How Do OSINT Investigators Find Things? Connect Dots
OSINT investigators rarely find a smoking gun in one place. They find ten ordinary public facts and connect them into one.
OSINT investigators find things not through secret access but by connecting publicly available pieces: cross-referencing records, geolocating photos, reading metadata, and pivoting from one data point, a username, an image, a detail, to connected ones across sources, until scattered dots form a picture. The core skill is link analysis, building a graph from public data, which is the same connection-making a First Brain does, scaled up. Tools assist, but the synthesis and judgment are human. This is educational, and OSINT must be used ethically and legally.
OSINT investigators find things not by accessing secret databases but by connecting publicly available pieces that, individually, look ordinary. A geolocated photo, a reused username, a timestamp, a reflection in a window, a company filing, none of these is a revelation on its own, but cross-referenced and linked together they form a picture no single source contained. The core technique is pivoting and connecting: start from one data point, find what it links to, follow that to the next, and keep building until scattered facts converge. In other words, open-source intelligence is graph-building at scale, finding the edges between public data points, which is exactly the connection-making a strong mind does internally, applied across datasets. The thesis: real intelligence gathering is the mass-scale application of node-bridging, connecting one piece of public information to the next. The Build First Brain approach is the same skill at personal scale: the investigator’s edge is a trained graph-thinking mind, with tools assisting but the synthesis and judgment remaining human. This is educational, and OSINT must be used ethically and legally. Here is how investigators actually find things, and why it is fundamentally graph work.
How do OSINT investigators find things?
By connecting public information, not by privileged access. Open-source intelligence is intelligence produced from publicly available sources, social media, public records, images, maps, news, leaked-then-public datasets, websites, rather than secret or classified material. The skill is not getting access, since the data is open; it is knowing how to find, cross-reference, and connect it.
The defining method is pivoting: an investigator takes one piece of information and uses it to reach connected pieces, then repeats. A username found in one place is searched across other platforms; a photo is geolocated by matching landmarks, shadows, and signage to map and satellite imagery; metadata, timestamps, and account histories tie events together; and details from one source confirm or extend another. No single fact solves the case, the answer emerges from the connections between many ordinary public facts, which is why OSINT is fundamentally about linking, not accessing.
What techniques turn scattered data into a picture?
A toolkit of methods, all of which are forms of connecting one node to the next:
| Technique | What it does | What it connects |
|---|---|---|
| Cross-referencing | Match a detail across multiple sources | Confirms and links records |
| Pivoting | Use one data point to find related ones | A username to other accounts and a name |
| Geolocation | Place a photo or video in the real world | An image to a precise location |
| Metadata and timestamps | Read embedded and contextual data | Ties events into a timeline |
| Link analysis | Map relationships between entities | Builds the network of connections |
The unifying discipline is link analysis, examining relationships between entities to find patterns, and its relative social network analysis, mapping how people and accounts connect. Geolocation is the vivid case: investigators have placed a single photo by matching a mountain ridge, a road sign, and the angle of shadows to public maps. The canonical practitioner is Bellingcat, the investigative collective that has reconstructed major events entirely from open sources by connecting public data, demonstrating that connection, not secret access, is the engine of modern investigation.
Why is OSINT fundamentally a graph?
Because the work is literally building a graph: entities are nodes, relationships are edges, and the investigation grows by adding connections. An investigator starts with one node, a name, an image, an account, and pivots to connected nodes, drawing edges, this account belongs to that person, who was at that place, at that time, with those associates, until the graph is dense enough to reveal what was hidden. The finding is not in any node; it is in the structure of the connections.
This is why OSINT is the external, large-scale version of graph thinking. The skill that lets an investigator see that two ordinary facts are connected, and pursue the link, is the same connection-making that produces insight in any field, the distant-node bridging we examined in what is graph thinking. The thesis follows: intelligence gathering is node-bridging across public datasets, the same cognitive operation as connecting ideas, applied to facts about the world. And it is a form of sensemaking under noise, assembling scattered, ambiguous public signals into a verified picture.
How does a First Brain make a better investigator?
By being the trained graph-thinking mind that drives the search and judges the connections, which tools cannot replace. OSINT tools, search operators, geolocation aids, aggregation platforms, are powerful, but they surface data; the investigator decides what to connect, which pivot to pursue, and whether a link is real. That judgment comes from a strong biological knowledge graph: an investigator who holds rich context, about places, platforms, behaviors, and how things fit together, sees connections a checklist misses and avoids the false ones a tool would suggest.
This is First Brain before Second Brain in investigation. The tools are a Second Brain that retrieves and maps, but the synthesis, the seeing of a meaningful connection and the verification of whether it holds, is a First Brain function. An investigator with a sparse internal model cannot tell a significant link from a coincidence; one with a rich, connected mind can. So the core skill is trainable in the same way graph thinking is: building broad contextual knowledge and the habit of asking what connects to what, then verifying ruthlessly, since OSINT can mislead as easily as inform. The method for building that connection-making, context-rich mind is the core of Building Your First Brain, free for the first 1,000 readers, and it complements the practical workflow in how to do OSINT research.
What are the honest caveats?
Several, and the ethical one is paramount. First, OSINT is dual-use and must be used ethically and legally: the same techniques that support journalism, research, and authorized security work can be abused for stalking, harassment, or doxxing, which are harmful and often illegal, so this is an explanation of the cognitive method, not encouragement to investigate or expose private individuals, and responsible practitioners follow strict ethical and legal boundaries. Second, verification is essential: connecting public dots can produce false pictures, coincidental links, misattributed images, manufactured data, so good OSINT is rigorous about confirming each connection and is acutely aware that the method can mislead, which is why careless OSINT has wrongly accused innocent people. Third, tools assist but do not replace judgment: the synthesis and the decision about what is real remain human, so the skill is cognitive, not just technical. Fourth, this describes the discipline at a conceptual level, not an operational guide to surveilling anyone. The durable point holds: OSINT investigators find things by connecting publicly available pieces through cross-referencing, geolocation, and pivoting, which is link analysis, graph-building at scale, the same node-bridging a First Brain does internally, with tools assisting and human judgment and verification, used ethically, at the center.
Key takeaways: how OSINT investigators find things
OSINT investigators find things by connecting publicly available pieces rather than accessing secret data: cross-referencing records, geolocating images, reading metadata, and pivoting from one data point to connected ones until scattered facts form a picture. The unifying discipline is link analysis, which is literally graph-building, entities as nodes and relationships as edges, the same node-bridging a First Brain does internally, scaled across public datasets. Tools surface data, but the synthesis and verification are human, so the investigator’s real edge is a trained, context-rich, graph-thinking mind, which the Build First Brain approach develops. The honest limit: OSINT is dual-use and must be used ethically and legally, verification is essential because connecting dots can mislead, and this is a conceptual explanation, not an operational surveillance guide.
Frequently asked questions
How do OSINT investigators find things?
By connecting publicly available information rather than accessing secret data. They pivot from one data point to connected ones, search a username across platforms, geolocate a photo by matching landmarks and shadows to maps, read metadata and timestamps, and cross-reference details across sources, until many ordinary public facts form a picture no single source contained. The core skill is link analysis, building a graph of connected entities. Tools assist with finding and mapping, but the synthesis and verification, deciding what connects and whether it is real, are human judgment.
What is OSINT?
OSINT, open-source intelligence, is intelligence produced from publicly available sources: social media, public records, images and videos, maps and satellite imagery, news, websites, and other open data, rather than secret or classified material. Because the data is public, the skill is not access but knowing how to find, cross-reference, and connect it. It is used in journalism, research, security, and law enforcement, and the canonical example is investigative collectives that have reconstructed major events entirely from open sources by connecting public data.
What techniques do OSINT investigators use?
Core techniques include cross-referencing details across multiple sources to confirm and link them, pivoting from one data point such as a username to related accounts and a real identity, geolocating images and videos by matching landmarks, signage, and shadows to maps, reading metadata and timestamps to build timelines, and link analysis to map relationships between entities. All of these are forms of connecting one piece of information to the next, which is why OSINT is fundamentally about building a graph of connections rather than finding a single decisive source.
Why is OSINT considered graph work?
Because the investigation is literally building a graph: entities are nodes, relationships are edges, and the work grows by adding verified connections. An investigator starts from one node and pivots to connected ones, drawing edges until the network is dense enough to reveal what was hidden, since the finding lives in the structure of connections, not in any single fact. This makes OSINT the large-scale, external version of graph thinking, the same connection-making that produces insight internally, applied to facts about the world.
Is OSINT legal and ethical?
The techniques are legal in many contexts since they use public information, but OSINT is dual-use and can be seriously abused. The same methods that support journalism, research, and authorized security work can enable stalking, harassment, and doxxing, which are harmful and often illegal, so responsible practitioners follow strict ethical and legal boundaries and avoid targeting private individuals. Verification is also an ethical duty, because connecting dots can produce false pictures and careless OSINT has wrongly accused innocent people. The method should be used carefully, lawfully, and responsibly.
Dive deeper in
Does AI Have Western Bias? Decolonizing the Knowledge Graph
Yes, measurably. LLMs default to Western, English-centric values even when prompted in other languages. Your native First Brain keeps your own epistemic map.
Why Is the Internet Splitting? The Splinternet, Explained
The internet is fracturing into national and corporate zones with different rules, data, and now AI-generated truths. Your own mind becomes the compass.
Will AI Cause a Cognitive Divide? Two Kinds of Mind
Probably yes, but the deepest divide is not access to AI. It is how you use it: outsourcing your thinking to AI versus using it to amplify your own.