On December 2, 2024, the Office of the Director of National Intelligence (ODNI) published a document that will fundamentally change the way open-source intelligence (OSINT) is cited and handled.[1] Promising a “forward-looking approach” to the handling of publicly available information (PAI), commercially available information (CAI), and OSINT, this new standard documents how each source will be cited and referenced in all U.S. Intelligence Community (IC) documents.

Why was this new standard developed?

It was created to help ODNI meet its goal of providing the IC with reliable and verifiable OSINT that is accurate and authentic.[2] A further goal is to professionalize the discipline of using OSINT. This professionalization helps the IC better understand “the type, quality, and use of PAI, CAI, and OSINT sources underpinning intelligence assessment.”[3]

Before we dive deeper into the new standard, let’s review what led to its creation.

The growth of OSINT and the emergence of AI

In 2021, the global market spent $5 billion on OSINT products and services.[4] Custom Market Insights estimated that the demand for OSINT will grow at an annual compound rate of 28% between 2022-2030, culminating in a global OSINT market of $36 billion by 2030. OSINT has proven its value. And the emergence of one trend has made the production of this valuable intelligence product even far more efficient and effective: artificial intelligence (AI).

Producing effective OSINT has traditionally been an intensive manual process. Humans have had to pore through news pages, transcripts, interviews, and videos to extract and compile the data required to answer an intelligence question. The advent of AI has dramatically changed this process[5], providing intelligence analysts with exponential advantages in:

Collecting, processing, and analyzing data
Reading multiple languages
Identifying trends
Mapping relationships
Predicting outcomes

Despite the advantages that OSINT and AI have yielded, their growth has nonetheless created a formidable problem for intelligence analysts.

What’s the problem?

OSINT has one core problem: it relies on PAI. Despite its value, PAI (the raw input to OSINT) creates a dilemma for intelligence professionals: how accurate and reliable is the data? This is one of the most difficult questions that intelligence analysts face.[6] The potential for false data to produce misleading or even disastrously wrong OSINT drives the need for PAI to be verified.[7] In short, intelligence professionals must produce reliable and verifiable OSINT.

In order for OSINT to be elevated to the INT of first resort[8], analysts must be able to determine the “provenance and validity” of source data.

Provenance and reliability: solving OSINT’s reliability problem

The word provenance means source or origin; valid means robust, well-grounded, and having legal authority. In simple terms, the way to vet PAI is to verify its source and then determine whether that source is reliable. Go to the source and find out if that source is reliable — before relying on what that source is telling you.

One writer on OSINT has identified three rules to follow when verifying whether a source is reliable.[9]

Be professional and unbiased — keep your emotions out of it
Evaluate the source separately from the data — do not be influenced by the data
Evaluate as close to the source as possible — do not accept secondhand distillations or interpretations

To formalize the process of validating PAI, ODNI has published the new standard we referred to in the opening paragraph. The document “Citation and Reference for Publicly Available Information, Commercially Available Information, and Open Source Intelligence” states that the new standard is an important step in modernizing the approach to analyzing PAI, CAI, and OSINT.

So, you may ask, what’s in the new standard? How does it “modernize” the approach to analyzing open-source intelligence?

Citations are the key

This new Intelligence Community Standard (ICS) establishes the citation convention for PAI, CAI, and OSINT objects. Going forward, the convention must be applied to every intelligence product — assessment, study, estimate, compilation, database, graphic, or interactive publication — created by any element (CIA, NSA, etc.) of the IC. ODNI is responsible for ensuring this new standard is implemented broadly and consistently across the IC.

At the heart of the citation convention is the source. The standard defines a source as “an originator or discrete parcel of data or information.”[10] Examples of sources are a person, document, passage, quotation, data record, database, tweet, email, book, and website. In addition to requiring the data elements you might expect — Author, URL, Title, Date — the ICS requires that for each source a source descriptor be provided.

According to the new standard, the mandatory source descriptor is a “brief, narrative exposition of factors that affect or indicate the quality or credibility of a single source.”[11] In other words, the citation assesses the trustworthiness and reliability of the source. This must be done in every citation created. In essence, the source descriptor addresses the key problem analysts face when using PAI: how to evaluate whether source data is reliable.

What does the source descriptor look like? The new standard gives an example:

PlatformXYZ, hosted by think tank Y, has a mission statement to increase public spending on X. Guest authors produce fact-based, original research but often from Y policy position.

Here’s a second example, this one coming from a source based on Generative AI:

TalkXYZ platform was used, with the following prompt: “Generate a report on the city of Beijing. Tell me about the history of the city. Write this in a formal tone. Include citations from National Geographic.”

Every element of the IC must implement the new citation standard defined in ICS 206-01. Therefore, it’s critical that you understand how to apply the standard when documenting the open-source intelligence sources you rely on.

Look for our helpful new e-book that provides clear examples on how to apply the citation standard to every source you cite.

End notes

1. Office of the Director of National Intelligence, December 2, 2024, “Citation and Reference for Publicly Available Information, Commercially Available Information, and Open Source Intelligence”, https://www.dni.gov/files/documents/ICD/ICS-206-01.pdf

2. Ibid

3. Ibid

4. Custom Market Insights, "Global Open Source Intelligence (OSINT) Market 2024 – 2033", https://www.custommarketinsights.com/report/open-source-intelligence-osint-market/

5. Uri Boros, August 25, 2024, “How AI is Changing the Game in Open-Source Intelligence: A Deep Dive”, https://www.linkedin.com/pulse/how-ai-changing-game-open-source-intelligence-deep-dive-uri-boros-cmezf/

6. Shadow Dragon, September 4, 2004, “What Are the Common Struggles of OSINT Investigations?”, https://shadowdragon.io/blog/what-are-the-common-struggles-of-osint-investigations/

7. Paul Wright, September 19, 2024, “The Challenges in OSINT Analysis Concerning Digital Evidence”, https://www.linkedin.com/pulse/challenges-osint-analysis-concerning-digital-evidence-paul-wright-yutrc/

8. Office of the Director of National Intelligence, March 8, 2024, “The IC OSINT Strategy 2024-2026”, https://www.dni.gov/files/ODNI/documents/IC_OSINT_Strategy.pdf

9. Callum Andrew, September 11, 2023, “Source Validation – A Critical Step in OSINT Investigations”, https://www.fivecast.com/blog/source-validation-a-critical-step-in-osint-investigations/

10. Office of the Director of National Intelligence, “Citation and Reference for Publicly Available Information, Commercially Available Information, and Open Source Intelligence”

11. Office of the Director of National Intelligence, “Citation and Reference for Publicly Available Information, Commercially Available Information, and Open Source Intelligence”