Most of us have shared holiday snaps or posted pictures from a wedding on social media – how risky could it be? Very, discovers Steve Boggan
When Japanese pop star Ena Matsuoka posted pictures of herself on social media, the intention was to grow a relationship with her fans – and, of course, to become that little bit more famous.
There were images of her out and about, dressing up and lounging in her room at home – exactly the sort of shots any fashion and music obsessed 21-year-old might post every day on Instagram, Facebook or Twitter.
What Ena didn’t realise, however, was that her pictures were being examined in the most terrifying detail by a stalker who would go on to use shadows in her bedroom, the position of curtains on her windows and even a reflection on her eyeball to identify where she lived, follow her home and sexually assault her.
Last month, loner Hibiki Sato, 26, was charged by police in Tokyo over the attack. He told stunned detectives that he had zoomed in on a selfie posted by Ena – a performer with Japanese pop group Tenshi Tsukinukeni Yomi – to identify the reflection of a train station sign on her eye.
Most of us don’t realise how much information we’re giving away each time we post a picture
Then, after waiting for her at the station and following her to her apartment building, he was able to work out exactly which flat was hers by comparing pictures she had taken with images of the building on Google Street View, the free website that has pictures of just about every street and building on the planet.
The case has brought into frightening relief the extent to which innocent pictures could be used for evil purposes. But while detectives were shocked by Sato’s revelations, cybersecurity experts weren’t – they’ve been warning about our photos being used for ‘cyberstalking’ for some time. We just haven’t been listening.
‘Most of us don’t realise how much information we’re giving away about ourselves and our loved ones each time we post a picture on social media,’ says Eliot Higgins, founder of the investigative website Bellingcat.
It was Bellingcat that identified the Russian agents who carried out the Salisbury nerve agent poisoning in 2018, and proved that a Russian missile had downed a Malaysian Airlines passenger jet over eastern Ukraine in 2014, in part by using the same techniques as Sato – a method Higgins, who developed it, calls ‘geolocating’.
This involves taking clues from pictures such as landmarks, road markings, distinctive buildings, shadows – all manner of tiny details – and comparing them with Google Street View or from outer space by using satellite images on Google Earth.
In his tiny office in the Midlands, Higgins gives me a lesson in geolocating by referring to a social-media campaign run by the terror group Isis in May 2016. ‘Isis asked its supporters around the world to post words of encouragement on social media,’ he says. ‘So these supporters – some of them possibly terrorists themselves – wrote messages on pieces of paper, including the city where they lived. The idea was to spread fear among the populations of these cities that Isis was in their midst.’
He shows me one that was posted in Paris and asks: ‘What do you see?’
I see a hand holding a piece of paper above a street that could be anywhere in Paris. Higgins, however, sees the edge of a sign that bears part of a Suzuki logo. He also sees a distinctive restaurant sign and a building covered by green mesh further down the road. He Googles ‘Suzuki Paris’ and one of the results is Google Maps showing the location of each dealership. He then visits them all using Street View and clearly identifies the one on our street.
‘If you rotate Street View around, you can tell which apartment the photograph was taken from,’ he says. ‘The cover of the person’s phone is visible in the shot, too, so whoever has that cover took the shot. We passed that on to the police and they were very grateful.’
But surely this is the stuff of cops and criminals? The rest of us aren’t exposing ourselves to danger simply by posting on Instagram or Facebook, are we? Well, yes, you could be if somebody wanted to do you harm.
To show how, I got two volunteers to agree to let me snoop around in their public social-media accounts for a few days.
Victoria James, aka Lady Dirndl, thought she was anonymous online …but this photo (left), with its distinctive ‘S’, enabled our reporter to find her home addr ess
First was a woman I was introduced to only as Lady Dirndl* who sells clothes, furniture and knick-knacks from the 1950s and 60s using Instagram and Facebook accounts in that same name. Her pictures are bright and cheerful but at first sight they give little detail away that might lead to her.
However, there are several pictures of events and pop-up shops that refer to an area in West London, so our focus narrows in on that location. Later, there are pictures of cards and celebrations, accompanied by messages wishing her well on her birthday and referring to her as ‘Victoria’, so we have her first name.
Much later in her feed is a photo of a flyer listing all the people taking part in an evening of poetry that Lady Dirndl is hosting. One of them is called Victoria James.
There is no listing of a Victoria James in that part of London in any public records I can find. However, she does have a personal Facebook account that references a now defunct website called ladydirndl.com. So we have her name – but where does she live?
The first clue comes in her personal Facebook account where she has posted pictures relating to an agency that finds locations for film and photographic shoots. One is of a location that is a homage to everything vintage. There is no guarantee that Victoria lives here – it might be a studio – but I contact the agency and get a street name, though not a building number, and there are hundreds of properties on the street.
However, one of the pictures on the agency’s page features a huge red letter S resting against a wall in what looks like a garden. It’s time for me to reach for Google Earth.
I load up the name of the road, zoom in from space and start my search for the big red letter S. Within minutes I have found it, and established that this is a house and not a studio. One of Victoria’s postings on her personal Facebook account is a picture of her husband, whom she names as Sean, renovating their home. This time I go to Street View at street level and establish that I do, indeed, have Victoria’s home and address.
We only have to slip up once to leave ourselves – or our loved ones – vulnerable
Feeling rather creepy, I call Victoria.
‘Oh my God,’ she says. ‘This has really freaked me out. Trading behind the name Lady Dirndl was done largely for reasons of privacy and I didn’t think there was anything in my postings that would identify me. The idea that you could find me from all these clues – and from outer space – is so creepy. I feel like I’m in some sort of weird film. I’m definitely going to be more careful from now on.’
But it isn’t just ourselves who can let slip information that could leave us vulnerable: our phones and the apps we use do it too, and unless we’re careful, they will spew out information about us all day long.
‘If you’re happy for your friends and loved ones to know where you are all the time, then that’s fine,’ says Dr Athina Karatzogianni, associate professor in media and communication at the University of Leicester. ‘But you should be aware that anyone tagged in these posts – and their friends – may also still see them, so eventually it becomes possible for complete strangers to see what you post.
‘It is also important to be aware that smartphones store lots of information on every picture you take, including your exact location. Unless you switch off this facility, that information will stay there. The big social-media companies such as Facebook, Twitter, Instagram and so on strip out this information before it appears in public, but ordinary forums often don’t, and computer-literate criminals know how to access this data.
‘However, apps such as Instagram and Facebook can show people where you are unless you stop them doing this. The “Check In” facility on Facebook will flag up your exact location, while Instagram will invite you to share your location with every picture you post. If you don’t feel comfortable with this, then don’t allow it when you are given the option.’
My second guinea pig is Georgia Shepheard, YOU’s very own social media editor. It is part of her role to have a big public presence and to build an audience of followers that she can keep up to speed on the kinds of lifestyle, health and fashion issues so beloved of this magazine. As a result, her Instagram feed in particular is bright, informative and entertaining.
‘I’m happy sharing much of my life with my followers but I do have boundaries and try not to have anything too personal up there, especially when it comes to my family,’ she tells me after I have used the techniques discussed by Eliot Higgins and Dr Karatzogianni to trawl through her picture posts.
What I have found is that Georgia is, indeed, very careful about switching on and off the location services flagged up by Dr Karatzogianni. At one point, she is flat-hunting and takes a picture of one she seems likely to move into – and, wisely, has not allowed Instagram to share its location.
You’s social media editor Georgia (left) posted a seemingly innocuous wedding snap not realising this earlier pic (right) could prove a cyberstalker’s dream
And, because of her astuteness at the use of social media, I am able only to find out the town in which she lives, and not her full address. Compared with most of us, Georgia’s use of social media is savvy, clever and reliable.
But because of the way our phones and the picture-posting apps are configured, we only have to slip up once to leave ourselves – or our loved ones – vulnerable.
One of Georgia’s posts is a picture of a beautiful wisteria-covered arbour where she is enjoying a bank holiday at a location she calls ‘home’. She has forgotten to disallow sharing of the location on Instagram and so the picture is accompanied by the name of a town in the Midlands. I do a search on 192.com and find the address of her parents.
Two months later on her Instagram feed, Georgia posts a picture of her family at a wedding. In the moment, she’s again forgotten to prevent Instagram sharing the location – Bury. It is a mistake anyone could make.
I go to Google Street View and take a picture of her parents’ front door. Then I go to Google Earth and zoom in on their back garden from outer space, and there is the arbour. I have their address, I can see how to access the rear of the building, and I know they are 100 miles away. This is a burglar’s dream.
I feel awkward when I break the news to Georgia and send her the pictures of her parents’ home. ‘Oh no,’ she says. ‘This is terrible! It feels so creepy to see those pictures. I’ve always been so careful when it comes to my family, so this is shocking. I don’t think I’ll be posting anything about them from now on.’
It is a lesson from which we all might learn. Unless you want strangers snooping into every detail of your life, learn how and when to stop your smartphone and the apps it uses from opening wide the myriad windows into your life. Think carefully before posting pictures of yourself or your children in vulnerable situations or in scenes that might give away your location. Only last month, thieves reportedly stole £50 million-worth of jewellery and watches from heiress Tamara Ecclestone’s London mansion – just hours after she shared a sweet snap on Instagram of her daughter and dog boarding a private jet.
And after learning all about this, perhaps ask yourself a simple question: do you feel safe posting all those pictures? If the answer is no, then maybe you should use your phone as… well, a phone.
*Some names and details have been changed