Where OSINT fits in a criminal investigation

Open sources touch almost every stage of a modern criminal investigation, and they rarely close one on their own. That is the first thing to be honest about. OSINT develops leads, narrows a field of suspects, corroborates an account, and builds the picture a case is later made from. But the case is made from evidence gathered under proper authority, then tested and disclosed. Treating an open-source finding as the case, rather than as the thing that points you toward it, is how investigations go wrong early.

Lead development and triage

Early in an inquiry there is usually more noise than direction. Open sources are where much of the first sorting happens: a name from a report checked against public records and social profiles, a phone number or an email run through what is lawfully visible, a location scouted before anyone is sent to it. The value is triage — deciding, quickly and cheaply, which threads are worth an investigator's limited time and which lead nowhere. Done well it saves weeks. Done carelessly it sends a team down a road built on a coincidence of names.

Identifying subjects and mapping the people around them

People rarely act in isolation, and open sources are good at showing the shape of a group. Public connections, shared registrations, a company directorship, a photograph that places two people together — these help resolve who a subject actually is and who sits around them. Link analysis of open material can turn a single name into a network with roles and relationships, which is often what changes an investigation's direction. The caution is the one that applies to all identification work: a match is a hypothesis until it is corroborated, and people share names, faces and habits more than intuition expects.

Reconstructing what happened, and when

Publicly posted material carries time and place, and a great deal of it. A run of posts, a timestamped image, a check-in, a piece of CCTV a member of the public shared — assembled with care, these reconstruct a timeline that either fits the account under examination or contradicts it. The discipline is verification. The same photograph can be recycled from an earlier event, and a claimed time can be wrong or deliberately false, so each fixed point has to be established rather than assumed.

The handling is what makes it evidence

Here is where open-source work in policing either holds up or falls apart. A finding relied on in a prosecution has to clear a higher bar than one that merely guides the inquiry, and the difference is entirely in the handling. Three things decide it. There has to be lawful authority for the collection appropriate to how intrusive it is: casually reading a public post is not the same as sustained covert monitoring of an individual, and the law treats them differently. Every artifact needs documented provenance — the source, the URL, the time in UTC, who collected it and how — captured at the moment of collection rather than reconstructed later. And the material has to be preserved so it can be examined again, which is what ISO/IEC 27037 sets out for digital evidence: identification, collection, acquisition and preservation, handled so the work stays auditable and repeatable. A screenshot with none of that behind it is not an exhibit. It is a picture, and a competent defence will treat it as one.

Front end of the case, not the whole of it

None of this argues for using open sources less. It argues for using them properly. The investigative teams that get value from OSINT treat it as the front end of a case — fast, wide and cheap for finding and prioritising — and then move anything they intend to rely on onto a proper evidential footing, with a chain of custody that survives disclosure. Collect widely to understand. Handle strictly what you mean to prove.

Frequently asked questions