Buy the file: what correlation assembles without a breach

The Internet Replaced Proximity

Locking the Digital Front Door

Federal filings in the June 2025 Minnesota legislator shootings describe notebooks recovered from the suspect's vehicle, including a list of people-search websites. This brief uses that case to revisit a familiar argument about residential exposure, asking which variable actually matters and what address removal can honestly claim. Built from the filings as reported, a Secret Service study of mass attacks, residence-to-crime research and the Daniel Anderl Act. For principals and family offices weighing data-layer work against physical security spending.

After the tunnel: the three pipes a VPN does not close

A VPN Closes One of Four Doors

The standard answer to browsing-privacy concerns is a VPN. Read against the 2024 FTC action over Avast's Jumpshot sales, the 2025 LummaC2 infostealer disruption and the Mixpanel compromise that exposed Pornhub Premium records, this brief asks where browsing history is recorded, by whom, and which of those records a tunnel reaches. Built from regulator filings, Justice Department reporting and vendor retention documentation. For advisors checking a principal's privacy controls against the exposure.

Four-surface browser history collection: the technical detail

A technical companion to CB-070 that takes each place browsing records are collected in turn, setting out who observes it, what is retained and for how long, how records escape, which control reduces the exposure and how an advisor can confirm the control works. Retention figures are tied to dated vendor documentation. For security advisors auditing a principal's current controls, household technical staff carrying out changes, and reviewers who want to test the parent brief's claims against their sources.

The file that was never breached

You Named Your Car

In March 2025 a website called DogeQuest published a searchable map of purported Tesla owners' home addresses, though Tesla had not been breached. This brief traces where the published records came from and asks how such a roster should be assessed, and by whom. Built from the firm's own investigation of the published set, public reporting and earlier documented re-identification cases. For advisors deciding how far an exposure assessment should look beyond a principal's own breach history.