This article was first published in 2019 on the website of Openfacto.
With the (temporary?) shutdown of Graph Search, Facebook's advanced search operator, and the removal of the tools section from the IntelTechniques website, the OSINT world experienced a minor earthquake last week. Before that, other tools (add-ons, software, specialised sites, and so on) had disappeared or become paid services, such as Pipl, which allowed searches to be run from a name, an email address, a username or a phone number.
However, as Michael Bazzell reminds us, OSINT is not a set of tools but a methodology. This article therefore sets out, without claiming to hold any absolute truth, to reflect on the notion of the tool and to offer some methodological elements that make a good investigator.
The tool: merely a support for human processing
A tool can be defined as "that which enables a task to be carried out". While tools are of course necessary to find information, no tool is indispensable, and none can function without human processing. To take a basic example, Google is a tool for running queries, but there is a considerable difference between the novice who simply types in keywords in the hope that the algorithm will find exactly what they need, and the user who has mastered the advanced search operators (Booleans, filetype, insite:, and so on). Yet this human, intellectual dimension is too often overlooked when the question of open-source research is raised, as the suggestions Google associates with the word OSINT go to show. This dimension is nevertheless fundamental, whether beforehand in defining the scope of the research, during it for the collection, or afterwards for the analysis.
Rigour, so as not to lose your way
By definition, open-source intelligence aims to obtain a piece of intelligence. Before setting out, then, it is essential to define clearly what is being sought: is it a matter of assessing the reputation of a potential partner? The reliability of a subcontractor? Of obtaining contact details? Of understanding the ecosystem of an organisation? The applications are extremely numerous and will not all require a focus on the same environment. In some cases it will be more relevant to look at social media, while other cases will require official documents to be interrogated through specialised databases (company registers, and so on). In practice, it is often necessary to cross-reference different types of source, as we shall see.*
Once the object of the research and the most relevant starting point have been defined, the investigation phase can begin. (Un)fortunately, there is no turnkey process of the kind: "to find such-and-such information, first run this query, then this one, then that one, and so on". There are, however, two guiding principles:
- Start from reliable information and/or the most distinctive elements when launching your searches, so as not to set off in the wrong direction from the outset. For example, there is probably a company whose common name is Total in every country in the world. If, however, you are interested solely in an Estonian company called Total, you will need to search for "Total OÜ".
- "Search. Find. Analyse. Repeat." This is the very essence of OSINT. To illustrate it, picture a su-do-ku grid. Fans of this logic game know it well (for everyone else, the rules are here): the few numbers you start with make it possible to find a new one, then combining that number with the others makes it possible to find another, and so on. OSINT is therefore about accumulating pieces of information and combining them to extract new ones, until you obtain what you are looking for.
Creativity, to investigate
As we have seen, a good investigator must show rigour and method. So much for the theory. It then falls to them to show creativity in order to create intelligence by cross-referencing data. The "capture the flag" video is a model of the genre in this respect (whatever one may think of the ideology of the individuals in question).
Two things then set a good investigator apart:
- Their ability to make the best possible use of the basic elements at their disposal in order to find new information. Example: starting from an email address, what are all the elements one can access? In the case of the "capture the flag" video, analysing sunrise and sunset makes it possible to roughly delimit a geographical area, and then analysing a site specialising in air traffic makes it possible to narrow this down to a few dozen smaller zones.
- Their ability to devise an information-gathering path that leads them to what they are looking for. Starting from a basic piece of information A, it is sometimes not possible to access a piece of information C. However, A may lead to a piece of information B, and B may then lead to C.
Suppose, for example, that one has to identify the Facebook profile of a known individual who, on the social network, uses a pseudonym. The investigator will work backwards and ask: what information do I need to find the Facebook account? In this instance, an email address might make it possible. The question then becomes how to find that address. Through a CV shared online? A presentation on Slideshare? LinkedIn? The example is fairly basic, but some schemes can be far more elaborate.
In short…
Ultimately, the quality of a good researcher lies less in their intrinsic knowledge of a multitude of tools than in their ability to make the most of the information they have and to establish connections between the pieces in order to gather new ones. Of course, the more tools a researcher has mastered, the greater their chances of finding what they are looking for. To this knowledge and this capacity for creativity must be added a certain methodological rigour, which is indispensable if one is not to lose one's way. To borrow the conclusion of this article from OSINT Essentials: "Your brain will always be your best asset. Use it".