ホーム/実践ガイド/OSINT・インテリジェンス

OSINT・インテリジェンス

Verify a claim using open sources

How do you verify an open-source claim? Define a precise assertion, trace its earliest publication and seek evidence of different kinds. The expected output is an evidence record covering the claim, original URL, event date, access date, context, supporting material, contradictions and justified confidence. Missing information does not automatically establish that an event did not happen; repetition is not independent confirmation.

OSINTCTIVerification
地図、モニター、資料を備えた無人のOSINTデスク
AIで生成した編集用イラスト

実践チェックリスト

  1. 01

    Define a testable claim

    Write precisely who allegedly did what, where and when. Separate the question from expectations to avoid looking only for confirmation. Separate an organisation from a namesake, subsidiary or account discussing it. Record the identifiers used and unresolved ambiguity. A conclusion should answer a question whose answer could change with new evidence.

  2. 02

    Trace the earliest source

    Find the original document or media, its date and publication context. A screenshot or repost does not establish authenticity. Find the complete edition and earliest accessible publication, then check whether it cites an earlier origin. Preserve the context around an excerpt: titles, captions, dates and corrections can change its interpretation.

  3. 03

    Document provenance

    Keep public URLs, access times and transformations. Preserve useful files while respecting rights, personal data and local law. Record what was collected, how and under which preservation permissions. A file hash can help detect changes but does not establish that the contents are true. Limit personal data to the defined purpose.

  4. 04

    Find independent evidence

    Cross-check different source types: institutional publication, technical observation and primary document. Identify repetitions of the same dispatch or report. Build a small map of relationships between publications. Three sites citing the same release represent a distribution chain, not three observations. Seek confirmation that contributes distinct primary information.

  5. 05

    Test alternative explanations

    Look for reused old imagery, timezone errors or missing context. Metadata may be missing or altered and is insufficient on its own. Test a competing explanation before concluding: an old company name, a place with the same name, a superseded document or an out-of-context photograph. Record important negative checks so readers understand the limitations.

  6. 06

    Write a proportionate conclusion

    Separate facts, hypotheses and unknowns. Attribute statements, explain limitations and identify what could strengthen or refute the conclusion. An actionable brief separates observation, inference and open questions. It identifies the decision consequence, next verification and review date. Wording should remain proportionate to the evidence.

    Worked example: an image is claimed to be recent and from a named city. Look for an earlier publication, then compare visible geographic features and available timing evidence. If the location is plausible but the date cannot be verified, preserve those conclusions separately. Cite the evidence supporting each and do not turn plausibility into certainty.

参照資料:データ・用途・限界

資料確認日 .

この言語版の詳しい参照メモは英語で提供しています。

参照資料:データ・用途・限界
出典と目的確認済みのデータ・指標利用方法留意する限界
FIRST · Traffic Light Protocol

Indicate who may receive redistributed information.

TLP 2.0 uses RED, AMBER, GREEN and CLEAR; AMBER+STRICT restricts sharing to the recipient organisation. Labels must not be translated. Keep the marking with the information and check recipients before forwarding. Ask the source to clarify any ambiguity.

手法を詳しく読む →

TLP is neither a formal classification nor a reuse licence. It does not guarantee content accuracy.
C2PA · Content Credentials

Describe and verify certain content provenance information.

C2PA specification 2.4 defines manifests, assertions and cryptographic binding mechanisms associated with media. Examine what the manifest asserts, who signed it and whether validation succeeds. Test preservation after transformations and distribution.

手法を詳しく読む →

Validated provenance does not establish the truth of a scene. Absence of a manifest does not demonstrate a fake.
ICANN · Registration Data Lookup

Consult available domain registration information.

RDAP is the registration data access protocol. ICANN Lookup provides access to available public registration data. Keep the exact domain, consultation date and result. Distinguish registrar, technical service and the entity operating a website.

手法を詳しく読む →

Data may be redacted or limited. Domain information alone cannot attribute content or an operation to a person.

メディアの来歴とC2PA検証

この言語版の詳しい参照メモは英語で提供しています。

Separate technical trace, source and judgment

Verifiable provenance helps describe a file’s history. Analysts must still check contextual claims and the independence of documents repeating them.

  • Associate each claim with its exact asset and source.
  • Trace repetitions to origins before describing corroboration.
  • Retain uncertainty and information that could change the judgment.

Open the C2PA explorer and publication cases →

References consulted on · C2PA · Content Credentials Explainer ODNI · ICD 203, Analytic Standards

OSINT:証拠の保全

この言語版の詳しい参照メモは英語で提供しています。

Usable intelligence retains the trail of its supporting material

Connect each conclusion to sources, preserved objects and working transformations. Custody complements corroboration; it does not turn unverified information into established fact.

  • Describe observed scope, capture limits and date uncertainty.
  • Separate preserved reference, technical copy and assessment extract.
  • Expose unconfirmed transfers and analytical assumptions.

See copy lineage and the eight preservation cases →

Sources reviewed on · NIST · Digital Evidence Preservation · NIST IR 8387 · Full report · NIST · SP 800-86 · NIST SP 800-86 · Full report · NIST · FIPS 180-4 · Secure Hash Standard

ページ分割:整合性と再開

この言語版の詳しい参照メモは英語で提供しています。

Reconcile collection identities and revisions

An exit inventory or OSINT collection can reach the last page while missing an object or mixing its revisions. A total alone does not establish that expected data is present.

  • Fix order, scope and consistency reference before reading.
  • Compare IDs and revisions beyond row counts.
  • Retain discrepancies and recovery decisions when the reference changes.

Compare computed reads and recoveries →

Sources reviewed on · Google · AIP-158 Pagination · PostgreSQL 18 · LIMIT and OFFSET · PostgreSQL 18 · Row constructor comparison · PostgreSQL 18 · Transaction isolation · OWASP · API1:2023 Broken Object Level Authorization