Are you looking for a career related to open-source intelligence or OSINT in Germany? With OSINT being used in a wide array of industries, such as law enforcement, cybersecurity, journalism, and market research, you have many options for professional development.
But is OSINT in Germany different from other areas? German companies and investigators should be aware of the legal and privacy implications of using OSINT in Germany, as they are subject to the GDPR and other relevant laws. By leveraging OSINT, German businesses can gain a competitive advantage and conduct various tasks such as competitive analysis, due diligence, risk management, and fraud detection.
In this article, you will learn about open-source intelligence (OSINT) definition, its common uses, and its advantages and disadvantages. You will also get an overview of the laws and regulations affecting OSINT data gathering in Germany, as well as the most common tools used for OSINT services and how to find OSINT-related jobs in Germany.
What is Open-Source Intelligence or OSINT?
If you have ever looked up someone on Google or social media, researched about a company you are planning to apply to, or tried to find a photo or video, then you have already conducted OSINT research.
The United States Department of Defense formally defines OSINT as intelligence “produced from publicly available information that is collected, exploited, and disseminated in a timely manner to an appropriate audience for the purpose of addressing a specific intelligence requirement.” Basically, the data is gathered from existing public information, then analyzed for insights.
For example, you can manually collect raw data from sources like social media posts, website information, and dark web discussions or use a discovery tool. OSINT investigators interpret and analyze the information so that they make sense, then furnish a report summarizing the findings and recommended action points.
However, open-source information is not limited to online sources. News and media sources, as well as grey literature like academic databases, statistics, and reports from organizations, also fall under OSINT. Even the “deep web,” which comprises over 99% of the internet according to former Google CEO Eric Schmidt, is considered open source despite not being indexed by any search engines.
The purpose of OSINT varies depending on the industry and the type of insights you wish to collect. Some of the most common purposes of OSINT include uncovering threats, protecting VIPs and executives, managing brand reputation, gauging brand sentiment, and monitoring one’s digital footprint.
How is OSINT Different from Internet Investigations?
While most people use OSINT and internet investigations interchangeably, there’s a subtle difference between these two related concepts.
As mentioned above, open-source intelligence or OSINT is intelligence derived from public sources. But it does not only cover internet sources; it also encompasses any information available to the public, like published research and satellite images. On the other hand, internet investigations are a subset of OSINT that focuses on discovering and analyzing information derived from online sources, such as social media, forums, and online databases.
In other words, OSINT is broader in scope as it includes publicly available information both online and offline, while internet investigations are solely for investigating online sources.
The Legal and Privacy Implications of Using OSINT in Germany
One of the common concerns raised when conducting internet investigations is, what gives you the “right” to carry out investigations as a private investigator or OSINT analyst?
The answer is simple: you can only conduct surveillance if you have “legitimate interest.” Under Germany’s Federal Data Protection Act, legitimate interest exists when the client is pursuing a reasonable interest justified by the situation and can present this in a coherent, consistent, and plausible manner. It is done to protect the rights of individuals being investigated on. It should be documented in writing and signed accordingly by the client, then verified by a lawyer.
That means, if you want to have a person or organization investigated, you should possess evidence that proves such a thing is necessary and appropriate. Ultimately, it is the client’s responsibility to provide documented proof of legitimate interest before any investigation takes place.
Another regulation that immediately comes to mind is the General Data Protection Regulation (GDPR). Applicable to all residents in European Union member countries, the GDPR ensures that personal data is protected during processing and storage, giving subjects more control over their own data. It also helps minimize the personal data collected by data controllers.
If you are a business owner leveraging OSINT in Europe or trying to find a job in this field, you have to remember the following basic GDPR principles:
- You must implement advanced technologies and policies to ensure you are providing your customers with the highest data privacy level during collection, processing, and storage of personal data.
- You must obtain user consent to collect personal data. The text should be unambiguous and explicit.
- You must restrict data collection to the minimum necessary information to achieve your objectives.
- You must be fully transparent with what, how, and why you collect personal data. Individuals have the right to object to the collection, correct their data, or have them erased.
- You must report data breaches within 72 hours.
To further strengthen GDPR, Germany also passed the Data Protection Adaptation and Implementation Act (Bundesdatenschutzgesetz BDSG-New), which was enforced the same day as the GDPR. BDSG-New specifically applies to private businesses and multinational corporations with business operations within Germany.
One of the explicit provisions of BDSG is appointing a data protection officer within a company. They are the main point person dealing with processing sensitive personal data. While GDPR imposes a fine of €20 million or 4% of the company’s global revenue, BDSG gives a maximum fine of €50,000, plus non-monetary fines and proposed compensation for pain and suffering.
While OSINT remains legal in Germany, it is important to be mindful of these data privacy laws to ensure you are not breaking any regulations when practicing OSINT in Germany.
What is OSINT Used for?
Businesses encounter many difficulties that can influence their operations, from cyber threats and physical security hazards to market competition and financial fraud. OSINT plays a significant role in organizations as it is used in different fields and ways. Below are some of the ways how OSINT is used in various industries.
Cybersecurity
OSINT is essential for cybersecurity professionals to gather information about potential threats and vulnerabilities. It can monitor web activities in social media, forums, and even the dark web to identify emerging risks and trends. This information can be analyzed to develop effective strategies to prevent and respond to cyberattacks.
OSINT aids in the detection of digital footprints in various cybersecurity assessments. Using publicly available information, security professionals and organizations uncover sensitive, exposed information that any malicious hacker may use to launch an assault on key assets.
On the other hand, black hat hackers use OSINT to gather information about their target and identify vulnerable access points to carry out a cyberattack.
Law Enforcement
Law enforcement agencies use OSINT to strengthen their investigative capabilities and respond to criminal threats. They use OSINT to gather intelligence from publicly available sources and use the information to investigate criminal activities, locate suspects, and collect evidence. OSINT is crucial in helping law enforcement agencies prevent and solve crimes.
Dark Web Scan
OSINT helps scan the dark web for unlawful activities. Dark web scans entail collecting and assessing data from secret networks for potential hazards or risks. This intelligence collection can allow security professionals to identify compromised credentials, stolen data, or illicit behavior, such as selling drugs or weapons.
By leveraging OSINT tools and techniques, organizations can better understand the dark web and proactively monitor for any suspicious activity that may impact their business.
Market Research
OSINT can also be valuable for market research as businesses can obtain insights into consumer behavior, industry trends, and competitor strategies. Gathering information for market research may include the following:
- social media analysis
- news gathering
- web scraping
- online surveys
Competitive Analysis
OSINT can be a powerful tool for analyzing competitors. Organizations can gather data with valuable insights into their competitors’ strategies, strengths, and weaknesses. Hence, OSINT helps businesses adjust strategies and positioning to gain an advantage in the market.
Due Diligence
Organizations must deal with business transactions, such as mergers, acquisitions, or investments. OSINT can be used to collect relevant data on a company’s history, management team, financial performance, legal issues, and other relevant information. This intelligence can help acquire information about the risks and opportunities associated with a potential transaction.
Risk Management
With OSINT collection and analysis, a company can identify potential issues that will affect its company. By doing this analysis, the company can take proactive measures to mitigate risks and protect its operations.
One example of using OSINT in risk management is monitoring social media, news, and other online sources for any negative feedback or reviews associated with a business’s brand.
Fraud Detection
Businesses can use OSINT to acquire insights into possible fraudulent activity and take preventative action to stop and identify fraud. OSINT can be used to monitor social media for any potential red flags associated with fraudulent activities, such as posts about suspicious financial transactions or unexplained wealth. Another way to use OSINT is to examine financial data like transaction records and bank statements to look for any indications of fraudulent activities.
OSINT is essential for businesses, providing valuable insights into their competitors, market trends, potential risks, and other vital information to help them make informed decisions and stay ahead of the competition.
OSINT Pros and Cons
While OSINT allows for more efficient data gathering and valuable insights, it also carries several risks. Below are some OSINT pros and cons.
OSINT Advantages
Accessibility
One of the leading benefits of OSINT is that it is widely accessible. As such, anyone with an internet connection can use OSINT and gather valuable information without special resources.
Real-time
OSINT often provides current and up-to-the-minute information. This can be especially useful for tracking events as they occur.
Versatile
OSINT has many purposes. For instance, users can conduct background checks and investigate potential business opportunities. It can also be used to strengthen corporate security or manage brand reputation.
Comprehensiveness
With OSINT, users can tap into various sources to comprehensively analyze a particular subject or situation.
OSINT Disadvantages
Inaccuracy
Information gathered from open sources is not always verified at the source. The authenticity and credibility of such sources might be questionable.
Time-consuming
Although OSINT is widely accessible, obtaining relevant and useful information is often time-consuming and frustrating. The good thing is that several OSINT tools and software make data gathering easier, although they often come with a steep price tag.
Limitations
OSINT relies on publicly available information, which can be limited. Additionally, certain sources of information are not open to the general public.
Bias
OSINT sources may have agendas or biases. It is essential to be wary of this when reviewing information.
Ethical considerations
Gathering personal data and sensitive information from open sources may violate ethical considerations.
It is essential to consider the OSINT advantages and disadvantages before utilizing it. While OSINT may provide valuable insights and information, it is best to combine it with other intelligence sources and approaches and apply proper analysis, verification, and considerations of ethical and legal considerations.
How to Find OSINT Jobs in Germany
Finding OSINT jobs in Germany can be challenging, especially for newcomers in the field. Below is a guide to help you find OSINT jobs in Germany.
Step 1: Get OSINT Training
Take advantage of different online OSINT courses and programs available in the market.
You may consider the following factors when choosing an OSINT course:
- Course content: Check whether the course covers the latest OSINT tools, techniques, and best practices. Ensure the course covers areas that align with your interests and goals.
- Instructor’s expertise: Look for courses taught by competent instructors with a good track record in the OSINT field. The instructor should also be knowledgeable and experienced in using different OSINT tools and techniques.
- Course reviews: Read reviews from previous students. Reviews can provide insights into the quality of the course, the instructor, and the course materials.
corma is a private investigative company that provides expert investigation and training services in Europe and worldwide. Check out corma’s Internet Investigations and OSINT Basic Training to help you jumpstart your OSINT career.
Step 2: Practice Your OSINT Skills
Here are a few skills needed for OSINT jobs:
Investigative mindset
An investigative mindset helps OSINT professionals approach problems critically and creatively. This skill is vital in identifying relevant information from a sea of data, verifying its accuracy, and connecting the dots to uncover hidden insights.
Understanding geolocation tools
OSINT investigators may use geolocation tools, such as Google Maps and Google Earth, to determine the location of a social media post or an image relevant to an investigation. Contextual understanding can help investigators avoid inaccurate conclusions from misinterpreting geographical data.
Leveraging social media platforms
This skill is used to collect and verify information through crowdsourcing investigations. It can help investigators comprehensively understand a particular subject or event. It can also help investigators gain diverse perspectives and insights that may not be available through traditional sources.
Step 3: Build Your OSINT Portfolio
Create a portfolio of projects where you can showcase your OSINT skills, such as diagrams, code snippets, or blog posts. Build a central repository for your projects, like a website, where you can share your accomplishments.
Step 4: Create Your Resume
Adapt your resume to match the requirements of the job you’re seeking. Include the projects and skills you gained in your training and relevant experiences. You should also add a link to your portfolio in your application.
Step 5: Look for OSINT Jobs in Germany
The last step is to find out who is hiring. Many OSINT jobs do not always represent themselves as such or even have the term “OSINT” in their titles.
Consider professions that would require specific OSINT expertise. Keywords such as research, intelligence, investigation, analysis, and geolocation may be relevant. Check multiple platforms and set up filters and notifications to look for newly advertised positions. You can also get leads on sites like Twitter and Facebook.
Finding an OSINT job can be challenging at first. But equipping yourself with knowledge and skills will lead you to a career path in OSINT.
OSINT Tools in Germany
In Germany and the rest of the world, organizations expedite fact-finding and enhance digital security using OSINT tools like the following:
Maltego
Maltego is a data mining software that uses OSINT to gather information and perform link analysis. Likewise, it helps visualize complex relationships between various entities, such as individuals, organizations, and websites.
Key Features
- Gathering information from public databases, social networks, and popular search engines
- Automatic correlation between gathered data and visual representation of connections and patterns
- Customization of entities, properties, and transforms according to one’s needs
- Collaboration features to share and annotate graphs with team members
corma, a professional investigation agency based in Germany, offers a three-day course on the Maltego Social Links Training. The course covers OSINT data gathering, link analysis, and entity recognition.
Spiderfoot
Spiderfoot allows users to automate searching for different types of information about a target.
Key Features
- Identify IP addresses, domain names, email addresses, and URLs associated with your target
- Determine the reputation of domain names and IP addresses using various databases, including VirusTotal and Shodan
- Discover hidden web services, web technologies, and exposed ports
- Scan indexed web, deep web, and dark web
- Perform geolocation, domain WHOIS, DNS, and email server tests
- Get search engine results for specific keywords
- Generate network diagrams and word clouds for visualization
BuiltWith
BuiltWith is a web technology profiler tool that helps users discover what technologies are used on their websites.
Key Features
- Web technology profiler. Identifies and analyzes the technology stack to build a website, including web server and CMS platform.
- Technology tracking. Monitor the usage and growth of web technologies over time. As such, it provides insights into market trends and technology adoption rates.
- Data enrichment. Provides additional data points like social media presence, advertising, and contact information.
Recon-ng
Recon-ng is an open-source reconnaissance tool that automates collecting information about a target. Besides that, users could use it for both web-based and network-based security assessments.
Key Features
- Modular architecture. Users can enable or disable modules as per their requirements. They can also add their custom modules for specific use cases.
- Support for multiple data sources. Recon-ng supports collecting information from various sources, including Google, Bing, GitHub, and more.
- Data correlation. Correlates the data from various sources to provide a comprehensive view of the target.
- Reporting. Provides customizable reporting options, allowing users to create reports in various formats.
Shodan
Shodan is a search browser that lets users find Internet-connected devices and information about them. For instance, it is frequently used by researchers, security professionals, and hackers to uncover vulnerabilities in connected devices.
Key Features
- Search for specific devices or services
- Filter search results by device type, location, operating system, etc.
- Scan internet networks for connected devices
- View live or historical device data, such as open ports or vulnerabilities
- Create alerts for specific devices or software changes
Best Practices for Using OSINT Tools
When using OSINT tools, make sure that you:
- Clearly define your research questions and objectives before starting your OSINT investigation.
- Verify the credibility and authenticity of your sources to ensure reliable data.
- Use multiple sources of information to cross-check facts and avoid biases.
- Keep a record of your sources and methodology for easy reference and transparency.
- Respect the privacy of individuals and organizations by refraining from hacking or unethical data collection methods.
- Follow legal and ethical guidelines.
- Stay updated with the latest trends and best practices for effectively using OSINT tools.
Conclusion
Open-source intelligence is used in various industries for a wide array of purposes globally. However, there are certain regulations that you need to follow when leveraging OSINT in Germany to ensure that you are not breaking any laws.
It is also essential to equip yourself with the proper knowledge and training to land an OSINT-related job. Familiarizing yourself with tools and best practices can open up OSINT career opportunities in Germany.
