2026-07-28

Protecting a source's identity: what document metadata reveals before you ever hit publish

A source hands a reporter a file. A freelancer attaches a document to a pitch email. A tipster screenshots a page and sends it along. In every one of those moments, the file itself can carry information that has nothing to do with its visible content and everything to do with who touched it — and unlike a byline, nobody chose to put it there on purpose. The most-cited case for why that matters ended in an arrest within days.

The printer dots that helped identify Reality Winner

In May 2017, The Intercept published a scan of a classified NSA report it had received from a source. Security researcher Rob Graham noticed the page carried a nearly invisible pattern of yellow dots — a "machine identification code" that some color laser printers embed in every page they print. Using a decoder built by the Electronic Frontier Foundation, Graham read the pattern out: printer model 54, serial number 29535218, and a timestamp of May 9, 2017 at 6:20am. Cross- referenced against the printer's own access logs, that was specific enough to narrow the pool of people who could have printed that page to a handful. Days later, NSA contractor Reality Winner was arrested and charged with leaking the document. EFF's own account of the episode notes one nuance worth keeping straight: the government affidavit that led to Winner's arrest didn't actually cite the tracking dots as evidence — but the case became, and remains, the case people point to first when explaining that a printed page can carry more identifying information than the text on it.

The dots themselves aren't new or secret in the sense of being undiscovered — EFF's research team, led by Seth Schoen, first cracked the code behind them back in 2005, confirming that at least one major printer line encoded the date, time, and serial number of the device into a pattern read via a Secret Service arrangement originally framed as an anti-counterfeiting measure. What made 2017 different is simply that someone applied that decade-old public research to a live case.

Why this is a different risk layer than file metadata

Here's the boundary that matters for anyone trying to reason about what actually protects them: tracking dots aren't stored anywhere in the file. They're added by the printer's hardware at the moment of printing, onto the physical page, invisible to the eye but readable under blue light or magnification. No metadata-scrubbing tool — NearScrub included — can find or remove something that was never part of the digital file in the first place; by the time those dots exist, the leak has already moved from "a file with metadata" to "a printed page with a different kind of mark entirely." That's a genuinely separate risk, and treating it as solved because a file's metadata was cleared would be a dangerous mistake for anyone in a real high-stakes situation.

The layer that is inside the file

What NearScrub — and file-metadata scrubbing generally — does reach is the layer underneath that: information the file carries about itself before it's ever printed. A newsroom security-training resource aimed at journalists, OpenNews's "Field Guide to Security Training in the Newsroom," names exactly two categories here: a Word document's author name, the Microsoft account or license holder tied to the software that created it, and its revision history; and a photo's EXIF data — GPS coordinates, camera model, capture timestamp. Both categories sit inside the file whether or not anyone prints it, and both survive being renamed, re-emailed, or re-uploaded, because renaming a file changes nothing about what's stored inside it.

For a Word, Excel, or PowerPoint file specifically, that means the author name and lastModifiedBy field — the actual Windows or Microsoft 365 account of whoever last saved it — sit in the document's property parts regardless of what the visible text says or who the byline credits. For a PDF, the same idea shows up in the Info dictionary's Author/Creator/Producer fields, which commonly name the software (and sometimes the organization) that generated a scan or export, plus an XMP metadata stream carrying a parallel copy of the same information. For a photo, it's the EXIF block's GPS tags and device identifiers.

Photographing a leaked document can make this worse, not better

There's a specific trap worth naming: the Freedom of the Press Foundation's own guidance for people sharing sensitive material recommends photographing a physical document with an old-fashioned camera rather than a smartphone — precisely because a smartphone photo carries the same GPS-tagged EXIF block as any other picture taken on that phone. The instinct to avoid sending the original file by photographing it instead is sound; doing that photographing with a phone quietly reintroduces the exact location-tagging risk the extra step was meant to avoid, just in a different file. The Foundation's guidance lists a screenshot, or a photo from a camera with no GPS capability, as the safer versions of that same workaround.

What to actually do before a document leaves your hands

None of this is really about journalism specifically — a freelancer forwarding a client's draft, a tipster attaching a screenshot, or anyone sending a document they'd rather not have traced back to a particular machine or account is in the same position. Before a file goes out: for a Word, Excel, or PowerPoint file, clear the author, last-modified-by, company, and custom-property fields. For a PDF, clear the Info dictionary and the XMP stream. For a photo, drop the EXIF block entirely — GPS tag included, whether or not you think it's set. That's exactly the layer NearScrub clears, in the browser, with nothing uploaded: drop the file in, and the property parts and EXIF/XMP data that carry a name, a username, a company, or a coordinate come out clean. For the small number of cases where the stakes go past that — a physical leak that will be printed and photographed, or a threat model where the transmission channel itself needs to be anonymous — that's exactly where dedicated tools built for that specific problem take over: Dangerzone (also from the Freedom of the Press Foundation) rasterizes a document to strip anything beyond plain content, and SecureDrop provides an anonymous submission channel in the first place. NearScrub isn't a replacement for either — it's the fast, no-install, no-upload way to close the file-metadata layer for the far more common case that doesn't need either one.