RTFM of OSINT: Know Thyself
“If you know the enemy and know yourself, you need not fear the result of 100 battles. If you know yourself but not the enemy, for every victory gained, you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.” — Sun Tzu, “The Art of War.”
There is an inconvenient truth that what may be embraced by the broader cyber community or considered the latest industry trend comes at a cost. While we are hopping from one acronym to another with intimidating usernames and using flashy pew-pew graphics, we have lost sight to what actually matters: information is a weapon.
Dialogue about responsible OSINT is an even more significant inconvenience when it collides with ambition. Having worked quietly amongst the OSINT community, it’s become predictable human nature; those who want to be recognized as leaders/experts push their way in front of the pack, leaving all emphasis on careful analytics of the actual data collection behind. This is incredibly dangerous and serves the larger Open-Source Intelligence community a grave disservice by not addressing the matter.
Grab your favorite beverage, get comfortable, and let’s talk about it.
Ethics vs. Values: What is your “why?”
When it comes to the practice of Open-Source Intelligence, you will find endless resources on the topic of “Ethics”. Having earned my Ethical Hacker Certification and learning a cybercriminal skillset did not imply that I could now behave like one. Applying this to the practice of OSINT, what exactly does ethics mean, and is that the only area that should be considered?
Ethics is most often discussed as an agreed upon set of rules to which members within a group or society are governed, or simply stated — laws. Within the context of open-source information, common examples to refer to within the United States are the Computer Fraud and Abuse Act, the National Information Infrastructure Protection Act, and the Electronic Communications Privacy Act. Although critical, none of these provide a framework for the quality of the actual analysis itself.
In contrast, values can provide a window into the analyst’s personal guiding principles and how that can influence their decision making during the data collection process. This can also play a significant role in cognitive bias (a subject I am passionate about and have an entire series of articles planned), but first we need to understand who we are at our core.
Finding Your Guiding Principles: What Do You Value?
I learned about this practice years ago in a business leadership development training course. I found it so valuable that I kept the old list, reviewed it every six months for what requires updating, and used it as a reference document when I find myself in professional situations that evoke emotional responses.
However, this exercise requires self-reflection and brutal honesty with oneself, both of which can be misleading to what we initially hypothesized to be the reason we chose to learn this skill set to begin with. This is not about therapy or how good you are; it’s about emotional intelligence and WHY you are here. We are our whole selves everywhere we go, and understanding WHY will help bring our analysis collections from good to great. Prepare yourself for this.
While I have lost the worksheets from the original class years ago, here are a few suggestions to help you start.
Tomi Llama Personal Core Values Exercise: offers a very clean and concise step by step guide on how to identify your core values and form them in statements. The site is very transparent in the process and I don’t believe that the worksheet and flash cards are needed. You can refer to the following link for a list of words as a reference.
Life Balance Institute Core Values and Essential Intentions Worksheet: includes a really great list of values to consider as you conduct this practice.
To quote a professional that I respect: OSINT is not something we do, it is a mindset so awareness is the tool that brings the advantage of how we come to the table everyday.
