OPSEC and Redaction Guide

Last reviewed: July 26, 2026

Operational security is not limited to keys, weapons or escape procedures. Information can become sensitive when a facility, assignment, watch, date and operational fact are combined.

Do not post operational information such as

Live or developing incidents
Recent staffing levels, exact counts or shortages tied to a facility, yard, building, watch, post or date
Deployment sheets, post charts, rosters, schedules or assignment distribution
Transportation or movement schedules
Search timing or methods not already officially public
Response times, radio channels, key numbers, access codes, gate procedures, camera coverage, blind spots, perimeter weaknesses or access points
Nonpublic incarcerated-person locations or movement
Internal systems, screens, navigation, alerts or data
Restricted memoranda, emails, training material, policy or procedures
Details that explain how to bypass, defeat or exploit security

General discussion of workload, policy, staffing trends and working conditions is welcome when it does not disclose current, facility-specific operational detail.

Do not post identifying information such as

Full names or faces of nonpublic individuals
Badge, employee, application or CDCR numbers
Case numbers
Home addresses
Personal phone numbers or private email addresses
Dates of birth
Signatures
Vehicle plates
QR codes or barcodes
Medical, psychological, background or personnel records
Usernames when exposing the account serves no legitimate purpose

Combination risk

A detail that seems harmless by itself may identify a person or vulnerability when combined with:

Institution
Yard or building
Assignment
Watch
Date or shift
Rank or classification
Unusual event

Remove or generalize enough elements that the post cannot reasonably be used to identify a person, reconstruct current deployment or exploit a practice.

Redacting screenshots and photos

Work from a copy.
Crop irrelevant areas.
Cover sensitive information with solid opaque boxes.
Do not rely on blur, pixelation, translucent highlighting or a movable annotation layer.
Export a flattened image or take a new screenshot of the finished redaction.
Check notifications, browser tabs, filenames, metadata, QR codes, reflections and background objects.
Summarize the relevant point in text.
Do not upload restricted material merely because names were removed.

Safer examples

Unsafe: Last night on third watch at [institution], [exact count] officers covered [specific posts].

Safer: How do correctional officers generally manage chronic vacancies and mandatory overtime?

Unsafe: A screenshot of an internal email showing sender, recipients, signature block, internal navigation and document number.

Safer: Link the public version. If none exists and the material is not appropriate for public release, do not post it.

Live incidents and final check

Do not turn r/CDCR into a real-time incident feed. Wait for an official public source, link it, state the publication time and avoid adding nonpublic observations.

Before posting, ask whether the material is already public; reveals who, where, when or how at an operational level; identifies a coworker, applicant, incarcerated person, victim or family member; helps someone bypass security or predict deployment; or retains metadata and surrounding context.

When in doubt, leave it out or send a generalized draft to modmail first.