Register for our webinar with Meric Bloch to learn how to effectively and fairly interview the implicated employee during a workplace investigation.

#Article

9 Rules for Using Open Source Intelligence in Investigations


9 Rules for Using Open Source Intelligence in Investigations

OSINT tools can transform your research when you know where and how to look

Posted by on
There are some basic rules that apply to conducting OSINT investigations, no matter how complex.

Every investigator should be able to use open source intelligence competently to conduct research, find subjects and check information. But with trillions of OSINT resources on the surface web and 500 times that number on the hidden web, online investigation tools are constantly changing. There are, however, some basic rules that apply to conducting OSINT investigations, no matter how complex.

Need a starting point for OSINT investigations? Read 101+ OSINT Resources for Investigators.

1. Have social media accounts

When using social media in your searches, most networks will require that you have an account in order to search with any depth. Many investigators set up a separate account to use for investigations to ensure anonymity. Some social media networks prohibit fake accounts so read the rules before you sign up John Smith.

2. Learn how to use geolocation

Geolocation uses clues in photos or videos to determine the exact location where the photo or video was taken.

Geolocation can be a valuable addition to the OSINT toolbox. It uses clues in photos or videos to determine the exact location where the photo or video was taken. This is useful to corroborate claims by those using these media as evidence and for finding a location if it wasn’t supplied.

3. Check your facts

Double-check your results when researching anything online. Anyone can put information and mis-information on the web, so it’s important to know the source and, when there is any doubt, to corroborate anything you plan to present as fact.

4. Be anonymous

There are also search engines that don’t track users.

There are several ways to hide your identity when searching online and sometimes it’s a good idea to do so. Using Tor Browser is one reliable way to search anonymously. There are also search engines that don’t track users.

5. Don’t pretext

When using social media in your investigations, never misrepresent yourself in order to become “friends” with a subject. Not only does this violate the terms of most social media networks, but it is also unethical and could render any information you gather inadmissible as evidence.

6. Check your bias

Be aware of any biases that may affect your research and keep them in check.

When conducting online research, it’s very easy to use search terms that render certain types of results and exclude others based on the way the search is worded. It’s also easy to discount information you find that doesn’t support your theory, if you have one; it’s as easy as closing a window. Be aware of any biases that may affect your research and keep them in check.

7. Spend on OSINT tools

Some OSINT websites require you to join and pay a monthly, annual, or per-use fee. While there many free OSINT resources, it’s also a good idea to join some to increase the depth of the searches you can perform and to help you find information faster.

8. Stay current

Stay abreast of changes in the industry that can affect the efficiency and accuracy of your investigations.

The internet is constantly changing. An open source resource that was there yesterday could be gone today and new, useful OSINT tools pop up every week. Read blogs, follow OSINT experts on Twitter and stay abreast of changes in the industry that can affect the efficiency and accuracy of your investigations.

9. Know that OSINT has limits

And, finally, recognize that online research has its limitations and that there’s some incorrect and incomplete information on the internet. As valuable a tool as OSINT is, it can’t replace good old-fashioned investigating in person in a lot of cases. It’s a great starting point, but not necessarily the only tool you should be using.