Welcome to “Ask a security trainer,” the column where the digital security training team at Freedom of the Press Foundation (FPF) answers your burning questions at the intersection of journalism and security. Submit yours here! Let’s jump right into this week’s question.

Dear DST,

I am used to this, but I am working on an upcoming story that I think may summon more trolls than usual. I won’t be surprised if someone tries to dig up information about me or my colleagues. I have heard of anti-data broker services like DeleteMe, but haven’t used them just yet. Is this something you would recommend to get ahead of doxxing (someone maliciously trying to collect and publish personally identifiable information)? And is there anything else I should be doing as well?

Signed,

Micro Scope

–

Hello Micro,

We always recommend trying to understand what information is out there about you, so that you can make reasonable safety decisions and get ahead of the potential for doxxing. But if you are writing a story that you feel confident will instigate blowback, absolutely, it’s a good idea to see what you can do to remove your information from data broker websites (e.g., Intelius, Radaris). This is also an opportunity to examine your “footprint” more broadly, including on search engines, social media, and more.

Depending on who you are concerned about, they may have different ways of operating and different capabilities to bring to bear to make your life harder. This is why we usually recommend starting with a risk assessment to better map out who you are most concerned about, and what they might be able to do. Your defenses may change accordingly. Read our guide to risk assessment.

You have a unique advantage in that you know your name, address, phone number, and other information that someone would want if they were to try to dox you. This means you can often find the public websites with this personal information before someone else does, and make decisions about how you want to deal with them. (Learn about search techniques to find such websites with this resource from NYT Open.)

Some search engines also allow you to submit a request for removal of results that include your personally identifiable information (e.g., Google, Bing, and DuckDuckGo, the latter of which heavily leverages Bing).

As you mentioned, one of the main places you will also find information about yourself is on data broker services. Unfortunately, in the absence of privacy laws preventing collection and distribution of personally identifiable information, we are often left to remove information ourselves through paid services or through opting out manually.

Trolls seeking to make your life harder or discredit your reporting may also try to dig up dirt on you — for example, unsavory jokes or quotes from many years ago. For this reason, we always recommend searching through your social media footprint. Take an inventory of the places you’ve often posted over the years, even if you haven’t used them for a long time. (These may very well be some of the juiciest places to find dirt.) For a useful shortcut here, read NYT Open’s social media security and privacy checklists.

There are also some tools that can help you automatically remove many of your posts. I’ve personally had a lot of luck using Cyd, which is maintained by FPF co-founder Micah Lee, and helps delete posts on X and Bluesky. Another (paid) option with support for a wide variety of platforms is Block Party. Check that out.

If I walked through everything you could do here, this article would likely need to be a book. To go further, check out this collection of resources on mitigating harassment, and if you are interested in working with our training team on how you can mitigate online harassment risks, reach out.

Best,
Martin