Home » Blog » OSINT for Lawyers Part T

OSINT, Online Investigations and Due Diligence. What Lawyers Need to Know in 2026 (Part 2)

The temptation to conduct your own online investigation is understandable. Search engines are free. Social media profiles are often public. Corporate registries are accessible. Why not have a paralegal spend an afternoon gathering what they can find?


The answer lies in the gap between finding information and producing usable intelligence. DIY online investigation carries risks that are easy to underestimate — and difficult to undo once realised.


Incomplete or misleading results

A quick search may return information, but that does not mean it returns the right information. People share names. Addresses change. Social media profiles may be inactive, satirical, or belong to someone else entirely. Without verification methodology, there is no way to distinguish a genuine lead from a coincidence or a misidentification.


A phone number that appears linked to a name in one database may have been reissued years ago. An address that appears current may be years out of date. An email address that returns a social media profile may belong to a different person with the same name. Each assumption introduces risk — and assumptions compound.


Confirmation bias

Research in forensic science and investigative psychology consistently demonstrates that even experienced professionals are susceptible to confirmation bias — the tendency to seek, interpret, and remember information in ways that confirm existing beliefs.


In DIY investigation, this risk is amplified. A person searching for evidence to support a pre-existing theory is unlikely to document the searches that returned nothing, or to consider alternative explanations for what they found. They may stop searching once they find something that appears to confirm their suspicion — without testing whether that result is accurate or complete.


Privacy and legal exposure

The Australian Privacy Act 1988 and state-based surveillance legislation impose real constraints on how information may be gathered and used. Accessing someone's social media profile is not necessarily lawful in all circumstances — particularly if it involves deception, the creation of false accounts, or the collection of sensitive information without a legitimate purpose.


The Office of the Australian Information Commissioner (OAIC) has issued guidance on the collection of personal information from public sources. The fact that information is publicly visible does not mean it can be collected, stored, or used for any purpose. Context matters. Purpose matters. Proportionality matters.

For firms conducting their own investigation, there is also the risk of vicarious liability. If a staff member crosses a legal line — even unintentionally — the firm may be exposed.


Evidentiary issues

Information gathered without proper methodology may be inadmissible or easily challenged. Courts require authentication. They require chain of custody. They require evidence that the material presented is what it purports to be, that it has not been altered, and that it was obtained lawfully.


A screenshot is not self-authenticating. A social media post may be edited or deleted before trial. Without contemporaneous preservation and documentation, even genuine evidence may be excluded or undermined under cross-examination.


Reputational and ethical risks

Investigation that is perceived as invasive, disproportionate, or conducted in bad faith can damage client relationships and professional reputation. In family law matters, for example, evidence of excessive monitoring or surveillance may reflect poorly on the instructing party — regardless of what it reveals.


The legal profession's ethical obligations extend to the conduct of those acting on a lawyer's instructions. If an investigator — or an internal staff member conducting ad hoc research — acts improperly, the instructing solicitor may bear professional responsibility.


The underlying problem

DIY investigation often begins with a question: "Can we find out where this person is?" or "Is there anything online that contradicts this claim?" These are legitimate questions. But the method of answering them matters as much as the answer itself.


In Part 3, we examine why licensed investigators offer a structured, accountable alternative — and what to look for when engaging one.