 Welcome everyone if you're here for I hope you're here for building Google for criminal enterprises if not feel free to go If you don't know what that is never use internet my name's Anthony Russell, and you can reach me at dotnet Russell. That's a Twitter handle There's my Twitter Twitter profile my blog I usually don't like to do in-depth speaking or in-depth about me profiles because no one cares Things we're gonna cover today How and why this project was started? What I how I define public data and where you can find it how we can scrape some public data and how we can scrape some social media data And then how to link those together Who cares about this and why and what would I do to fix it? And I also have a tool that I'm releasing today that I put on GitHub this morning, so you'll be able to download it So here's the disclaimer We're gonna be looking at some sensitive information today I would appreciate it if you did not harass the people that are in my slides. I'm using real information. These are straight from the tool They don't deserve to be harassed And I don't contone. I don't condone doing illegal things with this information my material or my research That said Everything that's in here is public information. It's been put out by these people It's been put out either by them or by the government on their behalf And If I were to redact this information from my slides I feel like it wouldn't have the impact that I intended originally when I started this project I wrestled with this for quite some time about releasing this tool and this information Because I don't want somebody to get hurt based on it But if we want things to change We really want things to change then we need to we need to put this out there We need to show people what what can really be done and on that note like this is just the beginning This is just scratching the surface This is stuff that I put together in my free time, you know if you're a nation state or something that really wants to do harm You could really do a lot with this Also, I talked to an attorney. So don't sue me, bro All right, so why this project? so about Six or seven months ago. I started looking into Being able to have a public profile. I like to do public speaking at different conferences I want to be able to have a public profile For conferences and for a living resume for work I'm sure a lot of you professionals like to have your resume online. So other companies might be able to find it But that's a challenge because you know, I don't want my data rated. So You know, how do you keep a public profile without? How do you keep a public profile without you know putting too much out there? So as we spoke about before I got started, I'm a you know, I'm an OIF fit I like to take challenges head-on. So I wasn't about to you know, just just let this go So some of the things I started to do to try make myself private on the web was I opted out of all the things like everything I could find I look for an opt-out page All the big data farms like everything and tell us this all that stuff I actually cut those slides out here because I could have gone on for like three or four slides on things I've opted out of if you go on the github it has all the links in there in the slide deck You can just click them and opt out yourself. I Scrubbed my social media But unfortunately even after you scrub it they still hold on to that information You might not be visible to your friends and it might not be visible to my tool But it's still out there. So what I had so what I decided to do is I decided to muddy the water a little bit I put a fake name. I said I was born in 1901 said I was a girl You know you just change everything and then eventually that muddies the water and they don't know what's real I scrubbed all my old email accounts against Have I been pwned have you guys seen that site sure a lot of you have I put it that in there See if any of my old emails were released at all. I got rid of old ones. I Registered for the do not call list. I went through my phone and uninstalled every app that Required any weird wonky permissions. So there's really that's pretty sanitized at this point By the way, if you use the Facebook or Twitter app or the Facebook messenger, that's like giving them access to your whole phone And then I also researched cleanup services. There's a lot of those on the web and they're all garbage. Don't use them so I opted out of all the things and Unfortunately, it didn't work like six months later. I'm still getting dick enhancement pills So it's like it doesn't doesn't work. Don't waste your time Yeah, both. Yeah. Yes, the pills do not work. Stay away from those So I figured, you know, maybe I needed a different approach And then I got this idea. I said, you know, maybe if I build a tool that does what they do But abuses the data instead of selling it for profit because that's what a lot of them do then maybe we can fix this problem So that's when I started my search for public data So public data as I define it is data that can be made public either by the local or state or federal governments data that can be collected from social media such as Twitter or LinkedIn and Facebook and Data that can be collected from APIs like the people API is anybody familiar with the people API sure if you're in this room, somebody probably familiar with it It's a it's a really nice tool they actually they recently changed their API used to be able to use sample underscore key to get everything and in the last week they updated their API to where you have to actually do a CAPTCHA and register a key Or to get a new key on its IP based but unfortunately for them you can just create a fake email account through like Yandex and register and get 30 free trials and you could just do that all day so Sucks they they they want off a free trial, but it doesn't really work So government data as I define it here's some here's some of the sources that I looked at I looked at the voter database There's quite a bit in here full name data birth current address party affiliation There's actually 99 about 99 columns. I put 99 in there. I think that's what I counted There could be more or less by a few property records so if you buy a house or Yeah, basically if you buy a house In at least in Ohio all that information is public. I'm sure it's the same in most states Traffic violations if you get a ticket your your information is out there full name date of birth current address you can just go to the county website and research traffic violations Register your pet. I don't know I have a dog and I I don't feel like just because I have a dog my information should be out there, but apparently it is and Car registration I put a question mark next to this I'm hoping somebody that watches this can help me. I bought a car earlier this year and You know, I'm super conscious about what information I let out there and what I sign up for I didn't sign up for anything and I started getting a ton of stuff with my exact car make a model in the mail So there must be some type of yeah, oh is that what it is? Okay, so yeah, there's some some public source out there that that people are able to scrape and then offer you You know shitty fake warranties I would love to incorporate something like that in the future, but I couldn't figure that one out So I left it out. These are the ones I didn't use in my tool I didn't use the property records traffic violations or pet registration mainly because one I had all that information that they offered other than the specifics of the traffic violation in in the voter database already and two because all of these are Very specific to the county So I would have to write a tool that would scrape every county site individually and I didn't want the state You know ishing their pants that I was scraping every county site So I ended up going to the Ohio voter registration database So from I spoke with the Secretary of State CIO and he told me that these are That it's a common format across all states So theoretically if you had another state in New York, you know, Nevada, whatever And you were able to download their database it would work in my tool So I just used Ohio because it made it super easy and they let you download Six and a half million records. In fact, I downloaded the six and a half million a few months ago They update this every week. So this is constantly updated With new people that register and stuff. So that's kind of scary. But yeah, I'll have the links at the I'll have the links in a blog post afterwards. If you guys want to get the links for that It's also in the tool Here's an example of some of the data that's in the voter database So you get voter ID county number county ID first last middle date of birth registration date voter status all types of stuff There's a lot of fun things you can do with just the database You can search for young people near me and then filter out young women and then be a predator or you can search for elderly people for me and You know go around and fish there, you know, Social Security checks out of their mailbox I know that's been a problem for a while. So just with the voter database, you can do that kind of stuff I I don't condone that but you know, that's what they're putting out there. So now that we have our seed data We could start getting the personal data Some of these sources of personal data that I looked at was Facebook which offers a slew of things interest current city State original city and state relationships degree in schools attended and jobs Twitter I tried to find a way to correlate to this. I really did but It's like people put I put random shit on there. I don't use my real name half the time. So like current thoughts. I don't know LinkedIn I that's a wealth of information. I'm actually gonna write a plug-in for that I just didn't have time to do it for Def Con. I'll have it done for Derby con The people API it's everything if you've seen the people API, you know that if not it has like phone numbers I'll demonstrate it here in a minute. It has phone numbers and Relationships and every address you've lived at every name every alias you've gone by And then Instagram, you know, I didn't incorporate Instagram, but in some of my early research I actually I did it in a blog post. I was able to abstract some detailed information about a target just from Instagram Based on like where they like to go shop and where they like to eat and some of the social Activities they're involved in like jazz band and soccer and where they played at just based on Instagram. So That's also a great target So now we're gonna look into scraping Facebook a Couple things to know about scraping Facebook is one it is a violation of their terms of service So if you get caught doing it, they will ban you they didn't ban me yet, but I'm using a fake profile. So Good luck And then also their data comes back when you try and scrape it They do some things to try and I'm sure it wasn't to try and mitigate people scraping Maybe it was but they do some things that that make it a little more difficult to scrape Does anybody know what Ajax is? I don't know if we have any developers any engineers in the room So Ajax will it kind of speeds up the way the page loads. It's like a trick to the eye So the page will load and it'll be a container and then as that container loads It'll go out and make another request for the actual data. So if you're trying to scrape I a lot of tools will just get you that container and you won't get the actual data. So It makes it a little more challenging, but I found ways around it. It's not too hard Facebook elements can be scraped by focusing on automation strings. Does anybody know what an automation string is? so Facebook like any other big company they want to be able to test their software So they put these little ID tags on every element and then they're able to write other programs that look through the page for those IDs and Then they can put in fake data or put in real data and they can check values And they leave that in their production environment So we're able to use that to scrape with we can say go get me all of the Info fields and you can get their work, you know where they work and their education and all that stuff And that's that's the technique. I'm going to show here in a second Also, I use multi-pass scraping it makes a little bit easier. So I'll go through it multiple times So one thing to note real quick about Facebook is this query right here search people and then the little cue is the as the query um so On authenticated I've only noticed that you'll get prompted with a capture once it may be more than that I've run this thousands and thousands of times If you're authenticated though, you can run this endlessly without a capture ever So if you create a fake Facebook account, you can just run this query over and over and over and again And what's fun about it is I can search for John Smith in Ohio and it'll go get me everybody in Ohio that their Name is John Smith It works really well So here's an example of that This is what it'll return and what the tool does and what we want to do is we want to get the links out of here Because obviously the names are hyperlinks. So we want to grab those So how do we do that? Well, uh These are the tools that I tried to do that with I tried using curl and w get and links Because I really didn't want to write this in Uh in anything that I couldn't run in the terminal, but unfortunately that didn't happen Um I tried the wpf web browser It wasn't very uh, it was limited on function calls So I ended up going with the windforms browser Fun thing about windforms browser. It has a memory link in the a memory leak in the uh You know when you have your browser open you have the back button Well, it keeps it keeps a log of everything that you've done Well, when you uh navigate like 10,000 times that back button doesn't empty out ever like the the history cache Doesn't ever empty out and it took me forever to figure this out But yeah, there's a memory leak in there So what I had to do was I wrote a separate application that all it did was take a url As a command parameter and then it dumped the source out and then in my application I just spin up one instance of it Get the source and then close it and then that kind of solved the memory leak issue But they're never going to fix that so that was my work around Um, here's an example. Does anybody know what a regex is? Regexes are kind of like magic You really shouldn't use them for web scraping, but you know, why not it's a hacker conference So, uh, this is a really basic example of the regex that I use over and over and over again. I am not a regex pro um I I really not a regex pro not at all, uh, but This is the example. So there's three parts to it. I use a positive look behind Which I'll show you what each of these mean in here in a second. I use a positive look behind I match zero tone limited with uh, and I make it lazy So it grabs just the minimum amount and then I use a positive look ahead And uh, this is what it actually looks like. So this is the positive look behind And you see that pink little dot right there That's saying that okay, this is this is where we're gonna we're gonna start And then when we add in the uh, period asterisk it grabs everything to the end of the line And then I add a question mark and it makes it lazy so it grabs as few as possible And then I add the positive look ahead Which you can't see it, but it's marking the end there by the uh, less than symbol and the forward slash So what ultimately what that does that regex will do is it'll go through and everything that matches that regex It'll grab me the text for it So that's how I use to get uh, actually all the information Here's an example of how I grabbed the uh, the urls off of the search the query page um So I use the I I'm not going to go too deep into this because it's it's kind of crazy, but uh, right here You can see the data test id This is something they would use to be testing with I'm guessing this is their automation id I don't know maybe not, uh, but it was unique. So I use that And uh as it grabs the center part right here You can see there's the data test id surf result. This is actually this is the real code um And then you know, I look for div a href So div a href and then it that would be where the pink line is right there So this is the target information. This is what I want to grab off of a profile And I mean if I'm doing this with an unknown amount of profiles for unknown people you got to use regex So I use something uh, I I like to refer to as multi pass reg scraping so I'll grab all the source and then I'll get chunks out of what I want And then I'll run regex's over those chunks So I use three passes to get the uh to get the profile information. This is like Where the person worked and where they studied and things like that um So real quick. Here's the first pass the first pass will get everything in blue now the blue is Um, this is each of those blocks. So you can see the first one says it's their high school And the second one says it's the electronic classroom tomorrow and the third one is it's probably their their location where they're from And that's ultimately what I want to get so right now. I have the blue blue chunks So then we run another regex over it and this regex cuts it down even more And as you can see we still have our data in here that we're trying to abstract But we have a lot less. So this is the second chunk that we have now And then finally in the last chunk. It's real easy. We just look for the uh Let's see we look for the uh greater than symbol right there And there's only one greater greater than symbol in the chunk. So it's easy to grab the data And then I add that to a list in the application and we can use that for analysis So now that we have it let's start analyzing it and figuring out if we have our target um So I i'm going to use a different example. This is actually a full example. Uh, and this is real data. So please don't harass this person uh So i'm going to use a result from the voter database Uh, and then i'm going to look at a series of facebook profiles that could possibly be that person and we're going to try and Match them up to find the actual person Uh, so this is our target. Uh, her name is Samantha Adkins. She's 18. She's from lakewood, ohio Um, I got this just by querying for 18 year olds in lakewood and I found one on a street Uh, there were a number of results, but you can do this in any city and you should be able to do this with any state Uh, and then I ran that query our facebook query for Samantha. Atkins the plus symbols are just spaces A lot of devs know that but if you're not a dev, that's all it is. It's just a space you can use I think you can use percent 20 in this too. I think that'll work. Um, it should But these are the results we got Uh, each of these is a profile that we scraped off the page using those regexes All right And now we want to dig into the each of those profiles and we want to see if that's our person So we got to scrape the details off. So we're assuming we're scraping the details off. Uh, this is Actually kind of super arbitrary. I don't know if you did anybody read the uh, 2600 article I wrote I Yeah, okay, so the uh This is super arbitrary. All right. I just uh, I messed with the scores until I got back really good results So if somebody way smarter than me, which is probably everybody Uh, can come up with something better. Please let me know I would love to actually have like a really good algorithm for this But um I look at the profile and I say, okay if the first name exists they get point point one five the last name exists they get point one five and then One of these three cases down here will be true either they'll the city and state will be found and they'll get point seven Or just the state is found they get point one or just the city is found and they get point four And then that builds a confidence score And we're able to identify targets with it So as you can see all those profiles we have point four one point four one four two Four three and then one point zero two So that is a really strong match And if we look at it, um, you can see that Samantha Atkins from Lakewood, Ohio And this is very likely our target So, um, based on this, what do we know about our target now? So we have her full legal name. We have her home address. We have her date of birth We have photos of her. We know her interests. We have a relationship status. We know who her her partner is Uh, and a slew of other information Uh, but we can actually do more than that. We can do a lot more. Uh, that was a simple example That was something that that was originally what I wanted to demo as my project But then I started thinking, you know, like a bad guy and I said, well You know, what if I really wanted to do damage with this? Um, it's one thing to be able to walk down the road and say, oh, yeah, you know, so-and-so lives there but you know, what if uh We started with facebook and used their search tools and then work backwards and try and resolve You know people that way So, you know, what if we search for people that work for things like the usps Or the cleven police department Or the cleven fire department or the peri nuclear power plant Or the ohio national guard or one of other one of another million, you know, possible You know, uh places that people would probably not want you to know they lived and So I'm going to demo a tool that I've been working on. Uh, it's it's definitely not a final tool yet I'm going to keep working on it. Um, but Let's see here. You probably won't be able to see some of the text. It's okay. That's not important Um, the first thing I'm going to demo is the uh the database searching So with this, uh This is just I mean, it's it's just a interface to the database I'm going to search for uh people that were born after 1998 Uh, we're going to choose a street here All right, I'm going to hit search and hopefully it works. Um I have videos if it doesn't work. Don't worry. Uh The wi-fi is kind of wonky. So what it's doing is it's searching a database that I have recreated in azure on I downloaded it from the ohio Secretary of state website and uh, as you see here, we get a number of results Uh, and these are all people that are uh right around 18 that live on um That live on Clifton and lakewood, ohio So, uh, I pulled I made a couple notes here because I didn't want to accidentally show like miners and things. So Uh, I'm going to use uh julia alvarez here. Let's try her So this is the application opening up spawning a browser and now it's searching facebook Uh, there must be two profiles that came back And as you can see julia alvarez came back with a score of 1.04 And if we visit the page That's julia alvarez from lakewood, ohio lakewood high school So we have all this information and uh in a matter of seconds We've managed to find an 18 year old that lives on a street could be your street And we know their personal information. Uh, we have a facebook link to it So that was originally what the project was about but then I would you know, that was kind of easy to do So I wanted to go a little bit further So, uh, this is you probably if anybody uses facebook, you'll recognize this is the find friends page I just embedded it right in my application and you'll notice over here on the right. They have the search for friends um The search for friends search criteria. So i'm going to search for something like Perry nuclear power If you don't know peri nuclear power plant is a nuclear power plant in the state of ohio And People register it as their workplace That's critical infrastructure. Uh, peri nuclear power plants have been in the news recently as targets of opportunity for foreign agents For fishing campaigns trying to get credentials identity theft a number of other things So, uh I've got my results here. I'm going to click this button up here at the top That says click here to import into aloha mora And we get this result back. So these are all the people over here on the left And uh, we can just uh, let's choose this guy And let's scrape his facebook information So that pulls down his facebook information jason weeks from ashtable, ohio And it's a little broken. So a quick story about the jobs thing up here I was trying to actually break down the different Details confidently like what they were and I had the bright idea to use the idea of the image because If you look at the facebook profile Like we can open it up here and I can take a look. So if we look at uh, jason weeks profile here You can see the little suitcase. I said, oh, well those images are probably unique I wonder if I could just use the idea of those images and know that what's in that column is a job But it keeps breaking. I think they're changing the IDs randomly every so often So I have to figure out a way around that but the good news is we still have all the details and we can still use it So we just scraped his information. We see that uh, He works at perinuclear power plant. He was in the navy. We see what school we went to we also see his Girlfriend or wife's name his spouse's name We can search the voter database and see if there's any information there on them Uh, and that should bring back a result So as you can see we get his home address now And his age and then I also built in a module for the people api And I tested this morning. So I hope it works. Okay. We get a bunch of results back Uh for the different people now we would have to dig through this. Uh, it depends on the person that you're pulling back Uh, whether or not it's him. I don't think that's him Um, it depends on the person you're you're pulling back on what information you get Uh, this one has been kind of wonky I don't know if people's messing with me or not because I've searched this guy like a million times at this point So I don't know if they're just trying to like Send me back a ton of results. Uh, we can use this lady here. I think she comes back pretty well Uh, this is another one So obviously that's not her that's probably her son, but she also works at perinuclear power plant. Um Yeah, that's her last name. So let's go ahead and search the voter database See if that brings anything back Uh, we can also search the people api and see if anything returns from that But the I guess the the point that i'm trying to make with this is that um So that's probably her right there Yeah, so as you can see she's got a picture of her son in there and um, we can we can definitely abstract some a ton of information Uh Using these methods now like I said, this is just a demo This isn't something that I meant to put in here as a a tool that I want people to go use I'm just trying to highlight a point that With these methods we can build detailed target profiles For phishing campaigns or for identity theft For a number of things that are nefarious So Mr. Shelton here see we get his home address I don't think that's him But we would be able to find him he's in here Yeah, it's not him But the point is we can do it so Let's head back over to the slides really quick All right, so uh, who cares well Uh, I would hope that these people that I presented today care for one. Um, I know that when I was in the military, uh Especially when I was state side. I was a police officer. I did not want Anybody knowing where I lived for obvious reasons, right? You know, if you give somebody a DUI You don't want them to be able to figure out where you live and come firebomb your house That's probably not a good thing Or have your phone numbers and harass you or one of a million scenarios That's just the local stuff. What about the critical infrastructure the nuclear power plant We saw the details we can get from that. I don't want foreign agents being able to fish Critical infrastructure like that shouldn't be a thing But it is Uh, what else, uh, I mean plotting troop movement So we can do that with the national guard and the army. We can figure out where our troops are Figure out where their families live. Uh, does anybody know what frg is? anybody Raise your hand if you know what frg is No one all right I was trying I was trying to weed out the feds. All right frg is family right in this group I I wanted to save this story. So frg is family right in this group when I was in the military They're like a uh, they're like the army spouses that stay back Or the military spouses that stay back I should say And they form together and they they provide information each other and support. They're really great group But when I went overseas, unfortunately, there was an act there was a miscommunication The frg really shouldn't be contacting family and members of soldiers and telling them about Firefights and things Well, we had a firefight and we were on blackout. We weren't able to communicate outside of the base And the frg went and called my family they called my mom and told her there was a blood bath and all this types of stuff And my mom was freaking out and I had no idea, you know us. I and I was on blackout. We were on blackout We couldn't call anybody for weeks so Yeah, you know like it's just It's not a good thing to be able to contact your family of contact the family's soldiers be able to get information I want that information secured um so Uh Who cares about this data? We talked about that, you know predators police or targets Uh, we talked about the nuclear power plant being able to resolve the information. It's not good What would I do about it? Uh, first and foremost, I would plead with facebook. Please for the love of god Why are you making everything public by default when somebody signs up for facebook? It should be private by default. They should have to opt in to make it public I don't know why it's not but that's It is what it is if all they have to do is flip a switch and 99% of this goes away Uh, but you know what? It's not entirely facebook's fault, you know, their business and people often to use it So people should be smart off to make it private Uh, the one thing I really do have a problem with though is the federal government Uh, and the state government's releasing all of our information like that shouldn't be a thing And when I spoke to the uh, cio of the secretary, I'm pretty sure cio. I don't know, uh, secretary of state of ohio He told me that the reason that these things are available are because of outdated laws Uh, the laws are in place that the voter records have to be public So they made them public and they can't just say hey, this is a bad idea We shouldn't do this because it's the law Um, and I I said I empathize with that. I get where he's coming from. I don't blame them They're just doing what they're supposed to do Uh, I do think that we need to change these laws though So, uh, we need to get more word out there that these things are available Also, you know Just because I get a traffic ticket or I buy a house or I buy a car or I License my dog That doesn't mean I'm opting in to have big data be able to farm my government data. Like I don't know why I don't know if the government's doing this willingly and knowingly or unknowingly But they're really selling us out to all these marketing firms Like my my identity should I only get one of them, you know, unless I unless I I'm uh, you know I turn state witness and I get I get in the protection program I only get one identity So it should be my choice and whether or not it gets put out there or not and the government is stripping us of that Uh capability by just releasing this information. Uh, so I definitely think we need to change these laws It's not specific to Ohio. I just use Ohio because that's where I live and I want to pick on them um So here's the summary one you can opt out of the internet if you put it on the internet It's out there. I think that's on a famous shirt somewhere Put it on the internet. It's out there forever. Uh, and it is public um voting Getting tickets owning a dog buying a house things like that. It shouldn't be opting into big data And the law is definitely need to catch up. We need to do this if the people don't say something Um, it's never going to change and that was kind of why I chose to put this information out there and this tool out there The source code is on my github Uh, I really hope that everyone goes and downloads it makes your own modules Uh, go build a linkedin module go build a google module Scrape everything. Uh hack all the things, you know, make it awesome share with me I'll I'll echo it back out and see if I can add more I would really love to collaborate on this. I'm going to continue developing this I'm going to be presenting this again in a few months at derby con. I'm going to be doing a 2.0 So we're going to have even more modules in here right now. It's just facebook and people But I want to get linked in A whole bunch of fun stuff. Uh, that's my blog. I post all types of random tech stuff on there I'm studying for my oscp. So every now you'll see me post vulnhub vm cracks on there and There's my github and my twitter And I'll open the floor for questions. Thank you So, uh, originally I wanted to do it in python, uh, or some language I could do in, uh, Multi-platform, but I ended up opting for c-sharp. Sorry. I'll try and port it one day. We'll see Oh, yeah, I'll be porting it Yeah, I'll I'll be trying to port it. I mean you could run it in mono. It should work. I don't know. We'll see I'll try and I'll try and run it in mono and see if it works. I don't see why it wouldn't Yes So the next step for the research is So the next step for the research is I want to be able to go to starbucks and sit down And uh resolve addresses of people around me based on packet sniffing um, so That's it's an idea. I need more modules Originally, I wanted to do it with facebook because I was hoping that I could abstract their Profile out of the get parameters, but it's all tls. So I don't think that's going to happen There might be other ways. We'll see Yes Yes Yeah, that's a great question. So they uh when I was originally doing my research on privacy and trying to opt out of everything I started with spokio and white pages and all those and worked my way up Um, they're so successful because they're getting all their information from pretty much the same spot. Uh, they're all Buying services from like in telsys. I think I think it's in telsys. I think that's their name Um, they're they're buying their data from big companies like that and those big companies Are going that you can opt out of them, but guess what they're going to the voter database and the traffic Violations they're going to public things that you can't opt out of so eventually you hit a point where there's no more opting out They're taking things they're allowed to take and they're doing connections very similar to what I'm doing. I would imagine So yeah, unfortunately, there's no getting away from it Any other questions? Yes no, so I looked into getting more states, but um I wanted to be I wanted to focus in on it doing as much damage as I could as opposed to collecting as much data This can be applied to every state because the voter database It's the same as far as my understanding. It's the same format for every single state So I use the Ohio database. So in the tool Um, I I put this in here. Uh, I didn't talk about it, but it's in the tool In the settings you can go in here and set like your people api key So if you have like a real people api key like when you pay for you can put it in there Um, you just put your connection string in there For your database. What state you're doing? That's the uh That'll be the state that we look for and then your state or your table name and it'll just kind of all work. What's that? Uh, that's uh, it's a demo key. It's a demo key. I register so whenever I do this demo I go to yandex. I create a fake email and then I go register a people a free account for people It takes like 10 seconds and you get 30. I think it's like 30 Queries for 30 days or 15 days or something like that So you can you can do it over and over and over again if you write a script or a tool to create accounts for you You just get a bunch of accounts, but I didn't go that far Any other questions? Yes Yeah, so um that took some time. Uh, it was totally arbitrary. I don't want anybody to think I'm not a data scientist I'm not a data analyst. I have no idea what I'm doing. I just went in there and I tweaked it until I was getting really confident results and it just worked so I'm sure there are much better ways to do it and if anybody has any ideas Please feel free to reach out to me. I would love to work with you and come up with something that I can say This works because of proof, you know, and uh right now it's I I I ran some some large-scale tests, uh, you know like a thousand two thousand people Which by the way you can do you can just query over and over and over again on facebook forever So I ran some large-scale tests with like everybody in my city And it was probably about 50 to 60 percent accurate if you consider a 80 percent or above's confidence score Or a 0.8 or above. I don't say percent because it's not percent a 0.8 or above is the confidence score It's like a 50 60 70 percent in there Accuracy if you lower that to a 0.7 you get much higher like 80 percent accuracy So yeah, it's I mean, it's definitely a viable means of finding people, but it's probably not the best. Yes That's a great question. Um, I don't know, you know, I'm I'm hoping that Doing talks like this coming to the you know biggest hacker conference in the world and making that making a stink about it I'm hoping that that will that will bring some attention to the problem. I I would love to work with Uh, the state the government, uh, I've reached out to them I I reached out to the uh, the Ohio, um, it department. I told them about this But like I said, they kind of shrug at you. So they're like, it's the law. What do you do? So you have to you have to get it put on the ballot You have to get people to vote it, you know to vote to change it and that's it Oh, yeah, nice You know, it's funny you mentioned that I actually did reach out to some, uh, local news outlets in Ohio And I a lot of news acres. They don't use their real name for obvious reasons They'll use like aliases. So I sent a couple anchors their their target profiles and hope that that would You know get them to respond to me, but it didn't work. So I'll definitely do that though I'm going to continue pushing on this. This is definitely something I believe in. I've believed in it for a while Um, it's a good cause. It just sucks that you know, the way to get the word out there is that you have to kind of You know, you have to drop drop information on people But that's the only person people off is the only way you're going to get anything changed. Otherwise Um, you know, you're going to get people that say Who cares, you know, what's somebody going to do with my my facebook profile, you know, who cares? Well, you know, if you work for a critical infrastructure, then they can use it to fish you, you know target efficient campaigns They know you like the browns, which is really rare But you know, they they know you like, you know, they know you like x y or z You know, so they can they can make very targeted fishing campaigns They saw you posted, you know that you went to starbucks someplace So now they're going to go and try and rip your company's rfid card off of you because they know where you go or It's the the opportunities are limitless Yes I'm not sure. I'm not sure if they are not. I hope they are But at the same time you run I I also empathize with facebook They they have this issue where um, you know, they nothing should be censored, you know They want everything to be free and open and I believe in that Um But at the same time you don't want people posting videos of people getting their heads cut off So like there's a there's a fine line you have to draw and there's a lot of work they have to put into Making the place safe for everyone. So I don't know if they're doing that research. I hope they do We'll see All right. Thank you so much. I appreciate everyone's time. Thank you for coming. Feel free to reach out to me Thank you