What Is OSINT?
OSINT, short for open-source intelligence, is intelligence produced from publicly available information, collected and analyzed to answer a specific question. The information can come from websites, social media, public records, maps, news, photos and commercial databases. Government definitions stress two points: the source is open to the public, and the work is aimed at a particular requirement rather than collecting for its own sake. The US statute that defines it, section 931 of Public Law 109-163, uses the same framing: intelligence produced from publicly available information to address a specific intelligence requirement.
Open does not mean easy
Public information is scattered. Nobody keeps one file on you. OSINT is the painstaking work of joining the scattered pieces: a username here, a property record there, a photo with a street sign in the background. Each piece is harmless alone. The combination is the problem.
That is why a people-search site feels so alarming the first time you search your own name. It did the joining for you.
Who uses it
- Investigators and journalists, to verify claims and trace people or events.
- Security teams, to see what an outsider can learn about their organization before an attacker does.
- Crowdsourced groups. Trace Labs, for example, runs events where volunteers work on missing-persons cases and pass tips to law enforcement.
- Attackers. The same methods work for stalking, fraud and targeting.
Offense and defense
I describe my own work as two halves. Offensive OSINT is finding information on people. Defensive OSINT is making that information hard to find. A privacy broker does the second half, and can only do it well by knowing the first.
The clearest example I have written is How Kidnappers Choose Their Targets. It walks through how an attacker finds a family using only open sources, then flips to how the same methods can help investigators after a crime.
Legal and ethical are different questions
Information being public does not make every use of it legal, and it does not make every use of it right. Aggregating someone’s address, routine and relatives can be perfectly lawful and still dangerous. The practical test I use is whether the person on the receiving end would be surprised and harmed by what I did with it. If so, I need a better reason than “it was public.”
Common mistakes
- “OSINT is hacking.” It isn’t. It does not require breaking into anything. Breaking in is a different discipline and needs permission, as the WordPress class story says in its first line.
- “OSINT is just Googling.” Search is one tool. The skill is knowing what to look for, how to confirm it, and when two records belong to different people with the same name.
- “If it’s wrong, it’s harmless.” Wrong information is only harmless if it is wrong in a way that helps the person it describes.
How it started for me
The short version is in From Lego Robotics to Privacy: I started by building things, then by breaking them, and ended up on the side that makes information harder to find.
Sources
- Public Law 109-163, section 931, as summarized in RAND’s report on open-source intelligence (via GovFresh).