CIAC CIAC Open Source Intelligence (OSINT) Methods 1 — Questions and Answers
Question 1: Open Source Intelligence (OSINT) in law enforcement is defined as intelligence derived from:
- Confidential informants with public-facing roles
- Publicly available information collected, processed, and analyzed to answer intelligence requirements (Correct answer)
- Declassified government documents only
- Any information obtained without a court order
Correct answer: Publicly available information collected, processed, and analyzed to answer intelligence requirements
OSINT is intelligence produced from publicly available sources such as news, social media, public records, and web content that can be legally accessed without covert means.
Question 2: Which of the following is NOT typically considered an OSINT source?
- Social media posts
- News articles
- Encrypted private messages obtained via wiretap (Correct answer)
- Public court records
Correct answer: Encrypted private messages obtained via wiretap
Encrypted private messages obtained via wiretap require legal authority and covert access, making them a signals intelligence (SIGINT) source, not OSINT.
Question 3: What is 'dorking' in the context of OSINT investigations?
- Monitoring dark web forums for criminal activity
- Using advanced search engine operators to find specific, publicly accessible information that is not easily surfaced by standard queries (Correct answer)
- Creating fake social media profiles to infiltrate criminal networks
- Analyzing metadata embedded in digital documents
Correct answer: Using advanced search engine operators to find specific, publicly accessible information that is not easily surfaced by standard queries
Dorking uses operators such as 'site:', 'filetype:', and 'inurl:' to precisely target search engine results and surface specific information that standard searches miss.
Question 4: In social media OSINT investigations, 'metadata' embedded in photographs can reveal:
- The emotional state of the person who posted the image
- GPS coordinates, device information, and timestamp data that can help establish location and identity (Correct answer)
- The number of people who viewed the photograph
- The social media platform's server IP address
Correct answer: GPS coordinates, device information, and timestamp data that can help establish location and identity
EXIF metadata in photos can include GPS location, camera model, date/time, and other data that are highly valuable for placing suspects at specific locations.
Question 5: Sock puppet accounts in OSINT operations are used to:
- Monitor a suspect's accounts without revealing the analyst's identity (Correct answer)
- Create a secondary storage location for seized digital evidence
- Automate the collection of public social media data
- Archive OSINT findings in a legally admissible format
Correct answer: Monitor a suspect's accounts without revealing the analyst's identity
Sock puppet accounts are pseudonymous online identities used by analysts to observe criminal activity or gather open-source information without revealing their official identity.
Question 6: The 'OSINT Framework' is primarily used by law enforcement analysts to:
- Submit OSINT findings as classified intelligence reports
- Navigate and organize available open-source tools and resources by investigation category (Correct answer)
- Train new recruits in basic surveillance techniques
- Manage chain-of-custody documentation for digital evidence
Correct answer: Navigate and organize available open-source tools and resources by investigation category
The OSINT Framework is a publicly available directory that organizes hundreds of open-source investigation tools by topic, making it easier to find the right resource for a specific task.
CIAC CIAC Open Source Intelligence (OSINT) Methods 1
Open Source Intelligence (OSINT) in law enforcement is defined as intelligence derived from: