Introduction to anonymity and privacy in OSINT

OSINT research involves the data mining of openly available resources. However, OSINT analysts must take precautions to preserve their privacy and anonymity for many important reasons, including the following:

• Avoid tipping off subjects: If individuals or organizations become aware they are being investigated through OSINT, they may act to prevent data collection. They could delete social media posts, restrict profile visibility, take websites offline, or even destroy evidence. Maintaining anonymity is crucial to avoiding alerting subjects to monitoring.
• Prevent compromising operations: Similarly, if targets realize they are being watched, they may change their activities or communications to avoid further detection. This could severely disrupt ongoing OSINT operations before investigators have gathered enough actionable intelligence. Anonymity helps avoid operations being exposed.
• Stop illicit activities from continuing: If investigations are compromised early on, law enforcement and other agencies may be unable to identify criminal conspiracies or gather the evidence needed to prosecute illegal activities. Subjects could continue operations under the radar. Anonymity is key to thoroughly monitoring subjects without detection.
• Avoid legal and ethical issues: In some states/countries, tipping off subjects about an investigation can lead to criminal charges. Anonymity helps avoid inadvertent ethical and legal violations.
• Protect analysts and sources: Threat actors such as hackers, terrorists, and criminal networks could retaliate against analysts and sources who they discover are investigating them. Anonymity and privacy safeguards help keep us analysts and our sources safe.
• Prevent data breaches: Sensitive information must be protected from falling into the wrong hands, and this can only be done with rigorous data handling and access controls. In order to avoid catastrophic data leaks, secure privacy practices must be in place.

Ways anonymity can be breached in OSINT

So, how can you be detected during an investigation? Well, let’s take a look at several methods:

• IP address exposure: One of the easiest ways you can hide yourself is via your IP address. If you’re not using a VPN or Tor, your real IP address will be logged by the websites you visit.

  As a cybersecurity researcher, I once faced a daunting challenge. I needed to uncover information about cyberattacks that seemed to originate from a specific area. To do this without alerting the attackers, I turned to a Virtual Private Network (VPN). I connected to a server in a different country, which hid my real IP address and location. It appeared as if I was browsing from that server’s location, not my own. This allowed me to safely explore various websites and forums, gathering the information I needed without exposing my identity. This experience taught me the power of a VPN in protecting one’s digital presence, especially when researching sensitive topics.

• Browser fingerprinting: Web browsers collect a surprising amount of data, from screen resolution to installed plugins, which can be used to create a unique fingerprint. Don’t believe me? Take a break and head over to privacy.net/analyzer. See, I told you!

Figure 2.1 – My results on privacy.net/analyzer

Oh, and if you think incognito mode will protect you, nope. Browser fingerprinting can still track your activities across different sessions.

• Overconfidence in technology: Relying solely on tools such as VPNs and Tor without fully understanding their limitations can create a false sense of security. For example, some VPN services actually log user activity, IPs, timestamps, etc., despite marketing claims of being no-logs services. Tor traffic can be de-anonymized in some cases by powerful adversaries such as government agencies. No single technology is a silver bullet when it comes to anonymity. You need to layer different protections and be cognizant of the weak points in each tool or approach.
• Cookie tracking: Cookies are small text files that websites place on your device to track and remember your online activity. While cookies can be convenient for things such as remembering login info or shopping cart contents, they also allow companies to build detailed profiles about your browsing habits, interests, behaviors, and much more across multiple sites and sessions. Regularly clearing your cookies can help limit tracking, but companies have developed more advanced techniques such as browser fingerprinting and canvas fingerprinting that don’t rely on cookies to track you. Using privacy-focused browsers such as Tor and covering your online tracks by avoiding behavior patterns are important ways to avoid surveillance.

Figure 2.2 – Cookies are stored in different locations, but can expose quite a bit of intel

• Metadata leaks: Files such as documents, photos, audio, and video recordings all contain metadata—information generated by your device about the file itself. This can include geotags, time stamps, device serial numbers, editing history, and more. Similarly, communications such as emails have headers that reveal your IP address, client info, etc. If this metadata leaks, it can reveal details about your identity and compromise your anonymity. You need to be very careful about stripping metadata from files before publishing them, using metadata removal tools. Avoiding communication methods that expose metadata is also important.

Figure 2.3 – Example of metadata included on a file

• Insecure public Wi-Fi: Public Wi-Fi networks at coffee shops, airports, hotels, etc. often have no password or security measures at all. This allows anyone nearby to easily intercept the unencrypted traffic passing through the network and eavesdrop on your Internet activity. Never access any sensitive accounts such as emails, banking apps, or confidential data while on insecure public Wi-Fi. Always use a trusted VPN on public networks to encrypt your traffic. Better yet, avoid transmitting sensitive data until you are on a known secure network again.
• Social engineering: Despite advancing technical protections, human nature remains vulnerable to old-fashioned social engineering attacks such as phishing. Avoiding password reuse across accounts, enabling multi-factor authentication wherever possible, establishing PGP-encrypted contacts, and training yourself to cautiously identify potential scams before clicking links or attachments is critical. No anonymity toolkit can protect against you being tricked into giving up personal information.
• Personal accounts for OSINT: One of the worst OPSEC mistakes you can make is to conduct OSINT investigations and cybersecurity research from accounts that can be traced back to your real identity. Always use anonymous, disposable accounts and masked IP addresses when gathering intelligence via search engines, social networks, forums, and other online venues. Maintain strict separation between your personal online presence and investigative online presence.
• Accidental slip-ups: A single accidental leak of personal information in a chat room, forum post, or conversation app can be enough to shatter your anonymity. Be extremely cautious when sharing any details about yourself online that could help identify you. Also, be consistent about separating your anonymous personas—reusing usernames, email patterns, passwords, etc. across accounts makes it easier to correlate your activity. A momentary lapse of vigilance is all it takes.
• Outdated knowledge: New hacking techniques, exploits, and vulnerabilities are emerging all the time. If you don’t continuously educate yourself about the latest privacy and security threats, your information could be snatched by new methods you’re unaware of and haven’t protected yourself against yet. You can never assume your current knowledge is sufficient—learning needs to be an ongoing process to keep up with an evolving threat landscape. Relying too much on technology such as VPNs or Tor without understanding their limitations can give you a false sense of security. For instance, some VPN services log user activity, and Tor is not immune to all forms of tracking.

Striking the balance – Privacy concerns in OSINT investigations

Look, tech has always been a game-changer, “Duh, Dale”! While it’s awesome for nabbing criminals, villains, and arch-enemies, it can also slice right through our personal privacy if we’re not careful.

We need a system where there’s oversight, checks, balances, and—most importantly—accountability. We can’t just let these powerful tools run wild without some ground rules. And hey, these rules need to be transparent so that you and I can have a say if something doesn’t smell right.

Technology itself doesn’t have a moral compass; it’s just a tool. We’ve got to be smart, ethical, and, above all, vigilant. In the end, it’s all about the long game. If we sacrifice our principles for some short-term security wins, we’re setting ourselves up for some serious long-term losses. We’ve got to keep our eyes on the prize: a society that’s both safe and free. And that, my friends, is a balancing act worth perfecting. OK, I think you get my point, I’ll get off my soapbox.