Open-source research is useful when it answers a defined question with sources a reviewer can inspect. It becomes unreliable when a search result is treated as an identity, an archived page as current fact, or repeated reporting as independent confirmation. This is a verification workflow for lawful public-source enquiries, not permission to gather a complete personal dossier. For an APP entity, the OAIC says publicly available personal information remains subject to the Australian Privacy Principles, including necessity and fair collection. OAIC APP 3 guidance.
Turn the brief into testable questions
Define the decision, the person or entity, the relevant period and what would change the decision. For example: “Did Company X publicly describe Person Y as a director on 1 July?” is answerable from a dated source. “What is Person Y really like?” is not a proportionate research question. List permitted sources and exclusions, including any restrictions on accounts, private groups, contact with third parties or sensitive information. Set a stop point so incidental material is not collected without purpose.
Build an identity key before attributing an account
Record the subject’s known lawful identifiers separately from search results: full name, business number, former names, role, location and relevant dates. For each candidate account or document, mark which identifiers match and which conflict. A name, photograph, username or mutual contact alone can point to the wrong person; accounts can be shared, renamed or impersonated. Label an account “attributed”, “possible” or “unresolved” and state the basis. If the finding would materially affect employment, litigation or safety, seek stronger corroboration or specialist review before using it.
Preserve the source and its context
- Record the exact URL, publisher/account identifier, access date and time with time zone, visible publication date and whether the page was live, cached, archived or supplied by another person.
- Save a faithful copy or screenshot showing the surrounding context, not just a cropped sentence. Note access barriers and material that could not be viewed.
- Keep a source log tying any report excerpt to the saved copy. If you annotate or redact a copy, retain the captured version separately and record the change.
- Follow a claim back to the earliest primary record available. A report copied by three sites remains one source chain.
ASD’s evidence guidance recommends recording collection and handling details for digital material; the exact preservation method should suit the matter and its legal obligations. ACSC evidence collection and preservation.
Use a source-reliability worksheet
For each material assertion, record: claim; primary source and URL; publisher and purpose; date of event versus date of publication; identity basis; independent corroboration; contrary evidence; what remains unknown; and how it affects the decision. Distinguish an official filing, a person’s own statement, a third-party allegation and an automated search snippet. A source may reliably show that a statement was published without establishing that the statement is true.
Worked example — an apparent job history
Hypothetical example. A profile with a matching name and photograph says its owner worked for a supplier in 2022. A blog repeats the claim and an archived company page lists the same name. The archived page is the stronger evidence that the company presented that person in a role at the time, but it may not identify the profile owner or prove the dates of employment. The blog may simply copy the page. The report should say which statements are directly observed, which identity link is inferred, and what additional authorised confirmation would be needed. It should not describe the profile as a verified employment record.
Stop and escalate when the question changes
Pause when the search reveals sensitive personal information beyond the brief, a possible wrong-person match, contested material likely to cause serious harm, a private or restricted source, or a need for covert access. Ask the commissioning party or legal/privacy adviser to reset scope. Do not attempt to bypass access controls or imply that a lack of results proves a clean history. The useful output is a sourced answer, an explicit confidence level and the next permissible check.