Whistleblowing guide: Why you should remove the metadata

** This is part four of ExpressVPN’s whistleblowing guide. **

Part 1: Whistleblowing guide: Blowing the whistle is tough
Part 2: Whistleblowing guide: How to stay anonymous when blowing the whistle
Part 3: Whistleblowing guide: How to protect your sources

If you’re involved in a whistleblowing case, either as the whistleblower or as a journalist, make sure you adequately deal with metadata.

Only retain data that is absolutely necessary

It might be tempting to retain everything, but it’s better to delete non-pertinent information. Knowing what to delete is hard as some data will be crucial to verify and underpin the claims made by the whistleblower.

Secure your chats

Decide whether to log or record chats and phone calls before you begin the call, and communicate this clearly to your source. Sources might behave differently if you record them, but will also choose their words more carefully.

If you log chats, consider saving them in plain text format to avoid metadata and remove time stamps. You can also edit out spelling mistakes or standardize the language of your source, in the hope the changes make it harder to identify them.

Discard envelopes

Is it important to retain the envelopes of physical mail delivered to you? Envelopes can reveal information about where and when the contents were posted, and might even contain DNA from your source.

Purge Email headers

Because they include digital signatures, headers can be crucial in verifying the authenticity of an email. But when proving authenticity is not important, it might be better to discard them. If authenticity is somewhat important, it might be a good option for a credible outside expert to verify them then delete the original data.

Remove metadata before you publish documents

No matter if you deal with documents, images, chat logs, or audio files—everything has metadata associated with it. Some metadata might be impossible to remove (such as the length of an audio file), but it’s incredibly important to understand what metadata someone could extract from a document.

PDFs, word documents, and .jpg files all carry metadata directly in their structure. The data may include the username of the person who created the document, or even the GPS location of a photo’s capture. You can remove this kind of metadata with a tool like MAT.

Look out for hidden metadata

Other metadata is more complicated to remove or to spot. The background noise of an audio recording might reveal where the recording took place, while every printed document contains barely visible yellow dots that show which printer produced the paper and the date of print.

Removing every piece of metadata that could identify your source is incredibly important, and you cannot rely on your source to take care of that alone. Depending on what documents you handle, try to inform yourself as much as you can about what links an outsider might draw between the documents, your source, and you.