OSINT for protective teams: what it can and can’t tell you

Oct 18

MXSG Intelligence Desk | Reviewed by Mike Mees, Chief Strategy Officer | Current as of 18 October 2026

Open-source intelligence shows a protective team what an adversary can see: where the principal will be, who the family are, what has been said about them and what is happening around the places they will go. It cannot establish anyone's intent on its own, it never gives a complete picture, and in a fast-moving incident it is polluted with false and AI-generated material. Treat OSINT findings as leads that need corroboration, collect them lawfully and proportionately, and record how you found them.

Key judgments

OSINT is the quickest way to measure a principal's exposure. Published schedules, geotagged posts, family members' accounts and property records are the same sources criminals use to plan virtual kidnappings and approaches. High confidence.
OSINT cannot establish intent by itself. A hostile post is an indicator, not a finding. Threat assessment needs context, history and, often, information that is not public. High confidence.
In a crisis, verification lag is a planning factor. During the unrest in Mexico in February 2026, false reports and fabricated images spread at the same time as real violence. High confidence.
Method matters as much as the result. Collection that relies on deception or unauthorized access can create legal exposure and undermine the credibility of what is found. High confidence.

What OSINT can tell a protective team

Exposure. What an outsider can learn about the principal and family: schedules published by organizations and event hosts, geotagged or real-time posts, vehicle and property details, children's schools, staff names, and old media coverage that is still searchable. This is usually the most actionable output, because most of it can be reduced before a trip.

Threat indicators. Direct threats, fixation on the principal, grievances against the company, references to the principal's movements, and online communities that discuss them. These are signals to assess, not conclusions.

Environment. Local incidents, demonstrations, crime patterns and official alerts around the hotel, venues and routes. This feeds directly into the advance work.

Change. Monitoring over time shows when something is new: a spike in mentions, a new account, a post that names a hotel.

What it can't tell you

Intent. People say things online they will never act on, and some who act say nothing. Open sources can show behavior worth attention, but judging intent requires a structured threat assessment and usually other information.

The whole picture. Absence of evidence is not evidence of absence. Private groups, encrypted messaging and offline planning are outside what ethical open-source collection should reach.

Truth in real time. After the operation that killed CJNG leader El Mencho on 22 February 2026, claims that gunmen had taken over Guadalajara's airport were false, and widely shared images of a burned passenger plane and a burning church in Puerto Vallarta were fabricated, one with an AI image tool. At the same time, real burning vehicles were reported in 20 states. A team moving on social media alone would have made bad decisions in both directions.

Collecting it responsibly

The U.S. Intelligence Community describes OSINT as "intelligence derived exclusively from publicly or commercially available information" that addresses specific requirements. The Berkeley Protocol on Digital Open Source Investigations, published by the UC Berkeley Human Rights Center and the UN Human Rights Office, sets out standards for doing this work professionally, legally and ethically, including protecting the safety of investigators and the people they research. For protective work, that translates into a few practical rules:

Collect to a requirement. Know what question you are answering for this principal, trip or event, and stop when it is answered.
No unauthorized access and no deception to obtain private information. If it isn't publicly or commercially available, it isn't open source.
Mind the law where the principal and the data are. Privacy laws, platform terms and rules on personal data differ by country and state.
Preserve and record. Capture what you found, where, and when, so findings can be checked and, if needed, handed to law enforcement.
Protect the principal's data too. Exposure reports are sensitive. Deliver them securely and limit distribution.

What it means for principals and protective teams

Run an exposure review before high-profile travel or events, then reduce what you can: remove itineraries, pause geotagging and ask hosts not to publish arrival details.
Brief the family. Many exposures come from relatives' and staff accounts, not the principal's.
Set monitoring to the threat level. Light periodic checks for routine travel; continuous monitoring around high-risk trips, public appearances or active threats.
Verify before you act. During incidents, weigh official alerts and your team's own observations above viral content.
Route credible threats properly. Escalate direct threats to the principal's counsel and, where appropriate, law enforcement.

Indicators that monitoring should step up

A new or escalating fixation on the principal or company.
Posts that reference specific locations, dates or travel.
Coverage that connects the principal to a contentious issue.
An incident at or near a planned venue or hotel.

Sources

Office of the Director of National Intelligence, IC OSINT Strategy 2024–2026: The INT of First Resort. archive.dni.gov. Reliability: high (official).
UC Berkeley Human Rights Center and UN Office of the High Commissioner for Human Rights, Berkeley Protocol on Digital Open Source Investigations, 2 December 2020. humanrights.berkeley.edu. Reliability: high.
Jonny Wrate and Lilia Saul, OCCRP, Fear is the Message: How the Jalisco New Generation Cartel Weaponized Algorithms to Paralyze Mexico, 27 February 2026. occrp.org. Reliability: high.
Erin Drake, S-RM Insights, analysis of virtual kidnappings targeting hotel guests in Mexico, 5 August 2020. s-rminform.com. Reliability: moderate.

This article is general guidance derived from open-source materials current as of 18 October 2026. It is not legal advice and is not a tailored assessment for any principal or event.

Mike Mees