Home/Praktische gidsen/OSINT & inlichtingen

OSINT & inlichtingen

Verify a claim using open sources

How do you verify an open-source claim? Define a precise assertion, trace its earliest publication and seek evidence of different kinds. The expected output is an evidence record covering the claim, original URL, event date, access date, context, supporting material, contradictions and justified confidence. Missing information does not automatically establish that an event did not happen; repetition is not independent confirmation.

OSINTCTIVerification
Leeg OSINT-bureau met kaarten, schermen en dossier
Redactionele illustratie gegenereerd met AI

Uw actiechecklist

  1. 01

    Define a testable claim

    Write precisely who allegedly did what, where and when. Separate the question from expectations to avoid looking only for confirmation. Separate an organisation from a namesake, subsidiary or account discussing it. Record the identifiers used and unresolved ambiguity. A conclusion should answer a question whose answer could change with new evidence.

  2. 02

    Trace the earliest source

    Find the original document or media, its date and publication context. A screenshot or repost does not establish authenticity. Find the complete edition and earliest accessible publication, then check whether it cites an earlier origin. Preserve the context around an excerpt: titles, captions, dates and corrections can change its interpretation.

  3. 03

    Document provenance

    Keep public URLs, access times and transformations. Preserve useful files while respecting rights, personal data and local law. Record what was collected, how and under which preservation permissions. A file hash can help detect changes but does not establish that the contents are true. Limit personal data to the defined purpose.

  4. 04

    Find independent evidence

    Cross-check different source types: institutional publication, technical observation and primary document. Identify repetitions of the same dispatch or report. Build a small map of relationships between publications. Three sites citing the same release represent a distribution chain, not three observations. Seek confirmation that contributes distinct primary information.

  5. 05

    Test alternative explanations

    Look for reused old imagery, timezone errors or missing context. Metadata may be missing or altered and is insufficient on its own. Test a competing explanation before concluding: an old company name, a place with the same name, a superseded document or an out-of-context photograph. Record important negative checks so readers understand the limitations.

  6. 06

    Write a proportionate conclusion

    Separate facts, hypotheses and unknowns. Attribute statements, explain limitations and identify what could strengthen or refute the conclusion. An actionable brief separates observation, inference and open questions. It identifies the decision consequence, next verification and review date. Wording should remain proportionate to the evidence.

    Worked example: an image is claimed to be recent and from a named city. Look for an earlier publication, then compare visible geographic features and available timing evidence. If the location is plausible but the date cannot be verified, preserve those conclusions separately. Cite the evidence supporting each and do not turn plausibility into certainty.

Referenties: gegevens, gebruik en grenzen

Documentatie geraadpleegd op .

De uitgebreide toelichtingen zijn in deze editie beschikbaar in het Engels.

Referenties: gegevens, gebruik en grenzen
Bron en doelGecontroleerde gegevens of maatstafPraktisch gebruikTe behouden beperking
FIRST · Traffic Light Protocol

Indicate who may receive redistributed information.

TLP 2.0 uses RED, AMBER, GREEN and CLEAR; AMBER+STRICT restricts sharing to the recipient organisation. Labels must not be translated. Keep the marking with the information and check recipients before forwarding. Ask the source to clarify any ambiguity.

Verdiep de methode →

TLP is neither a formal classification nor a reuse licence. It does not guarantee content accuracy.
C2PA · Content Credentials

Describe and verify certain content provenance information.

C2PA specification 2.4 defines manifests, assertions and cryptographic binding mechanisms associated with media. Examine what the manifest asserts, who signed it and whether validation succeeds. Test preservation after transformations and distribution.

Verdiep de methode →

Validated provenance does not establish the truth of a scene. Absence of a manifest does not demonstrate a fake.
ICANN · Registration Data Lookup

Consult available domain registration information.

RDAP is the registration data access protocol. ICANN Lookup provides access to available public registration data. Keep the exact domain, consultation date and result. Distinguish registrar, technical service and the entity operating a website.

Verdiep de methode →

Data may be redacted or limited. Domain information alone cannot attribute content or an operation to a person.

Mediaherkomst en C2PA-validatie

De uitgebreide toelichtingen zijn in deze editie beschikbaar in het Engels.

Separate technical trace, source and judgment

Verifiable provenance helps describe a file’s history. Analysts must still check contextual claims and the independence of documents repeating them.

  • Associate each claim with its exact asset and source.
  • Trace repetitions to origins before describing corroboration.
  • Retain uncertainty and information that could change the judgment.

Open the C2PA explorer and publication cases →

References consulted on · C2PA · Content Credentials Explainer ODNI · ICD 203, Analytic Standards

OSINT: bewijs bewaren

De uitgebreide toelichtingen zijn in deze editie beschikbaar in het Engels.

Usable intelligence retains the trail of its supporting material

Connect each conclusion to sources, preserved objects and working transformations. Custody complements corroboration; it does not turn unverified information into established fact.

  • Describe observed scope, capture limits and date uncertainty.
  • Separate preserved reference, technical copy and assessment extract.
  • Expose unconfirmed transfers and analytical assumptions.

See copy lineage and the eight preservation cases →

Sources reviewed on · NIST · Digital Evidence Preservation · NIST IR 8387 · Full report · NIST · SP 800-86 · NIST SP 800-86 · Full report · NIST · FIPS 180-4 · Secure Hash Standard

Paginering: consistentie en herstel

De uitgebreide toelichtingen zijn in deze editie beschikbaar in het Engels.

Reconcile collection identities and revisions

An exit inventory or OSINT collection can reach the last page while missing an object or mixing its revisions. A total alone does not establish that expected data is present.

  • Fix order, scope and consistency reference before reading.
  • Compare IDs and revisions beyond row counts.
  • Retain discrepancies and recovery decisions when the reference changes.

Compare computed reads and recoveries →

Sources reviewed on · Google · AIP-158 Pagination · PostgreSQL 18 · LIMIT and OFFSET · PostgreSQL 18 · Row constructor comparison · PostgreSQL 18 · Transaction isolation · OWASP · API1:2023 Broken Object Level Authorization