For journalists, source protection means treating every photo, scan or screenshot from a source as something that may identify them. Image files can carry GPS coordinates, the exact capture time, the device make and model, camera serial numbers, owner names and embedded preview images, and some identifying traces, such as printer tracking dots, are not metadata at all. Before you publish or share any source material, work on copies, inspect them, remove the metadata, and check what the image itself reveals.
What a source's photo or scan can reveal
The table lists the common traces in material that reaches a newsroom. The first group can be removed with metadata tools. The second group cannot.
| Trace | Where it lives | What it can reveal | Removed by metadata cleaning? |
|---|---|---|---|
| GPS coordinates | EXIF GPSLatitude, GPSLongitude, XMP | Where the photo was taken: an office, a home, a specific floor | Yes |
| Capture time | EXIF DateTimeOriginal, OffsetTime | When it was taken, which can be matched against access logs or shift rotas | Yes |
| Device identity | Make, Model, BodySerialNumber, maker notes | The specific phone or camera, which may be registered or linked to other photos | Yes |
| Owner or author name | Artist, CameraOwnerName, XMP dc:creator | A name, sometimes the source's own | Yes |
| Software and edits | Software, XMP history | Which apps were used, file names from the source's system | Yes |
| Embedded thumbnail | EXIF IFD1 | An uncropped preview, sometimes showing what was cropped out | Yes |
| Printer tracking dots | On the paper, printed in faint yellow | The printer's serial number and the print date and time | No |
| Visible content | The pixels | Desk details, reflections, screen names, window views | No |
| Unique document versions | Wording, layout, spacing | Which recipient's copy leaked, if versions were individually varied | No |
| Sensor noise pattern | The pixels | Forensic researchers have shown that a camera sensor's noise pattern (called PRNU) can link an image to a specific camera without any metadata | No |
For more on how serial numbers connect separate photos, see camera serial numbers in photos. For the investigator's side of the same techniques, see how investigators use photo metadata.
What the Reality Winner case actually involved
The 2017 Reality Winner case is often cited as a metadata failure. It is worth describing precisely, because it was not about photo EXIF data.
On June 5, 2017, The Intercept published a story based on a classified NSA document about Russian attempts to compromise US election systems, with a scan of the document. The same day, the Justice Department announced that Reality Winner, a federal contractor, had been arrested on June 3 and charged with removing classified material and mailing it to a news outlet. According to the FBI affidavit, as reported at the time, a copy of the document had been provided to the government while the outlet sought to verify it. The NSA noticed the pages appeared folded or creased, suggesting they had been printed and carried out. An internal audit found that six people had printed the document, and Winner had exchanged emails with the outlet from her work computer.
After publication, people examining the published scan noticed the faint yellow dots that many color laser printers add to every page. Decoded, they appeared to give the printer's serial number and a print date and time of May 9, 2017, at 6:20. As the Electronic Frontier Foundation noted, the affidavit did not mention the dots, which may have played no role in identifying her.
The lessons for newsrooms are still clear:
- Sharing a source's material with anyone, including the subject of a story for comment or verification, can narrow down who had access to it.
- Physical documents carry traces that survive scanning, such as tracking dots, folds and handwriting.
- Publishing a faithful copy of the original publishes everything in it. Re-creating the content, by transcribing text or showing only the necessary parts, is safer.
A documented case of a published photo leaking a location
In December 2012, Vice published a photo of John McAfee, who was then avoiding authorities in Belize. The published image file still contained GPS coordinates, and readers quickly found that they pointed to a location in Guatemala. The story is a reminder that a newsroom can leak a location through its own publishing pipeline, not only through source material. Our article on whether someone can find your location from a photo covers both metadata and visual geolocation.
Your own field photos need the same care
Source protection is not only about material sources send you. Photos you take yourself can expose the people you meet:
- Meeting places. A phone photo of a document taken during an interview records the GPS coordinates and the time of that meeting. If the file is later shared with a colleague, a fixer or a lawyer, the meeting place travels with it.
- Bystanders and participants. At protests or in sensitive communities, faces, tattoos, clothing and vehicles in the background can identify people who never agreed to be in a story. Metadata removal does nothing about them; cropping, blurring or choosing another frame does.
- Your own movements. A series of geotagged photos posted from the field shows where you have been and, by extension, who you may have met there.
- Shared newsroom drives. Photos uploaded to shared storage or chat tools are often seen by more people than you expect. Clean them before they enter shared systems, not just before publication.
A simple habit helps: turn off location for the camera on the phone you use for reporting, and keep it off unless a story specifically needs geotagged images, for example to support verification of your own footage.
A safe workflow for handling source images
- Receive through a channel built for it. SecureDrop and similar systems are designed to keep the source's identity out of the transfer. Email is not: attachments arrive byte for byte with their metadata intact, as explained in our guide on email attachments and photo metadata.
- Open files in an isolated environment. SecureDrop's own documentation for journalists describes working on a Secure Viewing Station running Tails, which includes the metadata removal tool MAT2.
- Inspect before you clean. Read the full metadata with a tool like ExifTool (
exiftool -a -G1 -s file.jpg). Note anything that could help verification, then decide whether you need to keep it, and where. - Clean a copy, not the original. Removing metadata from a working copy keeps the original available for verification under your retention policy.
- Look at the pixels. Zoom in on reflections, screens, documents, badges, window views and anything printed. Crop or redact as needed, and make sure redactions are burned into the image, not layered on top in an editable file.
- Consider re-creating instead of publishing. For documents, publishing transcribed text or a re-typed excerpt removes printer dots, layout quirks and scan artifacts in one step.
- Verify the published file. After publication, download the image from your live site and inspect it again. CMSs sometimes serve the original upload or copy metadata into resized versions.
Do not send a source's original files to the people or organizations your story is about, even to ask for comment. Describe the material in words, or show a re-created excerpt, unless you have weighed the risk with your editor and, where possible, the source.
Advice you can give sources
Sources often ask how to send material safely. Some general points to share, adapted to your own security guidance:
- Do not use work devices or work networks to photograph, scan or send material.
- Turn off location for the camera before taking photos, and remember that this does not clean photos already taken.
- Avoid sending originals by email or as "files" or "documents" in messaging apps, which usually deliver them unchanged.
- Think about the background: a recognizable desk, screen, window or reflection can identify a place.
- Remember that printed documents can carry tracking dots and that photographs of screens can show usernames, open tabs or notifications.
Where an online tool fits, and where it does not
Our tool processes images on our server and deletes them automatically and permanently 10 minutes after processing, with no copies, backups or image logs. It accepts JPEG, PNG and WebP, removes EXIF, XMP, IPTC and C2PA data, and shows a report of what it found. That makes it a fast option for routine newsroom images, such as field photos, staff portraits or contributor pictures, and for sources who have nothing else at hand.
For highly sensitive source material, the safest rule is that the file should not leave a trusted machine you control. Use an offline tool such as ExifTool or MAT2 on that machine, then check the result. Our guide on how to check that metadata was really removed shows what clean output looks like. And remember that no metadata tool, online or offline, removes what is visible in the image.
Newsroom checklist
- Receive source material through a secure channel, not email.
- Inspect metadata and the visible content before anyone else sees the file.
- Decide deliberately whether to keep originals, where, and for how long.
- Clean working copies; keep cleaning offline for sensitive material.
- Never share originals for verification or comment.
- Prefer re-created excerpts over facsimiles of documents.
- Clean your own field photos too. For quick jobs, our free metadata remover works in any browser.
- Download and inspect what your site actually publishes.