XFTFSecurity For the Folks

Lesson 1.1

What Is OSINT?

Learning Objectives

  • Define OSINT using both the formal US government definition and a practical working definition
  • Explain what “open source” means in an intelligence context and identify gray areas
  • Walk a piece of raw data through the data → information → intelligence progression
  • Place OSINT alongside the other intelligence disciplines and explain how they overlap
  • Summarize how OSINT evolved from WWII radio monitoring to the internet and AI era

Defining OSINT

The formal definition

The most widely cited US definition comes from the National Defense Authorization Act for Fiscal Year 2006 (Public Law 109-163, Section 931):

“Open-source intelligence (OSINT) is intelligence that is produced from publicly available information and is collected, exploited, and disseminated in a timely manner to an appropriate audience for the purpose of addressing a specific intelligence requirement.”

Every phrase in that sentence matters:

Phrase What it means for us
“intelligence that is produced” OSINT is an output someone creates through analysis, not just the raw material
“from publicly available information” The inputs must be things the public can lawfully access
“collected, exploited, and disseminated” There is a process: gather it, make sense of it, deliver it (this is the OSINT cycle, covered in Module 3)
“in a timely manner” Intelligence that arrives too late is useless
“to an appropriate audience” Findings go to the people who need them, not to everyone
“addressing a specific intelligence requirement” You start with a question. Searching without a question is browsing, not OSINT

The updated definition (2024)

In March 2024, the Office of the Director of National Intelligence (ODNI) and the CIA released the IC OSINT Strategy 2024–2026, titled “The INT of First Resort.” It describes OSINT as intelligence derived exclusively from publicly or commercially available information that addresses specific intelligence priorities, requirements, or gaps.

Two things are worth pointing out to students:
- “Commercially available” was made explicit. Data you can buy (from data brokers, satellite imagery companies, or threat intelligence vendors) counts as an open source if anyone can purchase it.
- “INT of first resort” means analysts should check what’s publicly available before using more expensive, risky, or intrusive collection methods. That goal was first stated by ODNI back in 2006.

A working definition for this class

OSINT is the process of collecting publicly available information and analyzing it to answer a specific question.

If you remember nothing else: public information + analysis + a question.

What “Open Source” Means (and Doesn’t)

“Open source” in intelligence has nothing to do with open-source software. It means the source of the information is open to the public.

A useful test: Could an ordinary member of the public lawfully see, request, or buy this information without special access or deception?

Generally counts as open source Generally does NOT count as open source
Public websites and social media posts Private messages or private accounts you weren’t given access to
News articles, press releases, TV and radio Data obtained by hacking or using stolen credentials
Government records (court filings, property records, business registrations) Information behind someone else’s login
Academic papers and conference talks Insider information shared in violation of an agreement
Commercial data anyone can buy (satellite imagery, data broker reports) Intercepted communications (that’s SIGINT)
Technical data anyone can query (DNS, WHOIS, certificate logs) Information gathered by pretending to be someone you’re not (that’s social engineering / HUMINT-style collection)

Gray areas worth discussing

The line isn’t always clean. These come up constantly in real investigations:

  • Leaked data. Breach dumps and leaked databases are “out there,” but they were not published by their owners. Bellingcat’s 2018 Salisbury investigation (see 1.3-why-osint-matters.md) used leaked Russian databases and passport file data alongside true open sources. Many practitioners argue this goes beyond OSINT, and the ethics are debated.
  • Registration walls. Is a forum you can join for free with an email address “public”? Usually treated as open source, but the site’s Terms of Service may restrict how you use what you see (see Module 2).
  • Sock puppet accounts. Creating a fake account to view content may violate a platform’s ToS even if the content is visible to any account holder (see Module 2 and Module 8).
  • Commercial data. Legal to buy, but the data may have been collected in ways the subjects never agreed to.

The takeaway: “I found it online” is not the same as “it’s an open source,” and neither is the same as “it’s ethical to use.” Module 2 goes deep on this.

Data → Information → Intelligence

Intelligence professionals separate three levels. Most beginners stop at the first or second, but the value is in the third.

Level Definition Characteristics
Data Raw, unprocessed facts Individual pieces with no context
Information Data that has been organized and given context Answers “what?”
Intelligence Information that has been analyzed and evaluated to answer a specific question Answers “so what?” and “what now?”

Worked example: Company X

The requirement (question): “How exposed is Company X to a targeted credential-phishing campaign, and who is most likely to be targeted?”

Data (raw facts collected):
- The MX record for companyx.com points to Microsoft’s mail servers
- A LinkedIn search shows 14 people listing “IT” or “Help Desk” at Company X
- The company’s contact page lists jane.doe@companyx.com
- A certificate transparency log shows vpn.companyx.com and mail.companyx.com
- A job posting asks for “experience administering Microsoft 365 and Okta”
- A press release announces a new CFO who started last month

Information (organized, given context):
- Company X uses Microsoft 365 for email and Okta for single sign-on
- The email format is first.last@companyx.com
- The company has an internet-facing VPN
- There is a brand-new CFO who may not yet know internal procedures

Intelligence (analyzed, answers the question):

“Company X is highly exposed to credential phishing. Because it uses Microsoft 365 and Okta, an attacker could build convincing fake login pages for both. The predictable email format means an attacker can generate valid addresses for any employee found on LinkedIn. The new CFO is a likely high-value target for business email compromise because they are unfamiliar with internal payment procedures. Confidence: moderate — the email format is confirmed by one example and should be verified with more. Recommendation: prioritize phishing-resistant MFA and targeted awareness training for finance and IT staff.”

Notice what changed at the intelligence level:
- It answers the question that was asked
- It connects separate facts into a conclusion
- It states a confidence level and what would raise it
- It is actionable — someone can make a decision from it

A good test for students: read your finding and ask “so what?” If you can’t answer, you have information, not intelligence.

OSINT Among the Other “INTs”

The US Intelligence Community commonly groups collection into five main disciplines:

Discipline Full name Source of information Example
OSINT Open Source Intelligence Publicly or commercially available information News, social media, public records
HUMINT Human Intelligence People Interviews, informants, debriefings
SIGINT Signals Intelligence Intercepted electronic signals and communications Intercepted radio or network traffic
GEOINT Geospatial Intelligence Imagery and geospatial data (includes IMINT, imagery intelligence) Satellite and aerial imagery, maps
MASINT Measurement and Signature Intelligence Technical measurements of physical phenomena Radar, acoustic, or chemical signatures

You’ll also hear terms that describe subsets or specialties rather than separate formal disciplines:
- SOCMINT (Social Media Intelligence) — OSINT focused on social media
- FININT (Financial Intelligence) — analysis of financial transactions and records
- CTI (Cyber Threat Intelligence) — intelligence about cyber threats and threat actors, which draws heavily on OSINT

Where they overlap

The disciplines aren’t sealed boxes:
- Commercial satellite imagery is both OSINT (anyone can buy it) and GEOINT (it’s imagery analysis).
- A public social media post can tip off a HUMINT officer about someone worth talking to.
- Publicly shared device data (like the Strava heatmap) blurs OSINT and geospatial analysis.
- The 2024 IC OSINT Strategy describes OSINT as enabling all other collection disciplines — it often tells the more expensive disciplines where to look.

All-source analysis combines every discipline into one picture. For most people outside government, OSINT is the only discipline available, which is exactly why it matters so much for security professionals, journalists, and researchers.

A Short History of OSINT

OSINT is not an internet invention. Governments have been collecting public information for decades.

Year Milestone
1941 On February 26, 1941, President Franklin Roosevelt allocated $150,000 to create the Foreign Broadcast Monitoring Service (FBMS) under the Federal Communications Commission. Its job: record, translate, and analyze shortwave propaganda broadcasts aimed at the US by the Axis powers.
1942 Renamed the Federal Broadcast Intelligence Service.
1947 Renamed the Foreign Broadcast Information Service (FBIS) and became part of the newly created CIA.
1967 FBIS’s mission expanded to cover foreign mass media in general — radio, television, and print.
Cold War FBIS translated and published foreign media for US government analysts; its “Daily Reports” are now a historical research resource in many university libraries.
2005 In November 2005, FBIS became the Open Source Center (OSC) under the Director of National Intelligence, covering print, broadcast, and online media.
2014 Bellingcat was launched by British citizen journalist Eliot Higgins in July 2014, showing that civilians could do intelligence-grade open source investigations.
2015 In October 2015, the OSC was renamed the Open Source Enterprise (OSE) and placed within CIA’s new Directorate of Digital Innovation.
2022 The OSINT Foundation, a nonprofit professional association founded by former intelligence leaders, launched to professionalize the discipline.
2024 ODNI and CIA released the IC OSINT Strategy 2024–2026, calling OSINT “the INT of first resort.”

The teaching point: the method (monitor public sources, translate, analyze, report) hasn’t changed since 1941. What changed is the volume of public information and who can do the work.

How the Internet, Social Media, and AI Changed OSINT

The internet: volume and access

  • In 1941, open sources meant a limited number of radio stations and newspapers. Today there are billions of web pages, posts, videos, and records, many searchable in seconds.
  • Government records that once required a trip to a courthouse are often searchable online.
  • Technical data (DNS, certificates, internet-wide scan results) created entirely new categories of sources (covered in Module 5).

Social media and smartphones: everyone is a sensor

  • Billions of people carry a camera, GPS receiver, and internet connection.
  • People document their own lives, workplaces, travel, and relationships — often in real time.
  • Breaking events are filmed by bystanders before any journalist arrives, which is how investigators like Bellingcat reconstruct events (e.g., the MH17 investigation).
  • Fitness apps, photo metadata, and check-ins leak location data that people don’t realize they’re sharing.

Democratization: not just governments anymore

  • Commercial satellite imagery, free mapping tools, and search engines give individuals capabilities that used to belong only to governments.
  • Journalists, human rights researchers, volunteers (e.g., Trace Labs), and security teams now do investigations that make international headlines.
  • The same democratization helps attackers: a criminal can research a company as easily as a defender can.

New challenges

  • Information overload: the hard part is no longer finding information but filtering it.
  • Disinformation: fake accounts, manipulated media, and coordinated campaigns mean verification is essential (Module 7).
  • Platforms closing doors: social platforms regularly restrict APIs and search features (for example, X made API access paid in 2023), which breaks tools and techniques.
  • Ephemeral content: stories, deleted posts, and disappearing messages mean you must document as you go (Module 7).

Artificial intelligence: both a tool and a threat

How AI helps OSINT practitioners:
- Translating foreign-language sources at scale
- Transcribing audio and video
- Summarizing large volumes of documents
- Assisting with image analysis and pattern finding

How AI complicates OSINT:
- Synthetic media: AI-generated images, video, audio, and fake profile photos make verification harder.
- Fake personas at scale: networks of AI-generated accounts can manufacture fake consensus.
- Hallucinations: AI tools can confidently state false facts, including fake sources. Everything an AI tool tells you must be verified like any other unconfirmed source.
- Attackers use AI for recon: In March 2026, MITRE ATT&CK added T1682 “Query Public AI Services” to its Reconnaissance tactic, describing adversaries using public AI services such as large language models to research victims, organizational structures, technologies, and personal information for social engineering.

Bottom line for students: AI speeds up collection and processing, but it does not replace analysis and verification. It actually makes verification skills more important.

Key Terms

  • OSINT (Open Source Intelligence): Intelligence produced from publicly (or commercially) available information to answer a specific requirement.
  • Intelligence requirement: The specific question an investigation is trying to answer.
  • Publicly available information (PAI): Information any member of the public can lawfully see, request, or buy.
  • Commercially available information (CAI): Data available for purchase, such as from data brokers or imagery vendors.
  • Data / Information / Intelligence: Raw facts / organized facts with context / analyzed information that answers a question.
  • HUMINT, SIGINT, GEOINT, MASINT: The other major intelligence collection disciplines (human, signals, geospatial, measurement and signature).
  • SOCMINT: Social media intelligence, a specialty within OSINT.
  • All-source analysis: Combining information from all intelligence disciplines into one assessment.
  • FBIS: Foreign Broadcast Information Service, the US government’s long-running open source monitoring organization (1947–2005).
  • Synthetic media: Images, audio, or video generated or altered by AI.

Key Takeaways

  • OSINT = public information + analysis + a specific question
  • “Open source” means publicly or commercially available — not open-source software
  • Data → information → intelligence: always ask “so what?”
  • OSINT is one of five major intelligence disciplines and often guides the others
  • OSINT dates back to WWII radio monitoring (1941); the internet made it explode
  • Smartphones and social media turned everyone into a sensor — including your targets and you
  • AI speeds up OSINT but makes verification more important than ever
  • “Found online” ≠ “open source” ≠ “ethical to use”

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.