OSINT methodology

Open-source research often supplies the link that on-chain analysis cannot: a post where a suspect published an address, a scam website's registration history, a service's archived terms of use. But a screenshot taken in a hurry, with no URL, no time and no record of how it was found, is a weak exhibit and an easy target. This lesson covers how to plan open-source work, run it without exposing the investigation, collect items with provenance, and document the result so that a court can rely on it.

Open source information, intelligence and evidence

The Berkeley Protocol on Digital Open Source Investigations, published in December 2020 by the Human Rights Center at UC Berkeley School of Law with the UN Office of the High Commissioner for Human Rights, is the main international reference for open-source work intended for legal proceedings. It draws distinctions worth adopting:

• Open source information is information any member of the public can observe, purchase or request, without special legal status or unauthorized access.
• Open source intelligence (OSINT) is open source information used mainly to support decisions, such as where to focus or what to request.
• Open source evidence is open source information with evidentiary value, which may be relied on to establish facts in proceedings.

Most OSINT in a crypto case stays intelligence: it points to the service to approach or the subject to look at. Only items collected and preserved to an evidential standard can become evidence. Plan for that from the first search, because a page that disappears cannot be collected again.

On the question of where data sits, the Budapest Convention allows a Party to access publicly available (open source) stored computer data regardless of where the data is located geographically (Article 32(a)). Domestic rules on investigators' online research still apply and differ between countries; the unit's legal advisers set them.

Planning: the intelligence cycle

Open-source work follows the classic intelligence cycle: direction (what do we need to know?), collection, processing, analysis, dissemination, and feedback into new direction. The Berkeley Protocol describes the investigative steps as online inquiries, preliminary assessment, collection, preservation, verification and investigative analysis.

Before searching, write a short collection plan in the case file:

The plan keeps research focused on what the question needs, in line with data minimization, which the Berkeley Protocol lists among its methodological principles alongside accuracy, preservation and security by design. It also gives the examiner an answer when asked why a source was or was not searched.

Research posture: attributable, non-attributable and covert

How the investigator appears online matters for safety and for the case.

The Berkeley Protocol asks investigators to minimize their digital trail and organizations to provide properly anonymized, non-attributable infrastructure when researchers go online. It also asks investigators to avoid misrepresentation, such as joining closed groups under false pretenses, which may violate privacy rights and taint an investigation; work of that kind needs its own authority. Even a lookup of a suspect address on a public explorer tells the explorer's operator that someone is interested; running sensitive queries on your own node avoids that (see the IDFE-BA lesson Node APIs and data access and the lesson Ethics, privacy and investigator safety).

Search technique

Search engines support operators that narrow results. Syntax and support differ between engines and change over time, so record the exact query string with each result.

Practical points for crypto cases:

• Search full addresses, with and without quotes, across several engines and inside code repositories and paste sites. Addresses are long, unique strings, so a hit is rarely a coincidence, though it may be a copy (see the lesson Linking on-chain and off-chain identifiers).
• Search handles and their variants: underscores, digits, common substitutions.
• Check web archives. The Internet Archive's Wayback Machine and other archives hold earlier versions of pages, often from before a scam site removed its deposit addresses or a forum user edited a post. Archive copies are themselves third-party captures; cite the archive URL and capture time as the archive records it.
• Capture first, analyze later. Live pages change and vanish, sometimes because the subject noticed interest.

Collection with provenance

Each collected item needs enough information to show later what it was, where it came from, when, how it was captured, and that it has not changed. SWGDE's Best Practices for Acquiring Online Content (document 21-F-001) recommends capturing the full URL sequence, recording dates, times and the time zone of access, preserving metadata, hashing every acquired file with NIST-approved algorithms, and documenting the examiner, the browser and the access IP. The Berkeley Protocol adds that investigators should record the tools and software used.

A collection log entry:

{
  "item_id": "OS-0007",
  "case_id": "CF-2026-0142",
  "url": "https://forum.example/t/48213?page=3#post-912",
  "query": "\"bc1q…7k3f\" site:forum.example",
  "captured_utc": "2026-03-06T10:41:12Z",
  "method": "full-page capture + HTML source + WARC",
  "tool": "open-source capture tool v3.2, browser 128",
  "files": [
    {"name": "OS-0007.warc.gz", "sha256": "5b0e…11d4"},
    {"name": "OS-0007.png", "sha256": "c3a9…7e20"}
  ],
  "archive_copy": "web archive capture requested 2026-03-06T10:44Z",
  "posture": "non-attributable, research host RH-2",
  "collector": "EX-07",
  "note": "post dated 2023-11-14 shows address in user signature"
}

The entry records the full URL including the post anchor, the exact query that found it, the capture time in UTC, and how it was captured. It keeps three forms of the page: a WARC file (the web archive format standardized as ISO 28500), which preserves the HTTP exchange and is hard to dispute; a screenshot a reader can understand; and the HTML source. Each file has a SHA-256 hash computed at capture. Requesting an independent archive copy at the same time gives a third-party record of the page. The note separates the date shown on the post, which is a claim by the platform, from the capture time, which is the examiner's own observation.

Verification and analysis

Collected items are claims until verified. The Berkeley Protocol asks investigators to establish whether information is authentic and to assess each item for reliability, relevance and probative value. A practical structure is to examine the source (who published it, and is the account authentic and established?), the content (is it consistent internally and with other information?) and the technical traces (metadata, page structure, archive history). For crypto OSINT, the chain offers a strong independent check: if a post dated November 2023 shows an address, did that address exist and behave consistently with the post at that time? A post that publishes an address before it first received funds is more telling than one that appears after a public alert, when anyone could copy it.

Analysis then weighs competing explanations: the poster controls the address; the poster copied it; the account was impersonated or compromised. Record each hypothesis and the evidence for and against it, and grade the resulting link (see the lesson From address to entity to person).

Documenting OSINT for court

An open-source exhibit is defensible when another examiner could follow the same path and check every item. The case file should contain:

1. The collection plan and any changes to it, with reasons.
2. The collection log, with hashes, and the captured files in protected storage under chain of custody (see the lessons Preserving on-chain evidence and Hashing, logging and chain of custody).
3. Contemporaneous notes, including searches that found nothing, which matter when the defense asks what else was looked at.
4. Verification steps and their results for every item relied on.
5. A statement of posture and of any interaction, confirming that no unauthorized access or misrepresentation occurred.

In the report, cite each item by its identifier, quote only what is needed, and redact uninvolved people. Keep identifying material about private individuals in a restricted annex, as described in the IDFE-BA lesson Data protection, ethics and responsible disclosure.

Exam focus: open source information, intelligence and evidence as defined in the Berkeley Protocol (2020) and its investigation steps; Budapest Convention Article 32(a) on publicly available data; the intelligence cycle and a written collection plan with stop rules; attributable, non-attributable and covert postures and why covert work needs specific authority; search operators and recording the exact query; web archives and capturing before analysis; collection records with full URL, UTC time, method, tool version, SHA-256 hashes and WARC (ISO 28500), per SWGDE 21-F-001; source, content and technical verification and using the chain to test dated claims; what a court-ready OSINT file contains.