Anyone who researches seriously ends up holding notes about people. Sources, subjects, contacts, the person you are trying to identify from a fragment. Investigators, journalists, lawyers, security researchers, family members keeping a safeguarding record, all of them accumulate files about human beings who never agreed to be filed.
Those notes are not yours in the way your shopping list is yours. They contain other people’s exposure. A leaked research folder does not embarrass you nearly as much as it endangers them.
So the discipline is not paranoia, it is duty of care. What follows is a working method, deliberately general. The particulars of any real case stay where they belong, which is the whole point.
The shape of it
Three rules, and everything else is detail:
- Sensitive material is encrypted at rest, always.
- The key lives in your head, not on the machine.
- Nothing sensitive is ever named anywhere it might travel.
Rule 1: Encrypted at rest
Symmetric encryption with a passphrase is the right primitive here. You are not exchanging messages with anyone, you are protecting a file from whoever ends up holding the disk.
# encrypt
gpg --symmetric --cipher-algo AES256 notes.md
# read it, WITHOUT writing plaintext to disk
gpg -d notes.md.gpg | less
That second command is the one that matters. Decrypt to a pipe, not to a file. The moment you write notes.md back to disk to read it, you have undone the encryption and left a copy that outlives your attention span.
age is a fine modern alternative and simpler to use, if you prefer it. The tool matters far less than the habits around it.
Rule 2: The key lives in your head
This is where most setups quietly fail, because the convenient options are the weak ones.
- Not in a password manager on the same machine. If the disk is compromised, you have stored the key next to the lock.
- Not biometric. This is the one people resist, so state it plainly: a fingerprint can be taken from you, a memorised passphrase has to be given. Someone can hold your hand to a sensor while you are unconscious, or unwilling, or under legal compulsion. In many jurisdictions the legal threshold for compelling a biometric is markedly lower than for compelling something you know. Convenience is the enemy here.
- Yes, memorised. One strong passphrase you actually remember, not written down in the same house as the disk.
The trade is real and worth naming: if you forget it, the data is gone forever. That is the correct failure mode. Data that can be recovered by a helpful support process can be recovered by someone else too.
Rule 3: Never name anything that travels
This is the rule people skip, and it is the one that saves you.
Assume that dashboards, logs, backups, sync clients, crash reports and screenshots all leak eventually. Not dramatically, just ordinarily. So the real identifiers should not be in any of them.
The pattern: keep one small local-only file that maps real names to arbitrary labels. Everywhere else, in your working notes, your task list, your project boards, your automation, you use only the label. Then when something does leak, it carries no person in it.
# key.md — local only, encrypted, never syncs
LABEL-ONE = <real subject>
LABEL-TWO = <real subject>
Pick labels with no semantic content. Star names, colours, numbers. A codename that describes the subject is not a codename.
Where this actually breaks
Four honest failure modes, three of which I have hit personally.
1. shred does not do what you think on modern hardware. This is the big one. On an SSD, wear levelling means writing a block does not overwrite the old block, the drive writes elsewhere and leaves the original cells intact. On copy-on-write and journaling filesystems the same problem appears for different reasons. So shred -u and rm -P are best-effort, not a guarantee.
The real protection is full-disk encryption, always on, so that “deleted” data is unreadable ciphertext regardless of what the flash controller kept. Treat secure-delete as tidiness, and full-disk encryption as the actual control.
2. Deletion silently fails. Related and more mundane: I have watched a file survive two separate deletion commands that both returned success. If a temporary file held a key, “I ran rm” is not the same as “it is gone.” Verify the deletion. One extra line, every time:
rm -P /tmp/secret && ls /tmp/secret 2>/dev/null && echo "STILL THERE"
3. Plaintext escapes sideways. Not through the file you were watching, but through the editor’s swap and undo history, the shell history, a crash dump, the clipboard, a screenshot, a “helpful” cloud sync, a backup tool that indexes everything. Decrypting to a pipe avoids most of this. Keeping the folder out of every sync client avoids the rest.
4. Key delivery. If a secret has to reach another machine or person, do not send the payload and the passphrase down the same channel. Split them. And treat any transport passphrase as burned the moment it has been used, re-encrypt under the real key at the far end and destroy the transport copy.
A working checklist
- Sensitive folder lives on encrypted local storage, in no sync client, no git repository, no shared drive.
- Files at rest are individually encrypted. Symmetric, AES-256, passphrase memorised.
- Reading is
decrypt | pipe. Plaintext never touches disk. - Real names live only in one encrypted key file. Everything downstream uses labels.
- Anything that leaves the machine carries labels only.
- Deletions are verified, not assumed.
- Full-disk encryption is on, because that is what actually backstops all of the above.
The judgment call, which no tool makes for you
The hardest part is not the cryptography, it is deciding what to write down at all.
Encryption protects a file. It does not decide whether the file should exist. Before adding something about a living person, the question is whether you need it, or whether you are collecting it because collecting is easy and it might be useful one day. The second reason is how ordinary research folders quietly turn into dossiers on people who never did anything.
Keep less. Encrypt what you keep. Name no one anywhere it can travel. And accept that if you forget the passphrase, the right outcome is that the material is gone.