Secure File Sharing and Storage: Handling Sensitive Files
Activists often handle sensitive files: contact lists, legal documents, photos, videos, reports, evidence, financial records and internal planning materials. This chapter explains how to store, encrypt, share and clean files without exposing more than intended.
Overview
Files can expose people, operations and organizations. A spreadsheet of contacts, a legal memo, a photo from a protest or a shared cloud folder can reveal names, locations, authors, timestamps, networks and internal plans.
Secure file handling means thinking before storing, uploading, forwarding or publishing. The goal is to make sure files reach only the intended people, remain protected if intercepted, and do not reveal hidden information through metadata.
Encrypting files and drives
Encryption protects data even if a file, USB drive, cloud folder or laptop is accessed by the wrong person. Full-disk encryption protects devices, but highly sensitive files may need their own extra layer.
Encrypt sensitive documents
Contact lists, legal files, credentials, evidence and internal planning documents should be encrypted before storage or sharing when the risk is high.
Use encrypted archives
Tools such as 7-Zip, Keka, VeraCrypt or GPG can protect files with strong encryption before upload, transfer or storage.
Protect USB drives
USB sticks and external drives are easy to lose. Encrypt the whole drive or store only encrypted archives on it.
Use strong passphrases
Weak passwords make encryption weak. Use long, unique passphrases and store them securely in a password manager where appropriate.
Password-protecting a file with a weak password is security theatre. Use strong passphrases, and never send the password in the same message as the file.
Safe cloud storage and collaboration
Cloud services are convenient for collaboration and backup, but they also create risk. Unless files are encrypted before upload or stored in a zero-knowledge service, the provider or a compromised account may expose them.
Restrict access
Share files only with specific people whenever possible, not with open public links.
Encrypt before upload
For highly sensitive files, encrypt locally before putting them in cloud storage.
Review sharing
Regularly check who has access to folders, documents and shared drives.
Remove old files
Do not use cloud folders as permanent graveyards for sensitive material.
Public cloud links are especially risky because they can be forwarded, copied, indexed or left active long after the original reason for sharing has passed. When possible, use access-restricted links, passwords, expiration dates and download controls.
If anyone with the link can open the file, assume the file may eventually reach people you did not intend.
Removing metadata and traces
Files often contain hidden information. Photos may include GPS location and camera data. Word documents may include author names, organization names, comments, edit history or timestamps. PDFs may preserve metadata from the original document.
Before sharing files publicly or with untrusted parties, remove metadata and review the visible content carefully. A clean-looking file can still expose details in the background.
Remove GPS and EXIF metadata from photos before public sharing.
Inspect Word, Excel and PDF files for author names, comments and revision history.
Convert final documents to clean PDFs when appropriate, then check PDF metadata too.
Blur faces, name tags, addresses, screens and license plates in sensitive images.
Securely delete sensitive files you no longer need instead of only renaming them.
Check cloud trash, shared folders and synced devices after deleting sensitive files.
Changing a filename does not remove metadata. Compressing a file does not necessarily clean it. You need to inspect and remove hidden information deliberately.
Secure file handling checklist
Use this checklist before storing, uploading, sending or publishing sensitive files.
I identify which files are sensitive before storing or sharing them.
I encrypt highly sensitive files before uploading or sending them.
I use strong passphrases for encrypted archives or containers.
I send passwords through a different channel than the file.
I avoid public cloud links for sensitive files.
I restrict access to named recipients whenever possible.
I use link expiration or revoke access after files are received.
I encrypt USB drives and external storage devices that contain sensitive data.
I remove metadata from documents, PDFs and images before sharing externally.
I securely delete old sensitive files instead of keeping them indefinitely.
I double-check recipients before sending sensitive material.
I periodically review cloud folders and shared drives for unnecessary access.
Useful tools and references
These tools can help with encryption, secure storage, metadata removal and safer file transfer. Choose based on your threat model, operating system and team capacity.
Test your understanding, then continue to incident response
Take the short anonymous quiz for this chapter. Your individual result is not stored on the server. After that, continue with recognizing security incidents, responding to compromised accounts, device loss, malware and recovery steps.
Download the full Digital Security Toolkit
Prefer reading offline or sharing the material with your team? Download the full PDF version of the Digital Security Toolkit.