Where OSINT Stops: Legal and Ethical Guardrails for Researchers

The most repeated sentence in this field is also the most misread: 'it's all public'. Public availability describes how data was published. It says nothing about what you may lawfully do with it, how you may combine it, or what harm the combination causes. A phone number printed on a company's contact page and the same number assembled from four unrelated posts are the same data with very different consequences.

Technique is not permission

Just because a query returns results does not mean you should run it. The tests worth applying before a search: is the target a private individual rather than an organisation or public figure; is the information being sought sensitive by category — health, religion, sexual orientation, immigration status, a child's location; and would the result be usable to intimidate, harass, or expose someone to a risk they did not accept.

Aggregation is where most good-faith researchers cross the line without noticing. Ten individually harmless facts about a person can combine into an address, a daily routine, or a schedule. Judge the finished output, not the inputs, and ask what someone could do with the completed report.

Terms of service and the access question

Automating access to a platform you have agreed not to automate is a contract breach, and on some systems it can be a criminal one depending on where you and the service are located. Logging into an account you do not own, using credentials obtained elsewhere, or viewing content behind a login you were not granted are qualitatively different from reading an open page — even when the underlying information is the same. Keep your work on the open web and off other people's accounts.

• Do not create throwaway accounts to defeat a viewing limit; that converts a public read into an access violation.
• Do not use scraping that degrades a service or that the operator has explicitly refused.
• Do not treat a lack of technical barrier as an invitation.

Personal data carries duties

If you are in, or publishing to, a region with strong data-protection law, information about an identified person is personal data regardless of where you found it. That brings obligations that survive publication: hold only what the investigation needs, keep it secure, record where it came from, and be prepared to delete it. A research folder that grows indefinitely is a liability, not an asset.

Before you publish

Publication is where the real decisions live. Write a correction route and keep it working, because you will be wrong about something. Consider whether releasing your method teaches a fixable problem or hands over a template. Weigh whether the finding needs the individual named at all, or whether the pattern can be reported without attaching a name to it.

The question is never 'can I find this?' It is 'should this be findable by me, in this way, and what happens because it was?'

Keep a short written scope for every engagement: who asked, what question, what you will not look at, and how long you will keep the material. A scope written in advance is the cheapest protection there is — for the subject, and for you.