Protecting a source's photos on your iPhone
A source sends you pictures. Metadata, faces, your cloud and your own phone can all give them away. Practical habits, and what a phone vault cannot solve.
Assume the original file identifies someone. Keep it off iCloud Photos, strip metadata before anything leaves your hands and cover identifying details with solid blocks, since blur can sometimes be reversed. For serious risk, ask your newsroom's security lead or a press-freedom group, because a phone app cannot address every threat.
Your duty to a source starts with the file they sent, and it runs through every device it touches. Here is how to reduce exposure on an iPhone. It will not replace a newsroom’s security plan.
Handle the original
- Ask how they sent it. A message app that strips metadata may leave you with a safer copy already. An emailed attachment may carry everything.
- Inspect a copy. Use the metadata viewer in your browser, which reads the file on your device. Freedom of the Press Foundation recommends checking files with a tool such as ExifTool on a computer as well.
- Do not save it to your library with iCloud Photos on, or it reaches iCloud and every device on your account. Under standard data protection, Apple holds the keys.
Before publication
- Work from a copy.
- Strip metadata, then check again.
- Cover faces, plates, tattoos and documents with solid blocks. EFF notes that blurring can sometimes be reversed, so blocking out is better. The redactor writes a new PNG with the pixels replaced.
- Look for what metadata tools miss, such as window views, serial numbers and printer patterns.
Your phone
Use a long alphanumeric passcode. Turn on Advanced Data Protection if your work allows it. If you believe you are a target of sophisticated spyware, Apple built Lockdown Mode for that situation, and it limits some features, including Shared Albums.
An app like Backroom can keep files out of your library, behind a separate pattern, with no account or cloud. Be realistic about it. Backroom has had no independent security review. It does not block screenshots, and it cannot help with a compromised phone, since malware could read what you see on screen. Do not treat it as the only protection for a person’s safety.
Press freedom organizations, including the Freedom of the Press Foundation, publish guidance and can point you to help.
Frequently asked questions
Does taking a screenshot remove metadata?
It drops the original file's metadata, as EFF notes, though a screenshot gets its own and the picture quality can fall. Look at the content too: reflections, street signs and device details can say as much as the metadata.
What does a forensic tool see in Backroom?
Files are encrypted, yet an examiner with a phone extraction could estimate how much data the app stores and how many vaults hold data. The app does not hide its presence on the phone.