Issue 015 min read12 items
Provenance and attribution
Provenance and attribution, from about 16 September to 6 October 2026: hidden ownership, influence-for-hire infrastructure, imagery dates, and the October conferences and meetups.
Editor’s noteNico Dekens
This first briefing is about provenance. Open-source reporting preceded charges over hidden Russian ownership of a forensics tool sold to U.S. agencies. Those are allegations, and both men are presumed innocent. Citizen Lab mapped an influence-for-hire firm from its own infrastructure. A viral view of Gaza that was passed around as new was imagery captured in February 2026. For a basemap, the capture date is the one that counts. The rest of the issue is tools, a definition of what open means, and the October calendar.
01News
Reporting and public developments from the last two weeks.
Oxygen Forensics leaders charged over hidden Russian ownership
CyberScoop reports the arrests of Oxygen Forensics CEO Lee Reiber and Russian co-owner Oleg Davydov. A federal complaint charges them with conspiracy to commit wire fraud for concealing Russian ownership, and Russian development, of forensics software sold to U.S. agencies including the Secret Service. The complaint does not allege malicious code. The Justice Department announced the case on 23 September. These are allegations: both are presumed innocent.
Why it matters
The allegation is hidden Russian ownership of forensics software sold to U.S. agencies, not malicious code. Both are presumed innocent.
The Justice Department’s announcement, dated 23 September, is the public summary of the complaint: Tech CEO, Russian national arrested on complaint alleging they hid Russian ownership.
Related: InformNapalm on Oxygen Forensics.
BlackCore's influence operations for hire
Citizen Lab maps BlackCore, an Israeli influence-for-hire firm, from its own sites, WHOIS, and passive DNS: subdomains, a public demo of coordinated messaging and counter-narratives, and a training course for Angolan government staff. That course included a supervised influence operation. The aliases in the materials match Facebook and Instagram accounts, including some already removed.
Why it matters
The lab’s map runs from the firm’s own sites, WHOIS, and passive DNS to accounts that match the aliases in its materials.
02Tools
Software, data, and utilities that earned a closer look.
Flowsint v1.2.13
Flowsint is an open-source platform for graph-based investigations. The 3 October release enforces object-level authorization when a flow is read, updated, or deleted. It also stops a node update from clearing fields that were not set, and fixes the Maigret username enricher so display name, bio, location, and created-at are kept.
Why it matters
The 3 October release is an authorization and data-integrity fix, not a new collection source.
Censys CLI Skills
Nine markdown skills that teach an AI coding assistant to drive cencli, the Censys command-line client for public Internet scan data. Wrappers cover search, view, aggregate, enrich, Censeye, and timeline. A CenQL reference and two methodology files tell the agent to count how common a pivot is before trusting it, and to leave the raw output next to the conclusion. Requires cencli 1.0 or later. The files are plain markdown, so they are not tied to one assistant.
Why it matters
The skills tell an assistant to count how common a pivot is before trusting it, and to keep the raw output next to the conclusion.
03Tradecraft
Methods, workflows, and notes on how the work is done.
Viral Google Maps images of Gaza were not the newest view
Posts treated a Google Maps refresh as new satellite imagery of destruction in Gaza, including Rafah. Google told Bellingcat the Airbus scenes had been online since June and were captured in February 2026. Planet Labs imagery from September shows demolitions that continued after that date, in Rafah, Bani Suheila, Shujaiya, and Jabaliya. For dating a basemap, the capture date is the one that counts.
Why it matters
Google told Bellingcat the Airbus scenes had been online since June and were captured in February 2026. The capture date is the one that counts.
Open to whom?
What makes a source open? Ludo Block argues it is set by whoever controls access, and tested against a generic member of the public, not against the analyst who happens to be asking. Language, expertise, budget, and search-engine indexing are restraints on the observer. Intranets, closed memberships, and protected databases are closed sources. A reply to the claim that OSINT should be abandoned as a concept.
Why it matters
Open is set by who controls access, tested against a member of the public, not against the analyst who already has it.
OSINT techniques: a field catalog for investigators
A categorized guide to OSINT technique, published by ShadowDragon and written by Nico Dekens. It covers social media, geolocation, domain and IP work, public records, advanced search, forums, and video and audio, and it draws the line at hacking and social engineering. Read it as a map of methods. The page is also a vendor resource.
Why it matters
Use it as a map of methods. The page draws the line at hacking and social engineering, and it is also a vendor resource.
04Events
Conferences, training, and meetups, soonest first.
| Date | Event | Where | Format | Price | Calendar |
|---|---|---|---|---|---|
| 15 Oct 2026 | OSINT workshop, Den Haagbibliotheekdenhaag.nl14:00–17:00Issue 01 | Den Haag | Free | Add to calendar | |
| 21–22 Oct 2026 | M3C 2026m3c.techIssue 01 | Munich | Free | Add to calendar | |
| 24 Oct 2026 | Trace Labs Global OSINT Search Party CTFtracelabs.org09:00–13:00 PDTIssue 01 | Online | — | Add to calendar | |
| 30 Oct 2026 | OScon '26osintswitzerland.ch09:00–17:00Issue 01 | Zürich | — | Add to calendar |
05More
Reading and items that still belong in the briefing.
What Iran and Ukraine reveal about OSINT in war
Justin Sherman at CSIS writes that the U.S.–Iran war and Russia’s war on Ukraine show how little a government can control adversary use of commercial geolocation, satellite imagery, social media, and OSINT-plus-AI products. He argues for limiting the sliver that can actually be limited, including data-broker sales and operational security, and for obfuscating the rest.
Why it matters
Sherman’s argument is about the sliver a government can limit: data-broker sales and operational security.