A Responsible OSINT Workflow for Cold-Case Research

Step 1 — Define the question lawfully

Start with a specific question you have a legitimate, lawful reason to answer — for example, "what was reported publicly about this event in the month it occurred?" A vague mandate ("find everything about this person") drifts quickly into collecting data you have no business holding. Scope the question, and write it down.

Step 2 — Know what counts as open source

Open source means information that is publicly available and that you are permitted to access: published news and media, government records and public databases, public social posts, academic publications, and public archives. It does not mean access-controlled systems, paywalled content you circumvent, leaked private data, or anything obtained by deception. If you would need a password you do not have, it is out of scope.

Step 3 — Collect with a paper trail

For everything you gather, record the source (URL or citation), the exact date and time you retrieved it, and how you obtained it. Capture a copy or screenshot. Months later, you must be able to show where each fact came from and when it was true. This is the same discipline that makes any investigation auditable.

Step 4 — Evaluate the source before you trust it

Distinguish primary from secondary sources, and official records from unofficial commentary. Ask who produced it, when, and why. A screenshot of a public record and a screenshot of a social post are not equally reliable, even if both are "public." Record your reliability assessment alongside the item.

Step 5 — Verify before you rely

A single source is a starting point, not a conclusion. Where you can, corroborate across independent sources. Treat any finding that rests on one unverified source as unconfirmed until it is not. When you cannot verify, say so — "insufficient evidence" is a complete and honest answer.

Step 6 — Respect privacy and avoid harm

Do not publish or collect personal information about private individuals, and never use research to identify, contact, or harass anyone. Presume innocence: describe people neutrally until an authoritative source establishes a role. If a step feels like it could endanger or embarrass an uninvolved person, stop.

Step 7 — Know the boundaries

Responsible OSINT has hard limits: no restricted systems, no circumvented access controls, no private data, no real-time tracking, no vigilante publication. Legal limits vary by jurisdiction and by your intended use. This guide is not legal advice — when your work could have legal consequences, consult a qualified professional.

Sources & further reading

• OSINT Framework — a community-maintained index of open-source intelligence tools and sources.
• Society of Professional Journalists Code of Ethics — standards for verification and minimizing harm in open-source research and reporting.