top of page

People are fecking idiots (sometimes): An OSINT perspective

Oct 6
5 min read

Finding information is easy. Understanding what it actually proves is considerably harder. The difference between collection and analysis is where good OSINT tradecraft begins.



Now before anyone queries it, I'm Irish, so feck isn't really a swear word. It's practically punctuation where I come from.


And given some of the conclusions I've reached over the years, I'm not entirely exempt from the title myself.


I've worked in intelligence for more than 25 years, and one thing that continues to surprise me is how readily people mistake finding information for understanding it.


And nowhere is that more apparent than in parts of the OSINT community.


Someone finds a photograph. A username. A company registration. A flight record. A social media connection.


Within minutes, there's a conclusion. Sometimes a very confident one.


And that's where I start to get uncomfortable.


Because finding something isn't the same as understanding what it means.


What does the evidence actually tell us?


Take the photograph accompanying this article.


Two Allied generals shaking hands. One clearly smiling, the other in profile. A lovely picture of friendship, mutual admiration and military cooperation, surely?


Except the historical context is rather more complicated.


The photograph is held by the US National Archives (NAID 315833768). The archive's record describes General Bernard Montgomery being bid a "jolly farewell" by Lt. Gen. George S. Patton at the airport in Palermo, Sicily, after a visit. The date given is 28 July 1943. Military Times reproduces the same image, captioned as Patton greeting Montgomery.


Greeting or farewell? The handshake doesn't say.


Which rather proves the point.


Patton and Montgomery are remembered as bitter rivals, a relationship reinforced by popular histories and film. The reality appears to have been more complicated. Historian Carlo D'Este argued that the supposed feud has been exaggerated, particularly on Montgomery's side, and that the two commanders shared a degree of professional respect. Their approaches to warfare, personalities and ambitions were nevertheless markedly different.


But does this photograph establish friendship? Mutual admiration? Agreement over how the war should be conducted?


Not remotely.


It establishes that, at that moment, two men shook hands.


Everything beyond that requires additional evidence and context.


And that's the point.


An image can be authentic and still support a misleading narrative. You don't need Photoshop, AI-generated imagery or a fabricated source to get something wrong.


Sometimes all you need is a perfectly genuine photograph and an analyst who hasn't asked enough questions.


Collection isn't analysis


The same applies to almost everything else we encounter in OSINT.


A connection between two people doesn't establish a relationship of significance. A company appearing in a corporate structure doesn't automatically imply wrongdoing. And just because three different websites repeat the same claim doesn't mean you've corroborated it three times.


That's circular reporting, and it's one of the oldest traps in the trade.


The tools have become extraordinarily accessible. That's a good thing. Almost anyone can now collect information and produce something that resembles an intelligence product.


Some are exceptionally good at it. Others have yet to appreciate the distinction between collecting evidence and assessing it.


And increasingly, AI can turn that collection into something that looks remarkably like a finished intelligence product.


A polished report. A confident assessment. Perhaps even a few citations.


But AI can produce a coherent explanation of evidence that was never properly verified in the first place. It can make a weak assessment look remarkably convincing without making it any more reliable.


Presentation isn't analysis.


The bit where you're supposed to stop and think

The problem isn't the tools. It's what happens between collecting the information and reaching a conclusion.


The bit where you're supposed to stop and think.


Question your assumptions. Consider alternative hypotheses. Assess the reliability and independence of your sources. Separate what you know from what you're inferring, and identify what remains unknown.


And, perhaps most importantly, ask yourself what evidence would challenge your preferred explanation.


And whether you've made a genuine effort to find it.


That last one is particularly uncomfortable. Especially when you've already invested several hours in an investigation and become rather attached to your conclusion.


I've been there. Anyone who has worked in intelligence long enough has.


But that's the discipline.


Intelligence analysis isn't about being the first person to announce something. It's about being able to explain why you believe it, what evidence supports it, what might contradict it, and how confident you should reasonably be.


Sometimes the most professionally defensible conclusion is simply:


We don't know.

That's not a failure of analysis. It's often evidence that someone has actually done some.


Getting it wrong has consequences


There's another consideration that I think gets overlooked.


Our conclusions can have consequences.


When we publish an assessment about an individual, an organisation or an event, somebody else may act upon it. Reputations can be damaged. Decisions can be influenced. Innocent people can find themselves associated with things they had absolutely nothing to do with.


We've seen what happens when this goes wrong.


After the 2013 Boston Marathon bombing, online communities attempted to identify suspects from publicly available photographs and perceived resemblances. Among those wrongly identified was missing Brown University student Sunil Tripathi, who had nothing to do with the attack. The speculation spread rapidly through Reddit and social media before the identification was shown to be false.


The photographs were real.


The confidence wasn't earned.


That's a significant responsibility, and one that shouldn't be taken lightly simply because the information was publicly available.


The evidence sets the limit


So no, people aren't necessarily idiots.


But access to information has never been a substitute for the ability to think critically about it. And having the tools to conduct an OSINT investigation doesn't automatically mean you possess the judgement to conduct one well.


The danger isn't always that we don't know enough.


Sometimes it's that we think we know more than the evidence allows.


The next time you see an OSINT investigation presented with absolute certainty, don't just ask what they've found.


Ask what alternative explanations they've considered, and why they've discounted them.


And perhaps, occasionally, ask yourself the same question.


Sources and further reading


 
 
 

Comments

bottom of page