OSINT Central for researchers
So, you are really good at OSINT, you have the tools you need, and you have experience. Well done! Now you probably want to have clients you can charge for your services. But somehow the clients fail to line up in front of your door, and you are wondering how to get in contact with them. How do you get in contact with your first client? And what do you do once you have landed your first client?
First of all, create a profile with OSINT Central. This will expose your profile to potential clients, who appreciate OSINT enough to invest in it. When registering, don’t be shy: tell people about yourself and your abilities. Another thing to mention is the sources that you have access to: do you have access to Equifax, Experian, Domaintools, or Lexis-Nexis? Do you have unique sources that nobody else has? Think about what you want a potential client to know: what makes you stand out from the rest of the researchers?
So, if you are very good at geolocation, have a background in penetration testing or speak Japanese fluently, let your potential clients know, make sure to mention that in your profile.
Other things to think about are:
Of course, you are in control on what you write about yourself: if you want to stay anonymous, no problem. But in most cases, the more you tell about yourself, the bigger the chance that someone will choose you as their researcher.
What you don’t want is finding out you’ve landed your first client, but are totally unprepared, and screw up your very first assignment. So before even considering taking on a client:
Make sure you have enough time reserved for the investigation
If you’re not used to working for a client, be sure you have reserved enough time for your investigation. Take into account that things like creating reports, doing administration and creating accounts on the fly can cost a lot of extra time. If you’re not sure how long it will take, it’s best to err on he side of caution (add 25% more time than you think you need).
Have your workplace properly set up
This means that you have a place where you can work for hours at a time, with smooth internet access, all your tools available, and things like food and drink taken care of.
Make sure your source accounts are working
If you have API access, check that your credentials are still working. If you anticipate using sock accounts, check to see if they still work. If you will be using 3rd party tools, make sure that the license is still valid. In short, make sure you can hit the ground running. Nothing is as annoying as first having to lose hours of investigation time because your most needed account has stopped working weeks ago.
So… You registered, you are prepared, and you have found your first OSINT client, congratulations! You might be wondering by yourself: “Now what? Where do I go from here, and what questions should I ask before I start my investigation?”. Read on for tips and guidelines on what to do next.
Communication is the most important part of what you deliver. You can have the best results ever when your investigation is over, but if your client is drowned in dozens of pages with techno-babble or irrelevant details, your client might not even understand the value of what you provide.
On the other hand, if a client is going to use the information you provide in court, he’ll want to know the sources you used to get that information, and the timestamps that come with it. Communication means making sure your client understands what to expect.
Good OSINT researchers do not only manage their investigations, they also know how to manage their clients. If your client expects a spreadsheet with the addresses of all rubber factories in Albania in a week, he will be very disappointed if you only deliver a PDF file with just the grid-coordinates of those factories after a month.
To create happy clients, consider the following when performing an investigation:
Define the end result
By clearly defining the what the end result of the investigation will be, and in what form you’ll provide it, you’ll prevent discussions about them when you deliver your report. “Give me everything you can find about company X” is not good enough in most cases.
On the other hand, we have seen many instances where researchers proudly presented a ton of information that wasn’t relevant, resulting in a disappointed client. A good rule of thumb is the “so what” rule: if you find a piece of information, and you doubt its relevance for your client, ask yourself: “so what?”.
Example: you are searching for a missing person, and you find out they were a member of the boy scouts when they were 7. “So what?”. How does this help? In most cases, this probably isn’t helpful, and won’t add anything to the case. In these cases, it’s best to leave these irrelevant details out of your report, or mention them in an annex if you use one. If you have found nothing useful, don’t try to hide it by showering your client with irrelevant pieces of information: it’s not professional, and will not result in a satisfied customer.
Depending on the client, you might also want to define the format (PDF format, Word, Excel, text files) and / or the language, especially if English is not the native language of both parties.
Set realistic expectations of the end result
Make sure your client does not have unrealistic expectations: it might be tempting to say “yes” to every request, but don’t fall for it. Your client might be happy when you say yes, but they won’t be if their expectations aren’t met in the end.
Plan realistically
Plan not just for the investigation, but also for things like report creation, setting up, drafting, dead ends and other work. Ask your client if they want regular updates, and if so, how frequent.
Interpretation by the client
Make sure your client knows how to interpret the end results. If the client is not tech-savvy, or aware of certain cultural differences, he might not interpret results correctly. Ideally, you have already established how much interpretation assistance is needed in the intake.
Next steps or options
In some cases, the client will need to decide on what next steps to take, or wants to know what options are available from here. If you, as a specialist, can offer assistance, don’t be afraid to let them know, most clients will appreciate it.
During the intake, do not be afraid to ask your client for more information. Many times, clients will be in the possession of relevant information, but will not share it, because they think you won’t need it. Remind your client that the more you know before you start your investigation, the faster you can get results.
The number one question that you need to answer before you start your investigation is:
What is the investigative question?
Before starting you investigation, be sure to understand what question your client wants you to answer.
What question is your client really asking? Try to get a specific answer as possible. What is your investigative question going to be? During your investigation, this is the question you should regularly check, to see if you are still on the right track to find the answer, and to prevent getting sidetracked.
When you have finished your investigation, you should be able to present an answer to the investigative question. A good follow-up question to ask is “what is the reason this investigative question is asked?"”. For example, if the reason is environmental research, you will focus on different things then when the reason is “we are preparing a takeover”.
Ask your client what kind of information they already have about the subject. If they say “nothing”, ask them if they are absolutely sure: is there nothing else they know about the subject? Often, the client has more information about the subject, but doesn’t realize the relevance or importance. Ask the client if the subject has been investigated before, and if the results can be shared. Do not assume all the information you get from your client is correct: the information can be outdated, biased, or just plain wrong. If possible, check it for validity before using it.
Often, your client will tell you things like:
We suspect that..
We have reasons to believe that..
This is good, because this tells you that your client probably has more information that can help you. Don’t be afraid to ask “why” questions:
Why do you suspect that.. ?
What reason do you have to believe that.. ?
Depending on the kind of investigation, varying levels of confidentiality can be required. Make sure you and your client understand what level of confidentiality is required.
For example: if you are doing research concerning a sensitive takeover of company A, it will not be good if your actions can be traced to company B. Sometimes it is even important to hide the country that you’re doing research from. Discussing this with your client up front is good practice.
In other cases, you might want to be careful about disclosing anything about yourself to the organization you are investigating (IP address, email, etc). For example, investigating (cyber)criminals or state actors can be downright dangerous without taking the necessary precautions.
Before starting the investigation, be certain to inform if the results are used in court. If the results are ever used in court, now or in the future, a forensic trail / audit trail should be kept of the investigation.
At the very least, you should be able to show what your source was for each piece of information, and what tool or service was used to collect that information.
Sometimes things will not go as planned:
Or maybe you have accepted an assignment that turned out much more difficult than you thought, of will take much longer. Whatever the cause, if this happens: always contact your client, and let them know ASAP. Most clients will understand if you tell them soon enough. If needed, you can then discuss an alternative solution that is acceptable to both you and your client.
While it can be tempting to accept as many assignments as you can, always plan realistically. If you know you are already swamped with assignments, and can’t make the deadline for the new job, have the courtesy to say no. Not meeting your deadlines will also result in bad reviews. Remember, you can always suggest a new deadline before accepting a job.
Sometimes, your client might ask for things you’re not quite comfortable with. It might be that someone is looking for too much personal information, or the request sounds borderline illegal. Whatever it is, if it makes you uncomfortable, or sounds too fishy, it is OK to say no.
Another time to say no is if your client keeps demanding more information (“milking”): the best way to avoid this, is to clearly define the end result before starting the investigation. If your client keeps demanding more information, even though the end results clearly match the agreed end results, you can offer them to start a new investigation. Communicate to your client you’ll have to invest more time to get the additional information. If your client insists on more information nonetheless, the last option is to ask us for mediation.