Ethics & Law
The rules that keep OSINT legal and defensible: jurisdiction, terms of service, and proportionality.
This is general orientation, not a substitute for advice from a qualified lawyer in your jurisdiction. Laws differ sharply by country and by your purpose (journalism, security research, private investigation, employment).
OSINT sits in a grey zone on purpose: the information is public, but how you collect it and what you do with it can still be unlawful or unethical. Three tests keep most work on the right side of the line.
1. Legality
- Never access anything behind authentication you are not entitled to use.
- Do not use leaked or breached datasets, even if they are "just sitting there".
- Respect anti-harassment and stalking statutes — repeated unwanted monitoring of a person is a crime in many places.
- Data-protection regimes (GDPR, UK DPA, CCPA) constrain collecting and storing personal data even when it is public.
2. Terms of service
Platform ToS are civil contracts, not criminal law — but violating them can get accounts suspended and, in some jurisdictions, carries separate liability. Automated scraping is the usual flashpoint: prefer official APIs and their rate limits.
3. Ethics & proportionality
- Minimise: collect only what the question requires, not everything you can.
- Do not cause harm to bystanders — the target's children, colleagues, and neighbours are not your subject.
- Do not make contact or interact without a clear, authorised reason.
- Document your authorisation: who asked, why, and what scope they approved.
The most common failure is losing the plot: investigation drifts into curiosity, curiosity into obsession. Keep a written objective taped to the work, and stop when it is answered.
Who you are changes what is allowed
The same technique can be routine for one investigator and a crime for another. Your lawful basis — not the method — is what defines the boundary. Know which box you are in before you start.
While profiling a target you discover an exposed admin panel for a service they use. It loads without a login prompt.
Method · The temptation is to look. But authentication-free access to a system you are not entitled to use is unauthorised access in most jurisdictions, regardless of how you found it.
Result · You do not touch it. You note the URL, the time, and a screenshot of the public-facing notice, and — if appropriate — you report the exposure through the vendor's security contact or a coordinated-disclosure channel.