File Metadata Risks for Journalists Using Tor

While the Tor network provides robust protection for internet traffic and physical IP addresses, it does not alter or sanitize the contents of the files transmitted through it. If a journalist or whistleblower sends a file containing embedded metadata via Tor, that metadata can directly compromise their identity, location, and hardware information. Understanding the boundary between network anonymity and file-level privacy is critical for maintaining operational security.

The Difference Between Network Anonymity and Payload Data

Tor functions at the network transport layer. It wraps data in multiple layers of encryption and routes it through a decentralized series of relays, preventing network observers and recipient servers from seeing the sender’s real IP address.

However, Tor treats the payload—the actual file being sent—as a black box. If an attached file contains identifiable data within its internal structure, the recipient (or anyone intercepting the decrypted exit traffic) can extract that information directly from the file itself.

Common Types of Deanonymizing Metadata

Files frequently store hidden information generated automatically by software and hardware:

• Images (EXIF Data): Photos taken on smartphones and modern cameras often store exact GPS coordinates, camera serial numbers, device models, and timestamps.
• Documents (Word, PDF, OpenDocument): Office documents routinely retain author names, company names, file paths, operating system usernames, printer tracking codes, and complete revision histories that reveal prior drafts and deleted text.
• Audio and Video Files: Media files can contain software identifiers, recording device details, and embedded thumbnail caches.
• Archive Files (ZIP, TAR): Archives often preserve original file creation dates, user IDs, and local directory structures.

How Metadata Compromises Sources and Journalists

If a journalist receives a leaked document via a SecureDrop instance running on Tor, or sends an investigative piece to an editor via a Tor-routed email, the network privacy remains intact. However, if the document’s internal properties list the journalist’s or source’s actual name, computer username, or local network path, the Tor connection becomes irrelevant.

Adversaries do not need to break Tor’s encryption to identify the creator of a document; they simply read the metadata embedded within the file structure.

How to Mitigate File Metadata Risks

To prevent metadata leaks when using Tor, journalists must sanitize all files prior to transmission:

• Use Metadata Stripping Tools: Programs like Metadata Anonymisation Toolkit 2 (MAT2) or Dangerzone convert complex, potentially compromised documents into safe, flattened formats while stripping hidden attributes.
• Export to Plain Formats: Converting documents to plain text (.txt) removes document properties and revision histories entirely.
• Strip Image EXIF Data: Dedicated command-line tools like exiftool can remove all metadata tags from images before distribution, or users can take a clean screenshot of the image to discard the original file’s metadata container.
• Utilize Specialized Operating Systems: Privacy-focused operating systems like Tails route all traffic through Tor by default and include built-in metadata cleaning tools to sanitize files before they are shared.