OSINT NOTES

A lot of OSINT sources like to clarify what OSINT is or open source intelligence from the get go. They give trite and staid definitions that seem to clear the hurdle for legalese. The OHCHR Berkeley Protocol is thorough in its proceedings of jurisprudence and the juridical nature of investigations. However it is also noted that open source investigators are not vested with the same powers of legal entities such as the ability to subpoena or carry out a full fledged legal investigation. Open source investigators still have the responsibilities to protect witnesses and respect the rights of the accused as legal entities practice. There is a fair bit of legalese used in the Berkeley Protocol making it abstruse to a regular reader. There is a gamut of evidentiary practices with regards to copy right. You have to seek the permission of the creator of content to get approval for use. But there is the case of 'fair use' of media though there is a narrow allowance as evidence. Creative Commons licenses may allow for freer use but not strictly permission free. Security is an important aspect of Open Source Intelligence. CIA is briefly mentioned in the security section of the Protocol, CIA being Confidentiality, Integrity, and Availability. There are trade offs depending on what is prioritized. You cannot have them all; one is in exclusion of the other. Greater Confidentiality may mean less Availability. Greater Integrity may mean less Confidentiality. Greater Availability may mean less Confidentiality or Integrity. There are different levels of security from the organizational level, project level, and specific activities level. One must stress the importance of security in an Open Source investigation to avoid detriments of person, reputation, financial, or legal. There was a huge build up to the actual steps in an open source intelligence investigation. I suppose all the preliminary information was necessary to build off of as a base of knowledge to further an educational objective. Being outed in an investigation is part of security. You do not want to leak your identity depending on the level of scrutiny of third parties. You have to be sure to protect your cover identity and tailor your internet activity accordingly to your sock puppet account. There is an idea of contamination of digital devices. You should not use personal devices for professional investigation. Your user agent can leak and expose you to being ID'd by your device. You need to properly segment different investigations as well if there are multiple investigations being done. This is done at a device level. Also there is a risk of malware infections. Depending on the technological prowess of the investigated there could be risk of malware infections also considering the risk of drive by downloading of malware off of websites while conducting an investigation is a credible risk in an investigation. The cyber threats that exist run the gamut of denial of service attacks, social engineering, and man in the middle attacks. The Berkeley Protocol does not refer to sock puppet accounts as such but as virtual identities cultivated. There is a certain level of paranoia to the Protocol maybe due to the fact that a lot of human rights abuses are carried out by nation state actors and nation state actors such as Russia have a sophisticated cyber element at play that can track researchers and their research online. Being overwhelmed by the wealth of information and data seems to be a feature of open source investigations. There is so much information that it can overload your senses to take it in seemingly all at once. From what appears to be the crux of the job of the analyst to ingest information in bulk, process and then provide actionable intelligence for the decision makers. With the inundation of information, from technological advancements, the Analyst have taken an outsize role in the intelligence cycle. In the manual called Criminal Intelligence for Analyst there is a distinction made between "Strategic Intelligence" and "Operational Intelligence". Strategic Intelligence is more concerned with policy and positioning of an organization. Operational Intelligence is concerned with a direct end in an investigation. It is more local in scope and short term than Strategic Intelligence which is more long term. Intelligence is generally regarded as information that has been analyzed and being able to draw inferences for action. It is information that has been processed. Inferences are described as being speculative and uncertain with their own risks of being incorrect.