Ep. 32 | AI Location Tracking on Social Media

AI tools can be used to mark exact locations from a single photo online, even without obvious signs and notable buildings in frame. From the positioning of shadows to the very soil and vegetation present, your pictures can be analyzed in mere seconds to determine precise locations. 

BlackCloak's Cybersecurity and Identity Protection Engineer Amee Baldacini breaks down how these tools track your location, and what you can do to lessen the risk. 

If you're interested in learning more, you can contact BlackCloak here, or visit the BlackCloak website. 

Transcript

SPEAKER_01 0:10

Welcome to Uncloaked, a podcast series brought to you by Black Cloak, the pioneer in digital executive protection and leader in personal concierge cybersecurity. I'm your host, Dan Basco, and today we're talking about the use of AI on social media, particularly its use for geolocation. Joining me today for this discussion is Amy Baldicini, Cybersecurity and Identity Protection Engineer at Black Lok. Amy, thanks uh again so much for being here on the show.

SPEAKER_00 0:40

Absolutely. Thanks, Dan. Thanks for having me back.

SPEAKER_01 0:42

Excited to talk with you once again. And I know you've uh you know had your uh dealings in the past, whether it's with clients or or educating um on social media. There's a lot of best practices when it comes to uh securing your social media, hardening that footprint. And now when we introduce AI into the mix, it's a whole new ball game, right? Um now we're talking about very powerful AI tools that can be used to find your location just from a photo that you post, and it doesn't even have to have a sign in the background or a very clear indication of where you're at. Uh, they're able to assess these photos and uh discover real-time locations, which uh certainly is alarming. So what is the overall, I guess, initial takeaway, I should say, with the advent of some of these tools?

SPEAKER_00 1:38

Yeah, absolutely. Like you said, it is definitely alarming uh to have this going on and you know, something that has been there in the past that people have done, but now we have tools that can do it so much quicker than what it was in the past. It used to be extremely manual, time consuming. It would take maybe law enforcement a couple of days to analyze a photo that now takes maybe 30 minutes max. I'd say probably five minutes max, but 30 minutes to actually verify the information as well. So quite a big deal, especially when you're trying to prevent stalking and doxing and you know, physical breaches, when this is something that is happening so quickly, you you can't necessarily get in front of it as quickly.

SPEAKER_01 2:21

Yeah, absolutely. And great point uh at the beginning there uh about the amount of time that it would take uh law enforcement potentially sometimes to discover uh locations through photos. And that's one great use case of this technology is that it has helped aid law enforcement agencies in investigations and and really now with the uh evolution of this technology, they've been able to be much more efficient and get that information a lot quicker. But conversely, obviously, as we talk about with all things AI, with the good guys have access to it, the same can be said for the threat actors who wish to do harm with it as well. And now that we are talking about a large-scale availability of such tools, and and of course, we we can go down a rabbit hole as well about various uh kits that are available for purchase on the dark web. Here, these uh these tools can be leveraged by cyber criminals to access the high-profile target who's posting on social media routinely. Uh, we also talk about obviously the influencers out there who in some cases are as part of what they're doing, discussing the location they're at, but when they're not, or when you're a celebrity just out to dinner somewhere or walking down the street, now we're talking about you know, targeted individuals being exposed so much more because of this technology. So uh would love to break this down a little bit. There's so many different AI tools that are available that can do this geolocating. What are some of the ways that it can actually pull this off? I know one of them is like the pixel level analysis that they're able to do.

SPEAKER_00 4:05

Yeah, so with some of these applications, there are quite a few different ways that they can go about finding your location in the picture. Like what you said, Dan, the pixelation, um, what can happen with some of these tools now is they just take some pixel information from the background of the picture and they're able to locate you based off of, say, there's a window that matches a specific angle, or this there's a sign that's you know says a street name. Those kind of areas are more manual, but with this automation now, it's able to pull the data from the background based off of all those different features. Now, what it also is looking for is shadows. It seems a bit strange, but do during the the peak location of the moon and the sun and all that fun jazz, the way that your shadow falls can actually tell what time of the year it is, what time of the day it is. Now it also looks at foliage, it looks at trees and what color the leaves are of trees. If trees are red, um and it's that time of the year where yellow, orange, red trees pop out where the leaves are falling, then it can tell that and say, okay, this picture was from this season. Things just basic like that that are now being taken and used in that manner. And there's a couple of different areas that you can start to look at this yourself. It's also like your clothing that you're wearing. Um, if you're wearing clothing that says the name of your school on the shirt, or if there's a street sign in the background that shows your cross sections, things like that that we already put the data into the picture to help. Whereas we can start thinking about that and changing our behaviors up to make that look a little bit uh less easy for them.

SPEAKER_01 5:53

It's wild that we're at a point now where you can have uh a certain type of plant in the backdrop and they're able to route it to a specific location and sometimes even the exact location down to the building on the street, uh, which is um pretty remarkable. Do you feel that this is gaining enough traction in terms of uh awareness out there, or is it still at the early stages where maybe people don't fully grasp the the nature of this or or perhaps how consequential it can be? Because, you know, we're we're talking on several decades now of use on social media. Some people have been using this since the beginning are used to using it the way that they did back in 2004, right? Or 2005 and six, but times have changed, and the way you post photos and the frequency, a lot of that has to be taken into account now.

SPEAKER_00 6:50

Absolutely. Um we still post pictures like we want everyone to see every aspect of our lives every time, all day long. Uh, and and the thing to remember though with those pictures that you're posting is you are giving so much information out there, so much information to the naked eye, but also to AI. Metadata is information within a picture that is available to track your location, the size of the picture, the camera you're using, the megapixels, all of that information is called metadata and it's stuck to your picture. When you transfer these pictures to Facebook, that data stays on the picture. Now, once Facebook gets it, or any other social media gets it, they strip that data from the picture. So if you and I were to go to Facebook right now, copy or download a picture from Facebook, we'll never be able to see necessarily that information. We may just be able to see where it came from, which is Facebook. Now, what this means though is that when Facebook strips that data or any other social media, they're keeping the data. So they have the data now, and they can use it to train their AI machines. So essentially you're giving that data away. So with that, you most people don't realize that that's happening in the background. And you know, most people honestly at some point they just don't care anymore because it's like, look, my information's already out there. What's the big deal about it? But just because something is out there already, that doesn't mean you have to keep doing it. You can protect your future from this point forward instead of looking at it as, well, it's already out there, why not? Well, let's put a stop gap in there and let's just keep going in a future that we don't have that all that data out there.

SPEAKER_01 8:40

Yeah, no, that makes perfect sense. And honestly, too, it's it's an instance where you you know you may have this fatigue uh where it comes to data breaches. We hear about them consistently, and so people can start to get overwhelmed and just you know, uh essentially uh apathetic towards them almost to your point. Even if uh your photos are out there in certain places, that doesn't mean that you can't do some spring cleaning of your own and take them down from you know these sites, uh, potentially if they've been up there for a long time. Yes, they may still be out there, of course. That's the nature of it, but you at least limit one area where it can be found, right? So you can make things, even if it's one percent more difficult to find, that's that's a reason to do it. On top of that, these AI tools, yes, they're being used a lot to find out where people are posting currently, but they can be used on your photos from five, ten, fifteen years ago still as well. And if you've been in the same location, you live in the same place for that amount of time, it's still probably worth it to go back and look and see are these photos really worth, you know, being up and and public facing, especially if you have a public profile, right? So I I think that's a really good point to make.

SPEAKER_00 10:00

Yeah, and I I understand getting those pop-ups of your memories and seeing the pictures that you posted six years ago, and it's like nostalgic, but it's like, do I really need that? I've got these pictures on my phone. I can go back to six years ago and look at these pictures. So, yes, to your point, doing spring cleaning. Absolutely. Go back and get rid of those pictures from 2005 when you very first started using your Facebook. It's easy to go on there and just delete them off. And that way it's one less thing, like you said, that people can use to track you. And the other thing that you can start doing as well to kind of protect yourself from these kind of pixel level analysis, if you will. If you have a picture and you've got everything in the background, right? You're the focal point, but then there's still a ton of what I call blank space around you. What you can do is actually start to narrow in on your face or narrow in on you instead of having all of that extra data around. Even reducing the picture size by 30%, that can actually drop significantly the ability for these kind of websites and applications to do their job. So um doing that, coming in, focusing more on yourself on the picture, and then also if you're in front of a building, do the same thing, do a portrait mode and maybe blur the background, right? And that would make a huge difference too. Um, and then of course, this one's kind of different, but it's a lot of fun. You take the picture that you have and flip it. So just do like a mirroring effect so that way it throws off the AIs as well. So it's a different way to look at your picture, but you're still there, your idea is still there, it's just a little bit different.

SPEAKER_01 11:42

Yeah, there's some really good tips there that anybody can really implement today and and not make it more difficult than it needs to be. Um, I thought it was really interesting that not only can it pick up on plants and stuff, but even the types of soil and things like that. They've they've got their own uh fingerprints there as well. And um obviously other aspects of the environment that you're in. Can you talk a little bit more about that? And I don't know, maybe some tips that could uh even avoid the AI from detecting uh those types of things.

SPEAKER_00 12:19

Yeah, so and that's funny that you bring up the soil and vegetation because that is one that's it's interesting because what happens is these kind of applications, they have this massive, massive database to pull from, including analyzing soil, analyzing vegetation, analyzing, you know, the extra tree in the background that it sees. And is that the only place in the world that tree grows? If not, is this the only species that grows there? Things uh, you know, stuff like that. You could do multiple different things. You can desaturate the background. What that means is you keep yourself in color, but you change or desaturate the background. So change it to black and white. So you're still in color, the background is not. That throws off these systems as well because they can't see the soil color, they can't see the tree color. Um, and you know, they can't necessarily see the shadows in some parts of that. Um, now there's also the sticker method, and I actually do this myself with pictures. You can put a sticker, a smiley face, a cloud, a heart, even you could put a sticker on there that's the you know, just random pieces like a school bus or something like that, where it'll actually cover some of that data and throw off the systems as well.

SPEAKER_01 13:39

It's good, it's good to know that there are some ways to get around this. And of course, you know, we we gotta mention when we're talking about AI and the rapid evolution of this stuff, uh, these may be best practices today that in three months from now, um, they may have gotten around some of these controls. But that's why a lot of what you're talking about here, Amy, is is a lot of universal uh best practices too. So some of these are specific to now, uh, but a lot of these are are good best practices to implement throughout, including, and I I I've heard you say this many times, not posting in real time if you're on vacation and things like that, right? Can you go through some of these uh evergreen uh best tips uh for folks so that um they can also you know stay protected today and tomorrow?

SPEAKER_00 14:26

Right. So, like you said, with AI in three months, things could be completely different. But as of today, some things to keep in mind. When you are traveling, you absolutely do not want to post on Facebook that you are traveling for starters. Um, don't ever post, hey, we're going to Cancun tomorrow, or um, my birthday, my spouse just bought me a trip to XYZ. Never post that online. The reason being is because once you've done that, other people, people with nefarious intent, will know that you're no longer in your home during those times. That could be a prime time for them to attack your home, steal your belongings, or um anything, you know, along along that kind of thought process. Um, additionally, when you are on your vacation, don't post pictures. Don't post anything less than 48 hours. So once you get home from your trip, you can post the pictures. Or 48 hours after you take the picture, post it. But that'll give enough time to change your location. You could be 500 miles away by the time you post that picture and people don't know. Just keeping the information about the trip off and also be conscientious about your friends you're with as well. Because if you're taking pictures of them on the trip and you're posting pictures right away, maybe they don't want that to happen. So just keeping in mind others around you that you're posting pictures of too.

SPEAKER_01 15:54

Yeah, try and be as thoughtful as possible when uh including others in in your postings. That's uh that's a great point. Uh finally, Amy, I know you have some good tips on that metadata that we talked about earlier. So obviously, these AI tools were talking about being able to screen uh these photos without um needing the metadata, but AI is also able to scrape metadata and find uh information a lot quicker that way. So, as a rule of thumb, it's it's probably best for individuals to strip all of that metadata from their phones.

SPEAKER_00 16:30

Yeah, absolutely. So, with the information about this metadata, what I'm I'm hoping for people to uh get from this is let's stop the data before it even gets to the social media platforms. If you're sending in pictures to this social media platform, don't give them more information than they need. So with an iPhone or an iOS device, what you can do is go into the picture and go into your photo apps. You can hit the share icon, you normally do, but go to the options and turn location off. What you can also do is for any picture and any further pictures, you can actually turn the data off completely so you don't have to do it manually each time. What you would do is go into settings, privacy and security, location services, camera, and then switch that to never. Now I know some people that are Android users. So from an Android, say you've got a Samsung Galaxy, you just want to open your gallery app, go to the three dots, swipe up to view the details, hit edit, and then the red minus symbol that's located in the bottom there. Okay, and then make sure that you tap save. What you could also do is there are many different applications out there on both iPhones and Androids that you can download to strip this media data as well. But make sure you read the terms and conditions of those applications prior to downloading them because you could just be giving your data to yet another site. Um, so highly suggest do it with the embedded capabilities of the device first and um look at third-party applications as a last resort.

SPEAKER_01 18:13

Amy, really appreciate the conversation, the insights. It's important, it's sometimes scary, but it's always uh a lot easier when we know the certain actions we can take to stay more protected uh and and safeguard ourselves from some of these threats. So really appreciate you being here today.

SPEAKER_00 18:33

Yeah, absolutely. And and one final thing just to throw in there.

SPEAKER_01 18:37

Absolutely.

SPEAKER_00 18:38

I no longer post pictures of my family, my children on Facebook, on social media. That's for their protection. Give it some thought because one thing that I also have the capability of now is identity protection. Identity protection starts with what information you give out, including the pictures that you've posted on social media. So please be conscientious of what you are posting. You want to continue posting pictures of yourself, that's fine. Just take your family and your children into consideration.

SPEAKER_01 19:07

Excellent. Yes, a very good tip there as well to take into account because we don't know what the threats of tomorrow will hold necessarily. So always good to be prepared. Thanks again, Amy.

SPEAKER_00 19:20

Absolutely, Dan. Have a great rest of your day.

SPEAKER_01 19:23

Likewise. You can listen to all episodes of Uncloaked at blackcloak.io slash podcasts or on your platform of choice. And if you're interested in becoming a member or want to learn more about how to protect your digital life, visit us at blackcloak.io. Thank you for tuning in, and we'll see you next time on Uncloaked.