I have been teaching OSINT for a few years now, and my courses have changed enormously. The tools are constantly evolving, of course, but the way I approach teaching has changed a great deal too.
At first I designed my training as a series of modules: first methodology, then search engines, archives, and so on. This method has several advantages: it gives students a clear direction, allows them to progress step by step and makes it easier to acquire new techniques. The drawback is that it does not allow them to grasp an essential dimension of investigation: managing uncertainty.
In a real investigation, the analyst is not only faced with the question of how to find a piece of information. They must also determine what is worth looking for, where to look for it, and when to abandon one lead in order to explore another. They build their own questions as the investigation unfolds, drawing on the information obtained, the hypotheses they form and the dead ends they run into.
Modular teaching tends precisely to remove part of this uncertainty. If a question is set during a module devoted to archives, the student already knows that the archives probably have something to offer them. In an investigation, that pointer does not exist: the information sought may lie in an archive, a company register, a database, a social network, the source code of a website… or may not be accessible at all.
For chess enthusiasts, the comparison below illustrates the problem rather well. In the first case, the player is simply presented with a position and has to work out for themselves whether there is anything to play. In the second, they know that a winning combination exists. The information given by the teacher does not hand them the solution, but it already steers their reasoning strongly. This is exactly what overly guided teaching can produce.
This does not mean that modular teaching is useless. It is in fact particularly effective for passing on a technique. But on its own it seems to me insufficient when it comes to training analysts capable of conducting an investigation independently.
So last year, with my bachelor's students at the École de Guerre Économique, I tested a different approach. Having laid down the essential foundations (methodology and search engines), we started from a practical case: carrying out a due diligence on a company. The course then progressed according to their own questions, with as little guidance as possible.
The point was less to teach them the “right” tool straight away than to discuss whether their choices made sense. Some wanted to start with social networks, others with the company register, a third group with the website. In the case studied, social networks offered little. The company register, on the other hand, led us to compare Pappers and Data INPI. Analysing the website then took us towards web archives and Whois data, and on to fresh questions: how should the closure of a subsidiary be interpreted? What can be inferred from successive changes of directors? At what point does an anomaly become a signal worth pursuing further? And, above all, how to answer these new questions.
It is precisely this journey that interests me: forcing the student to prioritise leads, form hypotheses, accept that a search yields nothing and decide when to pivot. In other words, not merely learning to find information, but learning to conduct an investigation.
This approach obviously does not suit every audience. Investigation professionals who have already internalised the management of uncertainty and the notion of pivoting will be more interested in modular learning that lets them discover new techniques.
We must therefore distinguish between two objectives that are often confused: training an analyst, or improving the research skills of a professional who is not meant to conduct investigations. In the first case, mastering the tools is necessary, but it is not enough. One must also learn to reason without knowing in advance where the answer lies, or even whether an answer exists at all.
It is this distinction, and more broadly the question of training for uncertainty in the teaching of OSINT, that I am currently developing in a more substantial paper prepared for the forthcoming European conference of IAFIE.