What Is OSINT, Exactly - A Builder's Definition That Survives a Legal Review

Most "OSINT" articles open with a spy anecdote and close with a tool list. The useful definition is drier and it decides what you're allowed to build:

OSINT = intelligence produced from publicly available sources, using a documented method.

Three parts, and all three matter:

1. Publicly available - you could, as a member of the public, walk up and see it. A public Telegram channel: yes. A leaked database of that channel's private members: no. A friend's screenshot of a private channel: legally grey, methodologically weak.
2. Sources - the material: posts, pages, registers, filings, code commits.
3. Documented method - the part everyone skips. If you can't write down where each fact came from and when, you have a vibe with a citation, not intelligence.

The boundary questions that actually come up in building

• Is scraping public pages "collecting" data? Collecting what a stranger can read in a browser is the core of the craft. Terms-of-service and robots rules are contract law between you and the platform - a real risk to manage, not a spy-movie crime.
• When does it become surveillance? When you start tracking an identified private individual's patterns at a scale and intimacy they didn't offer to the public. Monitoring a broadcast channel selling goods is market research. Building a dossier on one person's every movement is where ethics review belongs.
• Can you use the output commercially? Generally yes for facts derived from public material - facts aren't owned. Copying a competitor's expressive content verbatim is copyright, not OSINT.

Why the legal framing matters for builders

Because your product's first real review will come from someone's legal team, and the answer they want is not "the data is public" - it's "we can show, per signal, the public source, the timestamp, and the transformation." Collection discipline (raw snapshots, source URIs, time-series storage) is cheap to build in and impossible to retrofit. Five gates to pass before you trust any OSINT pipeline: source is public at collection time; collection is logged; transformation is reproducible; claims cite timestamps; personal-data rules of the relevant jurisdiction are checked before, not after.

If you build in this space, the collection-layer playbook - cursors, coverage ceilings, repost-ring flags, wording-diff alerting, raw-storage discipline - is the $5 bundle: https://heyuhe.gumroad.com/l/poddr. A free sample brief (real data, pay what you want, $0 is fine): https://heyuhe.gumroad.com/l/ruldgm.