Questa pillola anche disponibile in versione audio podcast nell’episodio S01E02 del Disruptive Talks (Spotify, Apple Podcasts, Deezer, Amazon Music…).

To begin this study, I ask you a question:

What is the common point between:

  • The death of Queen Elizabeth II
  • The protests in Iran
  • The Boston Marathon bombing in 2013

Have you found the connection?

Let me help you understand it. Let's see together how technology allows us to connect these stories.

On September 8, 2022, when the news was released that Queen Elizabeth II was "under medical supervision", some web users expert in advanced search techniques immediately took action. Using real-time private flight and jet trackers, they noticed an unusual coming and going in the skies around Scotland, where the Queen was staying at Balmoral Castle. In particular, Prince William's plane was tracked. These movements revealed that the situation was more serious than expected. In fact, a few hours later, the Queen's death was announced. Death that some had already anticipated…

In IRAN: Since the beginning of the protests, Iranian activists have identified some agents involved in the repression, cross-referencing videos and images with social profiles and other open sources. For example, an officer who beat a protester was identified thanks to the comparison of her face with her profile photo on WhatsApp. In another case, they managed to confirm the killing of a 16-year-old protester, Nika Shakarami. By analyzing videos and photos, activists reconstructed her movements before her death, denying the Iranian authorities' version that she had fled from home.

On April 15, 2013, two bombs exploded near the finish line of the Boston Marathon, killing 3 people and injuring 264. In the days that followed, investigators were stumbling around in the dark. But on Reddit and sites like 4chan, ordinary users spontaneously got to work analyzing photos and videos of the attack spread on social media. In particular, efforts focused on images showing two men with identical backpacks, taken before and after the explosions. Users enlarged the images, compared the faces pixel by pixel, and finally, after a few failed attempts, identified the suspects: the Dzhokhar brothers and Tamerlan Tsarnaev. All while the FBI was still groping in the dark. Only on April 18 did the FBI release photos of the attackers, which online users had already discovered the day before.

In short, in all these cases, the crowdsourcing and theopen data analysis they have proven faster and more effective than professional intelligence.

These techniques and methods, which allow anyone to conduct open and transparent investigations into global events, fall into a field called OPEN SOURCE INTELLIGENCE, often abbreviated OSINT.

So, the OSINT it is the art of collecting and analyzing publicly accessible information from open sources such as websites, social media, public data, satellite imagery and much more. This information can reveal patterns and connections useful for a variety of purposes, from investigations to cybersecurity.

Abbonati alla newsletter per maggiori articoli e approfondimenti:

But what exactly is meant by “publicly accessible data”?

Let's start with the simplest and most immediate examples.

Search engines like Google, Bing and Yahoo are obviously a gold mine for OSINT. Just do a search with a person's name to find websites, social profiles and articles about them.

Social networks themselves are also a valuable source. Users often share personal information, such as the city they live in, where they work, even when they are on vacation. Just take a look at the profile of a target to discover many things.

But OSINT goes much further. For example, there are specialized search engines, called "dork searches", that allow you to search for specific files, such as PDF documents, presentations, spreadsheets. This allows you to find, for example, CVs or financial data leaked online.

The deep web and public data are also OSINT mines. Land registers, court archives, financial documents. All information theoretically public and legally obtainable, even if hidden behind complex search interfaces.

And then there are the technical sources. The metadata contained in digital photos, for example, reveals GPS, time and smartphone model with which they were taken. By analyzing the code of a website you can discover the technologies used and vulnerabilities.

In summary, the variety of OSINT sources is almost infinite. As well as its fields of application, which cover practically every sector with a need for information collection.

Obviously, intelligence and national security, but also law enforcement and private investigators.

Cybersecurity experts use OSINT techniques to analyze online threats, anticipate cyber attacks, track down hackers, and prevent sensitive data breaches.

Companies, to obtain information on markets, competitors, potential partners.

Investigative journalism uses OSINT to cover war events, scandals and cases of public interest. In this regard, I recommend the excellent Bellingcat site, which has long been a precursor in the practice and training on Open Source Intelligence.

But why talk about OSINT today, in 2023, 10 years after the Boston attack that made these techniques popular?

OPEN SOURCE INTELLIGENCE is becoming increasingly central in the era of big data and the overabundance of online information. Every day we produce 2.5 quintillion bytes of data, an unimaginable amount. Most of these are public and accessible.

But it is not only the large amount of data that allows the development of this discipline.

L'use of drones and other aerial surveillance devices is increasingly popular among OSINT investigators. Drones with high definition cameras allow a close-up view of otherwise inaccessible places, providing images and videos useful for investigations.

L'artificial intelligence allows you to analyze huge volumes of data in real time, identifying patterns and insights that are impossible for human analysts. It can connect heterogeneous sources and generate intelligence in an automated way.

There blockchain, eliminating much information asymmetry from the economy, is an area of interest to OSINT analysts. Whether it's to track hackers or identify people behind public keys.

THE deepfake, videos manipulated with artificial intelligence, are the new frontier of OSINT to unmask fake news and disinformation.

Even in the context of cybersecurity, OSINT is becoming critical. Collecting large amounts of public information can be invaluable in analyzing cyber threats, identifying security flaws, tracking hacker activity, and preventing potential attacks.

For example, through OSINT it is possible to scour the dark web to intercept sales of zero-day exploits, stolen credentials or other sensitive data. Or monitor hacker forums and communities for signs of impending phishing or ransomware campaigns.

Additionally, by analyzing open source code repositories on GitHub, researchers can discover vulnerabilities in popular software libraries, alerting companies.

Automated OSINT tools allow you to monitor domains, IP addresses, web pages for malware or anomalous behavior. Signals that allow you to raise your defenses in time.
Finally, social engineering techniques simulate cyber attacks to test user awareness and the effectiveness of security controls.

I personally have found OSINT very interesting for several years. Read articles by Bellingcat, where journalists detail investigative techniques, is always inspiring.

If you are curious about the topic, I recommend the OSINT Framework, a collection of OSINT sources and techniques classified by categories.

On the tools front, I mention Maltego for the visual analysis of relationships between people, groups and organizations, Shodan for searching devices connected to the Internet and Recorded Future, an automated threat intelligence platform (see further information at the end of the article for the links).

In conclusion, OSINT is an ever-evolving discipline, with new tools and techniques emerging. For journalists, investigators, analysts or even the simply curious, it offers unique opportunities to shed light on dark events and bring hidden truths to light. But let's remember to always act ethically and responsibly. After the Boston bombing, some OSINT analysts publicly identified a totally innocent person. So, as Stan Lee would say: great power requires great responsibility.


Insights

News and useful links:

News:

  • Bellingcat
  • Rand
  • https://techjournalism.medium.com/how-irans-internet-block-gagged-local-online-protests-5dcf5dfa0d19
  • https://www.csis.org/analysis/protest-social-media-and-censorship-iran
  • https://www.theatlantic.com/national/archive/2013/04/reddit-find-boston-bombers-founder-interview/315987/

OSINT Materials:

Leave a comment

Your email address will not be published. I campi obbligatori sono contrassegnati *