Who the Hell Wants to Steal Your Data?

Melissa asked me to buy tickets for an event. The site was one of those single-use ticket portals you load once and never see again. So I did what I always do with sites like that. I used Apple's Hide My Email, the feature that hands the website a random, throwaway address instead of my real one.

A few days later she was in our family password manager and saw it. A long string of garbage characters where an email should be. She turned to me, genuinely confused, and asked:

"Who the hell wants to steal your data?"

I smiled and told her she didn't know the half of it. In Europe, I said, they would kill you for that question.

"Who do you think you are?"

Her question wasn't really about an email. It was a whole worldview compressed into one line. The assumption underneath it is that your data isn't worth protecting because you are not worth targeting. Who do you think you are? Some VIP that hackers are plotting against? Relax. Hand it over.

In the Levant and the GCC, this is just the air you breathe. In Saudi, my phone number is effectively public. When I order something, my number is handed to the delivery driver automatically. Random drivers send me WhatsApp messages, and the social expectation is that I answer a stranger who happens to be holding my address. Nobody finds this strange. The data is currency, and everyone spends it freely.

When I first arrived, I didn't have WhatsApp on my Saudi number, and people were genuinely baffled. Not "how do I reach you," but "how do you function." As if a shared number, not a message, not a call, not an email, but specifically a WhatsApp, is what makes you a functioning member of society. People add you to groups without asking, left and right. In Germany it inverts completely. I need explicit consent to send a teammate a WhatsApp.

There is a tell in all of this. WhatsApp, the app built entirely on your phone number, just announced you can be found by a username instead and keep the number private. The platform whose whole foundation was the shared number is quietly walking away from it. When the company that made your number feel like proof you exist decides to let you hide it, that says something.

I used to be the same. I gave my number to every shop, every loyalty card, every guy with a clipboard. It never occurred to me that "annoying" and "dangerous" were two stops on the same line.

You don't have to be important

Here is the part that breaks the "who do you think you are" logic. You don't have to be important. You just have to be counted.

The richest companies on earth lose money on purpose to collect the data of perfectly ordinary people. Amazon sells the Kindle at cost, by Jeff Bezos's own admission, and has reportedly burned more than $25 billion on its devices business, the Echo, Fire, and Kindle, in just a few years. They don't eat that loss to be generous. They eat it because the device is bait. The real product is you, sitting inside their ecosystem, producing a stream of behavior they get to read.

When Google bought Fitbit for $2.1 billion, regulators weren't worried about the watches. They were worried about the 28 million people wearing them, and the health and location data sitting on those wrists. The European Commission only cleared the deal after Google promised not to feed that health data into its advertising machine. Sit with that for a second. A company that prints money from ads had to legally promise not to use your heart rate to sell you things. That promise only exists because the data was the entire point.

And it is not only the corporations running this math. The criminals run the same one. In the US alone, people reported losing $12.5 billion to fraud in 2024. And when researchers looked at who actually gets hit, a quarter of mass-market scam victims earned under $20,000 a year. Fraud does not chase the rich. The rich can afford to be careful. It chases everyone else, precisely because no one expects them to be a target.

So when Melissa asks who would want my data, the honest answer is: the most valuable companies in history and the busiest criminals on earth, both badly enough to keep chasing it. Not because I'm special. Because nobody is, and that is exactly what makes the pile worth so much.

Two knocks on the same door

Two scenes taught me more than any privacy policy ever could.

The first was in Riyadh. A woman knocked on my door and said she was from the government, doing a survey, and she needed my ID number. I told her I'd like to see some identification first. She was offended. Genuinely insulted, as if I had cursed her family, all because I asked a stranger at my door to prove who she was before I handed over the number that unlocks my entire life.

I closed the door and listened to the rest of her round through the camera. One by one, the neighbors gave it all up. ID numbers. How many people lived in each home. When they had moved in. No badge, no proof, no hesitation. I stood there thinking, I could steal every one of these lives right now, and they just handed me the keys.

The second scene was in Germany. A technician from O2 came to fix my internet, an appointment I had asked for and booked myself. Before he touched anything, before he even fully stepped inside, he showed me a badge with a barcode I could scan to verify him, and a set of papers explaining what he was there to do and what he was allowed to access. I signed more paperwork for that visit than I ever did to open a bank account in Lebanon. He led with proof. He assumed I would ask, because in his world, of course you ask.

Same situation. A stranger at the door wanting access. Opposite defaults.

This is why the scams are so easy

The free-data mentality isn't just a vibe. It has a body count.

When one ID number is linked to everything, your bank, your phone, your residency, a single piece of information becomes a master key. So the scam writes itself. Someone calls you and says, "We're from the government, we need to verify your ID." And since a real government office literally did knock on your door last month asking the same thing, you give it. Boom. A bank account opens in your name. The convenience and the fraud are not two different things. They are the same feature, used by two different people.

🔑 The master key

Imagine every lock in your life, your house, your car, your office, your bank, opened with one key. Convenient. You only carry one. Now imagine you hand a copy to anyone who asks politely, because asking politely is the only check there is. That is what a national ID linked to everything becomes when the culture treats "give me your number" as a normal greeting.

And the region sees it too. Saudi now has a data protection law of its own, modeled in part on GDPR and in force since 2023. The government takes the scams just as seriously. They go after the people running them, and when someone does get hit, the help is real. So no, this is not a story about a state that is asleep. The state is wide awake. But a law arrives faster than an instinct, and no government can pick up the phone for you. The last lock is the one you install yourself.

There is no unsubscribe

In fifteen years of working back home, I am not sure I ever saw an unsubscribe link that actually worked. You don't opt in to marketing. You are opted in by existing. You book a hair appointment, hand over your number because of course you do, and from the next morning messages start arriving every day about new offers. There is no "manage preferences," no "delete my account," and definitely no "download everything you hold on me." The data is not something of yours that a business happens to store. It is theirs, and you happen to appear in it.

The gap is not a feeling, it is measurable. On my German number I received two marketing messages in the past year. Two. On my Saudi number, twenty. On my Lebanese number I lost count. Same person, three numbers, three completely different ideas about who my attention belongs to. In Europe that daily-offer salon would be courting a lawsuit, because the right to see your data, carry it somewhere else, and have it erased is not a favor you beg for. It is the law.

The other side of the invoice

So why doesn't Europe just do the easy, convenient thing?

Because Europe decided your data is radioactive, and protecting it is brutally expensive to build. I live this at work every day. Data retention rules that force you to delete things on a schedule. Audits. Whole security teams whose job is to say no. Legal sign-off before you can launch an idea you sketched in an afternoon.

We waited roughly six months to turn on a coding assistant, just legal and the vendor going back and forth over what the tool could see. Before we copy production data into a development environment, we randomize the personal fields so engineers never touch a real customer. Before a dashboard can read from the database, we build dedicated views so the dashboard physically cannot see a real email address. Every one of these is friction. Every one of these costs time and money that the shortcut never pays.

Even logging in is a ritual. To reach one system at work I open Keeper, plug in my YubiKey, enter a code, add a fingerprint, copy the password, close it again, then sign in a second time through SSO. In a decade and a half across Lebanese agencies, from the tiny ones to the huge ones, I never once saw a password manager. Passwords lived in WhatsApp threads and on sticky notes. I still have access to a company I left ten years ago. Not a login, my public SSH key still lives on their production server, which I can reach directly because of course there is no bastion host and SSH is wide open to everyone, from anywhere. I told them. They didn't care. We trust you, Charbel. But it was never about trust. It's about the day my old laptop gets stolen, and a stranger inherits everything I was trusted with.

If you've read The Tri-Regional Operating System, you know I think each region runs on a different set of defaults. This is one of the deepest. The GCC and Levant build fast, Europe builds slow and heavy, and I used to think the difference was just enforcement, someone checking your work. It isn't. It is mentality. In Europe the care for data is internalized. People protect it even when nobody is watching, because the awareness already lives inside them. Back home the data leaks not because anyone decided it should, but because no one is thinking about it at all.

A suspicion versus a stolen server

At Emma, the bar is almost comic. The moment we even suspect that a third party might have been breached, not confirmed, just suspect, we pull the CTO, the department heads, staff engineers, legal, and DevSecOps into one call. And we stay on that call until we are ten thousand percent sure nothing leaked. And when we can't prove with concrete evidence that nothing got out, we report it anyway, just in case. A maybe is enough to scramble the entire chain of command and to file a disclosure. In Lebanon, there is no one whose job it is to hear about it.

Now the other version. At a company in Lebanon I won't name, a physical server was stolen. Not suspected breached. Gone, carried out of the building. It held customer PII and credit card data. I called the owner. His first question was whether we had a backup. Yes, I said. "Then why are you calling me on my vacation? Buy another server and restore it." That was the entire incident response. A machine full of people's card numbers walked out the door, and the only worry in the room was uptime.

We did take it further and opened a lawsuit over the lost data. Then, nothing. Until the day I left the company, we did not hear a single word. No hearing, no call, not even someone coming to take our statement. The theft had its report, a stolen server is property and property has paperwork. The data on it never made it into any file.

What the tax actually buys

For a long time I thought all that overhead was just Germans being German. Then I saw what it's actually for.

A friend in Lebanon took a ride-share. The driver ended up with her address and her phone number, the same automatic sharing I described above, and he used it. He harassed her so relentlessly that she changed her phone number and then moved out of her home. The "convenience" of handing a stranger your address became a woman packing boxes.

Now hold that against a small thing my German teammates do. Some of them refuse to give out a personal mobile number, even inside the team. Their line is simple: if the company wants me reachable, the company gives me a phone. The first time I heard it, it sounded cold. Now I hear it for what it is. A boundary, drawn early, by people who never had to learn the hard way why it matters.

That annoying overhead, the views, the retention jobs, the badge at the door, the refusal to share a number, is not bureaucracy for its own sake. It's the same instinct that would have kept my friend in her home.

The paranoid side is the freeing one

When I first moved to Germany, the privacy culture felt restrictive. Forms for everything. Permission for everything. Then one day it flipped, and it felt like the opposite. It felt freeing.

I don't flinch when a stranger has my number, because a stranger doesn't have my number. I don't brace for the scam call, because the scam call doesn't have a master key to my life. Privacy isn't paranoia wearing a suit. It's the quiet confidence of someone who knows the doors are locked.

The warmth back home is real, and it is what I love and miss the most about it. And I get it, I really do. People are open, generous, over-welcoming. They hand you their trust before you have earned it. When I was a kid, I would sit with my grandmother on her balcony. Strangers walked by below, and the rule was simple: you said hello to every one of them. Half the time she would call down one word, "hawwel." Come up. Actual strangers. Some came, climbed the stairs, sat with us, and before long she was bringing out the family photo albums to show them. That was a perfectly normal afternoon. That instinct was never stupid. It was built for a world that ran by hand, where you had to show up in person, sign in front of someone, be physically present to do any harm. Presence was its own kind of limit.

Then everything moved online and went anonymous. Nobody has to show their face to drain you now, and AI just handed every scammer a thousand more hands. The hospitality didn't change. The exposure did. As I wrote in Debugging the Cultural Stack, some inherited defaults are worth keeping and some are legacy code you finally have to refactor.

The warmth, keep it. The open door is the part that needs a lock.

So who the hell wants to steal my data? The honest answer is: probably nobody. Today. But I'd rather build my life on a system that doesn't depend on that staying true. Because the day it stops being true, the cost isn't spam in an inbox. It is someone packing boxes.

If it happens to you

"The help is real" deserves an address. Save these before you need them, because the first hour matters more than anything that follows.

• In Germany: one call to 116 116 blocks your cards, and you can file the police report online through your state's Onlinewache without leaving home.
• In Saudi: call your bank first, the same hour, not the same day. Money that moved minutes ago can sometimes be frozen; money that moved yesterday is usually gone. Then report it through the Kollona Amn app. Phishing and spam messages forward to 330330.
• In Lebanon: the ISF Cybercrime Bureau takes these cases. File the report, but keep your expectations modest. It exists, it just moves the way everything back home moves.

None of this replaces the lock. It is what you do when the lock was not there yet.