OSINT

Open source intelligence is the craft of turning public information into answers. This is a guide to how it works, who uses it, and why it matters for your own privacy.

During World War II, Allied analysts needed to know whether their bombing raids were wrecking the rail lines south of Paris.

They could have sent spies. They could have flown reconnaissance planes through anti-aircraft fire.

Instead, someone checked the price of oranges.

Oranges reached Paris by train from Spain. If the railways were broken, fewer oranges arrived and the price at the city's central market went up. A fruit stall became a damage report.

Here is that idea as a picture. Three rail lines carry oranges from the left into the market on the right. The tag under the market shows what a buyer pays. Click a line to bomb it. Fewer oranges get through, and the price climbs. Click it again to repair it.

The analysts never saw the tracks. They only saw the tag. But the tag told them how many lines were down.

That is open source intelligence in a single story. You take something anyone can see, you ask it a sharp question, and it tells you something no one ever announced.

This article explains what OSINT is, where it came from, how professionals actually do it, why it now shapes journalism, war and cybersecurity, and why it should change how you think about your own life online.

If you are new to this, you will leave with a working mental model. If you already practice it, skip ahead to the sections on bad signals, source grading and the new verification problem.

The short version

OSINT means turning publicly available information into answers to specific questions.

No hacking. No stolen documents. No secret sources. Just patience, method and the uncomfortable fact that the world is constantly describing itself out loud.

What the name actually means

OSINT stands for Open Source Intelligence. Two words in that name trip people up.

"Open source" has nothing to do with open source software. Here it means information that is publicly or commercially available. A newspaper. A court filing. A satellite photo you can buy. A job posting. A restaurant review. A radio broadcast. If an ordinary person can legally get it, it counts.

"Intelligence" is the word people skip, and it is the one that matters most. The SANS Institute, one of the big training bodies in security, defines OSINT as intelligence produced by collecting and analyzing public information for the purpose of answering a specific question.

Here is the clearest way to picture the difference.

Information is flour. Intelligence is bread.

A bag of flour feeds nobody. A screenshot, a public record or a photo is raw ingredient. It only becomes intelligence when someone with a question mixes it, tests it and bakes it into something a person can act on. A thousand screenshots with no question behind them is not an investigation. It is a messy kitchen.

OSINT sits alongside other intelligence disciplines with similar names. HUMINT comes from human sources. SIGINT comes from intercepted signals. GEOINT comes from imagery and maps. OSINT is the only one where the raw material is already sitting on your screen.

It is much older than the internet

People assume OSINT was born with social media. It was not.

In ancient Rome, the Acta Diurna was a daily public notice posted in the town square. Citizens read it. So could anyone visiting from an enemy city.

In 1862, during the American Civil War, Harper's Weekly published details of a Union naval expedition, including the names of the ships. Confederate officers could look up each ship's size, estimate how many troops and supplies the fleet carried, and guess where it might land. Generals on both sides read the other side's newspapers as a matter of routine.

In World War I, Allied analysts read German newspapers with special attention to one section. The obituaries. Counting dead officers was a way to measure losses the enemy would never admit.

The modern discipline has a birthday. On February 26, 1941, President Roosevelt created the Foreign Broadcast Monitoring Service. Its job was to record, translate and analyze radio broadcasts from around the world.

Its first analytic report, released on December 6, 1941, warned that Tokyo's tone was turning increasingly hostile. The next morning, Japan attacked Pearl Harbor.

That small radio office was renamed, folded into the CIA after the war, rebuilt as the Open Source Center in 2005 on the recommendation of the 9/11 Commission, and lives on today as the CIA's Open Source Enterprise. Its officers now watch foreign social and digital media and use AI to sort the flood. The discipline officially turned 85 this year.

The idea never changed. The volume did. In 1941 the raw material came through a radio speaker. Today billions of people carry a camera, a GPS receiver and a publishing platform in their pocket.

How harmless pieces become a secret

The single most important idea in OSINT has a name. The mosaic effect.

One tile in a mosaic shows you nothing but a colour. Put enough tiles together and a face appears. Nobody handed you the face. You assembled it.

In January 2018, an Australian student named Nathan Ruser was scrolling through Strava's Global Heatmap. Strava is a fitness app, and the map showed every public run and ride its users had logged between 2015 and late 2017. More than a billion activities.

In cities, the map glowed everywhere. In the deserts of Iraq and Syria, it was almost completely dark. Except for a few bright little loops.

Those loops were soldiers jogging around the inside of their bases. Each runner had shared nothing more than a workout. Together, they had drawn base perimeters, supply routes and daily patterns of life. The Pentagon launched a review and Strava tightened its privacy settings.

Nobody leaked anything. Nobody hacked anything. Every individual piece was harmless. The picture was not.

That is why security people describe OSINT as the mirror image of OPSEC, which is the practice of protecting the small public details that could reveal something big. One side assembles the mosaic. The other side tries to make sure the tiles never line up.

Where the raw material comes from

Think of the world as a building where every room leaks a little light under the door. OSINT analysts learn which doors to watch.

• What people post. Social media, forums, reviews, fitness and photo apps. Reveals locations, routines, relationships, who was where and when.
• Public records. Court filings, company registries, property records, government contracts. Reveals who owns what, who is connected to whom, where the money goes.
• Media. Local news, broadcasts, press releases, trade magazines. Reveals official claims, and local details that national outlets miss.
• Imagery. Satellite photos, street level photos, user videos. Reveals construction, troop movements, damage, environmental change.
• Technical traces. Domain registrations, website code, security certificates, devices exposed online. Reveals hidden infrastructure, links between websites, careless security.
• Broadcast signals. Ship and aircraft position transmissions picked up by public tracking networks. Reveals the movement of vessels and planes in close to real time.
• Behavioural exhaust. Prices, traffic data, store busyness, job listings. Reveals activity that people never meant to announce.

That last one is the most fascinating, and the most dangerous to misread. More on that shortly.

How investigators actually work

Amateurs collect. Professionals follow a cycle. The classic intelligence cycle has six steps, and it works like a doctor diagnosing a patient.

1. Ask the right question. "Find out everything about this company" is not a question. "Did this company's ship visit a sanctioned port last year?" is. A good question tells you what to collect and, just as importantly, what to ignore.
2. Collect. Gather the material. Analysts distinguish passive collection, where you never touch the target, from active collection, where you interact with it. Passive is looking through a shop window. Active is walking in and asking the clerk questions, which means the clerk now knows you were there.
3. Process. Translate, timestamp, archive and organise. Save everything immediately. Posts get deleted, accounts vanish and websites change overnight.
4. Analyse. This is where flour becomes bread. Cross-check every claim against independent sources. Ask what else could explain what you are seeing. Look hardest for the evidence that would prove you wrong.
5. Share. Deliver an answer in plain language, with an honest level of confidence attached.
6. Feed back. Every good answer raises a better question, and the cycle starts again.

A useful habit borrowed from weather forecasting. Good forecasters never say "it will rain." They say "70 percent chance of rain." Good OSINT speaks the same way. Likely. Almost certainly. Cannot confirm. Confidence is part of the answer, not an afterthought.

A missile launcher and a photo album

On July 17, 2014, Malaysia Airlines Flight MH17 was shot down over eastern Ukraine. All 298 people on board were killed. Governments traded accusations within hours.

A small group of online investigators called Bellingcat started doing something slower. They collected photos and videos that ordinary people had posted online that day, including footage of a Buk anti-aircraft missile launcher moving through separatist-held territory.

Then they did the patient part. They compared that launcher against photos posted online since 2010 by members of Russia's 53rd Anti-Aircraft Missile Brigade, based in Kursk. They matched seven distinguishing features, including paint marks and details on the side panels, and identified the vehicle as Buk 332. Later they found a photo of the same launcher in a mechanic's personal album, taken before part of its unit number was painted over.

Think of it like identifying a stolen car not by its colour, which millions of cars share, but by a specific dent, a scratch and a sticker on the bumper.

In September 2016, the Dutch-led international criminal investigation confirmed Bellingcat's findings about where the missile was fired from.

The lesson is not that the internet solves everything. The lesson is that small, boring, verifiable details beat big confident claims.

When a signal lies

Washington has an old legend. The night before the first strikes of the 1991 Gulf War, pizza deliveries to the Pentagon reportedly jumped from a handful to over a hundred. Late nights mean takeout.

Today the legend has a live dashboard. An account on X called Pentagon Pizza Report watches the "busier than usual" indicator that Google Maps shows for pizza places near the Pentagon. On June 12, 2025, it flagged a surge at several of them around 7 pm, hours before Israel launched strikes on Iran. The post spread everywhere.

Then, in August 2025, a Friday night spike set off wild and baseless rumours about the President's health. Pizza places get busy for many reasons. A game is on. It is payday. It is Friday.

This is the trap every analyst has to learn to see.

If you remember the nights the pizza spiked before a war, and forget the hundred nights it spiked before nothing, you have not built an indicator. You have built a horoscope.

One clever signal is a lead. It is never a conclusion. Behavioural exhaust like prices, traffic and busyness is brilliant for raising questions and terrible for answering them alone.

Who uses OSINT

Almost everyone with a reason to understand something that someone else would rather keep quiet.

Journalists and fact checkers verify whether a viral video was filmed where and when the caption claims.

Security teams map what attackers can see about their company. Which employees list their job titles publicly. Which old servers are still exposed. Which passwords have leaked.

Attackers do the exact same research in reverse. A convincing phishing email often starts with an org chart someone rebuilt from public profiles.

Businesses check out partners, suppliers and acquisition targets before signing anything.

Human rights investigators document war crimes using videos, satellite imagery and social posts, often for use in court.

Volunteers help search for missing people. Organisations such as Trace Labs run events where volunteers gather public leads on real missing persons cases and pass them to law enforcement.

Same skills. Very different intentions. Keep that in mind for later.

The toolkit without jargon

Specific tools come and go every year. The underlying techniques stay the same. Here are the core ones.

Precise searching. Search engines understand special instructions. Quotation marks force an exact phrase. Other operators restrict results to one website or one file type. Most people use a search engine like a fishing net. Investigators use it like a scalpel.

Reverse image search. Instead of searching with words, you search with a picture and ask where else it has appeared. This exposes the old photo from a different country being passed off as today's breaking news.

Geolocation. Working out where a photo was taken by matching what is visible. The shape of a mountain range, the style of a street sign, the language on a shop front, the type of power pole, the side of the road cars drive on. Every image is full of quiet clues about place.

Chronolocation. Working out when a photo was taken. Shadows work like a sundial. Their length and direction, combined with location, can narrow a time of day and even a season.

Metadata. Files carry hidden labels. Photos can store the camera model and sometimes GPS coordinates. Documents can store the author's name and the date they were edited. Big social platforms usually strip this out. Plenty of other places do not.

Web archives. The internet has a memory. Archive services regularly save snapshots of websites, so a page that was quietly edited or deleted may still exist in an older copy.

Signal tracking. Large ships and most aircraft broadcast their position by radio for safety. Volunteer networks receive those broadcasts and put them on public maps.

None of these require special access. They require curiosity and discipline.

The uncomfortable part

The same skills that identified a missile launcher can identify a stranger's home from a single selfie.

OSINT is a tool, and tools do not have morals. People do. Stalkers, harassers and doxxers use these techniques. So do online mobs who think they are helping. After the 2013 Boston Marathon bombing, internet sleuths confidently named the wrong person as a suspect, and a grieving family paid the price.

Legal is not the same as ethical. Information being public does not make every use of it fair. Responsible investigators ask themselves a few questions before they act.

Does the public interest actually justify looking into this person?

Am I collecting only what my question requires, or everything I can find?

Am I protecting the bystanders who appear in my material, by blurring faces and leaving out addresses?

What happens to a real human being if I am wrong?

If you cannot answer those honestly, stop.

When the raw material can be faked

For most of OSINT's history, the hard part was finding information. Increasingly, the hard part is trusting it.

AI can now generate realistic photos, videos and voices quickly and cheaply. That changes the job. Think of a jeweller who, for a century, could spot a fake by eye. Now the fakes look flawless. So the test changes from "does this look real?" to "where did it come from, who first posted it, and what else independently agrees with it?"

Provenance and corroboration have become the core skills. A video matters less on its own and more in combination with satellite imagery, eyewitness accounts from different sources, weather records and shadows that line up with the claimed time.

AI cuts both ways, though. The same technology that floods the internet with fakes also helps analysts sort through volumes of material no human team could read.

Going a layer deeper

If you already do this work, these habits separate solid findings from viral mistakes.

Grade the source and the claim separately. The Admiralty system, used widely in intelligence and policing, rates source reliability from A to F and information credibility from 1 to 6. A historically reliable source can still pass along a bad claim. A random account can still post a real video. Keeping the two ratings apart stops reputation from doing your thinking.

Test competing hypotheses. Before you settle on an answer, write down every plausible explanation, then check each piece of evidence against all of them. The strongest explanation is often not the one with the most evidence for it, but the one with the least evidence against it.

Distrust the moment you think you found it. The first plausible match is the most dangerous one, because relief switches off scepticism. Slow down exactly when you feel most certain.

Preserve as if it will end up in court. Capture the original file, the page around it, the URL, the time of capture and a cryptographic hash. The Berkeley Protocol, published in 2020 by the UN Human Rights Office and UC Berkeley's Human Rights Center, sets out professional standards for digital open source investigations, and it is worth reading in full.

Mind your own footprint. Some platforms tell people who viewed their profile. Some websites log visitors. Researching carelessly can alert the very person you are researching and ruin the investigation.

Record what you did not find. A documented absence is evidence too, and it stops the next person from repeating your dead ends.

Turn the lens on yourself

You do not need to become an investigator for any of this to matter. You are already a source. Here is a short self check worth doing tonight.

Search your full name in quotation marks, then again alongside your city and your employer. See what a stranger sees.

Reverse image search your profile photo. Find out where else it appears and which accounts it connects together.

Check your fitness and photo apps. Many of them let you hide the start and end of your routes so your front door is not on a map. Turn that on.

Read your public posts as a stranger would. Do they reveal your gym schedule, your children's school, or the fact that you are on holiday right now and your home is empty?

Look up your email address in a breach lookup service such as Have I Been Pwned, and change any password that appears.

Hunt down old accounts you forgot about years ago. They are often the least protected and the most revealing.

Check your photos before posting. House numbers, car plates, mail on the table and the view from your window all do more talking than you think.

None of this is about paranoia. It is about choosing which tiles of your mosaic you leave out on the table.

Back to the oranges

The analysts in Paris did not need a spy, a bribe or a break-in. They needed a good question and the patience to look at something ordinary from a new angle.

That is still what OSINT is. The world reports on itself all day, through prices, photos, shadows, workouts, takeout orders and shipping signals. Most people see noise. A trained eye sees answers.

The real skill was never the tools. It is asking a fruit stall the right question.

And the next time you post something, it is worth remembering that somebody, somewhere, might be checking the price of your oranges.

If this changed how you see public information, share it with someone who posts their morning run every day.