OSINT for law enforcement: The complete guide

Law enforcement open source intelligence (OSINT) is the disciplined collection and analysis of publicly available information (PAI) for use in criminal investigations. Use cases include missing persons investigations, criminal investigations, suspect identification, gang investigations, trafficking investigations and threat assessments. The need is great: law enforcement added 533,936 missing person records to NCIC in 2024. Open-source information often provides the first solid lead in these investigations. Done according to agency policy, OSINT turns unstructured public data into structured, documented intelligence.

This guide defines OSINT as it applies to law enforcement and examines the use cases it supports. It then addresses the legal framework that keeps this work defensible. Later sections describe how agencies build an OSINT capability and train their personnel. The guide concludes by explaining how ShadowDragon®’s tools integrate into an investigative workflow.

Agencies approach OSINT with the same rigor they apply to evidence handling. Its value depends on sound methodology backed by thorough documentation. Strict adherence to policy is equally essential, and no individual investigative technique can substitute for that discipline.

For law enforcement, OSINT refers to intelligence derived from publicly available sources that investigators can lawfully access. OSINT may be conducted by investigators directly or by dedicated intelligence analysts supporting a case. Common sources include social media platforms and public records. Investigators also draw on news coverage and online forums, along with imagery and other open web data. SANS defines the discipline as intelligence produced from public information to answer a specific question.

OSINT is distinct from records obtained through the legal process, such as subpoenaed account contents. The intelligence community has practiced this discipline for decades, and agencies now apply it daily to leads that originate online.

The underlying principle is straightforward. Investigators collect information that is already public and then verify its accuracy. They connect related findings and document them to a standard that will withstand review. OSINT confers no special access. Its value lies in organizing information available to any member of the public and applying analytic rigor to that material.

Effective OSINT is repeatable. Another investigator following the same steps should arrive at the same source and be able to trace how each conclusion was reached.

Law enforcement OSINT follows a structured intelligence cycle rather than relying on isolated searches. Most agencies organize the work into five phases. The cycle opens with planning and direction, which leads into collection and processing. Analysis and dissemination complete it. The intelligence community has relied on this framework for decades, and the United Nations Office on Drugs and Crime analyst manual describes it in detail. Applied consistently, the cycle transforms raw public data into findings that can withstand judicial scrutiny.

Planning establishes the case question and its legal basis before any collection begins. Collection then gathers public material relevant to that authorized question, drawing on sources such as social media and public records as well as online forums and imagery. During processing, investigators organize and preserve the material. They record the source URL and timestamp for each item, and they hash collected files to protect their integrity.

Analysis is where the work produces its value. Investigators verify each item and resolve identities across accounts and aliases. Investigators use link analysis to visualize relationships between a subject and their associates or connected locations. Mapping these connections can reveal patterns that are difficult to recognize in individual records. Dissemination delivers the results in a documented form that supervisors and courts can review. Executing the cycle the same way in every case is what makes each conclusion repeatable and defensible.

A structured process also helps investigators recognize when a lead is not producing useful results. By identifying dead ends early and refining their approach, investigators can redirect their efforts toward more promising leads while documenting what they tested and why they changed direction.

Law enforcement OSINT use cases tend to cluster around five recurring needs. The first two involve people: locating persons of interest and resolving missing-persons cases. Agencies also rely on OSINT to monitor crime and emerging threats and to support digital evidence. The fifth need is building public-safety awareness around planned events.

Nearly every use case depends on identity resolution and network mapping across a wide range of sources. Horizon® Identity, for example, aggregates more than 600 data sources to link a single subject across multiple accounts and aliases. It also maps the networks surrounding that subject.

The breakdown below is illustrative, but it reflects how investigative teams typically allocate their open-source workload.

Locating persons of interest

OSINT helps investigators locate persons of interest by resolving identities across multiple online identifiers. Usernames and email addresses are frequent starting points. Phone numbers and public profiles provide additional connections. A single alias reused across platforms can link an anonymous account to a real name. From there, investigators pivot from one confirmed data point to the next, using public traces to identify a subject’s associates and the locations tied to them. Over time, the same material often reveals the subject’s patterns of activity.

Missing persons

Missing-persons investigations are among the most valuable applications of law enforcement OSINT, because early public signals can narrow the search window. Investigators begin by reviewing the person’s most recent public posts and check-ins. They also examine recent contacts before coordinating with families and the relevant platforms. Open-source leads complement formal legal process and field canvassing, but they never replace either.

Crime and threat monitoring

Crime and threat monitoring uses open sources to detect emerging risks, ranging from coordinated retail theft to threats against schools or public officials. Investigators review public posts and online marketplaces for indicators connected to an active case. Public forums are another important source of these signals.

Social media monitoring tools for law enforcement can help investigators track relevant public content across platforms and receive alerts when new information matches case-specific criteria. The objective is early detection followed by lawful referral. Every alert should be documented and reviewed before any action is taken.

Digital evidence and case support

OSINT supports digital evidence work in two ways. It preserves public material in a defensible manner, and it gives detectives useful context before interviews or warrant applications. A public post or image can corroborate a timeline, while a profile may help identify a witness.

To ensure the material withstands scrutiny, investigators record the source URL and timestamp for each item. They also hash every collected file to verify its integrity.

Event and public-safety monitoring

Event and public-safety monitoring applies OSINT to protests and other large gatherings. The same approach supports critical incidents, where timely situational awareness can save lives. Command staff rely on publicly reported information to track crowd movement and road closures. As events unfold, this information also helps them identify emerging hazards. Collection remains focused on public safety and stays within the limits of agency policy.

Legal and privacy requirements govern every stage of law enforcement OSINT, and agency policy translates those requirements into daily practice. Together, they distinguish defensible intelligence from institutional liability. Agencies should ground all open-source work in written policy, and many build on the IACP Law Enforcement Policy Center guidance on social media. Four areas warrant particular attention.

Minimization

Minimization means collecting only the information an authorized investigation requires. Under 28 CFR Part 23, a criminal intelligence project may retain information about an individual only when there is reasonable suspicion of criminal activity and the information is relevant to that activity. Investigators should tie all data collection to a specific case and avoid gathering data on uninvolved individuals. Any irrelevant material should be purged. The fact that information is publicly available does not, on its own, justify open-ended monitoring of any person.

Federal guidance takes the same approach. The FBI’s internal rules for online investigations, published in a 2025 federal oversight report, require that all online investigative activity be “focused in scope, time, and manner to achieve the underlying purpose.”

Documentation

Documentation is the foundation of admissibility. For each item collected, investigators should record the source URL along with the date and time of capture. The record should also identify who collected the material and the associated case number. Finally, it should describe the collection method used. Contemporaneous notes allow a supervisor or a court to reconstruct precisely how each finding was reached.

Court admissibility

Admissibility in court depends on proper authentication and an unbroken chain of custody. Investigators should capture original material and preserve its metadata whenever possible. Hashing each file allows its integrity to be demonstrated later. Under the Federal Rules of Evidence, the person who collected or verified the material may be required to testify about how it was obtained and authenticated.

Agency policy and oversight

Agency policy should specify who is authorized to conduct OSINT and which accounts and personas they may use. It should also establish how results are reviewed. Supervisory approval and audit logs keep the program accountable. Periodic training reinforces that accountability over time. Clear policy protects both the public and the investigators who serve it.

Federal guidance for state and local agencies makes the same point:

“Strong policies must not only be in place but also be effectively implemented.”

Bureau of Justice Assistance, Real-Time and Open Source Analysis (ROSA) Resource Guide, July 2017

Putting policy into practice depends on the people, processes and tools an agency builds around it.

An effective OSINT capability pairs trained personnel with a written process. Purpose-built tooling and clear governance complete the foundation. Agencies should start small by designating one or two trained analysts or personnel trained in OSINT and adopting a documented workflow. Selecting a primary platform should come before the program expands. Many teams begin with free OSINT tools to develop their tradecraft and then transition to an integrated platform as caseloads grow.

To scale investigations that use OSINT, agencies should define where open-source research fits into the wider investigative workflow. Establishing when to collect public information and how findings inform subsequent steps helps teams apply OSINT consistently across both urgent cases and longer investigations.

A mature capability rests on four pillars. The first is people, who bring tradecraft and sound judgment to the work. The second is the process, which establishes standards for collecting and verifying information. Those standards should extend to documentation as well. The third pillar is tooling, which performs identity resolution and link analysis at scale. Effective tooling also supports ongoing monitoring. The fourth is governance, which sets policy and defines approval requirements. Governance also provides the framework for regular audits.

Operational security should be the baseline and built into the program from the outset. Investigators need managed research accounts and attribution controls so that collection activity cannot be traced back to the investigator or the agency. These safeguards also prevent collection from compromising the case itself. Tooling and process should reinforce this separation rather than undermine it.

OSINT training for law enforcement should develop repeatable methodology rather than familiarity with a list of websites. Tools change constantly, but sound methodology endures. Strong programs address five core areas. Investigative methodology forms the foundation, supported by instruction in operational security and attribution management. Programs should also build proficiency with specific tools. The remaining areas cover legal and ethical use, along with documentation practices that will hold up in court. Agencies should prioritize programs that offer hands-on labs built around realistic case scenarios.

Methodology instruction teaches the full cycle from collection through analysis. Students learn to plan an investigation and collect information lawfully. They then practice verifying findings and pivoting between data points before producing a final report. Operational security training covers managed research accounts and attribution management, including techniques for conducting research without revealing an investigator’s identity or intent. Legal and ethical modules connect investigative technique to agency policy, with attention to warrant thresholds and minimization requirements.

Agencies have several established training options. Agencies can compare OSINT training courses based on investigator experience, course content and delivery format. The SANS Practical Open-Source Intelligence course (SEC497) is widely used. The National White Collar Crime Center (NW3C) also delivers cyber and intelligence-analysis courses to agencies. Vendor-neutral certifications from organizations such as the OSMOSIS Association and the McAfee Institute are common as well. Agencies should select training that leads to a defensible certification and that updates its content as platforms evolve. Ongoing practice ultimately matters more than any single course.

ShadowDragon® provides law enforcement with investigation tools designed for lawful open-source work. These tools support documented workflows and strong operational security. The platform unifies identity resolution and link analysis in a single environment. Monitoring capabilities are integrated alongside them, so analysts spend less time moving between tools and more time verifying leads. ShadowDragon® designed these products for investigators in law enforcement and government. Corporate security teams use them as well.

The Horizon® platform is a browser-based environment for link analysis and investigation that allows investigators to pivot across entities and visualize networks. Horizon® Identity performs identity resolution and network mapping across more than 600 data sources, linking a subject across multiple accounts and aliases. It also enables investigators to triage a subject’s public presence quickly. Horizon Monitor® provides ongoing monitoring and alerting on open internet data to support active cases and public-safety operations.

Two considerations are especially relevant for agencies focused on policy compliance. First, ShadowDragon® tools work exclusively with publicly available information that can be lawfully accessed. Second, ShadowDragon® does not retain data once it has been deleted or made private, which ensures that results reflect only what is currently public.

OSINT delivers the greatest value to agencies that pair rigorous methodology with sound policy. Agencies prepared to equip their investigators with lawful, documented open-source workflows can request a demo of the Horizon® platform to learn how ShadowDragon® supports law enforcement from the first lead through a court-ready record.