What Is OSINT? Understanding Open Source Intelligence in 2026

OSINT Journalism: An Expository Analysis

Executive Summary: Open-Source Intelligence (OSINT) journalism harnesses publicly available digital information to support reporting. At its core, OSINT means using open data—social media posts, videos, news reports, satellite imagery, public records, etc.—to answer specific questions and uncover facts. Journalists employ systematic OSINT steps: collecting relevant data, verifying authenticity (e.g. checking metadata or geolocation), analysing patterns or networks, and attributing findings (identifying people or places). In practice, OSINT tools range from simple (Google searches, image reverse-lookup) to advanced (satellite mapping, specialised plugins). For example, Bellingcat used OSINT video analysis to locate a massacre site in Ethiopia, and satellite plus ship-tracking data to trace a sanction-evading grain shipment from Ukraine. OSINT has also illuminated events like conflict incidents (e.g. analysing Gaza attack videos and audio) and environmental harms (e.g. mapping war-related deforestation via satellite). These examples show OSINT’s powerful impact. However, journalists must navigate legal and ethical limits: even public data are subject to privacy laws (GDPR, CCPA), rules about consent and doxxing, and the need for secure, careful handling. OSINT has pitfalls: data overload, misinformation (deepfakes or old media used misleadingly), and cognitive bias can lead to errors. This report explains OSINT step-by-step, surveys key 2025 tools (free and paid), details real-world cases, discusses legal/ethical issues, outlines common pitfalls, and offers a beginner’s checklist. An executive summary appears here, followed by structured analysis, tables, and a concise glossary.

What Is OSINT in Journalism?

Open-Source Intelligence (OSINT) refers to collecting and analysing information from publicly accessible sources to produce insights. In journalistic terms, this means using openly available digital content (social media posts, videos, news articles, corporate data, etc.) to investigate stories. For example, OSINT analysts might use satellite photos, social-media videos, or leaked data to verify events or track wrongdoing. Unlike covert intelligence gathering, OSINT relies only on data meant to be in the public domain. As one analyst explains, OSINT is “the analysis of openly available digital footage and data – video, audio, pictures (including satellite images), geolocation data, weapons movements and so forth – to answer intelligence questions”. In journalism, OSINT acts as a tool to corroborate and enrich reporting. It can complement traditional reporting: for instance, when on-the-ground access is limited, OSINT can help piece together timelines or verify accounts. It does not replace reporting but provides data-driven evidence to support stories. Organisations like Bellingcat and investigative teams at news outlets have pioneered OSINT methods to expose corruption and document war crimes.

How OSINT Works: Step-by-Step

An OSINT investigation follows a systematic workflow of defining, collecting, verifying, analysing, and attributing information. The typical steps are:

• Define the Question/Scope: Start with a clear question (e.g. “Who is responsible for this explosion?” or “What is the origin of that shipment?”) and determine what types of open data might help answer it.
• Identify Data Sources: OSINT uses myriad sources. These include social media platforms (Twitter/X, Facebook, TikTok), websites and news archives, public records (company registries, government filings), forums, satellite imagery, mapping services, video-sharing sites, and even the “dark web” (for certain leaks). For example, corporate registries or leaked databases can illuminate financial networks; social posts and videos can show events; satellite maps can verify locations.
• Collect Data Methodically: Using the identified sources, gather relevant information. This may involve manual search (e.g. Google advanced queries, Boolean search on social media), specialised search tools (like threat- or social-data search engines), or data-scraping tools. Investigators often archive content (screenshots, downloads) along with metadata (URLs, timestamps, poster ID) as they go. For efficiency, many rely on specialised tools and aggregators (see next section).
• Verify and Authenticate: Crucial to OSINT is verifying that content is genuine. Reporters examine metadata (e.g. image EXIF data, video frame information) and use geolocation (matching landmarks in photos to maps) and chronolocation (using shadows, weather, or contextual clues to timestamp an image). Common methods include reverse-image searches (to check if a photo appeared elsewhere), cross-referencing multiple independent sources, and applying tools like the InVID plugin for video frame extraction. As one guideline notes, OSINT findings are leads, not conclusions: you must cross-check evidence (for instance, confirming that “blood stains” in a video are actually what they appear) and seek on-the-ground confirmation if possible.
• Analyse and Corroborate: Once verified data are collected, analysts look for patterns and connections. This might involve network analysis (linking people or organisations via shared attributes), timeline reconstruction (assembling events in order), or geospatial analysis (mapping movement). For example, investigators might map a shipment’s journey by combining ship-tracking (AIS) data with satellite images, or trace digital footprints of extremists across platforms. The goal is to turn raw data into actionable intelligence – insights that support a journalistic claim.
• Attribution and Context: Finally, OSINT often involves attributing actions to actors. This could mean identifying who made a post, which unit used a weapon (through markings or vehicle IDs), or which company sold illicit goods. Attribution requires careful evidence: publicly claiming someone’s role (e.g. “we identified General X in this video”) typically relies on multiple clues (uniforms, language spoken, official records). It is an advanced step and demands extra caution: misidentification can harm innocents (see Pitfalls).

Throughout this process, investigators document everything. They record search queries, tool outputs, screenshots, and data sources with dates. This creates a chain of evidence for transparency. As one OSINT guide notes, investigators should “collect what is relevant, archive it, and analyze it without error”, and should “document the actions and steps you make” to ensure accountability.

mermaidCopyflowchart LR  A[Define Question/Scope] --> B[Identify Open Data Sources]  B --> C[Collect Data (search, archive, scrape)]  C --> D[Verify Authenticity (metadata, geolocation, reverse search)]  D --> E[Analyze Patterns & Corroborate]  E --> F[Attribute to Actors and Context]  F --> G[Report Findings (with sources and documentation)]

Figure: OSINT investigation workflow (adapted for journalism).

Tools and Platforms (2025)

Journalists today have a rich toolkit of OSINT platforms. Many are free, open-source or browser-based; others are paid or proprietary. We highlight key categories and examples of tools in use by 2025. Some tools serve multiple functions (e.g. Bellingcat’s toolkit) while others are specialised. We summarise common options in the table below:

Table: Key OSINT tools and platforms used by journalists in 2025. Sources for specifics: [35], [49], etc.

Many of these are complementary. For example, a typical image-check might use ExifTool (free) to read metadata, Google/Yandex to do a reverse-image search, and Google Maps/Earth to geolocate landmarks. Many tools (e.g. Maltego, Orbis, LexisNexis) require subscriptions or fees, whereas key tools like Google searches, Google Earth, reverse-image search, OSINT Framework, InVID plugin, ExifTool, and Sentinel-EO Browser are freely accessible. Bellingcat’s newly released Online Investigations Toolkit catalogues hundreds of tools, marking which are free vs paid.

Case Studies of OSINT Impact

OSINT has proven transformative in numerous investigations. Below are examples where open sources yielded breakthrough reporting:

• Conflict and War Crimes: Investigators have used social-media videos and satellite imagery to document atrocities. In Ethiopia’s Tigray war (2021), analysts found videos of a reported massacre. By analysing shadows and terrain, they pinpointed the location (the village of Mahbere Dego) and time. They identified Ethiopian soldiers (by language and uniforms) as perpetrators, and published a report with Newsy/BBC that local forces carried out the killings. Many used freely available tools (Google Earth, PeakVisor, open data) to do this. Another example: Bellingcat traced a grain-carrying ship (the Zafar) violating Ukraine sanctions. They combined Planet Labs satellite images with AIS vessel data and Lloyd’s ship registries to reconstruct the ship’s route from Crimea to Yemen. This exposed how Russian-occupied grain was laundered into global markets. Such OSINT findings “can be really, really important,” noted an OSINT journalist.
• Verifying Attacks: In conflict zones, OSINT can verify what weapon or direction caused an incident. For instance, after a hospital explosion in Gaza (Oct 2023), reporters used open camera footage and satellite maps to trace the trajectory of the rocket. Wall Street Journal analysts found that footage from multiple locations showed a rocket coming from within Gaza, not from Israel. An NPR science reporter similarly highlighted how acoustic analysis (using open audio of rockets) confirmed this conclusion. These OSINT analyses helped correct initial misreporting by pinpointing the true origin of the blast.
• Environmental Crimes: OSINT is valuable for environmental reporting. NGOs have created platforms (e.g. Global Forest Watch) that publish satellite data on deforestation. In Ukraine, an OSINT Forest Area Tracker (built on Google Earth Engine) enabled analysis of war-related forest damage. Researchers selected dates and areas to map burned or cleared land, cross-checking with Sentinel-2 satellite imagery. By combining this with local reports, they could assess unexplored environmental harm from conflict. More broadly, public databases (e.g. land registries, pollutant reports) have supported investigations into illegal mining, deforestation, or pollution. For example, an African nonprofit used public data to expose “green” supply chains fueling Amazon deforestation, illustrating how open data drives accountability.
• Accountability Reporting: OSINT can unmask financial and political corruption. (While not a single case here, historically investigations like the Panama Papers used leaked data via networked collaboration.) Current OSINT workflows allow reporters to chain-connect corporate filings, leaked document troves (via tools like Datashare or Aleph), and public sanctions lists. These have revealed hidden company owners and illicit flows. Bellingcat’s toolkit even includes specialised resources (like the Open Source Munitions Portal) to identify weapons from user photos.

These cases show that by systematically mining open data, journalists can uncover truths out of reach of normal reporting, often faster and with strong evidence. Many major news stories (e.g. identifying aircraft types, verifying footage of human rights abuses, tracking disasters) have been made possible only because open-source data could be assembled and analysed.

Legal, Ethical, and Safety Considerations

OSINT journalism operates in a complex legal and ethical landscape. While collecting public information is generally legal, journalists must guard privacy, consent, and safety at every step. Key considerations include:

• Privacy Laws: Even public data can implicate privacy rules. In the EU, the General Data Protection Regulation (GDPR) restricts how personal data (even if published) can be processed. California’s CCPA imposes similar obligations for some data. Journalists should practice data minimisation: gather only what’s relevant to the story. Where possible, anonymise or blur incidental personal details, especially of private individuals. As one analyst advises: “collect only relevant data… store it securely”. Open data about public figures can be used more freely, but revealing sensitive details about private persons (e.g. home addresses) risks violating privacy and journalistic ethics.
• Consent and Public vs Private Data: By definition, OSINT uses publicly accessible information. Journalists must not cross into illegal access (hacking or paid private databases). For example, scraping a website behind a paywall or exploiting a login breach would be illegal. If information is only available through legal means (like a public archive or database), it can be used; otherwise, do not hack to get data. Ethically, some information might be public but exploitative to use (e.g. private home videos posted by victims). Journalists should weigh consent and public interest: identifying a war-crime suspect is valid, but “posting someone’s home address with intent to harass” is doxxing and unethical.
• Doxxing and Harassment: Journalistic OSINT must avoid doxxing: publishing personal data (contact info, addresses) that can harm individuals. There is a clear ethical line between accountability journalism (naming officials who commit atrocities) and invasion of privacy (exposing unrelated personal details). As guidelines state: “We don’t doxx people”. Always consider the impact: revealing a whistleblower’s identity without consent or necessary cause is unethical and dangerous.
• Jurisdictional Limits: Laws vary by country. What is legal data collection in one place may be illegal elsewhere. For instance, deep legal protections in Europe might make scraping certain social data problematic, while other places have fewer safeguards. Investigators should be aware of local rules, including those on recording (some countries require consent for interviews or calls). One OSINT guide recommends journalists know the laws in every relevant location. Using VPNs and secure browsers can help protect the investigator’s identity when working across borders.
• Ethical Codes: Traditional journalism ethics still apply. The Society of Professional Journalists’ principles—to seek truth, minimise harm, and be accountable—extend to OSINT. That means fact-checking findings rigorously (treat OSINT as leads, not final answers), and correcting errors. “We verify before we publish” is a new OSINT maxim. Journalists should also be transparent about methods when appropriate (document sources, cite evidence) and ready to be held accountable. Many newsrooms now encourage explicit OSINT protocols: e.g. “We don’t hack or break the law. We don’t publish private info without compelling reason. We fact-check and verify each claim”.
• Digital and Physical Safety: Using OSINT tools can expose journalists to risks. Websites and links may carry malware; open networks can surveil or censor investigators. Using a secure, updated operating system (or a dedicated OSINT machine), employing VPNs/Tor, and avoiding login with personal accounts are prudent measures. Reporters should also protect mental health: reviewing graphic war footage or hate speech can be traumatic, so plan for counselling or peer support. Furthermore, if an OSINT investigation targets a powerful actor (organised crime, authoritarian regime), reporters must consider retaliation risks. Anonymous publication (through intermediaries) or maintaining strict confidentiality about the investigation may be needed. As one analyst notes, creating a personal code of conduct (e.g. “what I will never do”) before starting an investigation is wise.

The table below summarises key legal/ethical issues and safe practices:

Table: Legal and ethical considerations in OSINT journalism (citations above).

Limitations and Pitfalls

While powerful, OSINT has inherent limitations. Journalists must remain aware of these common pitfalls:

• Misidentification and Attribution Errors: OSINT sources are raw data, not verified facts. Without care, one can misidentify people or locations. For example, a photo of a bystander might be mistaken for a suspect if not cross-checked. Raw data often contains errors: outdated info, duplicate records, or false leads. Hence, cross-verification is essential. OSINT expert advice warns that “misattributed IP addresses, false positives, [or] outdated records” can mislead analysts. Always verify identity by multiple signals (e.g. match a name with a consistent online footprint, official ID, or corroborating source).
• Deepfakes and Manipulated Media: Advances in AI make convincingly fake images/videos increasingly common. Generative models can insert realistic landmarks or people into footage, creating shallowfakes or deepfakes. OSINT traditionally trusted geolocation as proof of authenticity, but now even a geolocated scene can be artificially constructed. As one study notes, “a geolocated video may suggest an event occurred at that location, but it does not guarantee the footage is genuine”. Analysts must therefore scrutinise content for subtle artefacts (inconsistent lighting, irregular facial geometry, audio glitches) and use detection tools. However, AI-detection software is imperfect; it may produce false positives or negatives. The only remedy is scepticism: when possible, obtain a source or witness, and treat potentially AI-generated content as unverified until confirmed.
• Confirmation Bias: Investigators can fall prey to cognitive bias, consciously or unconsciously seeking data that fits their hypothesis. For example, if one believes a certain official is guilty, there may be a tendency to accept weak evidence that confirms that view. Journalists must systematically check contradictory evidence and consider alternative explanations. Peer review or collaborative teams (as practised by OSINT collectives) can help catch bias. OSINT methods stress that verified clues are leads, not conclusions. Always ask, “What evidence would disprove this?” and pursue it.
• Information Overload and Fragmentation: The vast amount of data online can overwhelm analysts. Important clues can be buried among irrelevant information. Moreover, relevant data may be scattered across platforms (e.g. fragments of a story on Twitter, Telegram, YouTube). Effective OSINT requires good tool use and focus: use aggregation tools or databases to collate relevant info (like the Online Investigations Toolkit). Prioritise sources by reliability, and document systematically to avoid losing critical pieces.
• Platform Limitations: OSINT success can depend on platform policies. Recent changes (e.g. Twitter/X API restrictions) have reduced data accessibility. This can hamper investigations. Journalists should diversify sources and not rely on a single platform. If data disappear or accounts are suspended, alternative archives or user contributions may be needed.
• Technical Limitations: Some analysis (e.g. fine-grained satellite imagery or proprietary databases) may require tools journalists can’t easily afford. This can limit evidence quality. Partnerships with organisations (NGOs, academia) or using open low-res alternatives (Sentinel imagery) can partly address this gap.

In sum, OSINT is a powerful investigative approach but must be used judiciously. Confidence in findings should be proportional to verification: verified geolocation or metadata gives partial confidence in when/where something happened, but not necessarily what it definitively means. The OSINT community emphasises an “arms race” mindset – as deceivers get better at faking content, investigators must update their methods and remain vigilant.

Getting Started: Responsible OSINT Practices

For journalists or researchers new to OSINT, here is a concise workflow and checklist to ensure responsible, effective practice:

1. Define Your Objective: Clearly state the question or claim you want to investigate. Keep it specific (e.g. “Did X happen on Y date at location Z?”). A clear scope prevents aimless data collection.
2. Plan Ethically: Before collecting, consider potential legal/ethical issues (see above table). Decide in advance: “We will only use public data, we will not hack, we will not collect irrelevant personal info.” Having these rules documented (a personal OSINT code of conduct) prepares you for dilemmas.
3. Gather Open Data: Search across diverse sources. Use targeted queries (e.g. site:domain.com [keyword], hashtag or user searches, corporate registry searches). Use archival tools (Internet Archive) to find deleted content. Save all raw data: take screenshots and note URLs, timestamps, and any user info. Keep a log (spreadsheet or database) of every finding. For efficiency, employ known tools: e.g. reverse-image search engines, social media monitoring tools, the Bellingcat toolkit directory.
4. Verify Carefully: For each piece of evidence (a photo, video, document), apply basic checks:
   • Geolocation: Do landmarks match maps? (Use Google Earth, Mapillary, or SunCalc for shadows.)
   • Chronolocation: Are timestamps plausible? (Check shadows, seasonal clues, metadata.)
   • Source Authentication: Can you find the original upload? (Use the Wayback Machine or metadata viewers.)
   • Cross-Reference: Does independent reporting or multiple witnesses support it? Always treat OSINT clues as leads. As one guide warns: “OSINT alone is never enough… it means seeking ground truth”.
     Use tools like InVID for videos, ExifTool for images, and analysis guides (e.g. GIJN’s AI-detection checklists). These steps should take a few minutes per item; doing them before publishing is essential to avoid being misled.
5. Analyse and Document: Organise verified data to conclude. Use spreadsheets or databases to link entities (people, companies, locations). Maintain evidence files (PDF or image with URL and date stamps). Note any uncertainties clearly. If possible, have a colleague review your chain of evidence.
6. Maintain Security: Use secure communication (encrypted email/Signal) when discussing sensitive OSINT leads. Operate on a separate OSINT device or virtual machine to reduce risk of malware. Employ VPNs/Proxies to mask IP. Limit personal exposure (do research from accounts not tied to your identity).
7. Follow Up and Report: Before publishing, re-verify critical facts (e.g. through a reliable source). Clearly cite sources (when possible) and explain methods, so others can reproduce your verification. If new information emerges that contradicts your findings, be prepared to correct the record.

mermaidCopyflowchart LR  A[Define clear research question] --> B[Plan ethics & legal constraints]  B --> C[Collect open data systematically (with logs)]  C --> D[Verify each piece (metadata, context, cross-check)]  D --> E[Analyze data (compile evidence, look for patterns)]  E --> F[Document sources and reasoning transparently]  F --> G[Publish findings responsibly (with citations)]

Figure: Responsible OSINT workflow checklist.

By following these steps and continuously learning (e.g. attending OSINT training, reading tool guides), journalists can build effective, ethical OSINT practices. Regularly consult resources like Bellingcat tutorials, GIJN guides, and communities (Discord, Telegram groups) to stay updated on new tools and techniques.

Glossary of Key Terms

• OSINT (Open-Source Intelligence): Collecting and analysing information from publicly available sources (media, internet, public records) to produce actionable intelligence. Not to be confused with open-source software.
• Verification: The process of confirming that data or content is authentic. In OSINT, this involves checking metadata, geolocation, timestamps, and looking for corroboration.
• Geolocation: Determining the geographic location of where an image or video was taken by matching visual landmarks or using GPS metadata.
• Chronolocation: Determining the date/time when an image or video was created, using clues like sun angle (shadows), weather, or metadata timestamps.
• Metadata: Data embedded in files (e.g. camera make, GPS coordinates, timestamps in a photo), which can be extracted to verify authenticity.
• Deepfake: An AI-generated fake image, video, or audio that convincingly mimics a real event or person. Requires careful detection.
• Doxxing: Publishing someone’s private personal information (address, phone, etc.) with malicious intent. Considered unethical.
• VPN (Virtual Private Network): A service that encrypts internet traffic and masks IP addresses to protect privacy. Used by journalists to secure OSINT activities.
• Wayback Machine: An archive of past versions of web pages (archive.org), useful for checking when content first appeared or whether it was altered.
• Crowdsourcing: Gathering information from a large number of people, often via online communities or platforms. In OSINT, this could involve public appeals for information or collaborative databases.
• Chain of Custody: Documentation of how evidence was collected and handled, ensuring its integrity. In journalism, keeping source details (URLs, dates) is an informal form of this concept.
• Confirmation Bias: The tendency to search for or interpret information in a way that confirms one’s preconceptions. Journalists must actively guard against this in OSINT.
• CrowdTangle: A Facebook-owned tool for analysing public content on Facebook and Instagram (used by journalists to track viral posts).
• EXIF (Exchangeable Image File): Metadata format for images, includes camera settings, often GPS data.
• NVD (Natural Earth, etc.): Example of public GIS datasets for maps and geography.
• OpenCorporates: An open database of corporate registry data globally, often used in OSINT.

Each of these terms is integral to understanding OSINT workflows. By using this glossary, journalists can quickly grasp the technical jargon and focus on applying OSINT techniques correctly.

Sources: Authoritative articles and guides (OSINT training sites, journalism networks) were used throughout this report, including the International Centre for Journalists, Reuters Institute, Al Jazeera Institute, and specialist OSINT publications. The endnotes above link to these sources for verification of the details provided.

OSINT Investigative Intelligence Hub by Tuhin Sarwar, Open Source Intelligence journalist in Bangladesh

OSINT in simple words: what it is, how it works, and why it is needed in 2026
Finding information doesn’t mean hacking it. OSINT (Open Source Intelligence) is a legal open source intelligence service. We will tell you how public data is used: profiles in social networks, leaks, photos, correspondence in Telegram, company websites, even comments on forums to find the necessary information.