They all use the same playbook.
Your investigative journalist trying to verify your source. Your ex trying to figure out if you moved. And the guy in the windbreaker with a federal badge who definitely says he's "just doing some background."
Different motivations. Same 5 tricks. And if you don't understand them, you are not hard to find. You are conveniently searchable.
I spent years on both sides of this game — finding people who didn't want to be found, and helping people disappear who absolutely needed to. The uncomfortable truth is this: privacy isn't about being a ghost. It's about breaking the pivots that make you trivial to pivot.
Here are the 5 tricks they all use.
1. The Breadcrumb Pivot: One Crumb Is All They Need
Amateurs search for your name. Professionals never do.
They start with the one thing you can't change easily and pivot off it. That one crumb is usually:
- A username you reused in 2016
- A phone number from a data breach
- An old email you used for a pizza loyalty program
- A photo you posted where your license plate is blurred but your neighbor's isn't
This is called pivoting, and it's the entire foundation of modern OSINT. You don't find Void Rane. You find izkaboz on a forgotten forum, which links to an email, which links to a GitHub, which links to a resume PDF, which lists a city.
Journalists call this "verification." Exes call this "just checking." Feds call this "establishing a pattern of life." It's the same graph traversal.
How it works in the wild: You post a story from a coffee shop. You don't tag the location. But the barista has a distinctive tattoo, the menu board has a phone number, and your latte art has a reflection of the street sign behind you. One pivot gives them the city. Second pivot gives them the shop. Third pivot gives them your routine: Tuesdays and Thursdays, 9:30am, oat milk latte, sitting by the window with the good light.
You didn't leak your location. You leaked three things that become your location when correlated.
The fix is ruthless compartmentalization. Different names, different emails, different browsers, different personas for different threat models. Not because you're paranoid. Because databases are forever and your memory of what you posted in 2019 is not.
The rule: If two accounts can be connected by a single search, they are the same account.
2. The Dork Bible: Google Isn't a Search Engine, It's a Confession Booth
Everyone thinks they know how to Google. Almost no one does.
Your ex isn't typing Void Rane Charlotte. She's typing:
site:venmo.com "Void" "Charlotte"
filetype:pdf "Void Rane" resume
intext:"@izkaboz" AND ("gmail.com" OR "protonmail")
Journalists have this down to a religion. It's called Google Dorking, and it's just advanced operators that turn Google from a popularity contest into a database query language. Add Yandex, Bing, and DuckDuckGo image search — because Google is actually the worst at faces — and you can find a person's entire digital exhaust in 20 minutes.
The real power move? De-indexed search. People think deleting a post deletes it. It just deletes it from your profile. The dork bible finds the cached version, the archive.org snapshot, the repost bot that scraped your Instagram to a spam site in Indonesia in 2021. The internet never forgets. It just gets worse at indexing until someone who knows how to ask comes along.
My favorite example: A founder told me he was "completely offline." I found his home address in 6 minutes because his dog walker tagged his dog's Instagram account, which had his old address in the bio from 2020. He didn't leak his address. His dog did.
The fix is pre-emptive poisoning and removal. You can't just delete. You have to audit what search engines think you are. Search yourself like someone who hates you would. Then dork yourself like someone who is paid to find you would.
3. The Metadata Trap: Your Files Are Snitching On You
This is the one that gets journalists and activists caught.
You take a photo of a sensitive document. You crop out your face. You post it anonymously. Congratulations, you just uploaded a file that contains:
- Exact GPS coordinates where the photo was taken
- Your iPhone model and iOS version
- The time you took it down to the second
- Often, your full name if you had "Save as: Void_Rane_license.jpg"
That's EXIF data. And it's not just photos. Word docs have author names and revision history. PDFs have the software that created them and sometimes the path it was saved to: /Users/void.rane/Documents/DO NOT LEAK/. I've seen it. Multiple times.
Feds love metadata because it holds up in court and you volunteered it. Exes love it because iPhones embed location by default and most people have never turned it off. Journalists hate it when their sources do it, because it burns the source without the journalist ever knowing.
A few months ago, a very smart person sent me a "fully anonymized" video. I ran exiftool on it and got the exact Airbnb they were staying in from the audio fingerprint of the smoke detector.
The fix is a Ghost Mode workflow. Never post originals. Ever. Screenshot the photo, screen-record the video, copy-paste text into a fresh .txt file. Run everything through a metadata nuker before it touches the internet. If your workflow doesn't include a deliberate metadata removal step, you don't have a privacy workflow. You have a hope.
4. The Network Pivot: You Are Your Friends
You can be perfect. Your friends won't be.
This is how 90% of real investigations close the loop. They can't find you, so they find the five people closest to you and watch them.
Your mom posts "So proud of my daughter moving to NoDa!" Your friend tags you at a climbing gym with the caption "my usual belay partner." Your roommate's Venmo is public and says "rent - 1520 Central Ave Apt 3B."
Journalists call this "mapping the network." Feds call this "two hops." Your ex just calls it "looking at who liked his post."
OSINT investigators have a saying: You don't need to find the target. You just need to find someone who loves the target enough to post about them.
Modern tools make this trivial. You can map an entire friend graph, cluster it by frequency of interaction, and identify the weak link — the person with 800 public friends, a public Facebook, and a habit of checking in everywhere. That person is your breach.
I once watched an investigator find a CEO who had gone fully off-grid by finding his executive assistant's Strava running route that started and ended at a private residence in Jackson Hole every morning at 6am.
He wasn't hiding. His assistant was exercising.
The fix is social media hygiene as a group project. Talk to your inner circle. Not in a paranoid way. In a respectful way: "Hey, please don't tag me in locations, don't post photos of my house/kids/car, and if you have to post that group photo, crop me or blur me." People who love you will get it. The ones who don't were never going to respect your boundaries anyway.
5. AI-Native OSINT: The Game Just Changed and You Didn't Notice
This is the new one. And it's the one that makes the previous four look quaint.
For ten years, OSINT was manual. You had to know where to look. Now AI looks everywhere at once.
- Face search: PimEyes, FaceCheck.ID and a dozen private models can take one blurry photo from a protest, a bar, or a dating profile and find every other place that face has appeared online. Your journalist source wore a mask but forgot about the reflection in their glasses? Found.
- AI-enhanced imagery: That license plate you blurred? AI de-blurs it. That background you thought was too dark to see? AI enhances it to daylight. That voice note you disguised? AI voice-to-text plus voiceprint matching.
- Pattern synthesis: AI can ingest 3,000 of your tweets, your Reddit history, and your Spotify playlists and predict with scary accuracy where you live, your political views, your mental health state, and your schedule. Not because it's magic. Because humans are predictable and you are training the model on yourself for free.
Exes use this now. Not just nation-states. There are TikTok tutorials for "how to find his new girlfriend with AI." It's not underground anymore. It's consumer software with a pastel UI.
This is why old privacy advice — "use a VPN" — is now basically astrology. A VPN doesn't protect you from yourself posting 400 searchable data points a day.
The fix is going AI-native on defense. You need to understand what AI sees when it sees you. Run your own face through PimEyes. Run your own writing through a stylometry detector. See what a clustering model thinks your friend group looks like. You cannot defend against what you don't measure.
Look, here's the uncomfortable conclusion no one wants to say out loud:
Privacy in 2026 is not about having something to hide. It's about having something to protect. Your focus, your location, your relationships, your future leverage. Every app you use is built on the assumption that you are the product and your data is the inventory. Journalists, exes, and feds are just power users of that system.
You have two choices. You can be searchable by default and surprised when it matters. Or you can be intentional by default and boring to find.
Boring is the goal. Boring is freedom.
If you want to go from "I should probably be more private" to having an actual, working system — not just a list of tips — I put my entire playbook into three packs:
For disappearing: My Privacy / OpSec stack covers the full Nukepack for account deletion, Ghost Mode for daily browsing, how to actually do OSINT pivots defensively, metadata nuking workflows, and the AI-native OSINT defense toolkit. It's the system I wish someone gave me 5 years ago.
→ Privacy/Opsec Stack: Nukepack + Ghost Mode + OSINT Pivots + Metadata + AI-Native OSINT — numbpilled.gumroad.com/l/privacy-opsec-stack
For going fully offline: If you want AI that can't snitch because it never touches the cloud — the Pi 5 NVMe + Hailo-8 + Pico W cluster build, local LLMs, offline workflows. Your own private Skynet in a Pelican case.
→ Offline AI Cyberdeck Pack — numbpilled.gumroad.com/l/offline-ai-cyberdeck-pack
For learning to see like they see: If you want to understand the investigator mindset — the Dork Bible with 400+ operators, pivot workflows in Obsidian, and the AI toolkit I use for investigations. Learn offense to build better defense.
→ OSINT Investigator Pack: Pivots + Dork Bible + Obsidian Workflows + AI Toolkit — numbpilled.gumroad.com/l/osint-investigator-pack
Stay boring out there.
Top comments (0)