What is Open Source Intelligence?

Most of us have probably done this before. Using the internet to help us make decisions. Whether it be finding a companies website to apply for a role, reading reviews to buy a product or seeing whether a dramatic picture is real.

However, there is a structured approach to this. When you wish to find out information, you search for it using publicly available information. Deciding on which sources are reliable.

Whilst it may sound complicated, you do not need to be a hacker or techy. Let's look at what OSINT really is, how to find the information and how to use it correctly.

What is OSINT?

Open Source Intelligence is using and analysing publicly or legally available information.

Open Source does not mean free. Although you may have lots of publicly available information, you will need to pay. Open Source does not mean using Open Sourced Software (software with publicly available source code and specific licensing).

Intelligence means you are not simply finding links. If you wanted to find 20 articles about a business you would not learn much. An OSINT analyst would look at the articles and decide whether the claims are reliable and why.

You will get insightful information.

Where can I find information?

There are many places to find publicly available information. News sites, Government announcements, research, reports, maps and business directories.

Social media can give extra information from publicly available posts. However, just because something is popular does not make it reliable. Web archives can show you what a publicly available page looked like in the past. Satellite images can help you identify changes to geography. Photos and videos can give you clues.

If you are a student looking into a company, it may be best to look at their official website, annual reports and reputable news sources.

Ensure you use the correct sources. If you are trying to prove something about a product launch use their statement. If you are looking into the impact of a product, use other sources.

Is it hacking?

No! One of the biggest misconceptions.

OSINT research uses legally available information. Hacking is exploiting and accessing systems without permission. Simply searching through publicly available reports is not hacking!

Some tutorials online can be confusing.

Just because you can find personal information about someone does not mean you should. There are still privacy laws, website terms and ethical considerations.

Responsible researchers will have limits.

How can I do OSINT?

Think of OSINT as a jigsaw puzzle, you need all the pieces.

Be clear about what you want to find out. If you want to know if a company opened a new office, this will be much easier than asking 'tell me everything'.

Find sources that will help you. Official announcements, current business directories and recent news articles.

Collect your information. Ensure you note down dates, links and any facts.

Compare your sources to draw a conclusion. If you do not have enough information to make a conclusion, state this. A good conclusion would be 'Unable to confirm'.

Keep it simple and you can explain how you reached your conclusion.

Example:

Someone posted on social media that a Technology company opened a new office in Lahore.

Rather than sharing the post, look at their official website. Are there any announcements? Have the dates and location matched up with a reputable news article? Are they stating they have opened a new office?

They may have said they are opening an office in Lahore however they may not have said they have opened it. Now you know the viral post was misleading and they are simply announcing their upcoming launch.

You now have a more accurate answer without using sneaky databases or high tech software.

This research can be very helpful to readers, students, journalists and businesses. Showing how important it is to use primary sources.

Simple OSINT Tools

Use simple research tools.

Search engines can help you find publicly available pages. Use ' ' to search for exact information. Use site: to find specific websites/domains on Google. Ensure you verify your information.

Use official websites and documents. This depends on your country and organisation.

Sometimes you can use web archives to see what public pages looked like in the past. However, not all pages will be available.

Use reverse image search to see where an image has been used or to find out more context about a viral image.

Don't worry about using specific tools. Being thorough, organised with your notes and asking sensible questions will be much more beneficial.

Finding Reliable Sources

If three different websites have posted the same shocking news, does this mean it is verified?

Not necessarily. They may all be using the same unreliable source.

Who has posted this and what evidence do they have? Try to find out where the original announcement was made. Use dated documents and direct news sources. When was the information created?

Images – Does the location and context make sense? Even if the image is real, it can be misleading if it has been added with the incorrect date/event.

Try to find information that contradicts your assumptions. If you are only looking for information to support your theory you are missing out on important information.

The best OSINT findings will tell you what you know and what you don't know.

How can businesses benefit from OSINT?

Businesses can gain insight into what people are talking about in the market. Staying up to date with announcements within their industry and what people are saying about their brand.

A small software agency may want to find out what their competitors are offering in their publicly available services. To see how companies describe their similar services. Retailers can stay up to date with Government notices within their industry rather than relying on rumours.

As long as you are following the law and ethical guidelines, OSINT can be used for basic due diligence and fact finding.

However, you will not find any confidential financial information from competitor websites or what their customers decided. A good analyst will know this.

Privacy, Ethics & Common Mistakes

Just because information is publicly available does not mean you should publish it.

Don't make a list of private individuals addresses, expose personal information or try to access locked accounts. Be extremely careful when researching children or at risk individuals.

Ask yourself why you need the information. Only save what you need. Don't share any sensitive information.

A common mistake is to assume correlation equals proof. Just because two things happen together doesn't mean one caused it.

Professional guidelines for Open Source Investigators (such as The Berkeley Protocol) place emphasis on accuracy, detailed notes, following the law and staying safe. Even if you are doing a simple project for yourself, it is a good idea to follow these guidelines.

Getting Started Safely with OSINT

Choose a safe topic to research. Maybe the history of a public landmark, changes to a Government service page or the timeline of a publicly announced product.

Ask yourself a question. Find the original source. Compare to an independent source. Note down dates and links. Write a short paragraph to make your conclusions.

Try to find an alternative source. Maybe a news article or archived web page. The more you do this the better you will become at identifying when there is not enough evidence and misleading context.

Using beginner guides and practice exercises from well known research organisations will help you build good habits without looking into private individuals.

Final Thoughts

OSINT is not about using sneaky tools to find out secrets. It is about using the information you have intelligently and correctly.

A search result is only the start. Finding reliable sources, comparing evidence, knowing what you don't know and respecting peoples privacy is key.

Whether you are researching a business, verifying a viral statement or building a new digital skill this method will help you reach more useful and trustworthy conclusions.

Start with a question and use your browser to verify information.