Osint Workflow

By the end of this lesson, you'll be able to:

• Understand the six-phase OSINT investigation framework
• Develop comprehensive planning and requirements documents
• Identify and evaluate both primary and secondary intelligence sources
• Create and execute effective collection strategies with proper OPSEC
• Analyze and verify information systematically
• Document and report findings in a professional, legally defensible manner

"Turning chaotic internet browsing into systematic intelligence gathering"

Effective OSINT investigations require a structured approach to ensure coverage, maintain evidence integrity, and produce reliable intelligence. A well-defined workflow helps analysts stay organized, avoid missing critical information, and document their findings properly.

"Where you figure out what you're actually looking for before diving into the internet rabbit hole"

Requirements Definition

• Intelligence Requirements: What specific information is needed?

• Target Definition: Who or what is the subject of investigation?

• Scope and Limitations: What are the boundaries of the investigation?

• Timeline: When is the intelligence needed?

• Legal and Ethical Constraints: What limitations must be observed?

• Success Criteria: How will you know when you have enough information?

"Mapping the digital universe before you start exploring it"

Primary Sources Direct sources of information about your target

• Official websites and publications
• Social media profiles
• Government databases
• Corporate filings
• News articles and press releases

Secondary Sources Sources that reference or discuss your target

• Academic papers and research
• Industry reports
• Forum discussions
• Blog posts and articles
• Third-party databases

"Your battle plan for conquering the information landscape"

Search Strategy Development

#### Keyword Development

• Primary keywords and variations
• Alternative spellings and translations
• Related terms and synonyms
• Industry-specific terminology

#### Search Operators

• Boolean operators (AND, OR, NOT)
• Google dorking techniques
• Platform-specific search features
• Advanced filtering options

Operational Security Planning

• VPN and proxy configuration
• Research account setup
• Browser security settings
• Data storage and encryption
• Communication security

"The actual hunting and gathering phase, but with keyboards instead of spears"

Systematic Collection Process

• Start Broad: Begin with general searches to understand the landscape

• Narrow Focus: Use specific keywords and operators to drill down

• Cross-Reference: Verify information across multiple sources

• Document Everything: Maintain detailed logs of searches and findings

• Follow Leads: Pursue new information discovered during collection

• Time Management: Set limits to avoid endless rabbit holes

Just like a detective would never trust a "totally reliable" tipster without verification, we don't trust any single source. The internet is full of lies, so we gather evidence like we're building a case in court!

"Separating the wheat from the chaff, or in OSINT terms, facts from internet nonsense"

Information Analysis

• Source credibility assessment
• Information correlation
• Gap identification
• Pattern recognition
• Timeline construction

Verification Methods

• Multiple source confirmation
• Reverse image searches
• Metadata analysis
• Fact-checking resources
• Expert consultation

"Making your digital detective work look professional and legally defensible"

Documentation Requirements

#### Evidence Chain

• Source URLs and access timestamps
• Screenshots and archived copies
• Search queries and methodologies
• Tool configurations and settings

#### Analysis Documentation

• Analytical assumptions and limitations
• Confidence levels and reliability assessments
• Alternative hypotheses considered
• Recommendations for further investigation

"Your OSINT toolkit for staying organized and professional"

Essential Templates

• Investigation Plan Template: Standardized planning document

• Source Evaluation Matrix: Systematic source assessment

• Collection Log: Detailed record of searches and findings

• Evidence Inventory: Catalog of collected materials

• Analysis Worksheet: Structured analytical framework

• Report Template: Professional intelligence product format

Develop your own OSINT workflow checklist based on your specific requirements and environment. Regularly review and update your processes based on lessons learned and new tools or techniques. A well-refined workflow is often the difference between amateur internet searching and professional intelligence gathering.

The OSINT Workflow

Open Source Intelligence requires a structured workflow to manage the volume, variety, and velocity of publicly available information. Without a systematic approach, analysts quickly become overwhelmed by data and produce analysis that is reactive rather than purposeful:

• The OSINT Cycle: OSINT follows a modified intelligence cycle tailored to the unique characteristics of open sources. The phases - planning, collection, processing, analysis, and dissemination - are the same, but the methods and tools at each phase differ significantly from classified intelligence disciplines.
• Source Saturation: The greatest challenge in OSINT is not finding information but filtering it. An analyst monitoring a single country's social media activity may encounter thousands of potentially relevant posts per day. Effective OSINT workflows prioritise triage and filtering over broad collection.
• The OSINT Toolchain: Professional OSINT operations use a stack of specialised tools - social media monitoring platforms, web scrapers, data visualisation tools, and analytical frameworks. The toolchain should be matched to the specific intelligence requirement, not dictated by what tools are available or familiar.

Phase 1: Planning

OSINT planning begins with the intelligence requirement and works backward to identify the most productive open sources:

• Source Mapping: Identify which open sources are most likely to contain the needed information. For a requirement about military movements, satellite imagery from commercial providers and local social media posts may be the most productive sources. For a requirement about economic conditions, government statistics and financial news may be more relevant.
• Collection Strategy: Determine how each source will be collected, at what frequency, and for what duration. Some sources (government websites) can be collected once; others (social media feeds) require continuous monitoring.
• Resource Allocation: OSINT collection can be resource-intensive. Prioritise sources and collection frequencies based on their expected contribution to the intelligence requirement. A satellite image that costs thousands of dollars per frame should be tasked only when the expected intelligence value justifies the cost.
• Legal and Ethical Boundaries: Before collection begins, confirm that the planned collection is within authorised legal and ethical boundaries. Different jurisdictions have different laws regarding web scraping, social media monitoring, and data retention. OSINT analysts must know and respect these boundaries.

Phase 2: Collection

OSINT collection gathers publicly available information from identified sources:

• Web Scraping: Automated tools collect data from websites at scale. Web scraping can collect thousands of pages per hour but must respect website terms of service and robots.txt instructions. For intelligence purposes, scraped data should be timestamped and source-tagged for future verification.
• Social Media Monitoring: Dedicated tools monitor social media platforms for keywords, hashtags, account activity, and network changes. Social media monitoring should be configured to minimise false positives while capturing relevant activity.
• Media Monitoring: News aggregation services and RSS feeds collect articles from traditional media sources. Media monitoring provides coverage of official statements, reported events, and editorial commentary that may not appear on social media.
• Database Access: Many open source databases require registration, subscription, or academic affiliation. Corporate registries, patent databases, academic journals, and government data portals are valuable OSINT sources that require active access management.
• Human Collection: Some open source information is best collected through human interaction - interviews with subject matter experts, attendance at conferences, engagement with online communities. This form of OSINT collection requires tradecraft more similar to HUMINT than to technical collection.

Phase 3: Processing and Triage

Raw OSINT data must be processed before it can be analysed:

• Deduplication: The same information often appears across multiple sources. Deduplication prevents the analyst from treating a single event as multiple corroborated reports.
• Translation: Foreign language sources must be translated. Machine translation (Google Translate, DeepL) is adequate for triage but should not be relied upon for final analysis. Critical foreign language content should be translated by a qualified linguist.
• Verification: Open source information varies enormously in reliability. Each piece of information should be assessed for plausibility, source reliability, and consistency with other available information before it is used in analysis.
• Triage: Not all collected information merits analysis. Triage rules should be established during the planning phase based on the intelligence requirement. Information that clearly does not meet the requirement should be archived without detailed analysis.

Phase 4: Analysis

OSINT analysis applies the same analytical tradecraft as other intelligence disciplines:

• Source Evaluation: Each open source should be evaluated using the same criteria applied to classified sources - access, motivation, history of reliability, and potential for deception. The fact that a source is "open" does not make it more reliable than a classified source.
• Cross-Source Integration: OSINT information should be integrated across sources before conclusions are drawn. A single social media post is not a trend; a single news article is not a confirmed fact. Patterns across multiple independent sources carry analytical weight.
• Temporal Analysis: When was the information published? Has the source updated or corrected it? Is the information still current? Open source information decays rapidly - a news article from six months ago may no longer reflect the current situation.
• Geospatial Correlation: Where possible, geolocate OSINT information to specific places. A social media post about a protest is more valuable when it can be geolocated to a specific intersection at a specific time.

Phase 5: Dissemination

OSINT products follow the same dissemination standards as classified intelligence:

• Source Transparency: Unlike classified intelligence, which protects sources through classification markings, OSINT products can often cite sources directly. However, analyst should consider whether citing a source could endanger the source or reveal analytical methods.
• Timeliness: OSINT products may have shorter shelf lives than classified products because the underlying open sources are updated continuously. Date and time stamps on OSINT products are essential for consumers to assess currency.
• Methodological Transparency: OSINT consumers benefit from understanding how the information was collected and analysed. A brief methodological note - sources used, search terms, timeframe - helps consumers evaluate the product's reliability and relevance.