OSINT ethics and legal boundaries: what open-source research may and may not do

What OSINT is

Open-source intelligence is information gathered from publicly available sources: websites, public records, registries, social media posts visible to anyone, news, and technical data such as DNS and certificate logs. Defenders use it to see what attackers could learn about their organization, journalists use it to verify events, and researchers use it to study threats.

Lines not to cross

Public does not mean anything goes. Do not log in with fake accounts to access private groups, bypass access controls or paywalls, use leaked credentials, contact or deceive people to extract information, or collect data on individuals without a lawful purpose. Privacy laws such as the GDPR apply to processing personal data even when it was public, so define purpose, minimize what you collect, and delete it when done.

• Have a written purpose and scope
• Collect the minimum needed
• Do not interact with or deceive subjects
• Respect terms of service and access controls
• Protect and delete collected personal data

Lab: write a scope statement

Before any exercise in this hub, write a one-paragraph scope: whose exposure you are assessing (yourself, or an organization that has authorized you in writing), which sources you will use, what you will not do, how you will store findings, and when you will delete them. Keep it with your notes. Review it if the research starts drifting toward individuals who are not in scope.

Scope: External exposure review of example.org (authorized by J. Smith, CISO, email 2026-11-01).
Sources: DNS, certificate transparency, search engines, public code repositories, the organization's own websites and social accounts.
Out of scope: employees' personal accounts, private groups, any login or contact with people, leaked credential dumps.
Storage: encrypted project folder; personal data minimized; delete 30 days after report.

Why defenders need this

Attackers use the same sources to plan phishing, find exposed services, and guess passwords. Running the review yourself, within a clear scope, lets you remove or reduce exposure before it is used.