For five months, images of Hong Kong’s leaderless protests have flooded out of the city and into the rest of the world. With police now treating every protest as an illegal assembly, anyone found in the streets can be found guilty under colonial-era public assembly laws. It’s impossible to arrest the entire crowd, but if you’re identified on camera, you can be singled out for punishment. More than 2,000 people have been arrested so far, and a parallel extrajudicial crackdown has targeted countless others with violence, doxxing, and online harassment. It’s led to a new struggle over how and when protesters can be identified - and what they can do to stay anonymous.

That struggle over anonymity extends to some of the movement’s most famous figures. On August 11th, a young woman was shot in the face with a “beanbag” round, breaking through her goggles and blinding her. To protect both her body and anonymity she wore a gas mask, black balaclava, and helmet with “do not aim at protester’s heads” written on it. (Her goggles were left on the street with the bloodied projectile still lodged in them.) After releasing a video thanking her supporters and expressing a desire to remain anonymous, police began searching medical records to identify her until her lawyers successfully got an injunction protecting her privacy.

As she fought to stay anonymous, her notoriety also gave her power. Hongkongers learned almost instantly about her injury because it was broadcast on live streams, one of the subtle but important differences in how technology has changed since the 2014 Umbrella Movement. Whereas only Sony phones could live stream in 2014, today, we have a GitHub page compiling up to nine different live streams and even live stream translations of those live streams. Her injury fueled the #EyeForHongKong hashtag, and an “eye for an eye” slogan, which was shouted the following weekend at the city’s airport.

Facing up to 10-year jail sentences if caught, frontline protesters conceal themselves with umbrellas, masks, balaclavas, and protective headgear, so that not even friends or family could identify them from a photo. Sometimes, protestors go after the cameras directly to protect their identities: more than 900 CCTV cameras have been destroyed since July. When protesters stormed the Legislative Council building on July 1st, the first move was to destroy its cameras, followed by a rush to the security room to destroy the system where the footage was stored.

After masks, umbrellas are the most common tool used to hide from cameras, usually coming out after police raise their warning flags. (Not leaving after the first warning flag goes up carries up to a one-year sentence for unlawful assembly if caught on the scene or identified later.) It is common to see three to four people holding umbrellas, often one in each hand, for every person spray-painting revolutionary slogans or preparing a Molotov cocktail on the street.

The recent mask ban has raised the stakes even further. Protesters find safety in numbers, so police try to thin out crowds with gas and rubber bullets before charging to grab as many people as they can. Most of the people detained are held for 48 hours before being released on bond. Before the ban, a large portion of the people arrested would be released without charges, depending on whether police could spot them in pictures or video. But with masks worn by almost every participant, most protestors can now be charged on the spot, leading to record-breaking arrest numbers in recent protests.

There are plenty of other ways for government-friendly forces to strike back. The organizer of the two massive marches in June has been attacked twice now, most recently by a group that bludgeoned him with hammers. An activist I know took their family into hiding for several weeks this summer after being followed in town, receiving death threats, and having our own district counselor share conspiracy theories about him on Facebook. Two acquaintances have been doxxed on a website dedicated to outing the personal details of activists, journalists, politicians, and anyone else associated with Hong Kong’s “Revolution of Our Time.” A police officer knocked on one of their doors to make clear he knew where they lived. Their child’s face appeared in a video posted by Chinese state media, which has also encouraged doxxing and solicited contributions from the public. All three say there were personal details released that could only have come from the Hong Kong government.

Even protestors who make it home without being arrested aren’t necessarily safe. Hundreds of thousands of Hongkongers will face a future of unknown retaliation for participating in the movement, supporting it online, or refusing to condemn it. The risks range from personal and family safety to job insecurity to fear of future arrest. The Hong Kong Police Force has shown an unnerving dedication to the task of arresting people on the streets, finding evidence for those already arrested, and piecing together evidence on people who thought they got home safely.

The same fear of identification extends to the digital space. Protesters have begun locking their accounts or adopting pseudonyms after years of using their real names. Government workers, teachers, or employees at a pro-government company could easily be fired if the “wrong” person finds evidence of participation or pro-protest posts. A string of comments in a private Facebook group led to Cathay Pacific employees getting fired. A lawyer in training nearly had his legal career derailed when his employer reported an anti-police post on Facebook to the High Court.

Faced with that harassment, the sheer volume of digital records can be overwhelming. You can take down a camera but not the dozens of live streams keeping the protests in the public eye. Masks can block facial recognition, but they can’t erase years of social media posting and cross-linked accounts. The people who built these networks didn’t think about how they might work in countries where public assembly can be criminalized or a connected online identity can be grounds for arrest. Now, some protesters are realizing too late that their digital footprint is hard to erase.