OPSEC in Donations and Foundation Reports: What Not to Publish

Donations are built on trust, and trust is built on reports. But the very same report that convinces a donor could reveal a unit’s location to the enemy. Below is the line between transparency and disclosure: what should not be published in photos, geodata, and text; under which regulations this is prohibited as of August 5, 2026; and how to report in a way that allows donors to see the results while keeping them hidden from the enemy.

What is OPSEC, and why isn’t it just a formality for the foundation?

The danger rarely lies in a single image. It is pieced together from several posts: the first shows the type of equipment, the second—a sign on a building, and the third—a thank-you note with the unit’s name. Each fragment on its own is harmless, but together they reveal a location on the map and the unit’s composition. That is precisely why OPSEC operates not with the concept of “secret,” but with the concept of “aggregation”: the foundation’s posts are an open source, accessible to anyone.

Three channels through which information leaks from the foundation’s content:

Next—each channel separately, starting with the legal provisions.

What is prohibited by law, and who is held responsible?

Article 114-2 of the Criminal Code of Ukraine is titled “Unauthorized Dissemination of Information Regarding the Direction, Movement of Weapons, Armaments, and Ammunition into Ukraine, or the Movement, Relocation, or Deployment of the Armed Forces of Ukraine… committed under martial law or a state of emergency.”

The provision includes two conditions that exempt a person from liability. First: the information has already been made publicly available by the General Staff, the Ministry of Defense, the Main Intelligence Directorate, or the Security Service of Ukraine, or through official sources of partner countries. Second, for Part 2: it is not possible to identify the unit on the ground.

The Commander-in-Chief’s List: An official checklist of what is useful to the enemy

Appendix 2 to Order No. 73 of the Commander-in-Chief of the Armed Forces of Ukraine dated March 3, 2022 (revised February 3, 2024) contains 18 items of information, the disclosure of which provides the enemy with insight into the actions of the defense forces. These include the actual names of units and personal data of service members, assembly points linked to specific settlements, the number and types of military equipment, routes of its movement, photos showing vehicle identification numbers and license plates, and images of the interiors of combat vehicles.

A separate note on personal data: publicly displaying a photograph of a person is permitted only with their consent (Article 308 of the Civil Code), and the unlawful dissemination of confidential information about an individual is punishable under Article 182 of the Criminal Code of Ukraine.

What photos should not be published in an aid delivery report?

The problem is usually not that there’s too much in the photo, but that no one paid attention to the background or the foregrounds: signs, house numbers, terrain features, or equipment in the corner of the frame.

The safest image is taken before delivery

Goods photographed in a warehouse or at the time of purchase convey the same information to the donor—what was purchased and with what funds—but reveal neither the location nor the unit. In a collection of components for combat drones, the components themselves are the focus, not the location of use.

• Instead of a photo at a forward position—show a handoff in the rear area or a shot without a background.
• Instead of a group photo—hands, a piece of equipment, or vehicles without serial numbers.

How do geolocation and metadata reveal a location without any captions?

Social media platforms usually strip out metadata during upload. But the foundation receives photos in other ways—as a file in a messaging app, an archive, or a link to the cloud—and in these cases, the metadata arrives intact: GPS coordinates, exact time, and device model.

Procedure for cleaning up the file before publication:

1. Do not publish the original. It remains in the foundation’s archive; a separate file is used for publication.
2. Remove the metadata. On Windows: go to the file’s “Properties,” select the “Details” tab, and click “Remove properties and personal information”; on a phone: turn off geotagging in the camera app.
3. Resave the file or take a new screenshot. Screenshots and resaving in a metadata editor do not remove metadata.
4. Examine the frame visually. Shadows indicate time and direction; the horizon and vegetation indicate the region; a tower indicates a specific location.
5. Check the audio in the video. The names of settlements, call signs, and background conversations are often more informative than the visuals.

Screenshots and maps are a trap in their own right

A screenshot of a chat with a military unit contains the chat name, unit number, full name, and time, while a screenshot of a navigation app shows the destination. We do not publish such images, even if parts of them are blurred out.

What details in the text of a post or report should not be published?

Text is more dangerous than photos because it is specific. A phrase like “tomorrow we’re taking a vehicle in such-and-such a direction” doesn’t need to be deciphered—it already contains the time, direction, and type of cargo.

Regarding quantity: the exact number of items transferred, along with the unit’s name, constitutes part of the combat strength—that is, item 2 on the official list. For the report, the total expenses and line items as documented are sufficient: the funds are audited, but the unit’s strength is not.

Comments and personal pages—that’s the risk zone

The team and volunteers often share details not in the post itself, but in the comments below it: where exactly the trip went, who to thank, and when the next trip is. There’s one rule: in the comments, we only repeat what’s already in the post.

• Do not confirm speculations in the comments, even if they were made by a donor.
• We do not tag locations in posts or Stories, and we do not forward internal photos to other chat groups.

We’ve described separately how to verify the recipient before the fundraising begins: how the foundation verifies a request from a military unit.

How can we report transparently without putting military personnel at risk?

The most common mistake is to assume that a secure report is less convincing. Donors check other things: whether the funds were used for their intended purpose, whether the aid reached its destination, and whether there is confirmation. None of these points requires coordinates or the name of the unit.

Structure of a transparent report:

1. The financial section is fully transparent: how much was raised, who was paid, and for what.
2. Documents—redacted. We publish the document with the unit number, full name, and signatures blacked out: the fact that the document exists is visible, but the identifying details are not.
3. Photos—taken before delivery or without any identifying location details: goods in the warehouse, in packaging, or during procurement.
4. Wording—generalized: unit type and field of activity instead of specific names and cities.
5. Timing—delayed. The criterion is not the number of hours, but the completion of the event.
6. Approval is mandatory. The unit has the final say regarding photos and text.

A complete list of what should be included in the report can be found in the article “What Should Be Included in a Foundation’s Post-Fundraising Report.” Please note one piece of advice from that article with the following modification: do not specify the location where the photos were taken in the public report.

Internal Archives vs. Public Reports

Distinguishing between these two types of records resolves most dilemmas. The foundation’s archive contains originals with metadata, complete records, and part numbers—for audits and inspections. A streamlined version goes into the public report: the need, the amount, and the result—just like on the fundraising page for a vehicle repair for a unit.

Is a soldier’s consent required to publish his photo?

The Civil Code states this explicitly: a photograph depicting a natural person may be publicly displayed, reproduced, and distributed only with that person’s consent (Article 308). Photographing a person is also permitted only with their consent, and consent is presumed only at public events (Article 307).

For the foundation, this is a simple procedure that should be documented in writing—even if only via a chat message:

• We ask before taking the photo, not after: Can we publish this photo, with or without the person’s face?
• We specify the scope of consent—one publication and one channel, not everything forever.
• We accept refusals without discussion.
• We do not publish photos of the wounded, even with consent: their condition may change, but the publication remains.
• Do not publish photos of the deceased or prisoners of war—this is the domain of families and official agencies.

For information on how the foundation handles donor data, see the article on the protection of donors’ personal data. The logic is the same: keep a minimum of data publicly accessible, and keep the rest in internal records.

A pre-publication checklist—and what to do if it’s already been published?

The same person who publishes the content is responsible for going through the checklist. The one item that’s usually missed is the background of the frame.

1. The metadata is removed; the original image is not used in the post.
2. The background must be free of signs, directional signs, house numbers, and distinctive silhouettes.
3. Serial numbers and markings on equipment are either absent or obscured.
4. Faces: either consent has been obtained, or the frame does not contain any faces.
5. The unit name is generalized; the unit number is not mentioned.
6. The quantity of items delivered is not linked to a specific unit.
7. Delivery dates and routes are not specified.
8. Future plans are not disclosed.
9. The post’s geotag is disabled.
10. Approval from the unit has been received.

If sensitive information has already been published

1. Delete the post entirely rather than editing the caption: the image remains in the cache via a direct link.
2. Check for reposts and screenshots—on your own channels, in donor chat groups, and in Stories that tag the foundation.
3. Ask those who shared it to take it down—briefly, without explaining the details: that draws attention.
4. Notify the department so they can assess the risk on their own.
5. Document the incident in the internal log: what was published, how long it was online, and who approved it.

And two things to do just once: turn off geotagging on staff phones and incorporate this checklist into the content workflow as a mandatory step. Most leaks aren’t due to malice but to a lack of understanding that the background of a frame is also information, so we make sure to emphasize this to volunteers during training.

This material is for informational purposes only and does not constitute legal advice. Legal provisions and departmental lists are subject to change—please verify the current versions on official resources (zakon.rada.gov.ua, mod.gov.ua). In cases of dispute, the decision to publish is made by the recipient organization, not the foundation.