The six layers
The L.A.Y.E.R.S. framework helps investigators and researchers reduce exposure. Use all six together.
L — Limit your exposure
Use a fresh browser profile with no personal logins or extensions. Create a dedicated research profile, remove personal extensions, and never sign into personal accounts in it.
A — Anonymize your connection
Route sensitive research through a reputable VPN or Tor Browser and verify the result with leak tests. Confirm that the visible IP is the exit node, not your ISP.
Y — Yank out metadata
Images, PDFs, and documents can carry device names, GPS coordinates, and author information. Check files from unknown sources before opening them, and strip metadata from your own files before sharing.
E — Establish separation
Keep your research identity separate from your real identity. Use burner email addresses for research accounts and a dedicated virtual machine or isolated browser environment. Never use your real name, phone number, or primary email for research accounts.
R — Research safely
Investigate targets indirectly. Submit suspicious URLs to URLscan.io or VirusTotal before visiting, use web archives where appropriate, and use WHOIS or passive DNS to learn about infrastructure without directly contacting unknown servers.
S — Secure your environment
Keep the operating system and tools updated, enable MFA on research accounts, encrypt research files, and remove temporary data or virtual-machine snapshots when the session is complete.
Bottom line
OPSEC is a habit, not a one-time setup. Apply the layers before every investigation and after it, and leave as little connection as possible between your research and your real identity.
Stay Protected
Use our free tools to protect yourself from the threats discussed in this investigation.