OSINT and Server-Side Social Media Data Use for Digital Investigations

Overview

In a group we examined the gap between what investigators can learn from open-source intelligence alone on Instagram and X, and what’s only obtainable through a formal request for server-side platform data, comparing this against EU and Dutch legal thresholds. My part focused on the legal classification: mapping how each data category is treated under EU and Dutch law.

Approach

• Catalogued what’s visible through OSINT alone on public Instagram and X profiles, using privacy policies, API documentation, and passive client-server traffic analysis, versus what only surfaces in a platform’s own data export or server-side records,
• Mapped each data category, identifying/subscriber data, traffic data, and content, against the EU’s E-Evidence Regulation and the stricter thresholds in the Dutch Wetboek van Strafvordering, where nearly all categories require suspicion of a serious offence under Article 67(1),
• Compared these legal thresholds against Instagram’s and X’s own law-enforcement disclosure guidelines to see how platform practice lines up with the legal categories,
• Defined indicators that justify escalating from OSINT to a formal data request, illustrated with real cases: a child sexual exploitation case, where public signs of contact with minors justified requesting DMs, and a stalking case, where public images plus a serious offence justified requesting upload logs and metadata.

Outcome

Publicly accessible data proved useful for early leads and reconstructing context, but consistently lacked the technical and behavioural detail needed for reliable attribution, timing, or location analysis. Server-side data resolved these gaps, but access is time-sensitive and requires meeting a much higher legal bar, especially under Dutch law, which is stricter than the general EU framework.