Topical Dossier — Subject of Structural Interest
Fig. 0 — Schematic representation of the OSINT collection posture.
05.05.2026
Directorate Notice
What OSINT Actually Is
Open Source Intelligence — OSINT — is the systematic collection, verification, and analysis of information derived from publicly available sources. The term originated in military and intelligence contexts, designating a class of collection distinct from signals intelligence (SIGINT), human intelligence (HUMINT), and imagery intelligence (IMINT). Its distinguishing characteristic is that the raw material is, in principle, accessible to anyone. The discipline is not about hacking. It is about looking, systematically, at what has already been left in the open.
What constitutes “publicly available” has expanded to an extraordinary degree over the past two decades. Social media platforms, public registries, satellite imagery services, data broker aggregation pipelines, court record databases, domain registration archives, publicly accessible APIs, and — increasingly — AI-assisted analysis of the resulting datasets have collectively produced an information environment in which the average person’s digital footprint contains more personally identifiable data than the classified files of most Cold War intelligence targets. The difference is that this data is not locked away. It is distributed across hundreds of platforms and services, each of which considers itself to be offering a convenience feature. In aggregate, they constitute a surveillance infrastructure operated by no single entity and accessible by any sufficiently motivated party.
As of 2026, OSINT is practised by intelligence agencies, journalists, private investigators, academic researchers, corporate security teams, non-governmental organisations, volunteer communities, and individuals with personal or adversarial motivations. The techniques are formally taught in law enforcement training programmes, covered in university curricula, documented in publicly available handbooks, and discussed in open online communities with hundreds of thousands of members. The knowledge barrier to entry is low. The barrier to misuse is, correspondingly, the same.
The Practitioner Landscape — Who Is Doing This
The OSINT community is not monolithic. Its practitioners span the full spectrum of institutional legitimacy and personal motivation, and it is a category error to characterise any single actor type as representative of the discipline as a whole. The Directorate documents the following practitioner categories, each of which uses overlapping but not identical toolchains:
Known Toolchain — Overview by Category
Social media intelligence — SOCMINT — is the most widely practised branch of OSINT and the one most immediately relevant to private individuals who are not public figures, do not operate businesses, and have no professional reason to consider themselves targets of any intelligence-gathering activity. It does not require specialist tools or technical knowledge. It requires an internet connection and patience. The practitioner’s primary raw material is information the subject provided voluntarily.
A private individual with a Facebook account, an Instagram profile, a LinkedIn page, an X/Twitter presence, and a Reddit account may believe they have provided limited personal information to each of these platforms individually. In aggregate, the five accounts may disclose: full name, date of birth, employer, job title, home city (sometimes street or neighbourhood), relationship status, political orientation, religious affiliation, school and university attended, physical appearance across multiple years, hobbies and routine activities, social network including names and relationships of friends and family members, travel patterns, consumer preferences, and — through photograph metadata, location tags, and check-ins — a partial geolocation history. This information was provided consensually to the platforms. It was not necessarily intended to be aggregated and cross-referenced by a third party. The distinction between these two facts is significant.
- Username Correlation — The Handle as Primary Identifier A consistent username used across multiple platforms constitutes a pivot point that allows any practitioner to aggregate all associated accounts into a unified profile. Tools including Sherlock, Namechk, WhatsMyName, and KnowEm query hundreds of platforms simultaneously for a given username and return a map of the subject’s platform presence. A username used consistently across a gaming platform, a Reddit account, a Discord server, and a professional forum — each of which reveals different information — is a structural vulnerability. The aggregation is trivial and automated. The fix — using different usernames across platforms — is underutilised.
- Photograph Analysis — Faces, Backgrounds, and Inadvertent Disclosure A photograph uploaded to social media carries multiple information vectors. The face itself is queryable via facial recognition tools including PimEyes, Google Lens, and Yandex Image Search, each of which may surface additional images of the subject across other platforms or news articles. The background of the photograph may disclose location — architectural landmarks, street furniture, vegetation, or signage that is geolocation-verifiable via Google Street View or satellite imagery. The EXIF metadata embedded in the image file may contain GPS coordinates, device model, and timestamp if stripping was not performed by the platform or the poster. Reflection analysis in windows, mirrors, or glasses has identified locations from photographs believed to contain no identifying information.
- Social Graph Mapping — Identifying the Network Around a Subject A subject who maintains strict personal privacy but maintains social connections with individuals who do not constitutes a partial privacy failure. Tagged photographs, mention patterns, group memberships, and interaction analysis on public accounts allow practitioners to map a social network even when the central subject’s own account is locked. Family members who tag locations, friends who upload photographs including the subject, and colleagues who identify workplace relationships in their own public profiles collectively disclose information the subject may believe they have withheld.
- Temporal Pattern Analysis — Routine as Vulnerability Regular posting patterns, check-in timestamps, and activity schedules disclosed across social media allow reconstruction of a subject’s routine — when they leave home, where they exercise, which coffee shop they use, which pub they frequent. Physical security researchers have documented that this information, aggregated over weeks of public social media observation, produces a predictive schedule accurate enough for physical surveillance planning without any requirement for the observer to be present at the location.
The data broker industry is a documented multi-billion dollar commercial ecosystem that aggregates personal data from public records, loyalty card programmes, purchase histories, electoral rolls, property registries, court records, social media scrapes, and data-sharing agreements, then sells access to that aggregated data to third parties. These third parties include marketers, insurance companies, employers, background check services, private investigators, and — with varying but often insufficient verification requirements — the general public via “people-search” platforms.
Platforms including Spokeo, WhitePages, BeenVerified, Intelius, PeopleFinders, TruthFinder, ZoomInfo, and dozens of others maintain profiles on hundreds of millions of individuals containing name, current and historical addresses, relatives’ names, phone numbers, email addresses, employment history, financial information indicators, and criminal records where publicly available. In most cases, the subject of the profile was never asked for permission and has no awareness the profile exists. Opt-out mechanisms exist for most platforms but require individual requests to each broker separately, are frequently re-populated from fresh data aggregation, and, in some jurisdictions, are not legally enforceable.
- Electoral Roll and Public Record Integration — Mandatory Disclosure as Data Feed In many jurisdictions, electoral registration data is legally mandated and partially or fully publicly available. Property ownership is a matter of public record in most Western legal systems. Court records, including bankruptcy proceedings, civil disputes, and in some jurisdictions criminal records, are routinely public. Data brokers aggregate these mandatory disclosures — which subjects provided not voluntarily but as a legal requirement of civic participation — and resell access to them. The subject has no practical mechanism for preventing this collection at source.
- The Relatives Graph — Consent Contamination Data broker profiles routinely list “known associates” and family members, derived from address co-residence history, shared phone numbers, and social media cross-referencing. A subject who has successfully removed their own profile from a broker’s database may be re-identifiable via their family members’ profiles, which the broker continues to maintain and which reference the subject by name and relationship. Privacy is not individual in an ecosystem that models social graphs.
- Historical Address Chains — Movement History as Permanent Record Data broker profiles typically contain a “previous addresses” field compiled from address history across all data sources. This field may contain every address a subject has lived at over the preceding decade or more, including addresses to which the subject moved specifically to escape a prior situation. Domestic violence support organisations have documented cases in which data broker profiles provided former partners with current address information for protected individuals.
The data broker ecosystem processes more personal data on more individuals than the surveillance programmes exposed by Edward Snowden in 2013 — with fewer legal restrictions, no oversight mechanism, and active commercial incentives to maximise data collection and accessibility. The difference is that the broker ecosystem was built with the consent of legislatures that did not anticipate its aggregate effect, whereas the surveillance programmes were conducted in explicit legal secrecy. Both produce functionally similar capabilities in the hands of whoever can afford the subscription fee.
Geolocation intelligence — the discipline of determining or verifying a physical location from available evidence — was, until recently, a specialist skill practised by military imagery analysts and geographic information system professionals. Since approximately 2014, the open-source community around Bellingcat and related organisations has documented and taught techniques for civilian geolocation using freely available satellite imagery, street-level photography services, and social media metadata that have been applied to verify or disprove claims about events in conflict zones, locate missing persons, and — demonstrably — identify private individuals’ home addresses from publicly posted photographs.
The widespread availability of high-resolution satellite imagery via Google Earth, Planet Labs, Maxar, and Sentinel Hub; the coverage of Google Street View, Apple Maps Flyover, and comparable services across most of the populated world; and the integration of location data into smartphone photographs and social media posts collectively mean that a motivated practitioner can frequently geolocate a photograph to within metres using open resources. The skill is teachable, is publicly documented, and has been demonstrated repeatedly to work on photographs taken with no intent to disclose location.
- EXIF Metadata — Coordinates Embedded in the Image File Itself Photographs taken on smartphones contain EXIF metadata — embedded data fields recording device make and model, timestamp, camera settings, and — when location services are enabled — GPS coordinates accurate to within a few metres. Many social media platforms strip EXIF data on upload; many do not, and this varies by platform, by upload method, and by platform policy changes that users typically do not track. A photograph uploaded directly from a device to a platform that preserves EXIF data discloses the precise location at which it was taken. A photograph shared via a messaging application or email preserves full EXIF data by default.
- Visual Geolocation — Landmarks, Shadow Angles, and Environmental Cues In the absence of EXIF data, a practitioner with access to a photograph can use visible environmental cues to geolocate the image: architectural style, street furniture design, vegetation type, visible signage (even partially), shadow angle relative to time of year, mountain or coastline profiles, or distinctive road markings. The Bellingcat community has demonstrated publicly that images from conflict zones — with all identifying text removed and taken at apparent random — can be geolocated to specific streets using satellite imagery comparison alone. The same techniques are applicable to any photograph.
- Smartphone Location Data Markets — Commercial Aggregation of Movement Smartphone applications request location permissions for functional reasons — navigation, weather, local search — and, in many cases, resell or share that location data with third-party brokers as a secondary revenue stream. This data, aggregated across millions of users, has been commercially available in de-anonymised or pseudonymised form. Journalists and researchers have repeatedly demonstrated that “anonymised” location datasets are re-identifiable: a dataset showing a device that travels between a single residential address and a specific workplace each weekday is effectively identified, even without a name attached. The military-grade location data broker Anomaly Six was documented selling device movement data to customers including government agencies without user knowledge or specific consent.
- IP Address Geolocation — Network Presence as Physical Indicator An IP address does not typically resolve to a precise physical address, but it typically resolves to a city, ISP, and organisation that narrows the subject’s physical location to a meaningful degree. Forums, game servers, and services that log IP addresses — including many that do so without disclosing this in their terms of service — constitute geolocation data points. For subjects operating behind a home broadband connection without a VPN, IP address data, combined with other vectors, provides a useful if imprecise location indicator.
For subjects who operate websites, run servers, use custom email domains, or maintain any form of technical internet presence, an additional set of OSINT vectors applies beyond those available against purely social media profiles. Domain registration records, DNS configurations, SSL certificate transparency logs, and historical hosting data collectively expose infrastructure relationships and, frequently, the personal details of the individuals who registered or operate that infrastructure.
- WHOIS and Historical Registration Data — The Registrant’s Paper Trail Domain registration requires submission of registrant contact information — name, address, email, phone number — to the domain registrar. While GDPR and similar regulations have removed much of this data from publicly accessible WHOIS records for European registrants, historical WHOIS data — captured before privacy regulations took effect — is archived by services including DomainTools and SecurityTrails and remains searchable. A domain registered in 2015 with a personal email address and home address, subsequently masked with privacy protection services, may still be historically attributed via archived WHOIS records.
- Certificate Transparency Logs — SSL Issuance as Disclosed Infrastructure Every SSL/TLS certificate issued for a domain is recorded in public certificate transparency logs as a regulatory anti-fraud measure. These logs are searchable via tools including crt.sh and Censys. A subject who operates multiple domains — including those they have not publicly associated with their identity — may be linkable across domains via shared SSL certificate issuance patterns, shared registrar accounts, or shared hosting infrastructure. Subdomains disclosed in certificate logs are frequently not intended for public discovery.
- Email Address as Universal Pivot — Breach, Registration, and Identity Correlation An email address functions as a near-universal identifier across the digital ecosystem. Tools including Hunter.io, Holehe, and breach data search services allow a practitioner to determine, from a single email address, which platforms the address is registered on, whether it appears in known breach datasets (and therefore what associated password, username, and profile information may be cross-referenced), and what other data has been publicly associated with it. The combination of an email address with a breach database query is among the most consistently productive OSINT starting points for individual subject profiling.
The integration of large language models, multimodal AI systems, and automated analysis pipelines into OSINT practice represents the most significant capability escalation in the discipline’s civilian history. Tasks that previously required hours of manual correlation — cross-referencing names across platforms, summarising leaked document sets, analysing large image collections for recurring faces or locations, generating synthetic social media profiles for cover identities, or identifying patterns in communication metadata — are now partially or fully automatable using commercially available AI tools. The capability uplift is distributed: it is available to the security researcher and the stalker with equal accessibility.
- LLM-Assisted Data Synthesis — Aggregation at Scale Large language models integrated with OSINT data sources can be used to process and synthesise large volumes of collected data into structured subject profiles significantly faster than manual analysis. The researcher who previously spent hours reviewing forum posts, social media histories, and public records can now process the same data in minutes using AI-assisted analysis pipelines. This does not change what data is available; it changes the speed and scalability with which it can be processed, effectively lowering the effort threshold for comprehensive profiling of private individuals.
- Synthetic Media and Persona Construction — AI-Generated Cover Identities AI image generation tools produce photorealistic portraits of faces that do not correspond to any real person. These generated faces are used to create cover social media profiles — “sock puppets” — with no real-world counterpart to trace. The ThisPersonDoesNotExist methodology, initially requiring dedicated model access, is now reproducible with general-purpose image generation tools. The use of synthetic faces in fake accounts conducting targeted harassment, coordinated influence operations, and social engineering attacks has been documented extensively. Detection tools exist but consistently lag behind generation capability.
- Voice Cloning and Video Synthesis — Identity Spoofing Beyond Text AI voice cloning tools requiring only a few seconds of sample audio can produce convincing synthetic voices of real individuals. Video synthesis tools — deepfake systems — can place a target’s face and voice into fabricated video contexts. The forensic identification of synthetic media remains technically demanding and is not consistently accessible to non-specialist audiences. These capabilities are relevant to OSINT in their use for social engineering (phone and video calls impersonating known individuals), evidence fabrication, and targeted reputation attacks using fabricated compromising content.
- AI-Assisted Facial Recognition at Scale — The Clearview AI Precedent Clearview AI assembled a facial recognition database of over 30 billion images scraped from public social media, news sites, and other web sources without the knowledge or consent of the individuals photographed. Its system allows a query photograph to be matched against this database and returns sources where the face appears — effectively reverse-searching the visible web for a face. Initially sold exclusively to law enforcement, its use has been documented across government agencies in multiple countries. The technology — if not this specific vendor — represents a capability that, at varying levels of accuracy, is increasingly accessible beyond law enforcement contexts.
Analytical Section — Who Gets Targeted and Why
OSINT-based profiling does not require a specific adversary, a government intelligence service, or a professional private investigator. The techniques documented in this file are practised by individuals with personal motivations — former partners, online antagonists, individuals with grievances real or imagined — using free or low-cost tools requiring no technical background. The Directorate documents the following threat actor categories, each with a distinct operational profile.
The Threat Taxonomy — Who Is Looking and What They Are Looking For
1. Hostile Former Intimates. The most common threat actor in documented OSINT-facilitated harassment and stalking cases. Motivations: location of a subject who has left a situation; monitoring of a subject’s movements and associations; collection of compromising material. Toolchain: typically basic — people-search platforms, social media monitoring, reverse image search. Effectiveness: high, because most private individuals have not adopted counter-OSINT measures. This threat is not exotic. It is the most statistically significant category.
2. Online Antagonists and Coordinated Harassment Groups. Individuals or organised communities that target subjects for harassment, typically following disagreements on social media, gaming platforms, or public forums. Practices documented include “doxing” — the public disclosure of a target’s real name, address, employer, and family members’ details — coordinated harassment of employers and family, and extended surveillance of a target’s online activity. The OSINT component is typically the initial doxing package; the harassment campaign is the subsequent use of that package.
3. Corporate and Competitive Intelligence. Organisations conducting due diligence on individuals — potential hires, counterparties, investment targets — or monitoring competitors and their key personnel. Generally legal, generally disclosed (in the sense that the organisation knows it is doing it), and generally using professional tools with subscription data sources. The distinction between legitimate background checking and corporate surveillance of individuals is contested in most jurisdictions and rarely resolved in favour of the subject.
4. Law Enforcement and Government Agencies. Documented extensive users of OSINT techniques, data broker access, and — in multiple jurisdictions — commercial location data purchases that circumvent the legal warrant requirements applicable to direct surveillance. The legal framework governing government OSINT collection is jurisdiction-dependent, contested, and in several documented cases has been conducted without the statutory authorisation that direct surveillance would have required.
5. Researchers, Journalists, and Civil Society Investigators. Practitioners using the same techniques for public interest purposes — war crime documentation, disinformation tracking, missing persons, investigative journalism. This category uses identical toolchains to the categories above. The distinction is intent and application, not capability. The Directorate notes that the legitimacy of investigative journalism and the illegitimacy of stalking are not separable at the level of the technique; they are separable only at the level of purpose and accountability.
- Username Segregation — Eliminate the Universal Pivot Use distinct usernames across different contexts — professional, social, gaming, political, hobby. The username that cannot be correlated across platforms cannot be used as a pivot point for cross-platform aggregation. This is the single highest-impact low-cost counter-measure available to private individuals. Tools including Sherlock and WhatsMyName work by searching for the same username across hundreds of platforms simultaneously. A unique username per platform is immune to this attack vector. The cost: the administrative overhead of managing multiple identities. The benefit: elimination of the most productive OSINT pivot point.
- Email Address Compartmentalisation — One Address per Context Maintain separate email addresses for: professional correspondence, social media registration, financial and government correspondence, and personal communications. A single email address used across multiple contexts is a universal identifier that links all those contexts to a single profile. Services including SimpleLogin, AnonAddy, and Apple’s Hide My Email allow the creation of unique, forwarding email aliases for each service — providing functional email addresses that do not disclose a master address and that can be deleted individually if compromised. This eliminates email as a cross-platform correlation pivot.
- Data Broker Opt-Out — Remove Existing Profiles Manually opt out of data broker profiles at the major aggregators: Spokeo, WhitePages, BeenVerified, Intelius, PeopleFinders, Radaris, MyLife, PeopleSmart, and the dozens of others. Services including DeleteMe (subscription) and Privacy Bee automate the opt-out process across hundreds of brokers and monitor for re-population. Manual opt-out is free but time-consuming and requires repetition every three to six months as brokers re-aggregate from fresh sources. This does not eliminate all broker data — historical snapshots, secondary brokers, and jurisdiction-specific data sources persist — but it reduces the accessibility of current-address and contact data significantly.
- Social Media Audit — Inventory and Lock Down Existing Disclosure Conduct a systematic audit of all existing social media profiles from the perspective of a practitioner with no prior knowledge of the subject. Review what information is publicly accessible: tagged locations, employment, family connections, routine activity patterns, and historical posts. Enable maximum privacy settings on all platforms. Remove or restrict high-sensitivity content: home location indicators, family member tags, workplace details, and routine schedule disclosures. Review friends’ and connections’ public posts for references that may disclose information about the subject indirectly. This is remediation of existing exposure rather than prevention of future exposure.
- EXIF Stripping — Remove Embedded Metadata from Photographs Before Sharing Before uploading or sharing photographs, strip EXIF metadata to eliminate embedded GPS coordinates and device information. On iOS: use the native “Adjust Location” feature before sharing. On Android: native options vary by device; dedicated apps including Scrambled EXIF and Photo Exif Editor perform this function. Desktop applications including ExifTool provide comprehensive metadata stripping. Most major social media platforms strip EXIF on upload — but messaging applications, email, and direct file sharing generally do not. The safe assumption is that any photograph shared outside a major social platform retains full EXIF data.
- VPN Usage — Masking IP-Based Geolocation A reputable VPN (Virtual Private Network) service routes internet traffic through servers in a location of the user’s choosing, replacing the user’s home IP address with the VPN server’s IP address in logs maintained by websites, services, and platforms. This eliminates IP address as a geolocation indicator and as a cross-platform correlation tool. Recommended providers as of 2026 with documented no-log policies and independent audits: Mullvad (accepts anonymous cash payment, no account required), ProtonVPN (Swiss jurisdiction, open source client), and IVPN. Free VPN services should be treated with significant scepticism: the service must be monetised, and in many documented cases, that monetisation involves the sale of user traffic data — the precise data the user is attempting to protect.
- Password Manager and Unique Credentials — Breach Isolation A unique, randomly generated password for each service eliminates credential reuse as a cross-platform correlation tool. Breach data frequently includes password hashes or, in poorly implemented cases, plaintext passwords. A practitioner with access to breach data can identify accounts using the same password across services and correlate them to a single individual. A password manager — Bitwarden (open source), 1Password, or KeePassXC (offline) — generates and stores unique credentials per service, eliminating this vector entirely while providing the additional security benefit of preventing credential-based account compromise.
- Virtual Phone Numbers — Separating Identity from Telecommunications Phone numbers function as identity anchors across an increasing range of services — SMS two-factor authentication, WhatsApp and Signal registration, account recovery, and data broker records. A virtual phone number service (Google Voice in the US; various VOIP providers internationally) provides a functional phone number disconnected from a real SIM registration for use with non-critical services. For high-sensitivity accounts, dedicated SIMs purchased without identity registration (in jurisdictions where this remains legal) provide a communications channel not linked to a subject’s primary telecommunications identity.
- Browser Fingerprint Hardening — Beyond IP Masking Browser fingerprinting — the identification of a specific browser instance via the combination of browser type, version, operating system, screen resolution, installed fonts, time zone, and dozens of other attributes — allows cross-site tracking and identification that persists regardless of VPN use or cookie clearing. A VPN masks your IP; it does not mask your browser fingerprint. Mitigation: the Tor Browser presents a standardised fingerprint identical to all other Tor Browser users, eliminating individual distinguishability. The Brave browser provides significant fingerprint randomisation for users unwilling to use Tor. Firefox with appropriate extensions (uBlock Origin, Canvas Blocker) provides partial mitigation.
- Address Compartmentalisation — Separating Physical Identity from Digital Presence For individuals with elevated threat models, the use of a private mailbox service (CMRA — Commercial Mail Receiving Agency) — distinct from a PO Box in that it provides a street address format — for all correspondence, domain registration, and government-adjacent documentation reduces the traceability of a residential address through public records. Company formation in jurisdictions with nominee director services can provide a further layer of separation for business-related public record requirements. The use of trusted nominees for electoral registration is legally available in several jurisdictions for individuals with documented safety concerns. These measures are relevant for individuals facing documented high-threat scenarios; they represent significant administrative overhead for routine privacy protection.
- Operational Compartmentalisation — Information Hygiene as Practice The most structurally effective counter-OSINT measure is the adoption of information hygiene as an ongoing practice rather than a one-time remediation exercise. This means: not sharing precise location in real time or near-real time on any platform; not tagging family members in ways that create mappable social graphs; not disclosing routine schedules, commute patterns, or predictable location data; using separate devices or browser profiles for separate identity contexts; and periodically re-auditing one’s own digital footprint from the perspective of a practitioner with no prior knowledge — the exercise that most consistently reveals residual exposure.
- Facial Recognition Countermeasures — The Emerging Frontier Documented academic countermeasures to facial recognition include adversarial makeup patterns (CV Dazzle — high-contrast geometric patterns that disrupt facial detection algorithms), infrared LED accessories that blind camera sensors without visible effect, and — less practically — hairstyle and clothing choices that disrupt key landmark detection points. The effectiveness of these measures against current commercial facial recognition systems is variable and degrades as systems improve. The most durable countermeasure against reverse facial search is the non-publication of clearly identifiable photographs in contexts that link to a subject’s identity. This is less a technical measure than an information hygiene practice.
The measures above are not presented in the expectation that any individual will implement all of them. They are presented in the expectation that any individual will identify the measures most relevant to their actual threat model and implement those. A person with no reason to fear a sophisticated adversary who simply wishes to reduce their commercial data broker exposure and eliminate the username correlation vector has a straightforward, low-cost action set: a password manager, username diversity, and a data broker opt-out service. A person with a documented high-threat adversary requires the Tier Three measures and should additionally consult with a professional security practitioner. The gap between these two scenarios is significant. Most private individuals occupy the former.
The legal status of OSINT collection is jurisdiction-dependent, rapidly evolving, and — in several key areas — genuinely ambiguous. What is legal in one jurisdiction may constitute a criminal offence in another. What is legal as a collection technique may become illegal at the point of application. The Directorate documents the framework without rendering legal advice, which falls outside its mandate.
- Publicly Available vs. Authorised Access — The CFAA Boundary (USA) The Computer Fraud and Abuse Act (US) and comparable legislation in other jurisdictions criminalises unauthorised access to computer systems but — following the Van Buren v. United States Supreme Court decision (2021) — does not straightforwardly criminalise access to data that is technically publicly accessible even if that access violates a website’s terms of service. The practical boundary between legal OSINT collection and illegal access to computer systems remains contested in active litigation, varies by jurisdiction and specific technique, and has not been definitively resolved for several key OSINT practices including automated scraping of platforms that prohibit it in their terms of service.
- GDPR and Data Protection Frameworks — European Rights and Their Limits The EU General Data Protection Regulation grants individuals rights to access, correct, and request deletion of personal data held by data controllers. Data brokers operating in or processing data of EU residents are subject to GDPR’s requirements, which include legitimate purpose requirements for data processing. In practice, GDPR enforcement against data brokers has been inconsistent; data brokers domiciled outside the EU but processing EU resident data occupy a legally contested space; and the right to erasure is not absolute, being subject to countervailing interests in freedom of expression, public interest, and archival purposes. For UK residents post-Brexit, equivalent provisions exist under the UK GDPR but enforcement and interpretation is diverging from EU practice.
- Doxing — Legal Status Remains Inconsistent The act of publishing a private individual’s personal information — address, workplace, family details — gathered through OSINT techniques is treated inconsistently across jurisdictions. In several US states, doxing with intent to harass is a criminal offence; in others, it is not specifically addressed. In the UK, doxing-facilitated harassment may be prosecuted under the Protection from Harassment Act or the Online Safety Act 2023, but the collection of information itself — as distinct from its weaponised publication — is not specifically criminalised. The European Union’s Digital Services Act imposes obligations on platforms regarding doxing content but does not create individual criminal liability for collectors. The legal gap between collecting and weaponising doxing-relevant information is significant and inconsistently addressed.
- Government Purchase of Commercial Data — The Warrant-Avoidance Controversy Multiple documented cases have established that US government agencies — including the NSA, DHS, FBI, and military intelligence components — have purchased commercially available location data, social media analytics, and data broker profiles in circumstances where obtaining the same data through direct collection would have required a court-issued warrant or other legal authorisation. The legal rationale is that purchasing data that is commercially available to any buyer does not constitute a “search” under the Fourth Amendment. This practice is the subject of ongoing litigation, legislative proposals, and — in the case of the data brokered location data — an FTC consent order that restricts but does not eliminate the practice. The practical implication is that the commercial data ecosystem accessible to any individual with a subscription fee is also accessible to government actors at a scale that existing warrant requirements do not constrain.
Analytical Section — The Structural Architecture of the OSINT Threat
Formalised Analysis — Why the Threat Is Understated
1. The Aggregation Problem. Each data source in the OSINT ecosystem, examined individually, appears benign. A publicly accessible LinkedIn profile. A voter registration record. A decade-old Instagram post. A photograph with unstripped EXIF data. An email address in a 2019 breach dataset. None of these, individually, constitutes a meaningful threat. Aggregated by a practitioner with a few hours and access to freely available tools, they constitute a comprehensive profile of an individual’s identity, location, relationships, routine, and history that no intelligence service in the Cold War era would have considered obtainable without significant operational effort. The threat is not in any individual data point. It is in their combination. Individuals assess each data point in isolation; practitioners aggregate them systematically.
2. The Consent Gap. The data that constitutes most OSINT targets’ profiles was, in many cases, provided voluntarily — but not with the expectation or awareness that it would be aggregated, cross-referenced, and made accessible to anyone with an internet connection and a motive. The consent given to a social media platform to display one’s employment history was not consent to have that employment history correlated with a residential address derived from voter registration data and a location derived from photograph EXIF metadata by an unknown third party. The legal frameworks governing this gap are, as Module G documents, inconsistent and inadequate in most jurisdictions.
3. The Asymmetry of Effort. The effort required to profile an individual using OSINT techniques is substantially lower than the effort required to protect against that profiling. A practitioner can produce a useful profile of an average private individual in under an hour using free tools. A private individual who wishes to reduce their attack surface to an equivalent degree must invest hours of initial remediation followed by ongoing information hygiene discipline. This asymmetry is structural. It is built into the architecture of the platforms and data systems involved and is not resolved by any individual user action.
4. The AI Escalation Curve. The capability uplift introduced by AI-assisted OSINT — documented in Module E — is a structural change rather than an incremental development. The reduction in time and skill required to perform comprehensive OSINT aggregation, combined with the AI-enabled capability for synthetic identity construction, voice and video cloning, and automated surveillance at scale, has altered the threat model for private individuals in ways that the countermeasures currently available were not designed to address. The countermeasures in Module F remain valid and important; they were adequate against the pre-AI threat model. Their adequacy against the AI-accelerated threat model is, as of May 2026, under active assessment by the security research community.
What the Evidence Already Establishes
Comparative Summary — OSINT Vectors and Countermeasures
| Vector | Primary Tool(s) | Data Surface | Threat Level | Primary Countermeasure |
|---|---|---|---|---|
| Username Correlation | Sherlock, WhatsMyName | Cross-platform profiles | HIGH | Unique usernames per platform |
| Facial Recognition Search | PimEyes, Yandex, Clearview | Photos across web | HIGH | Limit photo publication; facial variation |
| Data Broker Aggregation | Spokeo, BeenVerified, Intelius | Public records, purchases | HIGH | DeleteMe / manual opt-out; CMRA address |
| EXIF Metadata | ExifTool, ExifPurge | Photo file metadata | HIGH | Strip before sharing; disable GPS in camera |
| Social Graph Mapping | Maltego, Manual review | Social connections | HIGH | Privacy settings; educate social network |
| Breach Data / Email Pivot | HIBP, Intelligence X, Dehashed | Leaked datasets | HIGH | Unique email per service; password manager |
| IP Geolocation | IP-API, Shodan, Forum logs | Network traffic logs | MEDIUM | Reputable VPN (Mullvad, ProtonVPN) |
| WHOIS / Domain History | DomainTools, SecurityTrails | Registration records | MEDIUM | WHOIS privacy; non-personal registrant details |
| Smartphone Location Data | Commercial data brokers | App telemetry | HIGH | Deny location permissions; review app access |
| AI-Assisted Aggregation | LLM pipelines, custom tooling | All above simultaneously | ESCALATING | Reduce source data; compartmentalise |
| Browser Fingerprinting | Third-party scripts | Browser session data | MEDIUM | Tor Browser; Brave; Firefox + uBlock |
| Synthetic Persona / Deepfake | DALL·E, ElevenLabs, et al. | AI-generated content | HIGH / EMERGING | Media literacy; verification practice |
Archival Status & Classification
OSINT — as a discipline, an ecosystem, and a threat model — is assessed by this Directorate as one of the most structurally significant information developments of the past decade for private individuals who have no awareness of it and no professional reason to have considered it. The discipline was not invented to target private individuals; it was developed to understand foreign governments, criminal organisations, and large-scale disinformation operations. The tools are neutral. The question of who applies them, to whom, and under what accountability framework is not resolved by the existence of the tools.
The countermeasures documented in this file are real, available, and in most cases free or low-cost. They are underutilised not because they are difficult but because the threat they address is invisible: the OSINT practitioner building a profile of a private individual does so without any communication that profiling is occurring. The absence of a notification is not the absence of collection. It is a feature of the architecture.
The most significant counter-OSINT measure is not technical. It is epistemic: understanding that the information environment in which private individuals operate is a collection environment in which every voluntary disclosure, every photograph, every account registration, and every public record represents a data point available to any motivated party. That understanding, applied practically, produces the behaviour changes that reduce the attack surface. No single tool resolves the problem. No single decision protects comprehensively. The discipline is ongoing. The eye is always open.
Recommended classification: STRUCTURAL CONCERN — AMBER/RED TIER — DUAL-USE DISCIPLINE — COUNTERMEASURES AVAILABLE — AWARENESS DEFICIT: CRITICAL
Source References & Further Reading
- OSINT Framework — tool directory: osintframework.com
- Bellingcat — open source investigation methodology: bellingcat.com/resources/how-tos
- Have I Been Pwned — breach data check: haveibeenpwned.com
- Bellingcat Geolocation Handbook: bellingcat.com — Geolocation Guide
- The Privacy, Security, and OSINT Show (Michael Bazzell): inteltechniques.com/podcast
- IntelTechniques Workbook — Michael Bazzell: inteltechniques.com/book1
- DeleteMe — data broker opt-out service: joindeleteme.com
- Mullvad VPN — no-log, anonymous provider: mullvad.net
- ProtonVPN — Swiss jurisdiction, open source: protonvpn.com
- SimpleLogin — email alias service: simplelogin.io
- Bitwarden — open source password manager: bitwarden.com
- Sherlock — username search across platforms: github.com/sherlock-project/sherlock
- ExifTool — metadata inspection and removal: exiftool.org
- SpiderFoot — automated OSINT aggregation: spiderfoot.net
- Maltego — graph-based link analysis: maltego.com
- Trace Labs — OSINT for missing persons: tracelabs.org
- OSINT Curious Project — community and resources: osintcurio.us
- FTC — Data Broker Practices Report (2014, updated): ftc.gov/reports/data-brokers
- Anomaly Six — location data brokerage documentation (WSJ): wsj.com — Location Data Contractors
- Van Buren v. United States (2021) — Supreme Court CFAA ruling: supremecourt.gov — Van Buren Opinion
- Clearview AI — litigation and database documentation: aclu.org/cases/aclu-v-clearview-ai
- EFF — Surveillance Self-Defence Guide: ssd.eff.org
- Privacy International — commercial surveillance documentation: privacyinternational.org
Last updated: May 2026. Compiled by the Directorate of Information Preservation and Archival, Realm33.org. The Directorate notes, for completeness, that the compilation of this file was itself an exercise in open source research, and that every source cited herein was obtained without accessing any system that did not explicitly offer public access. The eye does not require permission to be open. This is the point of the file.