Careful with LinkedIn, dammit

The careerist's platform can be useful to hostile actors

The following was co-authored by Natalia Antonova and James Griffin, check out more of his work here.

Social media has created a wealth of platforms for us to act stupid on. Stupidity, of course, is part of the human condition and all serious opsec analysis should filter that in (even if people don’t like to admit this in mixed company). 

However, when stupidity intersects with national security concerns, it is time for someone to be blunt: NETWORKING ON LINKEDIN COMES WITH UNIQUE RISKS. 

If you’d like a succinct example of what is meant by unique risks, please check out this thread:

Thucydides Traplord @spawnofKahn

We need to have a talk about the shadowy 3 letter agencies and LinkedIn. Please gov employees over the age of 40, just use Facebook and/or Twitter. Y'all are killing me here.

Now look, plenty of people under 40 use LinkedIn — because we’re trapped into doing so by DC culture in particular — but the point still stands. 

If you have a sensitive job, talking about your current workplace on LinkedIn could be a bad idea. 

It doesn’t just expose you, it can expose the people who work around you, and who are more vulnerable. 

In order to show you what we mean, let’s take a look at a couple of Central Intelligence Agency profiles that are supposed to be very public-facing (we’re not going to highlight anyone who’s unaware of potential risks, we’re not playing gotcha here, we’re creating a quick case study):

https://www.linkedin.com/in/jennifer-ewbank/

https://www.linkedin.com/in/randy-nixon-814973205/  

Deputy Director Jennifer Ewbank is the Central Intelligence Agency’s lead for digital innovation, and Randy Nixon is the head of their relatively new OSINT wing. 

It’s not so much their presence that’s the problem, but the larger conundrum created by LinkedIn. On this social network, employees (in this case IC officers) invariably connect with their bosses and other potential patrons for the sake of advancing their careers. 

Lower level analysts and officers may leave out their current occupations, but will still use their full names and are visibly connected on LinkedIn with their more senior patrons. 

At the risk of pointing out the obvious, if your name is publicly available, you’re connected with senior leader(s) on LinkedIn, you don’t have a recent publicly available career history AND your address shows up in the DMV [that’s the DC-Maryland-Virginia area for laypeople], it’s not difficult to infer that you’re employed by one of the three letter agencies, which makes you a potential mark. 

Keep in mind that some potential targets are more vulnerable than others. 

Furthermore, LinkedIn data can be cross-referenced and/or combined with other datasets to detrimental effect. 

Hamfisted attempts by Chinese intelligence officers (who are known for using LinkedIn to look for potential turncoats) are significantly less of a national security risk/danger than the mountains of publicly accessible data possessed by data aggregators. 

If, say, Wikileaks had attached the addresses of the thousands of ICE employees exposed in a 2018 leak (which it could’ve done for about $15), it’s quite likely that ICE would have been instantly paralyzed.

It’s worth pointing out that there are quite a few obvious work-arounds to the issue of LinkedIn if you have a sensitive job. Think of it as adding numbers and letters to a password. 

First, don’t use your last name on LinkedIn (last initials are fine, the search engines used by data aggregators struggle to fill in those gaps), and for the love of all that is holy, don’t use the geographic location of whatever office you work for. 

If you need to keep a presence on LinkedIn and want to get extra creative with your profile without listing your actual job, consider saying that you work for some small business that doesn’t have a LinkedIn profile itself way out in the Midwest (just pick a random store from google maps). If your colleagues and references have any questions, you can explain. 

Here’s another tip: Don’t use a photo that has popped up elsewhere as your LinkedIn picture. This is especially true for people who are on dating apps (what? People in sensitive jobs have personal lives… or semblances of them). Use a unique photo, or just leave it blank. It’s LinkedIn, no one cares.

The bottom line is that LinkedIn exposes professional networks far too efficiently for it to not be a concern. Again, we’re not asking you to go live in a bunker — just consider potential risks, and mitigate them as needed. 

And if you don’t need LinkedIn, if it does not advance your career, stick to easier social media platforms. They’re more fun anyway.