Responsible OSINT: the legal and ethical lines

Open-source intelligence has a convenient-sounding premise: the information is public, so using it is fine. The premise is half right. The information may be public, but laws, ethics and plain decency still govern how you collect it, what you combine it with, and what you do next. This post sets out the main lines, as we understand them, for anyone using account lookup tools, ours included.

This is general information, not legal advice. Laws differ between countries and states, and they change. If your work depends on the answer, ask a lawyer who practices where you do.

Public does not mean permitted

A single public profile rarely harms anyone. The harm comes from aggregation: a handle linked to a real name, linked to a city, linked to a workplace, linked to a daily routine. Each piece was public on its own; together they can let someone turn up at a person's door. Many legal frameworks recognize this, which is why "it was on the internet" is not a defense to harassment, stalking or misuse of personal data.

So the first question is never "can I find this?" It is "should I be looking, for this purpose?"

The FCRA line: no screening decisions

In the United States, the Fair Credit Reporting Act (FCRA) regulates consumer reports: information about a person that is used, or expected to be used, to decide their eligibility for things like credit, insurance, employment or housing. Companies that assemble that information for others are consumer reporting agencies, and they carry real obligations: verifying the purpose of each request, following procedures to ensure accuracy, and giving people the right to see and dispute what is reported about them. People who use consumer reports have obligations too, such as notifying an applicant before taking adverse action based on one.

Tracehound is not a consumer reporting agency and does not provide consumer reports. That means you must not use it, or anything it returns, to decide:

• whether to hire, promote, retain or contract someone;
• whether to rent to someone, or on what terms;
• whether to extend credit or insurance to someone;
• any other eligibility decision the FCRA covers.

This is not a technicality. A lookup result can be wrong, outdated or about a different person with the same handle, and the FCRA exists precisely so that people affected by these decisions can find out what was used and correct it. Several US states add their own rules on background checks, and other countries have comparable protections. If you need to screen people, use a provider built and regulated for it.

Harassment, stalking and doxxing

Using information to frighten, threaten or track a person is illegal in most places, whether or not the information was public. In the US, federal law and every state criminalize stalking, including conduct carried out online, and a growing number of states specifically address publishing someone's personal information to encourage others to harass them. Similar laws exist across Europe and elsewhere.

Practical rules that keep you well clear of that line:

• Never use lookup results to locate, contact or monitor a person who does not want contact from you.
• Do not publish what you find about a private individual, even in aggregate, unless there is a clear public interest and you have weighed the harm.
• If you are researching a person because you are in conflict with them, stop and involve the appropriate authority instead.

Our Acceptable Use Policy forbids all of this, and we close accounts that do it.

Data protection: GDPR, UK GDPR and US state laws

If you collect information about people in the EU or the UK as part of your work, data protection law likely applies to you, not just to the tool you use. In broad terms that means having a lawful basis for processing (for many investigations, a legitimate interest that you have actually weighed against the person's rights), collecting no more than you need, keeping it secure, deleting it when you are done, and being able to explain all of that if asked. Journalism and some other purposes have specific exemptions, which vary by country.

US state privacy laws, such as California's CCPA as amended by the CPRA, mainly regulate businesses and give individuals rights over data held about them. Whatever your jurisdiction, minimization is a good habit: keep findings that serve your purpose, and delete the rest.

Consent and proportionality

You will rarely have the consent of the person you are researching; fraud investigators do not ask scammers for permission. That makes proportionality the working test. Before and during a search, ask:

• Purpose: what specific question am I trying to answer, and is it legitimate?
• Necessity: is this search needed to answer it, or am I curious?
• Scope: am I collecting only what serves the purpose? Do I need the person's hobbies to check whether their email is real?
• Impact: what happens to this person if I am wrong, or if my notes leak?
• Stopping point: when will I have enough, and what will I do with the rest?

The one case where consent is easy is your own footprint. Searching yourself is the best way to learn what these tools reveal. Our footprint audit guide walks through it.

Stay on the public side of the line

Open-source work uses what is openly available. It does not include:

• logging in to someone else's account, or guessing or resetting their password;
• creating fake profiles to befriend a subject or join their private groups;
• pretending to be someone else to get information from a person or a company;
• using leaked or stolen data, whatever its source.

Some of these are crimes; all of them undermine the credibility of whatever you find. Tracehound only queries public sources and only returns what they make public, and the same rule should apply to everything else in your workflow.

Accuracy is an ethical duty

Most real harm from OSINT comes not from malice but from mistakes: a confident conclusion built on a common username, an old account attributed to the wrong person, a lead followed three steps too far. Treat every result as a lead to verify, corroborate with independent details, and say how sure you are when you report it. Our post on how username enumeration works covers the practical side.

Why we offer an opt-out

We think people should have some say in being searchable. Anyone can block Tracehound searches for their email address by confirming a one-time code on our opt-out page; it takes effect immediately and needs no account. Usernames and phone numbers can be blocked through a request that a person reviews, because those cannot be verified automatically and a careless block could help someone hide from a legitimate investigation. Opted-out identifiers are stored only as keyed one-way hashes.

An opt-out does not delete accounts on other sites, and it does not bind other tools. It is one small piece of control, offered because it is the right thing to do.

A checklist to keep

1. Write down your purpose before you search.
2. Never use results for employment, housing, credit or insurance decisions.
3. Never use results to locate, contact or monitor someone who does not want it.
4. Stay on public information; no logins, pretexts or leaked data.
5. Corroborate before concluding, and state your confidence.
6. Keep what you need, secure it, and delete the rest when you are done.
7. When in doubt, ask someone with legal or editorial responsibility.