In the latest episode of From the Source, we’re joined by Henri Beek, lead analyst at DataExpert in the Netherlands. Discussing agentic AI, synthetic data, continuous learning and ethics, Henri shares his experience and insight. Read more from Henri below or listen to the full episode: A Journey Through OSINT with Henri Beek.
Henri has been working professionally in OSINT for 17 years, but his interest began with his passion for gaming.
“It started with multiplayer gaming, trying to find out on the internet, well, in the stages of the internet when you still had a modem with a phone line, who the adversary is. And see if you can find stuff you can shout at them during a multiplayer match so that they would slip up and you would win.”
He then started writing scripts and eventually got the attention of a private investigation firm who used OSINT as part of their investigations. However, the company’s OSINT procedure only consisted of the local Chamber of Commerce, the land register, and Google. Henri began learning more about OSINT and experimenting. Eventually, he moved to a digital forensics investigation firm before joining DataExpert, first as a trainer and now in cyber threat intel(CTI).
Henri says that when it comes to artificial intelligence (AI), you must be careful with personally identifiable information (PII). But in his current role, where he works a lot with domains and hash values, he sees possible benefits from an agentic AI that could find the relevant information for him.
”I’m currently dabbling a lot with agentic AI. I am trying to see if there is a possibility of building something like an OSINT agent that could help you during your investigations and leave all the repetitive stuff to the agent so I can focus on the more serious things myself, for example,” says Henri.
He adds that while AI can help with tasks like debugging or writing a bookmarklet, he tries to avoid AI when teaching beginners during a coding training course, for example. This is because when AI makes mistakes, you don’t know how to fix it. After all, you didn’t build it.
“I always see AI as a companion, like Yoda on the shoulder of Luke on Dagobah. It can support you with the stuff you're doing, but not in the lead role,” he adds.
For Henri, AI also presents some pitfalls, including synthetic data and legislation. He explains that, today, entire websites and social media profiles can be created with AI. This introduces investigation complexity by adding an extra layer of data filtering and a question of trust. And, with no legislation in place to watermark all AI-generated content, or other ways to identify AI-generated content, this can be difficult. “Is it good enough to help in our investigation, or will it become a larger problem in the coming years, and we will have to sift through the mud to find those gems of real data?”.
Henri discusses the ethical and legal implications of using breached data. He explains that some law enforcement and cybersecurity teams can use it, depending on the country’s legislation. But as an OSINT professional, it’s sometimes unclear.
“Yeah, it's troublesome to see if you can use it,” he says. “Although it's a very good source of information, it’s still stolen data.”
He’s interested to see what’s next and whether there will be a consensus about using breached data in OSINT investigations.
“I still see so many question marks around its usage between different countries or continents around the world,” says Henri. “I'm very curious to see where it goes.”
Henri explains that, like the fragmentation of regulations and guidelines, the web experiences similar splintering.
“There was not much of a border between countries on the World Wide Web back in the day,” Henri begins. “What you currently see with all the geopolitical tension is that countries tend to block certain content, disallow the usage of VPN, or even block entire websites or even disconnect themselves from the World Wide Web to keep information in for other users and also keep other information out for their own citizens.”
He adds that this is a problem he will likely see as an OSINT professional. He explains that for some countries, it will become harder and harder to get information from public sources because the websites will be out of reach, even with a VPN. He believes this ‘splintering’ will present itself in other ways, too, through paywalls.
“There are a lot of journalists doing hard work, and they also need to get paid. They also have a mortgage or rent they have to pay,” says Henri. “So I understand that many news media are using paywalls to ensure they get paid for their content. But it doesn't help to get reliable information sources for your investigation, especially if you are a starting OSINT investigator; your budget is usually tight for tooling.”
If you want to get into OSINT, Henri recommends various books, podcasts and resources.
You can find out more from Henri on K2SOSINT.
Listen to A Journey Through OSINT with Henri Beek in full and stay tuned for even more OSINT insight on Blackdot’s next podcast episode.