Safeguarding your privacy

[Pauline]

Although I broadly agree with Peter's comments in the latest newsletter about DNA testing and people's privacy concerns, I think we would be kidding ourselves to assume that having a private rather than public Ancestry tree will do much - if anything - towards safeguarding our privacy and security.

In most cases, if you know where to look, it is a relatively straightforward process to track down people's addresses, at least within the UK, without needing to look either at online trees or social media. We may be surprised at just how much people can find out about us online, even if we have never had a public online tree or a social media presence.

 

[peter]

If you don't know someone's name and you cannot see their tree, how are you going to track them down?

 

[Pauline]

With or without a tree you are not going to get very far if you don't know someone's name. I guess there may be people out there who think they can profit by selecting someone at random from an online tree and then tracking down their address, but most people will start by knowing something about the person they are trying to trace.

 

[peter]

With or without a tree you are not going to get very far if you don't know someone's name. I guess there may be people out there who think they can profit by selecting someone at random from an online tree and then tracking down their address, but most people will start by knowing something about the person they are trying to trace.

What's the importance of the name to a family historian? There are plenty of cousins I've corresponded with where I didn't know their name at the start, and it certainly wasn't my top priority. After all, it's our ancestors we're researching.

However if they've got a public tree it doesn't matter whether they tell me their name or not - much of the time I can work it out. And that's why sites like Ancestry are potentially valuable research tools for fraudsters.

Even if 99.99% of Ancestry users are honest, the remaining 0.01% can still do a lot of damage.

 

[Pauline]

However if they've got a public tree it doesn't matter whether they tell me their name or not - much of the time I can work it out.

And if they didn't have a public tree, there's every chance you'd still be able to work it out, though it might take you a bit longer.

I guess what I'm saying is that if a fraudster - or anyone else for that matter - wants to obtain this sort of information, there are plenty of ways to do so without needing to use an Ancestry public tree.

 

[peter]

And if they didn't have a public tree, there's every chance you'd still be able to work it out, though it might take you a bit longer.

How could I work it out? Even if they were a DNA match it would be very difficult with no tree to guide me. I'd love to know how it can be done because my closest DNA match is with someone who uses a false name, has no tree, and won't rely to my emails. I can figure out which ancestors we share but that's as far as I can get.

Of course, a fraudster isn't going to test their own DNA - that would be a bit stupid - and they don't need to when there are so many public trees to plunder.

I guess what I'm saying is that if a fraudster - or anyone else for that matter - wants to obtain this sort of information, there are plenty of ways to do so without needing to use an Ancestry public tree.

I'm not a fraudster but I can't think of an easier way to find soft targets. Can you?

 

[Pauline]

How could I work it out? Even if they were a DNA match it would be very difficult with no tree to guide me. I'd love to know how it can be done because my closest DNA match is with someone who uses a false name, has no tree, and won't rely to my emails. I can figure out which ancestors we share but that's as far as I can get.

A lot will depend on how close to you these shared ancestors are. Identifying living descendants from a 4x great grandparent would be quite a challenge, and even for nearer ancestors it would be unlikely you could identify exactly which living descendant had done the test unless their profile has helpful clues, such as an age, occupation or location etc.

I'm not a fraudster but I can't think of an easier way to find soft targets. Can you?

If a fraudster selects someone at random from an online tree, and assuming that they are then able to identify a living descendant of that person, they still need to find that person's address from other sources. So, yes, there are easier ways of finding random people to con.

But the point I was trying to make in this discussion, is that we shouldn't kid ourselves that having a private rather than public tree is a sure fire way to safeguard our privacy.

 

[peter]

A lot will depend on how close to you these shared ancestors are.

Based on the DNA we share he's probably a 2nd cousin, or 2nd cousin once removed, so my great-grandparents are our common ancestors. But they had around 18 grandchildren and goodness knows how many great-grandchildren and great-great-grandchildren.

But the point I was trying to make in this discussion, is that we shouldn't kid ourselves that having a private rather than public tree is a sure fire way to safeguard our privacy.

Any form of security is only as strong as its weakest link. So whilst having a private tree rather than a public tree won't completely eliminate all possible risks, having a public tree makes you an easy target.

 

[Pauline]

Any form of security is only as strong as its weakest link. So whilst having a private tree rather than a public tree won't completely eliminate all possible risks, having a public tree makes you an easy target.

At the risk of seeming thick(!), I just don't get how a public Ancestry tree constitutes a weak link or makes you an easy target. Could you enlighten me as to the kind of fraud you are thinking of, that people with public trees are likely to be vulnerable to because their tree is not private? 'Heir hunter' type frauds tend to start at the Bona Vacantia list, though may occasionally be helped by online trees.

The kind of privacy issues you mention in your newsletter, and which prompted my response, can happen to anyone (at least in the UK), irrespective of whether they have a public Ancestry tree. There are plenty of other ways to find out people's addresses, as well as personal information about them and their family, just by spending a few minutes online.

 

[peter]

I don't know how fraudsters pick their targets, but I do know that to succeed they have to be convincing - that's why we used to call them 'confidence tricksters'. The more information they have on their marks (victims), the more likely it is that they'll be successful.

Online public trees are not the only way of finding out about people, but they must be very attractive to fraudsters because a single tree will usually lead to multiple potential victims. And for many of those victims - those who are too old or too smart to be on Facebook - the public tree will be the best source, by far, of information about them.

To imply that public family trees are not a fraud risk because there are other sources of information is a bit like saying you may as well leave the front door unlocked because the bedroom window is open. A fraudster could buy an Ancestry subscription using a stolen credit card and get unfettered access to millions of public trees - it's a very easy, virtually risk-free, way of gathering information that might 'earn' them tens or hundreds of thousands of pounds.

I don't know where you got the idea that 'heir hunter' frauds start with the Bona Vacantia lists. These frauds are less common nowadays, possibly because they are more difficult to execute than other frauds, but in the days when I regularly received emails from people attempting to con me they never once referred to the Bona Vacantia lists. After all, if the deceased person was on the list it wouldn't be necessary to go through a middleman (which is one reason why genuine heir hunters rarely reveal the name of the deceased person).

I'm not saying that there shouldn't be any public family trees at all, but simply hiding the details of people who are still alive doesn't provide much protection against fraud. All it really achieves is to protect the platforms which host the trees against the Data Protection Acts.

 

[Pauline]

I think we will have to agree to disagree on this, Peter. I'm aware that to be convincing fraudsters need to gather as much information as they can on their victims, but I still think there are easier and cheaper ways of obtaining that information, and of scamming people out of their money.

 

[peter]

I still think there are easier and cheaper ways of obtaining that information, and of scamming people out of their money

But what are they - if you're right, then surely we need to be warned?

 

[Pauline]

As I suggested above, Peter, I think we should agree to disagree on this and leave it at that.

 

[peter]

As I'm going to be writing about privacy issues again in the future - and the public/private tree issue is just a small part of the debate - it would be really helpful to know what sources or techniques you were thinking of. By all means message me privately - it probably wouldn't be a good idea to highlight them on an open forum.