OSINT, short for open source intelligence, is intelligence produced from information anyone can lawfully obtain: news reports, public records, company filings, social media posts, satellite images, websites and the technical traces they leave. “Open source” here has nothing to do with open source software. It means the source is open to the public, as opposed to secret or obtained by covert means.
The term comes from government intelligence, but most OSINT today is done by journalists, security teams, fraud and compliance analysts, brand protection teams and researchers. Our page on proxies for OSINT and investigative journalism covers the collection side for those teams; this article covers the basics: what OSINT is, where it comes from, how it is done and where the boundaries are.
A working definition
US law gives one of the most quoted definitions. Section 931 of the National Defense Authorization Act for Fiscal Year 2006 describes open source intelligence as intelligence “produced from publicly available information” that is “collected, exploited, and disseminated in a timely manner to an appropriate audience for the purpose of addressing a specific intelligence requirement.”
Two parts of that definition matter outside government too.
- Publicly available information is the raw material, not the product. A screenshot of a post is information. Knowing who posted it, when, from where, and whether it is genuine is intelligence.
- It starts from a requirement. OSINT answers a question someone actually has: is this supplier real, who is behind this phishing domain, did this event happen where and when the video claims. Collecting everything that is public, without a question, is hoarding, and it creates legal problems of its own.
Where OSINT comes from
Open sources fall into a few broad groups.
| Source type | Examples | Typical questions |
|---|---|---|
| Media | News sites, broadcasts, press releases, local outlets | What was reported, by whom, when |
| Public records | Company registries, court records, procurement notices, property and planning records | Who owns or directs an entity, what legal history it has |
| Social and community platforms | Public posts, forums, reviews, video platforms | What people say, show and claim, and when |
| Imagery and maps | Satellite and street-level imagery, mapping services | Where something is, whether it changed |
| Technical traces | DNS records, WHOIS and RDAP data, certificate transparency logs, archived web pages | Who runs a domain or server, what else is connected to it |
| Grey literature | Academic papers, NGO reports, conference talks, government publications | What is already known about a subject |
Most investigations combine several of these. A domain found in a phishing email leads to registration data, then to certificates issued for related hostnames, then to a company registry entry, then to a social profile. Each step is public on its own; the value is in the connections.
Core techniques
Advanced search. Search operators (site, filetype, exact phrases, date ranges) narrow huge result sets to the few pages that matter. Running the same queries from different countries matters too, because results and local sources differ by location.
Archiving and change tracking. Pages change and disappear. Web archives show what a page said in the past, and saving your own timestamped copies, with the URL and capture time, is what turns a finding into evidence.
Image and video verification. Reverse image search finds earlier copies of a picture. Geolocation (matching landmarks, signs and terrain to maps) and chronolocation (shadows, weather, other footage of the same event) test whether a photo or video shows what it claims. File metadata can help, although most platforms strip it on upload.
Infrastructure analysis. For security work, DNS history, certificate transparency logs and hosting data map an adversary’s domains and servers. Our article on residential proxies for threat intelligence covers why some of that infrastructure behaves differently depending on who is looking.
Records research. Company, court and procurement records answer ownership and history questions. Our guide to public-record collection for investigative reporting covers method and verification in detail.
How the work is organised
Professional OSINT follows a cycle: define the question, collect, process (deduplicate, translate, structure), analyse, then report to the person who needs the answer. The cycle repeats as findings raise new questions.
Two habits separate reliable work from guesswork:
- Corroboration. No single source is enough. Claims are checked against independent sources, and the report says how confident the analyst is.
- Documentation. Every finding records where it came from, when it was captured and how. The Berkeley Protocol on Digital Open Source Investigations, published by the UC Berkeley Human Rights Center with the UN Human Rights Office, sets out this kind of standard for investigations that may end up in court.
Legal boundaries
“Public” does not mean “anything goes”. The main lines are these. This is general information, not legal advice; the rules depend on your country and your purpose.
Personal data is still personal data. Under the GDPR and similar laws, information about an identifiable person is protected even when it was published openly. Collecting it needs a lawful basis, a clear purpose, and only as much as the purpose requires. Journalism and security research often have specific exemptions, but they are not unlimited.
Public means you did not have to break in. Accessing accounts, private groups or systems without authorisation can be a criminal offence under computer misuse laws such as the US Computer Fraud and Abuse Act or the UK Computer Misuse Act. Guessing passwords, using leaked credentials or getting around a login wall is not OSINT.
Platform terms still apply. Many sites restrict automated collection or fake accounts in their terms. Breaking terms is usually a contract matter rather than a crime, but it can get accounts closed and weaken the standing of your evidence.
Copyright covers what you republish. Collecting a page to analyse it is different from publishing the photos or text it contains.
For the specific question of automated collection, our overview of whether web scraping is legal goes through the main cases.
Ethical boundaries
Legal is the floor, not the standard. Experienced investigators also ask:
- Is it proportionate? Mapping a fraud network justifies more collection than satisfying curiosity about a private person.
- Who could be harmed? Bystanders, sources and family members appear in public data too. Minimise what you keep about people who are not the subject.
- Could the finding be wrong? Misidentification in public, especially online, does lasting damage. Corroborate before you name anyone.
- Are you protecting yourself and your sources? Investigation can tip off the subject, and some subjects retaliate.
Where proxies fit in
OSINT work has a network layer that is easy to forget. Every page you open tells the site your IP address. That can reveal your organisation to the subject of an investigation, and many sites show different content, results or prices depending on where the visitor appears to be.
A residential proxy lets an analyst view a site as a local visitor in the country or city that matters, and keeps the organisation’s own network out of the target’s logs. Teams that collect at scale, such as security teams monitoring phishing kits or brand abuse, also use it to spread requests so that collection stays within what sites tolerate. Our cybersecurity use case describes those workflows.
Be clear about what this does and does not do. A proxy changes the IP address a site sees; it does not make an investigator anonymous, and logged-in accounts, browser fingerprints and behaviour can still identify you. Our explainer a proxy is not an anonymity tool goes into the limits, and operational security has to cover them.
FAQ
What does OSINT stand for?
Open source intelligence: intelligence produced from publicly available information. “Open source” refers to the source being public, not to open source software.
Is OSINT legal?
Collecting and analysing public information is generally legal, but data protection law, computer misuse law, platform terms and copyright still apply. Personal data stays protected even when it is public, and getting past logins or access controls is not OSINT.
Who uses OSINT?
Journalists, security and threat intelligence teams, fraud and compliance analysts, due diligence firms, brand protection teams, human rights researchers and governments.
What is the difference between OSINT and data scraping?
Scraping is one collection method. OSINT is the whole process of answering a question from public sources: planning, collecting by hand or automatically, verifying, analysing and reporting.
The bottom line
OSINT is not “googling someone”. It is a disciplined way to answer a specific question from public sources, with corroboration, documentation and clear limits. Start from the question, collect only what it needs, keep a record of where every finding came from, and treat the legal and ethical lines as part of the method.