"Open-source intelligence gathering and analysis (OSINT) techniques are no longer predominantly the remit of private investigators and journalists. An estimated 80-90% of data analysed by intelligence agencies is also now derived from publicly available material. Additionally, the massive expansion ... of the internet and, in particular, social media platforms, have made OSINT increasingly accessible to civilians who simply want to trawl the Web for information on a specific individual, organisation or product. In May 2018, the European Union’s General Data Protection Regulation (GDPR) was implemented in the UK through the new Data Protection Act, intended to secure personal data against unjustified collection, storage and exploitation. This document presents a preliminary literature review of work related to the GDPR and OSINT, which was collated as the basis for an as-yet-unpublished study evaluating the effects of the GDPR on OSINT capabilities in the UK. The literature reviewed is separated into the following six sections:‘What is OSINT?’,‘What are the risks and benefits of OSINT?’,‘What is the rationale for data protection legislation?’,‘What are the current legislative frameworks in the UK and Europe?’,‘What is the potential impact of the GDPR on OSINT?’, and ‘Have the views of civilian and commercial stakeholders been sought and why is this important?’. As OSINT tools and techniques are accessible to anyone, they have the unique capacity for being used to hold power to account. It is therefore important that new data protection legislation does not impede civilian OSINT capabilities." (Abstract) more

"Open-source intelligence (OSINT) gathering and analysis techniques are used by investigators from a variety of fields, owing to their accessibility and exceptional capacity for corroboration. It has previously been argued that proposed data protection legislation can chill the free press, but there ... have been no studies assessing the effect of such reforms on more general OSINT capabilities. European Union’s General Data Protection Regulation (GDPR) was implemented in the UK through the 2018 Data Protection Act (DPA) to protect personal data against exploitation. This study surveyed 16 OSINT gathering and analysis practitioners across public and private sectors to determine firstly, what, if any impact the implementation of the GDPR/DPA have had on their ability to successfully operate as OSINT analysts and secondly, if they have noticed any subsequent changes in UK public perception around issues of the surveillance state and digital privacy. I argue that this initial survey shows that the GDPR is merely a first step in establishing societal expectations and regulations around digital privacy. While some changes to OSINT practice have been reported, to date few substantive changes to OSINT methods or analysis resulted or seemed poised to take effect, one year after the advent of the GDPR/DPA." (Abstract) more