Open-source intelligence (OSINT) collects, analyzes, and interprets information from publicly available sources. It is a valuable investigative tool in modern forensic practice that can help your organization navigate:

• Fraud detection
• Corporate investigations
• Intelligence gathering
• Cyber security incidents

Discover the role and application of OSINT and explore a case study showing how OSINT can support the due diligence process during an acquisition.

Your organization needs the right external data to make informed decisions — whether you are performing due diligence for an acquisition, require research on potential business partners or senior leaders, or are investigating a suspected case of wrongdoing. A vast amount of data is now stored publicly online in locations such as websites, social media posts, or industry reports. How can you use this information to guide decisions for your organization or support your case during an investigation?

Open-source intelligence (OSINT) collects, analyzes, and interprets information from publicly available online sources. It is a valuable investigative tool in modern forensic practice that can help your organization navigate fraud detection, corporate investigations, business intelligence gathering, or cyber security incidents. Let’s review the role and application of OSINT — and explore a case study showing how it can help an organization perform due diligence during the acquisition process.

OSINT is the collection, analysis, and interpretation of information from publicly available sources. It can help highlight new relationships between known or unknown entities or unearth new areas of inquiry to strengthen the confidence of investigative inferences and conclusions.

These publicly available sources may include sources from the clearnet — or the indexed Internet — such as social media platforms, public databases, forums, or websites. However, OSINT also collects and analyzes information from the unindexed Internet, also known as the deep and dark web, by using specific tools and browsers to find data from these sources.

OSINT helps investigators uncover information about individuals, organizations, events, or activities related to a case. Forensic OSINT can be used a variety of types of investigations, including:

OSINT can provide evidence to help investigators unearth fraudulent activities, identify perpetrators, and prevent financial losses. Public records can help investigators uncover discrepancies, false claims, or unique interrelationships in the history of an individual or a business.

An OSINT investigator can analyze publicly available financial data such as corporate filings or transaction records to identify irregularities or suspicious patterns. Social media monitoring may also help uncover activities indicating potential fraud, such as excessive spending or connections to known fraudsters.

OSINT can support suspect identification by collecting and analyzing data from social media platforms, online forums, or public records. It can also provide information about locations relevant to the investigation through satellite imagery or street view images.

Additionally, OSINT can help discover criminal histories, financial records, and other information related to an investigation by searching public records, databases, and social media profiles. More leads may emerge during this process that may support a case and require further examination. 

OSINT can gather intelligence from public records to support informed business decisions. During the due diligence process, it can provide businesses with information about potential acquisition targets or business partners through analyzing financial data, corporate filings, and industry reports.

OSINT can analyze the domain emails associated with a company to confirm the number of employees is accurate or research land titles to identify if any other businesses are registered to that address. OSINT can also help verify the identities and backgrounds of an organization’s board of directors by analyzing public records. This provides context to help a business understand its risks and make informed decisions when entering a merger or acquisition.

OSINT can offer valuable insights during a cyber security incident investigation by reviewing communications in online forums to identify hacking patterns, tactics, or techniques that may be related to the incident.

Online databases may document vulnerabilities, patches, or exploit techniques to help investigators pinpoint potential weaknesses that enabled the incident to occur. OSINT can also analyze the digital footprint of targeted businesses or individuals such as domain registrations, IP addresses, or social media profiles to identify potential vectors of attack.

OSINT is applicable in many situations and is not restricted to a specific sector, type of business, or client. Its uses within a forensic context are varied and multifaceted — and often depend on the types of questions an investigation aims to answer.

However, OSINT typically supports an investigation by providing:

• Data collection — Gathering information from a wide variety of publicly available sources such as industry reports, forums, and social media.
• Data analysis — Analyzing the collected data to identify relevant information, patterns, connections, and relationships that may be useful for the investigation.
• Verification — Verifying the authenticity and reliability of the collected information to ensure its accuracy and relevance to the investigation.
• Documentation — Documenting the findings and evidence obtained through forensic OSINT for use in legal proceedings or investigative reports.

A large and established company in the tech industry was considering the acquisition of a small but successful tech startup. However, it wanted to fully perform its due diligence before going through with the deal — and engaged MNP to examine publicly available records about the startup to identify any warning signs before it proceeded. 

The advisor used OSINT to search through a variety of publicly available records to uncover more information about the tech start-up company — and discovered several areas of interest. An analysis of the land title where the tech start-up company was registered revealed that 21 other businesses were registered to the same address.

Additionally, the tech company reported that it had over one hundred employees, but an analysis of the email addresses registered under the company’s domain revealed only five employee email addresses. Searching through public records also revealed that the tech start-up was facing a lawsuit regarding data privacy.

The tech company requested more information from the start-up that it intended to acquire when it received the report from the investigation. However, the explanation from the start-up did not satisfy the acquiring company and they chose not to proceed with the acquisition.

You need the right information to make decisions in a variety of situations — from gathering evidence in suspected fraud cases to performing due diligence during an acquisition. OSINT is a valuable tool to collect, analyze, and interpret publicly available information and give you context to support your decisions.