OSINT in the Age of AI: Tradecraft at a Turning Point

While Gemini, Claude, ChatGPT, and Perplexity are becoming household names, the OSINT (open-source intelligence) community is still struggling to find its uniform stance. On the surface, there is a unanimous agreement: the sector should embrace technological advancement. Ask anyone, from a new joiner to a head of practice. However, in reality there is often little understanding as to what aspects of technological advancement are being invoked, or what concrete implications those entail for either the workflow or ethical standards. 

 

Definitional conundrum and skills gap

 

‘AI’ being the safe buzzword of the day, OSINT analysts often use it interchangeably with ‘technology’, ‘LLMs’, and even any sort of ‘automation’, ‘scraping’, or ‘data aggregation tools’. In part, this situation springs from the fact that many commercial OSINT firms are heavily dominated by former security officers, as well as social science and humanities graduates. The latter got hired out of the school when the industry boomed in the last decade. Naturally, this left a gap in the fundamental training in computer science and machine learning, often making institutional knowledge insufficient to keep abreast of technological developments. Undoubtedly, the OSINT industry is vast. There are some forerunners employing software engineers en masse. Yet, even these organisations still rely heavily on humans in the loop who demonstrate limited understanding of the magic behind AI. The vast majority of companies, though, still vigorously advocate laborious manual input and hiring 'linguists' due to ‘AI hallucination’ and ‘unreliability’. Colleagues agree, but opportunities are missed. 

 

Lagging workflow implementation 

 

LLMs’ effectiveness for quick background summation being undeniable, some companies hastily put guidelines in place to regulate AI usage by analysts. However, those often remain vague, and the extent to which they are used rests on an individual analyst’s risk appetite. Is using an LLM for your background research an act of cheating? It almost feels as such. Advanced OSINT skills require high analytical and verbal capacity under high pressure and tight deadlines that take years of practice to develop. Now software can produce comparable results in a fraction of the time and … with respectable competence. Unsurprisingly, industry pundits can become somewhat territorial: there is pride in the ability to see what most brains overlook. Undoubtedly, OSINT work stretches far beyond background research and automated queries. Most realms require the level of contextualisation, hypothesis testing, bias mitigation, and the kind of pattern recognition, aka ‘nudge’, that a publicly available general-purpose LLM is likely to miss. For now. What could the next few years bring?

 

Increasing ethical challenges 

 

Fundamental ethical questions lie ahead of the OSINT community. These, however, are less discussed within the industry and are frequently overshadowed by concerns around client confidentiality and work sensitivity. Once again, the industry is vast, and, undeniably, encompasses companies and organisations with different types of work, level of publicity, and commitment to public good. Nonetheless, ethical concerns stemming from the vast availability of data, such as those associated with mass surveillance and data leaks pertain to all. With AI technology readily available, social engineering attacks risk becoming more sophisticated and easy to orchestrate if data ends in the hands of malicious actors, be it armed groups or insider threat actors. The same applies to deepfakes. At present, companies seem to navigate the ethical landscape mainly through varying combinations of custom and an unstandardised, subjective sense of ethics. But can we always know who ‘the bad guy is’ with most certainty? Or how third-party providers obtain their data?

 

Looking ahead 

 

OSINT analysts are unlikely to be eliminated in the immediate future, neither by AI agents nor by computer scientists. However, organisations that successfully integrate the latest technological solutions into their workflow are bound to get ahead of those who are tech-averse. Strategically allocating resources to upskill in-house subject matter experts in machine learning to work out relevant in-house solutions to reduce time spent on data collection and embed verification tools could be one such approach. The question of ethical standards across the industry is much more entangled given the wide array of heterogeneous organisations and lack of a centralised authority governing either the OSINT or AI standards. This situation calls for a voluntary global dialogue on the industry’s best practices, similar to those existing in other hard-to-regulate lines of work. With little external impetus, the push needs to come from the analysts sharing a responsible and informed approach to anticipate and mitigate emerging risks. In any case, grappling with AI literacy, workflow redesign, and professional ethical standards is a pressing task for the OSINT industry in the next few years.