What Is OSINT?

OSINT, or open-source intelligence, means collecting and analysing information that anyone can access, such as websites, public social media posts, official documents and ad libraries, to answer a specific question. At Debunk.org we use it to investigate disinformation. In 2022 our analysts looked at the accounts reacting to LRT English posts about the Kaliningrad sanctions, and found that "Manual analysis of 848 accounts revealed more than half of them (56.9 %) to be suspicious".

What does OSINT mean?

OSINT means intelligence built from open sources: public information that has been gathered, checked and analysed to answer a defined question. The Berkeley Protocol on Digital Open Source Investigations, published by the UN Human Rights Office (OHCHR) and the Human Rights Center at UC Berkeley School of Law (2022 edition), separates the two ideas.

Open source information is "information that any member of the public can observe, purchase or request, without requiring special legal status or unauthorized access". Open source intelligence, in the US intelligence definition that the Protocol quotes, is the part of that information "that is collected, exploited, and disseminated in a timely manner to an appropriate audience for the purpose of addressing a specific intelligence requirement".

In practice, a screenshot of a post is open source information. It becomes intelligence only when someone has checked it, placed it in context and used it to answer a question.

What counts as an open source?

An open source is anything a member of the public can see, buy or request without special status and without breaking in. In disinformation research, typical open sources include:

• websites, and the public records of who registered and hosts them;

• public social media posts, comments, profiles, pages and groups;

• public ad libraries kept by platforms;

• news articles, broadcasts and Telegram channels;

• official documents such as budgets, laws and press releases.

Our reports show how varied these sources are. For our 2022 report on Russian state spending on propaganda, "The information for this report was obtained from official channels of the Russian government, press releases, and sites collecting statistical data." For a 2022 study of the migrant crisis on Facebook, "The dataset was collected from 18th August 2021 to 12th January 2022 and consists of 327 Facebook groups which shared 1010 disinformation articles from 75 domains."

Most OSINT today is digital; the Berkeley Protocol describes digital open source information as "publicly available information in digital format, which is generally acquired from the Internet".

What falls outside the definition is just as clear. A private chat you were not invited to, an account you would need a false identity to enter, or data that someone obtained by breaking into a system is not open source information, because it needs access the public does not have.

Who uses OSINT, and for what?

Intelligence services, human rights investigators, courts and researchers all use OSINT. At Debunk.org we use public information to examine how disinformation and FIMI campaigns are built and spread, and our method page explains how we write up each case.

On 8 November 2024 the European External Action Service (EEAS) published How to Detect & Analyse Identity-Based Disinformation/FIMI: A Practical Guide to Conduct Open Source Investigations. Written about identity-based disinformation and FIMI, it notes that "OSINT’s ability to aggregate and analyse data from diverse, publicly available sources makes it an indispensable tool in detecting and countering FIMI and zooming into issue-specific attacks."

The Berkeley Protocol, written for human rights and criminal investigations, says that "Open source information can provide leads, support intelligence outputs and serve as direct evidence in courts of law."

How is OSINT used to investigate disinformation?

In disinformation research, OSINT shows who is spreading a message, how they do it and how far it travels, using the traces an operation leaves in public. Our reports give three common patterns.

Accounts change their names but keep their identity. In the Sprinter network on X, we found that "Despite facing multiple suspensions, these accounts evaded detection by regularly renaming themselves and continuing their operations under new identities". Checking the platform's account numbers behind the names gave the answer, "revealing only two unique account IDs despite different handles and names".

A few accounts produce most of the content. In our 2025 analysis of Belarusian Silovik content on X, we "identified five inauthentic accounts responsible for nearly all posts referencing Belarusian Silovik on the platform between May 2024 and July 2025". The report adds that "These accounts exhibit patterns associated with coordinated information operations, including identity impersonation, AI-generated content, and narrative localization".

Timing can give automation away: in a 2022 study of comments on Lithuanian social media, "the interval between each pair of comments was measured to detect possible patterns of automated behaviour". Of the profiles checked, "27% were accounts locked to others, and in total 58% of accounts were considered suspicious."

Outside research points the same way. The EEAS's 3rd report on FIMI threats (2025) found that disposable accounts, such as bot networks and coordinated inauthentic accounts, "dominate FIMI operations, accounting for 3 out of 4 (73%) recorded channels (28,000 out of 38,000)".

A worked example: suspicious accounts under the Kaliningrad posts (2022)

In September 2022 we published an analysis of the accounts that interacted with LRT English's social media posts about the Kaliningrad sanctions. The report combined manual checks of single accounts with automated analysis of the whole set, and then followed the links between them.

The manual check of 848 accounts is the finding quoted at the top of this page. The automated step showed that the "accounts interacting with the LRT English posts originated from 91 countries, with 57% of interactions from Africa and Asia". The last step "uncovered links between the suspicious accounts and an organised operation to buy access to established social media profiles".

The report uses the word "suspicious", not "bots", and so do we: public data can show that an account behaves oddly, not always who runs it.

What standards guide public interest OSINT?

Investigators who publish their OSINT work can follow the Guidelines for Public Interest OSINT Investigations, published in March 2023. In their words: "With the support of a European Union (“EU”) Project aiming to establish a European Fact-Checking Standards Network, this group of public-interest oriented OSINT practitioners established a working group to develop this set of Guidelines."

The EEAS's 2nd report on FIMI threats (January 2024) calls them "voluntary guidelines for investigators conducting public-facing Open-Source Intelligence (OSINT) work". They "build on existing frameworks, such as the Berkeley Protocol on Digital Open Source Investigations".

The working group "identified five overarching principles that relate to all stages of the public interest, public-facing open-source investigation process". The EEAS guide lists them: "accuracy, community, diversity, accountability, and balance and responsibility". Under accuracy, "The research should be clear, self-explanatory and written in a way that makes it possible for others to evaluate and replicate." Balance and responsibility means "focusing on what should be done over what technically can be done".

The guidelines also ask why an investigation is worth doing. Public interest "is distinct from ‘what the public is interested in’, focusing on public interest topics, which, if left unexposed and unaddressed, would jeopardise the democratic fabric of society and negatively affect people’s wellbeing." In practice, "Every operation should have a clear statement on how and why it contributes to the public interest and the impact it intends to achieve."

Read against these guidelines, our reports quoted above share some of these habits: they state their data and period, and word findings no more firmly than the evidence allows.

Is OSINT legal and ethical?

OSINT works with information that any member of the public may access, so the method needs no special powers; the legal and ethical questions come from how the information is collected, stored and used. Hacking, guessing passwords or using stolen data is not OSINT, because it needs access the public does not have, as in the definition above.

The EEAS guide notes that "OSINT itself is a neutral method, and its application depends on the context and intent of its users", and asks investigators to ensure "adherence to the General Data Protection Regulation (GDPR) and other relevant legal frameworks". The 2023 guidelines agree: "Researchers will need to adhere to data protection laws, for example the European General Data Protection Regulation (GDPR), as applicable in their country."

In the EU, the GDPR, in Article 4(1), defines personal data as "any information relating to an identified or identifiable natural person". The definition makes no exception for information that is public, so a public profile or post about a person is still personal data.

For sensitive categories such as political opinions or health, Article 9(2)(e) lifts the stricter ban only where "processing relates to personal data which are manifestly made public by the data subject". The general principles still apply, including that personal data are "processed lawfully, fairly and in a transparent manner" and "limited to what is necessary in relation to the purposes for which they are processed". This is the regulation's wording, not legal advice.

The Berkeley Protocol (2022) sets out ethical principles for open source investigators: "These include, at a minimum, protecting the dignity of all individuals who participate in or are implicated in an investigation, as well ensuring humility, inclusivity, independence and transparency."

Because open source material can end up as evidence, verification is part of the ethics too. The Protocol defines it as "the process of establishing the accuracy or validity of information that has been collected online".

What are the steps of an OSINT investigation?

The 2023 guidelines start with research design, which should "clearly define the objectives of the research and the process, tools and methods used to identify, collect, analyse, preserve and verify data, including how data samples will be constructed."

On collection, they accept that "Organisations may need to take steps to protect the security of their researchers, such as the use of sockpuppet accounts", and add: "However, data collection should not be based on deception."

Analysis "should consider the entirety of the dataset and not cherry-pick evidence in order to support research hypotheses", and includes "providing an honest confidence level of the findings". In the report, "Language and terminologies used should reflect the level of confidence achieved in data analysis, especially in listing conclusions and when assumptions and attributions are made."

The work continues after publication: "A reasonable effort should be made to follow up on the impact of the publication." The good practices listed include a "Corrections Policy - Update your publication in a timely and honest manner when required."

The Berkeley Protocol divides the process into six phases, from online inquiry to investigative analysis. Our page of OSINT investigation techniques goes through them in practice, with a worked case and the free tools we use.

How do you start learning OSINT?

Start with a question, not with a tool. Four steps are enough to begin:

1. Pick a small, public question. For example, who is behind a website, why one post spread, or where a photo was taken.

2. Try one free tool for that question. Finding who owns a website is a good first exercise, and search operators such as Google dorks make searches more precise.

3. Save and check what you find. Keep the link, the date and a copy, for example in a web archive such as the Wayback Machine, and confirm it before you rely on it.

4. Retrace a published investigation. Follow the checks in one of our reports and see what the evidence does and does not show.

That last step is how analysts learn to judge evidence. Our FIMI 101 course, a 10-hour, self-paced online course, covers the skills and tools to recognise, analyse and counter AI-driven disinformation and FIMI campaigns.

If you came here looking for tools:

• OSINT framework: a free directory of tools sorted by category, explained in our guide to the OSINT Framework; our free OSINT tools page lists free tools by task.

• Username search: tools that check where a username is used are on the tools page.

• Email OSINT: tools that check an email address are on the tools page.

What OSINT does not do

OSINT shows what is public; it cannot see what is hidden. Operators can stay anonymous, delete posts or use accounts that look real, and many cases end with patterns rather than names. In the Sprinter case, for example, the evidence supported this wording: "This connection points to the potential involvement of Belarusian state actors in the network's operations".

Public data is also incomplete, because platforms show some numbers and not others, and content is removed before anyone saves it. The 2023 guidelines ask that methods "be clear about methodological limitations, the scope of data/sources collected and used". OSINT gives a well-sourced answer to a narrow question; it does not replace access to platform data, official records or the people involved.

Frequently asked questions

What does OSINT stand for?

OSINT stands for open-source intelligence: information from public sources that has been collected, checked and analysed to answer a specific question.

What is OSINT used for?

Intelligence services, human rights investigators, courts and researchers use it. At Debunk.org we use it to trace disinformation campaigns, fake accounts and coordinated networks.

Is OSINT legal?

Collecting information that any member of the public can access is the basis of OSINT. Getting in where the public cannot, such as hacking or using stolen data, is not OSINT. Data protection and other laws still apply to how the information is stored and used.

What skills do you need for OSINT?

Precise searching, careful record-keeping, verification and clear writing about what the evidence shows.

Get our new analysis by email

We'll tell you when we publish a new article, with a short summary, and invite you to upcoming Debunk.org events.

Subscribe