A question raised during yesterday's impeachment proceedings illustrates a common misunderstanding about open source intelligence (OSINT). During the cross-examination of NBI Director Melvin Matibag, defense counsel asked whether the Bureau's use of OSINT amounted to a Google search.
The exchange highlights an important distinction between using a search tool and conducting an OSINT investigation.
In teaching OSINT and Digital Forensics at the National Cyber Training Institute, I often begin with a simple observation. Google is one of many tools that may be used in an OSINT investigation. The credibility of an OSINT investigation depends on the methodology used, not on any particular tool.
OSINT is a discipline that involves the systematic collection, processing, analysis, and reporting of information derived from publicly available sources to support decision-making or answer specific investigative or intelligence requirements.
A professional OSINT investigation may rely on government records, court documents, corporate filings, archived websites, geospatial data, satellite imagery, social media, public registries, technical metadata, and other lawfully accessible sources. The objective is to produce findings that are traceable, verifiable, and reproducible.
Methodology determines whether an investigation can withstand scrutiny. Investigators identify relevant sources, assess their reliability, corroborate information across independent sources, document how information was obtained, and ensure that their findings can be independently examined and reproduced.
Two investigators using different tools can arrive at the same conclusion if they follow the same sound methodology. Conversely, two investigators using the same tool can reach different conclusions if their methodology differs.
The same principle applies in digital forensics. Courts, oversight bodies, and peer reviewers place greater weight on investigative methodology than on the particular software used. Different investigators may use different tools and still arrive at the same conclusion when they follow sound, transparent, and well-documented methods.
Tools change. Methodology endures.
Whether the discussion takes place in a classroom, a laboratory, or a courtroom, understanding this distinction benefits everyone. Public confidence in digital investigations depends on methods that are transparent, documented, and capable of independent verification.
Technology will continue to evolve. Search engines will change. New platforms will emerge. Sound investigative methodology will remain the foundation of credible investigations. That is the lesson worth taking beyond the courtroom.
