About the LevelUp series: At The Markup, we’re committed to doing everything we can to protect our readers from digital harm, write about the processes we develop, and share our work. We’re constantly working on improving digital security, respecting reader privacy, creating ethical and responsible user experiences, and making sure our site and tools are accessible.
Hi! It’s Monique again. I’m an investigative reporter here at The Markup, and this week I’m revisiting a topic that sparked some serious interest after we published a guide on anonymizing your phone in October.
LevelUp
Without a Trace: How to Take Your Phone Off the Grid
A guide on anonymizing your phone, so you can use it without it using you
In the piece, Wesley Callow—The Markup’s IT specialist—and I put on our trenchcoats and gave you a behind-the-scenes look at our quest for phone anonymity. We gave you a step-by-step guide on how to set up an off-the-grid phone, and a glimpse into why, personally speaking as a journalist, having one is so important for protecting my sources and staying safe (for example: making sure my contacts are aware that they have a secure way to communicate with me—or preserving my own privacy by ensuring my private information isn’t attached to any account).
The feedback was dynamic, and I was delighted to chat with readers who share similar interests. Some of those conversations included questions and responses that could benefit a broader audience. So, tech detective Wesley and I dug a little deeper into some of the remaining questions.
Is it true that if I don’t want someone to track me, I shouldn’t do personal tasks with a burner phone on me, like go to an ATM, get groceries, or pick up my child from school, especially if I have my personal phone on me, too?
It’s possible for someone to make inferences about your identity if you use your personal and anonymous phones at the same times and in the same places.
If you have privacy concerns and want to limit the potential for your personal and burner phones to be associated with each other or with your home, you can take certain precautions to minimize their simultaneous presence and activity in the same physical locations:
- Turn off location services: Disable location services on both your personal and burner phones when you don't need them.
- Use airplane mode: You can put your personal phone in airplane mode or turn it off while using your burner phone, and vice versa, to reduce the likelihood of co–location tracking.
- Review permissions: Regularly review and adjust the permissions you've granted to apps on both phones. Limit access to location data unless it's essential for an app's functionality.
- Leave your personal phone behind: If you’d prefer your personal phone weren’t associated with your location or activities, you can achieve a higher level of anonymity or privacy by leaving it at home or in a secure location when you use your burner phone.
Balancing privacy with convenience is important. Avoiding co–location tracking entirely may require trade-offs. Connecting your identity based on the co-location of your burner and personal phones would generally require access to data from multiple sources and may not be easily achievable without your consent or cooperation. Decide what level of privacy you’re comfortable with and what makes sense for your daily life.
If I open an email address or a grocery rewards account with the burner phone number, does that make my line easily discoverable to advertisers or bad actors?
Yes! Do not use an anonymous burner phone number to register for anything that pertains to you, your life, habits, store locations, etc.
Is it too risky to make a phone call from a burner phone? Or is it better to solely text a contact?
You can do both, but it is recommended to send messages using a secured encrypted messaging app like Signal and have a virtual private network (VPN) running. Do not use standard SMS or iMessage.
Are Android messaging systems more secure than Apple, or vice versa?
There are a number of factors that influence the security of messaging systems, so it’s hard to make a blanket statement. Instead, let’s take a look at how Apple and Android compare in a number of different areas.
End-to-End Encryption
- Apple: Apple's iMessage uses end-to-end encryption, which means that messages sent between Apple devices are encrypted and can only be decrypted by the sender and the recipient. This provides a high level of security.
- Android: Android devices do not have a standardized messaging app with end-to-end encryption across the board. Some apps like Signal and WhatsApp, which are available on both platforms, offer end-to-end encryption for text messages and voice/video calls.
Default Encryption
- Apple: iMessage uses end-to-end encryption by default for messages between Apple devices. This means that users don't need to take any extra steps to enable encryption.
- Android: Encryption may not be enabled by default on all Android messaging apps. Users may need to opt to use a messaging app that offers end-to-end encryption or manually enable encryption in some cases.
App Permissions: Both Android and Apple devices allow users to control app permissions, including access to contacts, location, and other sensitive data. If you really want to enhance your security and privacy, it’s crucial to review and manage what permissions apps have.
Updates and Patching: Regular updates and timely security patches are essential for maintaining the security of any device or messaging app. Both Android and iOS receive updates, but the speed at which updates are delivered can vary depending on the device manufacturer and wireless carrier.
Third-Party Apps: Both Android and iOS allow users to install third-party messaging apps. The security of these apps can vary widely, so it’s essential to choose reputable and well-reviewed options.
If I post or send a photo or video on social media or a messaging platform like WhatsApp or SMS from my burner phone, can someone find me?
Posting a photo or video from a secure and anonymous phone can still carry risks when it comes to maintaining your anonymity. Here are some considerations:
- Metadata: Photos and videos often contain information like the GPS coordinates of where the photo or video was taken, the date and time it was captured, and the device used. If this metadata is not stripped or altered, it could reveal your location and device information.
- Content Analysis: Even if you take steps to protect your identity, the content of the photo or video itself may contain clues that could be used to identify you. This could include landmarks, unique objects, or other contextual information.
- Social Media and User Behavior: The way you use your anonymous phone and the patterns of behavior you exhibit on social media or online platforms can sometimes be used to identify you, especially if you share similar content or engage with the same communities using your regular accounts.
- Network and IP Address: Depending on how you connect to the internet (e.g., using public Wi-Fi or a VPN), your IP address may be associated with the activity. Advanced tracking methods can link your activity to your IP address.
- Contact Tracing: If you have connections or share contacts with your regular identity on the platform where you're posting content from your anonymous phone, it might be possible for someone to make inferences about you based on your interactions and connections.
- Legal and Investigative Actions: In some cases, law enforcement or investigative authorities may have the ability to track down individuals who use anonymous phones, especially if they are engaged in illegal activities.
To maximize your anonymity when posting content from a secure and anonymous phone, consider the following precautions:
- Strip or alter metadata from photos and videos before posting them.
- Be cautious about sharing identifying information in the content itself.
- Use a VPN to mask your IP address.
The Breakdown
How Do I Prepare My Phone for a Protest?
Simple steps to take before hitting the streets
What about government spy agencies? Can they still find you?
Spy agencies have a range of capabilities depending on the resources of the specific agency, the methods they employ, and your own operational security practices. Here are some considerations:
- Government agencies that engage in spying often have significant resources, advanced technologies, and legal authority to conduct surveillance. This means that they may have the means to track individuals even when they take measures to protect their anonymity.
- Many of these agencies can employ advanced surveillance techniques, such as tracking communication patterns, monitoring network traffic, and conducting signal interception. These methods can reveal individuals’ identities, even if they are using anonymous phones.
- In some cases, spy agencies may resort to physical surveillance methods, such as tailing individuals or deploying tracking devices on vehicles.
- Some agencies have legal authority to compel service providers or technology companies to provide access to user data and communication records. This can compromise anonymity if an individual's identity is linked to their phone or online accounts.
This question is for Monique: If you’re worried about the government blocking your access to your sources, why do you list your phone number on The Markup’s website?
If you read our previous post, I took readers back through my 15 years of reporting. At one point, I was followed home after I published a story. At another, the federal government blocked my access to the community I was covering: people detained by U.S. Immigration and Customs Enforcement. The lowest point: Someone threatened to harm my dog after my personal information was traced and blasted in a chatroom.
As I continue to build this beat—covering technology at the intersection of criminal justice, immigration, social justice, and government accountability—protecting myself and my sources means communicating with them via the only medium they have: recorded phone calls or a government-monitored mobile app. It means being able to receive leaked documents and communicate with people instantly. It means being able to change the phone number if it ever gets blocked or compromised.
My goal has never been total anonymity, but rather striking a balance between building trust and safety. When I do everything in my power to protect my sources’ identities, while simultaneously staying under the radar and keeping my own personal information private, it results in better journalism.
As I continue doing this work alongside my colleagues at The Markup, I hope this Q&A has empowered you to best safeguard your privacy, no matter what extent that may be.
Until then, call me, beep me, if you want to reach me at (786) 369-6249. 😉
