OSINTers are Good at Bad Jokes

One of my favorite jokes:

Doctor: I have bad news. Your cancer has taken a turn for the worst. You have 3 months to live. And sorry, I have to give you the bill.

Patient: Oh my god. I can’t pay that

Doctor: OK, you can have another 3 months.

Here’s a variation of the joke heard often in fancy airline lounges, same idea, a bit more sophisticated:

CPA, what is 2 +2

CPA: what do you want it to be

I’m telling bad jokes because I just rolled off a pretty large case. I got a few hours to kill. Our final memo topped 30 pages. Of all those thirty pages, perhaps the most notable, a passage about half-way through, with excerpts from a court filing I found. There it was. On paper. A Temporary Receiver reported. Of the same people we were researching. It was not pretty. Allowed me to put a lot of vital information into the memo. I’m ready to relax.

We laugh at these jokes because we all know the best answer to any question is, it depends. The invariability of open source intelligence is that much of it doesn’t depend. There is a criminal record. There is not. The financial statements have a going concern warning. They do not. Articles have been written. They have not. A suit was filed. It was not. You ask. You get. We hoover up these results; summarize and sort them into various categories. Except whether certain things are found—well, it depends.

·       It depends on things not always under your control

·       It depends on things you do well

You Can’t Control the Weather

A few weeks ago, I sat in front of my laptop. Continued to search. I had a good sense of the target’s sleaziness. I still needed articles, lawsuits, regulatory filings, something, anything, to support my opinion, my gut. I put in words, looked at what came across my screen; followed a link. There it was. That Temporary Receiver report. All of it. Documented. It  was filed on that day. It wouldn’t have been there had I searched the day before. No part of my 30 years of research brilliance would have mattered.

I could give hundreds of other examples of the adage, it’s better to be lucky than good. Sometimes things just find their way into your lap. It is also true that scope, the amount of time you spend, what names you search, where you search, all impact your findings. It depends because you cannot control the weather.

You Can Be Good at OSINT

It depends because you can figure things out. In a huge asset search a few years back. I collected a public record that exposed, and I mean exposed, the subject of our research. From this document, we produced a schedule with like 800 entities from off-shore to on-shore. We looked like geniuses. Again, this was a public record. Anyone could find it. Would other researchers have found it? It depends. On whether they would have done what I did. Figured it out the way I figured it out.

The material I found, the 800 entities. It was buried deep, and I mean deep in a document. These were like appendices to appendices, all within pdfs, which are not easily searchable. What it depended on was 1) finding the main document; 2) understanding the value of this document in the context of the asset search. In other words, the document was not titled ‘800 companies within’; and, 3) keep reading to get to the right material. Making that connection, knowing that document even mattered, and then knowing to look deeper into another document. All that. It depends.

I’ve written about this before, as I put it way back in 2022, “It’s not what you find, it’s what you know when you find it.” I really should have said, It’s not what you find, it’s when you know you’ve found it. My blog lesson in 2022, was, you had to just know things, via reading, podcasts, social media, so that things make sense when you see them. The more you know, the more likely you will see the importance of a piece of data. That’s part of it. There are other traits: making connections, abstract thinking, curiosity—which are harder to teach. I’ll say this, just having more insight is not a great blog topic.

Good OSINTers laugh at your jokes because they know so much of their work depends. Like this.

In 2024 I didn’t do the Chicago Marathon. I didn’t do one in 2021, 2022, or 2023, either. This is a running joke.