A witness says one thing in a deposition and something very different online. An opposing party claims they have no business interests, but a public filing suggests otherwise. A judgment debtor seems to have vanished. In each case, some of the answers may already be sitting in public view.
That is the idea behind open-source intelligence, or OSINT: finding, verifying and documenting information that is publicly available. Used well, it can shape strategy early in a case. Used carelessly, it can produce screenshots that are easy to challenge. Here is what OSINT can do in litigation, how it should be captured, and where it stops.
What OSINT is, and what it is not
OSINT is research into sources anyone could lawfully access: public social media posts, news coverage, websites, public records, business filings, court dockets, online forums and similar sources. The skill is not in typing a name into a search engine. It is in knowing where to look, connecting accounts and identities, checking what is real, and preserving it properly.
OSINT is not logging into someone's private accounts, getting around privacy settings, or accessing anything without authorization. If information is behind a login that belongs to someone else, it is generally a matter for discovery, a subpoena or a court order, not open-source research. OSINT is one part of our broader online, OSINT and dark web investigations work.
What open-source research can find
Depending on the person, the company and the question, an OSINT investigation may help with:
- Background and due diligence on parties, witnesses, experts and potential business partners.
- Social media activity that contradicts a claim, such as posts about travel, work or physical activity.
- Business connections, including companies, roles and relationships that appear in public filings and online.
- Locating people such as witnesses or parties who need to be served.
- Online identities behind usernames, profiles or websites, where public information connects them.
- Timelines of what was posted, changed or removed, and when.
- Mentions on the dark web, such as leaked credentials or discussion of a company or person, through our dark web investigations.
None of these results are guaranteed. Some people leave a large public footprint; others leave almost none.
How findings are captured so they hold up
Online content changes. Posts get edited, accounts go private, and pages disappear. A screenshot taken on a phone may show what someone saw, but it often lacks the details needed to show where it came from and when.
In our work, capturing a finding typically means:
- Scope — agree with counsel on the questions, the subjects and the limits.
- Search — research across public sources, keeping notes on where each lead came from.
- Verify — confirm that an account or record actually belongs to the subject, rather than someone with a similar name.
- Capture — record the page, its address, the date and time, and the method used, so the item can be authenticated later.
- Report — deliver a written report with sources, a timeline and the captured material as exhibits.
Whether a particular item is admissible is a question for counsel and the court. Our job is to collect and document it in a way that gives counsel the best footing. When findings need to be explained, that work connects to our litigation support and expert testimony services.
Where open-source research stops
It is worth being clear about the limits:
- It cannot see private messages, deleted content that was never captured, or anything behind someone else's login.
- An online profile is not proof of identity on its own. Attribution has to be supported, and sometimes it cannot be established.
- Public records can be outdated or wrong, so findings need to be checked against other sources.
- Absence of information is not proof that something does not exist.
When the answer lives on a device or in an account, digital forensics is usually the right tool, and the device should be preserved first. Our article on preserving digital evidence before you reset a device explains why.
How this looks in practice
In one matter, in-house counsel found a hidden device used to secretly record an employee. While our examiners worked on the device, our investigators carried out open-source background research on the person responsible, and counsel received one written report. Identifying details were changed for confidentiality; see the covert recording device case study.
The same skills also apply outside litigation. For a high-profile business leader, our analysts review social media, news, forums and dark web sources every day and report only verified findings. See the online threat monitoring case study and our executive online threat monitoring service.
Frequently asked questions
When should we bring in OSINT? Often early, before depositions or settlement talks, while online content is still up. Information found later may already be gone.
Can't a paralegal just search social media? Simple searches can be a start. The difference is verification and capture: confirming who an account belongs to and documenting it so it can be authenticated.
Will the subject know we are looking? Open-source research is designed to be passive, meaning we review publicly available information rather than contacting or interacting with the subject.
Is OSINT useful for harassment cases? Yes, it is often part of identifying who is behind anonymous accounts. See our cyber harassment investigations.
Talk to an investigator
If a case turns on what someone has said or done online, or you need to know more about a party before you act, call us for a confidential conversation about what open-source research can realistically find.
- New York: 631-982-4632
- Boca Raton, FL: 561-391-6057
- Hours: Monday–Friday, 9 AM–5 PM ET
- Request a confidential consultation
Executive Digital Group is a women-owned business founded by Tiffany Graziano and her husband, Michael Graziano. We provide digital forensics, OSINT, investigations, cybersecurity and managed IT, with remote support anywhere in the U.S. and worldwide.
Originally published on the Executive Digital Group website on October 29, 2026.