Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

delivering247

macrumors newbie
Original poster
Dec 17, 2019
8
0
Hi all,

I need to send an anonymous email to our management team at work. A member of staff has been posting very abusive twitter messages to a colleague who is being bullied and I want to anonymously send screenshots to managers.

I have read that if I purchase a subscription to a VPN, set up a webmail account while logged into the VPN, and then use that email account to send the screenshots, then the source (i.e. my IP address and identity) will not be visible to my employer.

Is this true, or are there other measures I need to take before I can be 100% confident my identity will be invisible?

Your help is appreciated. I want to do the right thing but I don't want to be picked on if the management decide to back the bully.

Many thanks
 
In principle this is enough.

A VPN will act as a middleman between you and the website/email provider. Your IP address is exposed only to the VPN provider. However, there are caveats. The VPN provider might keep connection logs about you or store the payment details that you used (such as credit card). These could lead back to you. A browser might also expose additional data than just your IP address, such as cookies, metrics and such that might also give websites a hint about your identity even if you are using a VPN.

You can change these things by:
  • choosing a VPN service that doesn’t keep logs and can be used anonymously (maybe even for free so that no payment details have to be transmitted)
  • using a different browser, one which has no previous website data
  • using the free Tor browser instead of a VPN service
 
Taking out a VPN subscription to send a single email seems unnecessary because tracing an email to the sending individual is extremely difficult other than for state actors. At the very most, the email header may contain the attached IP of the originating point, which will only reveal the ISP and a possibly huge geographic area, and possibly the computer name. Because the header will also be time-stamped the ISP will likely have a record of which subscriber had the IP address at the time of the email, and they will give up the information to the aforementioned state actors.
Some web email services, Gmail is one, do not include the originating IP address in headers, but I believe any SMPT client (including Google’s) is likely to include that info in headers. To use web email while masking your IP address I would suggest using the Opera browser, the MacOS version of which still offers a VPN (actually a proxy server) option.

I’m assuming you won’t be using a work computer to send the email, and that the screenshots weren’t taken on a work computer? And you know nothing is 100% secure?
 
Hi all,

I need to send an anonymous email to our management team at work. A member of staff has been posting very abusive twitter messages to a colleague who is being bullied and I want to anonymously send screenshots to managers.

I have read that if I purchase a subscription to a VPN, set up a webmail account while logged into the VPN, and then use that email account to send the screenshots, then the source (i.e. my IP address and identity) will not be visible to my employer.

Is this true, or are there other measures I need to take before I can be 100% confident my identity will be invisible?

Your help is appreciated. I want to do the right thing but I don't want to be picked on if the management decide to back the bully.

Many thanks

First of all, let me ask you this question. Does your company have a zero-tolerance anti-bullying policy? If so, there should be an anonymous TIPS submission service provided by your company through a third party neutral source that allows you to post whatever screenshots you have. This third neutral source will then submit these bullying screenshots to the company's management. The company management will then contact this third party service to contact you. You will then only communicate with this third party company and any messages and interviews will be conducted by this company. Your managers will never know who you are. Only the third party source will. THIS IS THE STANDARD procedure for any whistleblower service. Basically, this is how it works.

If you have to setup up an anonymous account and use it through a VPN, then I highly suggest that you ask the person being bullied to do this by him or herself. To me, it sounded like the company you are working for does not have an anti-bullying policy in place, which is probably why you are having this issue of abusive bullying over twitter is considered grounds for review and possible immediate dismissal if the allegation is confirmed.

Let me tell you why I highly advice you not to get yourself involved and this is coming from someone who have had extensive experience dealing with these issues, including being a whistleblower for 2 companies and eventually being terminated, banned for life over the industry I had so loved working in. You become the black sheep just being a whistleblower.

First of all, management probably knew this is happening. You are probably not the only one that had reported the incident or had thought that through. Management should have dealt with this, but it seemed that these days bullying is an acceptable form of behaviour due to a leader of a great nation who bullies people and gets away with it free and justifies it soundly with the people who voted for him. And this is the conundrum..

Hiding behind a VPN and a secured encrypted email account like ProtonMail will get your message through to management. But accusations like this will require some authentication from the whistleblower or from someone who rats out the abuse. Unfortunately, some companies just don't care. Once they receive the complaint, they will either act on it or simply ignore it. If a company does not have a whistleblower act in place to provide secured communication through a third party; chances are your efforts will be met with little motivated action. Now, it does not mean that you should not do this.

Keep in mind the implications that you do this....

1, You need to accept that you are a whistleblower and you are ratting out your fellow co-worker and while this is a needed action to be made aware of, you also become the target of the bully. You will be getting involved in this incident.

2, Anonymous accusations will have to be met with face-face verification of the evidence provided. Managements will not act unless they interview you. There are labour laws that prevent prosecution of such individuals without physical witnesses. Otherwise, it is just hearsay. And who said that snapshot twitter messages aren't fabricated by yourself to create some sort of bullying cause to the accused?!?

3, Whistlerblowers normal fate usually end up leaving the company and your name will probably get spread out over social media. You are a party pooper and you rat people out. Don't you think you can hide via a VPN and ProtonMail. Your real name will be discovered just like I did before VPN and ProtonMail. I used dial up then through a public library, but they traced my info through the group information I provided working for that company.

I know that it is probably the right thing to do to help defend the person being bullied, but I think your job is to help the one being bullied and get him or her some proper help, contacting some agencies for advice. If you get yourself involved, you will be at the crosshairs of the bullies and in my experiences thus far, management will usually side with the bullies, because management knows that the corporate or company environment is the main cause of all that bullying. A company who doesn't tolerate bullying usually don't have people bullying period. I now work for a non-profit company who has a zero tolerance of bullying and full transparency. Meaning, if you feel bullied, just email the whole group of staff and the one who bullies usually get kicked out by the group.
 
Last edited:
  • Like
Reactions: Meuti
Hi again,

After a lot of thought I opted to go the Tor route, as from what I have read that is pretty much doing the same as a VPN in terms of concealment.

I now have a new problem. I need to attach screenshots of the tweets which are bascially photos on my iphone. The culprit has deleted the tweets so my screenshots are the only remianing evidence. The managers I anonymously emailed have requested screenshots as evidence to support my claim.

I have read somewhere that photos on iphones contain data/info that traces them back to the user. Is there a way around this?

My guess was to import the files into a PC that isn't mine, screenshot the photo and then use that file as an attachment?

Any thoughts/help once again greatly appreciated.
 
Hi again,

After a lot of thought I opted to go the Tor route, as from what I have read that is pretty much doing the same as a VPN in terms of concealment.

I now have a new problem. I need to attach screenshots of the tweets which are bascially photos on my iphone. The culprit has deleted the tweets so my screenshots are the only remianing evidence. The managers I anonymously emailed have requested screenshots as evidence to support my claim.

I have read somewhere that photos on iphones contain data/info that traces them back to the user. Is there a way around this?

My guess was to import the files into a PC that isn't mine, screenshot the photo and then use that file as an attachment?

Any thoughts/help once again greatly appreciated.

Photo metadata isn't directly personally identifiable. GPS position of photo (if not disabled) camera make and model, eg Apple iPhone 6, aperture and shutter setting etc. There are apps to display it all.
 
Thanks Spudlicious. I found an app called ImageOptim. It appeas to remove as much of the background data, in particular something called Chromaticities (whatever they are). When I look on "Show Inspector" nothing indicating an IP address or GPS seems visible so looks as if I've cracked it!
 
also, you can go in Terminal and type

strings <file> | more

and then hit the spacebar to scroll...

to read if there are strings readable in the file
 
Thanks junkw. I am a bit of a novice when it comes to this sort of stuff (hence posting on here), but I tried your suggestion but it came back with xcrun: error: invalid active developer path

i typed in: strings image1.PNG | more
 
Hi again,

After a lot of thought I opted to go the Tor route, as from what I have read that is pretty much doing the same as a VPN in terms of concealment.

I now have a new problem. I need to attach screenshots of the tweets which are bascially photos on my iphone. The culprit has deleted the tweets so my screenshots are the only remianing evidence. The managers I anonymously emailed have requested screenshots as evidence to support my claim.

I have read somewhere that photos on iphones contain data/info that traces them back to the user. Is there a way around this?

My guess was to import the files into a PC that isn't mine, screenshot the photo and then use that file as an attachment?

Any thoughts/help once again greatly appreciated.

In my experience, you will face a problem if you try to hide the EXIF data of your photo source. You need the time and data as evidence for incident location and verification, since as you claimed the culprit deleted the tweets. So if you erase the EXIF data, then the culprit will simply say, those photos were doctored with Photoshop. It won't stand up in a tribunal of any kind if your manager confronts the culprit. You are dealing here with the courts and the culprit can go to court and say those photos are fake and who ever sent them are bullies. The accused hopes you don't show your face so then the accused gets away free. So eventually though, you do have to face the accused as a means to back up your evidence. If you see many of the sexual accused cases from prominently important people; eventually the accusers (despite how anonymous they were in the beginning) will eventually have to show their faces in order to validate the accusations.

TOR services is used for investigative journalist to provide transparency for exposing hidden government agendas. This was what led to the admission of the Iranian government that they had shot down the Ukrainian flight. Why do you think they finally admitted it?!? Because the Canadians had SOLID evidence with factual data that finally forced the Iranian to be truthful! The Canadians didn't hide nor did the Prime Minister of Canada announced it through TOR; the Prime Minister spoke out in public. That's how you expose a culprit for what they are.

Which is what I had said earlier; when you get yourself involved, you have to also be transparent in order to bring the culprit to justice.
 
Last edited:
Screenshots produced on iOS or macOS do not have location information attached. Only pictures you take with the camera.

When you import the photos into the Photos app on macOS, you can also enable a setting that strips location data from exported photos automatically.

Screenshot 2020-01-11 at 17.17.07.png
 
Screenshots produced on iOS or macOS do not have location information attached. Only pictures you take with the camera.

When you import the photos into the Photos app on macOS, you can also enable a setting that strips location data from exported photos automatically.

View attachment 888009

True of Windows screenshots as well. But, possibly wrongly, I had the impression the O/P had literally taken shots of the offending screen with his phone.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.