Is this source any good? Five checks for OSINT beginners

Finding information is the easy bit. Deciding whether to believe it is where beginners come unstuck. A five-question checklist, how fact checkers read “sideways”, the grading scales used by UK policing and NATO, and a fictional viral rumour traced back to where it started.

Photo: Utsav Srestha / Unsplash

What it is

Source evaluation asks two questions.

1. Is the source any good? Who gave you this, and what is their record?
2. Is the information any good? Could the source know it, and does anything else confirm it?

A reliable source can be wrong on the day: a national newspaper misreading a court listing. An unknown account can post something true. UK policing grades the two on separate scales.

Why it matters for an OSINT analyst

OSINT (open-source intelligence) turns public material into something a decision-maker can act on. Your report is only as defensible as your worst source.

In a Stanford study, professional fact checkers reached better-founded judgements than historians and students, and faster. They glanced at a page, then checked what the rest of the web said about its publisher. This is lateral reading.

How to do it

One fictional case runs through the steps: a viral post about Harrowgate Freight Ltd, a haulage firm that does not exist.

Step 1: Stop. Mike Caulfield’s SIFT method starts here: Stop, Investigate the source, Find better coverage, Trace claims to the original context. Open a new tab, not the share button.

Step 2: Read laterally. Search for the publisher, not the claim:

"northern-haulage-news.example" -site:northern-haulage-news.example

Quotation marks match an exact phrase, the minus sign excludes a term, and site: limits results to one domain, so -site: hides the site’s own pages. For our fictional site, only its own social accounts turn up.

Step 3: Ask the five questions. Applied to the fictional article:

1. Who published it? No named editor, no address, just a contact form.
2. When? Dated today, but the forum post it quotes is two days old.
3. Is it the original? No. A primary source is first-hand (the filing, the court record, the witness). An article quoting “a post on a drivers’ forum” is secondary.
4. Does an independent source confirm it? Three blogs repeat it, but all link to this one article.
5. Why does it exist? The domain is three weeks old and every page carries adverts. Clicks.

Step 4: Grade it and word it carefully.

• UK policing 3x5x2 (three source grades, five information grades, two sharing codes). College of Policing guidance (13 January 2026) grades the source 1 to 3 (reliable, untested, not reliable) and the information A to E, from “known directly to the source” to “suspected to be false”. The “2” is a sharing code, P or C. Our forum post grades 2D: an untested source, and information we have no means of assessing.
• NATO “Admiralty” code. Source reliability runs A (completely reliable) to F (reliability cannot be judged); information credibility runs 1 (confirmed by other sources) to 6 (truth cannot be judged), written together, for example “B2”. Wording differs slightly between publications. The same forum post grades F6: a source not used before, making a claim with nothing to test it against.
• PHIA probability yardstick. PHIA (the Professional Head of Intelligence Assessment) sets standard UK government words for likelihood, from “remote chance” (up to about 5%) through “realistic possibility” (about 40% to under 50%) to “almost certain” (about 95% and above), alongside a confidence rating of low, moderate or high. So instead of “Harrowgate may have gone bust”, write, in the yardstick’s own words: “It is unlikely that Harrowgate Freight has entered administration. Low confidence: one unverified source, and official notices can lag.”

The two grading systems run the opposite way round (police number the source, NATO letters it), so name the scale you are using.

Worked example (fictional)

The viral post claims Harrowgate Freight “has gone into administration, drivers unpaid”, with a screenshot from northern-haulage-news.example. It has 1,200 reposts.

We stop. We trace the three blogs to one article: one claim repeated, not four sources. We read laterally and find nobody else mentioning the publisher. We find the original: a forum account two days old, with no other activity. Then we check the primary records. Companies House registers company information and makes it public; The Gazette carries formal insolvency notices, including administrator and liquidator appointments. Neither shows anything.

Our log entry reads: “Source 2, information D. It is unlikely that Harrowgate Freight has entered administration. Low confidence. Checked Companies House and The Gazette on 23 September 2026, nothing found. Re-check 25 September.” Absence is not proof, so we show our working: what we checked, and when.

Figure: OAT teaching graphic. Fictional data.

The OAT view Collection is the easy bit. The professional standard is saying how far you trust a source, why, and what you checked. If your grading would not survive a colleague’s questions, it is not defensible.

Common beginner mistakes

• Counting repeats as corroboration. Everything tracing back to one origin is circular reporting. The College of Policing’s “B” grade demands separate verification for a reason.
• Trusting a professional-looking site. A polished logo and an official-sounding web address are simple to fake, and a site’s “About us” page is no substitute for lateral reading.
• Confusing recency with reliability. The 1,200th repost adds nothing the first one lacked.
• Trusting AI summaries. An October 2025 European Broadcasting Union (EBU) and BBC study of more than 3,000 AI-assistant news answers found at least one significant issue in 45% of answers and serious sourcing problems in a third. Treat an AI summary as a lead, never a source.

Next steps

Print the top tips sheet and try the five questions on the next post you see.

The legal bit

Stick to public information. If a source leads to personal data, UK GDPR and the Data Protection Act 2018 apply: have a clear purpose and collect only what is proportionate. Never access an account or system without authorisation to “check” a claim; that is Computer Misuse Act 1990 territory. Logging into the drivers’ forum on someone else’s account to see who posted would cross that line.

Key takeaways

• Judge the source and the information separately.
• Read laterally: leave the page and see what independent sources say about it.
• Ten repeats of one post are still one source. Trace it to the original.
• Use a recognised scale (3x5x2, Admiralty, PHIA yardstick) and say which one.
• Write down what you checked, and when. Absence of evidence needs a date on it.

Want to go further?

OSINT is easy to start and hard to do properly. We teach the hard part. Grading and confidence wording are core to the course. Find out about our Level 3 Award in OSINT at obsidianarctraining.com.