Remember the debate about eBay port scanning visitors?
Turns out this was about ThreatMetrix, a fraud/identity analytics firm. The CIA was an early investor. Now owned by a massive data broker. FB and thousands of other companies are sending data to them. blog.nem.ec/2020/05/24/eba…
Turns out this was about ThreatMetrix, a fraud/identity analytics firm. The CIA was an early investor. Now owned by a massive data broker. FB and thousands of other companies are sending data to them. blog.nem.ec/2020/05/24/eba…
ThreatMetrix is owned by LexisNexis Risk Solutions / RELX.
Together, they claim to have data on hundreds of millions of people including names, addresses, phone numbers, email addresses, insurance records, criminal records and data on 4.5 billion devices.
relx.com/~/media/Files/…
Together, they claim to have data on hundreds of millions of people including names, addresses, phone numbers, email addresses, insurance records, criminal records and data on 4.5 billion devices.
relx.com/~/media/Files/…
I wrote about LexisNexis in 2016 (crackedlabs.org/dl/Christl_Spi…), about ThreatMetrix in 2017 (crackedlabs.org/dl/CrackedLabs…).
Many companies are harvesting data for marketing and advertising. Data collection for risk/fraud/identity stuff is even more pervasive, secretive and unaccountable.
Many companies are harvesting data for marketing and advertising. Data collection for risk/fraud/identity stuff is even more pervasive, secretive and unaccountable.
ThreatMetrix is everywhere. Most likely, you're sending data to them every day when using digital services or conducting financial transactions.
They ingest data on 1.4bn people, their devices and behaviors in 185 countries.
Basically, it's a global mass surveillance system.
They ingest data on 1.4bn people, their devices and behaviors in 185 countries.
Basically, it's a global mass surveillance system.
Identity verification, fraud detection and cybersecurity can make sense, of course.
But they maintain incredibly powerful data, calculate opaque 'reputation' and 'trust' scores that affect people's lives every day, and they operate without oversight and very much in the dark.
But they maintain incredibly powerful data, calculate opaque 'reputation' and 'trust' scores that affect people's lives every day, and they operate without oversight and very much in the dark.
In addition to maintaining a private population registry, constantly screening people in the commercial sphere, providing data, analytics and scores to insurers, landlords and employers, LexisNexis (and ThreatMetrix) are closely linked to US law enforcement and national security.
"ThreatMetrix provides government with the ability to harness intelligence related to devices, locations, identities and past behaviors ... in order to distinguish between trusted and fraudulent behavior. It connects online and offline identities ..."
risk.lexisnexis.com/-/media/files/…
risk.lexisnexis.com/-/media/files/…
"ThreatMetrix Digital Identity Network outputs the LexID Digital identifier for each citizen (currently over 1.4 billion) by analyzing the innumerable connections between devices, locations, past behaviors..."
...a personal pseudonymous (not 'anonymous') ID for each 'citizen'.
...a personal pseudonymous (not 'anonymous') ID for each 'citizen'.
Sometimes they claim to use 'anonymous' or 'anonymized' data, but this is not true.
They link all kinds of pseudonymous personal IDs to each other.
They used hashed IDs, but that doesn't matter. They can still link online behavior to their 'Lex ID', and thus to everything else.
They link all kinds of pseudonymous personal IDs to each other.
They used hashed IDs, but that doesn't matter. They can still link online behavior to their 'Lex ID', and thus to everything else.
Who else is sending all kinds of personal information to ThreatMetrix and LexisNexis Risk?
For example, PayPal.
"Please note that data disclosed to these agencies may be retained by the ... agency for audit and fraud prevention purposes"
paypal.com/ie/webapps/mpp…
For example, PayPal.
"Please note that data disclosed to these agencies may be retained by the ... agency for audit and fraud prevention purposes"
paypal.com/ie/webapps/mpp…
LexisNexis Risk Solutions, owned by British RELX group, has long been focusing on data on the US population. ThreatMetrix also emerged in the US, but seems to be everywhere now.
From a EU perspective, I'm wondering whether this is GDPR compliant in every sense. I doubt it is.
From a EU perspective, I'm wondering whether this is GDPR compliant in every sense. I doubt it is.
The GDPR provides ways to process data based on so-called 'legitimate interests'. Purposes such as 'network security' or 'fraud prevention' make it easier to argue that those interests outweigh the violation of rights+freedoms of data subjects. But this is not at all a free pass.
"ThreatMetrix device ID is globally unique and persistent; every company will see the same device ID for the same computer"
"ThreatMetrix uses native device attributes for matching—not hashes created from attributes"
Some details about data processing:
pymnts.com/assets/Uploads…
"ThreatMetrix uses native device attributes for matching—not hashes created from attributes"
Some details about data processing:
pymnts.com/assets/Uploads…
This $1.5m contract for 'statewide personal information research databases' contains many details about the data LexisNexis sells.
LexID, a unique personal identifier for every person (which is also linked to ThreatMetrix data), can be queried+retrieved.
michigan.gov/documents/dtmb…
LexID, a unique personal identifier for every person (which is also linked to ThreatMetrix data), can be queried+retrieved.
michigan.gov/documents/dtmb…
Oh my, and I missed that LexisNexis Risk also acquired ID Analytics in January.
...another data broker focusing on identity, fraud and credit data that claims to operate 'one of the nation’s largest networks of cross-industry consumer behavioral data': risk.lexisnexis.com/about-us/press…
...another data broker focusing on identity, fraud and credit data that claims to operate 'one of the nation’s largest networks of cross-industry consumer behavioral data': risk.lexisnexis.com/about-us/press…
Did you know that Symantec, the antivirus vendor, owned ID Analytics, a data broker and credit rating company from 2016 until 2020?
Now, LexisNexis Risk Solutions acquired it.
I wrote about ID Analytics back in 2016 and 2017, too:
crackedlabs.org/dl/Christl_Spi…
crackedlabs.org/dl/CrackedLabs…
Now, LexisNexis Risk Solutions acquired it.
I wrote about ID Analytics back in 2016 and 2017, too:
crackedlabs.org/dl/Christl_Spi…
crackedlabs.org/dl/CrackedLabs…
ID Analytics claims to have data on 300m people, on "credit card and wireless phone applications ...sub-prime loans and eCommerce transactions", plus device data, names, postal/email addresses, SSNs and more.
web.archive.org/web/2017061013…
idanalytics.com/media/Fraud-ID…
idanalytics.com/media/Fraud-ID…
web.archive.org/web/2017061013…
idanalytics.com/media/Fraud-ID…
idanalytics.com/media/Fraud-ID…
Oh, here's another massive data company acquired by LexisNexis in Feb 2020:
Emailage calculates risk scores for 40 million email addresses globally, 'connected to IP addresses, domain names, phone numbers' and '200+ data elements'.
emailage.com/email-risk-sco…
emailage.com/wp-content/upl…
Emailage calculates risk scores for 40 million email addresses globally, 'connected to IP addresses, domain names, phone numbers' and '200+ data elements'.
emailage.com/email-risk-sco…
emailage.com/wp-content/upl…
The problem is, as soon as I start digging, it's like diving in a never-ending rabbit hole 😬
tl;tr Risk data companies are monitoring billions of digital transactions every day, often linked to offline identity/credit data, for multi-purpose use. This needs much more scrutiny.
tl;tr Risk data companies are monitoring billions of digital transactions every day, often linked to offline identity/credit data, for multi-purpose use. This needs much more scrutiny.
