The Badge Archive

Metadata – Cards

Fulfills Step 3 of GSUSA Cadette Cybersecurity Safeguards badge requirements.

Info Needed for badge requirements: Metadata is information about a file, such as when a photo was taken, where it was taken, or the type of camera used. It’s like a digital “tag” that describes the file. It makes it easier to organize and find files or helps photographers protect their work with copyright information. Hackers can use metadata, like the time, location, or device information from files and photos, to harm users. For example, metadata in a photo might reveal where it was taken, allowing hackers to track your location. They can also use this information to figure out what device you’re using and look for ways to attack it. How to Protect Metadata? Turn off Location Services on your phone to avoid sharing where photos were taken. Remove personal information from file properties before sharing files. Be mindful of what files you share and who you share them with.

Items Needed

  • Photo Cards: Create a set of photo cards with metadata printed on the back (See examples below)
  • Clue Cards: Create cards with questions like “What was the location?” or “What device was used?” (See examples below)

Instructions

Metadata Detective Challenge Instructions

Step 1: Form Groups

  • Divide scouts into groups of 2–4. Each group receives one mock photo card with printed mock metadata.
  • Groups take turns drawing a Clue Card. The group must analyze the metadata to answer the question on their Clue Card. The leader confirms if the answer is correct.
  • (Optional) Award points for each correct answer and play another round by each group drawing an additional Clue Card. Play as many rounds as you have clue cards.

Variants

Time It: Add a timer where once a Clue Card is drawn they only have 30 seconds to come up with an answer.

Relay Race: Divide scouts into teams and have them line up. The photo cards stay with the team for reference but cannot be brought across the room. The first scout in each line (the line leader) runs to the opposite side of the room to draw a Clue Card. They must read the question and decide whether they can answer it from memory. If they remember the correct answer, they can provide it immediately to the leader or judge. If they need to check the photo metadata, they must run back across the room to consult with their team. Once they have the answer, they return to the Clue Card side to provide the correct answer. They tag the next person on their team who then runs to answer a new Clue Card. Continue until all team members have answered a Clue Card. First team to finish wins and can cheer the other teams on until they have also finished.

Mock Metadata

It does not matter what photo is used, just make sure mock meta data is on the back of each photo you chose, like these examples:

1. A picture of a dog playing in the park

  • Date and Time Taken: April 6, 2025, 10:15 AM.
  • Photographer: Jamie Walker.
  • Device: iPhone 13, Service Provider: Verizon.
  • Location: Willow Creek Park, 456 Parkview Lane, Spring, TX.
  • Sender Name: Jamie Walker
  • Recipient Name: Taylor Adams
  • Stamp (Time Sent): April 6, 2025, 10:20 AM
  • Subject Line: “Fun Day in the Park”

2. A picture of a birthday party with balloons

  • Date and Time Taken: March 25, 2025, 4:45 PM.
  • Photographer: Taylor Adams.
  • Device: Google Pixel 6, Service Provider: T-Mobile.
  • Location: 123 Maple Street, Austin, TX.
  • Sender Name: Taylor Adams
  • Recipient Name: Riley Johnson
  • Stamp (Time Sent): March 25, 2025, 4:50 PM
  • Subject Line: “Birthday Celebration Highlights”

3. A picture of a beach sunset

  • Date and Time Taken: July 12, 2025, 7:38 PM.
  • Photographer: Riley Johnson.
  • Device: Samsung Galaxy S22, Service Provider: AT&T.
  • Location: Seaside Beach, 567 Ocean Avenue, Miami, FL.
  • Sender Name: Riley Johnson
  • Recipient Name: Morgan Lee
  • Stamp (Time Sent): July 12, 2025, 7:45 PM
  • Subject Line: “Beach Sunset Views”

4. A picture of a soccer game in action

  • Date and Time Taken: February 18, 2025, 1:20 PM.
  • Photographer: Morgan Lee.
  • Device: OnePlus 10, Service Provider: Sprint.
  • Location: Greenwood Soccer Field, 890 Stadium Drive, Houston, TX.
  • Sender Name: Morgan Lee
  • Recipient Name: Avery Brown
  • Stamp (Time Sent): February 18, 2025, 1:30 PM
  • Subject Line: “Soccer Game Thrills”

5. A picture of a science project display

  • Date and Time Taken: May 9, 2025, 3:00 PM.
  • Photographer: Avery Brown.
  • Device: iPhone SE, Service Provider: AT&T.
  • Location: Central Middle School, 240 Schoolhouse Road, Dallas, TX.
  • Sender Name: Avery Brown
  • Recipient Name: Casey Smith
  • Stamp (Time Sent): May 9, 2025, 3:10 PM
  • Subject Line: “Amazing Science Fair!”

6. A picture of a carnival or fair

  • Date and Time Taken: October 15, 2025, 6:45 PM.
  • Photographer: Casey Smith.
  • Device: Samsung Galaxy Z Flip, Service Provider: Verizon.
  • Location: Sunnydale Fairgrounds, 789 Festival Way, Austin, TX.
  • Sender Name: Casey Smith
  • Recipient Name: Jamie Walker
  • Stamp (Time Sent): October 15, 2025, 6:55 PM
  • Subject Line: “Carnival Fun Memories”

Sample Clue Cards

Clue Cards for Photo Metadata:

  1. Where was the photo taken?
  2. What device took the photo?
  3. When was the photo taken?
  4. Who took the photo?
  5. Does the photo’s time show a routine?
  6. Is the location in the photo somewhere private or public?
  7. What type of camera or phone was used?
  8. Does the metadata suggest a specific event or occasion?
  9. Does the service provider reveal anything about the sender?
  10. Could this metadata help someone guess the sender’s identity?
  11. Who sent the envelope?
  12. Who received the envelope?
  13. What time was the message sent?
  14. What is written on the envelope’s subject line?
  15. Can the return address tell where the sender lives?
  16. Is the delivery time part of a pattern?
  17. Does the sender name or address reveal anything personal?
  18. What might the subject line reveal about the message?
  19. Is the recipient’s name important for tracking connections?
  20. Could a hacker use this metadata to target the sender or recipient?

Answers for Leaders (Using 6 Sample Examples)

  1. Where was the photo taken?
    • The location is included in the metadata:
      • Dog in the park: Willow Creek Park, Spring, TX.
      • Birthday party: 123 Maple Street, Austin, TX.
      • Beach sunset: Seaside Beach, Miami, FL.
      • Soccer game: Greenwood Soccer Field, Houston, TX.
      • Science project: Central Middle School, Dallas, TX.
      • Carnival: Sunnydale Fairgrounds, Austin, TX.
  1. What device took the photo?
    • The specific device is included in the metadata:
      • iPhone 13 (Dog photo).
      • Google Pixel 6 (Birthday party).
      • Samsung Galaxy S22 (Beach sunset).
      • OnePlus 10 (Soccer game).
      • iPhone SE (Science project).
      • Samsung Galaxy Z Flip (Carnival).
  1. When was the photo taken?
    • The metadata provides the date and time:
      • Dog in the park: April 6, 2025, 10:15 AM.
      • Birthday party: March 25, 2025, 4:45 PM.
      • Beach sunset: July 12, 2025, 7:38 PM.
      • Soccer game: February 18, 2025, 1:20 PM.
      • Science project: May 9, 2025, 3:00 PM.
      • Carnival: October 15, 2025, 6:45 PM.
  1. Who took the photo?
    • The metadata lists the photographer:
      • Jamie Walker (Dog in the park).
      • Taylor Adams (Birthday party).
      • Riley Johnson (Beach sunset).
      • Morgan Lee (Soccer game).
      • Avery Brown (Science project).
      • Casey Smith (Carnival).
  1. Does the photo’s time show a routine?
    • Scouts might conclude if the time reflects part of a daily schedule:
      • Morning walk in the park (Dog photo).
      • Afternoon soccer game (Soccer photo).
      • Evening sunset at the beach (Beach photo).
  1. Is the location in the photo somewhere private or public?
    • The metadata specifies this:
      • Public locations: Park, soccer field, beach, carnival.
      • Potentially private locations: Birthday party at a home, science project at a school.
  1. What type of camera or phone was used?
    • Specific devices are listed: iPhones, Pixels, Galaxy, and OnePlus phones. Scouts should observe that device types could hint at the sender’s technology or habits.
  1. Does the metadata suggest a specific event or occasion?
    • Yes, the metadata can hint at special events:
      • Birthday party, sunset viewing, soccer game, science fair, carnival.
  1. Does the service provider reveal anything about the sender?
    • The service provider in metadata (e.g., Verizon, T-Mobile, AT&T) might suggest the sender’s network preferences or availability in specific regions.
  1. Could this metadata help someone guess the sender’s identity?
  • Scouts should conclude that combining metadata (name, location, device type, time, etc.) makes it easier to identify the sender. For example, knowing someone’s name, where they live, and when the photo was taken could help track their movements or personal preferences.

11. Who sent the envelope?

  • The sender is listed in the metadata. For example:
    • Jamie Walker for the “Dog in the park” photo.
    • Taylor Adams for the “Birthday party” photo.
    • Riley Johnson for the “Beach sunset” photo.
    • Morgan Lee for the “Soccer game” photo.
    • Avery Brown for the “Science project” photo.
    • Casey Smith for the “Carnival” photo.

12. Who received the envelope?

  • The recipient is written on the envelope. For example:
    • Taylor Adams for the “Dog in the park” photo.
    • Riley Johnson for the “Birthday party” photo.
    • Morgan Lee for the “Beach sunset” photo.
    • Avery Brown for the “Soccer game” photo.
    • Casey Smith for the “Science project” photo.
    • Jamie Walker for the “Carnival” photo.

13. What time was the message sent?

  • The time is included on the envelope’s stamp. For example:
    • “Dog in the park” was sent at 10:20 AM on April 6, 2025.
    • “Birthday party” was sent at 4:50 PM on March 25, 2025.
    • “Beach sunset” was sent at 7:45 PM on July 12, 2025.
    • “Soccer game” was sent at 1:30 PM on February 18, 2025.
    • “Science project” was sent at 3:10 PM on May 9, 2025.
    • “Carnival” was sent at 6:55 PM on October 15, 2025.

14. What is written on the envelope’s subject line?

  • The subject line reveals the content of the photo/message. For example:
    • “Fun Day in the Park” for the dog photo.
    • “Birthday Celebration Highlights” for the party photo.
    • “Beach Sunset Views” for the sunset photo.
    • “Soccer Game Thrills” for the game photo.
    • “Amazing Science Fair!” for the science project photo.
    • “Carnival Fun Memories” for the carnival photo.

15. Can the return address tell where the sender lives?

  • Yes, the return address could reveal the sender’s location. For example:
    • “Willow Creek Park, Spring, TX” suggests Jamie Walker’s general area.
    • “123 Maple Street, Austin, TX” suggests Taylor Adams’ home or location.

16. Is the delivery time part of a pattern?

  • Scouts should notice whether the time aligns with routines or events. For example:
    • Morning time for the dog photo suggests a routine like a morning walk.
    • Evening time for the sunset photo aligns with the time the sun sets.

17. Does the sender name or address reveal anything personal?

  • Yes, names and return addresses provide information about identity and location.
    • For example, “Jamie Walker” and “Willow Creek Park” reveal the sender’s first and last name and where they were when the photo was taken.

18. What might the subject line reveal about the message?

  • The subject line gives a clear idea of the photo’s content.
    • For example, “Fun Day in the Park” signals that the photo relates to the park outing.

19. Is the recipient’s name important for tracking connections?

  • Yes, the recipient’s name can show connections between senders and recipients.
    • For example, Casey Smith’s photo sent to Jamie Walker suggests a relationship or shared activity.

20. Could a hacker use this metadata to target the sender or recipient?

  • Yes, a hacker could combine this metadata (names, locations, devices, times) to build a profile of the sender or recipient.
    • For example, knowing the sender’s device (Samsung Galaxy Z Flip) and location (Sunnydale Fairgrounds) could allow a hacker to exploit specific vulnerabilities.

Tia Kennard