What Is OSINT? Understanding Open-Source Intelligence

If you've spent any time around investigators, journalists, law enforcement or corporate security teams, you've almost certainly come across the term OSINT. It appears in job adverts, conference agendas, LinkedIn profiles and software marketing. 

Yet despite its popularity, it's one of the most misunderstood terms in investigations. Many people use OSINT to describe searching Google, looking at social media profiles or running searches through online databases. Those activities are certainly part of OSINT, but they are not what OSINT actually is.

To understand open-source intelligence properly, we first need to understand what intelligence means.

What is intelligence?

The simplest definition you'll often hear is: Intelligence is information with added value.

While accurate, that definition doesn't really explain how intelligence is created. A better way to think about intelligence is as a process rather than a product.

It begins with data. Data consists of individual facts that, on their own, have little meaning. A person's name, a company registration number, a photograph, a timestamp or a social media post are all examples of data.

When that data is collected, organised and evaluated for a particular purpose, it becomes information. At this stage, you've begun to answer questions, but you haven't necessarily reached any conclusions.

The final stage is knowledge. Knowledge is developed through analysis, corroboration and interpretation. Different pieces of information are connected together, assessed for reliability and used to explain what has happened, why it happened and what it might mean.

This is where intelligence is created.

Simply finding information online does not automatically produce intelligence. Intelligence exists because someone has analysed that information and added value to it.

From data to intelligence

Consider a simple example. You search for "Steve Adams" on a social media platform. The search returns hundreds of profiles. At this point, you've collected data.

You narrow the results using a location, employer and profile photograph until you're confident you've identified the correct individual. You now have information.

You then combine that profile with Companies House records, archived websites, professional biographies and other public sources. You establish employment history, identify business relationships, build a timeline and corroborate key findings across multiple independent sources.

Now you've produced intelligence. The internet didn't create the intelligence. Your analysis did.

What is OSINT?

OSINT stands for open-source intelligence. It is the collection, evaluation, analysis and dissemination of information obtained from publicly available sources to produce intelligence that supports decision making or investigations.

The emphasis should be on the final word: intelligence. Public information is the raw material. OSINT is the finished analytical product.

Historically, public sources have included far more than the internet. Newspapers, academic journals, government publications, conference papers, maps, books, broadcast media and commercial publications have all been valuable intelligence sources long before the web existed. OSINT predates Google by decades.

Today, however, the internet has become the largest and fastest-growing collection of publicly available information ever created. As a result, modern OSINT is largely internet-based, even though the discipline itself is much broader.

What is an internet investigation?

Most investigators spend the majority of their time working online rather than visiting physical archives or libraries. This has led to the emergence of the term Internet Intelligence & Investigation (III or i3) within UK policing and government.

i3 recognises that investigators routinely work with information obtained through the internet, including publicly available material, commercial databases and organisational systems, rather than relying exclusively on traditional public sources.

Outside the UK, the term OSINT remains far more widely used, even when investigators are carrying out internet-based enquiries that stray beyond publicly available information.

For most practitioners, the distinction is less important than understanding that an internet investigation often combines many different types of information while still following the same principles of intelligence collection and analysis.

Why do organisations use OSINT?

Almost every investigation now has an online element. People leave digital footprints through social media, company records, property transactions, photographs, forums, blogs, maps, court records and countless other publicly accessible sources.

Organisations use OSINT to answer questions such as:

• Who is this individual?
• Who are they connected to?
• Where have they lived or worked?
• What companies do they own?
• Are they associated with criminality, fraud or financial risk?
• Has this event happened before?
• Does the online evidence support or contradict other information?

The exact questions differ depending on whether you're working in policing, corporate security, insurance fraud, journalism, cyber threat intelligence or due diligence, but the underlying methodology remains the same. The objective is to reduce uncertainty so that better decisions can be made.

Passive and active investigations

One of the first concepts every investigator should understand is the difference between passive and active research.

Passive investigation means observing publicly available information without interacting with the subject. Searching websites, reading social media profiles, examining company records and reviewing archived web pages are all passive activities.

Active investigation involves engaging with the subject in some way, such as sending a friend request, following an account, liking a post or sending a message to an individual or group.

The distinction matters because active activity can have legal, ethical and operational implications. It may alert the subject to the investigation, compromise ongoing enquiries or, in some organisations, require specific authorisation before it can be undertaken.

Joining online groups often sits somewhere between these two categories and illustrates why investigators need clear organisational guidance. On some platforms, anyone can join a public group immediately without approval, making the activity little different from viewing any other publicly accessible content. On others, membership requires approval from an administrator or moderator, creating an interaction between the investigator and the group.

The position becomes even more complex where investigators seek access using an alias or false persona. Even if no direct conversation takes place, requesting access under an assumed identity may be regarded as a form of active investigation or covert engagement, depending on an organisation's policies and the legal framework in which it operates.

For this reason, organisations should define within their OSINT policies what level of online engagement is permitted, who may authorise it, and under what circumstances investigators may use aliases or other covert online identities.

For most OSINT investigations, passive collection remains the preferred approach. It minimises operational risk, reduces the likelihood of alerting the subject, and is often sufficient to obtain the information needed to support an investigation.

OSINT is about analysis, not tools

Ask someone what OSINT is and they might suggest pulling information from a social profile and companies house. These are valuable resources, but they are simply sources of information.

The skill of an OSINT practitioner lies in knowing what questions to ask, how to evaluate the evidence, how to corroborate findings and how to turn information into actionable intelligence.

Two investigators can access exactly the same publicly available information and produce entirely different outcomes depending on the quality of their analytical thinking. The tools matter but the tradecraft matters more.

Where this series goes next

This article introduces the foundations of OSINT, but successful investigations depend on far more than understanding the terminology.

Over the rest of this series we'll explore how to plan investigations, identify the best sources, search effectively, evaluate information, analyse findings and present intelligence that supports sound investigative decisions.