What Is OSINT? The Complete Guide to Open-Source Intelligence

What is OSINT? Open-source intelligence is the discipline of collecting, verifying and analyzing publicly or commercially available information to answer a specific question that matters to a decision-maker. It began in 1941 as a small US government unit transcribing enemy radio broadcasts, and it now underpins everything from war-crimes investigations to corporate security and the daily work of newsrooms. This guide explains where OSINT came from, how professionals actually do it, where its ethical and legal limits sit, and what the field looks like as a career.

Key takeaways

• OSINT is intelligence derived from publicly or commercially available information, produced to answer a defined requirement. Raw public data alone is not intelligence.
• The discipline traces back to the Foreign Broadcast Monitoring Service, created in February 1941, and was transformed after 2011 by smartphones, social media and commercial satellite imagery.
• Core techniques include geolocation, chronolocation, satellite imagery analysis, and flight and ship tracking, all bound together by rigorous verification.
• Landmark investigations into MH17 and the war in Ukraine showed that open-source evidence can stand up in courts and international bodies.
• "Publicly available" does not mean "free of rules": privacy law, platform terms, investigator safety and harm to subjects all constrain responsible OSINT.

What is OSINT? A working definition#

The official definitions#

The most widely cited modern definition comes from the US Intelligence Community. In its IC OSINT Strategy 2024–2026, released on 8 March 2024 by the Office of the Director of National Intelligence (ODNI) and the CIA, OSINT is described as intelligence derived exclusively from publicly or commercially available information that addresses specific intelligence priorities, requirements or gaps. An earlier statutory definition, written into the US National Defense Authorization Act for Fiscal Year 2006, framed it in similar terms: intelligence produced from publicly available information that is collected, exploited and disseminated in a timely manner to an appropriate audience to address a specific requirement.

Both definitions share two features that are easy to overlook. First, the inputs must be lawfully accessible to any member of the public, whether free or purchased. Second, the output is intelligence only when it answers a question someone actually needs answered. A spreadsheet of scraped social media posts is data; an assessment that a particular artillery unit relocated to a named village on a named date, with a stated confidence level, is intelligence.

Information versus intelligence#

This distinction explains why so much online activity that calls itself OSINT is better described as open-source research or simple aggregation. Professional practitioners talk about turning publicly available information (PAI) into finished intelligence through a chain of collection, processing, analysis and dissemination. Each link adds value: filtering noise, establishing provenance, corroborating across independent sources and stating uncertainty openly.

It also explains why OSINT sits alongside, rather than beneath, the other collection disciplines such as signals intelligence (SIGINT), human intelligence (HUMINT) and geospatial intelligence (GEOINT). OSINT often provides the context that makes classified reporting usable, and in some cases it provides the decisive evidence by itself. The ODNI strategy describes OSINT as a discipline that the US government intends to professionalize, which signals how far its status has risen.

Who uses OSINT today#

The user base is now far wider than intelligence agencies. Journalists use OSINT to verify footage before publication. Human rights investigators use it to document atrocities for courts. Corporate security teams use it to monitor threats to staff and facilities, while financial crime and sanctions specialists use it to trace shell companies and vessels. Militaries use it for situational awareness, and analysts at research institutes use it to track weapons programs. Each community applies the same core methods to different questions, which is one reason OSINT skills transfer so well between sectors.

A short history of open-source intelligence#

From radio monitoring to the Cold War#

Modern state OSINT began on 26 February 1941, when President Franklin D. Roosevelt allocated $150,000 to establish the Foreign Broadcast Monitoring Service under the Federal Communications Commission. Its task was to record, translate and analyze Axis shortwave propaganda. Listening posts transcribed speeches by Hitler, Goebbels and Mussolini and tracked Japanese broadcasts, delivering weekly reports to wartime agencies. The service was renamed the Foreign Broadcast Intelligence Service in 1942 and, as the Foreign Broadcast Information Service (FBIS), became part of the new Central Intelligence Agency after the 1947 National Security Act.

Throughout the Cold War, FBIS translated foreign newspapers, journals and broadcasts at an industrial scale. Analysts learned to read shifts in Soviet editorial language, the order of officials at public events and changes in technical journals as indicators of policy change. The underlying insight, that adversaries reveal a great deal in what they publish openly, remains the foundation of the discipline.

The digital turn and the rise of Bellingcat#

In 2005, as part of the post-9/11 reorganization of US intelligence, FBIS was reorganized as the Open Source Center within the CIA, later renamed the Open Source Enterprise. The bigger change, however, was happening outside government. Smartphones, social media and free satellite basemaps put geotagged photos and videos from conflict zones into public view within minutes of events.

During the Syrian civil war, a British blogger named Eliot Higgins, writing as "Brown Moses", began identifying weapons in YouTube videos uploaded by fighters. In July 2014 he founded Bellingcat, a collective of open-source investigators. Days later, Malaysia Airlines Flight MH17 was shot down over eastern Ukraine, and the investigation that followed made open-source methods internationally famous. Since then, newsrooms such as The New York Times, the BBC and The Washington Post have built dedicated visual investigations teams, and in 2020 the UN Human Rights Office and UC Berkeley's Human Rights Center published the Berkeley Protocol on Digital Open Source Investigations to set professional standards.

Chart: key dates in OSINT history. Sources: FBIS history, CIA; Berkeley Protocol, UC Berkeley Human Rights Center (2020); ODNI/CIA IC OSINT Strategy (2024).

OSINT and the intelligence cycle#

The five stages#

OSINT follows the same intelligence cycle as every other collection discipline. It begins with direction, where a decision-maker's need is translated into a precise, answerable question. Collection then gathers relevant material from appropriate sources. Processing turns raw material into usable form through translation, archiving, metadata extraction and deduplication. Analysis evaluates, corroborates and interprets the material, producing a judgment with an explicit confidence level. Dissemination delivers that judgment to the right audience, in the right format, at the right time, and feedback refines the next round of questions.

Chart: the intelligence cycle as applied to OSINT. Source: adapted from the ODNI IC OSINT Strategy 2024-2026 and standard intelligence doctrine (2024).

Why the requirement comes first#

The most common failure in open-source work is skipping the direction stage. Without a clear question, collection becomes endless scrolling, and analysts drift toward whatever is most viral rather than what is most relevant. Good requirements are specific in time, place and actor: "Has the air defense unit observed near a given city in May moved since 1 June?" is answerable, whereas "What is happening in the region?" is not.

A clear requirement also defines when to stop. Experienced OSINT teams set collection plans that list which sources will be checked, in which languages, over which time window, and what evidence would confirm or refute each hypothesis. That discipline keeps investigations efficient and reduces the risk of confirmation bias.

Types of open sources#

The main source families#

Open sources fall into several families. Traditional media, including newspapers, broadcast and wire services, remains essential for context and official statements. Social media and messaging platforms provide first-hand imagery and eyewitness accounts, often in real time. Government and corporate records, such as company registries, court filings, procurement notices and sanctions lists, provide documentary evidence that is harder to fake. Academic and technical literature, including patents and scientific papers, reveals capabilities and research priorities.

Geospatial sources form a family of their own. Commercial satellite imagery, aerial photography, mapping services and street-level imagery let analysts see places they cannot visit. Transponder data from aircraft (ADS-B) and ships (AIS) records movements, while specialist data such as fire detection from NASA's FIRMS satellites or seismic readings can corroborate explosions and strikes.

Chart: principal families of open sources. Source: RAGE X Intelligence Desk classification based on the Berkeley Protocol (2020) and IC OSINT Strategy (2024).

Commercially available information#

A growing share of OSINT relies on commercially available information (CAI): data that anyone can buy, such as high-resolution satellite imagery, shipping databases or aggregated location data. CAI is powerful but raises distinct concerns. In May 2024, ODNI published an Intelligence Community Policy Framework for Commercially Available Information, following a declassified 2023 advisory report that warned bulk commercial data could reveal sensitive details about individuals. Civil liberties groups such as the Brennan Center argued that the framework did not go far enough, showing that the boundary between open and intrusive collection remains contested.

Core OSINT techniques#

Geolocation#

Geolocation is the process of establishing exactly where a photo or video was taken. Analysts identify distinctive features such as building outlines, road junctions, mountain ridges, signage, power lines and vegetation, then match them against satellite imagery, street-level photography and maps. A competent geolocation is reported with coordinates and with annotated side-by-side imagery so that anyone can check the match. Embedded metadata such as EXIF GPS tags can help, but most platforms strip it on upload, so visual matching remains the core skill.

Chronolocation#

Chronolocation establishes when an image was captured. Shadows are the classic tool: given a confirmed location, the length and direction of shadows constrain the time of day and the time of year. Weather records, the state of construction visible in satellite imagery, seasonal foliage, and the first known appearance of a file online all narrow the window further. Together, geolocation and chronolocation turn an unverified clip into a dated, located piece of evidence.

Satellite imagery analysis#

Commercial providers now deliver sub-meter optical imagery, and synthetic aperture radar (SAR) satellites can image through cloud and darkness. Analysts use this imagery to monitor troop concentrations, airbase activity, damage to infrastructure, construction at missile or nuclear sites, and changes to vessels in port. Comparing images over time, known as change detection, is often more informative than any single frame. Free sources such as the European Union's Copernicus Sentinel satellites offer lower resolution but frequent revisits, which is valuable for tracking large-scale changes.

Flight and ship tracking#

Aircraft broadcast their identity and position through ADS-B, which became mandatory in most controlled US airspace from 1 January 2020. Aggregators such as Flightradar24 and ADS-B Exchange collect these signals and make them searchable, allowing analysts to follow military transport surges, government jets and surveillance flights. Ships carry the Automatic Identification System (AIS), required under the International Maritime Organization's SOLAS convention for most ships of 300 gross tonnage and above on international voyages. AIS data from services such as MarineTraffic reveals port calls and routes, and gaps or inconsistencies in that data can expose sanctions evasion, ship-to-ship transfers and identity spoofing.

Other techniques#

Investigators also use reverse image search to find earlier copies of an image, social network analysis to map relationships between accounts, document and corporate-record analysis to trace ownership, and weapons identification to match munitions remnants to known types. Increasingly, machine learning helps with triage, such as detecting objects in imagery or transcribing large volumes of video, but human judgment remains responsible for every conclusion.

Technique	Core question	Typical evidence	Common pitfall
Geolocation	Where was this captured?	Landmarks matched to satellite and street-level imagery	Matching generic features that appear in many places
Chronolocation	When was this captured?	Shadows, weather records, first upload time	Assuming upload time equals capture time
Satellite imagery	What changed on the ground?	Before-and-after optical or radar images	Misreading resolution limits or decoys
Flight tracking	Which aircraft moved where?	ADS-B and MLAT position data	Military aircraft often fly with transponders off
Ship tracking	Where has this vessel been?	AIS positions, port calls, ownership records	AIS can be switched off or spoofed

Table: core OSINT techniques and their limits. Sources: Berkeley Protocol (2020); FAA ADS-B mandate (2020); IMO SOLAS AIS requirements.

Verification: the discipline behind the discipline#

Provenance, source and content#

Verification is what separates professional OSINT from rumor. The standard approach examines three things. Provenance asks whether this is the original piece of content or a copy, and where it first appeared. Source asks who captured or posted it, what their track record is and whether they could plausibly have been present. Content asks whether the location, time, weather, equipment, uniforms and language are consistent with the claim.

A single piece of footage rarely settles a question. Analysts look for independent corroboration: a second video from a different angle, satellite imagery showing damage in the same location, or an official statement that unintentionally confirms a detail. Each additional independent source raises confidence; sources that copy each other add nothing.

Chart: a simplified verification workflow. Source: adapted from the Berkeley Protocol on Digital Open Source Investigations (OHCHR and UC Berkeley, 2020).

Preservation and confidence#

Online content disappears quickly as posts are deleted, accounts are suspended and platforms change. Professional investigators archive material as soon as it is found, recording the URL, time of capture and a cryptographic hash so they can later prove the file has not been altered. This chain of custody is essential if the evidence may end up in court.

Finally, verification ends in a judgment, not a certainty. Responsible OSINT reporting uses calibrated language such as "likely" or "almost certainly", explains the evidence behind each claim and publishes the method so others can test it. Transparency is the reason open-source findings can persuade skeptical audiences: anyone can retrace the steps.

Ethics and legal limits#

Publicly available is not the same as fair game#

The fact that information is accessible does not make every use of it acceptable. Combining scattered personal details into a single profile can expose private individuals to harassment, a practice often called doxxing. Data protection laws such as the EU's General Data Protection Regulation apply to personal data even when it is publicly visible, and platform terms of service may restrict scraping. Investigators must also avoid deception that crosses legal lines, such as accessing closed groups under false identities without a lawful basis.

Harm, safety and misidentification#

OSINT can cause real damage when it goes wrong. Online crowds have repeatedly misidentified innocent people as suspects after attacks, with lasting consequences for those named. Professional teams therefore set higher thresholds for naming individuals than for describing events, and they weigh the public interest against the potential for harm. The Berkeley Protocol also emphasizes the digital, physical and psychosocial safety of investigators, who may be exposed to graphic material or targeted by hostile actors, and of witnesses and victims whose content is analyzed.

Rules for states#

Government use of open sources is subject to additional oversight. In the United States, intelligence collection is governed by Executive Order 12333 and agency procedures, and the 2024 CAI framework requires agencies to catalog sensitive commercial data and apply safeguards. Other democracies apply comparable frameworks. Many independent investigators argue that such rules matter for legitimacy: OSINT gains authority precisely because it is transparent and lawful.

Case studies: MH17 and the war in Ukraine#

MH17: from social media to the courtroom#

On 17 July 2014, Malaysia Airlines Flight MH17 was shot down over eastern Ukraine, killing all 298 people on board, including 196 Dutch citizens. In the months that followed, Bellingcat and other investigators collected photos and videos posted by local residents and soldiers showing a Buk surface-to-air missile launcher moving through the region on the day of the shootdown and leaving afterwards with a missing missile. Using soldiers' social media posts and distinctive physical features such as a side dent and soot patterns, researchers linked the launcher to Russia's 53rd Anti-Aircraft Missile Brigade based in Kursk. Russia's Foreign Ministry dismissed the work as amateur.

The Dutch-led Joint Investigation Team reached the same conclusion about the brigade in May 2018. In November 2022, a Dutch court convicted two Russian men and one Ukrainian man of murder in absentia. In May 2025, the Council of the International Civil Aviation Organization ruled that Russia was responsible for the downing, in a case brought by Australia and the Netherlands; Moscow called the ruling "scandalous". In July 2025, the European Court of Human Rights also held Russia responsible. Open-source research did not replace official investigation, but it shaped the early evidence picture and showed how public material could be corroborated by intercepted communications and forensic analysis.

Ukraine 2022: OSINT in real time#

Russia's full-scale invasion of Ukraine in February 2022 became the most documented war in history. At around 3:15 a.m. local time on 24 February, Jeffrey Lewis of the Middlebury Institute noticed an unusual traffic jam on Google Maps on the road from Belgorod toward the Ukrainian border, hours before the scale of the invasion was clear; Google later disabled live traffic features in Ukraine. In the weeks before the invasion, analysts had already tracked Russian military convoys through TikTok videos and commercial satellite imagery.

After Russian forces withdrew from Bucha near Kyiv, Russia's defense ministry said its units had left by 30 March and that images of bodies were staged. The New York Times compared videos of bodies on Yablunska Street with Maxar Technologies satellite imagery dated 19 and 21 March, which showed objects consistent with bodies in the same positions while the town was under Russian control. Maxar said its imagery "verifies and corroborates" the footage. Throughout the war, projects such as Oryx have catalogued equipment losses only when supported by photographic evidence, an approach widely cited by analysts while acknowledging that it records a minimum rather than a complete count.

Case	Year	Key open-source methods	Outcome
MH17 shootdown	2014–2025	Social media imagery, geolocation, vehicle feature matching	Findings consistent with JIT (2018); Dutch court convictions (2022); ICAO Council (May 2025) and ECHR (July 2025) held Russia responsible
Invasion of Ukraine	2022	Live traffic data, social video, satellite imagery	Early public detection of troop movements
Bucha	2022	Satellite change detection, video geolocation and chronolocation	Imagery contradicted Russian claim that bodies appeared after 30 March

Table: selected OSINT case studies. Sources: NPR (2016); Government of the Netherlands (2025); Malay Mail/ICAO (2025); Vice (2022); Arab News/NYT/Maxar (2022).

OSINT careers and tool categories#

Roles and skills#

OSINT careers now span government, the private sector, journalism and civil society. Common job titles include open-source intelligence analyst, threat intelligence analyst, investigative researcher, due diligence analyst, sanctions and financial crime investigator, and visual investigations journalist. Employers range from defense and intelligence agencies to banks, consultancies, technology platforms, international organizations and NGOs.

The skills that matter most are less about specific software than about method. Strong candidates write clearly, think in hypotheses, understand the region or subject they cover, and are rigorous about sourcing. Foreign languages are a major advantage, as is familiarity with geospatial analysis, basic scripting for data processing, and the ethics and legal frameworks covered above. Many practitioners build portfolios through public investigations, training from organizations such as Bellingcat, and university programs that now teach open-source methods.

Tool categories rather than tool lists#

Specific tools change constantly, so it is more useful to think in categories. Search and discovery tools include advanced search operators and reverse image search engines. Geospatial tools include satellite imagery platforms, mapping services and 3D terrain viewers used for geolocation. Tracking tools include ADS-B and AIS aggregators. Archiving tools capture and hash web content for preservation. Records tools include company registries, court databases and sanctions lists. Analysis tools range from spreadsheets and link-analysis software to geographic information systems. Every tool should be judged by whether it supports verifiable, documented work.

Frequently asked questions#

What is OSINT in simple terms?#

OSINT, or open-source intelligence, is intelligence produced from information that anyone can lawfully access, including news reports, social media, public records, satellite imagery and transponder data. What makes it intelligence rather than research is purpose and process: it starts with a specific question, uses structured collection and verification, and ends with a judgment that helps someone make a decision. The US Intelligence Community defines it as intelligence derived exclusively from publicly or commercially available information that addresses specific intelligence priorities, requirements or gaps.

Is OSINT legal?#

Collecting and analyzing publicly available information is generally legal, but legality depends on jurisdiction, the type of data and how it is obtained and used. Privacy and data protection laws, such as the EU's GDPR, can apply to personal data even when it is public. Platform terms may prohibit scraping, and deceptive access to private groups can create legal risk. Government agencies face additional rules on collecting information about their own citizens. Responsible practitioners document their methods and seek legal advice for sensitive projects.

What is the difference between OSINT and normal research?#

The difference lies in purpose, method and output. Ordinary research may gather information broadly, while OSINT is driven by a defined intelligence requirement. OSINT also applies a formal verification process covering provenance, source reliability and content consistency, and it expresses conclusions with explicit confidence levels. Finally, OSINT is disseminated to a decision-maker or audience who will act on it. A collection of links is research material; a sourced assessment that answers a specific question is intelligence.

Who uses OSINT?#

Intelligence agencies and militaries use OSINT for situational awareness and to provide context for classified reporting. Journalists use it to verify images and investigate events they cannot reach. Human rights organizations and international courts use it to document violations. Companies use it for threat monitoring, due diligence, brand protection and supply chain risk. Banks and regulators use it to investigate sanctions evasion and financial crime. Researchers use it to track weapons programs and conflict trends.

How do I start a career in OSINT?#

Start by learning the fundamentals: the intelligence cycle, verification standards and the ethics of open-source work. Practice geolocation and chronolocation challenges, study published investigations to understand how analysts document their reasoning, and build a small portfolio of careful, transparent work. Training from organizations such as Bellingcat and university courses in digital investigations can help. Pair these methods with subject expertise, such as a region, language, industry or type of threat, because employers value analysts who understand context as well as technique.

Can OSINT evidence be used in court?#

Yes, provided it is collected and preserved properly. Courts expect a clear chain of custody, evidence that the material has not been altered and a transparent explanation of how conclusions were reached. The Berkeley Protocol, published in 2020 by the UN Human Rights Office and UC Berkeley, sets out standards for this kind of work. In the MH17 case, open-source material formed part of a much larger evidence base that contributed to convictions by a Dutch court in 2022.

The RAGE X view#

Open-source intelligence has moved from the margins of the intelligence world to its center in a little over a decade. The reason is not that public information has become more important than secret information, but that the volume, speed and precision of public information now allow independent analysts to answer questions that once required a state's collection apparatus. That shift brings a responsibility: as the barrier to entry falls, the value of rigorous verification, calibrated judgment and transparent method rises. The most influential OSINT work, from MH17 to Bucha, persuaded skeptical audiences because anyone could retrace its steps.

At RAGE X, we treat OSINT as a discipline rather than a feed. Our conflict monitoring through the RAGE INDEX and our reporting on RAGE Intel apply the same principles described in this guide: a clear question, independent corroboration, explicit confidence and attribution of contested claims. The next phase of the field will be shaped by commercial satellite constellations, machine-assisted triage and tighter rules on commercially available data, and the analysts who succeed will be those who combine new tools with old-fashioned skepticism. More on our work is available at theragex.com.

Sources#

1. CIA, "IC OSINT Strategy rollout" (March 2024): https://www.cia.gov/stories/story/ic-osint-strategy-rollout
2. ODNI, "The IC OSINT Strategy 2024–2026": https://www.dni.gov/index.php/newsroom/reports-publications/reports-publications-2024/3785-the-ic-osint-strategy-2024-2026
3. ODNI, "Intelligence Community Policy Framework for Commercially Available Information" (May 2024): https://www.dni.gov/files/ODNI/documents/CAI/Commercially-Available-Information-Framework-May2024.pdf
4. Brennan Center for Justice, "Intelligence Community's Policy on Commercially Available Data Falls Short": https://www.brennancenter.org/our-work/analysis-opinion/intelligence-communitys-policy-commercially-available-data-falls-short
5. CIA Center for the Study of Intelligence, "FBIS Against the Axis, 1941–1945": https://www.cia.gov/resources/csi/static/fbis-against-the-axis.pdf
6. Wikipedia, "Foreign Broadcast Information Service": https://en.wikipedia.org/wiki/Foreign_Broadcast_Information_Service
7. UC Berkeley Human Rights Center, "Berkeley Protocol on Digital Open Source Investigations": https://humanrights.berkeley.edu/programs/investigations/berkeley-protocol
8. NPR, "Russian Military Involved In Shooting Down Flight MH17, Researchers Say" (May 2016): https://www.npr.org/2016/05/07/477168263/russian-military-involved-in-shooting-down-flight-mh17-researchers-say
9. Government of the Netherlands, "European Court of Human Rights: Russia responsible for downing of flight MH17" (9 July 2025): https://www.government.nl/latest/news/2025/07/09/european-court-of-human-rights-russia-responsible-for-downing-of-flight-mh17
10. Malay Mail, "UN aviation body rules Russia responsible for downing Malaysia Airlines flight MH17" (13 May 2025): https://www.malaymail.com/news/malaysia/2025/05/13/un-aviation-body-rules-russia-responsible-for-downing-malaysia-airlines-flight-mh17-as-moscow-denounces-ruling-as-scandalous/176545
11. Vice, "Google Maps Live Traffic Showed the Russian Invasion of Ukraine" (February 2022): https://vice.com/en/article/google-maps-live-traffic-showed-the-russian-invasion-of-ukraine
12. Arab News (Reuters/NYT reporting), "Satellite images show bodies in Bucha for weeks, rebutting Moscow claim" (April 2022): https://www.arabnews.com/node/2056976/world
13. Centre for Information Resilience, "Disinformation & Denial: Russia's attempts to discredit open source evidence of Bucha": https://www.info-res.org/eyes-on-russia/reports/disinformation-denial-russias-attempts-to-discredit-open-source-evidence-of-bucha/

About RAGE X: RAGE X is a global media, intelligence and technology organization working across geopolitical intelligence, military and conflict analysis, OSINT, global news, security and software. Learn more at theragex.com.