Open-source intelligence in public health: a decision-centred framework

Introduction

Early signs of public health threats can show up outside the usual monitoring systems, including in local news, citizen reports, social media, publicly available images, and leaks before official publication. But these signals can be unreliable, inconsistent, or even manipulated. The challenge for public health authorities is not simply to gather more data. It is to quickly determine which signals are credible and what they mean, so they can make informed decisions while still following evidence-based, legal, and ethical standards.

Open-source intelligence (OSINT) refers to information obtained by collecting, verifying, analyzing, and selectively disseminating data from legally accessible sources [1]. This distinguishes raw open-source data from information that has been evaluated and given intelligence value for a defined purpose [2]. In Ukraine [3], the Gaza Strip [4], and Sudan [5], investigative journalists, humanitarian organizations, and military intelligence are showing how these scattered digital traces can be authenticated and confirmed [1]. Public health applications include early detection of epidemics, such as during the Ebola outbreak in West Africa; verifying compliance with protective measures; identifying misinformation and communication gaps; and understanding rapidly developing emergencies.

Sources can be freely accessible, such as official announcements, local press, social media posts, public databases, preprints, maps, and publicly available images. In the context of OSINT, however, ‘open’ means legally accessible although not necessarily free of charge. Other sources, such as near real-time satellite imagery, mobile phone and tracker data, or sales data, may require payment, although just because information is legally accessible does not mean that it is necessary, proportionate, or ethically appropriate to collect or use it. Public health already uses event-based surveillance, digital epidemiology, social listening, participatory surveillance, and cyber-threat intelligence. OSINT does not replace these methods. Rather, it complements them.

The WHO’s Open Source Epidemiological Intelligence initiative illustrates how these methods are being integrated into operational public health intelligence, although governance, evaluation, and institutional integration still need further development [6].

Greater use of OSINT should not be used to justify indiscriminate data collection. Its main value is helping reduce uncertainty when making decisions. When combined with reliable epidemiological data and models, OSINT can also support short-term forecasts and scenario planning. It is important not to treat open-source signals as reliable predictions on their own. We therefore propose a decision-making model that connects four priority functions with clear information needs, proportionate verification, safeguards, and established routes into monitoring and emergency response systems. Compared with existing approaches to epidemiological surveillance and investigation, its added value lies in integrating these elements into a single, structured cycle that begins with a clear decision and ends with responsible action and review.

OSINT as part of public health intelligence

Open data becomes useful intelligence through a structured process that connects data collection to interpretation and action. The need for information should start with the decision that needs to be made, who will make it, and how quickly it needs to happen. Instead of simply telling analysts to ‘monitor social media for outbreaks’, a government agency could ask, ‘Is there enough credible evidence of unexplained respiratory illness in Region X to justify an on-site investigation within 24 hours?’ Framing the question this way helps guide what data to collect, who the information is for, and what could happen if the assessment is wrong.

The intelligence cycle has five connected phases: decision, information gathering, verification, evaluation, and action and review. The process is iterative, meaning that new information can change the situation, failed verification can stop an issue from escalating, and feedback can help improve future information gathering (Box 1).

Box 1.

A decision-oriented cycle for OSINT in public health

1. Decision: what decision should be made, by whom, and when? Define the requirements and costs of taking action or inaction.

2. Data collection: which legitimate sources are necessary and proportionate? Scope and blind spots of data collection.

3. Verification: is the content authentic, temporally, and geographically appropriate, independent, and contextually relevant? The threshold must correspond to the action.

4. Evaluation: indicate what is known, uncertain, or biased. Assess the authenticity, interpretation, and relevance; consider alternatives.

5. Actions and analysis: integrate the results into existing systems. Document the decision, the outcome, and what would have happened without the use of OSINT data.

The model distinguishes between signal verification and epidemiological validation [7]. Signal verification checks whether a source, such as a publication, image, video, document, recording, or dataset, is authentic, correctly dated and geolocated, independently verified, and correctly interpreted. Epidemiological validation, on the other hand, typically aims to determine whether an event indicates the occurrence or transmission of disease or injury. Even an authentic, correctly geolocated artefact may provide only limited evidence of health effects. OSINT should therefore support, not undermine, epidemiological investigations.

Four public health functions

OSINT is particularly valuable when timely information is scarce. Table 1 applies the decision, collection, verification, evaluation, action, and review cycle to four public health functions. For each function, define the information requirements, verification thresholds, and action modalities in advance, and re-evaluate them after application.

Table 1.

Application of decision-oriented OSINT to four public health functions.

Function	The decision was supported	Typical open-source sources	Primary failure mode	Verification threshold	Access route to the event
Epidemic signal	Should we investigate this further?	Local media; community and multilingual social reporting; animal health reports	False, duplicate, or non-representative reports	Trace origin and independence; confirm; search for clinical or field evidence	Incident monitoring and field investigations
Awareness of emergency situations	Where should resources be deployed?	Geolocation reports; notifications; images; fault and bottleneck reports	Overload; errors in scheduling or location selection; endangerment of sensitive areas	Triangulation in relation to urgency; stronger evidence justifying public action	Crisis management and disaster relief
Information environment	Whether the communication is appropriate and how	Summarized research findings and social listening; media; community feedback	Viewing online activities as expressions of opinion; platform and language distortion.	Behavioural and cross-platform evaluation; offline triangulation	Risk communication and infodemic management
Resilience of services	It needs to be determined whether protective measures are necessary.	Threat and fault alerts; exposed systems; power signals	Identified weaknesses; incorrect attribution; fragmented ownership	Specialized, limited review of functionality and relevance	Cybersecurity and business continuity planning

The first signs of an epidemic

OSINT can reveal whether an unusual event requires investigation before routine reporting or laboratory confirmation. Potential sources include official websites and alerts; local, specialist, and diaspora media; community reports and helplines; social media platforms and multilingual news outlets; professional and animal health networks; public dashboards and registries; search trends; preprints and data repositories; maps, photos, videos, and satellite imagery; transportation, mobility, weather, and environmental data; and, where applicable, commercially available data. These sources can uncover outbreaks of infection, unusual patterns of illness or death in humans or animals, service overload, patterns of adherence to public health measures [8] or misinformation that could affect case detection, immunization, or other control measures. This function is the longest established. ProMED alerted English-speaking audiences about SARS [9], while HealthMap identified reports related to the West African Ebola outbreak before its official announcement [10]. A retrospective analysis in the WHO Africa region identified corresponding signals for 81% of events reported to the WHO. Of these, 47.4% of cases were detected before official reporting [11]. However, false alarms, duplicates, media exaggeration, and digital blackout limit the reliability of these signals. Any follow-up should include tracing the original report, verifying source independence, and correlating the signal with clinical, laboratory, or field findings. The threshold for a discrete investigation may be lower than that for a public alert.

The value of OSINT depends on the situation. When routine surveillance is timely and comprehensive, it can add useful context, identify events that fall outside standard reporting systems and definitions, and help independently verify official data. When surveillance is delayed, inconsistent, or incomplete geographically, OSINT may provide earlier warnings and help target verification efforts, e.g. when events cross national borders. However, such settings may also have less connectivity and reduced capacity to coordinate investigation of signals. For this reason, OSINT should complement rather than permanently replace investment in clinical, laboratory, community, and regulatory reporting systems.

Knowledge about the emergency

In emergencies, OSINT can help determine the locations of personnel and equipment [12], in many cases more quickly than conventional reporting systems [13]. However, as Bernard et al. [14] demonstrate in their detailed analysis of the opportunities and challenges involved, the sheer volume of information can overwhelm emergency responders, while location errors or the disclosure of sensitive locations can have serious consequences.

Agreed priorities, responsibilities, and escalation procedures for gathering information should be established before a crisis happens. After a flood or earthquake, e.g. verified, geolocated reports of blocked roads, damaged clinics, medicine shortages, or displaced populations can help incident commanders decide where to send mobile teams and how to prioritize supply routes. During an epidemic, repeated local reports of long queues, staff shortages, limited oxygen, or disrupted treatment can trigger checks of health facilities and help reallocate resources faster. These signals should prompt verification, not replace official operational reports. If delays could create additional risks, verification may need to happen quickly and in stages. However, claims with serious consequences should always include a clear assessment of confidence, which can be updated as new evidence emerges. Crisis managers need clear, focused assessments, not a flood of unfiltered information.

The information environment

Aggregated social listening helps determine if and how public health organizations communicate, which target groups need information, and which channels are most likely to reach them [15]. Recurring narratives can reveal communication gaps and perceptions of the feasibility or legitimacy of proposed measures. Misinformation can negatively impact vaccination rates, treatment adherence, case reporting, and trust. OSINT can help describe the scope, velocity, sources, and cross-platform spread of these narratives. The WHO defines social listening as analyzing diverse data on conversations, attitudes, beliefs, and intentions to inform proportionate interventions [16].

OSINT can help assess sources, compare information across platforms, and judge how reliable a signal is. However, online conversations rarely give a complete or accurate picture of public opinion. Automated tools can also struggle with things like irony, minority languages, and coordinated activity, including bots. Analysts should therefore focus on broader trends, combine automated tools with behavioural science expertise, and compare their findings with surveys, service data, and direct engagement with communities.

Operational resilience of health services

OSINT data can reveal whether operational threats require protective or business continuity measures. Reports of phishing attacks, unprotected systems, outages, supply chain disruptions, or digital infrastructure threats can precede routine notifications. The focus should remain on business continuity. While participatory symptom monitoring systems and citizen science provide complementary data, they do not capture service load or incident frequency [17–19].

This function inherently serves a dual purpose, as detailed information about vulnerabilities can be useful to attackers. Therefore, it requires expert review, role-based access control, a reporting system restricted to those who need to know, and integration with cybersecurity, procurement, and disaster recovery planning.

Verification, trust, and boundaries

One of the main risks with OSINT is confusing how much attention a problem gets with how often it actually happens, or assuming repeated reports automatically confirm something. Reports can be wrong, manipulated, duplicated, or taken out of context, and seeing the same claim many times does not mean that the reports are independent. Search activity can also reflect media coverage rather than actual disease activity or transmission patterns. The experience of Google Flu Trends shows how changes in search behaviour, platform changes, and differences between models and reality can lead to misleading results [20].

Verification should include checking a source’s origin, asking when and where the information was collected and whether different reports are truly independent. Methods include reverse searches and metadata checks. No single OSINT tool is sufficient for all purposes, so verification will often require a combination of automated tools and manual methods [2]. Artificial intelligence (AI) is increasingly useful for translation, information extraction, source combination, and summarization, but it can introduce errors, reproduce bias, misinterpret context, and reduce traceability [21, 22]. AI-generated findings should therefore be corroborated against independent sources and subjected to appropriate human review [2]. Where legally permitted and required, organizations should retain original documents, search queries, tool versions, and analysis results. An AI-generated summary may not be independently reproducible.

OSINT users also need a standardized method to express their trust in a source. Trust assessments must consider three dimensions: (i) authenticity, i.e. whether the signal is genuine and correctly located; (ii) interpretive validity, i.e. whether its meaning and context are correctly understood; and (iii) relevance to the decision, i.e. whether the signal has a significant impact on the decision to be made. A source may be genuine and correctly located, but still be unrepresentative or irrelevant.

These assessments should consider factors such as how reliable the source is, how credible the information appears, whether it has been independently confirmed, whether the timing and location are accurate, whether it fits with what is known epidemiologically, what other explanations are possible, and what the consequences would be if the assessment were wrong [23]. Users can assign a rating to each dimension, taking into account characteristics such as independence, clarity, completeness, relevance, and rigour [24]. They should be able to justify their rating and identify factors that could influence it. A low level of trust may warrant discreet verification, while public warnings or actions affecting individuals require more extensive confirmation.

Online data are often unrepresentative, as they tend to overrepresent populations with good internet access and strong media presence. Depending on the platform and the situation, some groups may be much more visible online than others. Young people, urban residents, wealthier people, those with higher levels of education, and majority-language speakers may be overrepresented, while children, older people, migrants, people living in institutions, and those in rural or low-connectivity areas may be missed. Online trends can also differ by age, gender, income, education, disability, location, and language, so it is important to understand what each platform’s data actually represent. People who are particularly vulnerable may leave very few digital traces, and a lack of online reports does not necessarily mean that there is no problem. Analysts should therefore consider who each data source represents, who may be missing or vulnerable, and what inequalities this could create.

Legal and ethical considerations are inextricably linked to OSINT. Online visibility, particularly on social media [25], does not eliminate the need to verify that it can be used. This is especially important when marginalized or persecuted communities are affected [26]. Studies of public health research projects that use social media data have found gaps in ethical oversight and in how personal information is handled. Consequently, data governance should be based on potential risks, rather than simply on whether the data are technically accessible [27]. In the EU and EEA, data protection is a fundamental right, and the General Data Protection Regulation applies to public bodies [28]. Institutions therefore need a clear legal basis for using data, should only use it for defined purposes, collect only what is necessary, protect sensitive and personal information, and carefully manage cross-border data transfers. Clear responsibilities, impact assessments where needed, role-based access, defined retention periods, audit logs, and transparency are all important safeguards.

Purchased data also require careful checks before use. Organizations should be able to explain why acquiring the data is necessary and proportionate, assess the provider and how the data were obtained, consider the risks of combining it with other data, review access requests, and limit how widely the data are shared [29]. The level of protection should correspond to the effort involved in the acquisition, not an ‘open source’ label. Governance must also consider intellectual property and risks to individuals, communities, and infrastructure.

Bias should be viewed as a potential risk at every stage of the process. Selection bias happens when the sources available or chosen over represent certain populations, places, languages, or events. Confirmation bias can cause analysts or decision-makers to focus on or interpret evidence in ways that support what they already believe. The echo effect occurs when the same claim is repeated across different media outlets or platforms and is mistakenly treated as independent confirmation. Algorithmic bias can also affect what people see through platform rankings and moderation systems.

Ways to reduce these risks include setting clear information requirements in advance, using a range of different sources, actively considering alternative explanations, tracing claims back to their source, recording evidence that challenges the main conclusion, using human review, and carrying out audits across different languages, populations, platforms, and time periods.

Institutionalization of OSINT in the European public health system

Europe faces a particular challenge because health threats can cross borders, while many responsibilities and resources are spread among national, regional, and European authorities. This structure is set out in Regulation (EU) 2022/2371, which covers epidemiological surveillance, the rapid alert and response system, risk assessment, and coordinated action on serious cross-border health threats [30].

Surveillance also needs to work across multiple languages and fragmented media environments. At the same time, assessments may need to be shared quickly between public health, disaster response, and cybersecurity organizations. The European Centre for Disease Prevention and Control already combines indicator-based and event-based surveillance through EpiPulse [31]. OSINT should strengthen these mechanisms, not duplicate them. Common standards would enable the rapid exchange of assessments without the unnecessary transfer of personal data. Four points deserve particular attention.

First, each function should have a designated manager who can set priorities, approve sensitive methods, and decide who is authorized to receive information. Their role should clearly define the purpose of the work, its legal basis, escalation procedures, safeguards, data storage, and available legal remedies. More intrusive methods should be subject to additional scrutiny.

Second, specialized or networked OSINT and public health intelligence teams within national, regional, and local health agencies, as well as associated emergency and security organizations, should combine expertise in epidemiology and intelligence analysis with data science, behavioural science, communications, cybersecurity, ethics, law, and languages [32]. Smaller organizations can develop this capability through formal interagency networks. Training should cover source evaluation, relevant verification methods, maintaining trust, dealing with bias, data protection, and concise, decision-oriented reporting.

Third, procedures should put the full cycle into practice, specify which sources can be used, ensure the origin of data is recorded, document key decisions, and provide secure tools suited to different roles. How data are collected is itself part of good governance. Institutions should therefore maintain inventories of their data sources and models; assess vendors and data quality; validate queries; and conduct regular reviews.

Fourth, OSINT should integrate with and complement existing risk assessment and incident management systems. Exercises should allow evaluation of lessons learned from the organization’s experiences under independent oversight.

Is it worth it?

Early detection is of little use if it leads to too many false alarms, consumes limited resources, or fails to influence decision-making. Existing event-driven monitoring frameworks assess input, activities, output, outcomes, and impact. OSINT data assessments should build upon these frameworks while also considering the impact on decision-making, fairness, harm, and the counterfactual scenario of what would have happened without this capability [33]. The assessment should include the following:

• Speed: has OSINT significantly reduced the time required for detection, verification, evaluation, or action?

• Added value: did it provide relevant information for decision-making that was not available with conventional systems?

• Accuracy: what proportion of the warning signals proved to be credible, and which important events were missed?

• Workload: how much time did analysts and stakeholders spend on collecting and verifying data?

• Impact on the decision: did the evaluation appropriately change the decision?

• Justice: has it improved or worsened the visibility of marginalized population groups and minority language communities?

• Harm: has it created risks to privacy, security, trust, or the avoidance of stigmatization?

• Cost-benefit ratio: did the advantages outweigh the costs?

• Have agreed measures been assessed in advance?

Conclusion

Public health OSINT is not just a new type of data but rather a new means to support decision-making. European organizations should treat OSINT as an important part of public health infrastructure, with clear, targeted objectives; independent oversight; skilled staff; and strong links to existing processes, from detecting and verifying signals through to taking action.

Conflicts of interest

All authors are writing in their capacity as advisers to or section leads in EUPHA. M.M. has been an adviser to the UK Ministry of Defence.

Funding

None declared.

Data availability

All data are from publicly available documents cited in the paper.

Ethics approval

Not applicable as no human subjects involved.