9.3 Open Source Intelligence (OSINT) & Online Investigation

The digital environment has transformed private investigation. Today, a vast amount of actionable intelligence is generated across the internet, commercial web servers, and social media platforms. In Ontario, private investigators routinely leverage Open Source Intelligence (OSINT) and Social Media Intelligence (SOCMINT) to support litigation, verify injury claims, locate missing persons, and investigate corporate malfeasance. However, the ease of browsing the web does not exempt an investigator from evidentiary rules or criminal laws: digital intelligence must be gathered lawfully, preserved forensically, and collected without violating computer integrity or statutory privacy rights.

---

Fundamentals of OSINT and SOCMINT

Understanding the precise definition and scope of open source intelligence is essential for maintaining professional standards and legal compliance:

• Open Source Intelligence (OSINT): The discipline of collecting, processing, and analyzing publicly available, unclassified information to produce actionable intelligence. In a legal context, information is "open source" if it can be viewed, accessed, or obtained by any member of the public without circumventing security controls, using fraudulent credentials, or breaching statutory protections.
• Social Media Intelligence (SOCMINT): A specialized sub-category of OSINT that focuses on information gathered from social networking sites, media-sharing networks, discussion forums, and messaging communities. It encompasses textual posts, photographs, video streams, user profiles, geolocation check-ins, and social relationship graphs.

Reasonable Expectation of Privacy

Under Canadian common law and constitutional principles, an individual's expectation of privacy varies dramatically depending on the digital context. Information published on an open, public webpage or an unrestricted social media profile carries a minimal or diminished expectation of privacy. Conversely, information protected by privacy settings, passwords, or encrypted channels carries a high expectation of privacy that private investigators cannot lawfully breach.

---

Advanced Search Methodology & Digital Profiling

Professional online investigations go far beyond simple keyword searches. Investigators employ structured search engine syntax, advanced Boolean logic, and digital footprint correlation to locate obscure records.

1. Advanced Search Operators (Google Dorks / Search Syntax)

Search engines index billions of web pages. Using advanced search operators allows an investigator to isolate target files, index directories, and filter out irrelevant results:

• Exact Match Quotes ("phrase"): Forces the search engine to return the exact phrase in exact sequence (e.g., "John Robert Smith" "Thunder Bay").
• Site Operator (site:): Restricts results to a specific domain or top-level country code (e.g., "Acme Holdings" site:ca or "Jane Doe" site:linkedin.com).
• Filetype Operator (filetype:): Targets specific document formats such as PDFs, Excel spreadsheets, or Word documents, often locating leaked corporate rosters, court transcripts, or conference attendance lists (e.g., "budget forecast" site:company.com filetype:pdf).
• Title and URL Filters (intitle: / inurl:): Identifies pages with specific terms in their title tag or URL path (e.g., intitle:"curriculum vitae" "Jane Doe" or inurl:profiles "Mark Jones").
• Boolean Logic (AND, OR, - / NOT): Refines queries by including or excluding terms (e.g., "David Miller" Hamilton -hockey -musician).

2. Username Correlation & Digital Footprinting

Individuals routinely reuse the same unique username (handle) across multiple digital platforms (such as gaming forums, social networks, classified ad sites, and code repositories). Investigators use username reconnaissance tools and open directories to map a subject's digital footprint across the web, revealing dormant accounts, personal interests, and alternative email addresses.

3. Reverse Image Searching & Visual Verification

Reverse image searching involves querying search engines (such as Google Lens, TinEye, Bing Visual Search, or Yandex) using an image file rather than text.

• Applications: Locating additional social media profiles utilizing the same profile photo, uncovering instances of online identity theft, tracing original image upload dates, and determining whether a photo posted by a subject was actually taken by them or copied from a stock photography site.

4. Domain & Infrastructure Lookups (WHOIS & DNS)

When investigating fraudulent e-commerce operations, corporate scams, or defamatory websites, investigators examine domain infrastructure:

• WHOIS Records: Disclose the domain registrar, registration creation date, expiry date, and registered contact information (name, address, email), unless shielded by privacy proxy services.
• Historical Archives (The Wayback Machine): Services like the Internet Archive preserve historical snapshots of websites, allowing investigators to view past corporate claims, removed staff bios, or deleted blog posts.

---

Cross-Platform Social Media Intelligence (SOCMINT)

Different social networking platforms fulfill distinct personal and commercial roles. A comprehensive SOCMINT inquiry synthesizes data across multiple platforms to construct a verifiable timeline of a subject's activities:

---

Preserving Digital Evidence for Court Admissibility

Digital evidence is inherently volatile: an online post, photograph, or account can be edited, deleted, or privatized in seconds. Under the Canada Evidence Act and the Ontario Evidence Act, digital documents are admissible only if their authenticity and integrity can be established to the court's satisfaction. A cropped smartphone screenshot is highly vulnerable to judicial challenge, as it lacks contextual metadata and can be easily manipulated.

1. The Digital Capture Protocol

When documenting online evidence, investigators must capture the complete digital environment:

• Full-Page Forensic Capture: The capture must display the entire, uncropped web page, including navigation headers and footer elements.
• Source URL: The unbroken, complete Uniform Resource Locator (URL) displayed in the browser address bar.
• Standardized Timestamp: The exact date and time of capture, recorded in Coordinated Universal Time (UTC) or local time with clear time zone notation, calibrated against a reliable network time server.
• Browser Environment & IP Address: Document the operating system, browser version, and the hosting server's public IP address (via DNS resolution).

2. Preserving EXIF and File Metadata

Digital photographs contain embedded technical data known as Exchangeable Image File Format (EXIF) metadata. EXIF data can reveal:

• The make, model, and serial number of the camera or smartphone;
• Camera settings (aperture, shutter speed, ISO, focal length);
• The exact date and timestamp when the photo was captured;
• GPS coordinates (latitude, longitude, altitude) where the shutter was pressed.

Important Technical Note: Major social media platforms (such as Facebook, Instagram, and X) automatically scrub EXIF metadata from uploaded images during compression to protect user privacy. However, original digital images obtained from personal blogs, unmanaged company servers, or direct witness files retain full EXIF data and must be preserved intact.

3. Cryptographic Hashing (SHA-256)

The gold standard for proving digital file integrity in court is cryptographic hashing. A cryptographic hash function (such as SHA-256) processes a digital file through an algorithm to generate a unique, fixed-length 64-character hexadecimal digest.

• Mathematical Immutability: Any alteration of the underlying file—even a single byte or pixel change—alters the resulting hash value completely (the "avalanche effect").
• Chain of Custody: The investigator generates a SHA-256 hash immediately upon saving the digital capture file and records this hash value in their contemporaneous investigative notes. If the opposing counsel at trial alleges the screenshot was altered, running the hash algorithm on the courtroom exhibit will produce the identical SHA-256 hash, conclusively proving the file has not been altered since the moment of collection.

---

Legal and Ethical Boundaries in Online Investigations

Operating online does not grant an investigator immunity from statutory rules, privacy laws, or professional ethics. The boundary between lawful intelligence gathering and unlawful digital intrusion is strict.

+----------------------------------------------------------------------+
|                 LEGAL & ETHICAL BOUNDARIES IN OSINT                  |
+----------------------------------------------------------------------+
| LAWFUL (PASSIVE OBSERVATION):                                        |
| - Viewing public social media profiles without logging in            |
| - Using non-attributed research accounts for passive review          |
| - Conducting search engine syntax and domain WHOIS queries           |
|                                                                      |
| HIGH-RISK OR UNLAWFUL (DECEPTION & INTRUSION):                        |
| - Sending deceptive friend requests under false personas ("friending")|
| - Pretexting or manipulating subjects into sharing private data      |
| - Hacking, cracking passwords, or credential stuffing (CCC s. 342.1) |
| - Circumventing privacy settings or security firewalls               |
+----------------------------------------------------------------------+

Passive Viewing vs. Deceptive Undercover Friending

• Lawful Passive Viewing: An investigator may use a non-attributed research account (often colloquially termed an investigative or research profile) to view strictly public content. Passive viewing involves observing what the subject has voluntarily made available to the public domain without any interaction.
• Deceptive "Friending" / Pretexting: Creating a fake persona (such as an attractive associate, a mutual friend, or a recruiter) to send a friend request, follow request, or direct message to a subject in order to bypass privacy settings and gain access to restricted, private content is unethical and legally hazardous.
  • This tactic violates platform terms of service;
  • It sits poorly with the Code of Conduct's duty to act with honesty and integrity (O. Reg. 363/07, s. 2(1)(a)). The Code's undercover exception (s. 2(3)) lets an investigator conceal that they are an investigator, but it does not authorize gaining access to content the subject deliberately restricted. That kind of access can amount to intrusion upon seclusion and is unlikely to meet PIPEDA's reasonable-purpose test (s. 5(3));
  • In civil and criminal litigation, evidence obtained through deceptive online pretexting risks being ruled inadmissible by trial judges for violating principles of fairness and privacy.

Criminal Code Section 342.1: Unauthorized Use of Computer

Private investigators are strictly bound by Section 342.1 of the Criminal Code, which makes it a hybrid offence (up to 10 years on indictment) to, fraudulently and without colour of right:

1. Obtain, directly or indirectly, any computer service;
2. Intercept or cause to be intercepted, directly or indirectly, any function of a computer system; or
3. Use or cause to be used, directly or indirectly, a computer system with intent to commit an offence.

Strict Prohibitions: Private investigators cannot hack into private accounts, use brute-force password cracking software, conduct credential stuffing using leaked database dumps, deploy spyware or keyloggers, or bypass security access controls. Gathering open-source intelligence is strictly restricted to information that is publicly viewable without unauthorized access.