Somehow that very obvious attack vector hadn’t occurred to me…location specific QR codes that redirect you through a site that captures a browser fingerprint before redirecting to a “legit” looking site. From there super easy to keep tabs on browsing behavior of anyone who was at the protest.