OSINT: CAN OPEN SOURCE INTELLIGENCE SERVE AS FORENSIC EVIDENCE?
Review Article
Keywords: OSINT • Open Source Intelligence • Digital Evidence • Bellingcat • Berkeley Protocol • ICC • ECtHR
ABSTRACT
Open Source Intelligence (OSINT) is an intelligence and investigation discipline that systematically collects and analyses data from publicly available sources. Social media posts, satellite imagery, geotagged content, forum records, news archives and registration and contract databases constitute the primary raw material of this discipline. The documentation work of organisations such as Bellingcat and Mnemonic on MH17, the Ukraine conflict and the Syrian civil war points to a reality in which OSINT methodology is actually used, or its use debated, in international courts. The Berkeley Protocol, published in 2022 by the OHCHR and UC Berkeley, codified international methodological standards for OSINT investigations systematically for the first time. This review article addresses comprehensively OSINT's historical roots, its core technical methodologies, its tool ecosystem, geolocation and verification methods, Mnemonic's archiving approach, Berkeley Protocol standards, the MH17 and Ukraine case examples, the debates on evidence admissibility in the International Criminal Court and the ECtHR context, the threat of artificial intelligence and deepfakes, the position under Turkish law, and the ethical and security responsibilities of OSINT researchers.
Keywords: OSINT, open source intelligence, digital evidence, Bellingcat, Berkeley Protocol, ICC, International Criminal Court, ECtHR, geolocation verification, satellite imagery, Mnemonic, deepfake, Turkish law, CMK 217, digital verification
ABSTRACT
Open Source Intelligence (OSINT) is an intelligence and investigation discipline that systematically collects and analyzes data from publicly available sources. Social media posts, satellite imagery, geotagged content, forum records, news archives, and registration databases constitute the primary raw materials of this discipline. The documentation work of organizations like Bellingcat and Mnemonic on MH17, the Ukraine conflict, and the Syrian civil war points to a reality in which OSINT methodology is actually being used or debated for use in international courts. The Berkeley Protocol, published by OHCHR and UC Berkeley in 2022, codified international methodology standards for OSINT investigations systematically for the first time. This review article comprehensively addresses OSINT's historical roots, core technical methodologies, tool ecosystem, geolocation and verification methods, Mnemonic's archiving approach, Berkeley Protocol standards, MH17 and Ukraine case examples, evidence admissibility debates in the ICC and ECHR, AI and deepfake threats, evaluations within Turkish law, and the ethical and security responsibilities of OSINT researchers.
Keywords: OSINT, open source intelligence, digital evidence, Bellingcat, Berkeley Protocol, ICC, ECHR, geolocation, satellite imagery, Mnemonic, deepfake, Turkish law, digital verification, chain of custody
1. Introduction
During the Second World War the Foreign Broadcast Monitoring Service (FBMS), attached to the US State Department, began in 1941 to compile intelligence from the open broadcasts of enemy countries through radio listening centres. The concept of 'Open Source Intelligence' was not yet in use at the time; but the basic principle — the systematic collection and analysis of publicly available information — was already at work. Over the eighty years since, that principle has grown beyond recognition with the abundance of data brought by the internet age and has become the OSINT discipline, described as 'the fingerprint science of the digital age' (Wikipedia, 2026).
Today a researcher can track the movements of military units, document war crimes evidence or establish the identity of suspects using a combination of Twitter/X archives, Google Earth historical imagery, Maxar satellite photographs, Telegram channel records and WHOIS registration databases. Bellingcat — which identified the Russian GRU agents in the Salisbury poisoning, proved that the missile that downed MH17 belonged to Russia and verified the geographical location of the massacre photographs from Bucha — has demonstrated the practical power of this discipline beyond dispute (IWPR, 2023).
The use of OSINT as forensic evidence is nevertheless a fundamentally different process from producing intelligence. The distance between obtaining a piece of information and proving it in court is filled with demanding requirements such as authenticity verification, chain of custody, methodological transparency and the criteria of judicial admissibility. As Dirisu (2025) notes in Opinio Juris, 'the principal problem is the absence of standardised methodologies; this complicates the application of the rules of evidence and prevents reliability and probative value from being assessed consistently.'
The aim of this article is to examine the OSINT discipline in depth in both its technical and its legal dimensions. OSINT tools and methodologies, Berkeley Protocol standards, international judicial developments, the position under Turkish law and the new threats created by artificial intelligence form the axes of the article.
Figure 1. The Historical Development of OSINT Methodology (1941–2025)
2. OSINT: Conceptual Framework and Definitions
2.1 Official Definitions and Scope
The US Department of Homeland Security (DHS) defines OSINT as 'intelligence produced from publicly available information that is collected, exploited and disseminated in a timely manner to an appropriate audience for the purpose of addressing a specific intelligence requirement.' NATO expresses OSINT as 'intelligence derived from publicly available information and from other unclassified data with limited distribution or access.' The EU adopts the definition 'the process of collecting and analysing information from open sources to produce actionable intelligence' (Wikipedia, 2026).
The common element of these definitions is the principle of 'public availability'. OSINT does not extend to unauthorised access, intrusion into a computer system or obtaining information from covert sources; information obtained by such means is not OSINT and carries a different legal status. This distinction is critically important both ethically and for the law of evidence: no special authority is needed at the collection stage for data compiled from a publicly available source, but this does not mean that the data is automatically admissible in court (OSINT FR, 2023).
2.2 The Fundamental Difference Between Intelligence and Evidence
The most fundamental tension for OSINT in the forensic context is the structural difference between intelligence and evidence. Springer Nature (2017) summarises the difference: 'Intelligence and evidence are fundamentally different from one another, and although all evidence can to some degree provide intelligence, the reverse is not always true. For intelligence to be usable as evidence it must meet the same forensic standards and clear the same legal hurdles as any other type of evidence.'
The practical consequence of this distinction is that OSINT analysts must keep a possible judicial process in view even while conducting the investigation. According to the assessment of AFCEA (2023), three criteria must be met for OSINT to be presented as evidence: clear and lawful identification of the source, an assurance of reliability that the data has not been altered or manipulated, and the independence and reliability of the person providing the evidence.
2.3 OSINT Sub-Disciplines
OSINT divides into several sub-disciplines according to source type. SOCMINT (Social Media Intelligence) is the process of collecting and analysing information from social media platforms — Twitter/X, Telegram, Instagram, TikTok, VKontakte. In Bellingcat's Ukraine investigations in particular, SOCMINT served as the primary data source for identifying military equipment and verifying identities.
GEOINT (Geospatial Intelligence) covers intelligence derived from satellite imagery, mapping data and geographical analysis. TECHINT (Technical Intelligence) denotes the technical analysis of weapons systems, vehicles and equipment from open sources. FININT (Financial Intelligence) describes analysis derived from company records, registration information and publicly available financial data (Wikipedia, 2026).
3. The OSINT Tool Ecosystem
Figure 2. The OSINT Tool Ecosystem — Six Categories and Representative Tools (2025)
3.1 Network and Infrastructure Tools
Shodan, described as a 'search engine for internet-connected devices', is a platform indexing every kind of online infrastructure from servers to IoT devices. It is used by cybersecurity professionals and digital researchers for open port detection, software version analysis and geographical threat mapping. AI-based threat prediction features are reported to have been added with Shodan's 2025 update (Web Asha Technologies, 2026).
theHarvester and Recon-ng are command-line tools used to build a target profile by collecting email addresses, domain names and IP information from open sources. WHOIS queries and ARIN/RIPE records provide access to registration information relating to domain ownership and network infrastructure. These tools are widely used particularly in cybercrime investigations and corporate due diligence processes.
3.2 Link Analysis: Maltego
Maltego is one of the most comprehensive link analysis and data visualisation platforms in the OSINT tool ecosystem. The tool works through a 'transform' mechanism that visualises in graph form the relationships between entities such as domain names, IP addresses, emails, social media profiles and company records. It serves as a critical tool for revealing hidden connections in complex investigations (Web Asha Technologies, 2026).
In the Salisbury poisoning investigation, a combination of Maltego and Shodan was used to trace the travel and digital footprints of the Russian GRU agents; passport information, travel records and prior travel data were analysed, allowing the suspects' movements to be linked to different countries and evidence supporting the allegation of state-sponsored involvement to be obtained (Web Asha Technologies, 2026).
3.3 Archiving and Retrospective Tools
The Wayback Machine (archive.org) is the most comprehensive web archive service, storing historical copies of internet content. It is used in legal proceedings to document the previous state of deleted or altered web content. In Gates Rubber v. Bando Chemical Industries, recounted by Ketcham (2025), archive.org records were taken as a reference in judicial assessments of authenticity standards for digital content.
Intelligence X is a specialised archive platform indexing leaked databases, deep web content and historical web snapshots. Offering the ability to search powerfully by email address, domain name, IP or document, the platform is an important resource for threat intelligence and forensic research (OSINT Byle, 2025).
3.4 1 TRACE and Integrated Platforms
Released in 2024, 1 TRACE is a next-generation platform combining the social media, geographical, cyber and financial OSINT disciplines in a single secure integrated system. Its ISO 27001:2022 certification lays the ground for its confident use by governments, law enforcement bodies and corporate users. Its cryptocurrency transaction tracing feature serves as a critical tool against the growing use of digital currencies in criminal activity (OSINT Byle, 2025).
4. Core OSINT Techniques: Methodology and Verification
Figure 3. The Five Stages of the Geolocation Verification Process
4.1 Geolocation Analysis: Methodology and Tools
Geolocation analysis is the determination of the location at which an image or video was captured from visual clues within it. According to Bellingcat's (2023) geolocation guide, this analysis is conducted in five stages. In the first stage, visual clues such as structures, landscape features, flags, vehicle plate formats, signage and vegetation in the image are catalogued systematically.
In the second stage these clues are compared using tools such as Google Earth, Google Street View, OpenStreetMap and Yandex Maps. In the third stage the sun's position at that moment is calculated from the shadow angle in the image using SunCalc or similar tools; this calculation offers a means of verifying both the time and the date of capture independently. In the fourth stage a comparison is made with Maxar, Planet Labs or Copernicus Sentinel satellite imagery. In the fifth and final stage the conclusion is not finalised until verification is obtained from at least two independent sources.
The most critical factor affecting the reliability of geolocation analysis is expert-dependent interpretation. Different analysts may arrive at different locations from the same image, which raises serious methodological concerns in the expert witness field in a court context. AFCEA (2023) therefore recommends that geolocation findings be verified independently by more than one analyst using a blind method.
4.2 Satellite Imagery Analysis
Commercial satellite imagery is one of the most powerful components of OSINT. Maxar Technologies, Planet Labs and Airbus Defence & Space offer imagery with ground resolution down to 50 cm; this resolution enables forensic applications such as vehicle counting, construction monitoring, damage assessment and mass grave identification. According to the Reuters Institute (2023) report, Bellingcat's TimeMap tool, supported by satellite imagery, located 1,094 incidents of bombing, armed attack and air strike in Ukraine in time and geography.
The forensic use of satellite imagery brings various methodological requirements: independent verification of the date and time of image acquisition, reporting of image quality and resolution, explanation of atmospheric distortions (cloud cover, haze) and documentation of the satellite provider's certification chain. Meeting these requirements constitutes the basic reliability criteria for presenting satellite imagery as forensic evidence.
4.3 Time Verification: Chronolocation
Determining independently when an image was captured is one of the most technical and exacting dimensions of OSINT methodology. Four basic chronolocation techniques are used: EXIF metadata analysis — the capture date/time information embedded in the image file; but it must be remembered that this data is stripped by social media platforms.
Sun shadow analysis narrows down the date by calculating the sun's position at that moment from the length and angle of the shadows in the image using SunCalc or Suncalc3. Weather archive comparison matches the weather conditions in the image against historical meteorological records for a particular region. Contextual time markers involve inferring a date range from content clues such as newspaper headlines, calendars or traces of particular events in the image.
4.4 EXIF Metadata and the Digital Fingerprint
The EXIF (Exchangeable Image File Format) metadata embedded in digital image and video files can contain forensically valuable information such as capture date/time, GPS coordinates, device make and model and software version. ExifTool is foremost among the widely used open-source tools for accessing this data. According to the assessment of Web Asha Technologies (2026), ExifTool and Creepy are widely used by digital forensic practitioners for metadata extraction, image geolocation and online identity tracking.
As regards the limitations of EXIF metadata, one critical point is this: the great majority of large social media platforms such as Twitter/X, Facebook and Instagram automatically strip or overwrite EXIF data when content is uploaded. This means that where an image has been obtained from the platform rather than from the device that actually captured it, the absence of EXIF data does not mean 'the image is fake'. The criterion should be consistency with other verification methods, not the absence of metadata.
Table 1. A Comparative Assessment of the Principal OSINT Techniques
Technique Tools Forensic Value Basic Limitation
Geolocation Google Earth, SunCalc, Wikimapia High (if verified) Expert-dependent interpretation; cross-verification mandatory
Satellite Imagery Maxar, Planet Labs, Sentinel Very High Provider certification; resolution limit
Social Media Archive Wayback Machine, archive.today Moderate-High Gaps for deleted content; platform EXIF stripping
EXIF Metadata ExifTool, Jeffrey's Exif Viewer Moderate (supplementary) Automatically stripped by platforms
Shadow/Sun Analysis SunCalc, Suncalc3 Moderate-High Requires precise date/time; cloud/shadow obstruction
Link Analysis Maltego, Gephi High (network identification) Can be concealed with VPN/Tor; requires expertise
Infrastructure Scanning Shodan, Censys, WHOIS Moderate Dynamic IP assignment; cloud hosting anonymisation
Note. Compiled on the basis of Toler (2022); OSINT Byle (2025); Web Asha Technologies (2026); AFCEA (2023).
5. Mnemonic / Syrian Archive: The Cryptographic Integrity Model
5.1 The Problem of Preserving Digital Content
The transient nature of social media content constitutes the most critical obstacle to OSINT archiving. Content shared on Twitter/X, YouTube and Facebook that may be of potential evidential value can be deleted at any moment by platform rules, government requests or the decision of the content owner. Founded in 2013, Mnemonic (formerly the Syrian Archive) represents the most comprehensive response developed to this threat: the systematic archiving of more than 5 million items of digital content and the safeguarding of their cryptographic integrity (IWPR, 2023).
5.2 SHA-256 Hash and Forensic Integrity
Mnemonic's fundamental methodological contribution is this: each archived item of content is stored with a SHA-256 cryptographic hash value computed at the moment of capture. This approach makes it possible to prove mathematically that the content has not subsequently been altered. Ritu Gill's Forensic OSINT application, reported by InCyber News (2024), works on a similar principle: 'By computing the hash value of content collected from the web, the hash serves as a "seal of authenticity" and enables digital evidence to be admissible in court.'
This method represents the adaptation of the traditional physical chain of custody to the digital world. The critical importance of ensuring digital evidence integrity arises from this: any pixel change or metadata edit changes the hash value, which provides a wholly tamper-evident verification mechanism. Blockchain-based notarisation is also among the complementary methods proposed in the research published in MDPI (2025) in this area.
6. The Berkeley Protocol: An International Methodological Standard
Figure 4. The Berkeley Protocol's 6-Stage Investigation Cycle (OHCHR/UC Berkeley, 2022)
6.1 The Genesis and Scope of the Protocol
The Berkeley Protocol on Digital Open Source Investigations was published in 2022 as the product of three years of joint work by the OHCHR (UN Office of the High Commissioner for Human Rights) and the Human Rights Center at UC Berkeley School of Law. Setting minimum professional standards for identifying, collecting, preserving, verifying and analysing digital open source information in investigations of international criminal, humanitarian law and human rights violations, this document constitutes the first comprehensive methodological framework in the history of the field (OHCHR, 2022).
The protocol's basic philosophy is tool independence: in a rapidly evolving technological environment, methodological principles and an ethical framework were established rather than rules dependent on particular tools. This gives the protocol the quality of a 'living document' able to retain its validity as new tools and platforms emerge. Alexa Koenig, Director of the UC Berkeley Human Rights Center, described the protocol as 'a living document using 21st-century methods that will strengthen the legal standards of open source investigations worldwide' (Lexology, 2020).
6.2 The Six-Stage Investigation Cycle
One of the most important contributions of the Berkeley Protocol is the six-stage investigation cycle set out in Chapter 6. According to Fortuna's (2025) assessment, this cycle 'transforms ad hoc digital research into methodologically sound evidence collection.'
Stage one — Planning and Setting Objectives: the legal framework, goals and ethical constraints of the investigation are established. Which types of evidence will be sought, which platforms scanned and what security protocols apply are clarified at this stage.
Stage two — Online Search and Discovery: systematic source scanning is conducted with search strategies and parameters documented. A record of the search terms used and of platform and date filters is mandatory for methodological transparency.
Stage three — Collection and Archiving: the content identified is archived with hash values computed. Content must be frozen at the moment of capture; a timestamped copy must be created with tools such as the Wayback Machine or Hunchly.
Stage four — Verification and Cross-Checking: every critical finding is confirmed at least twice from independent sources. Geolocation, time verification and source reliability must be addressed separately. Blind verification — analysts working independently without knowledge of each other's results — is recommended as the strongest approach.
Stage five — Analysis and Assessment: the whole of the data collected is analysed and conclusions and confidence levels established. Alternative explanations must be addressed explicitly; claims of one hundred per cent certainty must be avoided.
Stage six — Reporting and Legal Presentation: the methodology, tools, verification methods and limitations used are documented transparently. Conclusions are presented in probabilistic language; definitive identity claims are extremely risky from the standpoint of legal defensibility.
6.3 The Protocol's Five Basic Principles
Five basic principles lie at the heart of the Berkeley Protocol. According to the summary by RESET.ORG (2024) these principles are:
• Legal compliance: collection activity must comply with the relevant national and international law.
• Ethical responsibility: privacy rights and the protection of vulnerable communities must be observed.
• Methodological reliability: procedures must be repeatable and transparent.
• Security: the digital and physical security of researchers, witnesses and first responders must be protected.
• Continuous learning: the protocol is a living document updated in line with the changing technological environment.
7. International Case Examples: OSINT in the Field
7.1 The MH17 Case: The Decisive Role of OSINT
MH17, the Boeing 777 shot down over eastern Ukraine in 2014, cost 298 people their lives. While Russia denied involvement, Bellingcat researchers built a comprehensive chain of evidence linking the missile to a Russian-origin BUK system using open sources alone. The research methodology covered the following steps: geolocation of photographs shared on social media; linking the launch point to a field in Ukraine through multiple visual clues; verification of the time of capture through shadow analysis; tracing of the route with satellite imagery; and confirmation of the identity of the weapons system through leaked telephone intercept recordings.
Bellingcat's findings were later confirmed by the Joint Investigation Team (JIT) composed of Australia, Belgium, the Netherlands, Malaysia and Ukraine. According to the assessment of SIDN CEO Valerie Frissen, 'Bellingcat's work on the MH17 case proved that an OSINT-based approach, combined with the tireless work of volunteers, can produce decisive evidence' (SIDN, 2022).
On the ECtHR dimension, Bellingcat's work has been cited directly. As Bellingcat (2023) recounts, lawyers representing Ukraine submitted as evidence findings compiled by Bellingcat and other sources concerning Russia's intervention in Ukraine, MH17 and cross-border artillery attacks, and Russian military personnel in eastern Ukraine. The Russian side challenged the open source evidence; but the allegation of manipulation directed at the Pavloka Training Camp photograph was rejected by the ECtHR. That decision constitutes a critical precedent showing that open source evidence can be taken into consideration by international human rights courts.
7.2 The Ukraine War and the 'Web of Accountability'
Russia's invasion of Ukraine in 2022 became both the largest case and the most comprehensive testing ground for OSINT investigators. According to the RUSI (2024) report, Ukraine and its allies adopted the concept of a 'web of accountability' at the 'United for Justice' conference in March 2023. That web brings state institutions, the ICC, civil society organisations and OSINT researchers together in a coordinated documentation structure.
The attack on the Okhmadit children's hospital in July 2024 provided the most striking example of this coordination. As RUSI (2024) recounts: 'OSINT analysts in Ukraine and around the world rapidly identified the structure and components of the Kh-101 missile that struck the hospital; this removed Russia's opportunity to cover up the attack and confirmed OSINT's growing importance in holding the Kremlin accountable.'
According to the IWPR (2023) report, Bellingcat and the Global Legal Action Network (GLAN) launched a joint initiative at the end of 2022 under the name Justice and Accountability Unit (J&A Unit). The aim of that initiative is to design, apply and teach methods for conducting OSINT investigations that meet strict evidential standards. Bellingcat's account of the landmark decision runs as follows: 'The Yemen case began earlier and was used extensively in the MH17 investigation. Two paragraphs about Bellingcat appear in the ECtHR hearing; our findings are assessed on their own merits rather than treating us as "amateurs". This is a positive recognition of our work.'
7.3 The Skripal Poisoning Case: OSINT in Identification
In the 2018 poisoning of the Russian agent Sergei Skripal, OSINT set out a model of transparency followed by the public. British intelligence identified the suspects; Bellingcat and The Insider then documented publicly that both individuals were attached to the Russian military intelligence service GRU, using passport information, hotel reservations, airport security footage and digital traces followed through Maltego and Shodan (Web Asha Technologies, 2026).
This case has become a reference point showing how OSINT can complement an ordinary law enforcement investigation and how it can strengthen state accountability in the eyes of the public. The OSINT findings presented to the public before the official announcement played a decisive role in generating diplomatic pressure.
8. The International Judicial Framework: The ICC, the ECtHR and National Courts
8.1 The International Criminal Court and Digital Evidence
Rule 69 of the ICC Rules of Procedure and Evidence makes evidential value conditional on reliability, the integrity of the source, authenticity and not adversely affecting the proceedings. This general framework opens the door for OSINT evidence to be submitted to the ICC in theory. According to the comprehensive research in the Leiden Journal (Cambridge, 2023), digital open source evidence is assessed within the category of documentary evidence as user-generated content posted to social media platforms.
The Leiden Journal (2023) research shows that in assessing evidence the chamber examines 'the origin, the source or the author's role in the events concerned, the chain of custody from the moment the item was created to the moment it was submitted to the chamber, and other relevant considerations.' These assessment criteria offer a concrete methodological guide as to how OSINT archives should be structured.
According to the assessment by Dirisu (2025) in Opinio Juris, in the period before the Berkeley Protocol the OSINT work conducted by civil society organisations and independent researchers 'was at times deprived of formal institutional support and wrestled with problems of evidential admissibility, methodological consistency and legal reliability.' The protocol represents the first structural initiative aimed at closing the gaps of that period.
8.2 Bellingcat's Role in the ICC Investigation
Following the ICC's opening of a war crimes investigation in Ukraine (2022), the question of whether the open source documentation compiled by Bellingcat, Ukrainian Witnesses and Mnemonic would be included in the official investigation file was opened for debate. Bellingcat's submission to the prosecution is a historic document in this context. In congressional testimony to the HHRG (Grozev, 2022) the following appears: 'The methodology we developed in the Yemen investigation involves forming a dedicated team that records events and isolating that team from the editorial team. That method had previously been found admissible for use in the courts by a British common law judge.'
8.3 English Common Law and the Yemen Case Precedent
The testing and acceptance within the English common law framework of the methodology developed by Bellingcat in its Yemen work constitutes one of the turning points in the history of OSINT methodological standardisation. As IWPR (2023) recounts: 'The Yemen case was a cornerstone. The process of using open sources began earlier and was used extensively in the MH17 case. Two paragraphs in the ECtHR hearing are devoted solely to Bellingcat; our findings are assessed on their own merits rather than treating us as amateurs.'
That decision shows that OSINT methodology can gain acceptance even in a rule-bound legal system, but that this requires systematic documentation, editorial independence and an isolated evidence collection process.
8.4 National Courts and Social Media Evidence
In national courts, social media evidence of OSINT origin is subject to different admissibility standards in different jurisdictions. According to the assessment of Springer Nature (2017), in England and Wales 'hearsay evidence' is widely accepted through statutory exceptions and OSINT material may fall within that definition. In French criminal law, Article 427 of the Code of Criminal Procedure adopts the principle of 'freedom of proof'; offences may be proved by any means of evidence (OSINT FR, 2023).
Nevertheless the critical distinction stressed by OSINT FR (2023) is this: 'Information collected in the course of OSINT activity under conditions that have a lawful legal basis and comply with legal principles is not automatically accepted as evidence in a case. Attention must be paid to the difference between the production of evidence and its admission.'
9. The Artificial Intelligence Threat: Deepfakes, Disinformation and OSINT
9.1 The Effect of Deepfakes on OSINT Methodology
The maturing of large language models and image generation AI constitutes the newest and most dangerous threat facing OSINT analysis. The ability to produce images, video and audio that look real but are wholly synthetic potentially invalidates traditional visual verification techniques: geolocation analysis rests on the assumption of a genuine photograph, and that approach becomes meaningless for an image with an AI-generated background. Shadow and sun analysis works only for genuine photographs of real environments.
According to Ketcham's (2025) assessment in Medium, the problem of digital evidence authenticity is becoming ever more critical in legal practice. Cases in which this threat is used deliberately by the opposing side have also been documented: Russia's allegations of manipulation directed at Bellingcat photographs in the Ukraine case constitute an example of the instrumentalisation of deepfakes in court. The ECtHR rejected that objection; but such claims are expected to increase.
9.2 Detection and Provenance Technologies
Two basic technological approaches are developing in response to the deepfake threat. The C2PA (Coalition for Content Provenance and Authenticity) standard is an industry standard documenting cryptographically the production chain of images and video. It records cryptographically on which device, with which software and in which time period content was produced; that record is tamper-evident.
The InVID/WeVerify toolkit is an open-source platform developed for video verification. Included in Bellingcat's toolkit, this set offers the ability to run video frames through reverse image search, extract metadata and analyse manipulation markers. Amnesty International's Digital Verification Corps uses these tools to train volunteer teams specialising in reverse image search, geolocation and shadow analysis (Lexology, 2020).
9.3 State-Sponsored Disinformation and the Pollution Strategy
The most sophisticated strategy for damaging the forensic value of OSINT is to flood the online environment with fake but plausible content. This strategy can be used for three purposes: to cause genuine OSINT findings to be lost in the noise; to offer false alternatives so as to damage the credibility of authentic evidence; and to send researchers off in the wrong direction. The information strategy pursued by Russia in the MH17 case has been examined by many academics as an example of this kind of 'epistemic sabotage'.
The response of OSINT methodology to this threat is the requirement of multi-layered verification and sceptical assumptions: a single source, however reliable it appears, is not sufficient. Source motivation, identity verification and independent confirmation have for this reason been made central principles of the Berkeley Protocol.
10. Forensic OSINT Tools and Blockchain Verification
10.1 The Court Admissibility of Open-Source Forensic Tools
Research published in PLOS ONE (2025) found that open-source forensic tools (Autopsy, ProDiscover Basic), compared with commercial tools (FTK, Forensic MagiCube), face four basic problems as regards court admissibility: the capability and usability of open-source digital forensic tools, the reliability and integrity of the digital evidence produced with them, the transparency of the tools, and the lack of references and standards governing the use of open-source tools.
The key finding of the research is this: in controlled test environments open-source tools exhibit performance comparable to their commercial counterparts. Even so, the development of standardised validation frameworks is essential for these tools to be accepted in court. The absence of such standards leads courts to approach open-source tools more sceptically than commercial ones.
10.2 Blockchain-Based OSINT Archiving
Research published in MDPI's Future Internet journal (2025) proposes a five-stage framework integrating blockchain-based notarisation and image verification mechanisms with existing forensic workflows to ensure OSINT evidence integrity: identification, acquisition, authentication, preservation and verification. The basic advantage of the blockchain-based approach over hash-based methods is that immutability is supported by a decentralised trust infrastructure: while a hash on a server can be altered, altering a blockchain record is theoretically impossible (MDPI, 2025).
11. OSINT in the Turkish Legal Context
11.1 CMK 217 and the Digital Evidence Framework
In Turkish criminal procedure law the general framework for digital evidence is provided by Article 217 of the CMK: the court may base its judgment only on evidence presented at the hearing and obtained lawfully. According to the assessment of Istanbul Lawyer Firm (undated), 'the admissibility of digital content in Turkish courts is not automatic — it requires strict legal compliance; lawful acquisition, authentication and chain of custody are foremost among these.'
In Turkish law, CMK 134 governs the search and seizure procedure for computer systems. The critical question for OSINT specifically is this: is information compiled from a publicly available source deemed to have been obtained by lawful means within the meaning of the CMK? Open source data by its nature requires no special authority at the acquisition stage; this means that it is subject not to the search and seizure procedure of CMK 134 but directly to the general admissibility standard of CMK 217. But even where the method of acquisition is lawful, evidential value depends on the elements of authenticity, integrity and methodological reliability.
11.2 Digital Evidence Practice in Türkiye
Social media posts of OSINT origin are widely submitted as evidence in Turkish courts. According to Istanbul Lawyer Firm (undated), 'Turkish lawyers submit audio files as evidence accompanied by a certified transcript and an expert opinion confirming the absence of manipulation.' The same principle applies to OSINT evidence: challenges to the authenticity of social media content are increasing and courts are requesting support from digital forensics expert witnesses.
As regards the KVKK (Law No. 6698), publicly available social media data also has the status of personal data. Collecting and analysing this data must be placed on a legitimate footing in accordance with the KVKK's principle of purpose limitation. Law enforcement bodies conducting OSINT for the purposes of a criminal investigation must observe this legal framework; that obligation constitutes the basic precondition for OSINT evidence not meeting a challenge in court.
11.3 Developments Under Law No. 5651 in Türkiye
The amendments made between 2022 and 2026 to Law No. 5651, which constitutes Türkiye's internet regulatory framework — particularly the provisions on disinformation and social media platform obligations — create a significant tension for OSINT methodology. According to the assessment of Istanbul Lawyer Firm (2025), thanks to 5651's content blocking mechanism it is theoretically possible to obtain social media content inaccessible in Türkiye from foreign archives through OSINT; but presenting such content in court requires separate methodological care.
12. Standards, Methodological Recommendations and Ethics
12.1 Researcher Security
The security of OSINT researchers is one of the central principles of the Berkeley Protocol. OSINT analysts investigating state actors can face serious physical dangers; cases of arrest and prosecution have been documented in some countries. On digital security, researchers face the risk of being recognised by their targets: an attempt to access a social media account may alert the account holder that they are being investigated, which threatens both the course of the investigation and the researcher's safety.
12.2 Ethical Limits: Privacy and Legal Compliance
The most fundamental ethical tension facing OSINT researchers is the conflict between the collection of publicly available information and the right to privacy. Koops's warning, recounted by AFCEA (2023), makes this tension concrete: 'Although the process of collecting the information may do no harm in itself, it is possible for the final collection to present a detailed profile identifying the person; this may constitute a privacy violation even though each element of the data comes from open sources.'
In Türkiye in particular, the KVKK's principle of 'data minimisation' requires OSINT work to be confined to a particular investigative purpose. The legal limits of systematic and comprehensive data scraping from an individual's publicly available account remain contested. SSC Legacy's (2022) emphasis is important in this context: 'The police face restrictions under constitutional protections such as the Fourth Amendment and, abroad, data protection frameworks such as the GDPR.'
12.3 Comprehensive Methodological Recommendations
To strengthen the admissibility of OSINT evidence in legal proceedings:
• A content archiving protocol: all source content must be archived with a hash value computed as quickly as possible. Forensic-purpose tools such as Hunchly should be preferred.
• Multi-source verification: every critical finding must be confirmed at least twice from independent sources; single-source findings are indefensibly fragile.
• Blind verification: analysts working independently without knowledge of one another significantly strengthens methodological integrity.
• Methodological transparency: the tools and techniques used, the margin of uncertainty and alternative explanations must be reported. Results must be presented in probabilistic language and definitive claims avoided.
• Accompaniment by an expert witness: the presentation of OSINT findings in court proceedings should be made through an expert meeting the Daubert / CMK 63-67 standard.
• Deepfake risk assessment: every item of visual evidence should be scanned for synthetic content with InVID/WeVerify or similar tools, and uncertainty reported.
• A researcher security protocol: particularly in investigations involving state actors, the use of sock puppet accounts, the concealment of access records and secure communication channels should be standard procedure.
Table 2. A Comparison of OSINT Practice Before and After the Berkeley Protocol
Dimension Before the Protocol (pre-2022) After the Protocol (post-2022)
Methodological standard Varying by researcher and organisation 6-stage cycle; OHCHR-endorsed framework
Cryptographic integrity Selective practice (Mnemonic the exception) Hash + archiving recommended as mandatory
Security framework Left to researcher discretion Systematic digital and physical security principles
Judicial acceptance Case by case; inconsistent Protocol compliance increases the likelihood of admission
Ethical framework Dependent on organisational policy 5 basic principles; including privacy and proportionality
Institutional legitimacy Contested; perception of 'amateurs' Recognition by the ECtHR, the ICC and national courts
Note. Compiled on the basis of Opinio Juris (2025); OHCHR (2022); IWPR (2023); Bellingcat (2023).
13. Conclusion
Open source intelligence has undergone an eighty-year transformation from the radio monitoring operations of 1941 to the identification of the missile used in the Okhmadit hospital attack in 2024. The last decade of that transformation is particularly striking: the data abundance of social media, the commercial accessibility of satellite imagery and the spread of powerful analytical tools such as Maltego, Shodan and the Wayback Machine have taken OSINT beyond being a research method and to the borders of an independent scientific discipline.
Even so, the use of OSINT as forensic evidence has not yet completed its process of maturation. The Berkeley Protocol symbolises the turning point of that process: the first systematic step towards transforming OSINT investigation into a methodologically defensible discipline. The confirmation of Bellingcat's findings by the JIT in the MH17 case and the opening of Bellingcat's evidence to debate at the ECtHR make concrete how rapidly this transformation has taken place.
The rise of artificial intelligence and deepfake technology constitutes the most sophisticated threat to date to OSINT's reliability. Overcoming that threat requires the spread of C2PA provenance standardisation, verification tools such as InVID/WeVerify and cryptographic integrity mechanisms. Alongside technical measures, methodological transparency and a culture of multi-layered verification must also become standard requirements in this field.
In the Turkish context the integration of OSINT methodology into legal practice is still in its infancy. The general digital evidence standard of CMK 217 may not be sufficient to meet the requirements specific to OSINT. Standardising how open source data is acquired, verified and reported; training digital forensics experts and members of the judiciary in this field; and clarifying the KVKK framework with OSINT use cases are among the critical agenda items in Turkish law's process of adapting to the digital age.
In conclusion, the answer to the question 'can OSINT be forensic evidence?' is this: yes, it can — but only with correct methodology, cryptographic integrity, methodological transparency and expert witness support. OSINT evidence lacking these four conditions is fragile to the point of being damaging in legal proceedings, however strong its claims to accuracy. The framework drawn by the Berkeley Protocol offers, for now, the most comprehensive guide to how those four conditions may best be met.
References
AFCEA International. (2023, September 1). The rise of OSINT: Few rules, many opportunities. Signal Media. https://www.afcea.org/signal-media/intelligence/rise-osint-few-rules-many-opportunities
Bellingcat. (2023a). Geolocation guide: How to geolocate images. https://www.bellingcat.com/resources/how-tos/geolocation
Bellingcat. (2023b, March 28). How open source evidence was upheld in a human rights court. https://www.bellingcat.com/resources/2023/03/28/how-open-source-evidence-was-upheld-in-a-human-rights-court/
Dirisu, D. M. (2025, April 28). Institutionalization: A way forward to prove the role of open-source intelligence to the courts. Opinio Juris. https://opiniojuris.org/2025/04/28/institutionalization-a-way-forward-to-prove-the-role-of-open-source-intelligence-to-the-courts/
Fortuna, A. (2025, November 5). Setting standards for digital investigations in the age of open source intelligence. https://andreafortuna.org/2025/11/05/setting-standards-for-digital-investigations-in-the-age-of-open-source-intelligence
Grozev, C. (2022, March 16). Open source investigation and the documentation of war crimes in Ukraine [Congressional testimony]. House Foreign Affairs Subcommittee on Europe, Energy, the Environment and Cyber. https://docs.house.gov/meetings/FA/FA14/20220316/114520/HHRG-117-FA14-Wstate-GrozevC-20220316.pdf
InCyber News. (2024, February 11). OSINT in the judicial process: A growing phenomenon. https://incyber.org/en/article/osint-in-the-judicial-process-a-growing-phenomenon/
Institute for War and Peace Reporting (IWPR). (2023). Integrating OSINT into justice processes. https://iwpr.net/global-voices/integrating-osint-justice-processes
Istanbul Lawyer Firm. (undated). How digital evidence works in Turkey. https://istanbullawyerfirm.com/blog/digital-evidence-admissibility-turkey
Istanbul Lawyer Firm. (2025). Understanding the 2025 amendments to Turkey's internet law. https://istanbullawyerfirm.com/blog/turkey-internet-law-changes-2025
Ismail, A., Ariffin, K. A. Z., Abdullah, M. T., Rauf, M. A., Mohd Zin, N. A., & Murad, M. A. A. (2025). The admissibility of digital evidence from open-source forensic tools: Development of a framework for legal acceptance. PLOS ONE, 20(9), e0331683. https://doi.org/10.1371/journal.pone.0331683
Ketcham, T. (2025, December 17). OSINT in the legal industry: More suits, less trenchcoats. Medium. https://medium.com/@tom.ketcham/osint-in-the-legal-industry-22608ca48f26
Leiden Journal of International Law / Cambridge Core. (2023). Closing cases with open-source: Facilitating the use of user-generated open-source evidence in international criminal investigations. https://doi.org/10.1017/S0922156523000237
Lexology. (2020, December 22). The Berkeley Protocol on Open Source Investigations. https://www.lexology.com/library/detail.aspx?g=88065c49-c099-4bee-835f-e15e183587ec
MDPI / Future Internet. (2025). A blockchain-based framework for OSINT evidence collection and identification. Future Internet, 17(12), Article 551. https://www.mdpi.com/1999-5903/17/12/551
OHCHR / UC Berkeley Human Rights Center. (2022). Berkeley Protocol on Digital Open Source Investigations. United Nations Human Rights Office of the High Commissioner. https://www.ohchr.org/en/publications/policy-and-methodological-publications/berkeley-protocol-digital-open-source-investigations
OSINT Byle. (2025, June 4). Top 15 OSINT tools in 2025. Medium. https://osintbyle.medium.com/top-15-osint-tools-in-2025-leading-platforms-osint-investigations-platforms-2771871b7bb6
OSINT FR Community. (2023, May 4). OSINT: What admissibility of the information collected in litigation? https://osintfr.com/en/osint-what-admissibility-of-the-information-collected-in-litigation-4-4/
RESET.ORG. (2024, February 2). The Berkeley Protocol is setting international standards for digital open source investigations. https://en.reset.org/the-berkeley-protocol-is-setting-international-standards-for-digital-open-source-investigations/
Reuters Institute for the Study of Journalism. (2023, February 21). How Bellingcat collects, verifies and archives digital evidence of war crimes in Ukraine. https://reutersinstitute.politics.ox.ac.uk/news/how-bellingcat-collects-verifies-and-archives-digital-evidence-war-crimes-ukraine
Royal United Services Institute (RUSI). (2024). Puzzling pieces: OSINT and war crime accountability in Ukraine. https://www.rusi.org/explore-our-research/publications/commentary/puzzling-pieces-osint-and-war-crime-accountability-ukraine
SIDN. (2022, April 1). Bellingcat uses open-source information to expose wrongdoing. https://www.sidn.nl/en/news-and-blogs/bellingcat-uses-open-source-information-to-expose-wrongdoing
Springer Nature. (2017). Following the breadcrumbs: Using open source intelligence as evidence in criminal proceedings. In A. Staniforth & P. Griffiths (Eds.), Routledge companion to UK counter-terrorism (pp. 213-228). https://link.springer.com/chapter/10.1007/978-3-319-47671-1_18
SSC Legacy. (2022). Open Source Intelligence (OSINT) and the law. https://ssclegacy.com/2017/11/15/open-source-intelligence-osint-and-the-law/
Web Asha Technologies. (2026). Real-world applications of OSINT: Exploring successes and failures. https://www.webasha.com/blog/real-world-applications-of-osint-exploring-successes-and-failures
Wikipedia. (2026). Open-source intelligence. https://en.wikipedia.org/wiki/Open-source_intelligence
