What is OSINT? Open-source intelligence, explained

Open-source intelligence, OSINT, is intelligence produced from information anyone could lawfully access: websites and their archived versions, news, company registers, court records, social platforms, academic publications, maps and satellite imagery, technical data such as DNS records or ship-tracking feeds. The definition sounds almost trivial. The discipline lives in the word "produced". A folder of search results is no more intelligence than a pallet of bricks is a house.

An open source is a lawful source

The test for "open" is legitimate access, and nothing else. If seeing the material requires someone else's password, a fake friend request, a scraper that ignores an access control, or a paywall bypass, it is closed, whatever a tool vendor's brochure says. Professional teams treat this line as absolute because their output has to survive lawyers. One tainted source can compromise an entire case file.

Lawful access does not end the legal analysis, at least not in Europe. Public personal data is still personal data, so a documented purpose and lawful basis come before collection. We covered that side in GDPR-aware intelligence workflows.

What separates OSINT from searching

Anyone can search. Four habits turn searching into intelligence work:

1. A requirement. Collection starts from a question someone actually needs answered ("who controls the company behind this tender?"), and the question bounds what gets collected. Aimless hoarding produces noise and GDPR exposure in equal measure.
2. Provenance. Every artifact is captured with its source, capture time and method. Months later, a colleague or an opposing counsel can retrace the path. A screenshot without a record of where and when is an anecdote.
3. Verification. Online content lies routinely: recycled photos, backdated posts, coordinated personas. Findings get tested against independent sources before anyone relies on them. In practice this is where most of the hours go.
4. An assessment. The deliverable states what is established, what is probable and what remains unknown, with the reasoning attached. Decision-makers read conclusions, not tabs.

A typical pass

A due-diligence request comes in: a mid-sized firm wants to know who is behind a prospective distributor. The analyst pulls the company register extract and its filing history, maps the directors across other registrations, checks litigation databases and sanctions lists, then reads several years of local news about the firm and its owners. Two directorships overlap with a company dissolved after a fraud judgment. That finding, with register extracts and dated sources attached, changes the client's negotiation. Total collection time: a day. Nothing exotic happened; the value was in knowing where to look and writing down what was found.

What OSINT is not

It is not hacking; the moment intrusion starts, open-source work has ended and something else has begun. It is not anonymous by default; visiting a page leaves traces, which is why practitioners use managed research environments. And it is not "free intelligence". The sources cost little. The analysts, the verification and the documentation are where the real cost sits, which is also why the results are worth something.

Frequently asked questions