Now you [don’t] see me: how have new legislation and changing public awareness of the UK surveillance state impacted OSINT investigations?

Open-source intelligence (OSINT) gathering and analysis techniques are used by investigators from a variety of fields, owing to their accessibility and exceptional capacity for corroboration. It has previously been argued that proposed data protection legislation can chill the free press, but there have been no studies assessing the effect of such reforms on more general OSINT capabilities. European Union’s General Data Protection Regulation (GDPR) was implemented in the UK through the 2018 Data Protection Act (DPA) to protect personal data against exploitation. This study surveyed 16 OSINT gathering and analysis practitioners across public and private sectors to determine firstly, what, if any impact the implementation of the GDPR/DPA have had on their ability to successfully operate as OSINT analysts and secondly, if they have noticed any subsequent changes in UK public perception around issues of the surveillance state and digital privacy. I argue that this initial survey shows that the GDPR is merely a first step in establishing societal expectations and regulations around digital privacy. While some changes to OSINT practice have been reported, to date few substantive changes to OSINT methods or analysis resulted or seemed poised to take effect, one year after the advent of the GDPR/DPA.