OSINT-002-enhanced-deep-dive-subject-investigation-collection

[SUBJECT FULL NAME] - Collection Map

OSINT-002 Enhanced Deep-Dive Subject Investigation - collection workspace. Central topic = the subject. Branches = data-point categories for a maximum-depth, multi-jurisdictional investigation. Drop each collected value as a child node; expand it with where it was found and what it links to. Paste raw tool output into the node’s Notes. → feeds deliverable OSINT-002. This is an escalation product above OSINT-001; it carries collection-tier tracking, beneficial-ownership mapping, source-of-wealth reconstruction, extended (2nd/3rd-degree) network risk analysis, human-source reputation findings, and deception/concealment analysis. Scope out: threat scoring (→ OSINT-004), forensic asset recovery, skip-trace (→ OSINT-003), approach/elicitation strategy (→ OSINT-005).

00 · Collection Plan - PIRs & EEIs

The driving intelligence requirements for this deep-dive. Each PIR maps to deliverable sections. Tick EEIs as satisfied. Carry open items to §19 Collection Gaps & Intelligence Requirements and §99 Admin. → feeds §3 Key Judgments, §4 PIRs, §14 Verified Findings, §15 Red Flags, §19 Gaps.

PIR-1 - Identity: is the subject uniquely and fully resolved?

• EEI: full legal name + DOB/place of birth confirmed in primary records
• EEI: all former legal names / AKAs / maiden name / transliterations identified
• EEI: acquired / second citizenships identified
• EEI: government / national IDs obtained (lawfully, redacted per policy)
• EEI: same-name candidates identified and excluded with documented basis
• EEI: identity anomalies or deliberate manipulation indicators assessed (→ §13)

PIR-2 - Biographic & career: is the self-reported history accurate and complete?

• EEI: employment history verified to each institution / employer
• EEI: education credentials verified to each institution
• EEI: professional licenses / military / government service confirmed
• EEI: claimed vs. verified discrepancies catalogued (→ §13 Master Discrepancy Matrix)
• EEI: family background / domestic relationships documented

PIR-3 - Corporate interests & beneficial ownership: what entities does the subject own, control, or benefit from?

• EEI: named directorships / officer roles identified in all in-scope jurisdictions
• EEI: UBO / nominee / trust structures mapped (including offshore)
• EEI: shared infrastructure across entities noted
• EEI: control vs. economic interest distinguished per entity

PIR-4 - Source of wealth: is the declared wealth narrative plausible and substantiated?

• EEI: all stated wealth events (business sale, inheritance, salary, etc.) identified and assessed
• EEI: wealth plausibility tested against known/claimed income and career
• EEI: real property (multi-jurisdiction) located via registries
• EEI: high-value movable assets (vessels, aircraft, art) checked in registries
• EEI: financial-stress / adverse indicators (liens, judgments, insolvency) identified
• EEI: hidden / nominee asset indicators surfaced (→ §13)

PIR-5 - Network & associations (extended): who are the subject’s key relationships and what risk do they carry?

• EEI: 1st-degree associates (family, business, social) identified and relationship characterized
• EEI: 2nd-degree risk nodes (PEP, sanctions, criminal, COI adjacency) identified
• EEI: 3rd-degree examined where warranted by risk or hidden-relationship indicators
• EEI: undisclosed relationships surfaced
• EEI: sanctions / PEP proximity quantified per node

PIR-6 - Reputation, integrity & conduct: what do documentary record and discreet human-source inquiry reveal?

• EEI: documentary reputation findings collated (media, regulatory, court narrative)
• EEI: human-source reputation reporting obtained and graded per sub-source
• EEI: integrity / conduct synthesis produced with corroboration level stated

PIR-7 - Digital & dark-web footprint: what is the subject’s attributed online presence and exposure?

• EEI: all attributed accounts and identifiers collected and graded
• EEI: breach / credential exposure identified across known corpora
• EEI: dark-web mentions / forum / marketplace presence checked
• EEI: technical infrastructure (domains, email auth, pseudonymous identities) examined

PIR-8 - Legal, regulatory, sanctions & adverse media: what formal derogatory record exists across jurisdictions?

• EEI: criminal / court records checked in all in-scope jurisdictions
• EEI: civil litigation mapped (role, status, summary)
• EEI: regulatory / professional actions identified
• EEI: OFAC SDN, EU / UK / UN / other sanctions screened (date recorded)
• EEI: PEP status of subject and key associates screened
• EEI: adverse media collected in all collection languages, graded

PIR-9 - Deception, concealment & discrepancy: has the subject deliberately misrepresented or concealed material facts?

• EEI: Master Discrepancy Matrix populated from all sections
• EEI: concealment indicators (hidden assets, identity engineering, structural opacity) synthesised
• EEI: deception assessment produced with likelihood and confidence stated separately

Collection gaps / RFIs (running)

• [open gap] → route to [product / §19]
• [open gap]

01 · Identity & Biographic

Who the subject is, verified vs. self-reported. Establish unique resolution at maximum depth - former names, acquired citizenships, breeder documents, and any identity anomalies that carry to §13. → feeds §5 Subject Identification & Identity Resolution, §6 Comprehensive Biographic & Career History.

Names

• Full legal name:
• Middle name / initial:
• Maiden / former legal name(s):
• AKA / aliases / nicknames:
• Transliterations / native script / romanisations:

Birth & nationality

• DOB / YOB:
• Place of birth:
• Nationality / citizenship(s) - primary:
• Acquired / second citizenship(s):
  • Country:
  • Basis (naturalisation / investment / descent):
  • Date:
  • Source grade:
• Government / national ID (lawfully obtained, redacted):

Physical description

• Description:
• Distinguishing features:
• Languages spoken:

Career chronology (high-level; detail under §06)

• [Employer / role / dates - current]:
• [Employer / role / dates - prior]:

Biographic anomalies / claimed vs. verified flags

• [anomaly / discrepancy]:
  • Type: [Omission / Overstatement / Fabrication / Unverifiable]
  • Carry to §13: [Y/N]

02 · Contact & Selectors

Pivot core - the selectors that link records across systems and jurisdictions. Every value cloneable. → feeds §5 Subject Identification & Identity Resolution, §11 Digital, Technical & Dark Web Footprint.

Phone numbers

→ feeds §5, §11. Clone block per number. ← (truecaller, caller-ID lookups, carrier/CNAM)

• [number - e.g. +1 555-0142]
  • Type / carrier: [mobile / landline / VoIP]
  • Jurisdiction / country code:
  • Linked accounts / apps:
  • Where found (source + URL):
  • Attribution confidence: [Confirmed / Probable / Possible]
  • Notes / tool output:
• [number 2]

Email addresses

→ feeds §5, §11. Clone block per address. ← (holehe, h8mail, hunter.io, breach corpora)

• [email]
  • Linked accounts (account discovery):
  • Breach / paste appearances:
  • Human-source / gated-DB hits:
  • Where found (source + URL):
  • Attribution confidence: [Confirmed / Probable / Possible]
  • Notes / tool output:
• [email 2]

Usernames / handles

→ feeds §5, §11. Clone block per handle. ← (idcrawl, sherlock, whatsmyname)

• [handle - e.g. jdoe_biz]
  • Platforms / where found (URL):
  • Linked email(s):
  • Linked phone(s):
  • Other accounts reusing it:
  • Attribution confidence: [Confirmed / Probable / Possible]
  • Notes / tool output:
• [handle 2]

03 · Addresses & Locations

Multi-jurisdiction. Every address graded. Known vs. assessed vs. historical. → feeds §5 Subject Identification & Identity Resolution, §8 Source-of-Wealth (property indicators).

Current address(es)

• [address]
  • Jurisdiction:
  • Dates associated:
  • Basis / source:
  • Confidence: [H/M/L]

Previous / historical addresses

• [address]
  • Jurisdiction:
  • Dates:
  • Source:

Other associated locations (work / business premises / frequented)

• [location]
  • Type: [Work / Registered-entity office / Frequented / Travel hub]
  • Basis:

04 · Digital Footprint

Full attributed online presence: social, forums, domains, breach exposure, dark-web. Carry deep-web and dark-web findings here; technical infrastructure below. → feeds §11 Digital, Technical & Dark Web Footprint.

Social media accounts

Clone per platform. Grade attribution per account.

• [platform - Facebook / X / Instagram / LinkedIn / TikTok / Telegram / other]
  • Handle / URL:
  • Attribution confidence: [Confirmed / Probable / Possible]
  • Status: [Active / Dormant / Deleted]
  • Content/affiliations of note:
  • Notes:

Websites / personal domains

← (whois, ViewDNS, DomainTools, crt.sh, SecurityTrails)

• [domain]
  • Registrant / WHOIS:
  • Hosting / IP:
  • Linked email in registration:
  • Notes:

Forums / communities / specialist platforms

• [site + handle]:
  • Attribution confidence: [Confirmed / Probable / Possible]

Breach / paste / data-broker exposure

← (HaveIBeenPwned, dehashed, intelx, Snusbase; data-broker removals audit)

• [indicator - email / username / hash found in breach corpus]
  • Source / corpus:
  • Date of breach / observed:
  • Data fields exposed:
  • Significance:

Dark-web mentions

← (Ahmia, OnionSearch, Recon-ng dark-web modules, vendor-specific dark-web intel)

• [mention / forum thread / marketplace listing]
  • Platform:
  • Date observed:
  • Substance:
  • Attribution confidence: [Confirmed / Probable / Possible]

Technical infrastructure & pseudonymous identities

• [domain / IP / hosting asset / pseudonym]
  • Link to subject:
  • Backdating / age-vs-claim indicator:
  • Notes:

05 · Network & Associations

Extended mapping: 1st, 2nd, and (where warranted) 3rd degree. Each node risk-coded. Carry beneficial-ownership overlaps to §07. Carry PEP / sanctions-proximity nodes to §12. → feeds §9 Network & Association Analysis (Extended).

Family & household

• [name]
  • Relationship:
  • DOB / nationality:
  • Known affiliations / risk indicators:
  • Basis / source:
  • Confidence: [H/M/L]

Business / professional associates (1st degree)

• [name]
  • Relationship:
  • Shared entity / interest:
  • Risk relevance: [PEP / Sanctions / Criminal / COI / Reputational / None]
  • Risk score (1–25):
  • Basis:

Business / professional associates (2nd degree)

• [name]
  • Via (1st-degree intermediary):
  • Relationship:
  • Risk relevance:
  • Risk score (1–25):

3rd-degree / warranted extended nodes

• [name / entity]
  • Via chain:
  • Trigger for inclusion:
  • Risk relevance:

Social / personal associates

• [name]
  • Relationship:
  • Risk indicator:

Undisclosed / hidden relationships (indicators)

• [suspected link]
  • Basis:
  • Confidence: [H/M/L]
  • Carry to §13: [Y/N]

06 · Employment, Education & Affiliations

Verified vs. claimed. Divergences flag for §13 Deception / Discrepancy Analysis. Check employer registry status, institution accreditation, license databases. → feeds §6 Comprehensive Biographic & Career History, §13 Deception Analysis.

Employment - current

• [employer]
  • Role / title:
  • Dates:
  • Verified via:
  • Status: [Verified / Claimed / Contradicted]

Employment - prior (clone per role)

• [employer]
  • Role / title:
  • Dates:
  • Verified via:
  • Status: [Verified / Claimed / Contradicted]
  • Discrepancy (if any):

Education (clone per institution)

← (institution registrar, accreditation bodies, degree-verification services)

• [institution]
  • Credential / field / dates:
  • Verified via:
  • Status: [Verified / Claimed / Contradicted / Unverifiable]

Professional licenses & credentials

← (state / national / professional body registers)

• [license / credential]
  • Issuing body:
  • Status: [Active / Lapsed / Revoked]
  • Verified:

Military / government / intelligence service

• [service / branch / role]
  • Dates:
  • Rank / grade:
  • Verified:

Memberships / affiliations / boards

• [organisation / role]
  • Dates:
  • Significance:

07 · Corporate Interests & Beneficial Ownership

Entities the subject owns, controls, directs, or benefits from - named, nominee, and trust structures. Multi-jurisdiction. Distinguish control (voting/direction) vs. economic interest (dividends/UBO). → feeds §7 Corporate Interests & Beneficial Ownership, §9 Network, §8 Source-of-Wealth.

Named directorships / officer roles

← (OpenCorporates, Companies House, SEC EDGAR, national registries, regulatory filings)

• [entity name - e.g. Acme Holdings Ltd]
  • Jurisdiction:
  • Reg. # / company number:
  • Subject’s role: [Director / Officer / Shareholder / Secretary]
  • % ownership (if known):
  • Dates active:
  • Status: [Active / Dormant / Struck]
  • Co-directors / co-owners:
  • Source grade:
  • Notes / tool output:
• [entity 2]

Beneficial ownership / UBO (behind nominees / trusts)

• [entity / structure name]
  • Nominee(s) / trustee(s):
  • Jurisdiction:
  • Basis for UBO attribution:
  • Control vs. economic interest:
  • Confidence: [H/M/L]

Offshore / opacity structures

• [structure / jurisdiction]
  • Layering description:
  • Shared infrastructure with other entities:
  • Jurisdiction-shopping indicator:

Ownership / control diagram notes

• [diagram reference / description]:

08 · Source-of-Wealth & Financial Profile

How accumulated wealth was built (SoW - relational) and specific funds (SoF - transactional, where in scope). Test plausibility: does the narrative account for observed assets and lifestyle? OSINT + public-records depth only - forensic recovery routes to Financial Intelligence & Asset Tracing. → feeds §8 Source-of-Wealth & Financial Profile, §13 Concealment Indicators.

Wealth events / declared sources (clone per event)

• [wealth event - e.g. sale of TechCo, 2019]
  • Period:
  • Description:
  • Claimed value:
  • Substantiation: [Substantiated / Partial / Unsubstantiated]
  • Source grade:

Real property (multi-jurisdiction)

← (land registries, deed records, HM Land Registry, county recorder, offshore land records)

• [property / address]
  • Jurisdiction:
  • Registered owner (nominee?):
  • Acquisition date / price:
  • Current estimated value:
  • Basis / source:
  • Confidence: [H/M/L]

Corporate / equity interests (cross-ref §07)

• [entity]
  • Subject’s stake / role:
  • Estimated value:
  • Registry source:

High-value movable assets

← (vessel registers / IMO / US CG NVDC, FAA / EASA / ICAO aircraft registers, art databases)

• [asset - vessel / aircraft / art / jewellery]
  • Type:
  • Registry / identifier:
  • Registered owner:
  • Estimated value:
  • Basis:

Public financial filings

• [filing - e.g. UCC, beneficial-ownership register, political-donation disclosure]
  • Source:
  • Key data:

Observable lifestyle vs. known/claimed means

• [lifestyle indicator]
  • Observation:
  • Income plausibility: [Plausible / Gap / Unexplained]

Financial-stress / adverse indicators

• [lien / judgment / insolvency / adverse filing (public)]
  • Jurisdiction:
  • Date:
  • Amount / substance:
  • Source:

Hidden / undisclosed asset indicators

• [indicator of concealment]
  • Basis:
  • Carry to §13: [Y/N]

09 · Media & Imagery

Subject photographs, video, audio - sourced and metadata-checked. Feeds identity resolution, reverse-image attribution, and the evidence archive. → feeds §5 Subject Identification & Identity Resolution, §11 Digital Footprint, §22 Appendix F Evidence Archive.

Photos of subject

• [image ref / filename]
  • Source / URL:
  • Date:
  • EXIF metadata:
  • Reverse-image search results:

Avatar / profile picture(s)

• [image ref]
  • Source:
  • Reverse-image search locations:
  • Attribution confidence: [Confirmed / Probable / Possible]

Video

• [file / URL]
  • Source / platform:
  • Date:
  • Metadata:

Audio

• [file / URL]
  • Source / notes:

10 · Reputation, Integrity & Conduct

Documentary record + discreet human-source inquiry. Human sources coded only - never named in collection workspace. Grade each sub-source for reliability (A–F) and each item for credibility (1–6). → feeds §10 Reputation, Integrity & Conduct Assessment.

Documentary reputation findings

• [outlet / document / source]
  • Date:
  • Substance:
  • Reliability (A–F):
  • Credibility (1–6):

Human-source / field reputation findings (clone per sub-source)

Sub-sources coded only - full identity in Source Protection Annex (Appendix A of deliverable).

• [sub-source code - e.g. SRC-1]
  • Access / vantage point:
  • Reporting summary:
  • Reliability (A–F):
  • Credibility (1–6):
  • Corroboration status:

Integrity & conduct flags

• [flag / indicator]
  • Domain: [Integrity / Conduct / Lifestyle / Professional]
  • Corroboration level: [Single-source / Corroborated / Contradicted]
  • Carry to §15 Red Flags: [Y/N]

11 · Legal & Derogatory

Comprehensive multi-jurisdiction scan. Charge vs. conviction vs. alleged - always distinguished. Date and grade every item; note record currency. → feeds §12 Legal, Regulatory, Sanctions & Adverse Media.

Criminal / court records (multi-jurisdiction)

• [matter - jurisdiction / case type / case #]
  • Jurisdiction:
  • Case #:
  • Type: [Criminal / Civil / Regulatory]
  • Status / disposition: [Charged / Convicted / Dismissed / Pending]
  • Date:
  • Summary:
  • Source grade:

Civil litigation

• [case - jurisdiction / parties / case #]
  • Role: [Plaintiff / Defendant / Third-party]
  • Status:
  • Summary:
  • Source grade:

Regulatory & professional actions

• [action / regulator / date]:
  • Status / outcome:

Sanctions, PEP & watchlist screening

• OFAC SDN / Consolidated: [Clear / Hit / Near-match]
  • Date screened:
  • Match quality:
• EU Consolidated List: [Clear / Hit / Near-match]
  • Date screened:
• UK Financial Sanctions List: [Clear / Hit / Near-match]
  • Date screened:
• UN Consolidated List: [Clear / Hit / Near-match]
  • Date screened:
• PEP databases (subject): [Clear / Hit / Near-match]
  • Database(s) used:
  • Date screened:
• PEP databases (key associates):
• Law enforcement / Interpol public notices: [Clear / Hit]
  • Date screened:

Adverse media (multi-language)

← (Factiva, LexisNexis, local-language press, GDELT, Google News advanced operators, translate tools)

• [outlet + date]
  • Language:
  • Substance:
  • Reliability (A–F):
  • Credibility (1–6):

12 · Pattern of Life

Open-source only - no covert or physical surveillance. Routine, geography, travel, anomalies. → feeds §6 Comprehensive Biographic & Career History (contextual), §8 Source-of-Wealth (lifestyle indicators).

Routine & temporal patterns

• [observed cadence / schedule indicator]
  • Source / basis:

Geographic footprint

• [habitual location / jurisdiction]
  • Frequency basis:

Travel & mobility

• [observed travel / visa indicators / departure records (public)]
  • Period:
  • Basis:

Anomalies / deviations

• [departure from established pattern]
  • Date:
  • Significance:

13 · Deception, Concealment & Discrepancy

Synthesise indicators of fabrication, concealment, and misrepresentation from all other branches. This is analysis, not accusation - grade and caveat every item. → feeds §13 Deception, Concealment & Discrepancy Analysis, §15 Red Flag Summary.

Master discrepancy log (clone per item; feed §13 table in deliverable)

• [discrepancy ref - D-1, D-2, …]
  • Claimed / represented:
  • Verified reality:
  • Type: [Omission / Overstatement / Fabrication / Identity / Asset / Structural]
  • Assessment: [Deliberate / Likely / Indeterminate / Innocent error]
  • Supporting sections:

Concealment indicators

• [indicator type - e.g. nominee structure, identity gap, jurisdiction-shopping]
  • Evidence basis:
  • Confidence: [H/M/L]

Collection-tier exploitation for concealment detection

• [tier used / method]
  • Gaps exploited / surfaced:

99 · Collection Admin

Working register - audit trail behind the deliverable. Not itself a deliverable section. Maps to §21 Sources & Methodology, §22 Appendices (A/D/F).

Source register

Every material datum traceable to a graded source. Human sub-sources by code only - full identity in Source Protection Annex.

• [S-1 - source name / description]
  • Type: [Primary / Secondary / Tertiary / Human / Licensed-DB / Gated]
  • Reliability (A–F):
  • Credibility (1–6):
  • Collection tier: [T1 / T2 / T3 / T4 / T5 / T6]
  • Date accessed:
  • Notes:
• [S-2]
• [S-3]

Evidence archive

• [screenshot / capture ref + SHA-256 hash + URL + timestamp]:

Collection-tier log

• T1 Open-source (OSINT): [engaged - tools / scope]
• T2 Licensed / gated databases & deep web: [engaged - databases / scope]
• T3 Multi-jurisdiction public records: [engaged - jurisdictions]
• T4 Foreign-language / in-country records: [engaged - languages / countries]
• T5 Human-source / discreet field inquiry: [engaged - type / coded sub-sources]
• T6 Technical / digital & dark web: [engaged - tools / scope]

Human-source code register (controlled)

Full identity → Source Protection Annex (Appendix A). Only coded entries here.

• SRC-1: [coded - access / vantage only]
• SRC-2:

Open gaps / RFIs (running)

• [gap description - what is needed, impact on assessment, priority]
• [item submitted to T5 human source - pending]
• [jurisdiction record not yet returned - routed to §19]

ACH / key assumptions working notes

• [assumption or hypothesis under test]:

Verification pending

• [item submitted - date - expected return]