2,989 photographs name the individual camera that took them

Published 2026-09-02 · OSIC infrastructure analysis

Most camera metadata describes a type of thing: a Canon, a 24-megapixel sensor, an exposure of a sixtieth of a second. One field does not. The body serial number identifies one physical camera, the specific object, for the whole of its working life.

3,933 images published across 146 of these companies still carry the serial number of the camera or lens that made them.

Why one field is different from all the others

A serial number does not tell you anything about the photograph. It tells you that this photograph and that photograph came out of the same box. On one company's website that is a piece of trivia. Across 146 companies it is something else: a way of joining pictures on unrelated corporate sites into a single trail, and then reading off which organisations one photographer worked for, and in what order, and when.

Nobody published that. The companies each published a picture. The trail only exists in the hands of somebody who has collected all of them and looked across the set — which is to say, it is created by the aggregation and not by any of the sources.

That is a specific and well-understood hazard, and it is the reason this article contains no serial numbers.

What OSIC stores, and what it refuses to

The number above is a count of true values in a boolean column. OSIC records that a serial number was present. It does not record what the serial number was.

It also does not record a hash of it, and that exclusion is deliberate rather than an oversight. Hashing feels like a compromise — the value is gone, the linkage survives — but the linkage is the risk. A stable hash of a stable identifier is a stable identifier. It would let exactly the cross-company trail described above be reconstructed while allowing us to say we had not kept the serial numbers, which would be true and beside the point.

The rule is enforced in three places rather than one, because a rule that lives only in a policy document is a rule that survives until the first person in a hurry:

the metadata policy refuses to promote the field as a value;
the write layer accepts only a named list of columns, and no column for it exists;
the database's own constraints reject anything name-shaped in the columns that do exist.

The same is true of the photographer's name, and of the coordinates

Serial numbers are one of three fields in an image file that describe a person rather than a picture. The other two are the creator name — which turns out to be filled in with a real name almost every time it is filled in at all — and the GPS coordinates, which survive on phones and drones and almost nowhere else.

All three are counted here and none is stored. What that buys is the ability to publish the scale of the thing — 3,933 images, 146 companies — without adding to it.

How this was measured

The first 64 KB of each image is requested, parsed for its metadata block, and discarded. The serial-number fields checked are the body and lens serial tags in the EXIF specification, in both JPEG and WEBP containers.

3,933 images, not 3,933 cameras. Since the values are not retained, the number of distinct devices behind them is unknown — and unknowable from what we store, which is the point. One prolific photographer could account for a large share.
It covers the companies we could crawl, which excludes sites whose CDNs refuse our robots.txt request. See coverage.
Only 5,618 images of 239,632 carry any camera metadata at all. Against that denominator, seven in ten of the images that name a camera also name the individual camera.

Collected 1–4 September 2026, over a completed first pass.