What is OSINT?
Definitions, the difference between open source and covert collection, and what counts as a legitimate source.
Open-Source Intelligence (OSINT) is intelligence produced from publicly or commercially available information that is collected, refined, and analyzed to answer a specific question. The "open" part means the source is lawfully accessible to anyone — no hacking, no deception, no special access required.
Open source vs. "publicly available"
The distinction that trips people up is that open does not always mean free or indexed by Google. Data can be public but gated (a paid records database), public but obscured (an image with useful EXIF), or public but scattered. OSINT is the discipline of finding it, not just googling it.
- Open source — media, websites, social platforms, public records, satellite imagery, government publications.
- Commercially available — paid data brokers and records services you are licensed to use.
- Not OSINT — breaching a system, impersonating a person to obtain access, or buying leaked data. Those are illegal regardless of intent.
Prefer primary sources (the original post, the raw record) over secondary ones (a screenshot, a blog that summarises it). Screenshots lose metadata, timestamps, and context — and are trivial to fake.
| Type | Example | Reliability |
|---|---|---|
| Primary | A live tweet, an official registry entry | Highest |
| Secondary | A news article quoting the tweet | Medium |
| Tertiary | A wiki summarising the article | Lowest |
Where OSINT is used
Journalists verifying claims, fraud and AML investigators, security teams profiling threat actors, corporate due diligence, and — responsibly — individuals trying to understand their own digital footprint. The techniques are neutral; the intent and the law are what matter.
The investigator's mindset
Tools do not find people; questions do. A useful working definition of the job: collect the minimum public facts that let you answer one specific question, and record why you believe each one. The discipline is in the reasoning trail, not the haul.
- Start from the question, never the tool. "Which accounts share this recovery email?" beats "open every social site".
- Write findings as claims with evidence: claim, source, timestamp, confidence. A screenshot with no URL is not evidence.
- Triangulate: one public data point is a lead; two independent sources agreeing is a finding.
- Assume you are wrong and hunt for the disconfirming case — this is what separates analysis from confirmation bias.
A subject claims a personal blog. You need to decide whether it belongs to the same person you are investigating, not just someone with a similar name.
Method · Pull the blog's author name, the email or social links in the footer, and the domain registration. Cross-check those against the subject's known handles and the reused profile photo — then look for one detail only the real subject would know (an old employer, a pet, a closed account name).
Result · Two independent matches (a re-used avatar and a listed work email at a company the subject previously worked for) plus a unique in-joke lift this from "unverified" to "probable, with provenance". You report the two matches and the confidence — not a bare yes.
Names are not unique, and common names collide constantly in every database. Never merge two records because the names match — merge them because an independent identifier (phone, email, handle, photo) matches.