By Quinn Varcoe, Founder & CEO, SleuthX
Open-source method, applied to reporting
Open-source intelligence for journalism is not a different craft from verification — it is verification, done rigorously, with publicly available material.
This guide is for reporters: it covers the techniques that corroborate online content, the legal line you must not cross, and the ethics of when not to use something.
It deliberately does not rehash the generic primer on what OSINT is; the goal here is the journalist-specific discipline that makes a finding hold up.
The verification toolkit
A handful of techniques do most of the corroboration work, and the point of all of them is the same: never trust a single signal.
- Geolocation — fixing where an image was captured from landmarks, signage, and terrain.
- Chronolocation — establishing when, using shadows, weather records, and other time signals.
- Reverse-image search — finding whether content appeared earlier elsewhere, which exposes recycled or miscaptioned media.
- EXIF and file-metadata analysis — reading embedded capture data where platforms have not stripped it.
- Archiving — preserving the source the moment you find it, so it cannot silently change or disappear.
The canonical method references are Bellingcat’s open-source research guides and First Draft’s five pillars of verification.
For legal and human-rights contexts, the Berkeley Protocol formalizes how to document method and preserve originals.
We apply these standards and cite them as the model.
- A direct line to Quinn, the founder — not a sales pipeline.
- Worked in-house by the examiner who scoped it.
- Explainable findings you can verify, with the methodology shown.
The lawful line: access, not motive
The most important legal idea in journalist OSINT is simple.
Under the Computer Fraud and Abuse Act (18 U.S.C. §1030), as the Supreme Court read it in Van Buren v. United States, liability turns on whether you were authorized to access a system — not on your purpose once you are there.
Viewing and analyzing genuinely public information is open-source work.
Using stolen credentials or defeating an access control is not — that is the Computer Fraud and Abuse Act line.
Intercepting communications in transit (the Wiretap Act, 18 U.S.C. §2511) and reaching into an account or stored messages that are not yours (the Stored Communications Act, 18 U.S.C. §2701) are off-limits too, no matter how newsworthy the result.
Terms of service and other laws can still shape how you may collect, so anything aggressive belongs in front of counsel before you do it.
We do not perform unlawful access, and we do not help anyone else do it.
Provenance, corroboration, and when to hold
The ethic that separates verification from rumor is restraint.
First Draft’s rule is the one to adopt: if in doubt, do not use it.
A single unverifiable source, a provenance you cannot reconstruct, or a chain you cannot show is a reason to wait.
Build corroboration from independent signals, preserve the original, and be candid about your confidence.
This is the same discipline that makes forensic evidence defensible — show your work, and do not claim more than the material supports.
Where forensics supports the reporting
A forensic practice supports OSINT-driven stories at the edges where credibility is tested: confirming the integrity of a file, preserving and documenting material to a standard that survives challenge, and corroborating a finding with artifact-level evidence.
It does not become the reporter.
Where a matter moves from public-record verification into formal investigation — for legal or corporate purposes — that is a different engagement; see our OSINT investigation services for legal and corporate matters.
What working with us means
- Written scope before any work. You see a written scope — deliverables, timeline, and price — and approve it before we begin. You are never billed for work you did not authorize.
- We commit to findings, not outcomes. We tell you up front what the evidence can and cannot establish. Recovery, attribution, and prosecution are decided by banks, platforms, insurers, and courts — we produce the record they act on, and we put that distinction in writing.
- Every case is investigated, not just scanned. A credentialed examiner reviews every case before findings leave the practice. You get a documented investigation to court-admissible standards — not a single automated scan and a one-line answer.
- We will tell you if you do not need us. If a free or simpler step — a police report, an IC3 filing, a platform's own recovery flow — would resolve your situation, we point you there first.
Related guides
To harden the devices and accounts you do this work on, see digital security for journalists.
The overview of how forensics supports reporting is on the For Journalists hub.
