1 of 45

Eyes Online: Practical Open Source Intelligence for Law Enforcement and National Security

Justin David Pineda CISSP, CISM

Version 1

Oct 2025

2 of 45

Time

Topic

Method

Hands-On / Output

0:00 – 0:10

Welcome & Orientation

Intro, motivation

Recognize real-world value of OSINT for national security

0:10 – 0:40

OSINT Framework & Ethics

Lecture + Demo

Identify legal vs illegal intelligence collection

0:40 – 1:10

People & Social Media Intelligence

Demo + Hands-on

Discover digital footprint of a sample persona

1:10 – 1:40

Website, Domain & Image Intelligence

Demo + Hands-on

Analyze domain and photo metadata

1:40 – 2:10

Geolocation & Mapping Intelligence

Demo + Hands-on

Verify location of a photo or event

2:10 – 2:30

Recap & Reflection

Discussion

Key lessons before group mission

3 of 45

Learning Objectives

  • Understand and explain the fundamentals of Open Source Intelligence (OSINT) — including its framework, ethical and legal considerations, and relevance to law enforcement and national security operations.
  • Apply practical OSINT techniques using free online tools to gather, verify, and analyze publicly available information from social media, websites, domains, and geolocation sources.
  • Demonstrate analytical judgment and teamwork by conducting a simulated OSINT investigation (Operation Silent Harbor), producing an intelligence briefing that integrates collected data, validation steps, and actionable recommendations.

4 of 45

Motivation

  • What’s the most surprising thing you’ve seen people post publicly online?

5 of 45

  1. OSINT Framework and Ethics

6 of 45

OSINT Framework and Ethics

7 of 45

Planning Stage

  • Identify the purpose (threat actor, missing person, fake profile, organization background, etc.)
  • Determine information needs and scope (what’s relevant, what’s off-limits)
  • Identify tools and limitations

8 of 45

Collection Stage

  • Online sources: Google, social media, websites
  • Public records: government portals, WHOIS, business registries
  • Archived data: Wayback Machine, caches
  • Use tools responsibly — do not hack or access restricted systems.

9 of 45

Processing & Analysis

  • Process: Clean, filter duplicates, translate, format
  • Analyze: Correlate information, timeline events, connect entities
  • Look for anomalies, relationships, geolocation clues, or behavioral indicators

10 of 45

Reporting & Verification

  • Summarize findings clearly and factually
  • Include sources and timestamps
  • Verify before reporting or sharing — disinformation spreads fast

11 of 45

Legal Boundaries (Philippine Context)

  • RA 10173 – Data Privacy Act
  • Respect personal data; no unauthorized access or disclosure.

​

  • RA 10175 – Cybercrime Prevention Act
  • Avoid illegal access, interception, or data interference.

​

  • RA 11479 – Anti-Terrorism Act (context awareness)
  • Use OSINT responsibly, avoid profiling or political misuse.

12 of 45

Intelligence Ethics

  • Verify before sharing — cross-check multiple sources
  • Avoid manipulation — no fabrication or alteration of data
  • Respect privacy — do not publish sensitive details unnecessarily
  • Follow professional duty — uphold organizational and national security values

13 of 45

Demo: OSINT Framework

Demo Guide:

  • Visit https://osintframework.com
  • Show categories: Username, Domain, IP, Social Media
  • Demonstrate one quick lookup (e.g., checking tools for domain investigation)

14 of 45

Demo: Wayback Machine

Demo Guide:

  • Go to https://archive.org/web
  • Enter a website (e.g., gov.ph, local organization)
  • Show old versions and timeline snapshots

15 of 45

Demo: Google Advanced Search

  • site:facebook.com "Philippine Coast Guard"
  • filetype:pdf "budget report" site:gov.ph

16 of 45

Practice Exercise

Activity Brief:

  • Split into pairs or trios
  • Visit osintframework.com
  • Use Google Advanced Search or Wayback Machine to find:
    • A past version of a gov.ph site or
    • A publicly available report or PDF from a government agency
  • Record: Tool Used, URL Found, What You Discovered

17 of 45

2. People & Social Media Intelligence

18 of 45

People & Social Media Intelligence

19 of 45

Persona Profiling

  • Summarize findings clearly and factually
  • Include sources and timestamps
  • Verify before reporting or sharing — disinformation spreads fast

20 of 45

Fake vs Real Accounts

Indicator

Real Account

Fake Account

Profile Photo

Consistent, natural

Stock or celebrity image

Friends/Followers

Gradual, organic

Sudden spikes or zero

Posts

Mixed (personal, shared, original)

Repetitive or copy-pasted

Interactions

Genuine conversations

Generic comments (“Nice post!”)

Creation Date

Older

Recently created

21 of 45

Behavioral Indicators

  • Posting time (time zones and patterns)
  • Language, grammar, emoji use
  • Repetition of topics or hashtags
  • Reaction to events or criticism
  • Cross-platform behavior (same user posting same message everywhere)

22 of 45

“Digital Footprints Never Fade”

  • Every post, like, photo, and comment can be traced.
  • Deleted posts may still exist in archives or screenshots.
  • Search engines and data brokers keep cached data.

​

“Once online, always online.”

23 of 45

Demo Tools Overview

  • Google Images Reverse Search – verify profile photos or identify duplicates
  • Social Searcher – track mentions of a name or keyword across social media
  • Lullar Lookup – find profiles linked to a person’s email, username, or name

24 of 45

Practice Exercise

Instructions:

  • Open your browsers.
  • Use Google Images, Social Searcher, and Lullar Lookup.
  • Search for your name.
  • Note any public info — city, photos, affiliations, or comments.

​

Discuss:

  • Is the information credible?
  • How do you verify authenticity?
  • What ethical limits should apply?

25 of 45

3. Website, Domain & Image Intelligence

26 of 45

What Websites Reveal

  • Domains show ownership, registration details, and country of origin
  • Server info reveals hosting provider, location, and technologies
  • Patterns show organizational links between sites
  • Sometimes you can trace the same person/company behind multiple domains

27 of 45

Domain Investigation

  • WHOIS reveals registration details (name, email, org, registrar)
  • Creation and expiry dates show site age and legitimacy
  • IP address can be mapped to a geographic region
  • Combine WHOIS + IP + SSL info to profile online entities

28 of 45

Technology Fingerprinting

  • Reveals web server type, CMS (WordPress, Joomla, etc.), analytics tools
  • Shows 3rd party integrations (Facebook Pixel, Google Ads)
  • Can help profile an organization’s digital maturity

29 of 45

Checking for Malicious or Compromised Sites

  • Aggregates multiple antivirus and threat feeds
  • Shows if a domain or URL is blacklisted or suspicious
  • Useful for validating phishing or malware indicators

30 of 45

Image Metadata Intelligence

EXIF data can reveal:

  • Camera model, GPS coordinates, timestamps
  • Software used to edit photo

Use for geolocation, timeline reconstruction, authenticity checks

Remove metadata before sharing sensitive images

31 of 45

Practice Exercise

Pick an unknown .ph domain (e.g., random company, organization, or page).

​

Use:

  • Whois.domaintools.com – find the registrar & registrant info
  • BuiltWith.com – identify hosting provider & technologies
  • VirusTotal.com – check if flagged or clean

​

Discuss findings:

  • Who owns or manages it?
  • Is it legitimate or suspicious?
  • What patterns or relationships can you infer?

Tool

Finding

Insight

Whois

​

​

BuiltWith

​

​

VirusTotal

​

​

32 of 45

4. Geolocation and Mapping Intelligence

33 of 45

What is Geolocation Intelligence?

  • Process of determining where and when an image or video was captured
  • Combines visual clues, metadata, and publicly available maps
  • Critical in validating evidence, crisis mapping, or countering misinformation

34 of 45

Verification of Place & Time

Step

Example

Tools

Identify landmarks

buildings, terrain, coastlines

Google Earth, Google Maps

Analyze shadows

sun direction & time

SunCalc.org

Check context

weather, signage, vehicles

Google Street View

35 of 45

Cross-Checking Clues

  • Landmarks: compare skyline, mountain ranges, road layouts
  • Transportation data: ships → MarineTraffic.com | aircraft → FlightRadar24.com
  • Weather archives: confirm sunlight, visibility, cloud cover

​

36 of 45

Demo Tools Overview

  • Google Earth / Maps – compare landmarks, measure distances
  • SunCalc.org – estimate shadow angles & capture time
  • MarineTraffic.com – track ship positions by AIS data
  • FlightRadar24.com – real-time & historical aircraft movements

37 of 45

Course Summary

What We Learned

  • OSINT Fundamentals: Plan → Collect → Process → Analyze → Report
  • Ethics & Legality: Respect Data Privacy (RA 10173) and Cybercrime Law
  • Verification First: Always cross-check sources before concluding

​

Tools in Your Intelligence Kit

  • People / Social Media: Google Image Search, Social Searcher, Lullar
  • Domain / Website: Whois, BuiltWith, VirusTotal
  • Image / Location: Exif Tools, Google Earth, SunCalc, MarineTraffic, FlightRadar24

​

Key Takeaways

  • Every post, photo, and domain leaves a digital footprint
  • Effective OSINT = Curiosity + Verification + Collaboration

38 of 45

Knowledge Check # 1

Which of the following best describes the OSINT process?

  • A. Detect → Hack → Exploit → Report
  • B. Plan → Collect → Process → Analyze → Report
  • C. Search → Capture → Delete → Archive
  • D. Identify → Intrude → Control → Extract

39 of 45

Knowledge Check # 2

Which Philippine law governs the lawful and ethical use of personal data gathered online?

  • A. RA 9995 – Anti-Photo and Video Voyeurism Act
  • B. RA 10173 – Data Privacy Act of 2012
  • C. RA 11479 – Anti-Terrorism Act
  • D. RA 8792 – E-Commerce Act

40 of 45

Knowledge Check # 3

Which tool would you use to find out who owns or manages a website’s domain?

  • A. Google Earth
  • B. Whois.domaintools.com
  • C. Exif.tools
  • D. Social Searcher

41 of 45

Knowledge Check # 4

You find a suspicious image online and want to verify if it’s genuine or reused. Which tool should you use first?

  • A. MarineTraffic.com
  • B. BuiltWith.com
  • C. Google Images Reverse Search
  • D. VirusTotal.com

42 of 45

Knowledge Check # 5

In verifying the location of a vessel photo posted online, which combination of tools is most appropriate?

  • A. Exif.tools and MarineTraffic.com
  • B. Whois.domaintools.com and BuiltWith.com
  • C. Social Searcher and Google Images
  • D. Wayback Machine and SunCalc.org

43 of 45

44 of 45

References

  • OSINT Framework. (n.d.). Open Source Intelligence Collection Tools. Retrieved from https://osintframework.com
  • Bazzell, M. (2024). Open Source Intelligence Techniques: Resources for Searching and Analyzing Online Information (10th ed.). IntelTechniques.
  • Center for Security Studies (CSS) ETH Zurich. (2019). Open Source Intelligence (OSINT): A Framework for Law Enforcement and Security Practitioners. Retrieved from https://css.ethz.ch
  • National Privacy Commission (NPC). (2012). Republic Act No. 10173 – Data Privacy Act of 2012. Retrieved from https://privacy.gov.ph/data-privacy-act/
  • Republic Act No. 10175 – Cybercrime Prevention Act of 2012. Retrieved from https://www.officialgazette.gov.ph/2012/09/12/republic-act-no-10175/
  • NATO StratCom Centre of Excellence. (2022). Guide to Social Media Intelligence (SOCMINT) for Law Enforcement. Riga, Latvia.
  • Bellingcat. (2023). Verification Handbook: Advanced Guide for Digital Investigators. Retrieved from https://verificationhandbook.com
  • Google. (n.d.). Advanced Search Operators and Techniques. Retrieved from https://support.google.com/websearch/answer/2466433
  • MarineTraffic. (n.d.). Global Ship Tracking and AIS Data. Retrieved from https://www.marinetraffic.com
  • FlightRadar24. (n.d.). Live Air Traffic Data. Retrieved from https://www.flightradar24.com

45 of 45

Eyes Online: Practical Open Source Intelligence for Law Enforcement and National Security

Justin David Pineda CISSP, CISM

Version 1

Oct 2025