Why there’s no one-size-fits-all OPSEC setup for OSINT

Tony Marshall is an award-winning detective with more than 26 years of experience in UK policing. He specializes in digital and technical threats, intelligence, and online investigations including OSINT. He has been active in the OSINT community as Ginger T for nearly a decade.

Phone syncing is an age-old OSINT trick to identify social and mobile app accounts connected to a phone number. Download the apps you want to test to a burner phone, then create contacts using the mobile numbers you want to research. Allow the apps to sync with your contact list and presto — you’ve now identified the apps your subject uses. Now you can gather more information, such as a profile picture that you can reverse image search.

But sometimes it goes wrong. In this particular case, you might accidentally ring one of the numbers of interest, revealing your number and the fact that you have theirs. I always say to people that OPSEC oopsies happen. The most important part is to learn from them. It’s the potential for such errors that got me interested in OPSEC.

Accidentally calling a target is a risk to an investigation, not to mention your personal safety. That’s why it’s never acceptable to use a personal phone for syncing. Remember, too, that the people you investigate can use OSINT on you. That’s why OPSEC is essential.

But what do I mean by OPSEC? Operational security as a term and concept originated with the US military to “prevent sensitive information from getting into the hands of an adversary, primarily by denying access to the data,” according to a SANS article by OSINT expert Ritu Gill. 

Google’s AI Overview says it’s “a process for identifying critical information, assessing whether it could be useful to an adversary, and then applying measures to eliminate or reduce that risk. It focuses on protecting sensitive operational details so attackers can’t gain an actionable insight.”

One word stands out to me: “assessing.” Many OSINT professionals do not properly assess their OPSEC requirements. They stick to the same methodology time after time. Something else I would add to the definition is that OPSEC is about not being discovered.

Let’s take this into the physical world of surveillance. A primary concern for a surveillance operative is to remain undetected. It’s exactly the same in the digital world.

That raises a question that gets to the heart of this guide: Is Facebook an adversary, or a very good OSINT resource with questionable privacy practices? Your answer depends on whether you’re thinking about privacy or OPSEC.

For me, OPSEC and privacy are different, but related, disciplines. However, some OSINT professionals believe they are the same thing. We can certainly learn from the privacy community, but we shouldn’t use its guidance as our OPSEC strategy.

Standard OPSEC advice includes using a VPN, virtual machine, privacy-enhanced web browser such as Brave or Firefox, as well as burner accounts/sockpuppets and perhaps even mobile device emulators. But following the crowd may mean you don’t get the most out of the OSINT environment you have built. 

There isn’t a single perfect OPSEC setup for doing OSINT. Rather than prescribing a single tech stack, this guide helps you think through the process and make the right choices based on your investigation and your needs. Because sometimes, the best way to ensure operational security is to blend in rather than stick out with a highly customized setup.