Legal & Ethics

The line between defensive OSINT and abuse is use, not access. What follows keeps your work lawful, proportionate, and defensible.

Pre-investigation checklist

0/7

Run through this before every engagement. Saved on your device.

I have a legitimate, lawful basis for this investigation.
Every source I plan to use is genuinely public, no bypassing authentication.
I will minimise the sensitive personal data (PII) I collect and retain.
There is a verifiable public interest, or explicit authorisation, for this work.
I will document sources, dates, and hashes for everything I rely on.
I will not stalk, harass, dox, or re-sell any data I find.
Where possible, findings can be de-identified before sharing.

Country	Framework	Key
Mexico	PDP Law 2018	Explicit consent for PII
Spain	LOPD-GDPR	Art. 6.1-f: legitimate interest (research)
USA	CFAA	No bypass to authentication
Europe	GDPR	DPIA if >1000 people
—	OSINT-Code-Ethics	No doxxing, no stalking, no data selling

Ethical checklist ☐ Is the source 100% public? ☐ Is the data sensitive PII? → minimize ☐ Is there verifiable public interest? ☐ Can it be de-identified?

Not legal advice. Laws vary by jurisdiction and change often. When in doubt, consult a qualified professional before acting.