Open Source Intelligence (OSINT): Intelligence Discipline Guide

Open source is not free intelligence. It is unvalidated raw material available to anyone, including your adversary, and the discipline is what turns it into something you would defend in a courtroom or a board meeting.

What Open Source Intelligence is as a discipline

Open source intelligence is the systematic collection, verification and analysis of information lawfully available to the public: registries and official publications, court, tender and procurement records, archived web content, academic and technical literature, broadcast and print media, and user-generated content. What separates it from searching is method. A defined requirement, a planned source list, provenance captured at the moment of collection, corroboration across genuinely independent sources, and an audit trail that lets a second analyst reproduce the finding without repeating the guesswork.

In the cycle, open source carries direction and collection and then feeds every other discipline. Sub-methods include public-record and registry research, web and archive research, technical enumeration of publicly exposed infrastructure, vernacular-language media collection, and structured link analysis. Mature programmes run it as a baseline layer, invoking specialist disciplines such as geospatial, financial or social media intelligence only where the requirement genuinely needs that depth.

Why it matters

Open source answers what can be established about a subject without privileged access, and by extension what an adversary can establish about you. It is often the only discipline available where no other collection is lawful or practical, and it produces citable evidence rather than assertions. It also sets the baseline against which closed and specialist sources are judged, because a claim that contradicts the public record needs a stronger explanation than one that fits it.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Registry filings that place a named person at an address, company or date, with the filing itself as citable evidence.
Archived versions of pages later edited or deleted, timestamped independently by a third-party crawler rather than by the publisher.
Contradictions across sources: a biography, a corporate filing and a news report that cannot all be accurate.
Document metadata, file naming conventions and publication paths that reveal the originating organisation or authoring system.
Procurement notices, tenders and grant awards linking an entity to a public buyer with values, dates and award procedure.
Job adverts and staff listings disclosing technology stacks, physical sites, expansion plans and internal structure.
Vernacular-language reporting and local records that never surface in English-language coverage or aggregators.
Absence of an expected record, such as a missing filing or lapsed licence, which is itself a finding where the obligation exists.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

Internet Archive Wayback Machine — Timestamped historic captures of pages later altered, taken down or quietly corrected
OpenCorporates — Cross-jurisdiction company records with officers, filings and links back to the originating register
National official gazettes and company registers — Authoritative primary filings for incorporation, appointments, insolvency and legal notices
GDELT Project — Global event and media metadata at scale for baselining coverage and spotting shifts
EU Tenders Electronic Daily — Public procurement notices and awards across the EU with buyers, suppliers and contract values
Common Crawl — Large-scale web crawl archives for historic content and site structure without touching live targets
OpenStreetMap — Open geographic base data for grounding addresses, sites and infrastructure references

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Define the requirement — Write the question you must answer and the decision it supports, so collection is bounded and you can recognise when you are finished.
Build a source plan — Name the sources expected to answer each part of the question, note their authority and language, and identify where gaps will remain.
Collect with provenance — Capture URL, retrieval time, full page, file hash and the original document, because a finding without provenance is only an opinion.
Verify and corroborate — Trace every claim to its origin and confirm through an independent source rather than a republication of the same origin.
Structure the material — Resolve entities, build a dated timeline and record relationships so patterns emerge from the structure rather than from memory.
Assess confidence and gaps — State what is established, what is inferred, what remains unknown, and what collection would resolve the most important gap.
Disseminate with citations — Publish findings where every material assertion carries its source, so a reader can audit the reasoning independently.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

Operates on these data points

Domain Name — Human-readable address that maps to IP infrastructure via DNS.
Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
Keyword / Narrative — A search term, topic, hashtag, or narrative tracked across media and platforms.
IP Address — Internet Protocol address identifying a device or server on a network.
Malware Family — A named class of related malicious software.
CVE / Vulnerability — Common Vulnerabilities and Exposures identifier for a known flaw.
Company / Organization — A legal entity — corporation, LLC, NGO, or business.
Sanction / Watchlist Entry — An entry on a sanctions list, watchlist, or PEP database.

Related disciplines

Reference Intelligence — Authoritative Reference Data and Standards
Risk Intelligence — Structured Assessment of Threat and Consequence

Inside the platform: where Open Source Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

discipline.php?d=OSINT — Discipline hub
source-catalog.php?disc=OSINT — Source catalogue filtered to this discipline
url-profile.php — Domain Name profile
ip-profile.php — IP Address profile
hash-profile.php — Malware Family profile
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Threat Hunt
Auto-Collect Feeds
Enrichment → Local
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Define the requirement is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Collect with provenance turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Disseminate with citations feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Open Source Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Open source underpins intelligence preparation of the battlespace before any classified collection is tasked. Analysts build the baseline on terrain, infrastructure, population, governance and local media, then use open reporting to cue and cross-check organic sensors. It supports force protection, route and site assessment, and understanding of the civil environment around a deployment, and it produces releasable products that can be shared with partners and host-nation forces without classification friction. Constraints are real: open collection touching persons in an operational area engages host-nation law and rules of engagement for information activities, contractual restrictions on commercial data follow into military use, and open reporting must be graded and never treated as confirmed simply because it is abundant.

🕵 National intelligence

In national agencies open source is a first-resort discipline that reduces demand on scarce technical and human collection. It answers a large share of standing requirements outright, provides the unclassified backbone that classified reporting is fused onto, and offers a releasable evidentiary layer for diplomatic or legal action. Handling is the recurring problem: aggregation of open material can produce a classified judgement, and the provenance of commercially acquired data must be recorded because it may later require disclosure. Mature programmes maintain a collection plan against named requirements, grade sources formally, and archive originals so a finding survives the deletion of the page it came from.

👮 Law enforcement

For investigators open source generates leads and corroborates other evidence, but only becomes evidence when collected to a defensible standard. That means capturing the material with a documented method, hashing the original file, recording the collection time and the tool used, and keeping a contemporaneous note explaining what was searched and why. Some jurisdictions treat sustained monitoring of an individual's public postings as directed surveillance requiring authorisation, so check the domestic regime before profiling. Material held by a platform generally requires a production order or an MLAT request; the public view is not a substitute. Disclosure duties extend to open material that undermines the case.

🔍 Private investigation and corporate security

Corporate security and private investigators use open source for due diligence, insider risk triage, asset tracing, litigation support and pre-employment checks within the limits of employment and data-protection law. The professional differentiator is method: a documented source list, provenance captured at collection, and a written distinction between what is evidenced and what is inferred. A private actor may not access accounts or systems without authority, may not create false identities where the platform or the jurisdiction prohibits it, may not scrape in breach of contract, and may not conduct sustained covert monitoring of a private individual without a lawful basis that survives scrutiny.

📰 Journalism and OSINT media

Newsroom open source work is verification-led. The standard is not that a claim was found online but that its origin, date and location are established and that independent sources corroborate it. Practitioners archive before publishing, retain the original file with its metadata, document each verification step so an editor can audit it, and are explicit in the copy about what remains unconfirmed. Source protection extends to the digital trail: contributors who supply material can be identified through upload metadata or platform activity, so material is stripped and handled carefully. Named individuals receive a right of reply, and identification of bystanders is avoided unless it is necessary to the public interest.

🌍 NGO, humanitarian and human rights

Human rights and humanitarian teams use open source to document incidents that field access cannot reach, to build patterns for accountability, and to inform security management. Practice is victim-centred and do-no-harm led: content that could identify survivors, shelters or medical facilities is withheld or blurred, and material is preserved to a standard that a future accountability mechanism can use rather than only to a standard sufficient for advocacy. Duty of care applies to staff exposed to graphic material, with rotation, limits on exposure and access to support. Consent and dignity govern the use of imagery of identifiable people, including the deceased.

🎓 University and research

Researchers use open source for conflict, governance, environment and information-integrity work. Reproducibility requires a documented sampling frame, a dated archive of retrieved material, and a codebook applied by more than one coder with reported agreement. Ethics approval is normally required where data relates to identifiable persons even when the data is public, and the fact that content is accessible does not establish that its authors expected research use. Data sharing is constrained by platform terms and by re-identification risk, so publish code, coding schemes and aggregate results, and share underlying identifiers only through controlled access with an approved data management plan.

Playbook: working Open Source Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Fix the requirement

Convert the request into a specific, answerable intelligence question with a decision attached. Establish who will act on the answer, what they will do differently depending on the result, the deadline, and the confidence level that would be sufficient. Write down what is already known and what is assumed. A good output is a requirement statement short enough to be repeated from memory and precise enough that two analysts would collect the same things. Stop when the requester agrees the question, because reframing after collection wastes the work and biases the result.

Phase 2 — Build the collection plan

Decompose the requirement into indicators and name the source families that could evidence each one: registries, court and procurement records, archived web, technical infrastructure, media in the relevant vernacular, and user-generated content. Assign each indicator a primary and an alternative source so a single access failure does not stall the task. Record known gaps and language needs at this stage. A good output is a table linking indicator, source, expected artefact and analyst. Stop when every indicator has a named source, or is explicitly marked as not collectable by open means.

Phase 3 — Set up the working environment

Prepare an environment appropriate to the sensitivity: a clean browser profile, an attribution posture matched to the subject and the risk, storage with hashing, and a capture tool that records URL, timestamp and page state automatically. Decide in advance what identity you present, and record that decision. Where the subject may detect and react to collection, plan for that before the first query rather than after. A good output is a configured, documented environment. Stop when a colleague could reproduce your setup from the note you wrote.

Phase 4 — Collect with provenance

Capture at the moment of collection, not later. For every artefact record the URL, retrieval timestamp with timezone, the tool used, a hash of the original file, and a screenshot showing context including any visible date. Save the underlying media file, not only a screenshot of it, because metadata and encoding are analytically useful. Log searches that returned nothing, since negative results shape later conclusions. A good output is an evidence store where every item can be traced back to a retrieval event. Stop when the plan's indicators are covered or exhausted.

Phase 5 — Preserve against loss

Push copies of key public pages to independent archives and retain local originals, since content is edited, deleted or geoblocked routinely and the version you relied on must remain provable. Record the archive URL alongside the local hash. For material that may become evidence, place it under a preservation hold with restricted access and a documented chain of custody. A good output is a dual-preserved record for every load-bearing artefact. Stop when nothing your conclusion depends on exists in only one place.

Phase 6 — Verify the artefact

Establish origin, date and location for each significant item before it influences analysis. Reverse-search images across multiple engines to test for earlier appearances, examine file metadata where it survives, compare visible landmarks, signage, shadows and weather against independent references, and trace the earliest posting rather than the most viewed. Note explicitly which of origin, date and location remain unestablished. A good output is a verification note per artefact with the checks performed and the residual uncertainty stated. Stop when further checks stop changing the confidence level.

Phase 7 — Resolve entities

Reconcile the names, companies, handles, addresses and identifiers you have collected into distinct entities, using strong identifiers where they exist and scoring weak matches rather than merging them silently. Record every merge decision and the evidence for it, and keep a list of candidates you deliberately did not merge. Common names and transliteration variants are where most open source errors originate. A good output is an entity register with confidence and evidence per assertion. Stop when the entities that carry the conclusion are resolved to a stated confidence.

Phase 8 — Corroborate independently

Test whether your supporting sources are genuinely independent or are recirculating one origin. Trace each claim to its earliest identifiable report and check whether the others cite it, mirror it, or observed the event separately. Syndication, aggregator republication and translated reposts create the illusion of multiple confirmation. Where independence cannot be established, say so. A good output is a citation chain per claim showing the origin and the genuinely separate observations. Stop when either independence is established or the claim is downgraded accordingly.

Phase 9 — Analyse and weigh

Move from artefacts to judgement using a structured method rather than narrative accumulation. State the competing explanations, identify which evidence discriminates between them, and check whether your conclusion rests on a single source or a single assumption. Grade source reliability separately from information credibility. Express confidence in calibrated language tied to defined probability bands. A good output is a judgement with its discriminating evidence and its key assumptions written down. Stop when you can state what observation would change your mind.

Phase 10 — Apply the harm test

Before any product leaves the team, review it for the harm it could cause: identification of private individuals, exposure of locations that put people at risk, information that could assist a bad actor, and material that could re-traumatise. Consider whether the level of detail is necessary for the decision the product supports. Redact, aggregate or withhold accordingly, and record what was withheld and why. A good output is a documented harm review signed by someone other than the author. Stop when the residual harm is proportionate to the public or client interest served.

Phase 11 — Produce with audit trail

Write the product so that every load-bearing claim carries a reference to a preserved artefact, and so that a reader can distinguish observation, inference and assumption at a glance. Include a methods note describing what was searched, what could not be obtained, and the limits of the finding. Attach the evidence index rather than pasting screenshots into the narrative. A good output is a report a second analyst can reproduce. Stop when the reproduction test is met, not when the word count is.

Phase 12 — Review and retain

Have a colleague who did not collect the material challenge the strongest claim and the weakest source. Then apply retention: delete or minimise personal data about uninvolved third parties, set a review date, and record the lawful basis for what is kept. Where the material may be needed for accountability, transfer it to the appropriate long-term preservation arrangement rather than leaving it in a working store. A good output is a closed case file with a retention decision recorded. Stop when the file is either archived under policy or destroyed under policy.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
Internet Archive Wayback Machine (archived)	Open	Historic snapshots of web pages captured over time, with on-demand capture of live pages.	Preserves the version of a page relied on and recovers content that has been edited or removed since collection.
OpenCorporates	Registration	Company registry data aggregated across jurisdictions with officers, filings and cross-jurisdiction identifiers.	Establishes corporate existence, officers and jurisdiction as the entity backbone for most open source investigations.
GLEIF Legal Entity Identifier data	Open	Global register of legal entities with legal name, address, registration authority and parent relationships.	Disambiguates similarly named companies and supplies a stable identifier for cross-source entity resolution.
OCCRP Aleph	Registration	Searchable archive of leaks, registries, procurement records and public documents assembled for investigative journalism.	Cross-corpus search for a name or company across document collections that are otherwise scattered and unindexed.
GeoNames	Open	Open gazetteer of place names, alternate names, feature classes and coordinates worldwide.	Resolves place-name variants and transliterations so location references in text can be matched consistently.
OpenStreetMap	Open	Community-maintained global map data covering roads, buildings, land use and points of interest with edit history.	Supports geolocation, route reasoning and infrastructure context, and its edit history dates when features appeared.
Copernicus Data Space Ecosystem	Registration	Free access to Sentinel optical and radar imagery and derived products with a browsing and download interface.	Provides open imagery to test claims about activity at a location and to date visible change.
USGS EarthExplorer	Registration	Archive of Landsat and other US civil satellite and aerial imagery, including long historic series.	Establishes a long baseline for a site so recent change can be distinguished from normal seasonal variation.
GDELT Project	Open	Machine-coded global news event and tone dataset with broad language coverage and a public query interface.	Finds early or vernacular reporting on an event and shows how coverage propagated across outlets and languages.
Media Cloud	Registration	Open platform for studying online news content across a large collection of sources with topic and source analysis.	Traces the chain of citation from earliest report to syndication when testing whether corroboration is independent.
ACLED	Registration	Coded dataset of political violence and protest events with date, location, actor and source notes.	Provides an independent event baseline against which a single reported incident can be situated or challenged.
Humanitarian Data Exchange	Open	Repository of humanitarian datasets including administrative boundaries, population, displacement and needs indicators.	Supplies authoritative boundaries and population baselines so open source findings can be located and scaled correctly.
RDAP registration data services	Open	Structured successor to WHOIS returning domain registration, status and contact data from registries and registrars.	Establishes domain registration facts and dates when investigating web infrastructure behind a claim or entity.
Certificate transparency logs	Open	Public append-only logs of issued TLS certificates including subject names and issuance timestamps.	Reveals hostnames and infrastructure associated with a domain and dates when services were first stood up.
EU Tenders Electronic Daily	Open	Publication of European public procurement notices including contract awards, values and supplier names.	Evidences commercial relationships with public bodies and locates suppliers not visible in company filings.
Berkeley Protocol on Digital Open Source Investigations	Open	Methodological standard for open source investigation in support of international criminal and human rights accountability.	Sets the collection, preservation, verification and analysis standard to which serious open source work is held.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Open Source Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

Hunchly — Captures every page visited during an investigation with hashes, timestamps and full-page content. Limitation: it records the browsing session, so a disciplined search plan is still required to make the archive coherent.
Maltego — Graph platform that runs transforms across data sources and visualises relationships between entities. Limitation: transform quality varies by provider and unweighted graphs make weak links look as strong as evidenced ones.
SpiderFoot — Automated reconnaissance across many open data sources for domains, addresses and identifiers. Limitation: automation generates volume and false positives that must be adjudicated manually before use.
InVID-WeVerify verification plugin — Browser toolkit for keyframe extraction, reverse image search, metadata inspection and magnification of video and images. Limitation: reverse search coverage differs by engine and region, so a negative result proves little.
Overpass Turbo — Query interface for OpenStreetMap data allowing feature searches by tag within a defined area. Limitation: results reflect community mapping density, which is very uneven outside urban and well-mapped regions.
Wayback Machine and archive.today — Independent web archiving services that preserve and date page states. Limitation: coverage is partial, some sites block archiving, and archived pages can omit dynamically loaded content.
Local archive and hashing workflow — Stores original files with cryptographic hashes and a chain-of-custody log. Limitation: requires discipline at the moment of collection, since a hash applied later proves only that the file has not changed since then.
Machine translation with human review — Makes vernacular sources tractable at speed across many languages. Limitation: it flattens register, idiom and hedging, so any quotation or load-bearing nuance needs a competent human reader.
Entity resolution and case management software — Reconciles records into entities and records the evidence for each merge. Limitation: automatic merging on weak attributes creates composite entities that are extremely hard to unpick later.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Auto-Collect Feeds — Pulls the registered feed set server-side on a schedule, recording per-feed status so a silently dead feed is visible.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Provenance is captured at the moment of collection or not at all. A screenshot taken today of a page you read last week proves nothing about what it said last week, and no later effort recovers the state you actually relied on.
Independence of sources is a claim that must itself be evidenced. Trace each corroborating report to its earliest origin; syndication, translation and aggregator republication routinely manufacture the appearance of three confirmations from one observation.
Log the searches that found nothing. Negative results define the boundary of what open collection could establish and prevent a later reader from assuming the gap was never examined.
Grade source reliability separately from information credibility. A source that has been wrong before can report accurately, and a normally reliable source can pass on a rumour; collapsing the two into one score destroys the distinction that matters.
Aggregation changes sensitivity. Individually harmless open facts about a person or a facility can combine into something that enables harm, so the harm test applies to the assembled product, not to each artefact in isolation.
Prefer the primary record to the reporting about it. A filing, a gazette notice or a court listing settles questions that ten articles paraphrasing each other cannot, and it usually takes less time to obtain than the corroboration exercise it replaces.
Attribution posture is a decision to be made before the first query. Deciding after a subject has noticed your traffic is too late, and inconsistent posture across a team is more revealing than any single query.
Automation should widen collection, not conclusions. Tools are excellent at finding candidates and terrible at adjudicating them, so treat every automated link as a hypothesis requiring a human evidentiary decision.
Write the methods note as you go. Reconstructing what you searched, in what order, and what you discarded is nearly impossible a fortnight later, and it is exactly what a court, an editor or a peer reviewer will ask for.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Open Source Intelligence is producing anything, and they are worth baselining before you change process or tooling.

Share of load-bearing claims in delivered products that link to a preserved artefact with hash and retrieval timestamp, rather than to a live URL alone.
Reproduction rate: proportion of findings that a second analyst can independently reconstruct from the methods note without contacting the original author.
Median elapsed time from requirement agreed to first evidenced answer, tracked alongside the proportion of requirements answered without invoking specialist collection.
Proportion of corroborated claims where source independence was explicitly tested and documented, versus claims accepted on count of sources.
Rate of post-publication corrections attributable to verification failure, trended over time and reviewed for common causes rather than individual blame.
Percentage of case files closed with a recorded retention decision and third-party data minimisation applied within policy timescales.
Analyst wellbeing indicators for teams handling graphic material, including adherence to exposure limits and uptake of support, treated as a capability metric rather than a welfare afterthought.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Circular reporting, where several sources appear to corroborate but all trace back to one unverified origin.
Aggregators presented as sources. They repackage other people's data, often stale, without the original provenance.
Unmanaged attribution, where logged-in accounts, browser fingerprints or corporate addresses expose your interest to the subject.
Collection drift, where analysts gather what is easy to find rather than what answers the stated requirement.
Treating absence of evidence as evidence of absence in jurisdictions with poor digitisation or restricted registers.
Confirmation bias reinforced by search personalisation, which quietly surfaces material agreeing with your first hypothesis.

Legal and ethical considerations

Publicly available does not mean unrestricted. Terms of service, copyright, database rights and data-protection law all continue to apply to personal data gathered from open sources, and automated collection may breach contract even where content is visible to anyone. Establish a lawful basis, keep collection proportionate to the requirement, minimise data about uninvolved third parties, and set retention limits. Where findings may become evidence, preserve originals with hashes and a documented chain of custody.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Open Source Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 8 data points, 5 mission domains, 2 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Is open source evidence admissible?

It can be, but admissibility turns on how it was collected and preserved rather than on where it came from. Courts and accountability mechanisms look for a documented collection method, the original file rather than a screenshot, a hash taken at collection, an accurate timestamp with timezone, and an unbroken chain of custody. A contemporaneous note explaining what was searched and why supports the analyst's later testimony. The Berkeley Protocol is the reference standard for this in international accountability work, and domestic digital evidence guidance such as ISO 27037 covers the handling principles. Material collected casually is usually a lead, not evidence.

Does publicly available mean I can collect and keep it?

No. Public visibility does not remove data-protection obligations, contractual terms, copyright or database rights. Personal data collected from a public page is still personal data, requiring a lawful basis, proportionality, minimisation of information about uninvolved people and a retention limit. Platform terms frequently prohibit automated collection and republication even where a human may read the same content, and breaching them can create contractual exposure and taint the material. In several jurisdictions sustained monitoring of an individual's public activity is regulated as surveillance and needs authorisation. Establish the basis before collecting, not after a challenge.

How many sources make something confirmed?

Independence matters more than count. Three outlets republishing one agency report are one source. The test is whether each supporting item derives from a separate observation of the event: a different witness, a different photograph taken from a different position, a document produced by a different body. Two genuinely independent sources that agree on the specifics are worth more than a dozen that share an origin. Where you cannot establish independence, say so explicitly and lower the confidence rather than counting. Record the citation chain so a reader can check the reasoning themselves.

What is the right attribution posture for collection?

It depends on the subject's capability and motivation to notice, and on the legal and platform rules that apply. For most corporate and public-record work, ordinary browsing from a clean profile is appropriate and honest. Where the subject is a hostile actor with the ability to identify and react to visitors, use infrastructure that does not link to your organisation or client. Do not create false identities where the platform or jurisdiction prohibits it, and do not misrepresent yourself to obtain information from a person, which crosses into deception. Record the posture decision and its rationale in the case file.

How should graphic material be handled?

As an occupational hazard to be managed, not endured. Set exposure limits, mute audio by default, view in reduced size or greyscale where the analysis permits, and rotate analysts off sustained review. Use tooling that allows triage without full playback. Provide access to trained support and treat uptake as normal. On the output side, do not embed graphic content in reports; reference it in a controlled store instead. DART Center guidance on covering trauma is the practical reference. Teams that ignore this lose experienced analysts and produce worse work in the interim.

Should findings be published if they identify private individuals?

Only where identification is necessary to the public interest served and the harm is proportionate. Run a harm review with someone who did not do the collection: consider physical safety, legal exposure in the subject's jurisdiction, and the consequences of being wrong. Bystanders, victims and minors should not be identifiable. Where the finding concerns a public official acting in an official role, the balance shifts, but the evidentiary standard rises with the seriousness of the allegation. Offer a right of reply, and be prepared to explain publicly what you did and did not establish.

How do I stop an investigation expanding without limit?

Return to the requirement. Open source rewards curiosity, and the discipline is knowing when an interesting thread does not serve the decision the product supports. Set a collection plan with named indicators, review progress against those indicators rather than against volume collected, and log promising but out-of-scope leads in a separate register for a future requirement. Time-box exploratory phases explicitly. If the requirement changes, restate it and revise the plan formally rather than drifting, because unrecorded scope creep is where both wasted effort and disproportionate collection of personal data originate.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

Berkeley Protocol on Digital Open Source Investigations, which sets professional standards for the collection, preservation, verification and analysis of open source information for accountability purposes.
ISO/IEC 27037, governing identification, collection, acquisition and preservation of digital evidence and the documentation required to support later admissibility.
GDPR and equivalent data-protection regimes, which apply lawful basis, purpose limitation, minimisation, accuracy and storage limitation to personal data regardless of its public availability.
Admiralty or NATO source grading system, which separates the reliability of a source from the credibility of a specific item of information.
Intelligence Community Directive 203 analytic standards, which govern sourcing transparency, expression of uncertainty, and distinction between judgement and underlying information.
DART Center guidance on trauma-informed practice, which governs handling of graphic material and duty of care to analysts and to the people depicted.
Do no harm principles as applied in humanitarian and human rights documentation, governing the publication of information that could expose individuals or protected locations.
National regimes on directed and covert surveillance, such as the UK Investigatory Powers and RIPA framework, which can bring sustained monitoring of an individual's public activity within an authorisation requirement.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Berkeley Protocol on Digital Open Source Investigations — UN Human Rights Office and Human Rights Center, UC Berkeley. Standard methodology for open source investigation supporting accountability
Wayback Machine — Internet Archive. Public web archive used to preserve and date page states (archived copy — the publisher moved or withdrew the original)
OpenStreetMap — OpenStreetMap Foundation. Open global map database with full edit history
GDELT Project — GDELT. Open global news event and tone dataset across many languages
ACLED conflict event data — Armed Conflict Location and Event Data Project. Coded political violence and protest event dataset with source notes
Humanitarian Data Exchange — UN OCHA Centre for Humanitarian Data. Open repository of humanitarian datasets and administrative boundaries
Copernicus Data Space Ecosystem — European Space Agency and European Commission. Open access to Sentinel satellite imagery and derived products
Global LEI Index — Global Legal Entity Identifier Foundation. Open reference data for legal entity identification
Dart Center for Journalism and Trauma resources — Columbia Journalism School. Guidance on trauma-informed reporting and handling of distressing material
OCCRP Aleph — Organized Crime and Corruption Reporting Project. Cross-corpus search across public records, registries and document collections

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: planned collection, provenance capture and cross-source pivots without leaving an audit gap. Explore the platform, or browse the rest of the library by following any tag above.