Stop Calling It OSINT

A field rant about shortcuts, ego, and other creative ways to waste everyone’s time

Let’s just say the quiet part out loud: most of what’s sold as “OSINT” online is cosplay. It’s people screenshotting shiny dashboards, speed-running Google like a speed-runner with a caffeine problem, and then stapling the word “intelligence” to whatever fell out of their browser. It’s fine, if you’re aiming to be loud. It’s lethal, if you’re aiming to be right.

This isn’t a manifesto. It’s a broom. We’re sweeping out the bad habits one by one, with real cases and ugly lessons. If anything here stings, it’s because it should.

I want to give a special shoutout to Matthias Wilson, our conversations have lead me to write this blog.

Google ≠ OSINT (and page one is a padded cell)

The ritual goes like this: type a name, slam Enter, skim headlines, paste three links into a thread, announce “OSINT complete.” That’s not analysis; that’s autofill with delusions.

When MH17 was torn out of the sky, the internet ran to Google for comfort. Real investigators ran past it. They pivoted, from manifests to flight logs to VK posts; from roadside poles in convoy photos to satellite passes; from shouted war-bragging to timeline-consistent telecom intercepts. All the weak glue (rumours, blogs, hot takes) peeled away under that heat. What stayed became evidence, the kind judges quote, not the kind influencers farm.

Rant translation: Google is a door handle. If you’re proud of turning it, congratulations; you’ve located the house. You still haven’t walked in.

Do instead: Start with a question you can falsify. Build pivots (people → places → platforms → patterns). Archive first, then analyze. Everything else is karaoke.

Tools ≠ OSINT (the dashboard isn’t thinking)

The fastest way to look smart online is to screenshot a dashboard. The fastest way to look foolish offline is to believe it.

Remember those viral “OSINT maps” that claimed to track units in a conflict hour-by-hour? Some were stitched from stale data. Others were poisoned on purpose. Professionals treated them like a rumor at a bar: interesting, but let’s see your dental records.

They checked commercial imagery (Maxar, Planet), matched terrain ridgelines in Google Earth, cross-referenced local Telegram chatter, and sanity-checked with FIRMS fire detections and weather. The shiny UI faded; the cross-checks stayed.

Rant translation: A tool is a screwdriver. Ownership does not confer carpentry. If your method dies when the server hiccups, your method was never a method.

Do instead: Treat every tool like a witness with motives. Corroborate with something that can’t share the same lie.

Guesswork ≠ OSINT (vibes are not a method)

“This looks European.”

“This feels like Iraq.”

This is astrology with street view.

When propaganda videos drip online, the amateurs vibe; the adults verify. Freeze frames, skyline matches, shadow lengths, vegetation type, road furniture, traffic flow, dialects. Not sexy. Very useful.

Rant translation: If you can’t explain your location call like you’d defend it in court, you didn’t find a location. You found a feeling.

Do instead: Write your proof chain. If a step can’t be described without hand-waving, redo the step.

Copy-Paste ≠ OSINT (amplification is not analysis)

The day the U.S. Capitol was stormed, feeds filled with “IDs.” Many were wrong. People got harassed. Some got death threats. Threads got numbers. The internet patted itself on the back.

Meanwhile, the boring crowd did the boring work: clothing across angles, timestamp triangulation, camera positions, geotag sanity checks, three independent corroborations before naming anyone. Their work aged well. The adrenaline crowd’s work aged like milk.

Rant translation: If your pipeline is screenshot → post → victory lap, your pipeline is liability → lawsuit → offline.

Do instead: Publish your uncertainty. Write your fail cases. If you can’t say “we might be wrong,” you’re not doing intelligence, you’re doing performance.

“Cool finds” ≠ OSINT (shiny objects are not insight)

Cartel TikToks. Hacker brag threads. Telegram chest-thumping. Internet magpies collect them like trinkets. “Look what I found!” Cool. Now what?

Journalists who know what they’re doing map that flex content: landmarks → highways → cadence → convoy composition → route probabilities. Suddenly, the same video graduates from party trick to pattern.

Rant translation: If your discovery cannot change a decision, it’s trivia.

Do instead: Define the decision the data could serve. If there isn’t one, stop. You’re sightseeing.

AI Autopilot ≠ OSINT (hallucination with swagger)

Typing a name into an LLM and believing the paragraph it sings back is a hobby called “ruining someone’s month.”

Yes, AI can help: summarise 10k chat posts, pull entity lists, sketch pivots you might try. But the judgment, what holds, what breaks, what repeats, stays human. Offload grunt; keep the brain.

Rant translation: If the model’s confidence becomes your confidence, you’ve outsourced accountability.

Do instead: Use AI like a junior intern: fast, energetic, wrong in entertaining ways. Everything they produce needs adult supervision.

Stalking ≠ OSINT (intent is the line)

Doxxing an ex is not investigation. Creeping a coworker’s Facebook is not “open source.” Monitoring a cartel’s TikTok flexes to identify convoy routes? That’s purpose.

Rant translation: Curiosity is not a justification. Purpose is. Write it down before you start.

Do instead: Scope your target, question, and harm model. If you can’t articulate a public-interest outcome, don’t proceed.

Noise ≠ OSINT (hoarding is not analysis)

Some Discords pride themselves on “volume.” A thousand messages a day. Ten thousand screenshots. No one reads them. No one can. It’s a landfill with a search bar.

Contrast that with the NGO output you’ve envied: maps, timelines, risk surfaces. Not because they had more data, but because they practiced data triage: label, dedupe, cross-check, collapse into something a decision maker can point at.

Rant translation: If your deliverable is a torrent, your deliverable is failure.

Do instead: Write the one-page brief you wish you had. Then backfill only what supports it.

Speed ≠ OSINT (fast and wrong is still wrong)

The “Ghost of Kyiv” myth sprinted around the world while due diligence tied its shoes. Memeable, heroic, incorrect. A perfect storm for the clout economy; a terrible day for the credibility economy.

Rant translation: You can be first or you can be right. Pick the one that survives daylight.

Do instead: Set a “proof budget” before you publish. Two sources? Three? Satellite confirmation? Stick to it, even when the likes are calling your name.

Public ≠ True (availability is not validity)

Open ≠ accurate. Disinfo farms rely on that confusion. They seed garbage into the public domain because they know lazy investigations treat “public” as “proven.”

Professionals assault claims with weather, shadow azimuth, satellite pass windows, reverse image across multi-engines, and archive digs. Claims that live through that beating get to keep breathing.

Rant translation: If you haven’t tried to break it, you haven’t validated it.

Do instead: Maintain a kill checklist. Try to kill your own finding. Publish what survived.

Hacks ≠ OSINT (illegal ≠ clever)

Breaking into systems isn’t “open source.” It’s exhibit A,for the prosecution. Besides, illicit evidence is usually unusable where it matters most.

The strongest exposures of influence operations didn’t use crowbars. They used WHOIS, ad tech trails, metadata, and temporal networks. Clean. Legal. Devastating.

Rant translation: If your “intel” can’t be shown to a judge, it’s not intelligence. It’s a secret you can’t use.

Do instead: Chain only evidence that can survive disclosure. If your method relies on “trust me,” it’s dead on arrival.

Templates ≠ OSINT (checklists don’t have intuition)

There’s no worksheet for noticing the insignificant patch on a uniform in a low-res video, the one that ties a militia to a massacre. That wasn’t a box to tick. That was judgment, trained over boring reps, sharpened by failures, tested by peers who don’t care about your feelings.

Rant translation: If a script can do your job, you don’t have one.

Do instead: Practice “explain-it-like-I’m-hostile.” If your proof survives a hostile reviewer, it’s getting close to real.

 Ego ≠ OSINT (clout is counterfeit currency)

Threads with 🔥 emojis are not outcomes. Likes don’t save lives. Shares don’t convict perpetrators. Engagement is a costume that can’t walk into a courtroom.

You know what can? Traceable chains from tattoos to military academies to unit photos to travel records. The volunteer work that uncovered GRU officers didn’t farm clout; it farmed consequences.

Rant translation: If your output dies on social, it was never alive.

Do instead: Aim every deliverable at a decision: a briefing, a risk posture shift, a legal filing, a tap on a shoulder in a newsroom. If you can’t name the decision, you’re decorating the internet.

blog iam

“Data ≠ Insight” (collection is the easiest part)

Anyone can collect. Most do. Few synthesize. Fewer still decide what it means.

The gap between “I have a folder” and “I have a finding” is where the job lives: weighting sources, resolving conflicts, calling uncertainty, and, yes-saying what to do next.

Rant translation: “We found stuff” is not a conclusion. It’s a confession you stopped early.

Do instead: Force yourself to write one sentence: “Given X and Y, we assess Z with ~confidence because A, B, C.” If you can’t, you haven’t finished.

“Busy ≠ Useful” (motion is not progress)

Hopping platforms, firing dorks, launching yet another tool, very active, very sweaty, very pointless without a question. A lot of “OSINT work” is an expensive way to avoid deciding what you’re doing.

Rant translation: If you cannot articulate the decision your work supports, you are procrastinating with style.

Do instead: Start every task with a three-liner: Question → Decision → Deadline. Tape it to your monitor. Police yourself with it.

Field Notes for People Who Actually Want to Get Better

• Write your method as you go. If you can’t reconstruct it, you can’t defend it.

• Version your evidence. Archive links; save originals; hash files. You are building a chain, not a vibe.

• Kill your darlings. Your favorite theory is usually the one lying to you.

• Find hostile reviewers. Friends will compliment you. Enemies will improve you.

• Publish uncertainty. Confidence isn’t a swagger; it’s a number.

• Protect the innocent. “We think” about a human being comes with duty. Earn the right to say it.

• Stay legal. If you can’t show your process, you don’t have a process. You have a problem.

The Uncomfortable Truth

OSINT is not:

Google, tools, vibes, copy-paste, hoarding, hot takes, hacking, or hero fantasies.

OSINT is:

Tradecraft. Verification. Context. Accountability. Outcomes.

It’s the grind after the screenshot. The pivot after the tool breaks. The correction after you catch yourself being wrong. The one-page brief that survives cross-examination. The map a field team can stake their plan on. The paragraph a prosecutor can read without blushing.

If your work can’t survive validation, can’t change a decision, can’t be shown without excuses, then it isn’t OSINT.

It’s just browsing the internet with better lighting.

Now shut down the dashboard, open a notebook, and build something that would scare you to defend in public, and then make it defensible.

That’s the difference.