Every day, members of the UBC community handle information that supports teaching, learning, and research. While we’re careful about what we intentionally share online, most of us leave behind another set of data that’s harder to see—our digital footprint.
Your digital identity includes information you knowingly provide, such as your social media posts or professional profiles. Your digital footprint, however, is the trail of information left behind unintentionally as you browse, message, take photos, or use apps and online services. Because this hidden trail can reveal more than we realize, understanding it is an important part of protecting ourselves and the university.
The Invisible Trail: Metadata and Passive Collection
Much of our digital footprint is made up of metadata—data about data. While the content of your actions may seem private, metadata records details such as:
- When and where a photo was taken
- Who an email went to, and when
- How you move and browse on websites
These traces are often collected automatically as we go about our day.
This passive collection is especially common when using “free” online services. If you aren’t paying directly for a product, the business model may involve collecting and reselling your metadata. This information can be extremely valuable, even without the content it describes.
The Mosaic Effect: When Small Pieces Build a Bigger Picture
Individually, a single data point—like a location or timestamp—may seem harmless. But when combined over time, these separate pieces form a larger picture. This is known as the mosaic effect.
By aggregating metadata, organizations and criminal actors can build detailed profiles that reveal:
- Location history
- Personal networks
- Patterns of communication
Experts warn that in many cases, the metadata alone can paint a near-complete picture of someone’s behaviour, even without accessing message content.
Criminal groups take advantage of this by correlating clues such as email addresses, user names, social media profiles, dates of birth, and physical addresses. This process—sometimes called identity mapping—creates a highly marketable profile of a real person. The more complete the profile, the easier it becomes to target that individual for financial or identity-related harm.
These risks may include:
- Identity theft, which can affect important records such as mortgages, driver’s licences, or social insurance numbers
- Surveillance pricing, where companies use behaviour profiles to adjust pricing, such as changing airfare costs based on your device
- Spearfishing, where attackers craft highly targeted messages to deceive their victims
In a university community, these tactics can be used to impersonate individuals, trick faculty and staff, or target institutional systems.
UBC as a Target
Large organizations like UBC can be attractive to criminal enterprises. Personal information belonging to faculty and staff can become a tool for further compromise, particularly through highly targeted spearfishing and CEO fraud campaigns.
Your Vigilance Matters
We can’t control every breach involving organizations we interact with. But we can reduce how much information we leave behind, and make it harder for criminals to misuse it.
By staying aware of your digital footprint, questioning what information you share, and taking simple protective steps, you help safeguard your identity and the UBC community.
Small actions add up. Your awareness and participation make a real difference in keeping UBC safe.