Who uses linkability-based survellance - other than mil intelligence?

Question

Because of what I see as degrading internet conditions, security/privacy wise, I'm doing my own evaluation of how I need to react towards this in order to keep such crap out of my life, overall. I'm not living my life in such a way that it is likely to happen. But I'd like to be a little more ready and informed for it than I am today, and at the same time reduce the digital target area if possible.

I'm not too concerned about being traceable by national military surveillance, or authorities in federal/unitary states, because I'm not in any way involved in stuff that would motivate them looking into me - certainly not as a primary object. Their logs of me will just forever sleep deep down their databases, probably never to be seen. My political convictions on surveillance policy overall, that's another discussion.

What I am concerned about, are private actors or organizations, partly in the shades, even some legit security firms, which could be targeting me, or can be hired by companies who .. for example, wish to get rid of their competition (me) using ugly methods, or simply take what I got or do extortion of several kinds (the opportunity makes the thief). Or I might just happen to step on the toes of an extremist organization (like Scientology etc) who will then be set to destroy my life, frame one for crimes etc. Overall some actor which decides to seriously mess up one’s life, take one's assets etc.

One way it is possible to find a person, or find out about a person, is by likability; to interconnect data stored in different systems and services through time, and build a 'digital paper trail' and/or profile from it. To reduce any risk of that, it would make sense to make this 'digital paper trail' difficult to compile, by adjusting one's usage of the internet and services in accordance. My question here is: To what degree?

Surveillance- and police authorities of nations use likability as part of what they do, but it is useful to them basically because they are hooked into lots of different databases and pools of recorded data, plus access to either logs or actors who will provide them with info that they don't immediately have their hands on.

But as mentioned, I'm not concerned about that. So in order to answer "To what degree", I'm trying to inform myself about what other actors in society - and how many - might have or get access to enough numbers of large database systems that likability would be a feasible option for them? Such linked information could then possibly be used, sold, or conveyed because of threats, or loyalty of different kinds. I imagine there could potentially be a lucrative market selling information of that kind, even if it is borderline illegal, sometimes even if strictly illegal.

Overall I’m trying to learn about what digital probing resources are there out there, legal or shady, for a determined but non-governmental actor with low morality and cash to spend? This, in order to answer to what degree would I need to adapt my internet service usage, in order to minimize the possibility of gathering a papertrail?

Answer 1

I'm not sure what your actual question is, but it seems these days a bunch of kids on 4chan can do a better job enumerating and uncovering your identity than most of the 3-letter government agencies.

to what degree would I need to adapt my internet service usage, in order to minimize the possibility of gathering a papertrail?

The Tor project covers this in depth, but here are some obvious points to consider:

• Always use an adblocker/noscript plugin. Social media sites and advertisers track your browsing patterns by tracking what assets of theirs you hit, and from what sites. This data can be subpoenaed.
• Never use OAuth where it is presented as an option. You create a central map of all of your accounts on the Google/Facebook/etc database, which could be subpoenaed or enumerated via social engineering.
• Never use the same identity twice. If I search for "Seraglio" in the context of paranoid anti-surveillance and/or conspiracy theories, I shouldn't be able to find other comments you've made about the subject or your interest in overthrowing the government. Every account you make should be disposable and created from an IP address/email address that has no connection to you.
• Never use the same password twice (or, the corollary-- use only the most obvious, dumbest, easy-to-guess password possible: i.e. "password123"). Once a site gets popped and your password is known, if it happens to work on another site there's a high likelihood the two sites have an entity in common-- you.
• Never use the same IP address twice. Use Tor for as much of your traffic as possible, and route across international borders wherever possible (if you can route through Russia or China, you're politically invincible). The guy that ran KickAssTorrents ultimately got busted because his domestic IP address on iTunes matched an IP address used to log into the KAT Facebook page (which means data got subpoenaed or leaked from both iTunes and Facebook).
• Don't use avatars ever, especially on Gravatar (SE uses it). Don't even post a cartoon or video game illustration. Reverse image search can dig up everyplace it's ever been used, which helps the entity resolution process.
• Try to stay off the grid. The credit bureaus track every address you've ever been associated with by virtue of all of your utility connections, credit applications and more. The good news is federal law mandates your consent, so if someplace says they're going to run a credit check on you, even if you're not trying to borrow money, your current whereabouts are being uploaded and updated the time of the request. Criminals regularly exploit this in the case of fraud, but either way this information is regularly subpoenaed.

Total anonymity is a myth (everything leaves a digital footprint, and the US government allegedly owns a not-insignificant portion of the Tor network), so the best you can hope for is to muddy the waters so much that nobody can see who you are through it. Think of it like money laundering, but for your identity.

Addendum:

I'm not too concerned about being traceable by national military surveillance, or authorities in federal/unitary states, because I'm not in any way involved in stuff that would motivate them looking into me - certainly not as a primary object. Their logs of me will just forever sleep deep down their databases, probably never to be seen. My political convictions on surveillance policy overall, that's another discussion.

What I am concerned about, are private actors or organizations, partly in the shades, even some legit security firms, which could be targeting me, or can be hired by companies who .. for example, wish to get rid of their competition (me) using ugly methods, or simply take what I got or do extortion of several kinds (the opportunity makes the thief). Or I might just happen to step on the toes of an extremist organization (like Scientology etc) who will then be set to destroy my life, frame one for crimes etc. Overall some actor which decides to seriously mess up one’s life, take one's assets etc.

You're being naive. Scientology, et al. have friends in high places.

The government may collect a bunch of data on you and do nothing with it, but APT actors are always targeting government and defense contractor assets, and if they get their hands on that data, then all bets are off as to what could be done with it.

Driving on the road, you're fairly anonymous-- only your license plate number is known to those around you. But if someone with a friend in LE gets them to run the plate, now someone you may have offended on the road has your name and home address.