1. Confirm authority
Identify the client, decision-maker, legal or operational purpose, and any restrictions on the engagement before searching for a person or organisation.
R6I guidance
Lawful OSINT Is More Than Finding Public Information
Access does not remove the need for authority, relevance, or care.
Open-source intelligence can assist investigations, verification, litigation support, and locating work. Its value depends on a lawful purpose, proportionate collection, reliable attribution, preservation, and clear limits.
Before collection begins
Six controls make the work defensible.
2. Define necessity
Set the question first. Public availability is not a reason to collect unrelated personal information or retain material that does not answer the brief.
3. Assess privacy
Collection must account for the Privacy Act 1988, the Australian Privacy Principles where applicable, platform terms, and any matter-specific legal duties.
4. Corroborate identity
A matching name, photograph, username, or location can be misleading. Attribution should be tested across reliable, independent indicators.
5. Preserve context
Record the source, time, access path, surrounding context, and any transformation. Distinguish direct observation from inference.
6. Report limits
Separate facts, analysis, and unresolved ambiguity. State what was not searched, what could not be verified, and what the material cannot prove.
Responsible boundaries
Some requests should not proceed.
Purpose and proportionality first
- No pretextingNo deceptive access or impersonation
- No intrusionNo bypassing accounts or access controls
- No harassmentNo stalking, intimidation, or family-violence risk
- No overclaimingOnline material is assessed in context
The Office of the Australian Information Commissioner explains that personal information should only be collected where it is reasonably necessary for an organisation's functions or activities. Read OAIC guidance on APP 3. This guide is general information, not legal or privacy advice.
No subject details initially
Start with purpose and authority.
A confidential call can establish the lawful commercial purpose, scope, jurisdiction, and safeguards before identifying information is shared.