What Is OSINT? A Practitioner's Answer for Builders, Not Enthusiasts

OSINT is open-source intelligence: making decisions from publicly available information. The "intelligence" part is the discipline, not the data. Anyone can Google. OSINT is what you do with the pile afterwards.

The three-layer stack (skip layer 3 and you're just browsing)

1. Collection. Public channels, forums, pastes, registries, certificate logs, code hosts, social previews. The constraint is coverage: you see a window of public data, not all of it, and you never know the denominator.
2. Processing. Dedupe, entity resolution (this handle = this person = this org), timestamps, provenance. This layer is plumbing; it decides everything downstream.
3. Analysis. Change detection, baselines, corroboration. Two independent sources saying X is intelligence. One source saying X loudly is marketing.

The five questions that separate a practitioner from a Googler

• Where did this come from? (provenance, not permalink)
• When was it published AND when was it last edited?
• What's the population I sampled from? (20 posts from a channel preview is a window, not a census)
• What would change my mind? (if nothing, you're not doing analysis, you're doing confirmation)
• Who benefits from me believing this? (applies to the data source AND to the analyst who sold it to you)

Is it legal? Generally, publicly available data collection is on safe ground in most jurisdictions, with edges: platform ToS (contract, not criminal law), scraping limits, copyright on content, privacy regulation on personal data (GDPR's legitimate-interest balancing). Build a five-gate checklist — publication status, terms of service, copyright, personal-data scope, downstream use — and run every collection through it once, on paper, before you build. (Full boundary map in my earlier post: https://dev.to/yuhehe/is-osint-legal-the-boundary-of-publicly-available-data-builders-map-3m5n.)

Where the money is

Not in "finding data" — that's increasingly free. In shrinking time-to-decision: monitoring that runs unattended, alerts on the sentence that changed (not the document that arrived), and a report a non-specialist can act on in five minutes. That's what buyers pay for.

I sell the collection-layer playbook — the polling cadence, cursor pagination, repost-ring flags, wording-diff alerting, raw-storage discipline — as a $5 bundle: https://heyuhe.gumroad.com/l/poddr. A real sample brief is free, pay-what-you-want, $0 fine: https://heyuhe.gumroad.com/l/ruldgm.

If this explained the thing that finally made OSINT click for you, the bundle is where the depth lives.