Lesson 2.4

Ethics and Harm

Learning Objectives

After this, students can explain why legal and ethical are not the same, and why “it was public” isn’t a complete justification.
After this, students can describe the mosaic effect and give an example of harmless facts combining into a harmful profile.
After this, students can apply minimization and proportionality to decide what to collect and what to leave out.
After this, students can handle breach data, sensitive data, and accidental discoveries responsibly.
After this, students can name the Berkeley Protocol and its three groups of principles as a professional ethics framework.

Legal Is the Floor, Not the Ceiling

The previous file covered what the law prohibits. Ethics asks a different question: should you do this, even if it’s legal?

Plenty of legal OSINT activity is still harmful:
- Compiling a detailed profile of an ex-partner from their public posts
- Posting a stranger’s workplace online after an argument
- Including an employee’s medical fundraiser in a pentest report because it was “public”

The information in each case might be public, but the context has changed. Someone who posts about a health issue for friends and family didn’t expect it to end up in a security report or a harassment campaign. Privacy scholars (notably Helen Nissenbaum, with the idea of “contextual integrity”) describe privacy as information flowing in ways that match the context it was shared in. OSINT almost always moves information into a new context, so investigators have a responsibility to think about whether that move is justified.

“Public ≠ permitted” in practice

When you find something public, ask:
- Did the person intend this to be seen by an audience like mine?
- Does my purpose justify collecting it?
- What happens if my notes or report leak?
- Would I be comfortable explaining this collection to the person it’s about?

The Mosaic Effect

The mosaic effect (or mosaic theory) is the idea that individual pieces of information, each harmless alone, can reveal something sensitive when combined.

The idea shows up in US law. In United States v. Maynard (D.C. Circuit, 2010), a case about 28 days of warrantless GPS tracking of a vehicle, the court reasoned that “the whole of one’s movements over the course of a month is not constructively exposed to the public because, like a rap sheet, that whole reveals far more than the individual movements it comprises.” (The Supreme Court decided the appeal, United States v. Jones, on different grounds.)

A fictional example

Each of these facts about a fictional person, “Alex,” is public and seems harmless:

Source	Fact
Fitness app post	Runs a 5K loop every weekday at 6 a.m.
Photo of their dog	Dog’s name is “Biscuit”
Local news article	Won a neighborhood garden contest on Maple Street
Professional profile	Works night shifts at a hospital
Old public post	“Happy birthday to my mom, Linda Carter!”

Combined, they reveal:
- Where Alex lives (the garden contest street plus the start/end of the running route)
- When Alex’s home is empty (running schedule, night shifts)
- Possible answers to security questions (pet’s name, mother’s maiden name)

No single fact is sensitive. The compilation is. This is why investigators have to think about the report as a whole, not just each finding, and why compiled OSINT profiles should be protected like sensitive data.

Minimization and Proportionality

Two principles keep investigations from turning into surveillance:

Minimization: Collect only what the objective requires, keep it only as long as needed, and share it only with people who need it.
Proportionality: Match the depth and intrusiveness of the investigation to the importance of the purpose.

Applying them

Objective	Proportionate	Disproportionate
Identify CompanyX’s email format	Collect a few example addresses from the company site	Build a spreadsheet of every employee’s personal email and phone number
Assess phishing risk for the finance team	Note job titles, public work-related posts, and exposed work details	Map finance employees’ home addresses and family members
Check if company credentials were breached	Confirm which accounts appear in breach notifications	Download the breach dump and store the passwords
Verify a video’s location for a news story	Geolocate the scene from landmarks	Identify and profile bystanders in the background

Practical habits:
- Write down the objective before you start, and check each new collection step against it.
- Redact what you don’t need (bystanders’ faces, family names, phone numbers) in notes and reports.
- Set a deletion date for collected data.
- Report categories and risk when that’s enough (“12 employees post badge photos publicly”) instead of listing every person.

Sensitive Data and Minors

Sensitive categories

Some data can cause serious harm if exposed: discrimination, violence, job loss, or legal trouble. The GDPR’s “special categories” are a useful checklist even outside the EU:

Racial or ethnic origin
Political opinions
Religious or philosophical beliefs
Trade union membership
Genetic data
Biometric data used to identify someone
Health data
Sex life or sexual orientation

Add to that: precise location and home address, immigration status, financial details, and criminal history. If a finding falls into one of these categories, it almost never belongs in an OSINT report unless it’s central to an authorized objective. When in doubt, stop and ask (see 2.1-authorization-and-scope.md).

Minors

Treat children’s data as off-limits:
- Minors can’t meaningfully consent to how their information is used.
- Children’s data has extra legal protection in many places (in the US, for example, COPPA covers online services collecting data from children under 13).
- Even face-search services have drawn lines here: in 2023, PimEyes said it would stop allowing searches of children’s faces.

If you run into a minor’s information during an investigation (a family member’s account, a school photo), don’t collect it, don’t include it, and don’t pivot from it.

Breach and Leaked Data: Check vs. Download vs. Use

Leaked data is some of the most useful OSINT there is, and some of the most ethically fraught. It was stolen from real people who never agreed to have it studied.

Action	Example	Ethical and legal position
Check	Looking up whether an email appears in a known breach using Have I Been Pwned	Generally fine; you learn that exposure happened, without handling the stolen data
Search via an authorized platform	Using a licensed threat intel platform to see which company accounts are exposed (Module 6)	Acceptable with authorization; handle results as sensitive
Download	Grabbing a breach dump from a forum or file-sharing site	Avoid; you now hold stolen personal data, may be handling illegal material, and may be exposed to malware
Use	Logging in with a leaked password, or testing it against other sites	Unauthorized access; illegal without explicit authorization
Buy	Paying a seller for a dataset	Never; it funds criminals and creates serious legal exposure

Handling rules when breach data is in scope:
- Never put plaintext passwords in notes, tickets, chat, or reports. Report “credential exposed for user X on date Y” instead.
- Store results encrypted, limit access, and delete them on schedule.
- Remember that infostealer logs (Module 6) include data from infected people’s personal computers: browsing history, saved passwords for personal accounts, and more. Only look at what your objective needs.

Responsible Disclosure of Accidental Discoveries

OSINT often turns up things nobody asked you to find: API keys in a public code repository, an open storage bucket, an exposed admin panel, a spreadsheet of customer data indexed by a search engine.

Do:
1. Stop. Don’t explore further than needed to understand what you’re looking at.
2. Don’t download, use, or share the exposed data.
3. Document what you saw, where, and when (URL, timestamp, a description; avoid capturing sensitive contents).
4. Find the right contact:
- The organization’s security.txt file (https://example.com/.well-known/security.txt, standardized in RFC 9116)
- A vulnerability disclosure program or bug bounty page
- The organization’s security team, or the repository owner for exposed code
- If you can’t reach the owner, a national CERT/CSIRT (check the right national contact before class)
5. Report privately, with enough detail for them to fix it, and give them reasonable time.
6. If it’s part of an engagement, report it to your client contact as your scope requires.

Don’t:
- Post it publicly to “prove” the problem
- Test whether leaked keys or credentials work
- Demand payment in exchange for details (this can look like extortion)

Doxxing and Real-World Harm

Doxxing is compiling and publishing someone’s personal information (home address, workplace, family, phone number) to expose them to harassment or harm. It uses exactly the skills this unit teaches.

The harms are concrete:
- Harassment campaigns, threats, and people showing up at someone’s home
- Job loss and damage to relationships
- Harm to family members who had nothing to do with the original dispute
- Misidentification: crowds doing amateur OSINT sometimes identify the wrong person, who then faces the harassment. (See Module 7 for the Boston Marathon bombing misidentification case and how verification prevents this.)

Doxxing can be a crime (see 2.2-computer-crime-and-privacy-laws.md), but even where it isn’t, it’s a clear ethical line for this class. Investigating someone isn’t the same as exposing them, and exposing them is almost never your call.

Face-Search Engines

Face-search engines let anyone upload a photo of a person and find other images of that face across the web, with links to where they appear.

Why they raise serious ethical concerns:
- They make it possible to identify a stranger from a single photo, such as someone photographed on the street or at a protest.
- A complaint to the UK’s Information Commissioner’s Office accused PimEyes of enabling “surveillance and stalking on a scale previously unimaginable.”
- Opt-out processes have been criticized as difficult and unreliable.
- Regulators have acted against facial recognition databases built from scraped photos: the Dutch Data Protection Authority fined Clearview AI €30.5 million in 2024.

For this class: know that these tools exist and how they can be used against people, including you (Module 9 covers defenses). Do not use them on real people.

Professional Frameworks: The Berkeley Protocol

The Berkeley Protocol on Digital Open Source Investigations was published in December 2020 by the UC Berkeley Human Rights Center and the UN Human Rights Office (OHCHR), developed with input from more than 150 experts. It was the first global guidance on using public digital information (photos, videos, social media posts) as evidence in international criminal and human rights investigations, and it’s a strong model for ethical OSINT generally.

It groups its principles into three categories:

Category	Principles	What they mean for students
Professional	Accountability, competency, objectivity, legality, security awareness	Know your limits, follow the law, stay impartial, protect your work
Methodological	Accuracy, data minimization, preservation, security by design	Verify, collect only what you need, preserve evidence properly, build security into your process
Ethical	Dignity, humility, inclusivity, independence, transparency	Respect the people in your data, admit uncertainty, avoid bias, be open about your methods

The Protocol also stresses the digital, physical, and psychosocial safety of investigators and the people involved. OSINT work can expose investigators to disturbing content, so taking breaks, limiting exposure, and talking about difficult material are part of doing the work responsibly.

A Quick Ethical Decision Check

Before collecting, keeping, or reporting something, run through these questions:

Purpose: Does this help answer the question I was authorized to answer?
Proportionality: Is this level of detail justified by the purpose?
Sensitivity: Is this a sensitive category, or about a minor or bystander?
Harm: Who could be hurt if this were misused or leaked?
Context: Would the person expect it to be used this way?
Accuracy: Am I confident this is about the right person? (See Module 7.)
Transparency: Could I explain this collection to my client, my instructor, or the person it’s about?

If any answer makes you uncomfortable, leave it out or escalate.

Rules for This Class

Only investigate yourself, classmates who give consent, or instructor-provided targets and purpose-built practice sites.
Passive techniques only unless a lab explicitly says otherwise.
No sock puppets, face-search engines, breach dump downloads, or dark web browsing.
Don’t share findings about real people outside of class, and delete lab data when the lab ends.
If you stumble on something sensitive or exposed, stop and tell the instructor.

Key Terms

Contextual integrity: The idea that privacy depends on whether information flows match the norms of the context it was shared in.
Mosaic effect: When combining individually harmless facts reveals something sensitive.
Minimization: Collecting, keeping, and sharing only the data a purpose requires.
Proportionality: Matching the intrusiveness of an investigation to the importance of its purpose.
Special category data: Sensitive data types (health, religion, sexual orientation, biometrics, etc.) that need extra protection.
Responsible (coordinated) disclosure: Privately reporting a security problem to the party that can fix it, and giving them time to act.
Doxxing: Compiling and publishing someone’s personal information to expose them to harassment or harm.
Face-search engine: A service that finds images of a person across the web from an uploaded photo of their face.
Berkeley Protocol: The 2020 UC Berkeley / OHCHR guidance on professional, lawful, and ethical digital open source investigations.

Key Takeaways

Legal is the floor, not the ceiling: “it was public” isn’t a complete justification.
The mosaic effect: harmless facts can combine into a dangerous profile, so protect the whole report.
Collect only what the objective needs (minimization), and match depth to purpose (proportionality).
Leave out sensitive categories, minors, and bystanders.
Check for breach exposure, but don’t download, use, or buy breach data.
If you stumble on an exposure: stop, don’t use it, document, and report it privately.
Investigating someone is not the same as exposing them. Doxxing causes real harm.
The Berkeley Protocol gives a professional model: professional, methodological, and ethical principles.

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.