Footnote Privacy? Footnote Privacy!  ## Metadata - Author: [[Heather Burns]] - Full Title: Footnote Privacy? Footnote Privacy! - Category: #articles - Document Note: --- tags: [privacy, opsec, Zotero] author: Heather Burns source: heatherburns.tech reference: [https://heatherburns.tech/2025/10/27/footnote-privacy-footnote-privacy/] date created: 2025-10-27 00:00 --- # 🏷️ Title: Footnote privacy? Footnote privacy! ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - Include links cited in or relevant to the article. ## 📝 Summary - What happened. - The author adopted Zotero for managing 100+ OSCOLA footnotes and examined its privacy and security implications. - Why it matters. - Academic research and researchers are targeted; citation tools can expose sensitive metadata and patterns. - Key stakeholders. - Researchers, students, journalists, universities, tool vendors. - Risks and tradeoffs. - Cloud sync convenience vs. confidentiality; public profiles vs. safety; vendor storage vs. self-hosted encrypted storage. - Bottom line. - Keep using effective tools like Zotero, but lock down settings (private account, encrypted storage) and review privacy practices. ## 📖 Main Content - Core arguments - Manual citation at scale is impractical; Zotero streamlines formatting and research capture. - Privacy and security questions must be first-class: “Is the cloud service end-to-end encrypted? Is my account publicly visible? Is my account being fed into an LLM? Are they selling my data? Is there adtech? Do they get subpoenas… Do they respond?” - Practical choices: set Zotero account to private; prefer own encrypted cloud storage even if discouraged. - Context and terms - OSCOLA: a legal citation style requiring precise formatting. - OPSEC/PERSEC: operational/personal security practices to reduce risk exposure. - E2EE: end-to-end encryption prevents providers from accessing content. - Uncertainties - Vendor responses to law-enforcement requests and model-training policies vary and can change; users must verify current policies. ### 🗒️ Notes - “Manually adding 100+ footnotes… in the relatively obscure citation style (OSCOLA)… is genuinely not possible.” - “I use Zotero… Browser extensions… word processor integrations… push a button and make your ~properly formatted~ footnotes appear.” - Threat model: “Academic research is a target of some rather nasty things… as are the researchers…” - Questions to cover: E2EE, public visibility, LLM training, data sales, adtech, subpoenas, responses. - Actions taken: account set to private; using self-managed encrypted cloud storage. - Guidance: if your work is controversial, address these questions; “2025 opsec sucks, but it is what it is.” ## 📚 References - Zotero reference manager: https://www.zotero.org/ - OSCOLA style guide: https://www.law.ox.ac.uk/research-subject-groups/publications/oscola - Understanding end-to-end encryption: https://ssd.eff.org/module/communicating-others ## 🗣️ Paraphrase - Paragraph A paraphrase. - The author relies on Zotero to handle complex OSCOLA citations at scale because manual formatting is untenable. - Paragraph B paraphrase. - Given rising threats to researchers, they audit privacy: turn off public visibility, avoid vendor cloud, and recommend others assess E2EE, LLM use, and subpoena policy. ## 📰 Newsletter - Research tooling meets privacy reality: If you’re wrangling OSCOLA or any heavy citation load, Zotero is a lifesaver. But threat models matter. Lock down your profile, confirm E2EE status, opt out of data sharing/model training, and consider encrypted self-storage. Quick win this week: review your Zotero privacy settings and your sync backend. Resource picks: OSCOLA guide, EFF on E2EE, and a friendly reminder that 2025 OPSEC is a team sport. ## ✅ Action Items #### DevRel - Publish a “secure research stack” guide with Zotero examples and OPSEC checklists; add sample projects demonstrating private configs; office hours on privacy setups. - Improve docs/snippets for private sync, export/import, and backups; quickstarts that default to minimal data exposure. - Campaign: “Private by default” with before/after profiles and metrics on reduced exposure. - Community moderation on sharing libraries safely and doxxing prevention. #### OSPO - Policy: require privacy reviews for research tooling; document acceptable sync/storage options. - Compliance: verify licenses for citation styles and connectors; scanning for telemetry/adtech in plugins. - Security: threat model for research metadata; signing and attestations for plugins; embargo and disclosure policy for addons. - Inventory: SBOM for tooling; owners; freshness SLOs. - Support: legal guardrails for subpoenas; consultation hours on data handling. - Engagement: MoUs with universities on privacy-respecting defaults; upstream funding for E2EE. #### Community - Maintainers: templates for privacy-first defaults; release checklists for telemetry. - Contributors: first-issue rotations on security-hardening tasks. - Sponsors: fund E2EE and private-sync features; publish impact reports. - Ecosystem: joint drills on coordinated disclosures and policy shifts. #### WordPress - Core: privacy settings discoverability; default off for telemetry; performance budgets intact. - Core Performance: measure impact of encryption/local storage on perf. - Core AI: explicit opt-out and provenance checks for training; red teams. - Core Program Team: align privacy guidance across Make teams. - Mobile: offline UX with private sync; telemetry review. - Playground: labs for testing Zotero-like flows and private storage. - Community/Training: lesson plans on OPSEC for researchers. - Marketing: campaign around “privacy-first workflows.” - Support/Docs: help articles on citation tools and privacy. - Accessibility/Meta/CLI/Hosting/Tide/Openverse/Themes/Plugins: include privacy checks, provenance, and review throughput with security liaison coverage. #### The WPCC - Programs: microgrants for privacy-by-default plugin work. - Projects: governance clinics on data exposure. - Funding: matched grants for E2EE storage integrations. ### FAIR - Technical independence: local metadata and signature checks. - Policies: transparency and sunset clauses for data collection. - Governance artifacts: operator agreements and scorecards for tooling privacy. ## 🧪 Hypotheses - Making Zotero profiles private reduces unsolicited contact or targeting. - Using self-managed encrypted storage decreases risk of third-party data access. - Clear privacy checklists increase researcher adoption of safer defaults. - Vendors with no LLM training policies deter high-risk users. ### 📊 Methodology - A/B study on profile visibility vs. reported harassment incidents. - Security assessment comparing vendor sync vs. encrypted self-storage breach surface. - Survey before/after privacy checklist rollout; measure configuration changes. - Policy analysis of vendor terms; correlate with user adoption in sensitive fields. ### ❓ Questions - Which citation tools offer true end-to-end encryption for libraries and notes? - How often do vendors receive and comply with subpoenas for research data? - What telemetry do popular plugins/extensions collect by default? ### 🔮 Future Research - Standardized privacy benchmarks for research tooling. - Usability studies for private-sync workflows. - Auditable opt-out mechanisms for model training. ### 💡 Implications - Practice: default-private profiles and encrypted storage. - Policy: institutional guidance for researcher tooling. - Security: minimize metadata leakage and subpoena exposure. - Education: OPSEC modules in research methods. - Funding: support deve - Summary: Now that I’m doing a certain amount of academic writing, I’ve had to start using a citations manager. - URL: https://heatherburns.tech/2025/10/27/footnote-privacy-footnote-privacy/ Now that I’m doing a certain amount of academic writing, I’ve had to start using a citations manager. Manually adding 100+ footnotes per document, correctly formatted *to the dot* in the relatively obscure citation style ([OSCOLA](https://www.law.ox.ac.uk/sites/default/files/migrated/oscola_4th_edn_hart_2012.pdf)) which my university uses, is genuinely not possible. (Well, I mean you *could* do it manually, but you’d go mad, you’d double the amount of time you spend on the piece, and you’d lose your writing flow 100+ times in the process.) I use [Zotero](https://www.zotero.org/), which is a nifty open-source utility which doubles as a repository for all your research. Browser extensions mean you can just chuck what you need in there when you’re doing the research, and then when you’re writing, word processor integrations mean you can push a button and make your ~properly formatted~ footnotes appear. Magic. But me being me, the question of *what are the privacy standards on Zotero?* popped into my head, on one of those nights when you randomly find yourself wide awake at 3 AM asking the universe questions such as *what is the point of my feeble existence on this earth* or *what are the privacy standards on Zotero* or *should I ask that guy out* and that kind of thing. Because if you haven’t been living under a rock, you know that academic research is a target of some rather nasty things right now. As are the researchers who do that research, and I of course am [entering that territory](https://heatherburns.tech/2025/08/21/queen-of-the-hill/). That raises questions about citation managers which can be critical to your persec and opsec, such as: * Is the cloud service end-to-end encrypted? * Is my account publicly visible? * Is my account being fed into an LLM? * Are they selling my data? * Is there adtech? * Do they get subpoenas from Bad People? * Do they respond to those subpoenas? [It turns out other people are thinking about these things too](https://forums.zotero.org/discussion/111047/privacy-and-security-in-zotero). That link is a good place to start if you find yourself up at 3 AM too, regardless of the citations manager you use. Personally I’m going to keep using Zotero – it works, I love it! – but I’ve set my account to private. Check your Settings.  I’m also using my own encrypted cloud storage, not theirs, [even though they tell you not to do that](https://www.zotero.org/support/sync). Imagine me not listening to people telling me what not to do. If you’re using a citations manager and your work might also be considered, erm, controversial, take some time to cover these questions too. 2025 opsec sucks, but it is what it is. I’m a UK tech policy wonk based in Glasgow. I work for an open web built around international standards of human rights, privacy, accessibility, and freedom of expression. The content and opinions on this site are mine alone and do not reflect the opinions of any current or previous team., Footnote Privacy? Footnote Privacy!, Heather Burns, 01k8kede357my6r1n53cjg1kmh.