Your Name Is an Attack Surface
Advanced Google operators expose board members in investor PDFs, shareholder registers, court filings and conference slide decks. Once indexed, that content does not disappear — regardless of what you delete from your own profiles.
What Google operators actually retrieve
Most people understand that Google indexes web pages. Few understand that Google also indexes the full text content of PDFs, PowerPoint files, Word documents, Excel spreadsheets and cached versions of pages that no longer exist. For an executive whose name appears across a decade of corporate filings, this distinction is significant.
Google's advanced search operators — combined queries using syntax like site:, filetype:, intext: and cache: — allow an analyst to retrieve documents that mention a target in contexts the target is unaware of.
Operator combinations used in practice
Each result above was retrieved without authentication, without paid tools and without any contact with the subject or their organisation. The session took eleven minutes.
The permanence problem
Executives often believe that removing content — leaving a board, resigning a directorship, updating a LinkedIn profile — removes the associated public record. It does not. Three mechanisms preserve the information indefinitely.
- Google cache — Google stores a snapshot of pages at the time of last crawl. Cached pages remain accessible even after the source page is deleted or modified, sometimes for months.
- The Wayback Machine — The Internet Archive crawls and stores billions of pages at intervals. A company website that listed you as a board member in 2019 and was subsequently taken down exists in multiple archived versions, fully text-searchable.
- Third-party aggregators — Financial data providers, news archives, corporate intelligence databases and academic repositories all mirror public documents. Removal from the source does not propagate to mirrors.
What the documents reveal
The specific intelligence value of document-level Google dorking is not limited to confirming employment history — which most executives accept as public knowledge. The more operationally significant findings are typically:
Undisclosed relationships. Shareholder agreements and JV filings name parties that companies do not publicise. An executive's stake in a separate vehicle, or a co-investor relationship with a politically exposed individual, may be disclosed in a regulatory filing years before it becomes a reputational consideration.
Compensation data. Dutch, German, Austrian and UK listed companies are required to disclose senior executive remuneration in annual reports. These documents are indexed in full. For a sufficiently motivated adversary, knowing a target's precise income establishes the expected lifestyle — and the expected assets.
Private contact details. Court filings, notarial deeds, property transfer documents and company registration papers all require a physical address at the time of submission. These documents are frequently published online by courts, land registries and commercial registers. The address submitted ten years ago for a business that no longer exists may still be the subject's home.
The asymmetry is this: an adversary only needs to find one useful document. You need to know about every document in which your name appears. Google dorking is the fastest way to close that gap — from your own side, before someone else does it from theirs.
What can be done
Suppression is partial but meaningful. For documents that are no longer hosted by their original publisher, a formal Google removal request can delist the URL from search results — not from the internet, but from the primary discovery mechanism. This reduces casual exposure significantly.
For documents still actively hosted — court records, regulatory filings, archived annual reports — the remediation path is different: legal redaction requests, privacy shield applications and, in the Netherlands, the KvK privacy shield procedure which conceals residential addresses from commercial registry searches.
The first step is inventory. You cannot remediate what you have not mapped.
Know what Google knows about you.
We conduct a full document-level OSINT assessment and deliver a prioritised remediation plan — including specific removal requests and suppression actions.
Request intake