Finding every copy of a leaked image or video, including the ones with no name on them

01What finding every copy means

A leaked file does not spread as one object. It spreads as derived objects: a re-encoded upload on a tube site, a cropped still in a forum thread, a screen recording of it, a mirror on a file host. Several carry nothing that connects them to you by name, so detection is a set of methods, each finding a different class of copy. The limits below are the ones the tool owners publish themselves.

02Why keyword search misses most copies

A search engine matches text: the title an uploader typed, the heading, the words around it. If none of them contain your name, the copy is invisible to a name search however prominent the page is.

• Re-titled uploads. Re-uploads are retitled to something generic, or to someone else's name - so a name search also returns material that is not of you.
• No file name. Hosts rename uploads to a generated identifier, leaving nothing searchable.
• Pages never fetched. Google states that Googlebot does not crawl every page it discovers, that some are disallowed by the site owner, that others need a login, and that indexing is not guaranteed. Closed groups and members-only boards sit behind that same barrier.

03Reverse image search: capability and limits

Reverse image search submits a picture instead of words. Three systems are worth running, and they are not interchangeable.

• TinEye states it does not commonly return similar matches and cannot recognise the contents of an image, so it cannot find different images of the same person. It searches only its own crawled index.
• Google and Bing also return similar images, which helps with crops and screen captures but means results need review. Neither searches inside a video: a video copy is found by submitting frames.

04Hashing: the difference that matters

Hashing turns a file into a short value that can be compared quickly. There are two kinds, and only one is useful for finding re-uploads.

A tube site re-encodes what it is given and a messaging app recompresses it again: byte-for-byte a new file, perceptually the same picture.

• It is a similarity measure with a threshold, so a different picture can score as near. Matches are reviewed, not auto-reported.
• PDQ's documentation states it does not guarantee exact rotational invariance, and that values for one image can differ between libraries.
• Microsoft states that PhotoDNA is not facial recognition software and cannot identify a person in an image.

05Faces and landmarks as a search key

Hashing finds copies of a known file; it cannot find a different photograph of the same person. That is what facial matching is for: measuring the geometry of a face in a reference image and looking for it in candidate material. It gives a similarity score, not an identification, and it is regulated - see below.

• The reference image must be clear enough to measure: two or three good frontal photographs beat a folder of poor ones.
• A face is not the only key: a tattoo, a room or a watermark can tie uploads to one source, assessed by a reviewer.

06Metadata: what survives an upload

Exif is the metadata format cameras write into image files, for the technical details of a capture. Where those fields survive they link an upload to a specific original - but usually they do not. IPTC, which publishes photo metadata standards, tested what social platforms do to embedded metadata: behaviour varied widely, some sites stripping it from saved or downloaded files and others keeping Exif and IPTC fields intact.

07Where search engines do not reach

Much leaked material sits where a general search engine will not usefully surface it: adult tube sites with their own internal search, link aggregators, image boards, file hosts that expose only a download page, registration-only forums.

1. Build the source list: the sites where this material is re-posted, plus their mirrors.
2. Search each source in its own interface, because its internal search sees pages the open web index does not.
3. Follow outbound links: a thread points to the host where the file lives, and that page is what a notice must name.
4. Hash what is found, and record every hit as an address rather than a tally.

08The coverage record: why a number fails

A report saying that a quantity of copies was found and removed contains nothing you can check. A figure with no addresses behind it cannot be verified, re-checked or used in a complaint.

09Lawfulness, and what must never be stored

Article 4(14) of the General Data Protection Regulation defines biometric data as personal data from specific technical processing of a person's physical, physiological or behavioural characteristics which allow or confirm their unique identification, naming facial images as an example. Article 9(1) prohibits processing it to uniquely identify a natural person, subject to Article 9(2) - here 9(2)(a), explicit consent, and 9(2)(f), legal claims.

• So facial matching runs on the person's own instruction, for a defined purpose, with scope and retention agreed in writing.
• Third parties in the same material are not a target of the matching and are excluded from the record.
• Rules outside the EU and the UK differ, and some jurisdictions add biometric consent requirements.

One category must never go through the normal evidence workflow. Section 1(1) of the Protection of Children Act 1978 makes it an offence to take or make an indecent photograph or pseudo-photograph of a child, to distribute or show one, and to possess one with a view to distribution.

10Monitoring after removal

Removing a page does not remove the file from the machines of everyone who downloaded it. Material that was widely posted tends to re-surface, often on a different host and months later. Monitoring is the same work on a schedule, with the reference set already built.

• Re-run the image and hash searches on the same reference frames, so a re-upload is recognised as the known item.
• Re-check the sources where copies were found before, since a removed upload is often replaced on the same site.
• Re-check the search engines separately: a delisting and a page deletion are different events, and either can be reversed.
• Keep the record cumulative, and hold only the minimum material needed for matching, with a stated retention period.