How Facebook Outs Sex Workers

Facial-recognition-book perhaps or they correlated her time, IP, cookies and/or location (Skyhook (WiFi), GPS, etc.) from inadequate opsec. Infrasound pinging would be a bit much, but not completely crazy as yet another trangulation method among many.

If someone’s gonna maintain two ID’s they gotta use consistently perfect opsec or game over: a known-good VPN or jumpbox in a non-treaty country (paid in cash or bitcoin from a throwaway wallet), separate devices (burners with no real info, different carriers, purchased in cash, all location settings off, cameras removed, microphones disabled until needed, kept in the microwave when not in use), different language quirks in chat and hide their face in all photos on the sketchy ID. And no voice audio uploads or direct photo uploads without scrubbing image metadata.

There might be other possible uniquely-identifying information leaks usable by deep-learning against device activity granted to apps: mouse, keyboard, screen, app switching, gestures, etc.