TIL in 2012, a burger king employee anonymously posted an image on 4-chan of him putting his feet in lettuce, with the caption: "This is the lettuce you eat at Burger King." It took 20 minutes for people to track down the branch the employee worked at and contact the news. He was fired.

The post went live at 11:38 PM on July 16, and a mere 20 minutes later, the Burger King in question was alerted to the rogue employee. At least, I hope he's rogue.

The BK employee hadn't removed the Exif data from the uploaded photo, which suggested the culprit was somewhere in Mayfield Heights, Ohio.

This was at 11:47. Three minutes later at 11:50, the Burger King branch address was posted with wishes of happy unemployment. 5 minutes later, the news station was contacted by another 4channer.

Three minutes later at 11:50, the Burger King branch address was posted with wishes of happy unemployment. 5 minutes later, the news station was contacted by another 4channer. And three minutes later, at 11:58, a link was posted: BK's "Tell us about us" online forum. Cleveland Scene Magazine contacted the BK in question the next day. When questioned, the breakfast shift manager said "Oh, I know who that is. He's getting fired."

Comments2

@khontis

All in all, a good reminder that you're not as anonymous as you think you are.

@yd reply

You're only as anonymous as your weakest link.

There are tools to remove exif data from images/videos.
There are VPN/Tor services for masking your IP.
There's disposable email for masking your personal mail accounts.
There are a lot of fake GPS tools to mask your current location.

You are already 80% safe if you follow the above. The above data is what most security analysts use to create a digital fingerprint of you to track you across the internet. So unless you're a journalist/spy, you're safe.

but what if I am a journalist and need that extra anonymity?

Then there's also a few operating systems and web browsers that store telemetry (Microsoft & Chrome, ahem) which they are then obliged to share with government officials with a police warrant. To stay safe from that, use custom operating systems which block/spoof all telemetry attempts. The best one is Tails OS imo.

Finally, use separate user profiles, not linked to each other (use different time zones, different IPs, different emails, etc) such that each account has a different fingerprint.