Digital Footprint and Metadata

Your digital footprint and metadata are often more dangerous than the content of your messages. While encryption can hide what you say, your footprint and metadata reveal who you are, where you are, and who you know.

This guide explains how these traces are created, why they are dangerous, and how to minimize them to protect against state surveillance, doxxing, and arrest.

---

1. Understanding Digital Footprint

A digital footprint is the trail of data you leave behind while using the internet. It is categorized into two types:

1. Active Footprint: Data you intentionally submit (e.g., Instagram posts, Tweets, Telegram comments, filling out online forms).
2. Passive Footprint: Data collected about you without your explicit action (e.g., IP addresses, device types, browser fingerprints, ISP logs).

The Three Identity Levels

To manage your footprint effectively, you must distinguish between three levels of identity usage:

• Known Identity: Activities linked to your legal name (e.g., Shaparak banking transactions, Snapp/Digikala accounts, university portals). Risk: High visibility to the state. Strategy: Compartmentalize; never use these devices/accounts for activism.
• Pseudonymous Identity: A consistent online persona (e.g., a Twitter handle like @AzadiUser98). Risk: Over time, behavioral patterns (writing style, posting times) can link this to your real identity.
• Anonymous Identity: Short-term, unconnected identities used for high-risk activities (e.g., reporting a protest). Risk: Difficult to maintain; requires strict OpSec (Tor, separate hardware).

The Iranian Context: Domestic Traffic

In Iran, "passive footprints" are weaponized by the state through the National Information Network (NIN).

• Domestic Apps: Usage of domestic messengers (Eitaa, Rubika) or services (Snapp, Neshan) generates a footprint directly accessible by security agencies.
• ISP Logging: Iranian ISPs log DNS requests and IP connections. Even if they cannot see the content of HTTPS traffic, they can see which servers you contact and when.

---

2. Metadata: The Invisible Informant

Metadata is "data about data." It describes the context of a file or communication rather than the content itself.

Types of Critical Metadata

A. Visual Content (EXIF Data)

Photos and videos taken with smartphones contain embedded Exchangeable Image File Format (EXIF) data. This is critical for protesters and citizen journalists to scrub before publishing.

• GPS Coordinates: Exact latitude and longitude where the photo was taken.
• Timestamp: The exact second the file was created.
• Device Info: Phone model and unique sensor data (which can link a photo to a specific physical phone seized by police).

Warning: Blurring a face or a license plate in a photo is not enough. The underlying file usually retains the metadata unless specifically scrubbed.

B. Email Headers

Email is fundamentally insecure for privacy. Even with PGP encryption, the headers remain unencrypted.

• Visible: Sender, Recipient, Date, Subject Line.
• Hidden: Routing servers, client software version, sometimes the sender's IP address.
• Risk: An adversary can map your entire social graph (who you talk to and how often) without ever decrypting a single email body.

C. Communication Metadata

Messaging apps generate metadata.

• Traffic Analysis: Even in encrypted apps like WhatsApp, the server knows who messaged whom, the file size, and the timestamp.
• Signal: Designed to minimize metadata; it does not log who is messaging whom, making it the preferred choice for high-risk communication.

---

3. Minimizing Your Digital Footprint

Account Hygiene and Lifecycle

Unused accounts are security liabilities. They often contain old data that can be used to build a profile or "dox" you.

1. Audit: Search your email for keywords like "Verify," "Welcome," or "Confirm" to find old accounts.
2. Delete: Do not just log out. Use the "Delete Account" function. If a service refuses to delete data (common with domestic Iranian apps), poison the data by changing your name, address, and details to fake information before abandoning the account.
3. Search Yourself: Regularly search your name, usernames, and phone numbers in quotation marks on Google (e.g., "0912*******").

Browser Fingerprinting & Tracking

Websites track more than just cookies. They build a "fingerprint" based on your screen resolution, installed fonts, and battery level.

• Defense: Use Tor Browser or Mullvad Browser for sensitive browsing. These browsers standardize your fingerprint to look like everyone else's.
• Extensions: Use uBlock Origin to block third-party trackers and ads that build behavioral profiles.

Link History & Smart Scams

Platforms like Facebook and Instagram now use "Link History" to track websites you visit through their in-app browsers.

• Action: Disable "Link History" in Meta app settings.
• Best Practice: Never use in-app browsers. Set your apps to "Open in External Browser" (e.g., Firefox or Brave) by default.

---

4. Metadata Scrubbing Tools & Techniques

Before sharing files, especially evidence of human rights violations, you must sanitize them.

Tools for Removing Metadata

• MAT2 (Metadata Anonymisation Toolkit): The gold standard for Linux/Tails users. It removes metadata from images, audio, and documents without compromising file integrity.
• ExifEraser (Android): A permission-less app to strip metadata from JPEGs and PNGs.
• ExifCleaner (Desktop): Drag-and-drop interface for Windows/macOS.
• Scrambled Exif (Android): Allows you to "Share" a photo to this app, which strips the metadata and then re-shares it to your destination (e.g., Telegram/Signal).

Visual Redaction (The "Blur" Trap)

Never use standard blurring or pixelation to hide text or faces. AI tools can increasingly reverse these effects.

• Correct Method: Use solid opaque shapes (black boxes) to cover sensitive info.
• Signal App: Use the built-in blur tool in Signal, which is robust, but for high-risk text, draw a solid line over it.
• ObscuraCam: An app designed specifically for blurring faces and removing metadata simultaneously.

---

5. Doxxing Prevention in the Iranian Context

"Doxxing" (publicly revealing private info) is a tactic used by state-aligned actors against protesters.

Reducing Exposure

1. Phone Numbers: Your phone number is your primary identifier in Iran. Avoid using your main SIM for Telegram or Signal registration. Use foreign virtual numbers (VoIP) or separate "burner" SIMs for activism.
2. People Search & Leaked Databases: Unlike the West, Iran lacks public "people search" sites. Instead, data comes from leaked databases (e.g., Snapp Food, banking leaks) traded on Telegram.
   • Defense: Assume your national ID and phone number are linked and public. Rely on compartmentalization (using different identities/devices) rather than trying to scrub this leaked data, which is impossible.
3. Social Media Lockdown:
   • Lock down Instagram and Twitter accounts.
   • Remove profile photos that show your face or local landmarks.
   • Disable "People Also Viewed" or "Suggestions" to break the chain of association between you and other activists.

---

6. Checklist: Before You Post or Click

1. VPN Check: Is your VPN active and trusted (e.g., Mullvad, Proton)? Never access sensitive content on a domestic IP.
2. Metadata Scrub: Have you run the photo/video through a metadata removal tool?
3. Visual Check: Are there reflections in windows/eyes? Are there unique street signs? Have you used solid bars to redact text?
4. Identity Check: Are you logged into the correct account (Anonymous vs. Personal)?
5. Location Services: Are global location services disabled on your device?

Note for Protesters: If you are recording video, audio metadata is also dangerous. Voices can be voice-printed. Consider removing audio tracks from protest videos unless the audio is essential evidence.

---

Related Resources

• [[Core_Concepts_Privacy_vs_Security]] - Understanding the difference between hiding content vs. hiding identity.
• [[Information_Lifecycle_and_States]] - How data persists from creation to deletion.
• [[How to Choose a Secure and Reliable VPN Service]] - Preventing IP leakage.