What is Open Source Intelligence?

There are two methods of data collection and information gathering used in military observation. Covert gathering refers to the use of clandestine, or secret data sources. As a result, covert methods are often illegal due to being performed secretively. Overt data collection refers to methods used openly or in plain sight. Overt does not involve the use of secretive methods and is generally not illegal. But what is Open Source Intelligence?

Open Source Intelligence is an overt method of data collection. Furthermore, publicly available resources are what distinguish OSINT from other forms of intelligence gathering.

How is Open Source Intelligence performed?

Open source intelligence involves gathering information from publicly available resources. There are six main categories to OSINT.

The first is the use of public media sources. This category includes news reports, printed magazines, and newspapers.

Internet is the second category and can include everything from online databases, social media, and search engine manipulation. In addition, it also includes online publications such as blogs and discussion groups.

Category three involves the use of public government data. These sources include public hearings, budgets, directories, and publicly available government reports. Although included in public records, the data comes from official sources.

Professional and academic publications is the fourth category. These sources include academic papers such as theses, dissertations, and journals.

The fifth category is the use commercial data such as corporate databases, financial, and industrial assessments.

The final category is the use of grey data. Grey data, or “hard to find” data includes business documents, unpublished works, technical reports, as well as patents.

What are the risks involved with Open Source Intelligence?

There are a number of tools available for performing Open Source Intelligence. Exploits exist for manipulating public records and search engines such as Google Dorks. Open-source software to streamline and automate this process is widely available online. Tools such as Shodan and The Harvester come pre-packaged in Kali Linux. Websites exist for the sole purpose of exploiting databases and searches.

The main risk involved with practicing OSINT is data overload. The rapid increase and collection of data, called “information explosion,” can cause an overload of information. Interpretation can be stalled if there is too much information to sort through. In addition, corporate or industrial espionage can result from certain forms of OSINT. Espionage is highly illegal and can result in fines, imprisonment, or both. In extreme cases, acts of treason can occur through the use of OSINT.

Implications to cybersecurity

Open Source Intelligence has many practical applications. However, Social Engineering hackers employ OSINT to research their target prior to an attack. Pretexting requires extensive research prior to setting up the attack. A pretexter will use OSINT to gather extensive information about the target. Impersonation is another form of pretexting that requires extensive research. Cyberstalkers and bullies use OSINT to monitor, track, and exploit their victims.