Nice Selfie… Now I Know Exactly Where You Are

What is Geolocating?

Geolocating is the process of pinpointing the exact location where a picture was taken by analyzing clues within the photo, GPS data, or internet signals. While this technique is crucial for security and Open-Source Intelligence (OSINT) professionals, it can also be misused by malicious actors, predators, or stalkers.

In this article, we’ll explore how to locate someone without any prior knowledge of their identity, background, or location—this is raw geolocating OSINT. To protect privacy, all faces in the examples have been blurred. I’ll explain the process step by step and provide examples to demonstrate these techniques. Additionally, we’ll showcase how this can be done using just open-source information, such as a student’s school selﬁe and content from the school’s social media page, to determine the student’s location.

(Note: This information is provided for educational purposes only.)

How to Find a Location from a Picture

Metadata (EXIF Data): Many digital photos, including selfies, have hidden information called EXIF data. This can include the GPS coordinates of where the picture was taken. By looking at this data, someone can find your exact location, like the address or the specific spot on a map.

(Note: Most platforms remove EXIF data when you upload photos. This includes Facebook, Instagram, Twitter, WhatsApp, Snapchat, TikTok, LinkedIn, Pinterest, and Reddit.)

Landmarks and Surroundings: If your photo includes a recognizable landmark, like a famous building or a street sign, it’s easy to figure out where you are. Even small details, like the type of trees or the style of buildings, can give clues about your location.

Environmental Clues: Things like the language on signs, the type of weather, or even the style of clothes people are wearing in the background can help someone figure out where a photo was taken.

Digital Clues: Things like the language on signs, the type of weather, or even the style of clothes people are wearing in the background can help someone figure out where a photo was taken.

1) EASY: (Where am I?)

How Easy Is It to Geolocate?

Geolocating may seem complex, but it’s relatively simple. Online tools can extract metadata, and platforms like Google Maps or Street View can help match photos to real-world locations. There’s even a game called GeoGuessr that allows people to practice geolocating by guessing locations based on pictures.

The Dangers of Sharing Photos Online

Sharing photos online can unintentionally disclose more information than you think. Here’s why:

Revealing Your Location: If someone can access the metadata in your photo, they can ﬁnd out exactly where you are; or where you’ve been. This can be dangerous if the information falls into the wrong hands.

Stalking and Harassment: By knowing your location, someone could follow your movements or harass you online or in real life.

Privacy Breaches: Even if you think your photo is harmless, it might contain enough clues for someone to track you down. This is especially true if the picture was taken in or near your home or a place you visit often.

2) MEDIUM: (Where am I?)

How to Protect Yourself

Here are some simple steps to protect your privacy when sharing photos:

Turn Off Location Services: Before taking photos, turn off location services on your phone’s camera to prevent it from storing GPS data.

Remove Metadata: Use tools to remove EXIF data from your photos before uploading them online. Some social media platforms automatically strip this data, but it’s not always guaranteed.

Be Mindful of What’s in the Background: Pay attention to the details in your photo’s background. Avoid sharing images that include recognizable landmarks, street signs, or other identifying features.

As schools reopen, a common trend is sharing photos of your child’s first day, often featuring a sign with detailed information such as their name, age, school, grade, and favorite subjects. While this can be a charming way to mark the occasion, it may inadvertently reveal sensitive information. Such details can compromise your child’s privacy and security, potentially making it easier for malicious actors to locate or identify them. To safeguard their personal details, choose a less descriptive photo and avoid including identifiable features in the background.

Conclusion

Geolocating is a powerful tool that can reveal the location where a picture was taken. While this capability is valuable for security and OSINT professionals, it also presents risks for anyone who shares photos online. Even a simple selﬁe can reveal your exact location if someone analyzes it carefully.

To protect yourself, your loved ones, and your assets, be cautious about the photos you share. Avoid including location information in your posts and be mindful of what’s visible in the background. By being more private and selective, you can better safeguard your details and address.

Remember, a picture might reveal more about you than you intend—so make sure it’s only sharing what you want.

(For this challenge, we will accurately pinpoint the exact location where this couple was standing in the photo, using only the buildings in the background, without any prior knowledge of the location.)