Intelligence [Agencies] Too Cheap to Meter

Full disclosure: this post was drafted with AI. I've also read the entire thing, and changed everything I wouldn't have written, myself.

There's a video going around about "a sound that leaks your exact location." Sounds like sci-fi shit, but I've got bad news and worse news: (1) it's real, and (2) that's barely scratching the surface.

The video in question features a technique for geolocating a recording from the Doppler curve of planes passing overhead. (colsto, 2026colsto "I discovered a sound that leaks your exact location (and it's everywhere)". YouTube, November. 2026. view source) The replies were a chorus of "nothing will be private ever again."

Sorry, that's wrong. It's worse:

That was true long before the airplane video.

For those of you who didn't know, I'm an ex-intelligence analyst (intelligence as in agency, not as in artificial -- that's my current line). Figuring out "who, what, where, when, and why" from juicy little tidbits that nobody meant to hand over is basically what I did for a living (though, I focused on machines, not people: turns out everyone wants to know where the tanks and missiles are; but locating an enemy war machine isn't so different in principle from locating anything else). I saw a lot of stuff that's never going to go into a blog post, but the long and short of it is that privacy, as most people imagine it... mostly doesn't exist anymore. It's pretty much overdetermined that you're deanonymizable, the same way it's overdetermined that you're hackable (have you seen the news, lately?). And, much like the cyber situation, it's not because of some single novel God-tier zero-day, but because there are so many independent ways in, and they compound.

And: "A defender has to get it right every time; an attacker has to get it right once."

Bottom line up front: you're cooked. I'd stop aiming for unidentifiable as an aspiration; that's over. It's no longer a safe assumption to build your life on, and if you think you've achieved it, you're in for some unpleasant surprises, much like the "Binance is secure" people.

What you can achieve without going full tinfoil is practical privacy against particular threats.

So, let's talk about it.

Let's start with the elephant in the room: AI. I wanted to say "AI can't do anything a motivated analyst could do"; but, sorry, that's not true. AI capabilities like "truesight" (models inferring who wrote something, and where they are, from tiny stylistic and contextual cues) are potentially game-changers. Still, the biggest shift is, like all knowledge work in 2026, the price of doing business, so let's start there.

(If you want the long, careful version with the models and caveats spelled out, there's a full report; it's linked at the end. (Jon, 2026Jon Meriwether / Owl + Kestrel Privacy in the Age of Cheap Intelligence: How data fusion changes personal security. report, 3 November. 2026. view source))

The Price of Research is in Freefall

When I did this kind of work, the binding constraint usually wasn't technique, or data availability. It was just time. People would ask me, "are they looking at my dick pics" and the obvious answer was, "What? Do you know how many dick pics there are? No one has time for that." Constitutional issues aside, even if an agency wanted to look at your junk, there's just no way. It's not important enough (I hope).

There was always more material than analyst-hours, and computers couldn't do the reading for you, back then. Plenty of information was technically available but practically safe, because nobody could afford to look at it.

That protection (and, to be clear, "security through obscurity" as a whole) is evaporating.

A 2026 USENIX Security paper ran AI agents against pseudonymous online profiles for roughly $1–$4 per profile. (Simon et al., 2026Simon Lermen and colleagues Large-scale online deanonymization with LLMs. USENIX Security. 2026. view source) On one benchmark the agent correctly identified 226 of 338 targets (67%) at 90% precision. Caveat: those test profiles were edited from accounts that originally linked to a real identity, and the authors note they're much easier to identify than most genuine pseudonymous accounts. So, this demonstrated a measured capability in a bounded setting, not a universal pwning apparatus.

But, as with cyber, the direction is the story. Work that used to need a trained person's day, week, or month... now costs a few dollars, and can be repeated across thousands of cases. "Someone could investigate this" turns into "fuck it, why not?" A lot of what used to be state-level capability is on its way to being formerly-state-level, on a $20 sub. Just like cyber.

Cheap analysis doesn't make everything cheap, though. A useful bit of arithmetic from the report: if analysis is 10% of the cost of some activity, making it ten times cheaper cuts the total by 9%. If analysis is 90% of the cost, the same speedup cuts it by 81%. (Jon, 2026Jon Meriwether / Owl + Kestrel Privacy in the Age of Cheap Intelligence: How data fusion changes personal security. report, 3 November. 2026. view source) So, the impact is unevenly distributed: the sharp edges are where figuring out what's worth doing was the expensive part.

Unfortunately, that's usually "most of it".

See, this isn't like sending a spy to go snap pictures in enemy territory. In the digital age? People just post that shit for free. In fact, people are posting far more than they think for free.

Let's Talk About Side Channels

When you post a recording, you think you're sharing... I don't know, say, "a conversation".

You're also sharing a room: its echoes, the machinery humming in the background, whatever happened to drive by, and quirks introduced by your particular device. A photo shares the scene behind you, the light, the weather and the sky. God forbid there are people in the background.

Some of that is, broadly, the kind of "enemy of the state" type shit that comes to mind when you think "spooky surveillance". The electrical grid, for example, hums at a frequency that actually wanders a little, all the time; and those wanderings can leak into recordings. Have you met a single person, ever, who even claims to sanitize recordings for electrical noise? That's tinfoil territory. Except, researchers used these fluctuations to estimate when a recording was made, and to synchronize recordings with each other. (UniversityUniversity of Maryland MAST Electric Network Frequency research. view source) If it's got electrical hum, it's got a timestamp; but who thinks of that?

That's one neat party trick; it's not the point. The point is the difference between two kinds of scrutiny:

The review a normal, sane person does before posting asks: does this contain my name, my address, something that'll get me fired?

The review an analyst does asks: what circumstances would produce exactly this data?

Those are different questions, and the second one includes facts that a normal person would simply never think of as "relevant content".

Story Time

Let me make that a little more concrete.

There's an imaginary person, let's call her... Kennedy. Kennedy is careful: pseudonymous account, no face, no location tags.

• She posts her coffee most Saturday mornings.
• One photo has snow on the windowsill behind the cup.
• She mentions finishing a local race.
• A friend, posting under their own name, shares photos from the same weekend.
• An old account under the same handle once mentioned her first name.

None of those, individually, is "a disclosure". Each one alone fits thousands of people. Together, they fit far fewer -- and a short list is cheap to check. That's the important part: a clue doesn't have to prove anything. It only has to change the next action, from "no idea where to start" to "check these three." The gap is between "tractable" and "intractable".

And "tractable" is booming, baby.

The exotic stuff later in this post doesn't change that logic; it just shows how many more kinds of clue exist than you'd think.

Clues Compound Quickly

The rule: "every observed parameter is a division of the search space; and params add up fast." More specifically, independent, informative clues compound very quickly. A clue that's irrelevant, or just repeats one you already have, divides nothing. But the ones that count don't "add up": they multiply.

Take a deck of 52 cards: each with a rank (a number, or A, J, Q, K) and a suit (hearts, diamonds, clubs, spades). For our purposes, A=1, J=11, Q=12, K=13.

• "It's red" could be any of 26 cards.
• "It's not a number" leaves 16.
• "It's even" is any of 24.
• Together, that leaves the Queen of Hearts, and the Queen of Diamonds.
• At that point, you might just be able to look at the cards in your own hand and narrow down which one you don't have.

Each clue, on its own, is "inconclusive."

Together, they're "decisive".

In information terms, each clue is worth a number of "bits". Picking one card out of 52 takes about 5.7 bits (2^5.7 ≈ 52). "Red" is worth 1 bit (52 → 26). "Not a number" is worth about 1.7 bits (26 → 8). "Even" -- once you know the first two -- is worth 2 bits (8 → 2). That's 4.7 of the 5.7 bits; your own hand supplies the last one. For scale: singling out one person among 8 billion takes about 33 bits. Thirty-three halvings. That's it.

The information adds; the candidate list divides. That asymmetry is, approximately, the whole game.

Real clues are both messier, and richer, than cards. Noisy signals usually don't "eliminate options completely" so much as "shift which are more plausible", and some evidence can be actively misleading. A good analyst spends a lot of time deliberately trying not to fool themselves. But, "each clue is vague, so I'm fine" is just straight-up bad math.

Sometimes, the information isn't in any particular clue at all, but in the relationship between them: flip two fair coins and ask whether they match, for example: one coin tells you nothing; both coins tell you everything. Information theorists call this synergy. (Paul et al., 2010Paul L. Williams and Randall D. Beer Nonnegative Decomposition of Multivariate Information. 2010. view source) In privacy terms: one record might hold "an anonymous observation", while another holds "the link that makes it about you in particular". Neither means much alone; and, yet.

You need... fewer clues than one might naively expect. In a study of 1.5 million people's phone location traces, four points in time and space (hourly points, distances measured in "cell antenna range") were enough to single out, drum roll, 95% of the traces in the dataset. (Yves-Alexandre et al., 2013Yves-Alexandre de Montjoye and colleagues Unique in the Crowd: The privacy bounds of human mobility. Scientific Reports. 2013. view source) Long before LLMs, researchers showed that "anonymized" Netflix ratings could be connected back to people using a little outside information. (Arvind et al., 2006Arvind Narayanan and Vitaly Shmatikov How To Break Anonymity of the Netflix Prize Dataset. 2006. view source)

Removing the name doesn't remove the person.

So What's Juicy?

Leverage is unevenly distributed across all domains; information isn't born equal.

While digging into this (hopefully some of you did a little more research after the airplane thing?), you probably came across a few "oh shit"s. Here's the checklist I'd use to decide whether a deanonymization attack is a real threat or just a cool demo.

An inference needs all five of these:

1. Distinguishing information. Different possible situations have to produce measurably different data; if two explanations produce the same data, no amount of analysis or computation separates them.

2. Capture and survival. The difference has to reach the sensor (e.g. a microphone or camera) and survive recording, compression, editing and upload.

3. Context and reference data. The analyst needs the timestamp, the comparison recording, the map, or the surrounding geometry that makes the observation interpretable. A picture of the night sky by itself says little; with an accurate timestamp and a vertical reference, a dedicated instrument has gotten to within tens of meters.

4. Reliable estimation. The method has to work despite noise, changing conditions, and information loss (e.g. compression).

5. Decision value. The leftover uncertainty has to be small enough to change what someone does next.

That last one is worth biting down on.

See, courtroom proof "beyond reasonable doubt" is a high bar; "worth a closer look" is a very low one. A clue that narrows your location to a neighborhood doesn't identify your house, but it changes how cheap the next step is. Most real-world harm needs leads, not proofs: you can generally take a next step to narrow the possibility space down further, if that next step isn't prohibitively expensive. No single clue has to finish the job: a lot of the "that trick wouldn't work on my video" objections are really a missing piece of context, and context is exactly what the rest of your record can supply. That video isn't enough by itself? Surely you didn't post it on a wall with hundreds more, right?

Right?

Party Tricks

Let's talk about some classics.

Stars. Software can work out exactly which patch of sky an image shows, its orientation and its scale, from the pixels alone. (Dustin et al., 2010Dustin Lang and colleagues Astrometry.net: Blind astrometric calibration of arbitrary astronomical images. 2010. view source) That gives you a reference frame, not an address. To turn sky into a position on Earth you also need accurate timing, and a sense of "which way is down". A dedicated stellar positioning prototype that had those reached about 50 meters over short time intervals. (Drew et al., 2010Drew Woodbury and colleagues Stellar Positioning System Part II. NAVIGATION 57(1). 2010. view source) So, "visible stars, cooked" is ~right, if the rest of your record supplies the missing pieces.

Echoes. In lab experiments with a known sound and a few microphones, researchers reconstructed the shape of a room from its echoes. (Ivan et al., 2013Ivan Dokmanić and colleagues Acoustic echoes reveal room shape. PNAS. 2013. view source) That proves acoustics can describe geometry; it doesn't prove your podcast reveals your floor plan. It tells you the information is physically there; whether it's usable from everyday recordings is still an open question. Of note: the more diverse the recordings of the same event, the better the spatial resolution. Remember that one Batman movie? They did their homework.

Passing things. A car driving past a single microphone has given researchers its speed, wheelbase and engine details. (Volkan et al., 2009Volkan Cevher, Rama Chellappa and James H. McClellan Vehicle Speed Estimation Using Acoustic Wave Patterns. IEEE Transactions on Signal Processing 57(1). 2009. view source) A train horn or a plane moving past you changes pitch in a way that depends on speed and geometry, which is the physics behind the video that kicked this off. One passing vehicle doesn't identify you -- but a shared event, say, the same dog bark or the same horn picked up by your phone and by three neighborhood doorbell cameras, can join recordings that were never meant to be joined.

Your hardware. Digital is implemented in analog. I'm going to emphasize this because it's important for more than just this: digital is implemented in analog. The "ones and zeroes" your phone transmits are real voltages and real radio waves, and they carry quirks of the specific hardware that sent them. Researchers extract "unique fingerprints" from transmitted signals to tell individual wireless devices apart. (Qiang et al., 2015Qiang Xu, Rong Zheng, Walid Saad and Zhu Han Device Fingerprinting in Wireless Networks: Challenges and Opportunities. arXiv. 2015. view source) My rule of thumb: if it creates an analog signal, assume it's fingerprintable.

One more distinction the viral threads skip: information existing isn't the same as someone having access to it. Your public posts are available to anyone. Your neighbor's doorbell footage exists, but a stranger can't just pull it (unless there were some kind of... cyber vulnerability...). Your phone's radio fingerprint is only available to someone with a capture of its transmissions; an uploaded photo doesn't carry it. A threat model is mostly about "who can reach what".

Two disciplines matter when you read stuff like this:

1. A demonstration is evidence, not a ceiling. A published experiment shows what one team achieved under its conditions; it does not tell you the limit for a better-resourced, more patient, or cleverer observer.

2. A plausible mechanism is not a success rate. "The information is physically present" is not "it works on you, today, X% of the time." Anyone who skips this step is selling something.

One practical corollary: "I filtered the audio" is not a privacy guarantee. Removing a frequency band removes that channel; it does nothing about what you said, the timing, the scene, or the other twelve channels.

You Don't Have To Be Interesting

A common line you'll hear is, "why would anyone bother with me? I don't have enemies."

That question assumes someone picks you first, and then investigates. Sometimes, to be clear, that's absolutely true: a stalker has a person in mind. But, a lot of the time, the search runs the other way: someone asks which people match this criterion? across a big pool, discards everyone ambiguous, and digs into the handful that resolve cleanly.

That changes the math completely: a method that fails on 95% of people can still be devastating, because the 5% it nails are now selected. Crude oil into kerosene (I don't actually know how oil refinement works; someone correct me if I fucked up this metaphor). "Average accuracy" hides a sharp tail.

(The catch: that only works if the method can tell which 5% it got right, or if the remaining candidates are cheap to check. A method that's simply wrong 95% of the time is noise. One that says "these 5%, I'm confident" is a target list.)

You don't need to be famous or rich in advance; you just need to be legible.

And, I'd be remiss if I didn't mention: an attacker being wrong doesn't make it harmless! A mistaken identification can still put heat on an uninvolved person. It doesn't particularly matter if you actually have a fat wad in your wallet, as long as the robber thinks you might.

Publication: 1. Interpretation: ∞.

You post once, under the conditions of that moment. Everyone else gets to interpret it repeatedly, with whatever tools and reference data exist years later. Oh whoops, AI didn't exist when you posted that, and no one was using it to hack the world? Shoulda thought about that in 2008, idiot.

Better models, new reference recordings and a later account link can each make an old post more revealing, even if you never post again.

Pseudonyms are weaker than they feel: writing style has been used to link authors across blogs, Twitter and Reddit. (Rebekah et al., 2016Rebekah Overdorf and Rachel Greenstadt Blogs, Twitter Feeds, and Reddit Comments: Cross-domain Authorship Attribution. PoPETs. 2016. view source) And, the archive was never just yours: friends, family and event organizers post about you, too. Researchers flagged this "multi-party" privacy problem over fifteen years ago, and it... hasn't gotten "better". (Kurt et al., 2010Kurt Thomas, Chris Grier and David M. Nicol unFriendly: Multi-Party Privacy Risks in Social Networks. PETS. 2010. view source) You can be perfectly disciplined and still get cooked from a dozen other people's photos.

Cash Me IRL, How Bout Dat

You're never gonna believe this, but online research already feeds in-person crime. The FBI has described organized burglary groups that combine internet research, physical surveillance and commercially available camera and tracking gear to scope out homes. (FBIFBI Inside the FBI: Intercepting the South American Theft Group Threat. view source) That's not an AI story; it's the existing baseline. That was before terrorist organizations were using AI to calculate motorcycle jumps over trenches (what a year). (AFP, 2026AFP via eNCA From bombmaking to motorcycle tweaks: How Nigerian jihadists use AI. July. 2026. view source)

My forecast (and I'm labeling it as a forecast, not a finding): cheaper extraction and inference will make detailed preparation available to more offenders, against more people. Some crimes will look "hypercompetent", because the prep no longer took the time and skill we instinctively assume. It won't be uniform: travel, physical access and the risk of getting caught don't get cheaper because a model got better (well... okay, you can mitigate risks of getting caught, too). But we shouldn't wait for a pile of attributable victims before taking the mechanism seriously.

Well This Whole Thing Has Been Really Shitty To Read

Yeah, sorry.

You tired of unprecedented times, yet?

Here's my honest advice: for most people, full counter-surveillance just isn't worth what it costs you. If you have to go forensically scrub your photos and videos to prevent information leaks, that sounds terrible.

I don't want to sugarcoat this part: if you have no-shit adversaries (a stalker, an abusive ex, a hostile state), get specialist help, because you need a real plan. "An attacker only has to hit once"; and fuck me, we've got aimbots, now. Don't take your anonymity for granted.

For everyone else, though? Forget being "unidentifiable", and aim for practical privacy against the threats you actually have: remove whole categories of easy exposure, and stay safe when, not if, something leaks.

1. Set a real boundary. What do you actually want to keep private, from whom, for how long? "My home address from strangers online" is a boundary you can work with. "Privacy" is not.

2. Kill live and routine. Don't post where you are while you're there, and don't post the places you go regularly, or places near home. Post afterwards, or not at all. This cuts a lot of live and routine exposure.

3. Pick the smallest audience that works. A group chat and a public post are different universes of exposure.

4. Look at the collection, not the post. Repeated backgrounds, the view from your window, the same café every Saturday, the username you reuse everywhere. Removing a location tag does not remove the scene. Remember how good o3 was at GeoGuessr before they nerfed it? What if someone buffed a model for this, instead?

5. Talk to your people. Friends' posts are part of your record; agree on what gets posted, and when, for shared events. This might be awkward, sorry.

6. Assume exposure; keep the boring protections. Strong account security, good locks (most standard locks in America are hilariously insecure, oh my god, they're only keeping honest people honest), and not leaving packages sitting at your door: postal inspectors explicitly recommend picking up mail and packages promptly. (U.S.U.S. Postal Inspection Service Mail Theft Prevention. view source) These still work after someone knows who and where you are.

7. Shut the fuck up. If you don't want people to know about it, you can just not talk about it.

And one thing that isn't (or IMO, truly shouldn't be) on you: it shouldn't take signal-processing expertise to live a normal life online. You shouldn't need to study countersurveillance to have a reasonable expectation of privacy. Platforms and data holders are the ones who can minimize what they capture and keep, make small-audience sharing the easy default, and account for posts about people who aren't the poster. That's the same burden-shift security people have been asking vendors for. (CISA et al., 2023CISA and partner agencies Shifting the Balance of Cybersecurity Risk: Secure-by-Design and -Default. 2023. view source)

In Conclusion

I'm ass at conclusions; let's try this:

Privacy isn't impossible; but it's not easy anymore, either. It's a lot more work than most people's intuitions suggest, and a lot of it should be someone else's job.

It kinda sucks right now; choose what you're gonna do about it. Better yet, it's time to choose what we're going to do about it: this is a "systems need to change, no one wants to live like this" problem, not a "subscribe to my Gray Man newsletter" problem.

Uh, the end.

The full report: Privacy in the Age of Cheap Intelligence: How data fusion changes personal security (Owl + Kestrel, 3 November 2026). It covers the models, error budgets and evaluation methods behind this post, with all sources. Read the full report (PDF). (Jon, 2026Jon Meriwether / Owl + Kestrel Privacy in the Age of Cheap Intelligence: How data fusion changes personal security. report, 3 November. 2026. view source)