the fixed outreach from these organisations on the lookout for advertising alternatives on Have I Been Pwned (HIBP) that is prompted me to put in writing this.
Let’s start with these providers, and since there are such a lot of and I do not wish to throw any of them beneath the bus, I will not identify names. I additionally will not identify them as a result of while they’re slightly assertive of their advertising outreach, I do consider they’re well-intentioned and I do not wish to indicate in any other case. And so they have a job to play; it is simply way more restricted than is represented. The positioning is usually round “information dealer elimination providers”, or “defend my information”, or “take away my info from the web”. You may discover varied firms offering these providers by trying to find these phrases, or you’ll be able to seek for particular organisations… and discover others hijacking the search time period as they pay to market their model in entrance of others. Standard web advertising shadiness, in fact, however IMHO it speaks volumes in regards to the commercialisation of the info elimination enterprise.
These providers all comply with roughly the identical advertising handbook:
Information brokers have your private info, which they could get hold of through each professional and dodgy meansIt could also be used for nefarious functions similar to id theft, stalking, spam and different privateness violationsPay us, and we’ll ask the brokers to take away your information
So let’s undergo these factors one after the other, beginning with the info dealer declare, which is completely appropriate. Your information has worth – “information is the brand new oil” – and there is enterprise in acquiring and promoting it. I’ve handled lots of them personally over time, primarily as a result of they’ve had information breaches. Grasp Deeds in South Africa was huge. Nationwide Public information a few years in the past was many instances bigger. Exactis, Adapt, and lots of others have additionally been added to HIBP over time. To the perfect of my information, they’re legally working providers, even when they could exist on the perimeter of what most of us would think about “a bit dodgy” so far as respecting our private info goes.
Which brings us to the second level about nefarious makes use of. There’s a very broad spectrum of legitimacy throughout information brokers. Let’s decide two extremes so far as the legality of the service goes. On the “very legally working” finish of issues, we’ve Experian, and even for those who do not like what they do, there is no arguing the truth that they’re on the cleaner finish of legitimacy and do present legitimate providers. On the different finish, you might have the likes of LeakedSource (and just about each different service with the phrase “Leak” in its identify) that… effectively… simply Google them. And there are a lot of, many extra at every finish and in all places in between. And loads of it’s totally gray: totally different authorized jurisdictions, totally different technique of acquiring information, and totally different tolerances for adhering to opt-out requests.
But it surely’s the info elimination piece that is the true downside. In the event you pay one of many providers in query to wash you from the web, I’ve little question they will have some extent of success with the legally working providers. These providers will adjust to authorized requests and are adequately geared up to obtain and course of them. However the LeakedSources of the world? Not a lot. And that is the place the rub begins:
Requests to take away private info are solely efficient for providers which can be keen to honour them.
That ought to sound profoundly apparent to anybody studying this now, however it would not actually characteristic whenever you learn the advertising materials on information elimination providers. However I am solely simply warming up…
Think about making an attempt to take away your information from right here:
🚨🇺🇸 ShinyHunters has leaked the info of a number of firms…
🇺🇸 American Tower Company
🇺🇸 JCPenney & subsidiaries beneath Catalyst Manufacturers & Genuine Manufacturers Group
🇺🇸 Madison Sq. Backyard Sports activities Corp.
🇺🇸 Ralph Lauren
🇺🇸 https://t.co/08IaUnp1sx pic.twitter.com/TvqanSTO1Y
— Darkish Net Informer (@DarkWebInformer) June 16, 2026
That is a small snippet of the ShinyHunters web site from a few weeks in the past. On the time of writing, a bunch extra information has been dumped, together with solely about quarter-hour earlier than placing these phrases down within the draft weblog submit. These breaches have impacted tens of tens of millions of individuals, together with my spouse courtesy of her having beforehand shopped at Canada Goose. Now, let’s have a look at the way you go about scrubbing her information from that incident. For all the info dealer elimination providers I will direct to this submit later, how do you do this? Clearly, you’ll be able to’t. The pee is now within the pool, and you are not taking it again out. And it isn’t simply “on the darkish internet” both, their Tor website hyperlinks by way of to a transparent website internet hosting all the info:
And that is just the start. As a result of we’re speaking about digitised information posted publicly, it replicates like loopy. There will probably be tens of hundreds of copies of my spouse’s private information floating round between private stashes, Telegram channels and public hacking boards. That genie is rarely going again within the bottle, not except we’re speaking in regards to the slim scope of a legally working information dealer, which raises one other subject:
What legally working dealer is enriching their corpus from information breaches?! That is simply not the place the professional ones supply information from. The information comes from surveys, exchanges with different providers the place you ticked the field to conform to the phrases and circumstances for exchanging information with “companions”, public enterprise directories, and even arrest data. Authorized providers, authorized sources, authorized processes. In one of many emails from an organization on the lookout for product placement, they described their plan as follows (daring is mine):
a plan which lets you take away your private info from any URL (the place it is authorized) you discover your private info on
So what we’re left with is information elimination providers being efficient for legally working brokers who honour professional requests, while being utterly ineffective towards the worst varieties of web sites that replicate and abuse your information. In different phrases, you could possibly choose out of some advertising materials or content material that is manner too particularly focused to you, however you’ll be able to’t cease the dangerous guys making an attempt to steal your id or extort you as a result of “we caught you watching porn in your PC through the malware we put in”. It is a bit just like the courtroom injunctions being the ideas and prayers of information breach response I wrote about in October: I can not contact the Qantas information breach as a result of I am a law-abiding Australian who is aware of in regards to the injunction, however there’s completely nothing stopping the genuinely dangerous actors from abusing that information.
And therein lies the core of why I do not wish to entertain partnerships with these organisations: not as a result of I disagree with the service or as a result of it’s going to trigger any hurt, slightly as a result of when somebody makes use of HIBP to seek for their electronic mail tackle and finds it within the Canada Gooses of the world, these providers cannot do something about it. They’re merely skimming the leaves off the highest of the pool, and no quantity of skimming goes to take away what everyone knows nonetheless lies beneath.
Safety
Have I Been Pwned
