# Opsec for the investigator

Source: https://otinstaller.com/guides/osintverse-community/osint-fundamentals/02-opsec (page 3 of 5 of osintverse-community/osint-fundamentals)

Operational security here means two things: not exposing yourself or your organisation while you look, and not
tipping off the person or group you are looking into.

## What your requests reveal

Every website and API a tool contacts sees the request: your IP address, and sometimes the time zone and language of
your machine. It does not see your files or who you are looking for, unless the request itself names them.

- If your IP address matters for the case, run tools from a server you control or through a VPN you are allowed to
  use, and keep that choice the same for the whole case.
- Some tools contact the target's own services, and a few may notify them, for example a password-reset or sign-up
  check that sends an email. Each tool page says so under **Behaviour**, and `ot info <tool>` shows the same flags.
  Run those only when your scope allows it.

## What `ot` does for you

- Each tool runs in a container that cannot read your files, with no network unless the tool declares it.
- API keys are kept in your system keychain and passed only to the tool that declares them.
- Images are pinned to a digest and checked against their signature before every run.
- When an AI agent runs tools for you through `ot mcp`, it has to ask before anything that goes online or touches a
  target, and every run is written to a local audit log (`ot mcp audit`).

## Keep your work separate

- Use investigation accounts and API keys that are not tied to your personal ones.
- Do not log in to the platforms you are researching with your own accounts; a "people you may know" list works both
  ways.
- Do not open links, attachments or files sent by the person you are investigating on your everyday machine.
- Keep results on an encrypted disk, grouped by case (`ot run … --case <name>`), and out of folders that sync to the
  cloud.

Next: https://otinstaller.com/guides/osintverse-community/osint-fundamentals/03-legal-and-ethics.md