Ethics of Civilian OSINT Collection

Chief Justice Earl Warren once remarked: “In civilized life, law floats in a sea of ethics

(Allen, 2006).” When laws are limited or not actively enforced, it is important to establish and

understand ethical guidelines for operations. Professional to amateur civilian OSINT collectors

can access a plethora of collection tools on the internet, with their own moral compass deciding

the course of their intelligence collection. Although ethical standards can vary based on a

person’s moral compass, a system can be established within the OSINT industry as an ethical

guide to collectors. Although there are numerous ethical conundrums in the industry of OSINT,

an important aspect to discuss is the utilization of anonymous accounts. While creating an

anonymous account is ethical for a civilian OSINT collector, the process becomes unethical

when there is the “active” collection of intelligence.

Distinguishing the roles of an OSINT collector and a Human Intelligence (HUMINT)

collector will provide insight on the ethics of anonymous profiles. The Central Intelligence

Agency describes OSINT as information drawn from “The Internet, Traditional mass media,

specialized journals, conference proceedings, and think tank studies, photos, and geospatial

information (INTelligence: Open Source Intelligence, 2018).” The definition of OSINT does not

mention engaging with subjects to acquire information. In an interview on Michael Bazzell’s

“The Complete Privacy & Security Podcast”, Justin Seitz states “OSINT becomes HUMINT

when a collector has contact with a human (Seitz, 2018).” HUMINT is an active form of

intelligence collection while OSINT is a passive form.

It is unethical for an OSINT collector to engage with any subjects online during the

duration of their research. By engaging with a person during OSINT collection, the action

becomes “active” rather than “passive”. The active collection of intelligence is engaging with a
user, whether online or in person, to obtain information. Robert Lee, the Co-Founder of Dragos

Security LLC, describes passive collection as “data collected on networks or information

systems you have responsibility over (Lee, 2014).” On the opposite end, Lee describes active

collection as data obtained from external networks or information systems under the influence of

an adversary (Lee, 2014). The moment an OSINT collector sends a message to a subject, that

gathering process becomes HUMINT. This form of covert operation is ethical as a HUMINT

collector, but not as an OSINT collector.

Creating an anonymous profile is an ethical way for OSINT information gathering. It is

essential to note that an ethical anonymous profile does not contain a real person’s name,

information, or pictures. If the profile is impersonating an actual person or misrepresenting them,

that is unethical, and on a majority of social media sites, illegal. Twitter states, “Impersonation is

a violation of the Twitter Rules. Twitter accounts that pose as another person, brand, or

organization in a confusing or deceptive manner may be permanently suspended under Twitter’s

impersonation policy (Impersonation policy, 2019). Anonymous profiles can contain information

that is randomly generated but as an OSINT collector it is unethical to impersonate a person

under any circumstances.

While creating an anonymous account is ethical for a civilian OSINT collector, the

process becomes unethical when there is an active collection of intelligence. Active collection is

HUMINT is collectors, who engage in covert operations. By understanding the role of an OSINT

collector, ethical standards of an anonymous profile are established. Merriam Webster defines

ethics as “a set of moral principles (Merriam Webster 2019). With the proper use of an

anonymous profile, an OSINT collector can conduct ethically sound research.

Bibliography
Allen, A. L. (2006). Moralizing In Public. HOFSTRA LAW REVIEW, 1325-1330. Retrieved from Earl Warren
Papers.

Impersonation policy. (2019). Retrieved from Twitter: https://help.twitter.com/en/rules-and-

policies/twitter-impersonation-policy

INTelligence: Open Source Intelligence. (2018, August 06). Retrieved from CIA:
https://www.cia.gov/news-information/featured-story-archive/2010-featured-story-
archive/open-source-intelligence.html

Lee, R. M. (2014, February 25). Cyber Intelligence Collection Operations. Retrieved from Tripwire:
https://www.tripwire.com/state-of-security/security-data-protection/cyber-intelligence-
collection-operations/

Seitz, J. (2018, September 21st 21). EPISODE 091: Privacy vs. OSINT with Justin Seitz. (M. Bazzell,
Interviewer)