Truly Disappearing: has the internet’s perpetual surveillance killed the option to escape? – Lachlan Jarvis

Gareth King (00:35)

Lachlan, thank you so much for joining us and welcome to the show.

Lachlan (00:38)

Thanks, Gareth, good to be with you.

Gareth King (00:39)

Before we get into it, can you tell us a little bit about what you do at Lyonswood?

Lachlan (00:42)

Well, I'm a private investigator. How would you sum up the role of a private investigator easily? Effectively, what a private investigator is endeavouring to do pretty much all of the time in the course of their job, is to uncover the truth in one form or another. And that could just be something simple as such as the whereabouts of a person, or it could be a serious criminal or civil matter in which you're trying to uncover information that's relevant to the litigation. So, it runs the gamut and we have a range of different services that we provide the clients to help them get to the truth in whatever their circumstances are.

Gareth King (01:18)

Yeah, awesome. It sounds super interesting. I know that a lot of the services that you offer are connected somehow to the online space and the digital world. And we've all seen how the internet and technology has gotten incredibly pervasive, not only in our immediate lives, but in wider society and culture. But from your vantage point as a private investigator, how has that rapid growth of the digital landscape changed the nature of your work, and what's been the most surprising way that it has?

Lachlan (01:48)

Yeah, so I started in the industry in 2009 and I've been in the industry in one form or another since then. And I think the thing that has changed the most in terms of the work that we do and access to information in respect of people's personal data is that there's more available to investigators and more available to the general public.

And I would suspect that means there's a great deal more available to governments and intelligence agencies and things like that. In terms of, without being too academic about it, I think that what is happening is that there's a centralisation of data taking place. So personal information used to be pretty segmented across different government departments, maybe in some larger corporations and so on.

These days, there is a lot more data available in relation to people’s private lives and personal information. And it's centralised in the sense that it's all in, or the vast majority of it is in databases. And that is often available to people such as hackers or leakers inside government departments or large corporations. So, there's more data.

It's more readily accessible to those with malicious intent or perhaps good intent if they think they're leaking for the right reasons. So that means that the general public's information is more accessible. But one thing to keep in mind is that I don't think that this is a one-way street. Keep in mind that people used to have their names and addresses listed in the white pages. And most people I think did have their details listed, their first initial or name, their surname and their location. Whereas that's much less common these days. So, it's a little bit of a change in the way as well in which the data is accessible.

Gareth King (03:46)

And it feels like, yeah, obviously we're doing so much more in that online space, now it feels like everybody is creating this footprint of themselves, and most of the time they're actively contributing to it and adding to that kind of publicly available data that people can get access to, whether for positive or nefarious means. But that said, can you just explain to us what the difference between an active and a passive digital footprint is?

Lachlan (04:13)

From my understanding, an active footprint is what people choose to put out there about themselves in an accessible or semi-accessible format on social media, for example. Whereas a passive footprint is something, for example, such as metadata that is created when you surf the internet and your ISP records your browsing history, that might be accessible through a subpoena or something like that.

People are generally, unless they're pretty savvy, doing both to some extent in most circumstances. Although there are people out there who don't do anything actively. They make an active decision, so to speak, not to put anything up online about themselves. Although it's pretty hard in this day and age.

Gareth King (04:46)

Yeah, I can imagine. But even if somebody is making that decision to minimise what they think is their digital footprint, how effective is that? You know what I mean? Like, a lot of people might think that setting your social media to private is, is quite an effective tactic, but is it?

Lachlan (05:14)

Well, social media is an interesting one because I think that, so over the course of my 15, 16 years in the industry, when I started, social media was helpful in certain respects, but I think the zenith of the usefulness of social media to an investigator was probably around 2016, 17, sometime around that period, and then the Cambridge Analytica thing happened.

And there was a sort of you know, repercussions for Facebook in the sense that they took a much more active role in restricting access to that person's data on Facebook. So, you used to be able to do a thing called graph search, you could access a whole bunch of information for people without their knowledge. And it was, you know, just accessible, but that's not the case these days.

So in terms of social media access, I think we're coming down the other side of it in terms of the average person out there. Their account is more restricted than what once was in terms of what an investigator can access. But you know, that's only a, Facebook's only a piece of the puzzle. Social media is only a piece of the puzzle. There are a lot of different ways to get access to people's information.

And you have to be, look, to your question, you have to be pretty savvy to know information you're putting out there, to actively restrict that information or access to that information. And in the event of a data leak, such as we've, I mean, we've seen multiple data leaks of a lot of people's information over recent years, and that's only going to continue. They're saying that, you know, in the AI era, there's going to be really advanced hacking and leaking platforms and techniques out there.

So once you've been hacked or once your details have been leaked, then what do you do then? So it's sort of a multifaceted response that people need to employ to be careful. I did read once, one guy I read about, he said what he did is for every service provider, he used a different email address so that when started to get spam emails, he knew which provider had been compromised. So, if you want to go to that extent, you can, but I don't do that myself personally.

Gareth King (07:19)

No, look, I, I've actually thought about doing that myself because you know, recently I've been using what I consider my professional account for a lot more things. And I'm finding that, as you said, more and more spam is coming through there, but I was just like, I can't be bothered, you know, making like a different email for every time.

But beyond kind of email database, social media, kyou now, browsing the internet etc, there's obviously a lot of ways that we are interacting and engaging with technology that is leaving some of that digital record behind us. What would you say, are some of the lesser known ways or, or the ways that people may not be aware of that we're just constantly adding to and creating that digital trail of ourselves?

Lachlan (08:04)

Well, it's probably to some extent an interplay between the online and the offline world, in the sense when we're doing an investigation into a person, whether if we're locating a person or we're doing a background check or an asset check, or we're just trying to answer specific questions that our client has posed in relation to a particular subject, what we do, the majority of the work that we do is twofold in that respect.

Firstly, we'll do searches on databases. When I say a database, what I really mean is a subscription database. That's a database where you pay a fee to access it. An example that's probably easy to understand is land titles. So, if someone has a registered interest in land, like they have a proprietary ownership of a property, in almost all circumstances, their name will go on land titles. So, we can search under the name, you know, Lachlan Jarvis or Gareth King, and see if that person owns land in a particular jurisdiction in whatever state they might live or where they invest or whatever.

There are a range of different databases that act in that manner, and there are some general ones that we refer to as public record databases. Now, we don't know where they get the data from. They won't tell us. We've asked them. I think they've gotten it perhaps from, from things like electoral rolls, postal redirection services, maybe mobile phone providers. The truth is I don't know. But when taken as a whole, those databases are quite useful in getting access to information. So that's not necessarily something that someone's done from a digital footprint perspective. It may have been because we don't know, but it could be just their general behaviour, you know, moving to a new address, signing up for utilities, getting on the electoral roll, signing up for a mobile phone. That data is then, whatever sources that data comes from, it's then put on these databases that investigators can then access to use, to build a picture of a person in the course of an investigation.

The second arm of that element is what's called open source intelligence, things that are not necessarily a database in the sense that you don't have to pay to access them. Google, when I started, results on Google were not bad, but they're better than they once were. People's sporting results, if they go out and play football or soccer or cricket on the weekend, then they might be listed in a sporting results. If they have posted on a forum in the past under their own name, they might be listed. If they've sold something and they've listed their mobile phone years ago, that might still be listed. Their photograph might've been taken in a local newspaper and that might still be online. And you know, a lot of people might not even know that that information is up there, because they might not know how to search properly to uncover it.

But that's the job of an investigator is to uncover that. That’s where we've seen a lot of information pooling, so to speak, in the sense that it is a digital footprint that is accessible and it might come from online activity, it might come from offline activity, it might come from both. Once it's there, it's probably there forever, but not in 100 % of cases.

Gareth King (11:12)

Yeah, that's a good point there around, once it's there, it's probably there forever. And leads me onto another thought as well, these right to be forgotten, you know, laws and regulations, but even just before we get into that, when I've looked into this open source intelligence myself, I remember stumbling upon a page that had all these tools on it that I'd never heard of.

And I just put my own name into it and saw what it gave me. And it was so many things that I'd completely forgotten all about. Whether it's things that I'd registered for online or, sometime I gave an old email in 2008, you know, and so I can imagine that people have just got so much of that stuff because we do need to sign into and register for almost everything now, that it must take an insane amount of vigilance to stay on top of all of that.

But yeah, back to the, that right to be forgotten laws, are getting a little bit more traction, and they sound like something that if you sign up to it, like you almost vanished off the internet, like if you just took it at face value, that's what it sounds like. What's the reality of these things? Like if people are signing up to, to I guess this service, what is it actually doing for them?

Lachlan (12:20)

Well, the right to be forgotten is, as I understand it, primarily a European concept in the sense that I think that it's part of the, Europeans are quite pro privacy. So, they have laws they've instituted in the last five to 10 years about, disclosure about cookies and things like that. And then they have this right to be forgotten.

And if you go to certain areas in particularly privacy conscious countries like Germany or France on Google Street View, you'll see whole streets that are blocked out because people can submit to remove themselves from the internet. That's not so common in, I mean, there are a few places here and there that you see it in Australia or the US, I mean, US is more pro-disclosure, European is more pro-privacy. We're a little bit in the middle in most respects, but we haven't adopted the right to be forgotten in any broad sense.

You can make application to search engines in certain circumstances to have things removed. For example, if you think you're being defamed, there were cases, if I recall correctly, where Australians were able to have their details removed because the listings were defamatory. So if there's a civil action basis for a removal in Australia, you might be able to do that. Whereas in Europe, I think it's just perhaps a general right to write and have your information removed. But you can't quote me on that, but it doesn't have a great deal of applicability to what I do, because most people are generally not aware of what's online about them, certainly not in the databases in most cases.

I was speaking to a, I had dinner with someone I know the other day who I hadn't seen in some years. He’s a barrister and he was working on some cases involving some organised criminal activity. And he was telling me about all the precautions that he takes and he even goes to the extent that when he's driving home, if there's someone directly behind him, he goes around the block to make sure they're not following him to his house. And so, I said to him, well, look, I'll run a few searches on the databases, on the public record databases to see if your name comes up anywhere, because he wouldn't know that that's there. So that's something that we occasionally do for people if they want to see if there's information available about them.

Gareth King (14:31)

You know, there’s almost like different forks in this road. There is that try and hide from someone bad let's say going after you, but then the other sense is someone bad trying to do the hiding. But even if you're driving a car, like a lot of cars now are very computerised. Are they, are they something that's leaving a trail that's followable. You know, you got your car registered to you. Am I just overthinking it, like do these cars send, where you're going, you know, your geo location and all of that to any kind of database, or is that just me being silly?

Lachlan (15:02)

We provide digital forensic services and have done for many years. And we did our digital forensics guy did some years ago, begin to learn vehicle forensics, which would enable him to access the car's computer and then do a download or mirroring the data, copying the data from the car and then examining it.

That's not something that we really do much of. It would be something that would be applicable in certain circumstances. I think that, I mean, you could set your car to record your location potentially. Of course, you can put a GPS tracker in your car and record your own location. I personally have Google Timeline active. Are you familiar with Google Timeline?

Gareth King (15:46)

No, no, can you explain what that is?

Lachlan (15:48)

So Google Maps Timeline is an application you can activate on your phone. I've had it active for probably 10 years or so now on various phones. And what it does is it GPS records your location, more or less all the time. Now, some people would choose to do that, and other people would say, well, why would you do that?

Well, I mean, number one, Google already knows where I am. I'm almost certain that once I've got a phone and I've got applications on it, Google is gonna know where I am. So they already know. So I'm not losing anything to Google. Number two, had a jury duty attendance notice some years ago. I attended, I subsequently received a fine in the mail saying that I did not attend. I used my Google Maps Timeline data. I took a screenshot of it and sent it to them saying, this is me attending. They scrubbed the fine, they cancelled the fine as a result of that.

So I keep it because I always want to be able to prove where I am because I'm not doing anything wrong. If I was someone who was doing something wrong, I wouldn't advise those people to do it. So in a sense, keeping a digital footprint can be beneficial for you if you have control over the data and if it's not going to be used against you.

In terms of are we working for the good guy or the bad guy. Look, the truth is, occasionally we don't know. We hope that we're working for the right people. And most of the time there's no doubt that we are. But we cannot prevent the possibility that someone might lie to us and use the information for an ulterior purpose. Although we take steps to try to minimise the risk of that.

Gareth King (17:08)

Yeah, look, that's, that's another good point there around kind of the data and lying through the data. And I think that you touched on it a few minutes ago as well around AI and what's going to happen with that. Now, how, do you imagine that that is going to be changing what you do? And then the entire landscape, once that's getting more and more sophisticated, and we potentially are getting worse and worse at discerning fact from fiction?

Lachlan (17:50)

It's a really difficult question to answer because I'm an investigator. So, my, the preoccupation of my working life is to go by the evidence. I'm not someone necessarily who can predict the future. I'm someone perhaps who can anticipate what might happen in particular circumstances and try to allow for that in an evidence gathering capacity. So for a surveillance investigation where we're trying to anticipate what a person might do.

In terms of the effect that AI might have on the industry, I don't know. I really don't know. Number one, I think that the job that an investigator does is not something that can easily be replaced by computers. I'm not saying that it can't be replaced. I'm saying that I think the vast majority of jobs out there would be things that would be replaced before investigations, because a lot of what we're doing is lateral thinking and second guessing ourselves and seeing linkages that, you know, computers at this point in time can't draw, logging into proprietary databases, getting the information, comparing it against what we've got and so on.

So, it could be replaced out. My job could be replaced one day, but I think that's a reasonably far way down the track. In terms of impact it's going to have on, well, in my experience, people tend to rely on computers. And I think that's quite dangerous. I think that people are not good at second guessing themselves and not good generally at uncovering the truth. And they rely on emotion too much in their decision-making process. Emotion should be part of the decision-making process, but it shouldn't be the overriding function of the decision-making process.

And so people will, will defer, I think to computers and the raw computing power. And I think that least in the near term, there's no basis upon which we should be doing that because I think computers are making mistakes and they'll continue to miss that. I ran some basic maths through Chat GPT a few weeks ago and it was completely wrong. And then I asked it, why is that? it said, oh, sorry, I made a mistake. I was, well, why am I using you?

So it will be interesting to see. I'm concerned as other people are, but I'm not an expert, so difficult to comment.

Gareth King (19:55)

We've been talking about a lot of the different ways that people are kind of contributing to the data about themselves online, and this picture of themselves that's being built in all corners of the internet and the digital realm. One of the things that I'd love to kind of get into with you now we've got that understanding of how that picture is being built is, we've all seen, films and scenarios from years past where someone might be trying to escape someone like yourself, an investigator, uh, and they can do it by just simply, changing their name and moving to the next town.

How realistic is the idea of, of kind of reinventing yourself in a new place these days, if you haven't been vigilant from day dot in regards to your digital footprint?

Lachlan (20:54)

I think it's possible. I just think it's a lot of work. So, we've done a few cases. It's not a common request, but every couple of years or so we get a request from a person who wants to disappear. One young woman came to us and she said, I want to get away from my family. If they find out I'm doing this, they'll kill me or whatever. And I had another, not a dissimilar matter where an older woman came to us, middle-aged woman, and she had been a witness to a, I think it was a murder, and the murderer was getting out of prison after 25 years or whatever it was. And so she was choosing to leave Australia and get away. I mean, there are various situations like this. And so in those circumstances, you have to very, very carefully consider what are the ramifications of the advice that you're giving. And is it possible to disappear? I think that the answer is yes, vis-a-vis, for example, your family or a murderer.

Is it possible to disappear from the government? Well, that's a bit harder. If you are a terrorist or if you wanted person, a cartel member or something like and the whole infrastructure of the US intelligence state is after you. I mean, I could give it a go, but I'd struggle to get away, because they have an enormous amount that they can put to that search.

In terms of an individual, look, I think that yes, you can do it. If you're prepared to move overseas, change your name, get a new passport, live off the grid, put clues out to show that you're in a different location than where you are, cut off contact with your family, go through all these steps. Yeah, I think you can disappear. If you are a wanted person by a government, like a large government like the US or something like that, very difficult.

Gareth King (22:48)

Yeah. So I guess, I guess in that sense, it kind of comes down to a few things. One of which is obviously your profile. Is there people looking for you? Are you just trying to disappear for, for a laugh? One of the other things that I think, some people might feel like they're hiding or disappearing, or through using is, we've all heard about, the dark web and VPNs and, privacy browsers too. Do they really work in the way that people think they do, or are they still leaving a trail to some extent?

Lachlan (23:19)

Well, things like VPNs, they're really for specific purposes. That's more or less, VPNs are more for masking your IP address and your identity vis-a-vis your ISP or perhaps the websites that you're visiting, things like that. So, it is sensible to use a VPN and that will potentially help you, but it's not gonna make the a difference if a person who wants to disappear or something like that. There's a whole raft of other things that a person in that situation has to consider.

Advice I do give to people like my friends and family and so on is don't use public wifi. That's not a good idea. Use your data. Don't allow people physical access to your phone. Keep your phone and your devices updated with software updates. Obviously, don't click on links that you receive in emails or in messages that you're not 100 % sure are secure. Don't open attachments from those messages as well. Don’t spend too much time in sites too far off of Google. If you're going down rabbit trails and you're coming across spammy sites, just be wary, I like to access sites generally from Google because Google will generally weed out the sites with malware in them and whatever. It’s a holistic process and that is part of the puzzle if you want to try to limit your risk and your identity security.

Gareth King (24:32)

Yeah, I mean, there's a few good suggestions there and just in a digital hygiene sense. I would never have thought myself about trying to not stray too far from Google. But I guess that that kind of malware and spammy stuff, is that kind of stealing your data or is it installing bad stuff on your device?

Lachlan (25:03)

The purpose of a lot of malware depends if it's specifically targeted at you. So, one of the things that we do is investigate devices for malware. If for example, a wife thinks that a husband has monitored her, he knows things in their family law dispute that he shouldn't know. He might have malware on her device and we'll examine her device and see if there's evidence of malware on there.

Malware online, look, as I said, I think the overarching principle is if you're primarily staying on main websites like social media sites that you're accessing through YouTube, that would be my advice unless you're somewhat of an expert in tech and you can secure yourself in a sandbox or something like that to protect yourself when you're going into sites that are potentially contaminated. And the same goes you're downloading materials for whatever purpose.

Gareth King (25:53)

Right. If I'm, if I've got to, I don't know, put my card details online, like all I do is I look for that, you know, that little padlock secure thing and I'm like, oh yeah, this is safe. And I don't know if that's, that's kind of very naive or I should, I should be a bit more aware about that as well, but that's like quite personal data, which, you know, you mentioned a few minutes ago, there's been a lot of breaches. Like I've had my license and that stuff leaked a few times now and have to get new ones. And it's a pain in the arse. But with all of that data that is constantly being leaked through those breaches, does that often result in the need for like new clean identities like overall, or is it simply a case of you can just get a new license with a different number and be safe?

Lachlan (26:41)

So, I have read stories about people who have been severely impacted by identity theft. So, for example, like you, their details have been leaked online through no fault of their own, through the fault of a government department or a company that they've signed up to for one service or another. And in those situations, sometimes it can create, I don't think it happens a lot, but when it does happen, it can be a terrible thing to go through.

People can, hackers can potentially use your details to access your existing accounts. You know bank accounts or phone accounts or whatever, or they can use your details potentially set up new accounts under your name, which can then affect your credit rating and whatever.

So If someone is being severely affected in that sense, then they might want to consider changing their name That would probably be the easiest way to deal with that if you’re experiencing a serious issue, because you can say, well, from, you know, the 1st of August in 2025, my name was changed to Bob Smith, so any new account set up under my old name, they are not related to me. And I can show you the proof of that. That's an extreme measure, but it's something that people might want to explore if they're severely affected.

But typically changing names would be if you want it to disappear, it's not, not saying that's the only reason why people change names, but that is, one reason. Something that we're asked to do fairly regularly is to find an old high school sweetheart, for example, or a childhood sweetheart, and that per, if it's a female, quite often, if they're in their sort of, you know, 60s, 70s these days, they might've changed name once or twice since then. And that can be quite hard to the trail of. So changing names certainly does make the trail a bit harder to follow. Yeah.

Gareth King (28:29)

Yeah, that's an interesting example there, like tracking down your old high school sweetheart with a potentially few different names. Just on the topic of changing name. Is it possible, well, theoretically, is it possible for someone to create or change a fake name, make a fake identity, flood the internet and everywhere with it and send, you know, anyone that's trying to find them off on that path? Like how, how can they distort the landscape that they're in by kind of just flooding the zone, so to speak?

Lachlan (29:01)

Yeah, that would be a tactic you could use. So if you had a serious situation that you wanted to escape from, you could use that, you know, bait, so to speak, as a tactic to give someone the impression that you're somewhere that you're not and that you're using a name that you're not using and so on.

Once I gave advice to a person who wanted to disappear and they had intended to move to the US. And they’d intended to adopt a distinctive name. And I said, well, this is not a good strategy. Number one, if you're going to adopt a distinctive name, it's going to make it any results online that relate to you are instantly going to be identifiable. So that's not a good idea. If you want to change your name, change your name to a common name.

And they had intended to move to the US. And the US is not a good place to move to if you want to disappear because they have access to a lot of information there. Whereas, you know, jurisdictions, there are some jurisdictions where we can't access information about people like Iran or Saudi Arabia or whatever. So you would be better adopt a common name and move to a location where it's harder to find people where information is not so accessible.

And you might want to, you know, use a country as a, if you're really serious, you might want to use a country as a stepping stone. So you'd go to, Laos or something, get residency, whatever, change your name there, and then move on somewhere else and live there under the new name. And so that's going to start to become quite hard for someone to track over time. Governments, as we've said, governments are an exception. But even a government, if you were really careful about it, and you lived in a rural area, and you didn't have digital devices, pretty hard in a lot of cases to track someone who’s really putting in the yards, the hard yards.

Gareth King (30:48)

And all of that does sound like it is a lot of hard yards. What that makes me think about is, well, if you are potentially putting in all of those secretive hard yards and all that planning, how quickly can it all be undone by something like facial recognition software and technology?

Lachlan (31:10)

Yeah, that's a good question. It depends on whose facial recognition technology you're being captured by. So I know that in the UK, the government, the police are trialling it. I've seen videos of that. personal belief is that's terrible, but everyone can form their opinion about that. And I think that some shops are using it and businesses are using it. I'm less concerned about that, than I am about the government using it because the government significantly more powerful than just one corporation, even if it's a big corporation.

So yes, facial recognition software is going to be used by at the very least, intelligence agencies and governments. But I mean, an American government, I think wouldn't have access to facial recognition technology in China, for the most part, unless their hacking is doing the right job or North Korea or Iran or something like that. So, I think it can be defeated, but yes, that's a good point that you make. It's getting harder over time. I think probably there are lots of airports around the world that are probably sharing that kind of information already that we don't, we wouldn't know about and probably public places as well where that's being sucked up. So, start wearing an eye patch, I guess is the get it, get in early.

Gareth King (32:26)

I think one of those, one of those interesting points there around in stores, you know, I remember, when people noticed that Bunnings was doing and it would, they’d have these little a four signs at the gigantic entrance to these stores. You know, the other, the other instance is I remember when they started scanning, say your ID to go into a bar or a club or something like that. But just on point of the software sharing and the data sharing, hypothetically, if you were say trying to get out of a, say a five eyes country, would you go outside the five eyes and that would be easier or doesn't really matter where you're going?

Lachlan (33:03)

If you're trying to disappear. Yeah, absolutely. Yeah. First thing I do is, is get out of the West. I mean, private investigators are not really legal in China, for example. I mean, let, let's say one of these people who's come to me and said, I have to get away from these people in Australia because I fear for my life. China would be a consideration. I guess one of the problems with China is that in certain locations, you might stand out a bit. But are locations, some of the locations I've mentioned where it's more rural, less developed, easier to live off the grid perhaps. The governments are not necessarily friendly to the West. And if you wanted to escape, they would be good places to go. Obviously there's a lot of work involved and you'd need time and money to make it happen. But if you had patience and you were willing to stick to it, then I think you could make it work.

Gareth King (33:57)

It is possible. I mean, interesting to know for anyone that might be thinking about that. But you mentioned as well a couple of minutes ago around, guess, the power and the resources of the government in this sort of stuff. One of the things I've seen a lot of people talking about is the kind of the purpose of this digital ID like a government issued digital ID. Are they overreacting or is something that people should be cautious of before signing up to something like that?

Lachlan (34:31)

I’m very, very concerned and apprehensive about the extreme centralisation of information that is taking place. My job, as you're aware, is to uncover the truth. And I think that there is no doubt, I've collected in recent years of the last 10, 15 years, instances of leaks of information. And the regularity with which government departments here and overseas do that quite remarkable. There are very, very, very regular breaches of personal information, citizens' private information, by government departments. And that's a real concern. And the more that it becomes centralised, the more data will get leaked. And with facial recognition and digital identification, there's an increased likelihood that very important personal information will be accessible and with ulterior motives will be able to use it for malicious purposes.

And it's also resulting in a power imbalance between the citizenry and the government. If the government has all the information and the citizenry has access to very little information by comparison, and Australia is not a country where the government feels compelled to disclose things compared to the US, for example, where they do have more of a policy or a tradition of disclosure. In my opinion, it’s pretty totalitarian where we're headed. So it's not a, don't have a positive take on this one, unfortunately.

Gareth King (35:56)

No, look, that's good to understand from somebody that's in the know as well. And you raised a really good point there that governments are seemingly leaking, breaches more and more. Are they, a more in demand target simply because of what is in there that, you know, people on the outside trying to get in could access, or do you think it happens more through incompetence?

Lachlan (36:20)

One thing to keep in mind about the government is that it's made up by a lot of individuals who are just humans like you and me. And a lot of the instances that I've seen are as a result of people selling information or illegally or improperly accessing government information that they then pass on to someone who shouldn't have it.

There's also negligence, there's also espionage, there's also other situations. And obviously, you know, the government's an enormous state and federal government in Australia. That's a lot of people who are employed. So obviously there are going to be problems. But I don't think there's really an appreciation by the government and by the general population how valuable this information is, how much of it has already been leaked by the government, how when it is leaked in the private sector, we don't necessarily have great regulation around how that's managed and how people are supported. So, it's a little bit like the Wild West and the sheriff is kind of out of control.

Gareth King (37:23)

Great. Super positive.

Lachlan (37:25)

So move overseas and hide and change your name immediately.

Gareth King (37:30)

Awesome. So we'll all be doing that. But just on that point there, you mentioned how valuable that information is. Is there certain bits of information about somebody that are more valuable than others?

Lachlan (37:41)

Yeah, well, things like date of birth can be useful. An email address can be useful because it can be used to trick you into, let's say your email address was caught up in a leak, someone can pose as the company that was the victim of the leak, that released your information inadvertently and contact you and say, we've got this briefing, read this, and then they can get access to your email if you click on that link and enter your details or access your account, for example.

These are sort of worst case scenarios, but any personal information can be used to help build a picture of someone. For example, if I get some information, then I find other information online about you. I now potentially, or I hire an investigator to get more information about you, I potentially have a picture of you that I can use for improper purposes if I want to.

I mean, the good news is that a lot of it is just sort of scatter gun approach, you know, that hackers get access to information, they sell the email addresses online and then, you know, scammers or spammers or whatever can use those email addresses to try to target you for malicious purposes or whatever.

But if you've had a whole bunch of information leak like passwords and credit card details and license number and photograph and date of birth, then you need to be really careful and take appropriate measures, because like changing your license number or whatever, maybe changing your email address because you might be targeted or those details might be used to then set up other accounts as we've said that makes it appear as though you've done something that you haven't.

Gareth King (39:14)

Right. Yeah. I'm just thinking about how many alerts that I've got that my passwords have been, in a breach or a leak, and that's something that feels like it happens to everybody. And most people I speak to about it, they're just quite, you know, myself included, I'm quite blase about it. Is this something that we should be just really vigilant with overall?

Lachlan (39:34)

You should try and have an understanding of it. I know it's a pretty, tech security and that kind of thing is it's a pretty dry subject. I don't find it particularly interesting, you know, remembering to update my phone and do all that kind of thing. And you remember a few years ago, Albo said, turn off your phone each night because that helps defeat the hackers and whatever else.

So, so there are, what I try to do is I because I'm in the industry and generally people should try to do this if they can, is they should try to read the news articles that relate to this kind of thing. If they do read the news or listen to the news or get on the algorithm on social media about this kind of thing, it does help because it just gives you a broad appreciation for the types of risks that it can arise. You know, don't reuse your password because if your password gets leaked, they'll use it to log into other things that you've used that email address for potentially, and then that can result in someone getting access to your account.

So you do have to kind of spend the boring, five to 10 hours to kind of learn about this, and then, ideally read the odd news article as it comes up or whatever comes up in your feed about it, just so you know what's going on, just so you won't be one of these poor people who ends up on today, tonight or whatever, who's lost their life savings because they, they took a scam call from someone.

Gareth King (40:49)

So much to think about. What are some, easily done immediate steps that people should take to not only minimise their digital footprint and gain a bit more control over their online privacy, but potentially also protect themselves? Like what should they be considering from just a general digital hygiene sense?

Lachlan (41:09)

Sure, so it's the things that we've discussed today. So, number one, what we've just discussed is a bit of education. So, it helps to understand what's involved, what is taking place in the general public. I mean, are people's details getting leaked? Are your details leaked? You can go to haveibeenpwned.com and enter your email address and see if your email address has been compromised. So, when you know a bit about it, it's easier to manage because you know what kind of things not to do.

We’ve also mentioned not straying too far from Google results. If you're browsing the web, just be mindful of the websites that you're going to. Don't click on attachments that you get in messages or emails unless you're comfortable that they're secure. Don't use public wifi. Keep your systems up to date. Install updates on software programs that you use. Pay attention to notifications that you get, whether in your email or on your desktop or on your device about security compromises or security weaknesses that have been identified by Google or Apple on your device or your accounts. Use difficult passwords. Don't reuse passwords. As Albo says, turn off your phone apparently each night. I don't know what difference that will make.

Gareth King (42:23)

I've never heard that one.

Lachlan (42:26)

Be mindful, could someone physically access your device? If you're subject to a break-in or something like that, could someone have accessed your accounts or your devices? Could they be logged into them? Keep a PIN number on your phone. Once you're offline as well, don't allow people access to sensitive documents in your mail. Keep a lock on your letterbox. Shred mail before it goes out.

Just be mindful, just do the things that you think should be done. Allocate a bit of time to understanding what's involved. AI is gonna change all of this to some degree, so be prepared for that. Spend the few hours that you need to to learn what's going on, as I said. And try to be boring if you can be. Don't be too extravagant online and sharing information, obviously.

Gareth King (43:09)

Awesome. Thanks so much Lachlan. That’s incredible to hear all of that information. I almost feel a little bit weird about asking this next question that I ask every guest, but what’s on the horizon for you and where can people follow what you're up to?

Lachlan (43:25)

Sure, yeah. So I work for a business called Lyonswood Investigations and Forensic Group. The website is investigators.net.au I've been a private investigator for a long time. I'll probably be a private investigator for a reasonable period of time from this point onward. There is never a shortage of people doing the wrong thing, unfortunately. So, it keeps me busy. And I enjoy learning and solving the case and trying to get the truth.

And, as you mentioned earlier, we live in a world where AI is going to make it hard to identify the truth. I mean, we're seeing that in videos now, you know, there's videos that are coming up in social media. No one knows if they're real or not. That's going to be pretty tricky. So, I guess that the need for people who can identify the truth will exist and continue to exist. And hopefully I can do my part to help people who need to identify the truth.

Gareth King (43:59)

Fantastic. Lachlan, thank you so much again.

Lachlan (44:18)

Appreciate it. Thanks, Gareth.