Research organizations
Browser fingerprinting and investigative research
The subject of an investigation may learn that it is being investigated before a report is published. Each visit leaves an observation; recurring browser and account signals can make the pattern legible.
- Mon · contractsAward notice
- Wed · facilitySite map
- Fri · ownershipCompany register
- Recurring profile R7Possible project focus ↗
The exposure
The research question can become visible before the answer.
Investigative work is repetitive by design. A team checks the same official page, follows changes in a registry, verifies addresses, and returns to a source of evidence. The sequence can reveal a subject, a geographic focus, and the pace of a project.
The Berkeley Protocol treats digital and physical safety as part of open source investigations. The browser is one part of that environment: it can present recurring technical signals to sites the team studies.
- 01
A question
The team investigates a procurement network and a remote facility.
- 02
A trail
Researchers revisit contracts, corporate records, maps, and official pages for weeks.
- 03
A handle
A recurring browser profile, login, network, or vendor identifier joins some visits.
- 04
An inference
An observer with enough coverage guesses the topic, pace, or likely next move before publication.
Observer lens
Who has enough pieces to draw the line?
Choose an observer to see how the same research activity becomes a different kind of record. Each view has a specific visibility boundary.
A monitored site recognizes the return.
A ministry portal, company site, or registry can observe visits to its own pages. If the same profile returns, the operator can see which records attract repeated attention and when.
- Visible record
- Its own pages, request times, accounts, IP context, and any browser signals it collects
- Possible inference
- Someone is repeatedly examining this particular subject.
- Boundary
- It cannot see visits to unrelated sites by default.
One vendor appears across the trail.
If several destinations load the same analytics or advertising vendor, that vendor may receive events from each property. Its ability to join them depends on the actual deployment, identifiers, and browser protections.
- Visible record
- Events from participating properties, plus identifiers and context available to that vendor
- Possible inference
- A recurring browser is studying the same cluster of people, places, or organizations.
- Boundary
- Coverage is partial. Separate destinations do not automatically share logs.
A commercial record can travel further.
A company that collects browsing or location histories may sell or license records to other parties. A buyer with additional account, employment, or network data could try to associate the trail with an institution.
- Visible record
- Only the fields that were collected, retained, shared, and made available to a buyer
- Possible inference
- An organization may be preparing work on an unpublished topic.
- Boundary
- The documented cases below concern different datasets; they do not establish that any specific research team was tracked this way.
The commercial path
A research trail can outlive the page that recorded it.
A destination can keep its own logs. Other collection systems can create records with a broader reach. Whether a government, contractor, or other buyer can learn about a particular investigation depends on the data collected and the contracts, access, and joins available to them.
A documented sale of click history
The FTC alleged that Avast’s Jumpshot sold detailed browsing histories, including a browser identifier, URLs, timestamps, and device context, to commercial clients. This case demonstrates how specific web activity can become a transferable dataset.
Read the FTC case →Commercial data can reach government purposes
The FTC’s Gravy Analytics and Venntel case alleges collection and use of location data for commercial and government uses. GAO has identified gaps in federal guidance for use of commercially provided information. These are separate examples of a market and an access path, not evidence that research browsing in this illustration was sold to a government.
Read the FTC case →Research patterns
Different investigations leave different shapes.
These are illustrations of what an observer with enough coverage could infer. The research itself can be lawful and public while its timing remains sensitive.
Team workflow
Make separation a research method.
Protect the question before repeated visits turn it into a recognizable pattern. The right controls depend on whether the team needs ordinary privacy, case separation, or anonymity against a capable adversary.
- 01
Map the observers
List destinations the team must visit, shared scripts on those sites, accounts it must use, and commercial sources that might contain related activity.
- 02
Separate investigations before the first visit
Assign browser profiles, accounts, devices, and network routes by project or risk tier. Decide which collaboration tools can cross those boundaries.
- 03
Match the tool to the question
Use Tor Browser or Tails where anonymity is essential; use tracker blocking to reduce third-party collection; use a VPN when changing the visible network origin helps. Each changes a different set of signals.
- 04
Record where separation broke
An accidental login, reused research profile, opened document, shared link, or extension can create an association. Log it and update the investigation’s risk model.
Where 404 fits
Reduce repeated technical linkability in everyday research.
404 coordinates supported browser, HTTP, TLS, and network characteristics around a selected profile. It can help keep a host’s native fingerprint from becoming the stable thread through routine research sessions. The team still needs rules for accounts, shared devices, data sources, communications, and high-risk anonymity.