The Friendly Guide To Assuming You’re The Main Character (In An Investigation)

You are not paranoid. You are just pre-famous.

There is a very specific feeling that hits at 2:13 AM when you realize someone, somewhere, might be piecing together your entire digital life like it is a true crime corkboard. Your Venmo history, your deleted tweets, your weirdly specific search for "how to disappear legally in New Mexico." Suddenly you are not just a person who pays for overpriced oat milk. You are a Person of Interest.

Congratulations. You have unlocked Main Character Syndrome, Investigation Edition. It is less fun than the TikTok version, but way more useful.

This guide is for when you have that itch. When you get a subpoena-shaped vibe from an email. When your ex works for a three-letter agency. When you are a journalist, an activist, a founder who annoyed the wrong billionaire, or just someone who would rather be cringe and prepared than chill and compromised.

Let's assume you are the main character. Here is how to act like it.

Everyone Leaves Breadcrumbs. You Leave Fewer.

The first rule of being investigated is not about encryption. It is about volume.

Investigators do not need you to confess. They need you to be boring and consistent and prolific. Most people produce about 10,000 data points a day without trying. Location pings, card swipes, face unlocks, background app refreshes, loyalty cards, Ring cameras catching you taking out trash in socks that do not match.

You cannot go dark. Going dark is suspicious and also impossible unless you live in a yurt. You can go dim.

Start with the low hanging fruit that makes you an easy target:

Your phone is a snitch. It knows where you slept, who you slept near, and how long you stared at their Instagram after. Turn off Significant Locations on iPhone, turn off Location History on Google, and audit which apps have Always Allow. Does your flashlight app need your precise location? No. It does not.

Your metadata is the real diary. People obsess over what they said. Professionals look at when, how long, how often, and to whom. That 47-minute call at midnight after you both swore you were done texting? That tells a story. The content is almost secondary.

Free is a business model. If you are not paying, your data is the product. That free VPN, that personality quiz that tells you which moldy sandwich you are, that app that ages your face into a raisin. You traded your cousin's birthday for server costs.

Think of it like this: you cannot stop leaving footprints in wet cement. But you can stop doing cartwheels in it.

2. Threat Modeling, But Make It Hot

Security people love to say "threat model" like it is a personality trait. All it means is: who might be looking, what do they want, and what happens if they find it?

There are three tiers of investigator energy.

Tier 1: The Nosy Amateur. An ex, a rival founder, a very motivated Redditor. They have time, Google, and spite. They will find your old Myspace, your public records, your LLC filing, your mom's Facebook comment from 2014 saying "So proud of you honey!!!"

Defense: Lock down public records. Scrub people-search sites. Make your Instagram private, or at least make your close friends list actually close. Delete those 2012 tweets. Yes, all of them.

Tier 2: The Professional With A Budget. A corporate investigator, a law firm, a private intelligence contractor, a journalist who actually knows how to use FOIA. They have tools. They have databases you have never heard of. They buy your data legally from brokers.

Defense: Data broker opt-outs. Freeze your credit. Use an alias for deliveries. Separate your identities. You need at least two emails: one that is your government name for banks and taxes, and one that is feral and unlinked for everything else. Never cross the streams.

Tier 3: The State. If you are here, you already know you are here. You do not need my little Medium guide. You need a lawyer, a Faraday bag, and to stop reading Medium guides about investigations.

Most of you are worried about Tier 1 and Tier 2. So act accordingly. You do not need a burner phone from a drugstore. You need better compartmentalization and less main character monologuing in the group chat.

3. Your Devices Are Already Testifying Against You

Let me say something that will ruin your day: deletion is a myth.

When you delete a file, your computer just removes the little Post-it note that says where the file lives. The file itself is still there, chilling, until something overwrites it. Forensic software recovers "deleted" photos like it is digging up gossip.

If you are the main character, here is your hygiene checklist:

Encrypt everything. iPhone does this by default if you have a passcode. Android, turn on encryption. Mac, FileVault on. Windows, BitLocker on. If your laptop gets seized or stolen and it is not encrypted, you basically handed over a printed memoir.

Update your shit. I know. Annoying. But that little "Update Now" badge is patching the exact vulnerability that lets someone turn on your camera without the little green light. Pegasus was not magic. It was unpatched software.

Use a password manager and kill password reuse. If your dog's name plus 123 is your password everywhere, one breach becomes every breach. Have I Been Pwned has your email. I promise.

Messaging matters. SMS is a postcard. Anyone in the middle can read it. WhatsApp and Signal are sealed envelopes. Signal is better because it collects almost nothing. Set disappearing messages to one week for most people. Not because you are shady. Because conversations should have an expiration date like milk.

And please, for the love of god, turn off iCloud backup for Signal and WhatsApp if you are serious. Otherwise you are encrypting a message and then mailing a copy to Apple and Google.

4. The Art Of Being Boring On Paper

The most dangerous investigation tactic is not hacking. It is asking for documents you forgot you signed.

Every loyalty program, every lease application, every newsletter that required your real address. That is a paper trail. And paper trails are forever.

If you are assuming main character status:

Minimize your attack surface for public records. Use a registered agent for your LLC. Get a PO Box or a private mailbox for business mail. Do not put your home address on your website's contact page. You are not that accessible. You are not Google support.

Pay attention to your financial exhaust. Your bank statements are a map of your personality. Cash is not dead. It is just retro. Use cash for things you do not need loyalty points for. Use privacy.com or similar virtual cards for online trials so you do not get charged and your real card does not end up in 17 breach dumps.

Social media is discovery. Lawyers love Instagram. Prosecutors love Instagram. HR loves Instagram. If you would not want it read aloud in a deposition while your mother watches, do not post it. Stories are not ephemeral. Someone screenshotted it. Someone always screenshots it.

Being boring on paper is not about being innocent. It is about being uninteresting to search. You want an investigator to open your file, sigh heavily, and close it.

5. How To Talk When Someone Is Taking Notes

Eventually, main characters get a knock. Or an email that says "Can we chat?" Or a friendly DM that feels just a little too friendly.

Here is your script for when that happens.

Do not lie. Lying to federal investigators is a separate crime that is often easier to prove than the thing they were investigating in the first place. You can be silent. You can be vague. You can say "I do not recall" if you genuinely do not. Do not invent.

Do not volunteer. The phrase "I want to be helpful" has ended more careers than tequila. Answer the question asked. Then stop talking. Silence feels awkward. Awkward is free. Lawyers cost money.

Get it in writing. If someone says "this is informal" or "just background," that means it is informal until it is not. Ask: Am I required to answer? Am I free to leave? Am I a target, subject, or witness? If they cannot answer, you have your answer.

And get a lawyer before you become a cooperator, a whistleblower, or a hero. Heroes in investigations get turned into cautionary tales.

6. The Plot Twist: You Are The Investigator

Here is the fun part. Once you learn how investigations work, you start seeing how sloppy everyone else is.

You want to know if someone is lying? Do not look for fidgeting. Look for consistency over time. Truth is messy but stable. Lies are polished and change slightly with each retelling.

You want to find someone? Do not start with their name. Start with their patterns. Where they order food, what gym they tag, what username they reuse across platforms because they have run out of creativity.

OSINT is just being nosy with better tools. Reverse image search your own photos. Search your email on breach sites. Google your name plus "pdf" or "filetype:xls." It is horrifying what you left on the internet in 2016.

Assuming you are the main character makes you better at spotting other main characters. And it makes you much harder to manipulate. Because you finally understand that every app, every service, every "free" tool wants the same thing an investigator wants: to know what you will do next.

Final Scene: The Exit Strategy

You cannot achieve perfect privacy. Perfect privacy is a cabin with no address and no friends and honestly that sounds like a different kind of investigation.

The goal is not to vanish. The goal is to have choice. To decide what is public and what is private. To make it expensive and annoying to build a file on you. To live like someone who knows that data never dies, but you can control what data you create.

So clean up your digital apartment. Not because someone is coming over right now. But because someone could. And when they do, you want them to find a place that is tidy, boring, and gives away absolutely nothing interesting.

You are the main character. Act like you have a sequel coming.

You have the right to remain interesting. Anything you post can and will be used to make a meme of you.

Stay nosy. Stay careful.

Want the extended, field manual version with tools, templates, scripts, and the full opt-out checklist I actually use? I put everything into a deeper guide here: The Person of Interest Playbook