Osint Investigation

OSINT Investigation

Single entry skill for open-source intelligence work — civilian, lawful, defensible. The engine refuses state-intelligence, surveillance, harassment, doxxing, and stalking-adjacent uses. Load pi-investigation for licensed-PI workflows; load due-diligence for corporate-vetting work.

Investigation-type router

The OSINT cycle (universal)

references/osint-methodology.md carries the full cycle. Quick reference:

1. Plan — define the question, the deliverable, the legal/ethical bounds, the timebox.
2. Collect — open-source channels only; archive snapshots at capture time.
3. Analyse — synthesize across sources; flag confidence per claim.
4. Disseminate — produce the artifact (report, brief, chronology, profile) with provenance per claim.

Source posture (mandatory pairing with source-evaluation)

OSINT lives or dies on source vetting. Every claim drawn from an open-source channel must pass through source-evaluation:

• Tier the source (1–5 credibility ladder).
• Apply Burke pentad to primary documents.
• Apply Tudor twelve points to media / journalism.
• Apply Silverman media-forensics to images / videos.
• Triangulate tier-5 claims against ≥2 tier-1–3 sources.

A single-tier-5 OSINT report is not an OSINT report; it is a rumour log.

Reference index

Lawful / unlawful boundary (engine refuses)

The engine refuses:

• State-intelligence collection or surveillance.
• Doxxing or harassment-enabling output.
• Pretexting for credentials / accounts (impersonation).
• Bypassing access controls (TOS-violating scrape of authenticated content).
• Information about minors except in narrow safeguarding contexts with explicit authorisation.
• Output that would identify a private individual's home address, schedule, or family without a verified safeguarding or legal authority.
• Operational targeting of specific living people in jurisdictions where such targeting is illegal or risks violence.

The engine permits, with discipline:

• Public-record research (court filings, regulator publications, registries).
• Map-of-public-footprint reporting on public figures, executives, and entities.
• Adverse-media collation tied to a defensible diligence purpose.
• Chronology of public events.
• Skip-tracing for legitimate civilian purposes (debt collection by licensed parties, journalism, family reconnection — never for stalking).

Universal output rule

Every claim in any OSINT artifact carries:

• Source URL or document ID (with archive snapshot).
• Source tier (1–5).
• Capture timestamp (UTC).
• Confidence (high / medium / low).
• Verification notes (Burke / Tudor / Silverman if applicable).

Claims that fail the rule do not ship.

Universal anti-patterns

• Single-tier-5 sourcing for a load-bearing claim.
• "Public record" cited without the actual record (URL, case number, registry hit).
• Screenshot of a social-media post with no archive and no posting timestamp.
• Profile of a private individual built without a defensible diligence purpose.
• Chronology with mixed-confidence events not flagged as such.
• Image used as evidence without a reverse-image-search trail.
• Mixing OSINT outputs with PI workflow steps that require licensure (load pi-investigation for those).
• "It was on Reddit" treated as evidence of fact rather than evidence of a claim being made.
• Scraping authenticated content to build the file (TOS violation; tier-5 evidence at best).
• Skip-tracing for purposes outside the lawful list above.

Universal ship gate

• Investigation goal stated in writing; deliverable named; legal/ethical bound stated.
• OSINT cycle (plan / collect / analyse / disseminate) followed.
• Every claim has source ref + tier + capture timestamp + confidence.
• Tier-5 claims triangulated against ≥2 tier-1–3 sources.
• Archive snapshots captured for every URL.
• Images / videos checked via Silverman workflow.
• Chronology gaps named, not papered over.
• Refusal-list checked: no doxxing, no minors, no state-intel, no pretexting, no TOS-violating scrape.
• Engine-level guardrail (source-evaluation/references/evidence-discipline.md) audit run.

Companion skills

• source-evaluation — universal source vetting (mandatory pairing).
• due-diligence — when the investigation is corporate/financial vetting.
• pi-investigation — when licensed-PI workflows apply (chain-of-custody, formal report).
• web-scraping-foundations — when collection requires automation.
• report-and-proposal-craft — for the artifact form.

Use When

• Use for a lawful civilian investigation based on publicly available sources.

Do Not Use When

• Refuse surveillance, stalking, harassment, doxxing, credential theft, impersonation, or targeting that could expose a private person to harm.

Inputs

Workflow

1. Confirm purpose, legality, proportionality, subject risk, and stop conditions.
2. Define questions and collect the minimum necessary public material with provenance.
3. Corroborate identity and claims; stop on private-data exposure, unlawful access, or material misidentification risk.
4. Build chronology and findings; recover from blocked access by recording no source found and narrowing conclusions.

Capability Contract

Default to read-only public-source research. Network collection must stay within authorised lawful scope; contact, bypass, surveillance, or publication of personal data requires separate lawful authority and may be refused.

Degraded Mode

Without source access or identity corroboration, return a collection plan and explicit gaps, not a speculative profile.

Decision Rules

Outputs

Osint Investigation Evidence Notes

• Preserve URLs, lawful captures, identity-resolution notes, contradictions, and no-source-found results.

Quality Standards

Minimise personal data, separate allegation from verified fact, and make confidence and limitations visible.

Anti-Patterns

• Treating a matching name as identity proof. Fix: corroborate independent identifiers.
• Republishing unnecessary personal data. Fix: redact and minimise.
• Using one adverse-media item as fact. Fix: verify and label allegation status.
• Bypassing an access control. Fix: stop and use lawful public routes.
• Hiding a failed search. Fix: report no source found and the search scope.

Worked Example

For an authorised stakeholder review, corroborate public organisational roles across independent sources, log dates and URLs, and omit unrelated private details.

References

• OSINT methodology
• Validation and anti-patterns
• Chronology construction

Evidence Produced

Reference Index

• Advanced techniques; adverse media; stakeholder reconnaissance
• Investigative search; case vaults; doctrine and history
• Skip tracing; social-source extraction