OSINT and the Three Tiers of Internet Investigation: When Does RIPA Engage?

Jul 7

3 min read

By Bob Denaro (KPM) @ the BDG Training Team · July 2026

Repeated or systematic online monitoring of a person or group can amount to directed surveillance requiring RIPA authorisation, even when the information is publicly available.

Open source intelligence (OSINT) and Internet Intelligence & Investigations (3III) cover the use of internet resources to gather information, intelligence and evidence, including overt and covert tactics to access closed areas, gather metadata, and monitor the online activity of a group, individual or geographical area. Knowing where lawful research ends and authorisation begins is the core competence.

The iceberg: surface, deep and dark web

• Surface web (~4%). Indexed by search engines and publicly accessible — Google, YouTube, Companies House, BBC. This is where Tier 1 activity takes place.

• Deep web (~90%). Not indexed; requires a direct URL or authentication — academic databases, financial records, subscription content, government repositories.

• Dark web (~6%). Invisible to standard search engines; requires Tor or specialist protocols. Not everything hidden is illegal — but everything illegal is hidden.

The three tiers of internet investigation (NPCC 3III Policy)

1. Tier 1 — Core internet use. All staff. Public sources, no login required.

2. Tier 2 — Overt internet intelligence and investigations. Trained investigators. Overt profiles, platform access, advanced searching. A Directed Surveillance Authorisation (DSA) may be required.

3. Tier 3 — Covert internet intelligence and investigations. Authorised, trained staff only. Covert accounts, closed group access, subject surveillance. DSA required.

Beyond Tier 3 sits authorised CHIS/undercover activity — specialist work requiring formal CHIS authorisation.

Key questions that can decide whether RIPA engages

Before starting any internet investigation, ask:

1. What is the intended purpose and scope?

2. Is it directed at an individual or organisation?

3. Will it obtain private information?

4. Will internet sites be listed to build an intelligence picture?

5. Will information be recorded and retained?

6. Will it provide a 'lifestyle' profile of the subject?

7. Will it be combined with other sources to build a picture of private life?

8. Is it ongoing or repeated viewing?

9. Is collateral intrusion likely?

On privacy settings: public information may carry a lower privacy expectation, but privacy concerns can still apply. The person did not share their information for covert investigation use, public access does not always mean lawful use. Always check the original purpose for which the data was shared.

The CHIS trap

If you direct a member of the public to gather specific information on your behalf for example monitoring social media activity with individuals where they already have a personal or business relationship they may meet the definition of a CHIS under s.26(8) RIPA — requiring formal authorisation and duty-of-care obligations. Never instruct a third party to conduct covert activity without proper advice: a source can now potentially be engaged in the conduct of a CHIS without direct tasking (for example, self-tasking), seek advice if unsure.

Training that covers this

BDG delivers OSINT / Open Source (3III) Training and RIPA Awareness Training — from lawful online research and the tipping point into directed surveillance, to avoiding CHIS creation errors. Email info@bdgtrainingconsultancy.co.uk.

This article is adapted from the BDG Investigator Bulletin, Edition 4 (July 2026). Download the full edition free — and subscribe to receive each monthly edition by email.

This article is provided for professional development purposes and does not constitute legal advice.