Chapter 10 — Ethics and authorized practice | Bachelor's Threat intelligence and OSINT

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 10 published. Map, example, EX028.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Public is not unlimited"]
  N2["10.2 Terms of service"]
  N3["10.3 Authorisation"]
  N4["10.4 Proportionality"]
  N5["10.5 Stop and ask"]
  N6["10.6 Ethics codes and peers"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX028"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Public is not unlimited"]
  N2["10.2 Terms of service"]
  N3["10.3 Authorisation"]
  N4["10.4 Proportionality"]
  N5["10.5 Stop and ask"]
  N6["10.6 Ethics codes and peers"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX028"]

[Learning outcomes]
    |
    v
[10.1 Public is not unlimited]
    |
    v
[10.2 Terms of service]
    |
    v
[10.3 Authorisation]
    |
    v
[10.4 Proportionality]
    |
    v
[10.5 Stop and ask]
    |
    v
[10.6 Ethics codes and peers]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX028]

Learning outcomes

You will (1) state the legal and ethical limits of OSINT collection; (2) respect platform terms of service; (3) apply data-protection principles; (4) recognise when to stop and ask.

10.1 Public is not unlimited

Information visible online is not automatically free to collect, combine and keep. Data-protection law such as the EU GDPR applies to personal data however it was obtained: collection needs a lawful basis, a specific purpose and minimisation. Combining scattered public facts about a person can create a profile that harms them.

Amara's tasks concern infrastructure, such as domains and hosting, not people. When a source includes personal details, such as a registrant's name in a domain record, she records only what the requirement needs and notes why it was kept. HCHT's data protection officer reviews the team's retention of any personal data each year.

10.2 Terms of service

Platforms set rules about automated access, account use and data reuse. Fake personas, scraping against terms and logging in to closed groups expose the analyst and employer to legal and reputational risk. HCHT's policy forbids them without legal sign-off.

Amara checks the terms of each public source before using it, and keeps a short note of what is allowed. When a source forbids automated access, she uses it manually or not at all. Sign-off from legal staff is recorded with the source, so later analysts know the decision and its limits.

10.3 Authorisation

Analysts act within a written mandate: which questions, which sources, which methods. Interacting with adversary infrastructure — visiting live phishing pages from a work laptop, registering for criminal forums — is outside an intern's authority and can alert adversaries or break the law.

Amara's mandate lists the HSSC feeds, HCHT's own logs and a short list of approved public sources, with the methods allowed for each. When a task seems to need something outside the list, such as checking a live phishing page, she asks her supervisor, who may arrange it in an isolated environment or decide it is not needed.

10.4 Proportionality

Ask whether the intelligence need justifies the intrusion. Identifying a phishing domain's hosting provider for a takedown is proportionate; researching the private life of a suspected individual is not CTI's job and belongs, if anywhere, with law enforcement.

Amara writes the purpose of each collection step in her notes and checks it against this test before starting. If the purpose cannot be stated in terms of protecting HCHT's systems or patients, the step is dropped. Her supervisor reviews a sample of her notes each month to confirm the practice is followed.

10.5 Stop and ask

When a task feels uncomfortable, pause and ask the supervisor. Record the question and answer.

Amara's notebook has a page for such questions, with the date, the answer and who gave it. Early in her internship she asked whether she could search a social media site for a phishing sender's profile; the answer was no, since the requirement was about the domain, not the person. Recording the answer means the same question does not need to be asked again, and it shows reviewers how decisions were made.

10.6 Ethics codes and peers

Professional codes — for example those of security certification bodies — ask members to act honourably and protect society. Peers help too: describing a planned collection to a colleague often exposes problems the analyst had not noticed. HCHT runs a short weekly "method check" where interns present any new source before use.

Amara presents her first new source in week three. The check takes ten minutes. Interns describe the source, what it would answer, its terms and any personal data involved, and a colleague asks questions. Several sources have been dropped or limited after a check, and the notes are kept with the team's source list.

Worked example

A colleague suggests creating a fake profile to join a closed forum where hospital data might be sold. Amara declines and escalates. The supervisor explains that HCHT will instead ask HSSC and its commercial intelligence provider, who operate under contracts and legal review, whether HCHT data has appeared.

Synthetic case. The scenario is invented.

Errors and limits

Law varies by jurisdiction; this chapter is not legal advice. Consult HCHT's data protection officer.

Exercises

EX028 — Public data. Explain why public visibility does not make personal data free to collect.
Show marking criteria
Rubric: 3 = data-protection law applies; purpose, minimisation, profiling harm; 2 = partial; 1 = it is free; 0 = none.
EX029 — Forum request. What should Amara do when asked to create a fake profile?
Show marking criteria
Rubric: 3 = decline, escalate; use authorised partners; 2 = decline only; 1 = comply; 0 = none.
EX030 — Proportionate or not. Is researching a suspect's family on social media proportionate CTI?
Show marking criteria
Rubric: 3 = no; outside mandate; law enforcement; 2 = no; 1 = yes; 0 = none.

Synthesis

Collect lawfully, follow terms, stay within mandate, weigh proportionality and ask when unsure.

Continue studying — chapter 10 of 40

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →