OSINT Ethics & Law
OSINT is a truly powerful tool, and it's crucial to use it correctly and responsibly. Therefore, when using OSINT, you must be mindful of the ethical and legal aspects.
Ethical OSINT
While OSINT is based on publicly available information, there are ethics that govern how this information should be handled.
Do's:
- We must ensure that the information we search for and collect is Publicly Available Information.
- Analyze why you are searching for this information and for what purpose you will use it. Use it only for purposes that benefit the public good.
- Verify the information we obtain. Cross-reference it with various sources to ensure it is accurate before using it.
- Understand and take responsibility for the consequences of your investigation.
Don'ts:
- Do not snoop on others' personal lives. Avoid excessively exploring information that could infringe on someone's private life.
- Do not break the law. Absolutely do not hack websites or break into accounts to get information.
- Do not deceive. Do not impersonate someone else to get information.
- Avoid searching for information that is not public and requires a login to access (e.g., posts from a private account).
Privacy & OSINT
Privacy is the right of an individual to control who can use their personal information and how. In the simplest terms, my diary is for me alone. This means that others should not take and read it without permission. That's privacy. (Except in cases where it is legally required for some reason.)
Therefore, when conducting OSINT, it is important to distinguish between what is intended for public viewing and what is meant to be private.
For example, if someone makes a Facebook post public, it is publicly available information. However, if they post something with a "Friends only" setting and you (as a friend) see it, take screenshots, and share it with non-friends, that is a privacy violation. This is an unauthorized dissemination of information and is unethical.
The essence of OSINT is not to find a single piece of information but to analyze it by compiling publicly available information (e.g., Public Facebook Posts, Company Website Info, News Articles). Sometimes, information that seems harmless individually can, when combined, harm someone's privacy. You must understand this and avoid such situations.
Furthermore, since your investigation is conducted without the permission of the individual or organization, how you use the information you obtain is extremely important. Therefore, the information should only be used for purposes that can benefit the public.
OSINT methods are powerful for verifying fake news, but they can also be used to create fake news or defame someone. You must maintain ethics to prevent such misuse.
Data usage laws and regulations (e.g., GDPR)
Around the world, there are many Data Protection Laws. These laws specify how businesses and organizations must collect, use, and protect people's personal information.
For example:
- #GDPR (General Data Protection Regulation): This law is used in the European Union (EU) to protect the personal information of EU citizens. Under this law, individuals have full control over their personal data.
- #CCPA (California Consumer Privacy Act): This law is used in the state of California and is also intended to protect the data of California residents.
OSINT users should know which country the person they are investigating is from and understand the laws of that country. It is especially important to be careful not to violate local laws.
In conclusion, when using OSINT, ethics and law must always be the top priority. It is most important to avoid collecting information for wrongful purposes or by breaking the law and to be a responsible investigator.
0 Comments