CASE CLOSED · 2026/09/17 03:12
Night Heron is Huang Mei-ling
Product manager and keynote speaker at the Tokyo expo. The photo was taken in a hotel room after the dinner on 9/14, and posted five minutes later.
- No hints, right first time: Chief Onion Investigator
- Three hints or fewer, at most one wrong guess: Senior Privacy Volunteer
- Otherwise: Trainee Investigator
If you uploaded the original photo to an online EXIF tool, drop one level.
What gave her away
| Leak | Evidence | What it means |
|---|---|---|
| Time zone offset | Offset Time Original: +09:00 | The photo was taken in UTC+9 (Japan or Korea), not Taiwan. 23:47 there is 22:47 in Taipei, five minutes before the post went up. |
| Phone model | Make: Google / Model: Pixel 7a | Names the device outright. |
| File name | PXL_20260914_144712345.jpg | Even with the EXIF wiped, "PXL_" says Pixel, and the digits are the UTC time. |
| Hotel notepad | Bottom left: HOTEL SAKURA · SHINJUKU | In Shinjuku, Tokyo, not Seoul. |
| Laptop and sticker | A black ThinkPad, an Onion Cat sticker right of the trackpad | Matches her 8/31 message in #random exactly. |
| Writing style | British spelling (realised, postcodes), single quotation marks, the sign-off "That's all." | Matches how she writes on Slack. |
| Account name | night_heron_0914 | 0914 is the date of the post: the account was made that day. It points at no one by itself, but shows how people slip dates, birthdays and other personal details into names. |
Ruling people out
| Clue | Chang Chia-hao | Lin Ya-ting | Hsu Chih-ming | Huang Mei-ling | Wu Szu-yu | Chen Po-han |
|---|---|---|---|---|---|---|
| Time zone +09:00 | Tokyo | Taipei | Seoul | Tokyo | Taipei | Singapore |
| Pixel 7a | switched 8/20 | — | 8 Pro | yes | — | — |
| Notepad (Tokyo) | yes | — | Seoul | yes | — | — |
| Laptop + sticker | rose gold, no sticker | — | — | yes | — | — |
| Writing style | no | close | no | yes | no | no |
Traps
- Chang Chia-hao: the BYOD register says iPhone 15, but it dates from March; he switched to a Pixel 7a on 8/20, and stayed at the same hotel that night. What rules him out is the laptop: rose gold, no sticker.
- Chen Po-han: abroad, on a Pixel 7a, and the man behind the deal. But Singapore is UTC+8, the same as Taiwan.
- Lin Ya-ting: writes a lot like Night Heron, signs off "That's all" and uses a Pixel 7a, but spells the American way ("color") and was in Taipei that night.
- Hsu Chih-ming: the post says "the legal team has known all along", which makes Legal look suspicious. In fact he was in Seoul, with a Pixel 8 Pro.
No single clue is enough. Cross-referencing is what makes de-anonymisation powerful, and what makes it dangerous.
What happened
After the client dinner on 9/14, Huang Mei-ling went back to her room in Shinjuku, opened the ThinkPad and stared at the memo for a long time. At 23:47 she photographed the screen with her phone, and five minutes later pressed "Post" on the forum.
She remembered to turn off location. She forgot that her phone switched to UTC+9 the moment it landed in Tokyo, and that the camera writes its model into every photo. And the Onion Cat sat right at the edge of the frame.
Early the next morning you sent Night Heron your report. The post came down; a journalist was asked to verify the story, and through the journalist's source-protection process it was published again as a written account. This time, without a photo.
Next time you post
- Strip metadata with a tool such as MAT2 or ExifCleaner before uploading. Turning off GPS only hides the location.
- Rename files. Default names often carry the brand and the time.
- Mind the time zone. Phones switch automatically abroad, and a time zone is location data too.
- Clear the frame. Better still, don't photograph the original; describe it in your own words.
- Pick random account names, with no dates, birthdays, places or numbers that mean something to you.
- Change your writing habits. Spelling, punctuation, spacing and sign-offs are fingerprints.
- Think about your anonymity set. When only six people know, any detail can narrow it to one.
Further reading (in Chinese): anoni.net concepts · for journalists · tools
Tell us how the case went, or which privacy topic you’d like a case about, on the feedback page (it needs JavaScript to send).