Passive vs Active OSINT
concept
Core idea
Passive OSINT collects information without interacting with the target, viewing a public profile, reading a cached page, or querying a block explorer. Active OSINT involves direct interaction and leaves traces, so it should only be done when operationally justified. The rule of thumb is to always begin with passive collection.
When to use
Use passive collection first for reconnaissance on any subject; escalate to active collection only when a specific, operationally justified need requires direct interaction.
Avoid when
Avoid active OSINT unless operationally justified, direct interaction leaves traces and can alert the subject.
Example
Reading a suspect’s cached forum posts (passive) before ever sending a message or connection request that would tip them off (active).
Related
The OSINT Lifecycle, Manage Both Digital Footprints (OPSEC), Investigation Risk Categories & Mitigations