Shawn Stephenson

OPSEC for social media investigations is the practice of controlling what information is generated, exposed, or logged when researching a subject’s online presence across social platforms — including LinkedIn, Facebook, Instagram, and X (Twitter) — without alerting the subject, exposing the investigator’s identity, or triggering platform notification systems. These controls exist because every major social … Read more

An anonymous background check is a search conducted using public records, people-search platforms, and OSINT sources in a way that prevents the platform from logging your real identity, prevents the subject from being notified that a search occurred, and leaves no traceable connection between the investigator and the investigation. These searches are necessary because most … Read more

An OPSEC checklist is a structured set of operational security controls that investigators apply before, during, and after a search to prevent identity exposure, protect investigative integrity, and ensure the subject remains unaware of the research. These controls exist because modern research platforms, data brokers, and digital infrastructure generate persistent records of investigative activity — … Read more

Evidence handling in investigative research is the process of collecting, preserving, documenting, and storing digital findings in a manner that maintains their integrity, establishes their provenance, and ensures they remain usable if the investigation produces legal proceedings. Metadata is the embedded data layer within digital files that records how, when, where, and by whom a … Read more

OPSEC tools for investigators are the specific applications, services, and utilities that enforce operational security controls at each layer of an investigation — network, browser, identity, and file handling. These tools exist because OPSEC is not a single setting or a single application — it is a stack, and each layer requires a dedicated tool … Read more

An OPSEC mistake is a procedural or technical failure that exposes an investigator’s identity, location, or activity during a research operation — often without any immediate indication that the exposure occurred. These failures exist because operational security requires multiple controls to work simultaneously, and the failure of any single layer can negate the others. Investigators … Read more

An anonymous background check is the process of researching a person’s public records, online presence, and data broker profiles without exposing your identity or alerting the subject. These searches are commonly logged by commercial platforms, which associate activity with an account, IP address, or behavioral profile — creating a trail that leads directly back to … Read more

EXIF metadata is structured data embedded inside digital image files at the moment of capture — recording the GPS coordinates where the photo was taken, the device that took it, the exact timestamp, camera settings, and in some cases the software used to edit it. For OSINT investigators, EXIF data is a high-value pivot source: … Read more

Operational security — OPSEC — is the practice of protecting your own identity, location, and investigative activity while conducting research on a subject. For OSINT investigators and anyone conducting anonymous research methods online, it means ensuring that the act of researching someone doesn’t reveal to that person that they’re being researched, doesn’t expose your real … Read more