1---
  2template:
  3title: Instagram OPSEC
  4subtitle: Operational security for the average zoomer
  5date: 2019-12-02
  6slug: ig-opsec
  7---
  8
  9Which I am not, of course. But seeing as most of my peers are, I am
 10compelled to write this post. Using a social platform like Instagram
 11automatically implies that the user understands (to some level) that
 12their personally identifiable information is exposed publicly, and they
 13sign up for the service understanding this risk -- or I think they do,
 14anyway. But that's about it, they go ham after that. Sharing every nitty
 15gritty detail of their private lives without understanding the potential
 16risks of doing so.
 17
 18The fundamentals of OPSEC dictacte that you develop a threat model, and
 19Instgrammers are _obviously_ incapable of doing that -- so I'll do it
 20for them. 
 21
 22## Your average Instagrammer's threat model
 23
 24I stress on the word "average", as in this doesn't apply to those with
 25more than a couple thousand followers. Those type of accounts inherently
 26face different kinds of threats -- those that come with having
 27a celebrity status, and are not in scope of this analysis.
 28
 29- **State actors**: This doesn't _really_ fit into our threat model,
 30since our target demographic is simply not important enough. That said,
 31there are select groups of individuals that operate on
 32Instagram[^ddepisode], and they can potentially be targetted by a state
 33actor.
 34
 35[^ddepisode]: https://darknetdiaries.com/episode/51/ -- Jack talks about Indian hackers who operate on Instagram.
 36
 37- **OSINT**: This is probably the biggest threat vector, simply because
 38of the amount of visual information shared on the platform. A lot can be
 39gleaned from one simple picture in a nondescript alleyway. We'll get
 40into this in the DOs and DON'Ts in a bit.
 41
 42- **Facebook & LE**: Instagram is the last place you want to be doing an
 43illegal, because well, it's logged and more importantly -- not
 44end-to-end encrypted. Law enforcement can subpoena any and all account
 45information. Quoting Instagram's 
 46[page on this](https://help.instagram.com/494561080557017):
 47
 48>a search warrant issued under the procedures described in the Federal 
 49>Rules of Criminal Procedure or equivalent state warrant procedures 
 50>upon a showing of probable cause is required to compel the disclosure 
 51>of the stored contents of any account, which may include messages, 
 52>photos, comments, and location information.
 53
 54That out of the way, here's a list of DOs and DON'Ts to keep in mind
 55while posting on Instagram.
 56
 57### DON'Ts
 58
 59- Use Instagram for planning and orchestrating illegal shit! I've
 60explained why this is a terrible idea above. Use secure comms -- even
 61WhatsApp is a better choice, if you have nothing else. In fact, try
 62avoiding IG DMs altogether, use alternatives that implement E2EE.
 63
 64- Film live videos outside. Or try not to, if you can. You might
 65unknowingly include information about your location: street signs,
 66shops etc. These can be used to ascertain your current location.
 67
 68- Film live videos in places you visit often. This compromises your
 69security at places you're bound to be at.
 70
 71- Share your flight ticket in your story! I can't stress this enough!!!
 72Summer/winter break? "Look guys, I'm going home! Here's where I live,
 73and here's my flight number -- feel free to track me!". This scenario is
 74especially worrisome because the start and end points are known to the
 75threat actor, and your arrival time can be trivially looked up -- thanks
 76to the flight number on your ticket. So, just don't.
 77
 78- Post screenshots with OS specific details. This might border on
 79pendantic, but better safe than sorry. Your phone's statusbar and navbar 
 80are better cropped out of pictures. They reveal the time, notifications
 81(apps that you use), and can be used to identify your phone's operating
 82system.  Besides, the status/nav bar isn't very useful to your screenshot 
 83anyway.
 84
 85- Share your voice. In general, reduce your footprint on the platform
 86that can be used to identify you elsewhere.
 87
 88- Think you're safe if your account is set to private. It doesn't take
 89much to get someone who follows you, to show show your profile on their
 90device.
 91
 92### DOs
 93
 94- Post pictures that pertain to a specific location, once you've moved
 95out of the location. Also applies to stories. It can wait.
 96
 97- Post pictures that have been shot indoors. Or try to; reasons above.
 98Who woulda thunk I'd advocate bathroom selfies?
 99
100- Delete old posts that are irrelevant to your current audience. Your
101friends at work don't need to know about where you went to high school.
102
103More DON'Ts than DOs, that's very telling. Here are a few more points
104that are good OPSEC practices in general:
105
106- **Think before you share**. Does it conform to the rules mentioned above?
107- **Compartmentalize**. Separate as much as you can from what you share
108online, from what you do IRL. Limit information exposure.
109- **Assess your risks**: Do this often. People change, your environments
110change, and consequentially the risks do too.
111
112## Fin
113
114Instagram is -- much to my dismay -- far too popular for it to die any
115time soon. There are plenty of good reasons to stop using the platform
116altogether (hint: Facebook), but that's a discussion for another day.
117
118Or be like me:
119
120![](https://cdn.icyphox.sh/fI7nL.jpg)
121
122
123And that pretty much wraps it up, with a neat little bow.
124