The Legal Landscape

Key Principle: Just because information is publicly available doesn't mean you can do anything with it.

Major Privacy Laws Affecting OSINT

1. GDPR (General Data Protection Regulation) - European Union

• Scope: Applies when handling EU residents' data

• Key Requirements:

  • Lawful basis for processing

  • Data minimization

  • Purpose limitation

  • Storage limitations

  • Right to erasure

GDPR Compliance Checklist for OSINT:

• Document lawful basis (legitimate interest)

• Collect only the necessary data

• Set retention periods

• Secure data storage

• Plan for deletion

2. CCPA (California Consumer Privacy Act) - California, USA

• Scope: California residents' personal information

• Key Points:

  • Right to know what's collected

  • Right to deletion

  • Right to opt out

  • Non-discrimination

3. Computer Fraud and Abuse Act (CFAA) - USA

• Critical: Prohibits unauthorised access

• OSINT Implication: Never bypass authentication

• Safe Practice: If it requires a password you don't have, stop

Ethical Framework for OSINT

The OSINT Ethics Test - Ask Yourself:

1. Is it legal?

   • Am I complying with all applicable laws?

   • Am I respecting the terms of service?

2. Is it necessary?

   • Do I really need this information?

   • Is there a less intrusive way?

3. Is it proportionate?

   • Does the benefit outweigh the potential harm?

   • Am I collecting minimal data?

4. What's my intent?

   • Am I investigating for legitimate purposes?

   • Could this information cause harm?

5. Would I be comfortable if this were done to me?

   • Apply the "golden rule"

   • Consider the subject's perspective

Passive vs Active Reconnaissance

Passive Reconnaissance (OSINT-Safe):

• Viewing public social media profiles

• Reading news articles

• Searching public databases

• Using search engines

• Viewing public websites

Active Reconnaissance (NOT OSINT):

• Port scanning

• Sending friend requests to targets

• Creating fake personas to gain access

• Direct contact with targets

• Any form of hacking

Common Ethical Dilemmas and Solutions

Dilemma 1: Finding Mental Health Information

• Scenario: Target's blog discusses depression

• Ethical Response: Note blog exists, don't include health details unless directly relevant to the investigation objective

Dilemma 2: Children in Photos

• Scenario: Target's family photos include minors

• Ethical Response: Never include children's photos or information in reports; blur faces if images are necessary

Dilemma 3: Leaked/Hacked Data

• Scenario: Finding the target in the leaked database

• Ethical Response: Consider legality in your jurisdiction; if used, note the source and potential legal issues

Responsible Disclosure

When You Find Security Issues:

1. Document the vulnerability

2. Don't exploit it

3. Notify the organisation

4. Give a reasonable time to fix

5. Consider coordinated disclosure

Template for Disclosure:

Subject: Security Vulnerability Disclosure

Dear [Organization],

I've identified a potential security issue:
- Type: [Exposed database/credentials/etc.]
- Location: [URL/specific location]
- Potential Impact: [What could happen]
- Discovered: [Date]

I have not accessed any data beyond confirming 
the vulnerability exists. Please confirm receipt 
and provide expected timeline for resolution.

Best regards,
[Your name]