Boolean searching for OSINT: turn a question into a query

Boolean search tells a search engine which words must appear, which are alternatives and which to leave out. Each platform speaks its own dialect, so a query that works on Bing can fail on Google or X.

Photo: Daniel Forsman / Unsplash

What it is

There are five building blocks, known as operators, illustrated here with Harrowgate Freight Ltd, a fictional haulier.

• AND requires both words: Harrowgate AND tender.
• OR accepts either: contract OR tender.
• NOT (or a minus sign) leaves pages out: Harrowgate -jobs drops careers pages.
• Quotation marks keep a phrase together: "Harrowgate Freight".
• Brackets group terms: Harrowgate (contract OR tender).

Bing documents all five, evaluating brackets first and OR last, so unbracketed Harrowgate contract OR tender reads as “Harrowgate and contract, or tender on its own”.

Why it matters for an OSINT analyst

OSINT (open-source intelligence) starts with a question; Boolean turns it into a query, something a search engine can act on.

• Google. Plain words are treated as “all these words”. Google’s Advanced Search page says to type OR between alternatives and a minus, not NOT, before unwanted words. It shows OR in capitals; vendor guides say lower-case or is an ordinary word. The pipe (|) and brackets are reported to work, but Google documents neither, nor the capitals rule, and a July 2026 test could not tell whether OR changed results much.
• Bing. It supports AND or &, OR or |, NOT or minus, quotes and brackets. Lower-case or and not are discarded as stop words, and only the first ten terms are used.
• X (formerly Twitter). The Advanced Search form works when logged in. Its “any of these words” field becomes contract OR tender in the search box, the exclude field becomes -jobs, and the phrase field adds quotes. X’s developer documentation says a space means AND, OR gives alternatives, a minus excludes and brackets group; operators are not case-sensitive. That covers the API (what programs use), not the site; investigators’ guides report the same typed operators work on x.com. Test first.

How to do it

1. Write the question in plain English. “Has Harrowgate Freight Ltd won or bid for public contracts?”
2. Pull out the key ideas. Company; contracts.
3. List alternatives. Trading names (Harrowgate Logistics); synonyms (tender).
4. Join alternatives with OR, inside brackets. ("Harrowgate Freight" OR "Harrowgate Logistics") and (contract OR tender).
5. Join the ideas with AND. Type AND on Bing; on Google and X a space does the job.
6. Remove noise with a minus. -jobs.
7. Go broad, then narrow. "Harrowgate Freight" first, then add (contract OR tender), then -jobs.
8. Log every query. Date, platform, exact query, useful results and next step (the diagram shows a fictional log).

Google:  ("Harrowgate Freight" OR "Harrowgate Logistics") (contract OR tender) -jobs
Bing:    ("Harrowgate Freight" OR "Harrowgate Logistics") AND (contract OR tender) NOT jobs
X:       ("Harrowgate Freight" OR "Harrowgate Logistics") (contract OR tender) -jobs

Figure: OAT teaching graphic. Fictional data.

Worked example

Harrowgate Freight Ltd (harrowgate-freight.example) wants to know what outsiders could learn about its supply chain. The company and every result below are invented. Its security lead begins with "Harrowgate Freight" and gets a page of job adverts. Adding (contract OR tender) and -jobs leaves two trade-press stories and a tender notice; on X the same query finds staff posts about a new depot contract. Her log records what each query found, and where.

The OAT view

A logged query is a record of what you asked, and so of what you didn’t. We would take a plain query anyone can rerun over a clever one nobody can reproduce.

Common mistakes

• Too many terms. Bing uses only the first ten and does not say how it counts operators or quotes. Five synonyms in one bracket is half the budget.
• Assuming the same syntax everywhere. Test each platform with your own organisation’s name and -jobs; if the careers page survives, the minus failed.
• Treating “no results” as “doesn’t exist”. "Harrowgate Freight Limited" can return nothing while "Harrowgate Freight Ltd" finds the notice. Google does not promise to index every page (add it to the catalogue it searches), and even site: can leave indexed pages out.

The legal bit

Purpose matters on public pages too. If your searches pull in personal data, UK GDPR and the Data Protection Act 2018 will usually apply, including purpose limitation and data minimisation: if the question is about the company, record the contract, not the contracts manager’s name. If a result leads to material clearly not meant to be public, stop and tell the owner: knowingly unauthorised access to computer material is an offence under section 1 of the Computer Misuse Act 1990.

Next steps

Print the companion top-tips sheet, then run the three queries above with your own organisation’s name in place of Harrowgate’s. Keep the log.

Key takeaways

• Bracket your OR groups; Bing and X’s API both document them.
• Google, Bing and X handle AND, OR and NOT differently; test before you trust.
• An empty results page is a finding about your query, not proof of absence.
• Log every query so your work can be checked and repeated.

Want to go further?

OSINT is easy to start and hard to do properly. We teach the hard part. Query design is where the course starts, and where most self-taught analysts have gaps. Find out about our Level 3 Award in OSINT at obsidianarctraining.com.