Now that I’m doing a certain amount of academic writing, I’ve had to start using a citations manager. Manually adding 100+ footnotes per document, correctly formatted to the dot in the relatively obscure citation style (OSCOLA) which my university uses, is genuinely not possible.

(Well, I mean you could do it manually, but you’d go mad, you’d double the amount of time you spend on the piece, and you’d lose your writing flow 100+ times in the process.)

I use Zotero, which is a nifty open-source utility which doubles as a repository for all your research. Browser extensions mean you can just chuck what you need in there when you’re doing the research, and then when you’re writing, word processor integrations mean you can push a button and make your ~properly formatted~ footnotes appear. Magic.

But me being me, the question of what are the privacy standards on Zotero? popped into my head, on one of those nights when you randomly find yourself wide awake at 3 AM asking the universe questions such as what is the point of my feeble existence on this earth or what are the privacy standards on Zotero or should I ask that guy out and that kind of thing.

Because if you haven’t been living under a rock, you know that academic research is a target of some rather nasty things right now. As are the researchers who do that research, and I of course am entering that territory.

That raises questions about citation managers which can be critical to your persec and opsec, such as:

• Is the cloud service end-to-end encrypted?
• Is my account publicly visible?
• Is my account being fed into an LLM?
• Are they selling my data?
• Is there adtech?
• Do they get subpoenas from Bad People?
• Do they respond to those subpoenas?

It turns out other people are thinking about these things too.

That link is a good place to start if you find yourself up at 3 AM too, regardless of the citations manager you use.

Personally I’m going to keep using Zotero – it works, I love it! – but I’ve set my account to private. Check your Settings.

I’m also using my own encrypted cloud storage, not theirs, even though they tell you not to do that. Imagine me not listening to people telling me what not to do.

If you’re using a citations manager and your work might also be considered, erm, controversial, take some time to cover these questions too.

2025 opsec sucks, but it is what it is.