Lesson 5.7

Public Records & Government Data

Learning Objectives

Explain what “public record” means and why governments publish so much information about people and organizations
Identify the main US public record categories (property, courts, business, securities, nonprofits, campaign finance, contracts, patents, equipment, aircraft/vessels, licenses, voter data, FOIA) and what each reveals
Describe how attackers and defenders each use public records
Recognize the legal limits attached to some records (e.g., FEC and voter data use restrictions)
Find international equivalents when a target is outside the US

Why Public Records Matter

Governments publish records so that citizens can hold institutions accountable: who owns land, who is being sued, who runs a company, who donated to a campaign, who won a government contract. The side effect is that these records form one of the most reliable OSINT sources available. Unlike a social media post, a court filing or a property deed was created by an official process, usually has a date, and is hard to fake.

Public records have three traits worth teaching:

Authority: They are often the primary source. A news article might say a company was founded in 2015; the Secretary of State filing proves it.
Aggregation risk: Individually, a deed, a business filing, and a donation record are boring. Combined, they can reveal a home address, a spouse’s name, an employer, and a side business. This is the mosaic effect from the Legal & Ethical Boundaries section.
Uneven access: Every county, state, and country publishes differently. Some records are free and searchable online, some cost money, and some require a trip to a courthouse.

Most of this file is US-focused. Other countries have equivalents, but what’s public varies a lot (for example, many European countries publish far less about individuals because of privacy law).

Quick Reference Table

Category	Main sources	What it reveals	Cost
Property	County assessor, recorder, GIS parcel viewers	Owner names, mailing address, purchase date/price, parcel maps	Usually free to search
Federal courts	PACER, CourtListener/RECAP	Lawsuits, bankruptcies, criminal cases, filings with names/addresses	PACER: $0.10/page (details below); CourtListener: free
State/local courts	State and county court portals	Civil, criminal, family, traffic cases	Varies by state
Business entities	Secretary of State, OpenCorporates, UK Companies House	Officers, registered agents, addresses, formation dates	Mostly free
Public companies	SEC EDGAR	Annual reports, material events, executives, insider trades	Free
Nonprofits	ProPublica Nonprofit Explorer (IRS Form 990s)	Executives, salaries, finances	Free
Campaign finance	FEC.gov (federal), state election sites	Donor name, city, employer, occupation	Free
Government contracts	USASpending.gov, SAM.gov	Contractors, contract amounts, agencies	Free
Patents & trademarks	USPTO Patent Public Search, Google Patents	Inventors, assignees, R&D focus	Free
Wireless devices	FCC Equipment Authorization (FCC ID), fccid.io	Internal photos, manuals, test reports	Free
Aircraft & vessels	FAA Registry, ADS-B Exchange, Flightradar24, MarineTraffic	Aircraft owners, flight paths, ship positions	Free tiers + paid
Professional licenses	State licensing boards, FINRA BrokerCheck, NPI Registry	License status, discipline, practice addresses	Free
Voter records	State election offices	Name, address, party, voting history (varies)	Varies; use restricted
Government documents	FOIA / state public records laws, MuckRock	Emails, contracts, reports, datasets	Usually free; can have fees

Property Records

Where: County assessor (tax valuation) and county recorder/register of deeds (ownership documents) websites. Many counties also run GIS parcel viewers where you click a parcel on a map.

What they reveal: Owner name(s), mailing address for tax bills (sometimes different from the property itself, which can reveal a second residence or an LLC’s address), purchase date and price, property characteristics, and sometimes scanned deeds and mortgage documents showing a spouse’s name or lender.

Attacker use: Confirming a home address, identifying wealth, finding family relationships through joint ownership, and discovering LLCs a person uses to hold property.

Defender use: Executive protection teams check what’s exposed about leadership’s homes. Fraud investigators trace assets.

Limitations and tips:
- Many people hold property in trusts or LLCs specifically to keep their name off the record. Pivot to business records (below) to see who is behind the LLC.
- Some officials can have their addresses shielded. For example, federal judges have protections under the Daniel Anderl Judicial Security and Privacy Act (verify before class for current scope), and many states have address-confidentiality programs for domestic violence survivors.
- Search by address and by owner name. Records often have misspellings.

Court Records

Federal courts: PACER

PACER (Public Access to Court Electronic Records) is the official system for federal court filings: civil suits, criminal cases, bankruptcies, and appeals.

Cost: $0.10 per page, capped at $3.00 (30 pages) per document for case documents and docket sheets. The cap does not apply to name search results, non-case-specific reports, or transcripts. If you accrue $30 or less in a quarter, your fees are waived, and PACER says about 75 percent of users pay nothing in a given quarter.
PACER Case Locator searches across all federal courts by party name.
What it reveals: Party names, attorneys, addresses in filings, exhibits (which may include contracts, emails, or financial records), and case outcomes.

CourtListener and RECAP

CourtListener (run by the nonprofit Free Law Project) is a free search engine for court opinions and a large archive of federal docket documents. Its RECAP browser extension uploads documents that PACER users purchase to a free public archive, so many documents are already available without paying. Check CourtListener before paying PACER.

State and county courts

Each state runs its own system. Some have statewide portals; others are county by county. These cover the cases that touch most people’s lives: divorces, evictions, small claims, traffic, and most criminal cases.

Attacker use: Divorce and civil filings can reveal addresses, children’s names, finances, and employers. Criminal records can be used for leverage or harassment.

Defender use: Due diligence on vendors and partners, investigating a fraud suspect, and finding prior lawsuits about data breaches or security failures.

Ethics note: Court records contain some of the most sensitive information about people’s lives. Collect only what the objective requires.

Business Filings

Secretary of State business entity search (US)

Every state’s Secretary of State (or equivalent) registers corporations, LLCs, and partnerships. Searches typically show:
- Legal name and any former names
- Formation date and status (active, dissolved, delinquent)
- Registered agent and address
- Officers, directors, or managers (varies by state; some states like Delaware reveal very little)
- Annual reports with updated officer lists

Why it matters: Business filings connect people to organizations. A person’s name appearing as an officer of several LLCs reveals side businesses, property holding companies, or shell structures.

OpenCorporates

OpenCorporates describes itself as the largest open database of companies, with 200M+ companies across 140+ jurisdictions. The website is searchable for free. API access requires a key: free access is reserved for public-benefit projects (journalists, NGOs, universities, anti-corruption researchers) and commercial use requires a paid plan. Bellingcat has a beginner’s guide to using the API for “following the money.”

International equivalents

UK Companies House: Free to search; shows officers, persons with significant control (beneficial owners), filing history, and accounts.
Most countries have a national business registry. OpenCorporates links to many of them and is a good starting point when you don’t know the local system.
ICIJ Offshore Leaks Database (offshoreleaks.icij.org): Free database from the International Consortium of Investigative Journalists built from leaks like the Panama Papers, showing offshore entities and the people connected to them (verify before class for current contents).

SEC EDGAR (Public Companies)

EDGAR is the SEC’s free database of filings from publicly traded companies. Its Full Text Search lets you search keywords and phrases across more than 20 years of filings and filter by date, company, person, filing category, or location.

Filing	What it tells you
10-K (annual report)	Business description, risk factors (including cybersecurity risk), subsidiaries, properties, legal proceedings. Since the SEC’s 2023 cybersecurity rules, 10-Ks also describe cybersecurity risk management and governance.
10-Q (quarterly)	Updates between annual reports
8-K (current events)	Material events: executive changes, acquisitions, bankruptcies, and material cybersecurity incidents (Item 1.05)
DEF 14A (proxy statement)	Executive compensation, board members, related-party transactions
Form 4	Insider stock trades by executives and directors

Item 1.05 details: Public companies must file an Item 1.05 Form 8-K within four business days of determining that a cybersecurity incident is material. Compliance began December 18, 2023 for most companies and June 15, 2024 for smaller reporting companies. SEC staff guidance in 2024 clarified Item 1.05 is for incidents the company has determined are material.

Attacker use: Executive names and biographies for spear phishing, subsidiaries and acquisitions (newly acquired companies often have weaker security), major vendors, and office locations.

Defender use: Tracking breach disclosures at peers and vendors, third-party risk management, and understanding what your own company has disclosed publicly.

Nonprofit Filings (IRS Form 990)

Tax-exempt organizations file Form 990 with the IRS, and those filings are public. ProPublica Nonprofit Explorer lets you browse millions of returns (Form 990, 990-EZ, and 990-PF), search organizations and individuals, and search the full text of filings. It shows executive compensation, revenue, and expenses, and it links to audits for nonprofits spending $750,000+ in federal grant money. There’s also an API.

What it reveals: Officers and key employees, salaries, board members, major contractors, related organizations, and addresses. Useful for researching universities, hospitals, foundations, and advocacy groups.

Campaign Finance (FEC)

Federal political committees must list the name, address, occupation, and employer of each individual who gives more than $200 in an election cycle (or calendar year for PACs and party committees). The FEC publishes these reports, and FEC.gov displays contributor name, city/state, employer, and occupation.

Important legal restriction: Federal law prohibits the sale or use of contributor information for soliciting contributions or for commercial purposes. OSINT researchers can view the data, but they need to be careful about how it’s used. State campaign finance sites have their own rules.

What it reveals: Employer and occupation (useful for confirming where someone works), city of residence, and political affiliations. Political affiliation is sensitive data; treat it carefully and only collect it when the objective requires it.

Government Contracts

USASpending.gov: Federal spending data: who received contracts and grants, how much, and from which agency.
SAM.gov: The System for Award Management, where businesses register to work with the federal government. Entity records show business details, points of contact, and whether an entity is excluded (debarred) from federal contracting.

Use cases: Identifying a company’s government customers (a company holding defense contracts may be a higher-value target), finding subcontractors, and doing vendor due diligence.

Patents & Trademarks

USPTO Patent Public Search: Free tool to search US patents and published applications, with basic and advanced search.
Google Patents: Free, fast, searches patents from many countries with full text.
USPTO also runs a free trademark search system.

What they reveal: Inventor names (often engineers at the target company, with their city), assignee companies, technical drawings, what a company is researching years before a product launches, and law firms they work with.

FCC Equipment Authorizations (FCC ID)

Devices that transmit radio signals (Wi-Fi, Bluetooth, cellular) and are sold in the US need FCC authorization. Each device has an FCC ID printed on it or shown in its settings. Searching the FCC ID in the FCC Equipment Authorization database, or the friendlier third-party mirror fccid.io, often reveals:
- Internal and external photos (showing chipsets, debug ports, and antennas)
- User manuals
- Test reports with frequency and power details

This is a gold mine for hardware and IoT research and connects directly to lesson 2.3 IoT Hacking. Some companies request short-term confidentiality for certain exhibits, so not every document is public immediately.

Aircraft & Vessel Records

FAA Aircraft Registry

Search by N-number (the tail number on US aircraft), owner name, or serial number to see the registered owner. Many private jets are registered to trusts or LLCs, which is another place to pivot into business records.

Flight tracking

ADS-B Exchange: Founded in 2016, it aggregates data from volunteer receivers worldwide. JETNET acquired it in January 2023. It’s popular with researchers because it historically did not filter aircraft that owners asked to hide.
Flightradar24 and FlightAware: Popular flight trackers with free and paid tiers. They generally honor filtering requests.
Privacy programs: The FAA’s LADD (Limiting Aircraft Data Displayed) program lets owners limit how their aircraft appears in FAA-provided flight data, and the FAA’s Privacy ICAO Address (PIA) program lets eligible owners use an alternate aircraft address (verify before class for current details).
Case study: The “ElonJet” account (2022) posted Elon Musk’s jet movements using public ADS-B data and was suspended from Twitter in December 2022. It’s a good discussion of where “public” data turns into a safety concern.

Vessel tracking

Ships broadcast their position using AIS (Automatic Identification System). MarineTraffic (acquired by Kpler in 2023, along with FleetMon) and VesselFinder display this data. Ships can switch AIS off (“going dark”), and gaps in the data are themselves an investigative clue (sanctions evasion research often looks for them).

Use cases: Corporate travel patterns (an executive’s jet visiting a competitor’s city can hint at an acquisition), supply chain research, and verifying where a vessel was on a date.

Professional Licenses

State licensing boards publish lookups for nurses, doctors, contractors, electricians, real estate agents, cosmetologists, lawyers (state bar), and more. Typical data: license number, status, expiration, disciplinary actions, and sometimes a business address.

National lookups worth knowing:
- FINRA BrokerCheck: Financial brokers and investment advisers, employment history, and disciplinary actions.
- NPPES NPI Registry: Healthcare providers’ National Provider Identifier records, including practice addresses and specialties.
- NMLS Consumer Access: Mortgage loan originators.

Use cases: Confirming someone’s profession and employer, verifying credentials during fraud investigations, and finding work addresses.

Voter Registration Records

Voter records can include name, address, date of birth or age, party affiliation, and voting history (whether someone voted, not how). Access varies widely:
- Some states make voter lists available to anyone, some only to political parties, candidates, election officials, or researchers.
- Some states prohibit commercial use, and many restrict use to election-related or political purposes.
- The US Election Assistance Commission publishes a summary of what each state makes available (verify before class for the current version).

Teaching point: This is a clear example of “public ≠ permitted.” Even where the data is obtainable, using it outside the allowed purpose can be illegal. For this class, discuss it; don’t collect it.

FOIA and Public Records Requests

The federal Freedom of Information Act (FOIA) lets anyone request records from federal agencies. Every state has its own public records law covering state and local government (city emails, police policies, contracts, budgets).

Requests take time (weeks to months) and some records are withheld under exemptions (privacy, national security, law enforcement).
MuckRock is a nonprofit that helps people file, track, and publish public records requests, and its site hosts many previously released documents you can search before filing your own. It also runs DocumentCloud, which newsrooms use to publish primary source documents.

Use cases: Researching government agencies (including their technology contracts), getting documents that were never posted online, and building timelines.

Attacker vs. Defender Summary

Record	Attacker might use it to…	Defender might use it to…
Property	Find an executive’s home	Assess executive protection exposure
Courts	Find leverage or personal details	Vet vendors, investigate fraud
Business filings	Map shell companies, find officers to impersonate	Verify a supplier is real before paying invoices
SEC filings	Pick targets from acquisitions and exec lists	Track peer breach disclosures
FCC ID	Find debug ports on a device	Understand what their device exposes
Flight tracking	Track an executive’s movements	Assess whether leadership travel is exposed

Key Terms

Public record: Information created or kept by a government body that the law makes available to the public.
PACER: The federal courts’ electronic records system.
RECAP: A Free Law Project browser extension and archive that makes purchased PACER documents free.
Registered agent: The person or company designated to receive legal papers for a business.
EDGAR: The SEC’s electronic filing database for public companies.
Form 990: The annual information return filed by US tax-exempt organizations.
FCC ID: The identifier assigned to radio-transmitting devices authorized for sale in the US.
ADS-B / AIS: Broadcast systems that aircraft (ADS-B) and ships (AIS) use to announce their identity and position.
FOIA: The federal Freedom of Information Act, which allows public requests for agency records.

Key Takeaways

Public records are authoritative primary sources and hard to fake
Individually boring records become powerful when combined (the mosaic effect)
Check CourtListener before paying PACER; PACER fees are waived at $30 or less per quarter
SEC 8-K Item 1.05 filings disclose material cyber incidents within four business days of the materiality decision
FCC ID lookups expose device internals, a major IoT research shortcut
Some public data has legal use restrictions (FEC donor data, voter files)
LLCs and trusts hide owners; pivot into business filings to see who’s behind them

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.