OPSEC for Investigators
Sock puppets, network hygiene, and the habits that stop your investigation from exposing you.
Operational Security (OPSEC) is the practice of denying your adversary — the target, their associates, or the platform — any information about you or your investigation. In OSINT the adversary is often just an attentive person with the same tools you have.
Separate identities
- Use a dedicated investigation browser profile or, better, a separate machine and network where feasible.
- For interactive steps, use a sock puppet account with a distinct name, avatar, writing style, and creation history.
- Never mix persona and personal accounts in the same browser profile — fingerprinting and cookie graphs will link them.
- Do not log into personal services while operating as the persona.
Network hygiene
- A commercial VPN hides your IP from the sites you visit, but not from the VPN provider. Honestly assess your threat model.
- Tor is the stronger option for anonymity, at the cost of speed and some sites blocking it outright.
- Watch for leaks: WebRTC, browser extensions, DNS, and the "shared link" previews that fetch from your IP.
Every interactive action — a profile view, a login, an API call with your key — is a signal. Exhaust passive sources (search engines, archives, cache) before you ever touch the target directly.
Protect the work product
- Encrypt your case files at rest; assume any device you carry can be lost.
- Strip metadata from anything you publish — see the metadata guide.
- Keep a clean audit trail: sources, timestamps, and reasoning, so your findings survive scrutiny.
- Do not let convenience erode discipline. One careless login can undo months of care.
The bundled Mapping Tool stores nothing off-device: projects are plain JSON files you control, and settings live in your browser. That is deliberate — it keeps your investigation out of someone else's database.
Start with a threat model
OPSEC without a threat model is theatre. Decide who you are hiding from — the target, the platform, or an adversary with resources — because each demands different controls. A curious subject needs far less than a hostile state actor.
- 1Write the threat model: who, against what, with what resources.
- 2Compartmentalise: one isolated identity and browser profile per investigation, never shared.
- 3Build the persona properly — a name, an avatar (reverse-search it to be sure it is not a real person), a history, and a writing style distinct from your own.
- 4Route traffic deliberately (VPN or Tor) and confirm there are no leaks before touching the target.
- 5Keep case files encrypted at rest and strip metadata from anything you export.
- 6Log your own actions with timestamps so you can prove what you did and did not do.
An investigator creates a sock puppet to view a locked profile, then a week later logs into a personal account in the same browser.
Method · The platform's cookie graph and device fingerprint link the two sessions. When the target checks "who viewed my profile", the persona's recent activity has faded, but the shared infrastructure now correlates the accounts.
Result · The burn comes from convenience, not cleverness. The fix is structural: a dedicated profile or machine for the persona, and never a shared login — discipline, not tricks.