Method and limits

The OSINT cycle

Open-source intelligence is a working method before it is a set of tools. The cycle has six steps, and the tools in this centre serve the collecting and preserving steps.

1. PlanWrite the question first and what would answer it. A value you collect without a question is a value you will struggle to justify.
2. CollectUse public sources only, one deliberate query at a time. Note the source, the exact address and the time of each query.
3. VerifyConfirm a finding with a second, independent source before you rely on it, and grade both the source and the information.
4. PreserveSave what you saw in a form that shows when and where you saw it, and record its hash.
5. AnalyseSeparate what the source says from what you infer. Put events in UTC order and mark every gap and assumption.
6. ReportState the question, the sources with times, the grades, the findings and their limits. Do not present a lead as a conclusion.

Preserving a finding

• Record the time in UTC, with the time zone you used for local times.
• Copy the full address, including parameters. Do not retype it.
• Save the page or response as a file and calculate its SHA-256 value. The research file does this for the raw output of every query.
• Take a screenshot that also shows the address bar and the clock. A screenshot supports a saved file; it does not replace it.
• Keep the original untouched and work on a copy.
• Write down which tool and which source produced each value.

Source grading (Admiralty code)

The Admiralty system grades the source and the information separately, for example B2: a usually reliable source, information probably true. The research file stores both grades on every item.

Berkeley Protocol

The Berkeley Protocol is a guide for online research into alleged international crimes, human-rights violations and breaches of humanitarian law, published by OHCHR and the UC Berkeley Human Rights Center. It is not Turkish law; it is a reference for method: how to plan, collect, preserve, verify and report digital open-source information so that others can check it.

Berkeley Protocol on Digital Open Source Investigations (OHCHR and UC Berkeley Human Rights Center, 2022) ↗

Legal limits in Turkey

• Public does not mean freely usable. An IP address, an email address or a phone number can be personal data. KVKK Article 5/2-d allows processing data that the person has made public, and the Board reads this narrowly: making data public is limited to the purpose for which the person shared it (Board decision 2019/331). KVKK ↗
• Law enforcement and citizens are under different regimes. KVKK Article 28 lists exceptions, such as preventive, protective and intelligence work by public bodies authorised by law, and processing by judicial authorities in investigation, prosecution and trial. Staff using this centre inside their own legal authority work under that regime. A private person collecting information about someone else is outside those exceptions.
• Do not access or load systems. Turkish Criminal Code Articles 243 and 244 cover unlawful access to an information system and blocking or disrupting it. For that reason this centre does no scanning, no login attempts and no bulk requests. TCK ↗
• Do not compile personal data. Articles 135 and 136 cover recording personal data and giving, spreading or seizing it unlawfully. Collecting scattered facts about one person into a profile can fall under them, so this centre has no profiling feature.
• What ZEKASTRA is responsible for. Law No. 5651 makes a content provider responsible for the content it publishes and, as a rule, not for third-party pages it links to, unless the way it presents a link shows that it adopts that content. The official services on this site are therefore labelled as services of the institution, not of ZEKASTRA. 5651 ↗

What this centre never does

• It does not derive a name, owner, subscriber or address from a phone number, an IMEI or an IP address.
• It does not scan ports, test logins, guess passwords or read pages that need a login.
• It does not scrape web pages or social profiles, and it does not check whether a username exists.
• It does not keep a query history: there is no server, no account and no analytics.
• It never sends a phone number, an IMEI, the part of an email address before the @ sign, a password or a file to any service. For a password check only the first 5 characters of its SHA-1 value leave your browser.
• It does not summarise results with artificial intelligence.

Sources used

These are the only places this centre queries, and only when you press a button. Everything else is a link that you open yourself. The official Turkish services are on the official channels page. Official channels