OSINT: what open-source intelligence is and where its limits lie

Open does not mean trivial

The abbreviation OSINT stands for open-source intelligence. “Open source” has nothing to do with software here: it means information that is not secret and can be reached without breaking any protection.^2,5

In their strategy for 2024–2026, published on 8 March 2024, the US Office of the Director of National Intelligence (ODNI) and the CIA describe OSINT as intelligence derived exclusively from publicly or commercially available information that addresses specific intelligence priorities, requirements or gaps. According to the document, OSINT has value of its own and also supports all the other collection disciplines.¹

The point about requirements matters. A piece of public information – an article, a photograph, an entry in a register – is not yet intelligence. It becomes intelligence only once someone has collected, assessed and processed it to answer a customer’s specific question (see intelligence requirement and intelligence cycle).^1,5

NATO doctrine AJP-2 (Edition A, 2016) defines OSINT as intelligence derived from publicly available information, as well as from other unclassified information with limited public distribution or access. So open sources include not only what lies on the surface but also, for example, specialist publications with a small readership.²

Where open knowledge comes from

AJP-2 lists radio, television, newspapers, state propaganda, journals and technical papers, the internet, technical manuals and books. The older ODNI page “What is Intelligence?” adds commercial databases as well as videos, graphics and drawings.^2,5

This is not an invention of the internet age. AJP-2 notes that there is considerable archival evidence that the intelligence community has always used open sources. The doctrine adds that freedom of information legislation around the world has unlocked many former state secrets, and the internet has made these resources easier to reach.²

According to AJP-2, OSINT is the most likely source of basic intelligence, meaning general knowledge of a country or environment: its geography, economy and institutions. It can also feed current intelligence – the doctrine acknowledges that, with modern news-gathering equipment, television reporting is sometimes used for current assessments.²

Who does OSINT in the United States

According to ODNI, open-source collection is spread across the US intelligence community. The major collectors were the DNI’s Open Source Center and the National Air and Space Intelligence Center.⁵

ODNI’s 2009 guide describes the Open Source Center as the body that collects, translates and analyses open information; the Director of the CIA served as its executive agent. ODNI and the CIA issued the 2024–2026 OSINT strategy jointly, and ODNI writes that the community has been working to modernise its approach to collecting, creating and delivering OSINT.^1,6

OSINT is one of several disciplines, alongside HUMINT, SIGINT, IMINT and MASINT. We compare them in HUMINT, SIGINT, IMINT, OSINT: how the intelligence disciplines differ.^2,5

The first limit: reliability

Being public does not make information true. AJP-2 points out that information may be unreliable or inaccurate for many reasons, including deliberate deception and subjectivity. The doctrine applies this caution to all disciplines, and so also to open sources, where anyone can publish.²

That is why the doctrine recommends corroborating information from several sources: time spent on confirmation increases certainty and reduces risk. The American counterpart is all-source intelligence, which combines OSINT with the other disciplines. The problems an open-source analyst faces every day are described in our article on disinformation and FIMI.^2,6

The second limit: criminal law

With OSINT it is easy to assume that if information is public, collecting it cannot be a crime. Polish law sees it differently once a foreign intelligence service is involved. Since 1 October 2023, Article 130(3) of the Criminal Code has provided for six months to eight years’ imprisonment for anyone who declares readiness to act on behalf of a foreign intelligence service against the Republic of Poland, or who, in order to pass to a foreign intelligence service information whose disclosure may harm Poland, gathers or stores it or enters an IT system to obtain it.³

The provision does not speak of classified information but of information whose disclosure may cause harm. What decides liability is therefore the purpose and the recipient – a foreign intelligence service – not whether the data could be found online. Taking part in the activity of a foreign intelligence service against Poland, or acting on its behalf, is itself punishable by at least five years (Article 130(1)); see espionage.³

Polish statutes on the intelligence services do not use the terms OSINT or “open sources”. Among the tasks of the Foreign Intelligence Agency, the Act on the ABW and the AW lists, in general terms, obtaining, analysing, processing and passing to the competent authorities information of significance for Poland’s security, international standing and economic and defence potential (Art. 6(1)(1)), without distinguishing where the information comes from.^7,8

The third limit: personal data

Much open information concerns people: names in company registers, photographs, social media posts. In the European Union its processing is governed by the GDPR, Regulation 2016/679 of 27 April 2016. Its scope, however, has clear exclusions.⁴

The GDPR does not apply to activities outside the scope of Union law (Art. 2(2)(a)); recital 16 gives national security as an example. Nor does it apply to competent authorities processing data for the prevention, investigation, detection or prosecution of criminal offences or the execution of penalties (Art. 2(2)(d)) – according to recital 19, a separate Union act governs those matters. State intelligence work is therefore governed above all by national law and its oversight mechanisms (see Who oversees Poland’s special services).⁴

For everyone else – companies, researchers, journalists, OSINT enthusiasts – the fact that data are public does not switch off the GDPR. The Regulation expressly provides for a separate duty to inform where data have not been obtained from the person concerned (Art. 14), and special categories of data, such as health or beliefs, may be processed among other cases where the person has manifestly made them public (Art. 9(2)(e)) – the provision refers to publication by that person themselves.⁴

The case behind the first fine imposed by the Polish supervisory authority shows this. Bisnode (now Dun & Bradstreet) took data on people running businesses from public registers such as KRS, CEIDG and REGON and did not inform them of the processing. The President of the UODO held that the company had to comply with the duty under Article 14 of the GDPR and imposed a fine of just over PLN 943,000. The Supreme Administrative Court dismissed the company’s cassation appeal (ref. III OSK 2538/21) and confirmed the duty to inform people running a business. The regional administrative court had annulled the decision as regards people who ran a business in the past, and consequently the fine as well; the UODO is reconsidering the case to that extent.⁹

What follows

OSINT is not “spying without spies” but analytical work on open material. Its strength lies in scale and accessibility, its weakness in reliability. The limits are set not by the technique but by the purpose and the recipient: the same search engine serves a journalist, a company and an intelligence analyst, and in the hands of someone working for a foreign intelligence service it becomes a tool of crime.^2,3,4