OSINT: Does it Violate Privacy and Other Questions You Need Answers

It is natural to feel a little squeamish about looking at the personal information of another individual. It can feel like a violation of someone's privacy, and many individuals and businesses are hesitant to get involved with reviewing information about their customers. However, there are considerations to make about when and how to view pieces of information about customers.

There are research tactics that one may use to learn more about their customers that are completely ethical and highly valuable for the companies that use them. One such tactic is known as Open Source Intelligence or OSINT, and it is steadily gaining popularity among a variety of different companies.

The growth of the use of OSINT research has exploded. Some estimates put the market value of OSINT research at approximately $5.4 billion in 2021, but it is forecast to grow to approximately $36.2 billion by 2030.

What is OSINT? 

Before you can begin to gain benefits from using OSINT, you first need to know what it is all about. Sans.org defines this in the following way: 

Open-Source Intelligence (OSINT) is defined as intelligence produced by collecting, evaluating and analysing publicly available information to answer a specific intelligence question.

It is important to note that anyone can perform OSINT on their own if they wish to do so. That said, it is most powerful when it is conducted by someone who has a clear intention to use it for a business purpose. In that case, they are seeking the information with a specific purpose, and they can leverage that information to immediate effect. 

OSINT is NOT Just Googling

There is a common misconception that OSINT is the same thing as simply Googling information about someone, but that is far from the truth. There are limitations to what one can accomplish by Googling someone's name. All that you will see when you Google someone's name is the information that Google has decided to index about them. You will also only see information that has been optimized to reach the Google algorithm. Therefore, what you are likely to read about someone is simply curated information targeted at the Google algorithm. Those are not the deep facts that you truly want to know about someone, and that is why OSINT is so much more than just Googling information about someone. 

Is OSINT a Violation of Privacy? 

You might find yourself tripped up by someone asking if performing OSINT research is a violation of privacy. Getting information about someone that is personalized to them can certainly feel like it is digging into the private lives of people in a way that they might not want you to do. However, that is simply not the case. In reality, OSINT is only research conducted on pieces of information that is available in the public sphere. 

This is a key point that also means that OSINT is a completely legal form of research as well. Some of the sources of OSINT research include the following: 

• Court records

• Voting records

• Marriage Records

• Birth certificates

• City Council meeting minutes

• Criminal records

• Immigration records

These are all records that are kept in the public sphere, and they are records that one can access to learn more about their customers and potential customers. It is important to sort through which records may be of value to your organization and create a strategic plan for how to use that information to reach out to a customer in a more personalized way. You shouldn't scour records just for the sake of looking through them, but you might find some hidden gems within the information that you have managed to pull out of the public records that you have accessed. 

Do Individuals Have to Consent to OSINT Research?

A question that you might have to contend with is when someone asks about the consent that must be obtained by those with that you are conducting OSINT research. Some believe that it is necessary to gain the consent of those from whom you are pulling records. While this might be true of certain types of private records, it is not true for the types of records that you will pull up when you are conducting OSINT research.

A full 91% of individuals admit that they do NOT read the terms and conditions of various services that they use. They simply accept the terms without reading them, and those terms often spell out how the service can store and use their personal data. Therefore, many users have already agreed to have the information they share online to be used in a wide variety of ways.

The nature of the records that you get with this type of research is all held in the public sphere. As such, there are no special permission requirements necessary to obtain that information. 

Does OSINT Research Include Social Media Posts? 

Anything that someone posts on social media is considered part of the public record, even if they have attempted to keep their profile isolated from the outside world. Therefore, some of the information that is pulled when doing OSINT research will include information from social media. This might include anything that one has submitted on a social network from status updates to pictures and videos. It can also potentially include information about the following: 

• The pages that one has liked

• The connections (friends) that one has

• Groups that one has joined

Any of this information may be public information that could be accessed by a company performing OSINT research. Not all of it will be of value to a company, but they may be able to see it. This information is what many social media platforms rely on to sell advertisements to the companies that they partner with. Social networks have the information on their users that marketers want, and those marketers are willing to pay for it. While certain details are available via OSINT research, some of that information is held in private. For the right price, most of it is available to marketers. 

Is OSINT the Most Effective Form of Research?

There are arguments to be made that OSINT is just the tip of the iceberg when it comes to conducting research, and that is largely true. This form of research is merely about scratching the surface of what is available out there, but it is an easy way to get some basic information and do so without cost. Again, the information is placed on the Internet and other public sources where anyone can gain access to it. Therefore, this is a great place to start if you are a growing business that is attempting to learn what you can about your customers with minimal costs. 

REFERENCES

• https://www.globenewswire.com/en/news-release/2022/09/13/2515324/0/en/Global-Open-Source-Intelligence-OSINT-Market-Size-Worth-36-241-24-Billion-by-2030-at-a-28-33-CAGR-Custom-Market-Insights-Share-Report-Outlook-Growth-Trends-Segmentation.html
• https://www.sans.org/blog/what-is-open-source-intelligence/
• https://www.liferaftinc.com/blog/7-powerful-google-dorks-osint-analysts-should-know
• https://cwsisecurity.com/what-is-open-source-intelligence-osint/#:~:text=OSINT%20is%20completely%20legal%20because,information%20available%20from%20public%20sources.
• https://study.com/learn/lesson/public-records-overview-examples.html
• https://www.businessinsider.com/deloitte-study-91-percent-agree-terms-of-service-without-reading-2017-11