@@@
Digital Security for Protesters
A field-guide to the risks and precautions to take before hitting the streets.
Encryptress · Jun 09, 2026
Protest season is upon us and BOY is there no shortage of things to take a public stance against. With the highly alarming increase in surveillance in the US, going to a protest takes much more forethought these days. The question isn’t just whether or not to bring your phone (obviously you’re bringing your phone), it’s how to responsibly handle everything surrounding that: how to keep your/others identity safe, whether you should be posting to socials at all, how to coordinate with the people you’re with without exposing or drawing attention to everyone. The risk isn’t just getting identified and/or arrested, it’s potentially leaking all kinds of data that could make you vulnerable to not only prosecution but harassment and even doxxing (derived from the slang phrase "dropping dox (documents)", the goal is typically to harass, shame, intimidate, or threaten the victim) from ideological opponents. This includes your home address, who you were standing next to, where you work, which accounts are tied to your real name - some of that could leak to police but plenty of it leaks to strangers online who are really bored and like to fancy themselves detectives for the cause.
I’m already ready to riot over Omar Artan (the famously talented Somali ref who flew into Miami to officiate the World Cup on a valid visa, got turned away over “vetting concerns,” and then got to watch FIFA shrug and say immigration isn’t their department). Every other FIFA ref should be walking out in solidarity... but I digress.
Securing yourself is a pretty simple mix of a few choices you make before leaving the house, plus some discipline about what you post after. Do NOT underestimate your ability to be compromised and targeted. Yes you’re one in a sea of people, but it can truly happen to anyone.
How It Could Happen
Police ran protest crowds through social media monitoring and facial recognition, and pulled people out by name. After Michael Brown was killed in Ferguson in 2014 and Freddie Gray in Baltimore in 2015, police used a tool called Geofeedia that pulled in geotagged posts from Facebook, Twitter, and Instagram tied to a specific location. The ACLU exposed the contracts in 2016, and the platforms cut the company off once it became public. The Baltimore piece is key because according to Geofeedia’s own marketing case study, police ran protest photos through facial recognition to find people with outstanding warrants and arrested them, in the company’s words, directly from the crowd.
The government tried to grab the IP addresses of everyone who even visited a protest website. After the 2017 inauguration protests in DC, the Justice Department served the web host DreamHost with a warrant demanding records that would have included the IP addresses of roughly 1.3 million people who visited disruptj20.org, the site used to organize the protests. Not organizers, visitors. Anyone who clicked the link. After a public fight the DOJ narrowed it, but the original ask tells you how broad these requests can be.
A single tattoo in a protest photo was enough to find someone in a matter of days. During the 2020 George Floyd protests in Philadelphia, the FBI identified a woman accused of setting police cars on fire by working backward from images. They spotted a distinctive tattoo and a slogan T-shirt in protest photos, traced the shirt to one Etsy seller, found a five-star review left by a user with a Philadelphia location, connected that username to her LinkedIn, and confirmed the same tattoo in a video on her business site. That whole chain started with photos other people posted.
The pattern to consider is this: you get identified through where your phone says you were, what you posted, and what showed up in someone else’s frame. Everything below works backward from that.
Beware Of Not Just The Police
A protest also puts you in front of people who disagree with you (deeply disturbed anonymous crazy people with too much time on their hands), and some of them will try to figure out who you are and make you pay for being there. They use the same material the FBI used in Philadelphia: a face, a reused username, a public profile. If you’re at all into True Crime, you KNOW people can dig up the craziest information from the smallest piece of proof. The goal is usually to get you fired, bury you in threats, or scare you off the issue. This is called doxxing, and it’s worth understanding because it’s both more common and more random than being targeted by the police.
This type of doxxing runs across the political spectrum. After the 2017 Unite the Right rally in Charlottesville, counter-protesters crowdsourced the names of marchers from photos and posted them publicly, openly trying to get them fired. In 2023, a conservative group ran mobile billboard trucks around Harvard, Columbia, and Penn displaying the names and faces of students tied to a pro-Palestinian statement and labeling them; students reported harassment and had job offers rescinded.
Another thing to know is that the crowd gets it wrong, and being innocent doesn’t save you from the fallout. During the Charlottesville identifications, a University of Arkansas professor named Kyle Quinn, who was more than a thousand miles away that weekend, got tagged as a marcher because he had a similar build and beard and a man in the photo happened to wear an Arkansas Engineering shirt. People posted his home address, the messages were vile enough that he and his wife left and stayed with a friend, and some refused to walk it back even after his own university confirmed it wasn’t him. In the campus cases, several students who got named on the trucks and on harassment sites hadn’t even signed the statement they were being targeted over. Once your name gets attached to a face online, it doesn’t quietly come back off.
What To Do: If You’re Casually Showing Up
You’re going in your free time off work, you support the cause, you’re not planning anything that’s going to land you in a holding cells. You still don’t want your attendance following you home, and you don’t want a stranger with opposite politics turning it into a passion project. Here’s how to prepare yourself:
What To Do: Serious Organizers/Higher-risk Activists
This tier is for people who organize, who’ve been targeted before, who expect to be near the front, or who have reason to think they’re already on somebody’s list. The everyday stuff still applies but add the following:
If You Do Get Doxxed
It can happen to anyone including people who did everything right and people who weren’t even there. If your information starts circulating and you’re experiencing harassment:
At the end of the day you’re protecting against your own phone’s location trail, your own camera roll, and a crazy stranger willing to work backward from one photo to your front door. Carry less, post less, keep your activism life separate from your real accounts, cover what identifies you, and if the stakes are real, line up a lawyer before you go rather than after.
Read more: EFF: Attending a Protest | PEN America: Online Harassment Field Manual
I’m already ready to riot over Omar Artan (the famously talented Somali ref who flew into Miami to officiate the World Cup on a valid visa, got turned away over “vetting concerns,” and then got to watch FIFA shrug and say immigration isn’t their department). Every other FIFA ref should be walking out in solidarity... but I digress.
Securing yourself is a pretty simple mix of a few choices you make before leaving the house, plus some discipline about what you post after. Do NOT underestimate your ability to be compromised and targeted. Yes you’re one in a sea of people, but it can truly happen to anyone.
How It Could Happen
Police ran protest crowds through social media monitoring and facial recognition, and pulled people out by name. After Michael Brown was killed in Ferguson in 2014 and Freddie Gray in Baltimore in 2015, police used a tool called Geofeedia that pulled in geotagged posts from Facebook, Twitter, and Instagram tied to a specific location. The ACLU exposed the contracts in 2016, and the platforms cut the company off once it became public. The Baltimore piece is key because according to Geofeedia’s own marketing case study, police ran protest photos through facial recognition to find people with outstanding warrants and arrested them, in the company’s words, directly from the crowd.
Source: ACLU via CBS Baltimore, Baltimore Fishbowl.
The government tried to grab the IP addresses of everyone who even visited a protest website. After the 2017 inauguration protests in DC, the Justice Department served the web host DreamHost with a warrant demanding records that would have included the IP addresses of roughly 1.3 million people who visited disruptj20.org, the site used to organize the protests. Not organizers, visitors. Anyone who clicked the link. After a public fight the DOJ narrowed it, but the original ask tells you how broad these requests can be.
Source: TechCrunch, Washington Post.
A single tattoo in a protest photo was enough to find someone in a matter of days. During the 2020 George Floyd protests in Philadelphia, the FBI identified a woman accused of setting police cars on fire by working backward from images. They spotted a distinctive tattoo and a slogan T-shirt in protest photos, traced the shirt to one Etsy seller, found a five-star review left by a user with a Philadelphia location, connected that username to her LinkedIn, and confirmed the same tattoo in a video on her business site. That whole chain started with photos other people posted.
Source: Philadelphia Inquirer, NBC10 Philadelphia.
The pattern to consider is this: you get identified through where your phone says you were, what you posted, and what showed up in someone else’s frame. Everything below works backward from that.
Beware Of Not Just The Police
A protest also puts you in front of people who disagree with you (deeply disturbed anonymous crazy people with too much time on their hands), and some of them will try to figure out who you are and make you pay for being there. They use the same material the FBI used in Philadelphia: a face, a reused username, a public profile. If you’re at all into True Crime, you KNOW people can dig up the craziest information from the smallest piece of proof. The goal is usually to get you fired, bury you in threats, or scare you off the issue. This is called doxxing, and it’s worth understanding because it’s both more common and more random than being targeted by the police.
This type of doxxing runs across the political spectrum. After the 2017 Unite the Right rally in Charlottesville, counter-protesters crowdsourced the names of marchers from photos and posted them publicly, openly trying to get them fired. In 2023, a conservative group ran mobile billboard trucks around Harvard, Columbia, and Penn displaying the names and faces of students tied to a pro-Palestinian statement and labeling them; students reported harassment and had job offers rescinded.
Source: Harvard Crimson, CNN.
Another thing to know is that the crowd gets it wrong, and being innocent doesn’t save you from the fallout. During the Charlottesville identifications, a University of Arkansas professor named Kyle Quinn, who was more than a thousand miles away that weekend, got tagged as a marcher because he had a similar build and beard and a man in the photo happened to wear an Arkansas Engineering shirt. People posted his home address, the messages were vile enough that he and his wife left and stayed with a friend, and some refused to walk it back even after his own university confirmed it wasn’t him. In the campus cases, several students who got named on the trucks and on harassment sites hadn’t even signed the statement they were being targeted over. Once your name gets attached to a face online, it doesn’t quietly come back off.
Source: NPR, PEN America.
What To Do: If You’re Casually Showing Up
You’re going in your free time off work, you support the cause, you’re not planning anything that’s going to land you in a holding cells. You still don’t want your attendance following you home, and you don’t want a stranger with opposite politics turning it into a passion project. Here’s how to prepare yourself:
- If you must bring your phone, set a REAL lock screen passcode before you go, not 1234 and not your birthday. An encrypted phone with a strong passcode is genuinely hard to get into. A four digit PIN is not. It’s super easy to get pick pocketed or drop and lose your phone at any point.
- Turn off your location history in your account settings, not just on the phone. In Google it’s your account’s Location History setting. Mine is always on because I forget where I park. Turn it OFF. On iPhone, check Significant Locations under Settings, Privacy & Security, Location Services, System Services. Your carrier can still see your phone, but at least you stop building a neat personal log of it.
- Use Signal for any coordinating, not regular texts. Set the conversation to disappear after a day.
- Think for two seconds before you post. Faces, tattoos, license plates, house numbers, a storefront in the background. All of it can place people. If you post photos of the crowd, blur or black out faces first. Blacking out is safer than blurring, since blur can sometimes be reversed.
- Strip the hidden metadata off photos before posting. The fastest way is to screenshot the photo and post the screenshot instead of the original, which drops the embedded time, location, and device info.
- Cover what makes you identifiable before you leave the house. A distinctive tattoo, the jacket everyone’s seen you in, a tote or pin with your name or workplace on it. Philadelphia turned on a tattoo and a shirt, and Charlottesville turned on a face.
- If you can and if it’s that deep, keep your activism handle separate from your real name. If you post protest content under the same username you use for online reviews, a marketplace account, or anything linked to your LinkedIn, you’ve connected the two for anyone who goes digging.
- Completely skip the live “I’m here at X right now, come join us” posts. Just don’t do it, common sense.
What To Do: Serious Organizers/Higher-risk Activists
This tier is for people who organize, who’ve been targeted before, who expect to be near the front, or who have reason to think they’re already on somebody’s list. The everyday stuff still applies but add the following:
- Separate yourself from your daily phone entirely. Your everyday phone is a logbook of your whole life, and it’s the thing most likely to get taken if you’re detained. The stronger move is to leave it at home and either carry nothing or carry a cheap second phone with only the contacts and apps you need for the day. Don’t carry both switched on at once, because two devices traveling together can be matched to each other and that undoes the point. Whatever you carry, keep biometrics off and use a passcode, and keep the phone fully powered down when you’re not actively using it. A phone that’s off, encrypted, and locked with a strong passcode is the hardest thing for anyone to get into, and unlike your face or your fingerprint, a passcode can’t be physically used on you while you’re being held. Assume that a confiscated phone can be plugged into forensic extraction tools, so the less that’s on it the better.
- Shrink your findable footprint before you’re ever in a photo. Doxxers do insane work to look you up. If you’ve never doxxed someone before, you can’t even imagine how their minds work. Before you put yourself in a high profile risk position, search yourself the way they would: your name, phone number, current and old addresses, email, and usernames, while logged out of Google, plus a reverse image search on your profile photos. Then (hire me to) get yourself off the people search sites, the data brokers that publish your address, phone, and relatives. Most have an opt-out form, and PEN America’s field manual below walks through the major ones. Set personal accounts to private and pull your employer and hometown off the public facing ones.
- Have a legal plan before you walk out the door, especially if there’s a warrant. Write a legal support or lawyer’s number on your arm in permanent marker, because your phone won’t be in your hand if you’re arrested. Know whether there’s a legal observer presence or a local hotline running for the action. The thing is though… if you have an active warrant, no phone setting changes your legal exposure. A large city protest is one of the most heavily surveilled environments you can walk into, and Baltimore in 2015 is the proof that facial recognition has already been used to pull people with warrants straight out of a crowd - in the years following, the technology has only rapidly advanced. The realistic move is to deal with the warrant through a lawyer first.
If You Do Get Doxxed
It can happen to anyone including people who did everything right and people who weren’t even there. If your information starts circulating and you’re experiencing harassment:
- Screenshot everything before it disappears, so you have a record of who posted what and where. You’ll want it for reports and, if it escalates, for police or a lawyer.
- Report it to the platform as targeted harassment or as sharing private information. Posting someone’s personal details to intimidate them breaks the rules on basically every major platform, and that’s usually the fastest route to a takedown.
- Lock your accounts down immediately. Turn on two-factor authentication everywhere, change any reused passwords, and set personal accounts to private.
- Tell your employer or school before a doxxer does. A heads up from you, “I’m being targeted online, here’s what’s true and what isn’t,” lands a lot better than a psychotic email from someone trying to get you fired.
- Get real help if it escalates. PEN America keeps a free Online Harassment Field Manual with step-by-step guidance on doxxing and threats, and if the threats get specific or you fear for your safety, that’s a police report and possibly a lawyer, not something to white-knuckle alone.
At the end of the day you’re protecting against your own phone’s location trail, your own camera roll, and a crazy stranger willing to work backward from one photo to your front door. Carry less, post less, keep your activism life separate from your real accounts, cover what identifies you, and if the stakes are real, line up a lawyer before you go rather than after.
Read more: EFF: Attending a Protest | PEN America: Online Harassment Field Manual