Open-source intelligence (OSINT) is becoming increasingly important as investigators confront rapidly expanding volumes of breach, malware, identity, financial, and communications data. Used effectively, OSINT can help investigative teams develop leads faster, strengthen attribution, and build a more complete picture of criminal activity.
Following a discussion at MeriTalk’s recent Shift Happens forum, MeriTalk sat down with Duncan Edwards, senior investigator at identity threat protection firm SpyCloud, to explore how federal investigators can prioritize digital intelligence, use artificial intelligence (AI) to improve investigative efficiency, validate information before using it in legal proceedings, and collaborate across organizational boundaries.
MeriTalk: As federal investigators confront an expanding volume of breach, malware, identity, financial, and communications data, how can they prioritize the leads most likely to advance a case?
Edwards: This really has to be approached on a case-by-case basis. Every properly opened case is going to have a predicate violation or set of violations, so investigators should begin by asking which available intelligence is most likely to move the needle toward proving those violations. The priority should be the information that can enrich the case, generate high-value leads, and potentially develop into evidence. With very large data sets, investigators may also be able to use a strong large language model in a closed, secure environment to surface the most relevant information. For example, the model could analyze a large financial data file, identify activity that warrants closer review, and help create a hierarchy or to-do list for the investigator. The investigator is still steering the bus. AI can reduce the time spent hunting and pecking through enormous amounts of data, and the investigator determines what matters and what steps come next.
MeriTalk: What steps should federal investigators take to validate OSINT before it informs an affidavit, subpoena, search warrant, charging decision, or other consequential action?
Edwards: Parallel reconstruction is paramount, because breach, malware, phishing, or other data may have passed through multiple hands before an investigator obtains it. From a traditional chain-of evidence standpoint, that creates questions about where the information originated and how it was handled.
With parallel reconstruction, investigators look for an alternative, verifiable way to obtain or confirm the same information. For example, a record found in a commercial data set may also be available through another public source. If an email address is connected to a known breach, an investigator may be able to reconstruct that connection using independently obtained information and then explain that acquisition in an affidavit.
Investigators need to create their own checks and balances because prosecutors and courts will want to know the information was thoroughly vetted before it influenced legal process or became evidence.
MeriTalk: Many investigations cross agency, jurisdictional, and sector boundaries. What would an effective model for sharing investigative leads and contextual intelligence look like – while preserving case sensitivity, source protections, and legal authorities?
Edwards: Effective collaboration begins with using the appropriate internal databases and information sharing systems to determine whether another office, agency, or partner is working on overlapping activity. If another team has related intelligence, the next step may simply be making a call. That collaboration can produce new leads, enhance an existing case, or provide information that supports probable cause. During my time with the FBI, I worked a ransomware case in which reporting from an international law enforcement partner in New South Wales was available through an internal system. I was able to use that reporting in an affidavit for a search warrant. With the volume of data investigators face today, this type of collaboration is more important than ever. It makes research and investigative activity more efficient while retaining proper protection and authority over the data.
MeriTalk: How can agencies connect fragmented identifiers – such as usernames, email addresses, credentials, devices, and transaction records – without overstating the confidence that those data points belong to the same person or organization?
Edwards: Investigators should look at patterns of human behavior and cross-pollinate identifiers across multiple sources. People frequently reuse usernames, passwords, phrases, sometimes after many years. Someone may create an identifier based on a hobby, an old address, a pet’s name, or a phrase they used on an early email or social media account. Investigators who can look across older and newer data may find correlations that broaden the intelligence picture. Those correlations should not automatically be treated as definitive attribution. They are indicators that can be combined with other information, validated, and weighed according to their strength.
In some cases, the language or cultural meaning embedded in a username can provide useful context about a subject’s behavior. The key is to use those patterns as investigative leads rather than overstate what any single data point proves.
MeriTalk: Which investigative tasks are well suited to AI-assisted analysis, and which decisions should remain with investigators?
Edwards: AI is particularly useful for sorting through large volumes of records. Imagine receiving the electronic equivalent of hundreds of boxes of bank documents. A properly secured model, prompted with the elements of the violation under investigation, could identify transactions, accounts, dates, or patterns that deserve a closer look. The same approach can apply to domain information, IP addresses, passive DNS data, shared certificates, and other technical records. AI can help explain how those elements connect and point the investigator toward information that might otherwise take weeks to find. But AI should not make the consequential decision. The investigator must review the underlying records, determine whether there is a “there there,” and be able to explain how the conclusion was reached. AI can be a partner in surfacing information, but investigators remain responsible for verification, legal sufficiency, and the final judgment.
MeriTalk: How should investigative organizations measure whether modern OSINT capabilities are improving outcomes?
Edwards: Start by evaluating whether the tools and methods are making investigators more efficient and helping them produce a more comprehensive picture. Organizations should also assess whether their collection methods are robust enough. No single platform or source provides everything. Investigators may need to combine commercial tools, public information, financial intelligence, breach data, and other forms of OSINT. The value becomes clear when those sources help investigators understand the broader criminal enterprise rather than address only one piece of it. You don’t want to cut off one tentacle of the octopus because it could grow back. You want to go for the head to really make a difference.
Watch the SpyCloud session from Shift Happens to learn more about using OSINT effectively.