How to Detect and Remove Stolen Photos from Fake Profiles, Listings and Ads
Photographs are routinely stolen from social networks, old advertisements, building chats, school websites and review platforms. The images later appear in unknown profiles, advertisements, product cards, rental listings or suspicious Telegram channels. People usually discover the theft when friends notice or when they run the pictures through dedicated reverse-image search services.
One photograph can violate several rights at once. Using a portrait to advertise courses infringes the right to one’s image, commercial-use rules and the photographer’s copyright. Creating a fake page with someone else’s face to solicit money requires a fraud report rather than a simple takedown request.
Legal basis in Russia
Article 152.1 of the Russian Civil Code protects the image of a citizen. Publication or distribution of a person’s photograph without consent is prohibited except in cases of public interest, open-place photography or paid posing. Copyright exists independently; the creator can demand removal, attribution or compensation. Consent from the recognizable person is always required for publication.
Where to search for copies
A single search engine rarely finds every duplicate. Yandex Images performs well on Russian-language sites. Google Lens excels at locating similar images and cropped fragments. TinEye often surfaces older publications missed by larger engines. Bing Visual Search serves as a supplementary tool for foreign sites. Text searches by name, nickname, company or rare phrases can reveal hidden results.
Users should also upload cropped versions focusing on the face, interior details or background objects, because thieves frequently crop, recolor or overlay stickers on images.
Preserving evidence before complaining
Before contacting the offender or platform, capture the entire page, record the exact URL, save the page as PDF, note the discovery date and retain the original file with metadata. For serious cases, a notary can officially inspect the page. Archive services such as web.archive.org are useful but incomplete; courts prefer screenshots, PDFs and notarized records.
Filing complaints
Platforms respond faster to built-in forms. VKontakte accepts reports via the post or community menu, with users flagging impersonation and linking the real account. Odnoklassniki handles photo complaints in its violations section. Telegram allows in-app blocking; fraud cases can also be reported to @notoscam. Avito, Yula and Cian collect reports on individual listings. Marketplaces provide dedicated copyright forms. When platforms ignore requests, complainants may contact the hosting provider.
Complaints to Roskomnadzor are appropriate when personal data such as phone numbers or addresses are leaked alongside the photo. Police should be contacted for extortion, blackmail or fraud. Courts can award compensation and issue injunctions.
Protecting future images
Technical prevention is limited, yet several practical measures reduce risk: publish lower-resolution versions, apply watermarks, store originals securely, photograph products against a background containing the seller’s nickname, avoid uploading sensitive documents, tighten privacy settings on family albums and regularly run reverse-image searches.
Related articles
Why Replace Proprietary BIOS and UEFI with the Fully Free GNU Boot Firmware
The Free Software Foundation announced in September 2026 that it is providing financial and legal support to the GNU Boot project, which aims to deliver a completely open-source replacement for traditional BIOS and UEFI firmware. GNU Boot builds on coreboot to initialize hardware at boot time and layers a free bootloader such as GRUB or SeaBIOS on top, ensuring no proprietary binary blobs are required. The initiative emerged after a 2022 split from Libreboot, which began accepting closed-source components to broaden hardware support, while GNU Boot strictly adheres to GNU licensing criteria that prohibit any non-free code. Supported platforms remain limited to older systems from roughly 2008–2012, including specific ThinkPad models, certain early Apple MacBooks, and a handful of AMD and Intel desktop boards, because newer Intel Boot Guard and AMD equivalent mechanisms enforce signed firmware that prevents unsigned replacements. Closed firmware from Intel Management Engine and AMD Platform Security Processor runs before the main operating system, possesses unrestricted memory access, and cannot be audited or disabled on most modern hardware. By offering reproducible builds and clearer installation instructions, GNU Boot seeks to lower the barrier for users who want to eliminate potential backdoors, Wi-Fi whitelist restrictions, and forced updates found in vendor firmware.
WhatsApp Help Pages Hid Secret Instructions Directing AI Bot to Avoid GDPR References
Researchers at Redact discovered hidden instructions embedded in WhatsApp's public help documentation that instructed the company's AI support chatbot to avoid recommending users contact data protection regulators. The instructions also prohibited the bot from referencing GDPR, LGPD, or CCPA when users mentioned legal proceedings or lawyers. The findings emerged after Redact analyzed 545 help pages and identified 102 concealed blocks across 80 of them. One directive explicitly told the bot not to suggest contacting supervisory authorities even when users had lost access to their phone number and could not delete their account, despite WhatsApp's own European privacy policy stating that such complaints are permitted. WhatsApp confirmed to WIRED that the blocks were intended solely for its internal chatbot and attributed their public exposure to an error. The company stated the restrictions aimed to prevent the bot from offering legal advice. All hidden blocks were removed by October 18.
WhatsApp Secretly Instructed AI Support Bot to Suppress References to Data Regulators and Privacy Laws
Investigators discovered hidden instructions embedded in WhatsApp's public help pages that directed the company's AI chatbot to avoid recommending users contact data protection authorities. The instructions also prohibited the AI from citing privacy regulations such as GDPR, LGPD, or CCPA, even when users raised these topics themselves. The directives appeared on pages about account deletion and complaints, remaining invisible to human visitors but delivered to crawlers and the AI model. WhatsApp later confirmed the text was intended for its internal support chatbot and attributed the exposure to an error that has since been corrected. The findings highlight a gap between the company's publicly stated privacy policy and the operational guidance given to its AI systems.
Developer Builds Password Manager with Plausible Deniability Using Argon2id and XChaCha20-Poly1305
A Java backend developer rewrote a personal password manager originally built with Electron and React, migrating it to Tauri and Rust while redesigning its storage to support plausible deniability. The new implementation derives keys with Argon2id using a single per-install salt and encrypts files with XChaCha20-Poly1305, storing only random 32-character hex filenames without any headers or magic bytes. Multiple decoy vaults of identical size are created automatically for every user, and all files in the folder receive synchronized timestamps to eliminate metadata-based identification of the active vault. History and sync data are stored as additional encrypted files of the same format, making it impossible to distinguish real from decoy vaults from the filesystem alone. The approach mirrors VeraCrypt hidden volumes but operates on ordinary files and folders, with the explicit goal of providing deniability when a user is compelled to reveal a password.