Subscribe now

This is not a tool list. There are plenty of those, and most of them teach you to run before you know how to walk. This is about the mindset and the habits that determine whether someone who gets into OSINT develops into a practitioner or stays a person who is good at searching.

The Difference Between Searching and Investigating

Searching is a task. You put something into a box and see what comes back. Most people who think they are doing OSINT are searching. They are good at it. They know more tools than the average person and they can find things other people miss. That is genuinely useful. It is not the same as investigating.

Investigating starts before the search begins. It starts with a question. Not a subject, not a name, not a topic: a specific question that the investigation needs to answer. Before you open a browser, before you run a query, before you reach for a tool, you need to know what you are trying to find out and what a complete answer looks like. Without that, you are not investigating. You are browsing with better tools.

The practical way to enforce this habit early is to write the question down before you do anything else. A sentence or two, specific enough that you could hand it to someone else and they would know what they were supposed to find out. If you cannot write it clearly, you do not know what you are investigating yet. That is useful information. It means you need to think before you search, not after.

The second part of the mindset shift is what you do with what you find. Searching produces results. Investigating produces assessments. A result tells you something exists. An assessment tells you what it means, how confident you are in that interpretation, and what the gaps are. Most beginners stop at results and call the work done. The whole second half of the process never happens, because nobody told them it was supposed to.

The third part is documentation. Every piece of information you collect during an investigation needs to be recorded with enough context that you or someone else could reconstruct how you found it. The source, the date it was retrieved, the platform or database it came from, the search terms or method used to surface it. This feels like overhead until the first time you need to go back and verify something you found three weeks ago and cannot remember where it came from. Documentation is not bureaucracy. It is what makes your work usable and defensible.

The First Tools Worth Learning

The tools worth learning first are the ones that build transferable skills rather than platform-specific workflows. Search engines are the right starting point because understanding how to construct a precise query, how to use operators to narrow or expand results, and how to think about what a search engine indexes versus what it does not is foundational to almost everything else.

Google’s advanced search operators or “Google Dorks” are not exotic. Site-specific searches, exact phrase matching, date range filtering, and file type searches are available to anyone and underused by almost everyone. Understanding why they work the way they do, rather than just memorizing the syntax, is what lets you apply the underlying logic to other search interfaces.

Archive services come next. The Wayback Machine is essential because the open source environment changes constantly, and content that exists today may not exist tomorrow. Building the habit of archiving what you find as you find it, rather than bookmarking live URLs, is something experienced practitioners do automatically and beginners almost never do until they have lost something important.

Share

Reverse image search is one of the highest-value skills relative to the effort required to develop it. Google Lens, PimEyes, and Yandex’s image search each index different content and return different results, and using all 3 rather than just the most familiar one meaningfully improves coverage. Understanding what reverse image search can and cannot tell you, including its significant limitations with AI-generated content, is part of the skill.

Document and record research varies significantly by country and jurisdiction but is worth learning in whatever context is most relevant to your work. Understanding what public records exist, where they are held, what they contain, and how to request or search them is a durable skill that does not become obsolete when a platform changes its API.

Social media investigation as a skill set is worth learning deliberately rather than picking up informally. Understanding how to search platform-native archives, how to use advanced search features that are not surfaced prominently, how to capture and archive what you find, and how to interpret what account activity and history do and do not tell you is a distinct body of knowledge from simply being a social media user.

The Most Common Beginner Mistakes

Starting with tools rather than questions is the root cause of most beginner errors. When you start with a tool, the tool shapes what you look for. You find what the tool is capable of returning rather than what the investigation requires. Start with the question. Let the question determine which tools are appropriate.

Accelerated Introduction to Intelligence

Treating search results as findings is the second most common mistake. A search result tells you that a piece of content exists somewhere on the internet. It does not verify the content’s accuracy, establish its original context, or confirm that the source is what it appears to be. Every result that matters needs to be evaluated, not just collected. The speed at which results come back can create a false sense that the work is moving fast. Collecting faster is not the same as investigating better.

Over-reliance on a single tool or a single source produces narrow coverage that looks complete because you do not know what you are missing. The practitioner who only uses Google, who only checks 1 social media platform, who only consults 1 database, has investigation-shaped blind spots they are not aware of. Building the habit of asking what you have not checked is as important as developing skill with the tools you have.

OSINT Username Tools

Failing to document as you go is recoverable in small investigations and increasingly costly as investigations grow. The instinct to document after the fact, once the work feels done, produces incomplete records and introduces errors from memory. Document during collection, not after.

Confusing volume with thoroughness is a trap that produces deliverables nobody can use. An investigation that has pulled every possible result across every available platform, without any analytical layer distinguishing what matters from what does not, is not a thorough investigation. It is a data dump. Thoroughness is defined relative to the question being answered, not relative to how much was collected.

Sharing unverified information because it seems credible is a reputational risk that compounds over time. In a field where accuracy is the professional currency, the practitioner who consistently pushes unverified claims because they look plausible erodes their own credibility faster than almost any other mistake. Verify before you share, and be explicit about what has not been verified when you share it.

What Good Habits Look Like Early

The practitioners who develop well are the ones who slow down at the beginning of an investigation rather than racing to collection. They write the question down. They think about what sources would be relevant and why. They note what they do not know before they start looking for what they do. They document as they go. They distinguish between what they found and what it means.

Intro to Intelligence Report Writing

These habits feel slower than just opening a browser and starting to search. Over the course of a real investigation, they produce better results in less total time, because they prevent the rework that comes from collecting in the wrong direction and the credibility damage that comes from advancing findings that do not hold up.

The practitioners who skip these steps early tend to hit a ceiling. They get fast at collection and the outputs look like a lot of work, but they cannot make the jump to producing something that actually serves the person who asked for it. The ceiling is not a talent problem. It is a habit problem, and it is much easier to build the right habits at the start than to rebuild them after years of working a different way.

The posts on this publication about the intelligence cycle, source reliability, and writing a proper intelligence requirement are not abstract theory. They are the framework that these habits are built on. If any of them felt like they were describing a discipline you wanted to develop, you are in the right place.

Some links in this post may be affiliate links. If you purchase through them, I may receive a small commission at no additional cost to you. This helps keep the blog running and the content free.

Subscribe now

Share

Leave a comment

The OSINTion Academy

Calibrated Citizen Academy

Calibrated Citizen Blog

The Pre-Mortem Intelligence Blog

True Blue Tactical Blog

This post covers where the verification process stands right now: what metadata can and cannot tell you, what visual artifacts are still worth checking, why reverse image search behaves differently with AI content, and what the emerging detection tools can and cannot be trusted to do.

Subscribe now

Metadata Analysis

Metadata is often the first thing practitioners check and the first thing that gets stripped or altered, intentionally or not. Most images shared on social media have already lost their original EXIF data through platform compression and re-encoding, which means the absence of metadata tells you very little on its own. A real photograph shared through a messaging app and then re-uploaded to a forum will often arrive with no more metadata than an AI-generated image.

What metadata can sometimes provide is a positive signal in the other direction. Some AI generation tools embed identifying information, either through the C2PA Content Credentials standard, which a growing number of platforms and generation tools support, or through tool-specific metadata fields that survive at least the first round of sharing. If an image carries C2PA credentials indicating it was generated or edited by a specific AI tool, that is strong evidence. The catch is that this metadata is easy to strip, either deliberately or as a byproduct of how an image gets re-saved, screenshotted, or re-compressed during sharing. Its presence is meaningful. Its absence is not.

For video, container-level metadata can sometimes reveal the software used to create or render a file, which is occasionally useful when that software is itself an AI generation tool rather than standard editing software. This is inconsistent enough that it should be treated as a secondary check rather than a primary method.

Share

The practical takeaway is that metadata analysis is worth doing because it occasionally provides a clean answer, but a negative or empty result should not be read as evidence that the content is authentic. It just means the metadata did not help.

Visual Artifacts and Inconsistencies

Despite the overall improvement in generation quality, certain categories of artifact remain useful, particularly in video and in images with complex scenes.

Hands, teeth, and ears remain disproportionately difficult for image generators to render consistently, especially in scenes with unusual poses or partial occlusion. This is less reliable than it was, but in a meaningful percentage of generated images these details still show subtle errors: an extra joint, asymmetry that does not match how the body actually works, teeth that do not align with the jaw structure.

Text rendering within images has improved substantially but still produces errors under scrutiny, particularly with text on signage, labels, or background elements that were not the focus of the generation prompt. Letters that are almost but not quite correct, logos that are close approximations of real brands but subtly wrong, and text that becomes incoherent at the edges of the frame are all still common.

Reflections, shadows, and lighting consistency are some of the more durable signals because they require the generator to maintain physical consistency across the entire frame, which is harder than getting any single element right. Check whether shadows fall in directions consistent with the apparent light source, whether reflections in glass, water, or mirrors show the same scene that is visible directly, and whether lighting on a subject’s face matches the lighting on their surroundings.

For video specifically, temporal consistency is the area where artifacts are most likely to appear. Background elements that subtly shift or warp between frames, hair or fabric that moves in ways inconsistent with physics, and faces that show small inconsistencies frame to frame even when any single frame looks convincing. These artifacts are often invisible at normal playback speed and become apparent when stepping through frame by frame or slowing the video down significantly.

Edge artifacts around the boundaries of people or objects, particularly where a subject meets a complex background, can show telltale blurring, color bleeding, or unnatural smoothness that differs from the texture of the rest of the image.

None of these signals is individually conclusive. The practical approach is the same as with any other OSINT verification task: look for a cluster of small inconsistencies rather than expecting one obvious tell, and weigh the cumulative picture rather than dismissing a single anomaly or treating a single anomaly as proof.

Reverse Image Search Limitations

Reverse image search is one of the most reliable tools in the OSINT toolkit for verifying real photographs, and it behaves very differently with AI-generated content in ways that practitioners need to account for.

When a real photograph has been used before, reverse image search can often find the original context, the original date, or prior instances of the same image being used in a different setting. This is the core mechanism behind a large portion of image verification work.

AI-generated images generally will not return prior instances through reverse image search, for the simple reason that the image did not exist before it was generated. A practitioner running a reverse image search and getting no results might interpret that as the image being original and therefore more likely authentic. With AI-generated content, the opposite can be true: a lack of any prior instances is consistent with both an authentic original photograph and a newly generated image, and reverse image search alone cannot distinguish between those two explanations.

There is a secondary use case that remains valuable. If a reverse image search does return a result showing the same image, or a very similar one, associated with an AI image generation platform, a prompt-sharing community, or a stock AI-image marketplace, that is strong evidence of AI origin. The search is not finding the “real” version of the image. It is finding evidence of the image’s existence within AI-generation ecosystems.

The broader point is that reverse image search needs to be understood as a tool that answers a different question for AI-generated content than it does for real photographs, and practitioners need to adjust their interpretation of both positive and negative results accordingly.

Emerging AI Detection Tools

A growing category of tools is being built specifically to detect AI-generated content, and the practical reality is that these tools are improving quickly but remain inconsistent, particularly across different generation models.

Detection tools generally work by analyzing statistical patterns in the image data that are characteristic of generation models, looking for the kinds of artifacts that generation processes tend to leave behind even when they are invisible to the human eye. Some tools focus on specific generation models and perform well against those models while performing poorly against others. Detection accuracy also tends to degrade significantly once an image has been compressed, resized, or re-encoded, which describes the vast majority of images encountered in real investigations.

The practical guidance for using these tools is to treat their output as one data point among several rather than a verdict. A detection tool returning a high confidence score that an image is AI-generated is meaningful and worth weighing heavily. A detection tool returning a low confidence score is much weaker evidence of authenticity, because it may simply reflect a generation model the tool was not trained to detect, or an image that has been processed in ways that obscured the relevant signals.

For video, detection tools generally analyze either individual frames using image-based methods or look for temporal artifacts across frames. The same caveats apply, with the added complexity that video compression is typically more aggressive than image compression and can further degrade the signals these tools rely on.

The detection tooling landscape is moving quickly, and tools that perform well against current generation models may perform poorly against models released six months later. This is not a space where a practitioner can learn a tool once and consider the skill set complete. Staying current with what tools exist and what their actual performance looks like against current-generation AI media is part of the ongoing work.

Why This Matters for Disinformation Tradecraft

The disinformation investigations covered in the previous post on this publication rely on establishing the authenticity and origin of content as a foundational step. A narrative built around a fabricated image or video is a different investigative problem than a narrative built around a real image used in a misleading context, and getting that distinction right at the start shapes everything that follows.

As AI-generated media becomes more difficult to distinguish from real content through casual inspection, the verification step becomes both more important and more demanding. The practitioners who treat this as a checklist item, running one tool and accepting whatever it returns, are going to miss things. The practitioners who understand what each method can and cannot tell them, and who weigh multiple imperfect signals against each other, are the ones whose assessments will hold up.

This is not a problem that gets solved once. The generation tools keep improving, the detection tools keep adapting, and the gap between them keeps shifting. Building the habit of methodical, multi-method verification now is what keeps a practitioner’s tradecraft relevant as that gap continues to move.

Some links in this post may be affiliate links. If you purchase through them, I may receive a small commission at no additional cost to you. This helps keep the blog running and the content free.

Subscribe now

Share

Leave a comment

The OSINTion Academy

Calibrated Citizen Academy

Calibrated Citizen Blog

The Pre-Mortem Intelligence Blog

True Blue Tactical Blog

Disinformation is not a new problem, but the scale at which false narratives now spread and the infrastructure that supports their spread has changed significantly. What used to require state-level resources to execute can now be done by small groups or individuals with access to social media accounts, a little patience, and some familiarity with how platform algorithms amplify content. The investigative response to that shift has also matured, and open source techniques now form the backbone of how researchers, journalists, and analysts trace where false narratives come from, how they move, and who is coordinating their spread.

This is applied OSINT work. It is not abstract analysis of a trend. It is methodical collection and analysis against a specific target: the network and infrastructure behind a piece of disinformation, and the people operating it.

Starting with the Narrative

Disinformation investigations typically start with a claim. Something is circulating that is demonstrably false or significantly misleading, and the question is where it came from and how it got to where it is now.

Subscribe now

The first analytical task is to establish what the claim actually says, in its most precise form, before attempting to trace it. This sounds obvious and gets skipped constantly. A claim that gets paraphrased or summarized before it is traced will produce a different search trail than the actual language of the original claim. Disinformation often spreads in specific formulations, and those formulations are what you search against.

Once the claim is precisely documented, the tracing process begins. The goal is to find and date the earliest instance of the specific claim in the form it is currently circulating. This is not the same as finding the first time the underlying subject was discussed. It is finding the first documented instance of this specific false narrative in this specific form. The difference matters because disinformation often layers false framing onto real events, and confusing the origin of the event with the origin of the false narrative is a common analytical error.

Tools like reverse image search, Google’s verbatim search, and archive services including the Wayback Machine and archive.today are essential here. Platform search with precise date filtering helps establish the timeline. The goal is to build a chronological record of the claim’s documented appearances, working backward from the current circulation to the earliest traceable instance.

Identifying Coordinating Accounts

Once the timeline of the narrative is established, the next layer of investigation focuses on the accounts amplifying it. Organic spread and coordinated spread look different when you examine them at the account level, and the techniques for distinguishing between them are well-established.

Account age relative to the current activity is one of the first signals. An account created recently that is posting at high volume on a specific topic, or an account that was dormant for an extended period and then suddenly became active around a specific event, warrants closer examination. Neither pattern proves coordination, but both appear consistently in documented influence operations.

Behavioral clustering is more diagnostic. When multiple accounts post the same content within a narrow time window, use identical or near-identical language, follow the same accounts, or engage with each other’s content in ways that suggest coordination rather than independent discovery, the pattern is worth mapping. One account doing this is noise. A cluster of accounts doing it simultaneously is a signal.

Profile construction tells a story when examined carefully. Accounts built for inauthentic amplification tend to have specific characteristics: profile photos that do not withstand reverse image search, bios that are either generic or suspiciously well-constructed, follower-to-following ratios that suggest artificial inflation, and posting histories that show either suspicious uniformity or gaps inconsistent with organic account use. None of these characteristics is conclusive on its own, but a cluster of them on a cluster of accounts engaged in the same behavior pattern is meaningful.

Share

The tools available for this layer of investigation include network visualization platforms like Gephi and Maltego for mapping relationship patterns, Botometer and similar services for behavioral scoring, and manual examination of account histories through platform-native search and archived captures of profile states over time.

Mapping the Influence Network

Individual accounts are rarely the full picture. Disinformation campaigns typically involve a distribution architecture: a set of accounts or pages that originate content, a set of amplifiers that push it to wider audiences, and downstream accounts that pick it up organically after it has gained enough apparent momentum to look credible. Mapping that architecture is the third layer of the investigation.

The origination layer is often the most difficult to identify because sophisticated operations deliberately obscure the true origin. Content may be introduced through low-profile accounts or obscure pages before being picked up by larger amplifiers, making the amplifiers appear to be the original source. Tracing backward through the share and repost chain, using timestamps to establish the actual order of propagation, is the method for getting past that misdirection.

Infrastructure analysis adds depth to the account-level mapping. Websites that host the original content or that multiple accounts in the network link to can be investigated through WHOIS records, registration history, hosting patterns, and cross-referencing against known disinformation infrastructure databases maintained by organizations like the Stanford Internet Observatory and the Digital Forensic Research Lab. Accounts that share the same external links, the same website references, or the same contact information in their profiles are connected in ways that transcend platform-level relationship mapping.

Metadata analysis of images and documents shared across the network can surface additional connections. Images shared by nominally independent accounts that share the same creation metadata, the same editing software fingerprint, or the same geographic EXIF data were likely produced from the same source. Documents with shared authorship metadata or creation timestamps that cluster around the same narrow window suggest centralized production regardless of how the distribution was structured.

Financial infrastructure is an underexplored area of disinformation investigation in the open source space. Accounts and pages that monetize engagement, that run advertising, or that solicit donations leave traceable financial infrastructure that can connect nominally independent operations to common ownership or funding.

What This Looks Like in Practice

A completed disinformation investigation of this type produces several distinct outputs. A timeline of the narrative’s spread, from first documented instance to current circulation, with the key amplification events identified. A network map of the accounts and infrastructure involved, with the origination layer, amplification layer, and organic downstream spread distinguished from each other. An assessment of whether the pattern reflects coordinated inauthentic behavior or organic spread of a false claim, with the evidence base for that assessment documented. And an identification of any infrastructure, accounts, or coordination patterns that connect this specific instance to prior documented campaigns.

That last element is where the investigative work connects to the broader intelligence picture. Disinformation operations rarely operate in isolation. Accounts, websites, and coordination patterns that appear in one campaign often appear in others, and documenting those connections is what transforms a single-incident investigation into an understanding of the actors and infrastructure behind a sustained effort.

It is also worth noting what this type of investigation does not produce without additional collection. It can establish that coordination occurred. It can map the infrastructure and accounts involved. It can identify the timeline and amplification pattern. It cannot, on open source collection alone, definitively identify the human beings behind the operation or their institutional affiliations without additional evidence. Overstating what the open source evidence supports is one of the more common and consequential errors in this field, and the standard of evidence for attribution claims should be treated with the same rigor applied to any other high-stakes analytical judgment.

The Tradecraft Foundation

The techniques described in this post are applications of standard OSINT tradecraft to a specific target set. The timeline reconstruction is source reliability and corroboration analysis applied to a narrative chain. The account analysis is entity profiling applied to social media infrastructure. The network mapping is link analysis applied to a coordination problem. None of it requires specialized tools that are unavailable to a trained open source practitioner. The methodology is the same. The target is different.

What it does require is analytical discipline, patience with a methodical process, and careful documentation of findings in a form that can withstand scrutiny. The subject matter is contested and the stakes for accuracy are high. An investigation that incorrectly attributes a disinformation campaign causes real harm to the people or organizations it misidentifies. The same standards of evidence, confidence calibration, and sourcing discipline that apply to any intelligence product apply here with at least as much force, and probably more given the public visibility this work often receives.

The OSINT community is well-positioned to contribute meaningfully to this space. The tradecraft is there. The analytical frameworks developed for entity investigation, network mapping, source reliability, and finished intelligence production map directly onto the disinformation investigation workflow. The application is a choice about where to direct skills that are already developed and a discipline that is already mature enough to do the work rigorously.

Some links in this post may be affiliate links. If you purchase through them, I may receive a small commission at no additional cost to you. This helps keep the blog running and the content free.

Subscribe now

Share

Leave a comment

The OSINTion Academy

Calibrated Citizen Academy

Calibrated Citizen Blog

The Pre-Mortem Intelligence Blog

True Blue Tactical Blog

Most geolocation work in OSINT focuses on the built environment. Street signs, architecture, road markings, storefronts, utility infrastructure. These are the signals practitioners learn first and reach for most often. They are also signals that can be obscured, cropped out, or simply absent depending on the image and how carefully the subject managed their surroundings before the shutter closed.

The natural environment is less controllable. A person trying to hide where they are does not think to remove the flowering plant in the background or position themselves away from the snake basking on the rock nearby. Flora and fauna appear in images constantly and get ignored constantly, because most practitioners have not developed the habit of reading them as geographic data.

They are geographic data. Not precise coordinates, but range data that can dramatically narrow a search area and, in some cases, add a temporal dimension that other geolocation signals cannot provide.

The Core Concept

Every species has a geographic range determined by climate, elevation, soil type, water availability, and ecological relationships with other species. That range is documented, often in significant detail, through scientific literature, species databases, field guides, and citizen science platforms. When a species appears in an image, its documented range becomes a geographic constraint on where that image could have been taken.

Subscribe now

The precision of that constraint varies. Some species have ranges spanning multiple continents. Others are endemic to a single mountain range or river basin. The investigative value scales with specificity, but even a broad range eliminates large portions of the map and focuses the search in ways that other signals can then refine further.

Combined with other geolocation data, a species identification can be the piece that locks a location. On its own, it establishes where to look. That is often enough to meaningfully advance an investigation.

Flora as a Geographic Signal

Plants are ideal geolocation signals because they cannot move. A plant appearing in an image was growing in that location when the photo was taken. That is a stronger geographic anchor than many other signals in the frame.

The example of the Mojave Prickly Pear illustrates the method well. That species has a documented range concentrated in the Mojave Desert and surrounding regions. An image showing a missing person alongside a blooming specimen narrows the search to that range, and then the bloom window, April through July, narrows it further temporally. You are not looking at the whole Southwest. You are looking at specific desert regions during a specific season.

The same logic applies across plant categories. Tree species carry geographic information because their ranges are constrained by climate and elevation. Coastal redwoods do not grow in the Rockies. Saguaro cacti do not grow in the Pacific Northwest. Spanish moss grows where humidity and temperature support it, which eliminates most of North America. Certain wildflower species bloom in ranges so specific that a positive identification puts you within a county or two.

Invasive species add an interesting dimension. Their ranges are expanding and are actively tracked, which means their presence in an image can sometimes be dated as well as located if the expansion front is well-documented in that area.

Share

The practical workflow starts with isolating the plant from the background and running it through a species identification tool. iNaturalist, PlantNet, and Google Lens all perform plant identification with varying degrees of accuracy. A confident identification goes next into the species range maps, which are available through sources like the USDA Plants Database, the Global Biodiversity Information Facility, and iNaturalist’s own range data. Cross-reference the range with whatever other geographic signals are present in the image and the search area contracts.

Fauna as a Geographic Signal

Animals are more complex than plants for two reasons. They move, and their ranges can shift with season and environmental conditions. Neither of these complications eliminates them as geolocation tools. They just require a more layered analysis.

The Ridge-nosed Rattlesnake is a strong example because that species, Crotalus willardi, has one of the more specific ranges of any North American rattlesnake. It is found in isolated mountain ranges along the Arizona and New Mexico border with Mexico, including the Huachuca, Santa Rita, and Chiricahua ranges. An image containing a Ridge-nosed Rattlesnake is not just pointing at the American Southwest. It is pointing at a handful of specific sky island mountain ranges. That is a significant constraint.

The same principle applies across the animal kingdom with varying levels of precision. Certain bird species are regionally endemic and appear nowhere else. The California Condor’s range, even in its recovered state, remains geographically limited. The Gila Woodpecker is a desert species whose range tells you something specific about where the image was taken. Insects are often highly localized. The Miami Blue butterfly exists in a range so small that a confirmed sighting is essentially a location.

Mammals are generally less useful because larger mammals tend to have broader ranges, but exceptions exist. Marine mammals can constrain coastal location. Certain bat species are range-limited. Livestock breeds and their regional distribution patterns can provide soft geographic evidence in agricultural settings.

The identification workflow for fauna parallels the flora approach. Isolate the animal, identify the species using iNaturalist, Merlin Bird ID for avian subjects, or reverse image search with species-specific terms, then map the range. The field guide literature for most species documents not just range but habitat preference within that range, which adds another layer of constraint.

Adding the Temporal Dimension

This is where flora and fauna analysis separates itself from most other geolocation methods. Many species signals are not just geographic. They are seasonal.

Flowering plants bloom on documented schedules that vary by latitude, elevation, and annual weather patterns, but fall within known windows. A plant in bloom is not just telling you where the image was taken. It is telling you approximately when. A blooming Mojave Prickly Pear is an April-through-July image. A blooming ocotillo is typically a March-through-June image at lower elevations. Documented bloom windows, combined with geographic range, produce a space-time constraint that can be cross-referenced against known timelines in an investigation.

Foliage state adds another layer for deciduous trees and shrubs. A tree in full leaf narrows the window to the growing season for that species at that latitude and elevation. A tree in bare winter dormancy does the opposite. Neither is as precise as a bloom window, but both eliminate significant portions of the calendar when combined with species identification and geographic range.

Migratory birds operate on predictable seasonal schedules. A migratory species present in an image narrows the window to the months it passes through or resides in that region. The presence of a Ruby-throated Hummingbird in an image taken in the eastern United States narrows the window to roughly April through October in most of its range. Breeding plumage visible on a bird tightens that further.

Insect activity is similarly seasonal. Certain butterfly species fly only during specific weeks of the year. Cicada emergences are among the most precisely timed biological events documented and can narrow an image to within days in regions with known emergence schedules.

None of this produces a timestamp. It produces a range of possible times that can be combined with other temporal signals in the image to narrow the window.

Limits and Honest Accounting

Range maps are representations of known occurrences and are not perfectly complete. A species appearing outside its documented range is unusual but not impossible, particularly for mobile animals, species undergoing range expansion, or escaped and introduced individuals. A positive identification should be treated as strong evidence that constrains the search, not as proof of location.

Identification tools make errors. iNaturalist and similar platforms are good and improving, but confident misidentifications happen, particularly with species that look similar to each other. Any identification driving investigative conclusions should be cross-referenced against field guide descriptions and, where stakes are high, reviewed by someone with direct expertise in the relevant taxa.

Indoor plants and pets complicate the analysis in different ways. A houseplant or an ornamental species purchased from a nursery is not a reliable geographic signal because it was placed there rather than growing naturally. The same applies to pets, zoo animals, or captive specimens appearing in images. Context matters for determining whether a species signal represents a natural occurrence or a human-introduced one.

Within those limits, biogeographic analysis is a legitimate and underused tool in the OSINT practitioner’s collection methodology. The built environment gets obscured. The natural environment is harder to hide and rarely thought about by the people being investigated. Learning to read species as geographic data is a skill that pays off in the cases where everything else in the frame has been carefully controlled and the only thing the subject forgot about was the plant growing behind them or the animal that wandered into the shot.

Leave a comment

The OSINTion Academy

Calibrated Citizen Academy

Calibrated Citizen Blog

The Pre-Mortem Intelligence Blog

True Blue Tactical Blog

Research personas have been part of investigative and intelligence work for as long as both disciplines have existed. The practice predates OSINT as a named field. Journalists go undercover. Law enforcement runs confidential informants. Investigators build cover identities to access communities that would otherwise be closed to them. None of this is new.

What is new is that building a convincing research persona used to require significant time, skill, and often a network of support infrastructure. AI tools have changed that equation in ways the OSINT community is still working through. For practitioners who have never built a persona before, AI makes the entry point more accessible than it has ever been. For experienced practitioners who have been doing this manually for years, AI removes a significant portion of the grunt work and improves consistency in ways that matter operationally.

This post covers both.

Why Research Personas Exist

Before getting into the how, the why matters. A research persona is an identity constructed for the purpose of accessing information or communities that would not be accessible to the practitioner under their real identity. The most common use cases in OSINT work are access to closed or invite-only online communities, source development in environments where the researcher’s affiliation would compromise their ability to gather candid information, and platform-level investigations where the subject would recognize and avoid a known researcher.

Subscribe now

The ethical frame here is straightforward: research personas are tools for access, not tools for deception as an end in itself. The goal is to observe, collect, and report accurately. A persona used to infiltrate a community spreading disinformation about a public health crisis is serving a legitimate research function. The same persona used to spread that disinformation is not. The distinction is about what the persona does once it has access, and that distinction sits entirely with the practitioner.

It also bears stating that research persona use carries legal and platform terms of service considerations that vary by jurisdiction, platform, and context. Those are the practitioner’s responsibility to understand before deployment.

What Makes a Persona Fail

Before building, it is worth understanding why personas get burned. The most common failure modes are thin backstory, inconsistent voice, implausible history, and activity patterns that do not match the claimed identity.

Thin backstory means the persona has a name and maybe a profile photo but nothing underneath. Ask it a question about its hometown and it cannot answer. Reference a cultural touchstone from its claimed background and it does not respond naturally. Communities, particularly tight ones with high social awareness, probe new members. A persona that cannot pass basic social interrogation does not last.

Inconsistent voice is subtler but just as damaging. If a persona claims to be a 45-year-old tradesman from rural Georgia and writes like a 28-year-old marketing professional from Austin, people notice. Not always consciously. But they notice.

Implausible history means the account was created yesterday but claims years of involvement in a niche community, or it has a job title that does not match its stated experience, or details that contradict each other across different conversations. Experienced community members keep track of things new members say. Inconsistencies accumulate.

Activity patterns are the operational failure mode. A persona that only posts during a 9-to-5 window in one time zone, never engages on weekends, and shows no organic activity outside the specific topic being investigated looks like what it is.

Where AI Changes the Work

AI tools address the first three failure modes directly and, when used thoughtfully, the fourth.

Backstory generation is where AI earns its place fastest. A well-prompted language model can produce a detailed, internally consistent personal history: childhood location, family structure, formative experiences, work history, hobbies, opinions on topics adjacent to the investigation, cultural references appropriate to the claimed background, and speech patterns that match the demographic profile. What used to take hours of careful manual construction can be drafted in minutes and refined from there.

Share

The key word is refined. AI-generated backstory is a first draft, not a finished identity. The practitioner needs to read it, internalize it, identify anything that does not feel authentic, and revise until it holds up. The persona is not the document. The document is a reference for the practitioner operating the persona. If you have not internalized the backstory well enough to answer questions in real time without checking notes, the persona is not ready.

Voice consistency is another area where AI is genuinely useful. Once a backstory and demographic profile are established, an LLM can generate sample posts, comments, and conversational responses in a voice consistent with that identity. This serves two purposes. First, it gives the practitioner a corpus of reference material for how the persona sounds. Second, it can help draft content for the persona’s public-facing activity during the warm-up phase, when the account is building organic history before being deployed for the actual research purpose.

Backstory coherence checks are underused. Feed an LLM the persona document and ask it to probe for inconsistencies, implausibilities, or details that would stand out to someone familiar with the claimed background. This is a faster version of the red team exercise that experienced practitioners do manually, and it catches things a single author misses because they wrote everything and cannot read it fresh.

Building a Warm Account

A research persona deployed immediately after creation is a liability. Platforms, communities, and alert members all apply more scrutiny to new accounts. The warm-up phase is the period of organic activity that makes the account look like it has been living its life before the investigation started.

AI-assisted content generation during this phase requires discipline. The posts and comments need to be about things the persona actually cares about based on its backstory, not the investigation topic. A persona built to investigate an extremist community should not be posting about extremist topics during warm-up. It should be posting about whatever else its identity would care about: sports, local news, a hobby, a professional interest. The investigation topic comes later, after the account has established a pattern of genuine-looking activity.

Scheduling tools and deliberate variation in posting times address the activity pattern problem. Build a posting schedule that reflects the persona’s claimed life: less frequent during claimed work hours, active in the evenings, occasional weekend activity, gaps that correspond to things a person in that life would actually be doing.

What AI Cannot Do

AI can generate backstory. It cannot generate judgment. The practitioner operating the persona has to know when to engage and when to hold back, when a question is a probe and when it is just conversation, when the persona is in danger of being burned and when it is fine. None of that comes from the backstory document or the voice samples. It comes from experience and situational awareness that only develops through doing the work.

AI-generated profile photos are a specific vulnerability worth addressing. Synthetic portrait images have improved significantly, but they have detectable artifacts and they do not hold up to reverse image search in the same way a real photograph does. A stolen or AI-generated photo that gets flagged ends an investigation. Persona photo strategy is a separate discipline and a longer conversation, but the short version is that AI-generated headshots are not a safe default.

Operational security for the practitioner behind the persona is also outside the scope of what AI helps with. Device separation, account isolation, network hygiene, and the procedural discipline required to keep the persona and the practitioner’s real identity from bleeding into each other are human problems that require human solutions. A persona that is operationally airtight but tied to the investigator’s real device or IP address is not actually protected. AI makes the persona more convincing. It does nothing to protect the person running it.

Connecting It Back

The first post in this series covered AI as a tool in the OSINT workflow, where it helps and where it fails. Research persona construction sits squarely in the category of legitimate AI assistance: it accelerates work that practitioners were already doing, improves consistency in areas where inconsistency has historically caused failures, and lowers the barrier to entry for newer practitioners developing the skill for the first time.

The failure modes from that first post still apply here. AI-generated backstory can contain implausibilities or demographic errors that the practitioner does not catch. Voice samples can carry artifacts that feel slightly off to a community member even if they cannot explain why. The output needs to be reviewed, refined, and tested before it goes anywhere near an active investigation.

A well-built research persona is an analytical asset. AI makes building one faster and more consistent than it has ever been. The judgment about when to use it, how to use it, and how to protect both the persona and the practitioner remains entirely human.

Leave a comment

The OSINTion Academy

Calibrated Citizen Academy

Calibrated Citizen Blog

The Pre-Mortem Intelligence Blog

True Blue Tactical Blog

Read more

Read more

Read more

Read more

Read more

Open source intelligence has spent the better part of the last decade building out an i…

Read more

Read more

Read more

Background

As some of you may know, Spread Privacy, the parent company of the DuckDuckGo search engine, announced on 20 July 2021 two new services. The first is similar to the disposable email address…

Read more

Sign up now so you don’t miss the first issue.

Subscribe now

In the meantime, tell your friends!

Read more

I was tossing around ideas for a blog about Poshmark. My first inclination was to check Micah Hoffman’s WhatsMyName tool (also available as Profiler in Recon-ng and as a Web Application). The tool ha…

Read more

Read more

Read more

As the world continues to battle the COVID-19 pandemic, some outlets are sharing samples of malware, while others are trumpeting politically biased information from both sides of the proverbial aisle…

Read more

I have been collecting old computers from friends and family for some time, and I always said that I was going to stand up a lab. I have finally started to put …

Read more