Skip to content
Lesson 3 of 8

People OSINT

7 min read

The Ethical Starting Point

People OSINT is probably the most sensitive area of the entire discipline, because it deals directly with data about real individuals. That is why it must begin — and not end — with ethical reflection. Before searching for a single datum, you must be clear about the investigation's legitimate purpose, its authorized scope, and the applicable legal framework, especially data protection laws like the EU's GDPR or equivalent regulations in other countries.

The guiding principle is proportionality: collect only the information necessary for the stated objective, no more and no less. Discovering that something is technically possible does not mean it is ethical or legal to do it. Legitimate people OSINT happens in contexts like consented identity verification in hiring processes, due diligence, public-interest journalism, or authorized penetration tests that include social engineering.

It must never be used for harassment, stalking, doxing, impersonation, or surveillance of an ex-partner or acquaintance. These activities are illegal in most jurisdictions and constitute a serious breach of professional ethics. This course teaches the technique to defend, investigate legitimately, and protect; never to harm. A central goal of this lesson, in fact, is for you to understand how you can be profiled so that you know how to protect yourself.

Social Media and Public Presence

Social media is the richest source of people OSINT, because users voluntarily publish large amounts of information. LinkedIn profiles reveal work history and professional connections; posts on X, Instagram, or Facebook show interests, locations, and relationships. The technique consists of analyzing what is publicly visible, without ever accessing private content or circumventing privacy controls.

A key aspect is analyzing the network of contacts and interactions: who a person interacts with, what pages they follow, what events they post. These connections often say as much as the direct content. Published photos can contain relevant background information (location cues, visible documents) and, as we will see in Lesson 6, metadata.

Surgical searching inside a social network is best done from a general search engine with operators (Lesson 5), because in-platform search is often limited:

# Locate a person's public professional profile in a legitimate context
site:linkedin.com/in "First Last" "City"

# Find public appearances of an alias on forums or blogs
"public_alias" (site:reddit.com OR site:medium.com)

Verification is fundamental: social media abounds with fake profiles, namesakes, and abandoned accounts. Confusing two people with the same name is a frequent and potentially serious error. Each attribution must be backed by several independent indicators before it is considered confirmed.

Mini-case: The Danger of False Attribution

Suppose a due diligence on a candidate named "Carlos Gimenez." A quick search finds a profile with problematic comments on a forum. Is it the same person? The disciplined analyst does not assume it:

  • The forum uses the alias cgimenez84; does that alias appear on other verifiable accounts of the candidate? (Sherlock)
  • Do the city, approximate age, and career track match the confirmed LinkedIn profile?
  • Is there a reused photo that independently links both identities?

If only the name matches, the responsible conclusion is "unverified, possible namesake." Presenting a likely correlation as a fact can ruin the reputation of an innocent person — and expose the investigator to legal liability. Verification is not a formality: it is the difference between intelligence and defamation.

Usernames and Identity Correlation

People tend to reuse usernames across different platforms, which makes them an excellent pivot point. If you find that someone uses "jdoe_dev" on GitHub, it is reasonable to search for that same identifier on Reddit, technical forums, gaming platforms, and social networks. Tools like Sherlock, Maigret, or WhatsMyName automate this search across hundreds of services and return the matches:

# Sherlock: hunts a username across hundreds of platforms
sherlock jdoe_dev

# Maigret: similar, with profile data extraction and report generation
maigret jdoe_dev --html

Email correlation follows similar logic. From an email address you can discover associated profiles, registered services, and — using tools like Hunter.io — deduce an organization's email pattern. The goal is to build an identity graph that links the different presences of the same person, always within the limits of the investigation.

It is worth remembering that correlation is never absolute certainty. Two accounts with the same username may belong to different people, and one person may maintain deliberately separate identities. The analyst must express conclusions with the appropriate confidence level and never present a likely correlation as a fact.

Data Breaches and Public Records

Data breaches are a delicate resource. Services like Have I Been Pwned let you check, legitimately and in aggregate, whether an email address has appeared in known leaks — very useful information in security audits to alert an organization to compromised credentials:

# Legitimate, aggregate check: does this email appear in known breaches?
curl -s "https://haveibeenpwned.com/api/v3/breachedaccount/user@example.com" \
  -H "hibp-api-key: YOUR_API_KEY"

# Returns the names of the breaches, NOT the passwords

However, downloading, buying, or using the raw content of leaked databases (passwords, personal data) is illegal in most jurisdictions and falls completely outside ethical OSINT. The line is sharp: checking exposure to defend is legitimate; exploiting the leaked data is not.

Public records, by contrast, are a perfectly legitimate source when the law makes them accessible: business registries, official gazettes, intellectual property, sanctions, public litigation, or professional registries. Their availability varies greatly by country, and the responsible investigator knows what is legally accessible in their jurisdiction.

How to Protect Yourself from These Techniques

Understanding people OSINT is the best way to shield your own privacy. Apply to yourself what an analyst would look for:

  • Do not reuse usernames across your personal, professional, and leisure lives: it is the number-one pivot.
  • Use different emails (or aliases) for sensitive services; review your exposure on Have I Been Pwned.
  • Review the privacy of each social network and limit who sees your contact list and posts.
  • Think before posting photos: backgrounds, documents, license plates, and metadata reveal more than you think.
  • Search your own name and aliases periodically to know what is exposed and request takedowns.

Investigator OPSEC

  • Browse profiles with research accounts that are credible, never with your personal ones.
  • Remember that LinkedIn can notify "who viewed your profile": use private mode or dedicated accounts.
  • Control network attribution (VPN, isolated browser) and avoid logging in with accounts that identify you.
  • Document each datum with its source and confidence level, especially in identity attributions.

People OSINT Checklist

  • [ ] Legitimate purpose, authorized scope, and legal basis verified before starting.
  • [ ] Public sources only; never private content or circumvention of privacy controls.
  • [ ] Each attribution backed by multiple independent indicators.
  • [ ] Conclusions expressed with a confidence level; never the likely as certain.
  • [ ] Breaches used only to check exposure, never to exploit leaked data.
  • [ ] Zero harassment, doxing, impersonation, or surveillance: lines that are not crossed.

In every case, the rule is the same: use only what is public and legal, document the source, and respect privacy. People OSINT done well is a powerful tool for security and justice; misused, it is a violation of rights. The difference lies entirely in intent, scope, and respect for the law.