JediMercer.com

Privacy concerns are riding high in the media currently, thanks to the high-profile data breach cases with the Veterans Association, AOL, AT&T and others. I’ll just note quickly here that these events aren’t really new, its just general public awareness is increasing. Which is good.

Privacy is a fickle thing in the United States. Unlike many other first world countries, we have no explicit guarantee of privacy rights, though many interpret parts of the constitution as such. Courts all over the land are involved in cases that (re)define privacy rights and law in the USA.

The single biggest issue with privacy rights in the US is having a clear definition of what privacy is. What sort of actions, information or things
can be said to be private? Privacy is deeply tied to social morés and subjective opinions. Often we Americans will go about our daily business with the assumption certain aspects of our lives are private, and others may not know about them. Yet in reality those parts of our lives are publically accessible. Once enough little pieces of information are put together and correlated, a surprisingly personal view of someone’s life can be presented.

OK, that’s enough musing, let’s get into the fun stuff!

Here I’ll demonstrate precise methods for obtaining detailed information about a person or organization using commonly available tools on the Internet. Note that everything done here is fully legal and involves accessing publically listed information, albeit obscurely defined.

For my target I’ll use the folks here at Gather.com. Since it’s a for-profit company with a very publically-oriented business model, we’ll consider anyone tied to the company fair game. I guarantee you before I even start that I’ll be able to get at least some personal information about at least one individual in the employ of Gather.com

First off, we’ll be gathering raw data using whois. For more information on whois (I strongly recommend reading up on it), see this Wikipedia article:

 

I’ll remove the Network Solutions legal boilerplate from the data I extract to
save space, but note that Network Solutions only forbids mass reaping of their database. They don’t say anything about what you can or can not do with the
data, and the policy doesn’t even mention privacy.

Here’s what Gather has on-file with their domain registrar for gather.com:

 

Now I’ve got a postal address for the company, which is presumably their headquarters. I also have a phone number and an e-mail address. Notice that the e-mail address is a personal name? That’ll be used later for people searching. But the e-mail address also reveals another domain name, gatherinc.com. So let’s get the whois data for that one as well:

 

Pretty much identical with the exception of the nameservers and registration dates. We can see that gatherinc.com was registered first, than gather.com. And while gather.com hosts their own DNS, gatherinc.com stuck with Network Solutions for nameservers (How do I know that? Hint: do a whois on worldnic.com).

For my next whois query, I’ll use the IP address of one of the gather.com nameservers. Since the nameservers for gather.com are listed as “ns1.gather.com” and “ns2.gather.com”, it’s extremely likely that Gather Inc is running their own nameservers. So the IP address for the nameserver is probably registered to Gather Inc. Let’s check ns2.gather.com first:

 

Hmmm, looks like the IP is registered to Verizon. Note that ns2.gather.com is a secondary DNS server. Its common (and good practice) for a company to put their primary and secondary nameservers on wholey separate networks  (Less impact from provider outages as well as denial-of-service attacks). Let’s check the IP address of Gather Inc’s primary DNS server, ns1.gather.com:

 

Ah, now we see that Gather, Inc. has their own set of IP addresses assigned to them by a service provider. CERFnet has four class B networks (The 206.16.0.0 to 206.19.255.255 bit). CERFNet than sub-delegated half a Class C to Gather, Inc. (the 206.17.100.0 to 206.17.100.127 part).

However, there’s not much info from here. All we can deduce is that CERFNet is providing network services to Gather, Inc. This report is abbreviated as its just for a single IP and only shows what net block the IP is associated with in ARIN’s database. Let’s do yet another whois query on that netblock name:

 

Now that’s a lot of information. Unfortunately, we didn’t get much of anything on Gather Inc. itself. All of the e-mail contacts listed are for AT&T and if we call any of those phone numbers, we’ll most assuredly get an AT&T representative (well, a voice response unit anyways).
If you are wondering why all the contact info for the netblock is for AT&T when the owner is Gather Inc, its because AT&T owns the parent block. They merely delegated the sub-block to Gather Inc. CERFNet turns out to be simply a branding for some of AT&T managed Internet services (Hint: Do a whois on cerfnet.net or cerfnet.com).

But we did learn one useful piece of information. This block of 128 IP addresses assigned to Gather Inc was assigned on July 21st, 2005. The gather.com and gatherinc.com domain names were registered in Feburary of 2005. That means one of two things, either the domain wasn’t put into active use until July of that year, or Gather Inc changed service providers in July.

OK, let’s do a little bit more probing about Gather Inc’s infrastructure and then we’ll go looking at other sources of information.

Let’s see if Gather Inc does their own website hosting by doing a DNS lookup of their website name:

 

Yep, the IP address returned is within the 206.17.100.0/25 netblock assigned
to Gather Inc. No real surprise there. But let’s do a reverse lookup on that
IP address and see what we get:

 

When we check to see what name is associated with the IP address for their webserver, we get the hostname mail.gather.com. Keep in mind that reverse DNS data isn’t automatically synched to forward DNS, it has to be manually updated.
If this DNS result is accurate, it implies that both e-mail hosting and web-hosting for Gather Inc runs off the same server.

In reality, that’s not necessarily true. It possible to have a single “Virtual” IP address that maps to multiple alternative addresses. So e-mail and webhosting may indeed be on separate servers. And frankly, I’d hope that they have more than one actual server for the website, :)

Let’s investigate the mail services a bit more. DNS lookups are good for this as Internet e-mail is strongly tied to DNS services. Any domain name that supports incoming e-mail must have a special DNS record that indicates what server or servers accept e-mail. So let’s dig that up:

 

Yep, mail.gather.com has the same IP address as www.gather.com. We can also see that they have only one Mail Exchanger (aka MX) record for their domain. This isn’t a good practice, since they’ll lose incoming e-mail forever if the Gather Inc e-mail server goes down, or simply becomes very busy. They should have a secondary MX record pointing to a mailserver on a different network. (Oh, and notice we are told there are THREE nameservers for gather.com. Just another little tidbit for us.)

Let’s see what sort of e-mail server Gather Inc uses, shall we?

 

What we did here was connect directly to the Simple Mail Transfer Protocol (SMTP) port on Gather Inc’s mailserver, and issued the standard SMTP command “HELO”. That command is the beginning of any e-mail exchange sequence. The response we got back gave us two VERY useful pieces of information:

1. We know that they are using Postfix for their e-mail servers
2. There’s a host in Gather.com named “thompson” that runs e-mail

Let’s do a DNS lookup on thompson.gather.com, why don’t we?

 

The IP address is within Gather Inc’s netblock, but it’s a different IP address than mail.gather.com and www.gather.com. This supports the theory that they are using a Virtual IP. Let’s do a reverse DNS check on that new IP address:

 

This is quite useful. “uhog” is more than likely the actual name of the server here, as used internally. This, along with the “thompson” hostname gives us a little peek into the naming convention Gather Inc. may use for all their servers.

That’s about as much as we’re going to get by looking at Internet infrastructure resources. There’s many other websites we can use to get additional detail.
We can use Google Maps or Google Earth to get satellite imagery of where their office is located. We can use http://www.archive.org/ to view the earliest incarnations of the Gather.com website (http://web.archive.org/web/20050305181704/www.gather.com/careers.html). We can use Google’s Groups search to look for postings made with a gather.com e-mail address.

Let’s review what we’ve compiled so far:

Gather.com is run by Gather, Inc.
They’ve registered the domain names gather.com and gatherinc.com.
Their primary postal address is 85 Devonshire St, 3rd Floor, Boston, MA 02109.
Their voice phone number is 617-720-4000.
The main e-mail contact for domain registration is russ@gatherinc.com.
The domain names were registered in Feburary of 2005, with gatherinc.com being
registered before gather.com.
They get their Internet access from AT&T CERFNet Managed Internet Services division.
They host their own e-mail, web and DNS services (or at least appear to).
They changed service providers, or made some major change to their existing provider, in July of 2005.
They have no backup e-mail server to handle inbound e-mail during outages.
They use Postfix for their incoming Internet e-mail.
They have servers with the names “thompson” and “uhog”.

================================================================================

Now its time to try and find more about the people behind Gather Inc. We didn’t glean much contact info from our first pass but we did get an e-mail address to start with. Let’s do a search on the e-mail address “russ@gatherinc.com” using the Google search engine:

 

No standard web pages containing all your search terms were found.

Your search – russ@gatherinc.com – did not match any documents.

Rats. Let’s try doing a search of Usenet newsgroups:

 

Your search – russ@gatherinc.com – did not match any documents.

Double rats. Searching Google Images and Google News also did not turn up any results. Now there’s a LOT of search engines out there, so sometimes you just need to be persistant and do hundreds of queries across lots of search engines. But thats time consuming, so first lets try a simple change to the query. Let’s search for “russ@gather.com” instead:

 

Ka. Ching.

Of course Russ isn’t an uncommon name, and Gather Inc has a lot of users. I’m sure there’s more than one Russ registered with gather.com. So how do we know any of these results are for the same Russ as “russ@gatherinc.com”? The very first result is for a Russ Barbour and his Gather.com page. Let’s just check the webpage out:

 

Right under the picture of Mr. Barbour is his hometown: Boston, MA. That’s the same city that the Gather Inc. headquarters is located in. So that narrows the field a good amount. But Boston is a big city, there’s bound to be lots of guys named Russ there.

Just underneath the picture of Mr. Barbour and his home city it lists his memebrship dates. Russ Barbour registered with Gather.com on August 31st, 2005. We know that the domain was registered in Feburary of that year and switched to CERFNet in July of 2005. How long was the website up before Mr. Barbour signed-up? Well we can do some websearches and try to determine when Gather.com actually opened their doors to the general public:

 

The very first result looks promising:

 

According to Gather Inc’s own press release, they launched the website for the general public in November of 2005. So Mr. Barbour was registered three months before than. At the very least, he was a beta tester. But the odds are very high
this is the same Russ Barbour who actually works for Gather Inc.

Of course we should check Russ’s own page for more information! Let’s look at all the articles he’s published:

 

Gee. Two whole articles. Well lets look at the first article:

 

That’s interesting. The date the article was written is listed as August 5th, 2005 and yet Mr. Barbour registered on August 31st. I won’t get into the many
ways such an artifact can occur (Hint: Databases lose consistancy when data is managed outside the primary applications that use the database).

Let’s see what comments Mr. Barbour has left on other peoples articles:

 

Well, duh. Now we feel a bit silly because the commentary makes it clear Russ Barbour not only works for Gather Inc, He’s the Chief Technology Officer. It’s likely that veteran Gather.com users already know that. But then, we’ve just proven that even someone utterly ignorant of the company and its people can determine the identity of the CTO with a whois lookup and a few web searches.

The initial web search we did on “russ@gather.com” listed a lot of different pages for Gather users. Several of them had the same last name as Russ, so maybe they are relatives?

 

Penelope Barbour hasn’t posted any articles, images or comments. But she’s been a member since May, 2006. She’s got Russ listed as a “People”. And she resides in Natick, MA. So at this point we don’t know if she is a sister, daughter, wife or mother to Russ. But she’s bound to be related.

Andrew Barbour has some amount of content on his Gather.com page. He’s been registered since August 31st, 2005, same date as Russ’s registration. Andrew’s place of residence is listed as Framingham. Again, we can be pretty sure it’s a relative. I’m going to suggest its his son, due to the Anime theme in the pictures.

Which begs the question, how old is Russ Barbour? His photo shows a man with some graying hair, definitely beyond his 30’s. But some folks look older than they really are, and age more clearly than others. Well if we go back again to those initial web search results for russ@gather.com, we’ll see one of the pages is the Gather.com About page:

 

Since we can be pretty sure Russ wasn’t doing software development at the age of 5, we know he’s well over 38 years old. Let’s say he was 18 years old at the time, making him 56. Of course he may have started earlier or later than that, but we can be confident he’s a man in his 50’s. Which fits with his career level of being a Chief Technology Officer.

What else can we find about Mr. Barbours history? The Gather About page gives a nice little summary of his career, but is vague on details. We can get more details using another search engine called Zoominfo:

 

Not all of the people listed are the Russ Barbour we’re interested in, but we know some of his career background. The Gather About page mentioned he worked for Advanced Visual Systems, so we can be confident this is the same person:

 

That page largely confirms what the About page tells us, though we do get to see some other people who worked for Advanced Visual Systems (that may be useful later). The links are mostly for press releases, but here’s one that’s quite informative:

 

Towards the bottom there’s a “Member Company Spotlight” that gives us some more details about Gather Inc:

 

We already knew Gather was based in Boston and of course we knew the URL. But now we know who the CEO is, the date they were founded and number of employees. The January 2005 date dovetails nicely with the domain registrations. Presumably the company was founded with just a basic premise. Once they decided on a brand name, they registered the domains immediately. But they didn’t go online with AT&T as their provider until July of 2005. Before that there was probably a lot of internal testing and development.

================================================================================

Now let’s get really invasive and see if we can find where Russ Barbour lives. Again, this is all done legally. However, socially this sort of behavior is generally unacceptable. I do NOT recommend doing this yourself unless you are willing to deal with potential social consequences
There’s a lot of search engines for finding people, such as:

 

to name a few. Many people searching websites give no results or are a maze of redirects trying to get you to fork over money for information that’s publically available. So we need to be careful, and not fall for any flim-flammery.

Let’s do a search from USSearch.com on Russ Barbour in Boston, MA. The ussearch.com website requires an age, but forutnately we already know Russ is in his 50’s. So we’ll plug-in 55 and see what we get:

 

Now we won’t click any links here because all this site wants is for us to pay them $30 to get what we can find in any phone book. But we can correlate this listing of results with other information we already have. For one thing, there’s no Russ Barbours listed for Boston, MA. But there are several listed for Framingham, MA. Does that sound familiar? Framingham, MA is where Andrew Barbour lives, according to his Gather.com webpage. While Russ is registered as being in Boston, it’s quite likely he lives in Framingham and simply listed Boston as his home city because its where he works.

One of the entries listed on the USsearch.com website is for a “Russell Gray Barbour” in Framingham, MA with an age listed of 55. Since that correlates two pieces of information we have independently verified (age and a city of residence for a family member), the odds are high this is the same Russ.
Let’s see what we can find on “Russell Gray Barbour” on another people searching engine, ZabaSearch. This is a meta-search engine that indexes results from other search engines as well as various municipality databases. We’ll use the advanced search page and plug in 1951 for Russ’s year of birth:

 

We get two hits for a “Russeel G Barbour” in Framingham, MA, with two different addresses and phone numbers. These could be two separate people, the same person with two residences or simply the same person who’s moved (A common problem with people searching is getting hits on older places of residence). Let’s just search for “Russell Barbour” with the same parameters:

 

Pretty much the same results, which is good. There’s not even a dozen Russell Barbours in all of Massasachusets. None of them listed live in Boston, but we have two for Framingham, MA. We’re going to assume that Andrew Barbour is Russell’s son and that they live in the same city, if not under the same roof.

The best search engines for locating people our local ones, run by regional governments. If we click on the County link by one of our search results, we get information about the county that Framingham is in:

 

Which shows us several useful websites:

 

Of course Mr. Barbour isn’t dead, but he may have descendents buried in the area. That can be used for verification of identity, but we’ll skip over it for and look at the land records. In pretty much all states, sale of land is considered a matter of public record. We should have enough information now to find Mr. Barbour’s records.

The Zabasearch.com website showed us that there are two possible counties for the zipcode of Russell’s potential address, North and South Middlesex. The map on http://www.masslandrecords.com/ main webpage shows Boston is right there in South Middlesex. So we’ll search there first:

 

We’ll select the “Recorded Land” radio button, put in Barbour for the last name and Russell for the first. Set the town to FRAMINGHAM and leave the recordered dates at the default. Click the Search button and…

 

Each of the names is a link. The amperand notations are not immediately clear to me. SO lets look at the first link:

 

We get a page saying the document in this case is a 1994 affidavit regarding “67 & 69 Re Carter Drive”. Remember those Zabasearch.com results? One of the entries for Russell Barbour was for a 67 Carter Drive. By the way, the affidavit here gives us the name of Russell’s wife, Jacqueline. It also tells us they sold some land to a neighbor in 1985 for an underground utility easement but the buyer didn’t follow through.

The next two links in our search results are just variations on the same theme. The fourth link however, provides us a list of five documents:

 

To save space and time I’ll just summarize the documents in ascending order of date. In 1983, Jacqueline Kinsley and Barbour Russell bought a house on Carter Drive from a development company. In 1998, they paid off their mortgage with Citzens Bank. In 2002, they sold their home to another couple for $690,000 (and had an $18 unpaid tax “lien” to resolve). In 2003 there’s another “lien” against the property involving unpaid water/sewer bills (probably due to bad billing on the utility company’s part, I’ve seen that happen a lot).

Oh, and there’s a real diamond buried in there. A digital copy of one of the mortgage documents with Citizens Bank, complete with Russ’s signature and that of his wife:

 

Russ and family lived at 67 Carter Drive for a long time but sold it in 2002. So where did they move to? Since there was no record of a purchase by them after that date, they presumably moved to a different county. Unfortunately, searching the South Middlesex county didn’t give any results, nor did Suffolk county.

If we go back to those Zabasearch.com results, we’ll see that the entry for “Russell G Barbour” at 67 Carter Road has a date saying “Recorded: 08/14/2002”. The entry above that is also for “Russell G Barbour” at 150 Warren Road. A date saying “Recorded 4/1/2006” is listed next to it. Is this the same Russ Barbour? A search of the phone number next to the entry turns up a Phonebook result on Google under the name “J K Barbour”, which is our Russ’s wife. So yes, it’s the same Russ.

Let’s do a land grant search on the 150 Warren Road address. We’ll go back to the Massachusets land records website. This time we’ll click on the tab for “Property Search”. We put 150 in for the Street Number, Warren Road for the Street Name and set the Town to FRAMINGHAM. The very first result is dated 7/29/05 and is for a mortgage obtained by Russ’s wife for the property at 150 Warren Road:

 

Curiously, this property is only Jacqueline Barbour’s name, though Zabasearch listed it as an address for Russell Barbour. There’s a variety of mundane explanations for that which I won’t bother to go into here.

Let’s review what we’ve compiled so far:

Russell Gray Barbour is ~56 years old and born in 1950 or 1951.
He has a wife named Jacqueline K. Barbour, who’s maiden name is Marie.
He has two children, one of them named Alyssa.
He resided at 67 Carter Drive, Boston, MA  01701 from 1983 until 2002.
He and his wife sold their house for $690,000 in 2002.
He currently resides at 150 Warren Road, Boston, MA  01702.
He currently works for Gather Inc. as their Chief Technology Officer.

================================================================================

Do you feel guilty or dirty now? Please don’t. Remember, all of the information we’ve found is classified as public knowledge and freely, fully available. It’s simply more convenient to find and correlate. Technology has removed what was once a natural enforcement of social privacy: laziness.

The Chaos Ocean is not going away. We need to learn to live with it, and at least part of that is adopting new social patterns regarding privacy.