OSIRA Summit 2014: creating a community
OSIRA Summit 2014: creating a community
Last week we attended the OSIRA Summit in London. This was an inaugural event aiming to create a community of OSINT professionals worldwide, and to enhance the knowledge and expertise of these practitioners in the public and private sector. The conference explored the following issues:
- Tools and techniques for open source research
- Actionable intelligence from OSINT techniques
- The regulatory environment for ethical open source intelligence activity
The conference was attended by a wide variety of organisations and individuals who focussed the debate on trends and innovation within business, law enforcement, military, and academia. We drew the following conclusions:
A call for the professionalisation of OSINT research
The volume of data on the internet is increasing exponentially and so is the need for a community to understand and exchange ideas about different tools and techniques to manage this. One of the principal concerns voiced by speakers was how a lack of real understanding around open source research, often at senior/board level, prevents effective implementation within common business practices.
Katherine Lindroth of the Zurich Insurance Group for example, spoke about a lack of awareness within senior management bodies about what is really required of Google searches and why people need to be trained to perform them. She highlighted how greater credibility could change the perception of OSINT activity. Similarly, David Maybin of CapGemini addressed the suspicion surrounding this type of research in big businesses, something which is preventing its integration as companies go through major structural changes.
Human skills are needed to benefit from OSINT tools and techniques
Open source expert Arno Reuser spoke about existing research tools becoming outdated, yet at the same time more and more people are dependent on fewer providers. These search systems are often complex which means that simple errors lead to big mistakes. Training analysts properly is therefore of paramount importance, so that the combination of technology and people is maximised.
Simon Thacker of the Cabinet Office spoke about this issue and emphasised that skills are needed more for the analysis, rather than the collection, of open data. Issues surrounding the regulation of ethical open source research calls for an accreditation qualification demonstrating that the analyst abides by regulations that apply to the OSINT community. This framework can be provided by the OSIRA network.
Social media and digital natives
Existing tools are becoming outdated and older generations are being overtaken by younger digital natives. Business leaders can therefore either attempt to catch up, or get behind people with the right skills and push hard.
Social media was a strong focus of the conference and many business leaders believe that accurate and penetrative analysis of this type of information can be a valuable source of open source research. However what was barely touched on was the importance of business-focussed open data. Knowledge of what is available on the Rwandan corporate registry, or whether full court records are available from the Judiciary of Belize is also powerful and arguably provides information that is more valuable for business practitioners than what can be found from social media.
The practical application of OSINT research
Stewart Bertram, the Cyber Capability Manager from Control Risks presented how OSINT research was used for terrorist reconnaissance in Sub-Saharan Africa and echoed other speakers in stating that “the collection of OSINT is the easy part, but drawing the ‘so what’ is the hard part.” He demonstrated this by showing how the internet presents different information from different angles. Running a google search in China on Tiananmen Square returns images full of flag-waving nationals, however the same search from the US shows a square full of tanks and military.
His research into terrorist use of social media websites showed that of 112 sites, 79 were authored in English calling into question the group’s intended audience, as well as the link between the author and the group.
What the conference showed is that although OSINT research is a relatively new concept, it is developing fast and increasing in importance. Sir Edmund Burton suggested that “we may be forming a profession” something that resonates with people and organisations now paying attention to this type of activity. As open source research rises to the forefront of business practice we should also expect to see the evolution of more tools and techniques to support it.