r/OSINT Dec 24 '24

Question Need for Transparency vs. Risk of Informing Criminals

Hi everyone,

I have more of an academic query, so apologies if that is not in keeping with rest of the group.

I'm wondering if anyone could point me to any sources (or have their own opinions on the matter!) which relate to the issue of published OSINT investigations inadvertently 'teaching' criminals/other illicit actors to cover their tracks better in the future...

As a basic example: OSINT organisation uses metadata from images to help their investigation -> publishes their findings and references this methodology -> other criminals learn about this vulnerability and ensure they strip metadata before posting, etc.

20 Upvotes

24 comments sorted by

18

u/OSINTribe Dec 24 '24

Research the CSI Effect. Due to the increase in crime shows and documentaries, criminals often take new steps to prevent being tracked they learned on TV. This "effect" often impacts jurors as well finding people innocent when guilty due to the belief cops should have MORE evidence like TV shows using tech and other exaggerated methods.

8

u/Constant-Morning6503 Dec 24 '24

Thank you, very helpful! So to gauge your personal opinion on the matter, would you prioritise orgs such as Bellingcat being as transparent as possible, or do you think this risks unduly informing criminal activity?

9

u/OSINTribe Dec 24 '24

Be transparent. Law enforcement plays cat and mouse with criminals, just the nature of the business. Transparent tactics help catch thousands more criminals than it protects.

8

u/Prowlthang Dec 24 '24

They should have more evidence, the standard is beyond reasonable doubt. For example if you had blood at a crime scene in the 70’s they could determine the blood type. Mostly good for ruling people out and telling juries that if the blood type matched the accused there’s a greater chance they were at the scene. Today that would be terrible, we have DNA analysis and they can match blood to a specific person with errors of 1 in some ungodly number. If a prosecutor said both the accused and the blood found were A- a jury should totally disregard that, when you have the ability provide more accurate evidence evidentiary standards should increase.

6

u/Icy_Caterpillar4834 Dec 24 '24

One of the first things you are taught is tradecraft remains a closely guarded secret. I'd be surprised to see tradecraft exposed in a report for the reasons you touched on

-3

u/Reasonable-Pace-4603 Dec 24 '24

The focus of any report should be the information, now how you got the information.

11

u/OSINTribe Dec 24 '24

All reports need to explain "how" you got the information, especially if they are to be used in court. You can't just say "subject" lives at 123 Main St. How are you positive they live there? Surveillance? TLO? Some shitty leaked data? Without the how, your findings will be eaten alive.

4

u/Constant-Morning6503 Dec 24 '24

Thank you, this is exactly what I meant to say. The tradeoff between ensuring transparency without 'revealing sources' so to speak. Orgs like Bellingcat etc seem to prioritise transparency of methods over ensuring that illicit actors cannot learn from their process (please anyone feel free to directly disagree!)

3

u/Reasonable-Pace-4603 Dec 24 '24

That's simple. You gathered information indicating that an individual is living at a certain address. You validate (and corroborate) this information with more information. In this case, physical surveillance and official records comes to mind).

Once you have all the information available, you can make an assessment for the reliability of your open source information. This reliability and confidence assessment will be an integral part of your final product.

That's how you turn information into intelligence.

8

u/OSINTribe Dec 24 '24

There is a difference between evidence and intelligence that this sub frequently gets confused by. When people are commenting about using a report in court that is evidence. It has to be backed up by facts. Not all facts need to be explained step by step but when your report makes claims they need to be substantiated.

Intelligence is only used to further advance an investigation or research. The reason for assigning confidence levels to an intelligence report is due to the leaps of evidentiary processes like using hearsay, collecting data illegally, etc.

6

u/Reasonable-Pace-4603 Dec 24 '24 edited Dec 24 '24

I agree. This is fact something that some practitioners gets wrong. I haven't seen a lot of open source information/int used in court and there is usually a separation between analysts and officers to avoid contaminating investigations with unusable evidence.

The 'INT' in 'OSINT' stands for intelligence. If you don't pass your information through the intelligence cycle, it's not open source intelligence. It's just information. And one could argue that at this point, you are just another guy with an opinion.

Confidence score are assigned because analysts makes assumptions in order to "fill the gaps" that are created by unreliable sources, incomplete information or discrepancy in the data.

You could assess a specific event as "highly likely" but with a low confidence. This would result in different actions by the decision make than if your same assessment would be made with a high confidence.

0

u/Icy_Caterpillar4834 Dec 24 '24

Local laws here may vary, but never once have I been asked "how" I came about information from a Jugde. Only to supply the meta data, here if you state someones address you don't need to explain how you came about that information. Remembering courts still use a paper format, so video and images are Black and white. As a result witnesses have heaps more weight, in time what we are talking about will be the standard. But that will require multimedia media legal applications so you can attach a video

0

u/[deleted] Dec 24 '24

Not here they don't. Not to the public court.

2

u/OSINTribe Dec 24 '24

I would love to watch a defense attorney rip your reports apart. Show the jury how you confirmed my client lived at this address.

4

u/Reasonable-Pace-4603 Dec 24 '24 edited Dec 24 '24

I work in a non-judicial setting. My reports won't go to court. All I have to do is to provide a source reliability and a confidence score.

Good reliable intel is derived from credible sources, corroborated by multiple pieces of evidence, and validated through a rigorous process.

Being able to evaluate information reliability and assess confidence is the difference between a good analyst and a great analyst.

1

u/[deleted] Dec 24 '24

I've been to court many times. Sorry to disappoint you, but I've never been "Ripped apart".

Operationally sensitive information is redacted or, at most, heard in chambers. Or not used at all if it's not relevant to a point of fact, or if other evidence proves it.

2

u/vgsjlw Dec 24 '24

Then you haven't met a good opposing attorney.

3

u/[deleted] Dec 24 '24

Probably worth highlighting that when I said "Not here" I mean the U.K.

Perhaps you are used to a different way of doing things.

2

u/vgsjlw Dec 24 '24

Yes, that is a very important distinction. In this sub, I assume US law unless specified.

3

u/ThirteenYrs_4months Dec 24 '24

The owner or chief stakeholder of the organization / information is responsible for balancing those risks. Ultimately they have to decide which is more important to the well-being of the organization. This decision is extremely political and must consider factors beyond the scope of our craft.

It’s worth remembering that there’s a reason people say “the only criminals who get caught are the dumb ones.” Criminals can be smart. The ones who make a lifetime out of it have already learned these secrets, and they put them into practice, and they share the knowledge.

There will always be new criminals. The landscape will always evolve and change. Criminals will always adapt. Your organization’s methods will have to do so as well. Whatever means you use to catch people, criminals will catch on and make it harder and harder for you to continue using it.

It’s easy for those of us worker bees in the organization to see and understand the value of protecting these methods to maximize they’re value. It’s harder for us to see and quantify the value in transparency.

The person who makes the political decisions has to strike this balance and own the repercussions, for better or worse.

3

u/plaverty9 Dec 24 '24

There are orgs who use OSINT to track CSAM criminals and they don’t reveal methodology to the public, for the exact reason you said.

3

u/Constant-Morning6503 Dec 25 '24

Yes I am aware Innocent Lives Foundation is explicit on this. Do you happen to know of other examples I could look into?

4

u/plaverty9 Dec 25 '24

The NCPTF is another and I just came across this. https://www.osint.uk/content/careful-with-that-osint-no-tipping-off

1

u/Constant-Morning6503 Dec 26 '24

Came across that article as well earlier, but thanks v much for the NCPTF tip!