In my setting, a handful of characters have to attend a daily event (such as classes). They do so anonymously, as attending this event could endanger their civilian life if the wrong people were to discover their identities.

Continuing with the example of classes, this event happens always at the same place, at the same time. On site, people are masked and use names different from their own. The location is adequately secured; the risk of intrusion is low. Thus, during the event, their identity is mostly safe.

However, following one attendee before or after said event could lead someone to this person's home, endangering their anonymity.

How could a group of people conceal their daily trip to a location with a predictable starting and ending time?

  • The technological level is roughly the same as our own (near future).
  • These people aren't criminal (though it could be a case where this question applies).
  • People interested in their identities would work alone or in a small group, no larger than the attendees.
  • People tracking the attendees can't do it openly, as it would ruin the value of the information.
  • Attendees live in a big city, and their method of transportation is up to the answerer (public or private transports).
  • Facilities for the event may include specifically designed installations (such as mazes, secret doors/access).
  • Event hosts have access to moderately-sized human resources to ensure anonymity.
  • 8
    $\begingroup$ I don't really see an issue with this question as such, but please note that basically anything they do could be circumvented or doesn't shield them perfectly. There is no perfect security. They might be able to eliminate known security issues, but they will never be defended against any possible attack. Yes, it's perfectly in line with what you see usually on this website, but if I were you, and I just want to point that out nicely, I would be a lot more specific with what you want to prevent exactly and what would be a tolerable risk $\endgroup$
    – Raditz_35
    Jan 27, 2019 at 19:58
  • 8
    $\begingroup$ "This event happens always at the same place, at the same time." This is extremely bad tradecraft. Your chacaters deserve to be unmasked. $\endgroup$
    – AlexP
    Jan 27, 2019 at 21:23
  • 2
    $\begingroup$ Would a video conference count? $\endgroup$ Jan 28, 2019 at 0:21
  • 8
    $\begingroup$ A security method must be designed against a specific threat. What's you main goal, protecting the identity of the attendees from each other, or to external people? You can (and should) try both, but often a very good method against one of these scenarios is going to be sub-optimal or worse against the other. $\endgroup$
    – Rekesoft
    Jan 28, 2019 at 9:15
  • 1
    $\begingroup$ @PyRulez: That opens the door to digitally following someone home. Not saying it can't count, but it doesn't particularly remove the problem, but rather shift it from a physical to a digital one. $\endgroup$
    – Flater
    Jan 28, 2019 at 10:06

13 Answers 13


Hide in plain sight.

Set up your class in a large office building with multiple businesses, all of which are legit, but all of which you control. Students have cover as employees. The businesses are large enough that it's reasonable not for everyone to know each other.

Each student is given an assigned time when they show up to "work". They go to their assigned business and make their way to an ordinary looking room that is secure and has a secret passage to a hidden corridor. Security controls both doors so it is impossible to open both doors at once, nor will they allow more than one person in a room at a time, not will they allow more than one person in any section of corridor at once.

In the corridor each has an individual assigned changing room where they stash their civilian clothes in a secure locker and change into their disguise. At another assigned time, security allows them out of the changing room through another door to another corridor to go to a waiting room where they wait as the group gathers. An elevator without indicators as to floor or direction then stops and carries the group to the class area before getting another one. Students are not allowed to tell each other what floor they got on, and they have no idea what floor they get off on (other than it's above or below theirs). The elevator also changes the order of the floors it picks up students at.

After class, process reverses. Students have an assigned time they have to wait in the lobby before going to the corridor and changing back. They have variable amounts of time to wait in the changing room. They are given a different time to report tomorrow. This means they may have to wait in the lobby for an elevator briefly one day, sit and cool their heels for a half hour or more the next.

The end results: aside from making it harder to follow them (since security surely knows who they are before they are disguised), they're not sure who the other students might be. Because you stagger both their arrival times, how long they have to wait in the changing room, and how long they have to wait in the lobby, you don't know if the person ahead of you walked in 30 seconds before or 30 minutes before, and you don't know how long they were cooling their heels in the changing room watching TV or whatnot, nor when they entered the building in civilian guise: after all, they might have come in after you but gone through the changing process faster so they were waiting at the elevator sooner.

You've essentially created 8 time variables: when they have to show up to work, when they're allowed into the changing room, how long they're in the changing room, and how long they have to wait in the lobby, and then the same in reverse. When they walk into the building in the morning, they have no idea if other students are walking in at the same time, entered earlier, or entering later, and by changing the time they have to show up, who arrives at the same time and who arrives earlier or later is always changing.

If you want to, you could also change, from time to time, what "business" they supposedly work for, so they're not getting off at the same floors. If you ensure that the legit portion of your businesses has flexible working hours, with perhaps individual departments working at different times, you further complicate recognition because there's always people arriving and departing.

Meanwhile, from the outside, all they see are people going in and out.


I should mention some other variables. Because you control their access between their "office", changing room, elevator lobby, and elevator, you can have people on the same floor staggered so they arrive at different times, not knowing if the elevator might have already picked up (or dropped off) people from the same floor. Again, one day there might just be one student taking an elevator to the class level from their work floor, another day ten, so they're never even sure how many people actually "work" on their own floor.

So, typical day for a student: they arrive at work the time they were given the day before, and go to the floor and office number they were assigned, which may change. After sitting in the office for a period of time they don't know in advance other than it might be anything from 5 minutes to an hour, they recieve a message telling them the secret door is open and allows them into the corridor, and what is their assigned changing room. In the changing room is a countdown timer showing them how long they have to change from their normal clothing, and they must be changed by the time the timer runs out, say 10 minutes. Once they are changed, they check in by pressing a button, which allows Security to verify they are in costume. Then the timer comes on again showing them how long they have to wait, which might be anything from 0 to, say, 30 minutes. They've got stuff in the changing room they can use to kill time, whether study, watch TV, whatever.

Once the timer runs out, they're allowed out of the room to the secret elevator lobby where they wait. A timer on the wall tells them how long until the elevator arrives. At this point, other students may or may not be arriving. At 0, they get in. The elevator goes up and down several times so they don't know for sure if they end up above or below their original floor. Door opens, they go to class.

End of class day: each student is informed what time they are to arrive tomorrow, as well as any changes in what office they are to report to. They are allowed into the elevator in different combinations than they were on arrival, again the elevator doing the floor-shuffle. They go to the changing room and again have a countdown timer to change back into civvies. They have to wait again some time between 0 and 30 minutes before they're allowed out. They go to their office and after again some random time, receive a signal that they are to leave the building (timed to coincide with a large group of people also leaving the building).

  • $\begingroup$ Great answer. I would mention specifically that there will be non-members/non-students working at the building too, so simply recognizing a friend at the building won't necessarily tell someone that they are also a member (maybe they just work there pushing paper for eight hours a day). $\endgroup$ Jan 28, 2019 at 13:54
  • 2
    $\begingroup$ Hide in plain sight So keep their eyes wide shut? ;) $\endgroup$
    – Machavity
    Jan 28, 2019 at 14:01
  • 2
    $\begingroup$ @RobertColumbia, that's why I mentioned reasonable not to know everyone. There will be people you recognize, which is fine, but also lots of people you won't. $\endgroup$ Jan 28, 2019 at 16:54
  • $\begingroup$ @KeithMorrison I came up with the floorless elevator about 5 minutes before checking my phone and seeing your answer the other day. As I'm going with a mix of answers, but yours include the main point, feels only fair to validate this one, despite the amount of excellent answers. (This one works best in my case) $\endgroup$
    – Nyakouai
    Jan 29, 2019 at 13:13

With this setup, someone determined to discover the identity of a participant is likely to succeed. There are too many places where a tracker can get a clue.

The tracker needs to know:

  1. That this meeting is something nefarious.
  2. When and where the class is. Varying the timing and location will help a lot with security. A daily gathering of people without an explanation is suspicious. All the more so if it's the same people each day. A million times more if they're all masked as they enter and leave!
  3. How to follow someone. This means the skill to keep track of them without being noticed.

Here are some ways to improve security:

Find a way so that the public never sees the attendee masked but the other attendees never see each other unmasked. I would place the meeting in a private room in a very large public place where the group's leaders control security for the entire building.

Everyone goes down a hallway (there are multiple hallways and very few people are in any particular one at any given time) with several doors to bathrooms along it. Each bathroom is single use and entirely private. Because the facility is mostly used for classes or activities involving sports, dance, cooking, painting, or something else where it makes sense to change, transitioning hallways via bathrooms/changing rooms would be reasonable.

A regular person enters the bathroom/private room, uses the facilities, and exits through the back door. The back door goes to another hallway which takes this person to their room. Since everyone must go through a private room to get to the hall that goes to their room, entering a private room doesn't single one out for more scrutiny.

An attendee enters the private room, changes her/his clothes, and puts on a mask, then uses the backdoor to eventually get to the room. It is possible for a regular person to see an attendee in a mask and wonder what's up, but they'll never see what they looked like when entering the bathroom. Changing clothes is an important part of this.

The bathroom has a special internally-controlled lock. It locks both doors at once when someone enters. When that person wants to leave, they can do so using a normal door handle that stays locked from the outside but opens from the inside. A random period of time later (1-3 minutes), both doors unlock. Someone waiting outside the door where the last person entered has no idea that the "occupied" room is actually vacant.

As the attendees make their way to their room, they have to go through a few more doors. This alerts them to being followed. A security guard could turn away anyone not in a mask ("sorry ma'am, I think you want that door over there") or only admit people with the right passcode or jewelry or whatever you want to use.

To leave the building, you must go through a similar process. You go down a set of hallways and eventually reach one with bathrooms. Enter the bathroom, change, and exit through the other door. The back doors of the bathrooms go to different hallways so you can't follow someone that way. If you try to follow using the same bathroom, you won't get there in time.

Get a cover. Maybe a tracker can never discover which room someone goes to. Maybe they'll never know which group of 30 people arriving and leaving the same time every day are the ones doing something "wrong" because there are 300 other people doing the exact same thing. But each individual doesn't want to arouse suspicious at home or work or among people they know.

Pretending that it's classes for something allowed in the society would keep a lot of potential trackers from noticing. Have all the equipment and materials for the fake class. Teach a bit each day so the attendees can prove they are learning something legitimate. Assign homework.

Change the code regularly. Worst case scenario is that someone figures out how to infiltrate the meeting. This is not hard since everyone's masked. They just need to know how to get there. Each meeting ends with the new codes for tomorrow. Perhaps combine these with a special (but disguised) piece of jewelry. Someone might steal the ring, or overhear the code, but surely not both.

  • 5
    $\begingroup$ I was thinking similar to this, but with small elevators (without indicators) that could stop at unmarked floors. Seems to me it would be exceedingly odd for single person bathrooms in a large public space to have multiple entrances/exits, and you would expect people to usually go in and come out the same door so if you see someone not come back out that would attract suspicion... but you don't expect people to come back out of the same set of elevator doors.. $\endgroup$
    – Mr.Mindor
    Jan 28, 2019 at 16:33
  • 1
    $\begingroup$ @Mr.Mindor That would also work. I thought of bathrooms because I wanted a place where people could change clothes or at least put on a mask and no one could see. Maybe think of them as preparation rooms/locker rooms/changing rooms with or without bathroom appliances. Maybe the building is mostly used for classes or activities involving sports, dance, cooking, painting, or something else where it makes sense to change. $\endgroup$
    – Cyn
    Jan 28, 2019 at 16:39
  • $\begingroup$ @Mr.Mindor Your comment was really good and got me to think about how else to arrange it, so I've edited my answer to reflect this new information. Thanks. $\endgroup$
    – Cyn
    Jan 28, 2019 at 16:44


Specifically because of the nature of the masquerade ball.

This could be run as a regular public ticketed event with a quiet back room used for whatever nefarious purposes you have in mind. It's reasonable to be a regular attendee at such an event. It's reasonable to attend in elaborate or formal costume and look remarkably similar to any other attendee of the event, especially for men and their traditionally conservative formal wear.

Importantly it's also reasonable to openly turn up to such an event, then publicly put on a mask and become an anonymous member of the crowd.

  • 4
    $\begingroup$ Similarly, Sci-Fi/Fantasy conventions are a good venue, with many people dressed up as Iron Man or C-3PO or whatever. When one has bumped into one's tenth masked Batman cosplayer of the night, it is easy and tempting to just zone them out. The main issue with this is that SFF conventions are generally held only once a year, or at most every few months. $\endgroup$ Jan 28, 2019 at 14:24
  • 2
    $\begingroup$ This is close enough to the answer I was going to give, since it involves public access to a place where it's not inappropriate to be masked. Other venues would be a fencing club or a poker tournament. $\endgroup$ Jan 28, 2019 at 17:41
  • 1
    $\begingroup$ @Robert Would people keep dressing up as Iron Man or similar, if the convention convenes on a daily basis? ;-) $\endgroup$
    – M.Herzkamp
    Jan 29, 2019 at 12:15

OK, I am assuming that it is not acceptable for the 'hunters' to abduct the participants during their journey, otherwise it is almost impossible for the attendees to remain anonymous.

Arriving at the venue seems reasonably simple - assuming the city has a lot of suitable routes - maybe a place like London with underground rail, buses, trains, taxis, bike paths rather than a small town or one poor in public transport. The attendees leave home wearing a disguise - false beards, dark-glasses, wigs, prosthetic noses etc - sufficient to cloak their normal identity, but not so outlandish that they will be noticed as 'odd'. Now they make a series of random journeys - preferably on foot or bicycle and public transport etc - anything that doesn't have an identifiable registration number that could be used to identify them. After a number of such journeys, they finish with a trip to the venue. The hunters can see them arrive each day, but can't identify them, and as they always arrive by a different route they can't use that information to trace their path back to home.

Getting home is trickier. The hunters can see them leave so could follow them all the way home unless they can be shaken off. Some tactics that might help would be:

  • Anonymously hire a number of people to leave simultaneously dressed in identical disguises.
  • All leave at once in a large vehicle that can hold them all (like a bus) - travel to a random destination and then disperse (the followers can chase their vehicle, but unless they also have a bus only a limited number of hunters can get to the dispersal zone so they will be easier to shake)
  • Choose a venue with lots of departure points and lots of foot traffic (i.e. hold the meeting in a busy transport hub building) so it is easier to mingle with others.
  • Hire third parties to make it hard for the hunters to follow - blocking roads, accusing hunters of being pick-pockets, driving away in blacked-out vans that may (or may not) have a participant inside.
  • Spy-craft - If the hunters have similar numbers as the attendees then there would only be one or two trying to follow each home, so switching transport, ducking through back doors, getting on or off subway trains at the last second, switching disguises in public bathrooms etc might all help.

Of course, in the long run, if the attendees turn up every day - sooner or later someone will get identified. A disaster for them, but OK for other attendees as long as they are anonymous to each other.

  • $\begingroup$ London's public transport system tracks everyone who uses it $\endgroup$
    – Separatrix
    Jan 28, 2019 at 13:15
  • $\begingroup$ Not by name I doubt. And how would the hunters access that data? $\endgroup$
    – Penguino
    Jan 28, 2019 at 20:10
  • $\begingroup$ By name if it's a registered card, their CCTV can also visually track a person though the person though the system. If you want to be untracked you have to walk or cycle and stay away from any public transport. $\endgroup$
    – Separatrix
    Jan 28, 2019 at 21:36
  • 1
    $\begingroup$ I recollect that last time I was in London I bought an unregistered card. Cannot rem,ember if I used cash or a credit-card, but if the former I would be effectively unidentifiable from my card. And as in my suggestion, the traveler is already disguised when (or immediately after) they leave home, CCTV will show someone getting on and off the train, but won't identify them. And in addition, unless the hunters have, or can steal access to the CCTV database, the footage won't be of use to them in detecting where the traveler got on, got off, or where they went next. $\endgroup$
    – Penguino
    Jan 29, 2019 at 2:44
  • $\begingroup$ It depends who's following them, if it's legal/official they'll have no trouble. All the cards have a number, that number is linked on their database to a full history on the card. If you have physical access to the card then you can use one of the more advanced ticket machines to see the history. $\endgroup$
    – Separatrix
    Jan 29, 2019 at 7:49

Multiple entry points, private transport, and body-doubles.

Your attendees go to a location with a different event advertised - either "private members only", somewhere with obscured faces (kendo / fencing / airsoft / paintball), or with some segregated classes for different skill levels (so that they can be seen at the start/end, and have an excuse to be away from their tail for the rest of it)

They then enter a changing room, and leave through a secret door. Their body-double enters through the secret door, and puts on a suitable disguise. The secret door leads to private transport where the passenger will not be observed travelling to the real location. Attendees will arrive from multiple entry points to further obscure who is part of the group - you would need to observe every group/activity taking place at that specific time in the city.

The tail will be able to observe the body-double - either from a distance such that they cannot notice the difference without being really obvious/suspicious (such as getting out a pair of binoculars or a camera) and removed by security, or with suitable obstructions in place (both wearing full-face masks, such as for paintball)

Bonus points if the "decoy event" is something that happens on other days at a different time too - so that your attendees can actually attend and practice that skill. If you are careful, you can also drag your tail into taking part in the decoy event, and convince them that they were actively keeping track of the right person all along


The main issue I see here is that this meeting is DAILY. I am sorry but almost no amount of security in the world can help with that unless you have magic.

If people are coming to the same place each day, it becomes routine. And routine is the enemy of security. Routine makes it easier to track people because you know where they will be, and it tends to lull them into a false sense of security, because if nothing has happened on the first 15 trips, they won't be looking for it on trip 16.

All of the cautions provided by other posters tend to dissolve with a daily trip. Because people aren't careful when they are on a routine.

Here's how you make it a non-issue.

They have a REASON to be in the building/area

Doctor's office, shopping mall, place of work, school, busy terminal, whatever it is, that entrance is set atop somewhere that it's easy to have a reason to be in the area. Because being able to pick out who your meeters are, that's a problem.

There's more than one way in and out.

Only one entrance/exit makes for problems. Have multiple ones, plus a way to secure each.

Define the tech and the city exactly so you know what the specific problems to solve might be. You say large city and you're non-specific, but some cities are harder than others. London for example, tracks people in a way that L.A. does not. And culturally L.A. while it does have public transport and is a large city, everyone seems to drive. Every city has its quirks and foibles. What helps you blend in one place might not work elsewhere. In some places, public transport means you will be tracked more fully. In others, automated systems take pictures of license plates.

The event starts at say, 9, but that doesn't mean that they all have to arrive at that time. Stagger it. Assign earlier times to different people. Make it a RANGE, with an official start and end time.

OR Use the traffic patterns This is one of the reasons why it's good to get specific about your city. Because you can use high-traffic times as camo to get in and out. And you can use low traffic times to make a tail obvious.

Penguino had some great tips and tricks as far as interference goes.


Watch Stanley Kubrick's last movie "Eyes Wide Shut". The lead character is allowed to enter the domain of a secret society, but is eventually ensnared because he does not know the elaborate rules, signs and countersigns, even though he too is disguised. (when looking up the clips, remember many are NSFW).


Multiple layers of security and secrecy, as well as tightly compartmentalizing things are the best ways to preserve secrecy.

  • 1
    $\begingroup$ While what you mentioned is all fine and right, i think it missed the core point of the question about how to secure anonymity getting to it and back from it without arising suspicion. What happens during the meeting is off-question, i think. $\endgroup$ Jan 28, 2019 at 13:57

Nightclub. Nightclubs are loud, crowded, dark, open almost every night and have a built in cover story for why the characters are constantly going there. The meeting facility can be below the nightclub proper and the attendees can be timed so they don't go in the several concealed entrances at the same time in the same place. Disguises can be hung by the door.

  • 1
    $\begingroup$ Nice idea for criminal/nefarious meetings. Plus nightclubs have a legitimate reason to have guards/bouncers. $\endgroup$
    – Nyakouai
    Jan 29, 2019 at 12:55

Individuals at this event are indistinguishable from each other.

kkk meeting source

Disguises are not merely to conceal the identity of the wearer. They are to make every individual in the facility identical to every other. Gender, build, age and everything else is concealed. Here depicted are people in Ku Klux Klan robes; burkhas might be another option, or hazmat suits.

The ideal solution to pollution is dilution. If there were many persons attending this event (in their regalia) who were of no interest to potential trackers that would be ideal for the members who are of interest. A tracker would have to pick a person at random and follow him/her home. There would be no way to know the person you are following is not the same person you followed last time until you got to their home. You would waste a lot of time.

  • 1
    $\begingroup$ This depends on what you want to know about them, the KKK were never really anonymous. What allowed them to operate in "secrecy" was that the people in authority who should otherwise be investigating them, were also members. $\endgroup$
    – Separatrix
    Jan 28, 2019 at 9:16
  • $\begingroup$ Bed sheets and a pair of scissors. +1 $\endgroup$
    – Mazura
    Jan 28, 2019 at 16:38

I think you'd have to have far more attendees than are 'active' members. Hold a regular innocent event, say a furries convention, where the vast majority of attendees are not part of the meeting.

Each member of the real meeting will know the 'costumes' of the other attendees but not their identities. There will be secret coded 'ack' and 'nack' phrases to ensure proper identification. First order of business is to agree next meetings costumes etc.

The trackers will know the identities of some or all of the attendees, but not exactly which members are part of the secret society.

There is no way to hide ones identity in the modern world, there are only ways to protect private conversation.

  • $\begingroup$ Hosting a furry convention every week day would be a) extremely noticeable b) totally not innocent. $\endgroup$
    – Nyakouai
    Jan 29, 2019 at 12:58
  • $\begingroup$ Masons then? :) $\endgroup$
    – Richard
    Jan 29, 2019 at 13:52

In my setting, a handful of characters have to attend a daily event (such as classes).

If these are classes, do they need to attend in person? Or could that be in the form of a remote videoconference?

The tech is there today (for some time already) and anonymity is simple to achieve that way?

if you want to go a bit more high tech you could have holograms attending.


Separate the entry and exit of the location and keep the exit hidden.

The entry might be a secured door close to a public place. Before an attendee puts on his mask or approaches the door he is indistinguishable from a normal person.

The door however leads to a long corridor/tunnel (say 1 mile/kilometer) which ends at the event location.

The exit could be connected to the sewer to help keep it secret an have attendees reenter public space at multiple places.

This way attendees can't be followed as their location and identity is unavailable as soon as you are able you know he/she is an attendee.


Steal someone else's identity on the way home.

After class, the attendees hide in a random busy single-use bathroom somewhere in the city. After a random amount of time, when someone comes into the bathroom, they knock them out and steal their identity. They then put a sorry note in the person's pocket, and hide them. They also hide a secret camera. They can then use the identity to get home.

A tracker could tell which bathroom they hid in, but not whose identity they stole. They would have to follow everyone who uses that bathroom home, which would be hugely impractical. They also can not search the bathroom, because the attendees would use the camera to catch them.

Eventually the person in the bathroom will wake up, but by then the attende will already be home free.

  • 3
    $\begingroup$ I'm not entirely sure knocking a person per attendee every day is exactly a sustainable strategy. $\endgroup$
    – Nyakouai
    Jan 28, 2019 at 14:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .