The ‘Seven Commandments’ for Using OSINT – According to Bellingcat

Today’s information purveyors, including news outlets, governmental agencies, NGOs and others, increasingly rely on a wide range of open-source intelligence (OSINT) resources, the best of which utilise the best practices of journalism, fact-checking, and critical thinking, but many don't.

Kyiv Post, like most modern media outlets, relies on multiple sources to provide, confirm and validate the news it reports – with social media and other OSINT being important such resources.

A recent article, by the Netherlands based independent fact-checking collective Bell¿ngcat, urges caution in the use of some of the plethora of OSINT reporting sites that have sprung up, particularly in the wake of the wars in Ukraine and Gaza.

Giancarlo Fiorella, Bell¿ngcat’s Director for Research and Training, said in a December FT article that open-source research is not only important for validation of news articles but could actually be used for the future investigation and prosecution of war crimes. He argues that it is critical that the credibility of OSINT is maintained as the data it provides could knowingly or unknowingly invalidate data provided by those who don’t actually follow best practices in their open-source research.

The Bell¿ngcat article lists “seven sins” the group has identified in the use of OSINT research. These have been slightly modified, for the purposes of this piece, into “seven commandments” for the use of such material.

Other Topics of Interest

Ukraine is Getting Its Own Capability to Strike Deep into Russian Territory

Deprived of the unrestricted use of long-range Western weapons to attack Russian bases, Ukraine has come up with its own weapons that blur the line between missiles and drones to fill the gap.

• Identify the original source

The information used in OSINT analysis is (generally) free and publicly available so that anybody can gather it together. It is vital that users of OSINT material are able to verify the original source of the material and, therefore, its veracity without blindly trusting the OSINT provider.

Some OSINT contributors are simple aggregators of others' material culled from Twitter, Telegram or other social media sources without linking to the original source. If, for instance, a video has been re-uploaded without reference to its origin it may have also been stripped of its metadata which would have allowed date, time and locations to be positively confirmed. This doesn’t immediately make the item invalid but needs to be treated with caution and verified in other ways such as comparing it with other sources.

• Avoid your own bias

OSINT researchers must be aware of the dangers of bias, both their own and those of the source they are examining. It is all too easy to accept data that supports a specific cause or hypothesis and discard that which doesn’t. This is known as “confirmation bias,” a tendency we all have to accept as true any information that confirms what we already “know” to be correct.

The best OSINT material admits to any gaps in its knowledge, or uncertainty about the data on which it is based, or when data doesn’t show everything, even if it doesn’t support, or contradicts the theories it is expounding.

• Archive your sources

Much of OSINT material is garnered online and links frequently disappear over time or because a user (or platform admin) has intentionally (or accidentally) deleted it. Aware of this Bell¿ngcat has frequently published articles on how to manually archive critical information, advocates the use of archiving platforms such as “Wayback Machine,” and has also developed its own Auto Archiver tool, with guidance on how to use it available here.

They suggest that, if all else fails, you take a screenshot, as it’s better than nothing.

• Understand the context of an event

It is all too easy when using online resources such as FlightRadar 24 or NASA’s Fire Information for Resource Management System (FIRMS) to take events, either regular or “one-off,” out of context and assign inaccurate, exaggerated, or malicious intent to an event.

The Bell¿ngcat article highlights a recent post on X/Twitter in which a FlightRadar 24 tracking of an Israeli government aircraft flying south towards Sinai led to rumors that Israel’s Prime Minister Netanyahu was secretly evacuating from the country in advance of Iran’s April 13 mass missile and drone attack.

Being able to differentiate between common and uncommon events when using such tools is something that is learnt with experience that many of the new generation of OSINT analysts have yet to master – practice makes perfect.

• Understand research tool limitations

There are many different open-source tools available, the most useful of which Bell¿ngcat has listed in its online “Investigation Toolkit,” and there are similar systems employed by media sites such as AFP use for fact-checking .

It is important to understand the limitations of such tools which, again, experience in their use will only accomplish. A simple rule of thumb for novice researchers is to use as many different tools as possible to cross-reference sources to help ensure that the information is credible.

The article cites an example where an OSINT site reported the results of the Iranian missile attack in one part of Israel having misidentified the shadows cast by clouds on a satellite image as craters.

• Identify if, how and why video footage has been edited

Unsympathetic (or malicious) editing can all too easily remove or obscure critical information.

Video footage that appears on many social media sites has been edited in some way that can make verification difficult. This can include making compilations of clips – a favorite of Ukraine drone attack footage which often splices live video from an FPV drone with third party over views to give a complete picture of what happened.

Other unhelpful adjustments are to remove original sound with an audio track, usually of some stirring music, trimming the footage that eliminates the build-up to and aftermath of an incident, and overlaying the video clip with a watermark which can mask details used in reverse image searches.

• Speed can kill

It is too easy to rush to be the first to publish breaking news, with social media often being the worst offenders in posting unverified and inaccurate snapshots and claim a “scoop.”

Validating and verifying content should always take priority even if it delays getting the news out, there is nothing more damaging to a news site’s own credibility than getting it wrong and having to eat humble pie after the event – we’ve all been there and can testify to the validity of that statement.