Investigator OPSEC & Sock Puppets

37.1 Browser Fingerprinting — Audit & Mitigation

Tool	URL	Function
Cover Your Tracks (EFF)	https://coveryourtracks.eff.org	Browser fingerprinting test
CreepJS	https://github.com/AbrahamJuliot/creepjs	Advanced Trust Score analysis
Mullvad Browser	https://mullvad.net/en/browser	Anti-fingerprinting browser (Tor Project + Mullvad VPN)
LibreWolf	https://librewolf.net	Hardened Firefox for privacy
Whonix	https://www.whonix.org	Two-VM Tor workstation

37.2 Pre-Investigation OPSEC Workflow — 10 Steps

1. Audit your current fingerprint with Cover Your Tracks + CreepJS. Document the baseline.
2. Decide OPSEC level: Low (normal browser + VPN), Medium (Mullvad Browser + VPN), High (Whonix gateway + Workstation VM).
3. Create an isolated research identity: dedicated email, no reuse of personal identity elements.
4. For sensitive investigations: use Tails OS on a bootable USB, no persistence.
5. Rotate identity periodically (every 30–90 days for long-running investigations).
6. Never mix identities: each sock puppet lives in its own browser profile / VM.
7. Network hygiene: trusted VPN + DNS over HTTPS. Do not use ISP DNS.
8. Metadata strip: MAT2 or ExifTool before uploading any file.
9. Communications: Signal or Session for source contact. Not personal WhatsApp.
10. Document OPSEC decisions in the final report: what level was used, why, what was done if something failed.

37.3 Sock Puppet Methodology (Updated 2026)

Rule 1: Never use real personal identity. Create a consistent fictitious identity (age, interests, plausible location).

Rule 2: The sock puppet needs a "digital history" — it cannot be born the day of the investigation. Buy accounts with 1–2 years of age or cultivate identities in standby.

Rule 3: Human behaviour. Do not do 200 searches in an hour. Respect plausible hours. Interact with irrelevant content to mix signal.

Rule 4: Consistent device fingerprint. If the sock puppet "lives" in Madrid, the browser must have timezone Europe/Madrid, locale es-ES, no obvious extensions.

Rule 5: Do not cross the line. Sock puppets for verifying public accounts = legitimate. Sock puppets to deceive, manipulate or extract information from people = ethically problematic and legally risky in many jurisdictions.

37.4 VPN & Anti-Correlation

Resource	URL	Function
Mullvad VPN	https://mullvad.net	No-log VPN, anonymous cash payment
IVPN	https://www.ivpn.net	Audited no-log VPN
ProtonVPN	https://protonvpn.com	Swiss VPN, freemium
Tor Project	https://www.torproject.org	Network anonymity
Snowflake	https://snowflake.torproject.org	WebRTC pluggable transport
obfs4 bridges	https://bridges.torproject.org	Anti-censorship Tor bridges

---