Operational Security for OSINT Researchers

BY DR. LELAND W. SMITH

Open-source research feels passive. You read pages, look at photos, and take notes. But almost every action you take online leaves a trace somewhere, and some of those traces are visible to the people and organisations you are researching. A careless profile view, a link pasted into the wrong chat, or a document with your name in its metadata can tip off a subject, compromise an investigation, or expose you personally.

Operational security, usually shortened to OPSEC, is the practice of identifying what an adversary could learn about your activity and taking reasonable steps to limit it. For OSINT researchers, the adversary is often the subject of the research, but it can also be a third party who sees your activity, or simply a platform that links your research to your real identity. This guide covers how to think about that risk and how to manage it in daily work.

Start with a threat model for your own research

OPSEC is not a fixed set of tools. It is a set of decisions that depend on who you are researching and what would happen if they noticed. Before you start a case, answer five questions:

1. Who is the subject? A large company, a small business owner, a private individual, an organised group?
2. What can they see? Do they control websites, servers, social accounts, or email systems you might touch?
3. How likely are they to look? A multinational's web server logs are rarely reviewed by a person. A small fraud operation may watch its visitors closely.
4. What would happen if they noticed? Evidence deleted, accounts locked, the subject warned off, or a threat to your safety?
5. What would happen if your identity were linked to the research? Harassment, legal threats, reputational harm to a client?

The answers set the level of care. Background research on a listed company before a meeting needs ordinary hygiene. Research on a person suspected of running a harassment campaign needs much more. Matching effort to risk is the point: too little care exposes you, and too much wastes time and creates its own mistakes.

What targets can see when you visit

Websites they control

When you load a web page, the server that hosts it typically logs your IP address, the time, the pages you requested, your browser's user agent string, and often the referring page. If the site uses analytics, tracking pixels, or third-party scripts, more information may be collected, including details that help fingerprint your browser. Your IP address can reveal your internet provider, your approximate location, and sometimes your organisation if you work from a corporate network.

The referrer is easy to forget. If you click a link from a search engine or from another site, the destination may learn where you came from. If you came from an internal case management tool with a revealing URL, that URL could leak. Browsers now limit referrer data by default in many cases, but you should not rely on that alone.

Social platforms

Some platforms tell users who has viewed their content. LinkedIn shows profile viewers depending on the viewer's privacy settings. Story views on Instagram and Facebook are visible to the poster. Some platforms notify users when someone takes a screenshot of certain content or joins a shared space. Rules change often, so check the current behaviour of each platform before you use it for research, and assume visibility unless you have confirmed otherwise.

Email and documents

Emails often contain tracking pixels, small images that load from the sender's server when the message is opened and reveal the time and your IP address. Shared document links can show the owner who accessed them. Some file-sharing services list viewers by account. Opening a file the subject sent you, or clicking a link in their message, can confirm to them that you are looking.

Link previews and read receipts

These two features catch experienced researchers off guard.

Link previews: When you paste a URL into many messaging apps, email clients, or collaboration tools, the app fetches the page to build a preview with a title and image. Depending on the app, that fetch may come from your device or from the service's servers. Either way, the subject's server records a visit at that moment, sometimes with a recognisable user agent. If you paste a subject's unusual URL into a team chat, the subject may see a hit from that chat service seconds later. Share sensitive URLs inside a code block, as plain text in a case file, or with link previews disabled.

Read receipts and typing indicators: If your research involves any messaging platform where you are in a group or channel with the subject, assume they can see when you read, and possibly when you type. Turn receipts off where the platform allows it, and avoid opening conversations you do not need to read.

Accidental likes, follows, and connections

A single mistaken tap can expose a research account or, worse, your personal account. On mobile apps, double-tapping a photo on Instagram likes it. Scrolling on a touch screen can trigger a follow or reaction. Some platforms suggest you to the people whose profiles you view, through "people you may know" features fed by contact lists, location, and browsing patterns.

Practical habits:

• Do research on a desktop browser rather than a phone app wherever possible. Touch interfaces make accidental interactions far more likely.
• Never use your personal accounts for research. If you must sign in to see content, use a dedicated research account, and make sure using it complies with the platform's terms and your organisation's policy.
• Do not sync a research account's contacts or allow it access to your phone's address book.
• Before you close a session, check the account's activity log, if the platform has one, for any interaction you did not intend. If you find one, record it in your case notes. Hiding mistakes from your own team is worse than the mistake.

Metadata in your own files

Your reports and exhibits can expose you as easily as your browsing. Common sources of leakage:

• Office documents: Word, Excel, and PowerPoint files store the author name, the organisation, revision history, comments, and sometimes tracked changes that were never accepted. Use the document inspection feature in your office suite before sharing.
• PDFs: PDF files carry metadata fields such as author, creator application, and creation date. They can also contain hidden layers or text that was covered with a black box rather than truly redacted. Use a proper redaction tool, then check the result.
• Images: Photos from phones often contain EXIF data, including camera model, timestamps, and GPS coordinates. Screenshots can include your device name in the file name, a visible bookmarks bar, open tabs, or notifications. Crop and check before sharing.
• File names and paths: A file called "Smith_divorce_research_final.pdf" tells anyone who sees it more than you might want.

The free tool ExifTool reads and removes metadata from a wide range of file types and is worth learning. Whatever tool you use, inspect the output rather than assuming the cleaning worked.

Separating identities

The core OPSEC principle for researchers is compartmentation: keep your research activity separate from your personal identity and, where the risk warrants it, separate cases from each other.

Levels of separation

• Basic: A separate browser profile used only for research, with no personal accounts signed in, no saved passwords, and no sync to your personal account. This stops the most common leaks: being signed in to personal accounts while researching, or your history and autofill mixing contexts.
• Moderate: A dedicated virtual machine or a separate computer for research, plus a VPN or similar service so the subject's servers do not see your home or office IP address. Research accounts kept distinct from each other.
• High: Disposable virtual machines reset after each case, network separation, and strict procedures for moving evidence out of the research environment. This level is for sensitive cases where the subject is capable and motivated.

Things that link identities

Separation fails through small overlaps. Watch for these:

• Signing in to a research account and a personal account from the same browser or IP address.
• Reusing a phone number, recovery email, or profile photo across identities.
• Writing in your recognisable personal style from a research account.
• Working the same hours from the same location, consistently, across identities, when the subject could observe both.
• Browser fingerprinting, which can link sessions even without cookies. A dedicated environment reduces this risk more than clearing cookies does.

A worked example

Suppose you are asked to research an online seller suspected of selling counterfeit goods through a small website and a social media shop. The seller appears to run everything personally and responds quickly to customer messages.

Your threat model: the subject controls the website and probably checks its analytics. They manage their own social accounts and can see some visitor information. If they notice attention, they could take down listings and move the operation before your client acts. There is no sign they are dangerous, but losing the evidence is a real risk.

Your approach:

• Use a dedicated research browser profile in a virtual machine, connected through a VPN so your office IP does not appear in their logs.
• Capture the website pages and listings early, before anything changes, recording URLs and timestamps.
• Browse the social shop while signed out where content allows it. Where sign-in is required, use a research account that has no connection to you or the client and has never interacted with the subject.
• Do not view the seller's stories, since story views are visible to the poster.
• Do not paste the seller's URLs into the client's chat tool. Share them in a plain-text file inside the case folder.
• Before sending your report, remove metadata from the PDF and check that screenshots do not show your browser bookmarks or other tabs.

None of these steps involves deception or interaction with the subject. They simply avoid announcing your interest.

Common mistakes and limits

• Over-trusting a VPN. A VPN hides your IP address from the sites you visit. It does not hide your identity if you sign in to a personal account, and it does not stop browser fingerprinting.
• Assuming private or incognito mode is anonymous. It prevents local history storage. It does not hide you from websites.
• Using a research account until it looks fake. Accounts with no history, no photo, and sudden activity draw attention and may be suspended. Understand platform rules before you create one, and do not use them to interact with subjects.
• Forgetting mobile devices. A quick check on your phone, while signed in to personal apps, can undo careful work on your desktop.
• Treating OPSEC as an excuse for deception. OPSEC is about not revealing yourself. It is not permission to impersonate people or to gain access you would not otherwise have.

No set of precautions makes you invisible. The aim is to reduce what a subject can learn to a level that fits the risk of the case.

An ethics and legality note

Good OPSEC protects the researcher and the integrity of the investigation. It does not change the legal and ethical limits on the research itself. Research accounts may conflict with platform terms. Pretexting and impersonation can be illegal. Hiding your identity does not make an otherwise disproportionate investigation acceptable. Use these techniques for lawful, authorised research, and keep a record of the methods you used so you can explain them if asked.

Pre-research checklist

1. Write a short threat model: who the subject is, what they can see, how likely they are to look, and the consequences of being noticed.
2. Choose the level of separation that fits the risk.
3. Open a dedicated research browser profile or environment with no personal accounts signed in.
4. Confirm your VPN or network separation is active before visiting subject-controlled sites.
5. Check each platform's current visibility features: profile viewers, story views, read receipts.
6. Disable link previews in any tool where you will share subject URLs, or share them as plain text.
7. Research on a desktop rather than a phone app.
8. Capture volatile evidence early, with URLs and timestamps.
9. Review account activity logs at the end of the session and record any accidental interaction.
10. Strip and inspect metadata from every file before it leaves your research environment.