Ethicality Analysis Framework for Active OSINT Research

Abstract

Open-source intelligence (OSINT), a research method crucial to many security fields, has become a critical capability in cybersecurity investigations, missing persons reports, sex trafficking cases, and other domains. Most OSINT processes, particularly active approaches, require some level of deception or interaction with subjects, emphasizing the need for ethics guidance tailored to these methods. Existing structures fall short in addressing the nuances of cyber research, especially when human subject involvement is indirect or unclear. Drawing from active OSINT field experience, we recognize persistent ethical “gray areas” surrounding active OSINT, including ethical hacking, Terms of Service violations, online privacy expectations, artificial intelligence use, fake accounts, and more. This paper is an attempt to clarify where and how to address these issues while filling the gap in proactively designing ethical and quantitative OSINT experiments. We propose a quantitative, adaptable framework integrating an ethics scorecard, risk–reward analysis, and expert advisory review to complement and enhance existing ethics oversight structures. This model is designed to guide both active OSINT projects and broader cyber research initiatives to enable consistent ethical experimental designs.