OSINT Foundations — Labs & Discussion

Rules for every lab: passive techniques only unless the lab says otherwise; only approved targets (yourself, consenting classmates, instructor-provided or instructor-owned targets, purpose-built practice sites); don’t share findings about real people outside class.

Lab 1: Data → Information → Intelligence

• Objective: Practice turning raw data into intelligence that answers a specific question.
• Time: 25–30 minutes / Difficulty: Beginner
• Setup / what the instructor prepares:
• A set of 12–15 “data cards” (printed or in a shared doc) about a fictional organization, “Company X.” Mix useful and irrelevant data, for example:
  • “MX record for companyx.com points to Microsoft mail servers”
  • “Job posting: ‘experience with Okta and Microsoft 365 required’”
  • “Contact page lists jane.doe@companyx.com“
  • “LinkedIn shows 3 people with ‘Accounts Payable’ at Company X”
  • “Press release: new CFO started last month”
  • “Company X sponsors a local 5K race”
  • “Certificate log shows vpn.companyx.com”
  • “CEO posted that they’ll be keynoting a conference in Denver next week”
  • A few distractors (e.g., “Company X’s logo is blue”)
• One written intelligence requirement: “What is the most likely way an attacker would try to steal money from Company X in the next two weeks, and who would they target?”
• Steps:
  1. In small groups, sort each card into relevant or not relevant to the requirement.
  2. Group relevant cards into information statements (e.g., “Email format is first.last@companyx.com”).
  3. Write a 4–6 sentence intelligence assessment that answers the requirement, includes a confidence level (low/moderate/high), and explains what extra information would raise that confidence.
  4. Add one recommendation for Company X’s defenders.
• Deliverable: The written assessment and the list of cards the group used.
• Debrief questions:
• Which cards did groups disagree about? Why?
• What was the “so what?” in your assessment?
• What information did you wish you had?
• How would your assessment change if the CEO’s trip post turned out to be old?

Lab 2: Case Study Teardown

• Objective: Analyze a real OSINT investigation, identify its techniques, and evaluate its ethics.
• Time: 40–50 minutes (20 research, 20 presentations, 10 discussion) / Difficulty: Beginner–Intermediate
• Setup / what the instructor prepares:
• Assign each group one case from 1.3-why-osint-matters.md: Strava heatmap, Salisbury suspects, January 6 identifications, MH17, or the Discord leaks.
• Provide the reference links for each case (listed in that file).
• Steps:
  1. Read the assigned case and at least one primary source (e.g., the Bellingcat article).
  2. Build a timeline of key events.
  3. List every OSINT technique used (e.g., geolocation, metadata analysis, username pivoting).
  4. Identify where the investigation relied on anything that was not strictly open source.
  5. Identify one ethical concern and one lesson for defenders.
  6. Present a 3–4 minute summary to the class.
• Deliverable: A one-slide or one-page summary: timeline, techniques, ethics concern, defender lesson.
• Debrief questions:
• Which techniques appeared in more than one case?
• Which case was the most ethically complicated? Why?
• Which case could have been prevented with better OPSEC, and how?

Lab 3: Same Technique, Different Intent (Role-Play)

• Objective: Understand that authorization and purpose — not technique — separate ethical and unethical OSINT.
• Time: 20–25 minutes / Difficulty: Beginner
• Setup / what the instructor prepares:
• Assign each group a role: pentester, defender (SOC/threat intel), journalist, fraud investigator, or attacker.
• Give every group the same fictional scenario: “Company X, a regional bank, just announced a merger with Company Y.”
• Steps:
  1. Each group lists what public information they’d want about Company X and why, from their role’s perspective.
  2. Each group (except the attacker group) writes down what authorization or permission they need and what they would not do.
  3. The attacker group lists how they’d use the merger news in a social engineering attack.
  4. Groups share; the class builds a combined table of overlapping techniques.
• Deliverable: A class table showing overlapping techniques and the different intent, authorization, and handling for each role.
• Debrief questions:
• How much overlap was there between the pentester’s list and the attacker’s list?
• What specific things make the attacker’s use wrong?
• How should Company X’s defenders use the attacker group’s list?

Lab 4: OSINT Career Explorer

• Objective: Connect OSINT skills to real job requirements.
• Time: 20–30 minutes (can be homework) / Difficulty: Beginner
• Setup / what the instructor prepares: Nothing special. Students use public job boards. (Reading public job postings is fine; students are researching the roles, not people.)
• Steps:
  1. Find three current job postings for roles from the table in 1.4-osint-careers.md (e.g., threat intelligence analyst, SOC analyst, fraud analyst).
  2. For each, list the OSINT-related skills and tools mentioned.
  3. Mark which skills you already have, which you’re building in this class, and which you’d need to learn.
  4. Pick one training or practice option from 1.4-osint-careers.md that would close a gap.
• Deliverable: A short skills-gap table and a one-sentence personal next step.
• Debrief questions:
• Which skills appeared across all three postings?
• Did any postings mention certifications? Which ones?
• Bonus: what did the job postings reveal about the companies’ technology? (Connects to Module 5 — job postings as an OSINT source.)

Discussion Questions

1. The formal definition of OSINT says it must address “a specific intelligence requirement.” Why does starting with a question matter so much?
2. The 2024 IC OSINT Strategy includes commercially available information. Should data bought from a data broker count as open source? What are the ethical concerns?
3. Bellingcat’s Salisbury investigation used leaked databases and passport data. Was it still an OSINT investigation? Does the public interest justify it?
4. If attackers and defenders use the same techniques, how should a university teach OSINT responsibly?
5. The Strava heatmap exposed military bases through aggregated data. What aggregated data about your school or workplace might be public?
6. After January 6, volunteers helped identify participants. What are the benefits and dangers of crowdsourced investigations?
7. AI tools can speed up OSINT but can also “hallucinate” sources. How should an analyst use AI responsibly?
8. MITRE ATT&CK added “Query Public AI Services” as a reconnaissance technique in 2026. What does that mean for how much information organizations should put online?
9. Which of the case studies would have been prevented by better personal OPSEC? Which could not have been prevented by the individual at all?
10. Which OSINT career path interests you most, and what’s one skill you could start practicing this week?