The exercise
On the fourth day of an assessment we run an exposure check on a sample of the roster. The rules are strict: public sources only, nothing that requires an account the player did not approve, nothing that requires pretending to be anyone, and a twenty-minute limit per player. The limit is not for our convenience. It is to show the department what a motivated stranger achieves before lunch.
The player is shown his own results in the briefing, privately. The department is told the category and severity of what was found, never the contents. Most players are surprised. A few are frightened. All of them change something that night.
Where it comes from
- The roster page and the recruiting profile. Hometown, high school, height, weight, class year, a photograph. Harmless, and the starting point for everything else.
- Data brokers. People-search sites compile addresses, telephone numbers, relatives and previous addresses from public records and sell them for a few dollars, or show them free. A player who has signed a lease has an address on one of them within months.
- Tagged photographs. The player's own account may be careful. His roommate's is not. The building number is visible behind him in a video. The parking lot shows his vehicle and its plate.
- Family. A parent's public profile with the family home, the church, the younger sister's school, and a proud post on signing day with the player's new telephone number in the comments because a relative asked for it.
- Class schedules and routines. A post from the same coffee shop every Tuesday at the same time. A location tag on the gym. The study hall the athletic department lists publicly.
- Public records. Vehicle registration in some states, property records, court records, voter registration in others. Each legally public, each indexed by someone.
- Old accounts. The profile from high school that was never deleted, with the home address in the bio and the mother's maiden name in a birthday post.
Who assembles it
Three kinds of people, in the principal's experience. The bettor who lost money and wants the player to know that he knows where he lives. The sextortion group that uses the family's names and the home address to make the threat specific. And the fraudulent agent or fictitious brand that uses the details to sound like someone who belongs in the player's life. None of them is sophisticated. All of them are patient for twenty minutes.
What a department can do
The department cannot and should not monitor its athletes' accounts. It can do four things that respect them.
- Show each player what is public about him, privately, once a year and on arrival. Players who have seen their own exposure act on it. Players who have been lectured about privacy do not.
- Remove what can be removed. Every major data broker has an opt-out process. It is tedious, which is why no nineteen-year-old does it, and it must be repeated because the records reappear. This is the work our optional quarterly exposure service does for a roster, reported to the department by category and severity only.
- Brief the families. The parents' edition of the athlete briefing exists because the family is usually the leak and frequently the first to be contacted. A parent who understands why the signing-day post should not include the telephone number will delete it in a minute.
- Give every player the first-hour card. When the assembled information is used, the player's first sixty minutes decide most of the outcome. The card tells him what to do and whom to tell. It is published on this site for any program to print.
What the department sees
Categories and severity. Never the player's address, the messages, the photographs or the sender. A compliance officer should know that a player is being threatened and that his home address is public. A compliance officer should not be holding a file on the player's private life. Athletes are told exactly what the department can and cannot see about them, and in the principal's experience that is the sentence that makes them willing to report.
Athlete safety briefings · Doxxing and exposure, on the threat landscape