New Rules of Privacy

Most of us give out the same phone number and email address without thinking twice. But when that information gets combined with everything else available online, it can reveal a surprising amount about who we are, where we live, and the people around us. And with AI making it easier to pull those details together, scammers can create attacks that feel much more personal and believable than they used to.

My guest today is Arjun Bhatnagar, the co-founder and CEO of privacy and security company Cloaked. Arjun has spent more than 20 years in technology, starting out as a programmer at a young age and later working as a CTO and leading engineering teams. His work now focuses on helping people take back more control over their personal information and digital identities.

We talk about how AI is changing scams, why reusing the same contact information can make us easier to track, and what he calls “data poisoning” or using aliases and alternative information to make that tracking more difficult. We also discuss why privacy doesn’t have to be all or nothing, and some practical ways to make yourself a harder target without giving up the technology you use every day.

Show Notes:

• [01:51] Arjun Bhatnagar explains how his interest in privacy began with using fake names and unique email aliases online.
• [05:05] Privacy and data protection matter to everyone, not just celebrities, executives, or other high-profile targets.
• [07:17] AI has made scams cheaper to create, easier to personalize, and much more convincing.
• [10:10] Public attitudes toward privacy have shifted as people have become more aware of how their information is collected and used.
• [12:43] Privacy is about having control over personal information rather than trying to remain completely anonymous.
• [15:05] Data poisoning can make it harder for companies and scammers to build an accurate profile of someone.
• [18:27] Alias phone numbers, email addresses, and other identifiers can protect personal information without disrupting everyday communication.
• [21:23] Cloaked uses different types of phone numbers to reduce tracking without creating an unnecessary shortage of available numbers.
• [26:14] Reusing the same username across multiple platforms can make separate accounts easier to connect.
• [29:41] Deepfakes, voice cloning, and highly personalized phishing attacks are becoming increasingly difficult to recognize.
• [37:21] Individuals are often expected to manage cybersecurity risks that companies are better equipped to handle.
• [40:39] Keeping multiple privacy tools in one service raises security concerns and requires careful protection of user data.
• [43:43] A phone number can reveal a surprising amount of personal information through data brokers and public sources.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review. 

Links and Resources:

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Cloaked
• Arjun Bhatnagar – LinkedIn

Transcript:

Arjun, thank you so much for coming on the podcast today.

Absolutely. Appreciate you having me today.

Can you give myself and the audience a little bit of background about who you are and what you do?

For sure. My name is Arjun, I’m the co-founder and CEO of Cloaked. We are a consumer and enterprise security and privacy company, all focused on we put people in control of their data and their identity. But the story that I really try to fight for is we want to help individuals have some sense of control when AI and companies try to grab everything about you, what can you do? We think around helping clean up your past, defend your present, and protect your future. I’ve been a technologist for more than 20 years. I started coding when I was even 10 years old, so I’ve been at this for a long time.

That’s awesome. What about the privacy space got you interested in doing this?

Yeah. My privacy experience goes back quite a bit where I actually got access to Facebook in 2005, and I remember when I got access to an account, it asked for your full name, your email, your phone number, and I thought, “Well, that’s a lot of information with this company. What if Facebook becomes a big company one day, and people start accessing your social media profiles, and they want to see everything about you?” I was like, “Well, let me put a fake name there.”

I think that started that journey where people thought it was crazy, and I was like, “Well, no, it doesn’t look too crazy.” But I thought it was crazy, and I started using alias emails. I still remember where every website, whether it’s Target or back then it’s Adobe Flash game websites. I’d make a unique email for every single one because I didn’t want to, if something got compromised or stolen, to affect my own personal email. I’ve been slowly becoming privacy aware.

I’ve been a CTO and led lots of engineering orgs, so I’ve known it’s like when you actually have full standing of security and managing engineering disciplines, what can happen and how do you keep the business safe? I’ve built depth now on how bad the problem can be, and what you need to do to actually thwart it or stop it when somebody tries to attack you.

Got you. So let’s talk about the privacy and data landscape. How big of a market is my personal information?

Well, we know it. At a baseline, it’s more than three trillion from Google, Facebook, everyone who’s leveraging your data to market, sell, advertise, to collect. We hear terms, and for those who don’t know, things like data brokers that harvest and sell your data, but those sound like just the bad guys. Then you have good guys and you think, “Oh, they’re nice. They’re social media companies, my work profile is maintained.”

Everybody is trying in an effort to profile you, aggregate information about you, sell your information to others, even if they’re positive companies, and maybe they’re not even selling their data, they then get hacked and then suddenly, everybody knows about information. It can be the parking app that you suddenly—and I still remember this e-mail I got and you probably got similar where one of the parking apps in 2022 or three got a breach and there’s something to think about for your personal privacy.

They said, “Don’t worry, your credit card and your password are safe. Only your name, address, your car’s make and model, your favorite color, your location history, your license plate were compromised. But don’t worry, your credit card is safe.”

Everywhere that your car has ever been parked, that got exposed, but your credit card number that you haven’t used in five years, that’s OK.

That’s OK. That’s kind of the weird aspect we think about in privacy. I’d love that we can talk around how I think around it. It’s that privacy has been designed to be an overloaded word, where it tries to catch all and do everything, and as a result, and even Big Tech wants to feel it, they think it’s about being hidden, being anonymous.

But in reality, it’s a matter about being in control, and how do you put yourself in control of your information, who knows what about you, and being in control of what people know about your family, where your kids go to school. This is a matter of safety. It’s a matter about preventing scams, spam, phishing, and it’s around being in control when there’s surveillance happening everywhere.

Tell me if this is a false perspective. I think at some point it was if you are a well-known individual, you’re an athlete, a politician, a Fortune 500 CEO, that was the type of person who I need to keep my stuff safe. Most actors don’t even use their real names. This is the segment of the population that needs to protect their data. They’re the ones that need to have privacy. They’re the ones that are targets of stalking and scams. Was that true at a point where that really was the only group, and now it’s gone to pretty much all of us, or has it always been all of us?

It’s always been all of us. I think the idea of collecting, harvesting, and indexing information about people, that has always been true. What’s different now is that people have to focus and spend time. I tell the individuals that think about a hacker, an attacker, someone who goes to work, shows up, go on his computer, has his nine-to-five, and his job is to compromise you. Sometimes they don’t know you’re compromising you because there’s lots of layers, and people are tricked into thinking that they’re doing something else, but they’re actually scamming or compromising you.

But in reality, there’s a job, and so then there’s waves, up and downs, and seasons of when they really try to attack. The difference now is that with AI, and especially as of March of last year, AI has lowered the cost to make wide-scale efficient attacks. You can now compromise anybody. You might see a spam or scam text that shows you a picture of your local Starbucks, talks about your home, says, “I’ve seen things in your personal device that you don’t want anyone to see. Send me a Bitcoin.” There is these very contextual attacks that are now being done with AI at scale by most actors versus them doing the attack. When you’ve made the attack cheaper, now it’s not a matter of if you’re going to be compromised, it’s a matter of when and what can you do to make yourself safer in that process.

I remember the really early forms of the sextortion scams were you get an e-mail saying, “Hey, I’ve turned on your camera and I’ve seen you doing things, and I have access to all your contacts, and if you don’t send me half a Bitcoin,” or whatever the number was at the time, “I’m going to release this. The proof is here’s a password that you had previously used, or here’s your password.”

I think a lot of this relied on the fact that people didn’t use password managers, and it was like, “Oh, my gosh. If they know my password, that must mean they actually have hacked my computer.” As opposed to, “They just knew what your password was.” For a lot of people, that was a very convincing piece of proof. But like you said, now it can say, “Well, I know your address, I know who your spouse is, I know who your kids are, I know where they go to school.”

Probably because you posted all that information on Facebook last week, but the social proof that the scammer actually quote-unquote “knows something,” that data just seems to be readily available to anyone anywhere now.

That is exactly the case. It is readily available to anyone, and it’s really easy to get, and it’s pennies on the dollar to get everything about you, your family, your accounts, your passwords, your credit cards. And the scary thing is that you are ultimately—you could be making the mistake of posting information on Facebook or social media website, but you could also be staying a bit private, but you’re giving out information like the phone number you had for 25 years, that is leaking everything about you.

That’s something I’ve always said out loud is that it’s because you give information that you use over and over again, that phone number, for example, to both the IRS and Domino’s, is what makes it easy for attackers to find a way to aggregate everything about you from just a single data point. It’s really about how do you put yourself back in control? How do you change the way you share information? I always give advice. How do I say no and then work my way to a yes versus say, “Here’s all my location history. Here’s all my contacts.”

This is where the dialogue is shifting. The good thing is that, unlike 10 years ago, where you said the word privacy or concerns about people accessing you, back then people were like, “Whatever. I want to get this free app and try it out.” Now people are unplugging their Lexus. They are saying, “I don’t want to try this new app because it asks me for all this information.” People are starting to wise up, even though they’re not deep security/privacy individuals, they’re feeling something is wrong.

Do you know if there was a specific event, or has it just been a slow change that people are starting to move away from the perspective, like the old version of privacy was either it’s like an all or nothing? Either you’re a hermit or your entire life is exposed and those are your only two options. At what point did that start to change and why?

I think it’s funny. Privacy has been pushing this narrative of being anonymous or being hidden and wearing this tinfoil hat. I think that was the narrative. I can talk about recent examples that show that that’s no longer [inaudible] for what people care about, but I think the journey began from the Cambridge Analytica incident in 2016, 2018, and the efforts that happened with the 2016 election. People really started to understand what was going on, but I think it’s starting to become more normalized.

You see in movies now, I remember there’s this movie New Dads where the guy lived on a farm, no technology, and the joke was that, well, because he put his phone number once for a donation somewhere in 1970, they found it. There’s this movie, there’s the TV show on Netflix called Beef, where they showed how in the first season, they could research the individual online, find them. You’re just seeing more and more instances with the social side guys around keeping yourself digitally safe.

The Netflix show, that scary Baby Reindeer, where there’s the stalker that kept following them, it was their phone number, and they kept finding them and finding them. The fact that these are becoming super, they’re becoming big hits, people love them, it’s normalizing the fact that this is creepy. I think creepiness factor has been building year over year over year, and the line the match for the fires AI.

AI has created that already, the creepiness factor, and shown that AI can be good, it can be really productive, but it can be a tool for that. I think now it’s going to be a conversation of AI v. AI, which is where we’re really trying—what a safe AI looks like to keep you safe against other AI, but the creepiness factor is built year over year.

Got you. If removing data is not the answer in and of itself, what is the larger answer?

Yeah. We talk about cleaning up all of your data online. The challenge is everyone’s like, “Well, that sounds like a lot of work. Also, is it going to be useful to me?” We say it’s got to be a holistic answer, and I think when you’re talking about getting some sense of control, because 77% of Americans feel like they lack control online. This is a real feeling, and what’s funny about that is that more than two-thirds of Americans feel more violated with their personal information being taken and harvested than a hacker stealing it.

I was like, “Wow, people are feeling more violated from companies harvesting data than they want a hacker stealing it.” It would be almost the entire country, 90 percent of the country find that they’d rather have it illegal to harvest your data than to have it, make it legal. It should be based on consent. What I found is that the answer comes into three parts. You have to think about first, the idea of let’s take some action on cleanup.

Absolutely. Your data has been out there. Let’s clean it from data brokers. Let’s actually help manage, rotate it like your credentials have been compromised. Don’t use the same password everywhere. Let’s help figure out that problem. You do want to make an effort there. But then you have to also start talking about defense. You’ve got scams, spam phishing, hitting you. How do you stop that? Make sure that you’re not compromised by a phone call or text or an e-mail.

You’re thinking about what happened in the past, cleaning it up, defending its AI threats, but the core biggest answer that I’ve found that really makes the biggest swing for long-term keeping you safe, your family safe, is starting to poison your data. Data poisoning is a concept that we really champion and talk a lot about, is this idea where your information is being harvested, it’s being collected. But there’s actually a win there that we still have a window to act on, but the win is the fact that nobody wants to know what you’re doing 15 years ago.

They want to know everything about you now. It should be contextually relevant. They’re harvesting everything. The moment that there’s new data introduced, they’re like, “That’s more important than this old data.” That’s the window where it’s like, “Let’s hijack that and poison that data.” I can talk about what that means if you like.

Let’s talk about it, because I think of, and you could probably talk about this, is I think of systems that are designed for identity verification, that look back at our histories. You want to set up an account with a bank, and they say, “I’m going to give you three addresses; which did you live at? Have you lived out in the past? What kind of car loan did you have? Who did you have it through?”

I’m trying to think of all the other questions that they ask, some seemingly random questions. But once you start poisoning that data, let’s talk about how the data poisoning works, but also are there some potential negative impacts?

For sure. I’ll talk about how it works and some of the impact. Why don’t you say data poisoning works with the fact that people aren’t trying to track you on your Social Security number. They’re not trying to track because that’s sensitive, it’s information that’s hard to share, but they can get that data through other information—your phone number, your email, your IP address, your credit card, your passwords.

There’s data points that reveal who you are, and so they want to follow that information because you have the same phone number for maybe 25 years. They want to track it, find it because that’s the easiest way to join you across every website, account, video game, whatever you’ve used. You can get everything all at once and join the data together with just that one data point. Data poisoning is let’s poison that information.

What we do, for example, at Cloaked is we create, we help clean up the data, we stop scams, spam phishing, but we also then now create information. We call them identities, but emails, phone numbers, credit cards, passwords, even now IP address to mask your information so that you don’t have to give out your information anywhere you go. This means you have a unique email, phone number, password, credit card for your Amazon account, and email, phone and password for your Uber account.

A phone number for that cute guy you meet at a bar, email for a [inaudible] you’re talking to. You don’t have to give up your actual information everywhere you go. I have 2,000 phone numbers via Cloaked. Every account, every website, I have different information. It makes it very unclear when someone looks up who I am, “What’s the right information?” I was recently at a bank and they’re like, “Oh, we looked up your information. This is your phone number.” And I smiled. I was like, “Well, that’s the thing the number is.” But the idea is that yes, you start to poison. All these systems are built on a system of consensus.

Your identity is not because the government says it’s your identity. It’s because a bunch of people say, “You know what? That’s urgent.” You’ve got your bank, you’ve got the government, you’ve got your retail utility company, all these social media, all these companies that kind of work in concert, both invisibly, visibly, by just giving and then sharing information to figure out who you are. And so what it is, and you start to poison the data in some places, actually gets poisoned everywhere very quickly.

What that leads to in talking about the impact is that people don’t need to know your actual information, your phone number, your email, your address. But they want to because they want to harvest your data. What we recommend is you share aliases. Cloaked can help create these. But what we’re able to also talk about is, “Well, what happens to the impact?” Well, in reality, nothing actually changes.

Cloaked just made sure to make everything route back to you. A call, a text, even a credit card transaction goes back to your actual credit card. The reality is that what we’re focusing on is don’t break the connection, make it still work, but no one needs to know the actual data. And speaking from the impact, when you use Cloaked information, you ultimately, people, including myself, bought plane tickets, filed taxes, bought a house, bought a car, got married using Cloaked information along the way.

It hasn’t stopped people. But yes, the more you do it, you might trip up and say, “Hey, I need you to either use your driver’s license or put your SSN.” But nothing has stopped it, right? Because when you set up an account, they might say, please uphold your license because they couldn’t figure out who you were from just your phone number, but that’s a good thing. And so say, “All right, I have to upload my license.” Now, the good thing is that the license actually sends their data.

The phone number isn’t. It’s not being shared in the license picture. They have to keep it all legal and can’t harvest that data. But phone number, they can harvest that information. Now you might have to do that, but it doesn’t actually add much friction. You have to do that half time anyway because systems don’t work. And then what we found is that the KYC questions, like which one of your few homes.

Now, I would say that if you take it further with address masking, which I have, I unfortunately do have to answer about this county in Mississippi, the zip code for this, this street address. I have never been to Mississippi, but I’ve managed to make everybody believe I live in Mississippi. All my KYC questions, but I’ve learned it. I was like, “All right, this is the county that I said I live in and then the address.” Because ultimately, real verification happens often with your license or a government-issued ID. We’re not making fake or alternative or aliased driver licenses.

For folks, we always try to make, generate, real things that looks like a phone number, acts like a phone number, feels like a phone number, so that way nobody feels differently. But we’re not masking your government ID. You give that out when it hits that wall, and that will always let you through the door. That proves the point. I give this example: people think with TSA, they look at you in the camera, you can just say no. And you’d be surprised, it actually had zero difference in time. They just look at your license and say, “All right, on through.” You don’t have to do all these things.

And so if you have 2,000 phone numbers and every one of your customers has 500 phone numbers—I won’t say every customer has 500 phone numbers—I’m a bit more on the extreme side. But does that result in a problem of, there was a major problem in the US telephone system when people started getting fax numbers.

Because every business went from having one phone number to two phone numbers and it ballooned. And then cell phones caused another ballooning of numbers. Is this kind of the next thing in telephone numbers that we’re going to have to create a whole bunch more area codes? Or are you doing something unique to reuse phone numbers across multiple customers?

Yeah, so Cloaked has multiple types of phone numbers. You can have a regular, normal, open phone number that you just give out. It just works like normal. You get calls and texts, the AI agent, we have scans for scam calls, spam, phishing, et cetera, but normal phone number. Cloaked also has a unique capability where we have locked phone numbers. I can spin up a phone number that just works between you and I.

That number is locked between us and that’s it. If anyone else tries to use it, it doesn’t work. But because it’s locked between you and I, the Cloaked system can now put multiple people on the same phone number. If you and I are locked onto it, well, then maybe your wife and her friend could be issued the same phone number that you and I are using.

Oh, interesting.

We actually overlay and we can do the same thing for businesses. If you sign up for Target and I sign up for Best Buy, then we might actually get the same phone number. Cloaked routes things to the right place. That way, we don’t have to balloon the phone number problem. That’s a big thing and kind of our special way to tackle this phone number problem. But I’m sure that Cloaked grows and there’ll be more error codes. But the good thing is that where we are working with proper government bodies and different groups to know what we’re doing with code phone and even different government bodies have approved and allowed us to do what we’re doing for our phone numbers.

And I assume that helps with the data poisoning also.

Yes.

It’s like, “We’re going to help you with it. You don’t have to go out of your way to poison the data. We’re going to poison the data for you,” so to speak.

It’s funny, right? If one phone number is being actively used by 100 people, now nobody knows who this number actually also belongs to. It’s even further poisons that data. Absolutely.

Gosh, I guess there’s really only specific uses for that because you don’t want it to be a general, you wouldn’t want it to. You can’t really use it as a general phone number, just a one-to-one, right?

You can have general phone numbers and you can have both of these. You can have both these contexts. We’re recommending having few general numbers because then it’s like now that you use it, it’s going to start to…. People build profiles on you and track you and things like that. We’re recommending having, maybe, a couple of those general numbers and more of these for a website or for an individual.

Yeah. Because there’s times where you’re going to get phone numbers, calls, from people that you don’t know that you want to get.

Yes.

That get routed to you. I don’t know the plumber’s cell phone number, but if he’s calling to say he’s late, I want to know about it.

Exactly. There’s many situations. One thing we recommend is you don’t need to get to my point to have 2,000 phone numbers. Even having a second one is still a big difference. If your security and privacy posture is here, going to here still makes a big difference. Using that, then you combine that with our call guard, our AI assistant that sits on top of your phone call to help screen scams, spam, and phishing. Well, then if that plumber calls, then the AI agent says who you’re trying to reach and explains it on the plumber, then it’ll let them through. You can feel safer even with just one, but our goal is to slowly get people to be comfortable with, don’t give our information to anybody.

Yeah, and I think that’s part of the privacy of shades of gray, not black and white. It’s not like, you’re only going to have privacy if you have 2,000 phone numbers. And if you never use the same email address twice, that is not the answer for everybody, but you’ve given a platform where a little bit more privacy, people can adopt it as they feel comfortable adopting it and not be an all-or-nothing sort of thing.

I think that’s the big goal that we’ve always been championing, is that it’s not an all-or-nothing principle. Everyone wants you to feel it that way, both from the big tech companies and unfortunately, even from GDPR efforts where it’s about deleting your account. People don’t want to delete their Instagram account, they want to feel better about it. And that’s the real message, is that how do we feel better about it?

Now you can feel super better, feel extreme better, you can feel a little bit better. And our goal is to allow that sliding scale, because ultimately, it’s about having comfort in the technology you’re using.

Are pseudonyms one of the other kind of telephone number, like the next version of the telephone number? If I start using the same handle at different places on social media, is that basically the same thing as handing out the same phone number?

Absolutely, it’s the same thing, just like using the same handle everywhere. That’s right, we generate usernames as well, because for this exact reason, you shouldn’t be using the same handle everywhere, because that’s the same thing. Now, you can join all these accounts. Because by design, handles are meant to be unique. It means the same, unique handle everywhere. Now everybody knows that’s you.

It’s interesting because some of this flies in the face of how some people are trying to live their life. That if you’re an influencer, you want your handle to be the same place everywhere, because you want to be easily found everywhere, but you also don’t want people showing up at your front door.

That’s the idea. That’s where we really focus, is that privacy as a solution should be adaptive. It should match who you are. I’m joking, we’ve got elder individuals who are super tech savvy, and 30-year-olds who don’t want to use tech. We’ve seen everything under the sun. It should be adaptive, especially if you’re an influencer.

Yeah, you want to have a gamertag everywhere, but the gamertag should not tie back to your address. How do you then make sure that is a true statement? That’s something that we’ve been really indexing on, is that you could do that, but let’s clean up information that could tie back to you. Now, ideally, most people aren’t influencers. You don’t need to be that, but if you have to, you have the other steps you can take.

It’s probably more common now than it initially was, is a lot of people now separate their professional and their personal identities. I’ve got a professional Instagram account and a personal Instagram account, and the personal ones, the personal accounts, may not share the same handle, but all the professional ones do, because those are the ones I want found.

Yeah, and I think that’s where I run a company, a privacy company. I’m more public. You can Google a lot of things about me, but I’m really making sure that those things don’t tie back to things that I don’t want to impact my safety. I don’t want to cause more spam scan, but I also want to make sure that I’m tackling what surveillance is happening about me across the board.

There’s a way to accomplish being public and being private. It’s about these shades of gray you’re discussing. That’s the way to think about the problem. Unfortunately, what we’re trying to support is trying to push this. The laws and different groups kind of force and it’s because a lot of lobbying efforts, they push into black and white. A social media company like Facebook would rather have you delete your account than let you be shades of gray, because shades of gray makes their lives harder.

They’re like, “All right, I’ll just lose the user.” They’d rather lose the user than have you create incomplete or incorrect data.

Or have lots of users create incomplete data.

I have lots of users, exactly.

Because of kind of like where you guys sit in between an individual and corporations and the rest of the world, is it starting to reveal any kind of trends that you see in terms of email scams and phishing and phone calls and text messages? What have you learned recently that it’s like, “Oh, we can see these trends and what are those trends”?

There’s a lot, and I think that’s hard. It’s more hard to say is what’s the biggest one. First fact is that studies have shown that since last year alone, scams and spam phone calls increased more than 15%. It’s just increasing despite everyone saying, “We need to solve this problem. It’s just continuing to go up.” I think the way to look at it is that there’s now deepfakes happening where people are cloning the voice and sounding like your family member.

We are seeing texts that are, as you said, kind of you talk about extortion, but even talking around, “Here’s your picture of your home. Here’s your Starbucks.” Very contextual-based scam spam phishing. The emails, another example of a trend is it’s not looking like before where on the Nigerian prince, the email has broken English. No, the email looks extremely legitimate now. You’re like, “Wait, is this real? Is this an email coming from my child’s preschool or school, or is this a scam?”

That’s because the information that’s being now put forth as an attack is hyper contextual. The biggest trend is that these things look very familiar now. They don’t look obvious, and because it’s not obvious, you’re much more susceptible. This can take any shape, call, text, email, a link. It comes down to how do you create established channels of communication with your loved ones, close ones?

How do you make sure that when you’re in a rush, you don’t click a bad link, you follow practices and protocols? There’s habits you should be following and happen to dig into them, but it’s now designed to compromise you when you’re going on the trip to Peru. They know that you’re going on that trip. Let’s now strike.

It was funny because I definitely have seen that for myself, that the phishing attempts and the scam attempts, the quality of them have gone up significantly. So much so that I got an email and I’m going to try to be vague about this. I got an email from a provider that I do business with on a regular basis saying that my account hasn’t been accessed in five years or something, like a surprisingly long period of time.

And because I haven’t logged in, they’re going to deactivate my account. I thought, “Huh, that’s an interesting message.” I’m always curious, like, “What’s the angle here? Where are they trying to direct me?” And I’m like, “No, the email looks like it has been routed through normal channels from this provider. The links, they all look like links from this email provider.”

And I’m starting to dig into stuff. I’m like, ”No, these are all valid links. This is weird. Everything about this looks like a legitimate email. But I know that I access this account on a regular basis. Is this a really, really amazingly good fake? Or did they send out this email by mistake?” I’m in that boat and so I start poking around, looking at it a little bit more. And it turns out it was sent to an email alias of mine that I had created with that platform that I hadn’t used in five years.

It was a legitimate email. I just assumed that it was, because it gets all funneled to the same place, that it was the email that I used for that provider. It was interesting. It’s like, because the quality of scams have gotten better, this was a legitimate email that I now thought was a scam and thought was a really, really good scam.

Yeah, so now you’re seeing the flip side of it. I think being skeptical is probably now the right response you have. The challenges you’re seeing, this type of attack is looking more and more legitimate. It’s looking like a proper communication, proper way of reaching you. And the only way to tackle this is really finding a way to say, “OK, am I using this? Does this link look right?” Don’t click it right away. Right click it, copy it, see, inspect it.

If you felt comfortable, I’d say opening on mobile iOS Safari is actually a little safer. Don’t log into anything, but see that URL. But because more and more, you have to just be more careful. And I’d say there’s known patterns. Like we say, “Well, if there’s something important, it happens on this channel communication.” Or it happens on, we say our code word over the phone, but there’s ways to do this. We’re not seeing if an email about a wire is legitimate. “Like, this is the only way we do wires.”

Yeah. OK, this will be the first time I admit this on a podcast. I like to watch police body cam videos.

Oh, yeah.

Because I just like to see the way people interact. I was just thinking this, there was a—and just to be sensitive to the people involved, a woman had been arrested, and she was going to be in custody, and her husband was out of the country. She needed to call him and let him know, “Hey, when you get home, I’m not going to be here.” And of course, the police made her make the other investigator made her make the phone call on speaker phone, so it gets picked up by the body cam.

It was interesting because she tells, “Hey, I got arrested by the police.” And the husband went to, “I think this is a scam.” And was like, “I need you to tell me this particular information about this family member so that I know it’s really you and not a scam.” It was interesting because she was pushing back as like, “I don’t have time for that right now. You don’t understand.” And it’s like, “Well, that’s exactly what a scammer would say.”

But it was interesting to see, like, in a real-world situation, like, someone actually pushing back on, I think, pushing back saying, “This sounds like it was a real situation.” But he was pushing back saying, “This seems like a scam. I’m going to now start asking specific questions that only a much smaller segment of people would know the answers to.” It’s interesting to see that actually starting to hit the real world.

You’re seeing the real world. That’s a great example. I would say the fact that someone actually did that means we are seeing the problem in real time. And the sad part about this—and it’s great that he’s asking questions digging in—companies right now have the ability, they have cyber security leaders, people who manage the security of the organization. But as individuals, the sad part is that we are left to be our own cyber security leader, which doesn’t make any sense. He’s rolling on his own questions. He’s trying his own things. There’s not a system in place to say, “How do I keep myself, my family safe? How do we do this together versus I guess I’ve got to figure it out”?

Yeah. And that’s one of the things I’ve always been annoyed with and upset about and advocate for is, you have an internet connection, your ISP provides you the router or the modem, and they don’t help you. No, once it’s in your possession, if there’s a problem, it’s your problem. It’s not our problem. We’re just the transit of data. We can absolutely tell that your computer has been compromised and is participating in denial of service attacks, but it’s not our computer, so we’re not even going to tell you.

The people who are least equipped to resolve issues like that are the ones that are being thrust into, “Well, it’s your responsibility to take care of something,” that you have no skill or training on how to take care of.

I think about this as a parable here where, and I’m sure you may or may not know the story, recycling. If you don’t know about recycling, recycling was invented by big plastic because instead of making it their problem, they said, “Hey, you need to recycle. Here’s what it means. It’s good for the environment. You need to recycle.” So instead of investing and spending the money for plastic companies to get better, some genius said, “Wait, let’s just make it their problem.”

And you’ll never realize that plastic industry invented recycling because it shifted the blame onto the individual. And so it’s cheaper and more cost effective for people to do it than the actual company. And I think that’s the thing we have to realize is when you think about your personal privacy, your personal security, your family’s safety, everybody’s trying to make it your problem. Digital attacks are now happening way more frequently than just people showing up your home and knocking your door.

It’s really around now they’re using digital to compromise you and everybody. What are you doing to keep yourself safe? It’s now become your problem. Now, well, there are companies and tools that can help you with that. That’s what I’d say is unfortunate, but that’s the space you’re in. If you’re working in law, the legal side of things and the law, it’d be great to now change that equation. But for now, that’s the situation we’re in.

I’ll ask you a tough question here, yeah. Because you guys are operating in a space of, we want to be this one-stop shop for privacy and user advocacy for privacy, that we’re going to be this one-stop shop. Does it make you guys a bigger target than if people were to separate all these products out into different providers?

This idea is like all-in-one shop doing these things. There’s that kind of concept of, “Well, don’t put all my eggs in one basket.” I think the reality is that that’s also itself another thing that people keep talking around. Where if you use 15 tools, you have to have 15 different ways to manage what you’re doing. As a business, being an all-in-one system, Google’s all-in-one system, tell me when and the number of times Google’s had a compromise. JP Morgan is an all-in-one system.

Tell me the amount of times JP Morgan’s had a compromise. So there are ways to keep systems safe, and especially in systems like keeping all in one. You have principles of zero knowledge encryption. We have a white paper around this. We have systems of how we separate data, organize it, such that the user is in more control than the way we manage data. The way you feel good about having systems in one place was the first thing we tackled.

We want to make sure that your data in an event doesn’t get compromised and you feel like you’re in control of it. That’s always been the core of what we do. Now, I can’t say all companies operate this way, but the system I could say is not all security companies are privacy companies, but all privacy companies have to be security companies. And the idea of privacy comes back to that sense of control, and that when you build and design with that in mind, it’s going to keep you a lot safer and feel more comfortable being all in one.

But it’s not an impossible task. I’d say it’s even harder when you start having, as you kind of alluded to right then, I use this tool for an alias that went into this one box and try to connect. It’s up to you to figure out how all these dots connect. Well, let a company that’s saying, “This is all you do is how do we keep you safe, spend the energy and cycles and investment to keep you safe.”

Gotcha. As we wrap up here, is there a way people can find out easily, like, how much data really is tied to my phone number? How readily available is this information?

Absolutely. This is something that we spend a lot of energy on. How do you get aware what you can do right now to find out information about your phone number? You can actually call our hotline. Our phone number is 855-752-5625. And I’ll say it again, 855-752-5625. And when you call it in real time, we’ll find out what others have about you from data brokers, public websites that are actually selling, sharing your data.

The information you find, information we don’t have, but what we discover in real time will surprise you. You’ll find your phone numbers leaking, sense of things about you, your family, even things like your Social Security number from just that one data point. Or if you’d like to, you can also go to cloaked.com and see what directly, what information others are collecting and harvesting about you.

Awesome. That’s scary that it’s real time and you can answer it on a telephone call.

Absolutely.

Arjun, thank you so much for coming on the podcast today. I super appreciate your time.