Blog · OSINT & verification

The Ethics of OSINT: What Is Legal to Investigate with Open Sources

Open the map →

The fact that a piece of information is published does not mean you can do anything you like with it. That sentence summarises the most widespread misconception about legal OSINT: many people assume that "open source" is equivalent to "no restrictions," and it is not. Investigating with open sources lawfully requires understanding that legality depends not only on where the information was, but on how you obtained it, what you do with it, and who it affects. This guide covers the general framework, the hard lines that are never crossed, and the good practices that distinguish a serious investigator from someone heading for trouble.

A note before we begin: this is general information, not legal advice. If your specific situation has legal consequences, consult a qualified professional.

The essentials, in 20 seconds

• OSINT means working exclusively with deliberately published sources, but legality also depends on how that data is used, not only where it came from.
• GDPR and UK GDPR keep personal data protected even after it is published, so collecting and profiling it still needs a lawful basis.
• Four hard lines turn an activity into intrusion, not OSINT: unauthorised system access, doxxing, private cameras exposed by accident, and anything involving minors.
• The Computer Fraud and Abuse Act (US) and the Computer Misuse Act (UK) criminalise unauthorised access to systems, even when it was technically easy.
• Public figures, such as those whose private jets are tracked, can be scrutinised more than private individuals because their power and influence increase the public interest at stake.

The basic principle: accessible does not mean usable for everything

OSINT is defined by working exclusively with information that has been deliberately made public: official websites, open registries, social media, signals broadcast openly such as those from aircraft and vessels. So far, no problem: looking at what someone has chosen to publish is, in essence, reading.

The nuance comes next. Information can be public and yet its subsequent use can still be regulated. A photo posted on a social network still has copyright. A name appearing in an official gazette is still personal data. A traffic camera is public, but using it to surveil a specific individual entirely changes the nature of the act.

The right question is never only "can I see this?" but "can I do with this what I intend to do?" Those are two different questions with often different answers.

Open the map →

The general framework: three layers of rules

Without going into specific statutes, it is useful to keep three levels of rules in mind that affect almost any open-source investigation, especially those touching on individuals in the UK, EU, US, or internationally.

Data protection law. Regulations like the EU's GDPR, the UK's UK GDPR, and similar frameworks in many other jurisdictions govern the processing of personal data, and here is the key point many people overlook: personal data remain protected even when published. The fact that someone shared their location on social media does not authorise you to collect it, cross-reference it with other sources, and build a profile of their movements. Processing needs a lawful basis, and purpose matters: verifying a fact of public interest is not the same as profiling a private individual out of curiosity.

Reuse of public sector information. Open government data frameworks (like the US Open Data Policy, the EU's Open Data Directive, or the UK Government Licensing Framework) encourage the reuse of administrative data, but with conditions: cite the source, do not distort the meaning of the information, and respect each dataset's licence. Open does not mean without rules; it means rules designed to permit use, not to obstruct it.

Each platform's terms of service. Every website, social network, or service sets its own conditions: what can be accessed, whether bulk downloading is permitted, what uses are prohibited. Breaching them is not always a criminal offence, but it can lead to bans, legal claims, and in some contexts, liability. A professional investigator reads these before building their work on a platform.

The hard lines: what is never OSINT

There are grey areas, but there are also clear boundaries. These four are not open to debate.

Accessing systems without authorisation is not OSINT, it is intrusion. If reaching certain information requires someone else's credentials, exploiting a security vulnerability, or slipping through a misconfiguration, you have left the domain of open sources. It does not matter that it "was easy" or that "the door was open": unauthorised access to computer systems can constitute a criminal offence, and technical ease does not make it lawful. US law (the Computer Fraud and Abuse Act), the UK Computer Misuse Act, and equivalent statutes across most jurisdictions are explicit on this.

Doxxing and harassment. Aggregating and publishing someone's data to expose, intimidate, or direct hostility against them is not investigation, it is an attack that uses investigative techniques. No cause justifies it, and the consequences (for the victim and for the person doing it) can be severe.

Private cameras exposed by accident. Lists of home and business cameras accessible because someone never changed the factory password circulate on the internet. The fact that they are reachable does not make them public: the owner never chose to publish them. Connecting to them is accessing someone else's system without permission, with the added aggravation of invading intimate spaces. The difference from a traffic camera published by an official body is vast: one is an open source; the other is a violation.

Children, always off limits. No nuances, no exceptions. Identifying, tracking, or exposing minors falls outside any legitimate open-source investigation, regardless of context.

Open the map →

Public figures and private individuals: public interest weighs differently

Not all people warrant the same level of scrutiny, and the law recognises this. Whoever holds public office, leads a major company, or exercises notable influence has assumed a degree of exposure that a private individual has never accepted.

The most illustrative example in recent years is the debate over tracking celebrities' private jets. Aircraft broadcast their positions openly by design of the air traffic surveillance system, and aggregators and social media accounts (including accounts tracking Elon Musk, Taylor Swift, and Jeff Bezos) have used that data to publish the flights of billionaires and public figures. Is it legitimate? The argument in favour invokes public interest: emissions, consistency between stated values and actual conduct, use of resources. The argument against points to safety and privacy concerns. There is no settled consensus, which is precisely what makes it a perfect case study, explored in depth in our article on tracking celebrities' private jets.

The practical rule that emerges from that debate: the more power and influence someone holds, the more scrutiny their public activity can withstand; the more anonymous a person is, the more protection they deserve. Applying to a private individual the techniques debated in connection with a billionaire is not equivalent, it is disproportionate.

Good practices: how professionals work

OSINT ethics is not a list of prohibitions; it is a method of working. Four habits summarise it.

Define your purpose before you begin. What legitimate question are you trying to answer? If you cannot state it in a single sentence, stop. Purpose delimits which data you need and which you do not, and it is your best defence if someone challenges your work later.

Minimise data. Collect only what is necessary for your question, retain only what is essential, and discard the rest. Accumulating personal information "just in case" is exactly the pattern that data protection law is designed to prevent.

Verify before publishing. An unverified finding is a hypothesis, and publishing hypotheses as facts destroys reputations, including your own. Triangulate with independent sources, date each piece of evidence, archive your proof. The free OSINT tools available today cover the entire verification cycle at no cost; there is no excuse for skipping it.

In journalism, offer the right of reply. If your investigation points to someone, that person deserves the opportunity to respond before publication. It is not only professional ethics: responses often correct errors that would otherwise have been yours.

The headline test: if you would not feel comfortable publicly explaining how you obtained a piece of data and what you used it for, you probably should not have done it.

How an open-source aggregator applies these principles

These principles are not theory, they can be seen working in the design of serious platforms. ARGOS ATLAS, which aggregates thousands of official public traffic cameras on a single map alongside live flight and vessel tracking layers, illustrates how they translate into concrete criteria:

• Only deliberately public official sources: cameras that transport authorities publish on their own websites, never private devices or dubious access points.
• No facial recognition or licence plate reading: the platform shows traffic context; it does not identify individuals or vehicles.
• No image history: only the latest frame published by the source is retained, in low resolution, making it impossible to reconstruct past movements.
• Source citation and a removal channel: every camera links to its originating body, and there is a contact route for requesting content removal.

These are minimisation decisions applied at scale: aggregating what is public without creating, through accumulation, a surveillance capability that no individual source provided. The full detail is on the sources and methodology page.

Frequently asked questions

Is it legal to investigate with open sources?

As a general matter, yes: consulting information that its owner has deliberately published is lawful. The complications arise with subsequent processing. If you handle personal data, data protection law applies even if those data were published; if you reuse public sector information, citation and licensing conditions apply; and if your purpose is unlawful (harassing, discriminating against, or surveilling someone) the legality of the source does not cleanse the use.

Where is the line between OSINT and intrusion?

At authorisation. OSINT means working with what has been deliberately published: if you reach the information through the door its owner opened to the public, you are within the framework. If you need someone else's credentials, must exploit a vulnerability, or take advantage of a misconfiguration, you are accessing a system without authorisation, which can constitute a criminal offence regardless of how easy it was technically.

Can I publish what I find?

Not automatically. Finding legally and publishing legally are separate evaluations. Before sharing, ask yourself: is there genuine public interest or only curiosity? Does it involve personal data of people without public profiles? Have I verified every claim with independent sources? Is the harm the publication may cause proportionate to the interest it serves? In journalistic contexts, add the right of reply: whoever is going to be identified should be able to respond first.

What about data on private individuals?

This is the most protected ground and where you need the greatest care. A private individual has accepted no level of public scrutiny, and aggregating scattered data points about them (each innocuous in isolation) can construct an invasive profile that breaches data protection law and causes real harm. The practical rule: scrutiny scales with power. What may be debatable regarding a public official or a billionaire is, applied to a private person, simply disproportionate.

Conclusion

Legal and ethical OSINT fits into three ideas: work only with what has been deliberately made public, treat personal data as what they are even when they are visible, and measure every publication by the interest it serves and the harm it may cause. The hard lines (intrusion, doxxing, private cameras, children) admit no debate; everything else demands judgement, a defined purpose, and constant verification.

If you want to see how these principles work in a real platform (which sources are accepted, which are rejected, and why) you can read our methodology: it is the applied version of everything you have just read.