What is open-source intelligence (OSINT)?

Open-source intelligence, or OSINT, is the collection and analysis of information that anyone can lawfully access, turned into findings that answer a defined question. "Open" refers to the source, not to the analysis: raw search results are not intelligence until they have been verified, linked and interpreted.

In corporate investigations, OSINT is the starting point for most due diligence and many fraud cases. It is fast, discreet and does not alert the subject, which makes it well suited to the early stages of an inquiry.

What sources does OSINT use?

In India, common sources include:

• Corporate records. MCA filings showing directors, shareholders, charges, annual returns and changes of registered office.
• Court and tribunal records. Cause lists and orders from district courts, High Courts, the Supreme Court, NCLT, NCLAT and debt recovery tribunals.
• Regulatory sources. SEBI, RBI and other regulators' orders, stock exchange disclosures and debarment lists.
• Property and asset records. State land-record portals and registered documents where accessible.
• Media and web. News archives, company websites, domain registration history, job postings and archived web pages.
• Social media. Public profiles and posts showing relationships, travel, lifestyle and business activity.
• International sources. Foreign company registries, sanctions lists and offshore leak databases.

How does an OSINT investigation work?

A disciplined approach follows five steps:

1. Define the question. For example: who ultimately owns this vendor, or does this promoter hold undisclosed assets?
2. Collect. Search systematically across sources, using name variants, addresses, phone numbers and identifiers.
3. Verify. Corroborate each finding with at least one independent source, and treat single-source claims as leads.
4. Link and analyse. Map people, companies, addresses and assets to reveal patterns such as common directors or circular shareholdings.
5. Record and report. Document how and when each item was captured, so it can be relied on later.

When is OSINT used?

OSINT supports integrity due diligence on acquisition targets and partners, background verification of senior hires, identifying beneficial ownership behind vendors, detecting shell companies, and pre-litigation asset tracing. In fraud investigations it often reveals the connection between an employee and a supplier before any document review starts.

What is the Indian legal context?

Collecting public information is generally lawful, but investigators must not cross into unauthorised access to computer systems, which the IT Act 2000 penalises, or obtain private data through deception.

The Digital Personal Data Protection Act 2023 is relevant. Section 3(c)(ii) states that the Act does not apply to personal data made publicly available by the individual it relates to, or by a person legally obliged to publish it, such as a registry. Other personal data gathered in an investigation remains within the Act, although s. 17(1) exempts processing needed to enforce legal rights or claims and to prevent, detect or investigate offences, subject to security safeguards. Most data-fiduciary obligations apply from about 13 May 2027, under the phased DPDP Rules 2025. Specific legal advice is advisable where personal data is extensive or sensitive.

For evidence, web captures are electronic records. Their admission in court is governed by s. 63 of the Bharatiya Sakshya Adhiniyam 2023, which replaced s. 65B of the Indian Evidence Act 1872 and requires a certificate recording hash values.

What are the common pitfalls?

• Confusing people with similar names, especially where only partial identifiers are available.
• Relying on outdated or unverified aggregator data.
• Leaving a digital footprint, such as profile views, that alerts the subject.
• Failing to preserve pages that are later deleted.

How does OSINT differ from related terms?

OSINT is a method, not a deliverable. Due diligence and asset tracing are outcomes that use OSINT alongside human-source enquiries, document review and legal process. Human intelligence (HUMINT) gathers information through discreet conversations, which OSINT cannot replace. For how public-record research feeds recovery decisions, see pre-litigation asset searches.

Spectra Forensics' integrity due diligence combine OSINT, public-record research and source enquiries.