Module 1 — FREE: What OSINT is, and what it is not

The definition: OSINT is finding, checking, and reporting information that is already public, in a way someone else can repeat and verify. Three words do the work: already public, checked, and repeatable.

What counts as public: search engine results, public registries and filings, official sites and announcements, and posts anyone can view. A source is only as strong as its provenance — who published it, when, and whether it is the original or a copy of a copy.

What OSINT is NOT: not hacking, not pretexting, not buying private data, not doxxing, and not surveillance of a real person. In this course you practice on your own footprint, on public organisations, and on worked examples — not on a real neighbour, client, or stranger. If a step would make you uncomfortable explaining it in plain language to the person it concerns, stop.

Public vs. private: ask — was it published for the public? Who controls access? Would republishing it harm a private person? Being visible online is not the same as being intended for public use. A photo posted by mistake or a private post shared without permission is still out of bounds here.

Verification rule: never report a single-source claim as a fact. Use two independent public sources — two articles quoting the same press release count as one source, not two. Label every finding: Confirmed (two independent sources agree, original available), Likely (mostly agree, one detail unconfirmed), or Unverified (single source, copy of a copy, or conflicting sources).

Common mistakes: trusting the first search result, copying a copy instead of finding the original, treating a post as proof of the event behind it, collecting more than the question needs, and skipping the gap. Naming gaps is what makes the rest trustworthy.

Hands-on exercise:

1. List five kinds of information about yourself that are already public. For each, note where it is public and who can see it.
2. Write down one thing you thought was private but is not, and how it became public.
3. For each item, decide: keep it public, tighten it, or remove it if you can — one action per item.
4. Write your one-page personal OSINT boundary: what you will look up, what you will not look up, what you will not share about other people, and how you will label confidence.

Outcome: that boundary page. Keep it — you will use it in every later module.

Self-check — can you answer these in plain language?

1. Give a public source example, and an example of something visible online but still out of bounds here.
2. Why are two articles quoting the same press release not two independent sources?
3. A public post claims an event happened. What does the post prove, and what still needs a second source?
4. What confidence level do you give a single-source claim, and what do you do with it?
5. What is one thing on your own footprint you decided to tighten, and what action did you take?

Ground rule for every module: public information only, no hacking, no pretexting, no buying private data, no doxxing.

Close Module 1

Module 1 — FREE: What OPSEC is, and what it is not

The definition: OPSEC is thinking, before you post, share, send, or save something, about who could see it, what they could do with it, and whether it is worth the risk. Three questions do the work: who could see this, what could they learn from it, and what would that cost me?

What leaks: photos show backgrounds, uniforms, signs, and screens. Posts show routines, locations, friends, and plans. Metadata shows when and where a photo was taken. A single post rarely matters — a pattern of posts does. That pattern is what OPSEC is for.

What OPSEC is NOT: not hiding from everyone, not deleting everything, and not spying on other people. It is not a reason to target a real person, collect their private information, or test their security without permission. In this course you practice on your own accounts, your own devices, and worked examples — not on a real neighbour, client, or stranger.

Your threat model: write down, in plain language, who you are protecting yourself from (a scammer, a stranger online, a thief, an ex, a data broker), what they could realistically do, and what matters most to protect — your money, your home, your family, your work, your location. A threat model for a scammer is different from one for a burglar. Start with the realistic one, not the worst one.

The pause rule: before you post, send, or share, pause and ask — does this show where I am, where I live, when I am away, who I am with, or something I would not tell a stranger face to face? If yes, do not post it, or strip the detail first.

Hands-on exercise:

1. List five things about yourself that someone could learn from your public posts and photos. For each, note where it shows and who can see it.
2. Pick the one that worries you most, and write down what someone could do with it.
3. For each item, decide: keep it, tighten who can see it, or remove it — one action per item.
4. Write your one-page personal OPSEC boundary: what you will share, what you will not share, who you will not share it with, and how you will pause before posting.

Outcome: that boundary page. Keep it — you will use it in every later module, and in the OPSEC Audit lab below.

Self-check — can you answer these in plain language?

1. Give an example of a post that is harmless on its own, and harmful as part of a pattern.
2. What is a threat model, and why does it come before any tool or setting?
3. A photo shows your street sign in the background. What does it leak, and what do you do before posting it?
4. What is the pause rule, in your own words?
5. What is one thing on your own footprint you decided to tighten, and what action did you take?

Ground rule for every module: defensive only, on your own accounts and devices. No targeting a real person, no doxxing, no collecting private information about anyone else.

Close Module 1