On the modern internet, disinformation spreads faster than ever. Fight it with OSINT.
With millions of individuals connecting over international platforms - from public Facebook pages to underground Telegram chats - a small falsehood can easily snowball into globally accepted fact. Bad actors know this, and they know how to use it; infecting public discourse, destabilizing democracies, and manipulating opinions on a global scale.
But don’t let the liars fool you into thinking all is lost. Disinformation campaigns can easily be dismantled under the sharp gaze of a determined OSINT investigator. In this guide, we’ll walk you through the essential techniques for using OSINT against disinformation: where to look, what to avoid, and how to trace falsehoods back to the source that spread them - all without tipping off your targets. Let’s uncover the lies.
What is Disinformation, and Why Use OSINT?
Disinformation is the technical term for deliberately false or misleading information. A ubiquitous tool in the modern bad actor’s playbook, disinformation is used to influence public perception or manipulate individuals’ behavior, usually to achieve a gain for the person or entity spreading it. Unlike misinformation (spreading lies by mistake, or without an agenda), disinformation is strategic. It’s often designed with a purpose in mind, like confusing the public on a pressing political issue to win an election, or damaging a business rival’s reputation to reduce their profits.
Disinformation is often spread through several online channels, sometimes simultaneously, from social media, to fake news sites,to messaging apps. These organised campaigns will even use AI-generated deepfakes and fake-but-official-looking documents to back up their lies, and may doctor real evidence to twist its meaning. But never fear; with the right tools and techniques, you can use OSINT against disinformation to sort truth from lies - and provide the necessary proof to convince others that they’re being deceived.
What makes OSINT so useful against disinformation is that it takes the fight to the source of fake news. Open Source Intelligence (OSINT) is all about working with publicly available information. So OSINT against disinformation can start with any freely available online data: exactly the kind of data disinformers rely on for their dodgy activities. By combining this data with strong analysis skills, an investigator can build a powerful toolkit for exposing false narratives, and holding their architects accountable.
(Find yourself forgetting the fundamentals of OSINT? Check out our OSINT Basics series for a refresher.)
The Quest for Truth: OSINT Techniques Against Disinformation
Now we understand the nature of online disinformation, it’s time to tackle it. There are many powerful techniques at an OSINT investigator’s disposal when working against disinformation; we’re going to break everything down so you can master them fast. Here’s our step-by-step strategy for OSINT against disinformation.
Map the Narrative
Fake news and false information has turned the online landscape into unsteady terrain. But as with any unknown territory, the first step to understanding the ins-and-outs is to get hold of a map. Then you’ll understand how to get to the heart of darkness - the truth.
So, the first step is to map the narrative. What is the false claim? Who are the stakeholders benefitting from it? Who is amplifying it, and where? And what were the circumstances where it first appeared? This is the first technique used by pro researchers to combat the most dangerous disinformations (like COVID conspiracy narratives); if it’s good enough for them, it’s good enough for us.
Look for patterns: Is the narrative aligned with a specific political agenda, for example? Or is it targeting a certain demographic group? Understanding the message gives you clues about the messenger, and could point you in the right direction for the rest of your investigation.
Identify Amplifiers and Bots
Once you’ve developed your map, you can start looking into the individual aspects of your target lie. Narratives will only spread if they’re being pushed by somebody, so find out who’s amplifying them. This could be real people, fake accounts, co-ordinated groups, or even specially-created bots with no other purpose than to push disinformation.
Searching through all of these different sources manually is time-consuming to say the least, and we definitely don’t recommend going through so much trouble in this day and age. Instead, you can rely on powerful OSINT tools like:
- Botometer: A tool that assesses the likelihood of Twitter/X accounts being bots, or real people. Created by Indiana University’s Observatory on Social Media, the Botometer is unfortunately only able to return results on accounts created before 2023. But if your target fits the range, this tool is invaluable.
- Whois Lookups: The easiest way to check out the domains of suspicious websites spreading fake news and falsehoods. You can use this protocol to instantly look up registration data, contact details, DNS records, and more for any domain name or IP address.
- Social network analysis (SNA): Use tools like OSINT Industries Palette to visually map influence networks; this will help you understand which accounts are influencing who, who they’re connected with, and how far their reach is spreading.
(Want to see OSINT Industries Palette in action? Check out our case study, ‘FSB Operatives Exposed: A Live OSINT Industries Palette Investigation’)
When you’re digging through the data, search for accounts with unusual posting patterns. If they’re posting at regular intervals or in inhumanly large volumes, consider if the account is a bot. Similarly, if an account only posts about one thing, or repeatedly shares the same false content on one or more platforms (also known as agendaposting); this could indicate that an account is part of a wider co-ordinated disinformation campaign.
Follow the Motivation
When looking for the source of disinformation, there’s one golden rule: follow the motivation. Disinformation by nature is rarely aimless. Ask yourself: who benefits? Who profits from this lie, politically, financially or ideologically? OSINT against disinformation can help you find the answer to this question.
- Isolate the first known appearance of the false narrative. Where is the first mention of the falsehood, and who was the first to post it online? Use a tool like OSINT Industries to look up the history of the account that posted for any clues about their views or financial history - or connections to known actors.
- Analyse metadata from images, videos and documents associated with the disinformation. They may be able to tell you where they were created, or how they were processed to support the narrative. Research the region for any ongoing political unrest, financial scandals etc.
- Follow the money. Check for funding sources through public records, legal documents or investigative reporting. Don’t forget to look up accounts with payment provider services like PayPal too, and cryptowallets connected to your target identity. As always, OSINT Industries is there to do the hard work for you here.
Leak databases and breached public data (handled carefully and legally by organisations like the ICIJ) can also reveal who’s behind sophisticated campaigns. Even linguistic analysis - examining the style and word choices, in layman’s terms - can sometimes point to a specific group or region.
Tie the Lie Together
As you probably know, you should always finish an investigation by correlating your data with other sources to create a complete picture. This is how you turn OSINT data into actionable insights; without concrete links between the evidence you’ve collected, you won’t be able to convince anyone that your OSINT against disinformation findings are real, and useful. As a final sweep:
- Use LinkedIn, Facebook, and Twitter to look for links to real people.
- Cross-check email addresses for repeats or links to other online accounts
- Review information on known disinformation actors for connections with any of the data you’ve gathered so far.
Some of the biggest breakthroughs in OSINT against disinformation missions happen by mistake: maybe the culprit forgot to log out of his real-name account before agendaposting, or a known actor reused a sock puppet username from another past campaign.
Staying Safe: Legal and Ethical Risks in OSINT Against Disinformation
Investigating disinformation can involve sensitive issues: political power, state responsibility, plus dodgy or even dangerous individuals. Protect yourself by reading up on local privacy and data protection laws (GDPR, CCPA, and CAN-SPAM etc.), and sticking tight to them. Never access to restricted systems or private data - after all, if it’s not public, it’s not OSINT. Lastly, always ensure you have strong OpSec, and practice good digital hygiene; for more on this, read our guide to keeping your investigations clean: ‘Scrubbing Up on OSINT Cyber Hygiene (Best Practices)’
Disinformation campaigns are sometimes orchestrated by powerful actors - individuals and groups you definitely don’t want to mess with. Working with legal advisors and maintaining strong operational security is essential to keep both you, and your OSINT against disinformation work safe.
Investigate Disinformation with OSINT Industries
Uncovering disinformation doesn’t have to be overwhelming; with the right tools, you can automate much of the heavy lifting. Our 1000+ lookup modules allow you to analyse almost any form of data with a simple search. You can even use reverse searches (like reverse email lookup and reverse phone lookup) to cross-reference information, reveal identities, and more.
What’s more, you can automate searches, visualize connections – with tools like OSINT Industries Palette – and automatically adhere to high ethical and legal standards without unnecessary complications. Disinformation may be the weapon of choice for modern manipulators - but with OSINT Industries, you’ll be ready to fight back.
To see examples of OSINT fighting misinformation, check out our Case Studies.
“If you have the tools and a trained analyst, you really have to go to a lot of effort to poison the well…”
Read: The Man in the Cybertruck: OSINT Decodes Livelsberger's Final Message
