"The best intelligence operation is the one the target never knew happened."
Open-Source Intelligence (OSINT)
Instructor Sele: The most accessible and underused intelligence tool in private security is the open internet. OSINT — intelligence from publicly available sources — can tell you who is threatening your client, what criminal networks are active in your area, and what is about to happen on the streets before it does. This module teaches you to use it professionally.
Section 1 — What Is OSINT?
Open-Source Intelligence is intelligence derived from publicly available information — any source that is legally accessible without special authority or covert means. In the Liberian context, the most operationally relevant OSINT sources include news media (FrontPage Africa, The Bush Chicken, New Democrat, Liberia Daily Observer), social media (Facebook community groups, WhatsApp, Twitter/X), government and official sources (LNP public notices, NEC announcements, Ministry of Justice press releases), international monitoring (UN OCHA, ACAPS, WANEP), corporate and public records (business registrations, land records, court filings), and mapping tools (Google Maps, satellite imagery for route and venue assessment).
Section 2 — The 3-Source Rule for OSINT
Never act on a single OSINT report. The 3-Source Rule requires that significant intelligence be verified by at least two additional independent sources before it is used operationally. This is especially critical for threat reports on social media (frequently inaccurate, exaggerated, or deliberately false), unverified rumours from community contacts, and single-source reports of specific incidents.
If only one source is available, the intelligence must be clearly graded and caveated: "Single source, unverified — treat with caution."
Section 3 — Social Media as an Intelligence Source
Facebook and WhatsApp are primary community communication platforms in Monrovia. They provide real-time information on road closures, protests, criminal incidents, and civil disturbances — often hours before mainstream media reports them.
However, social media intelligence is inherently unreliable. Posts are frequently inaccurate, exaggerated, or fabricated. Images and videos are often mislabelled (from different locations or dates). Misinformation spreads rapidly, especially during political events. Criminal actors use social media to spread deliberate disinformation.
Social media OSINT should be graded D — Not Usually Reliable by default and cross-referenced with two or more additional sources before any operational action is taken.
Section 4 — Information Classification
All intelligence handled by SafeHaven is classified at one of three levels. A principal's home address, movement schedule, and security arrangements are always classified SENSITIVE. Sharing this information on unsecured channels or with unauthorised persons is a serious disciplinary and potentially criminal offence.
| Classification | Description | Handling |
|---|---|---|
| OPEN | Non-sensitive — public information | May be shared freely |
| RESTRICTED | Sensitive operational information | Share only with authorised team members |
| SENSITIVE | Highly sensitive — principal's personal details, home address, schedules, vulnerabilities | Strict need-to-know only; never transmitted on unsecured channels |
- •OSINT sources in Liberia: local news media, social media, LNP notices, international monitoring platforms
- •Apply the 3-Source Rule — never act on a single source report without verification
- •Social media OSINT is graded D (Not Usually Reliable) by default — always cross-reference
- •Three classification levels: Open, Restricted, Sensitive
- •Principal's personal details, address, and movements are always Sensitive — strict need-to-know
"During an election period a client called me in a panic — a Facebook post was circulating saying their neighbourhood was being 'targeted by a gang.' I told them I would check and call back. In 20 minutes I had confirmed with two community contacts and the LNP that the post was fabricated — likely spread by a political actor to cause disruption. If I had acted on that single post, I would have moved a client unnecessarily, disrupted their schedule, and confirmed to them that they were under threat when they were not. Verify first. Always."
OSINT collected from a Facebook post should be treated as: