Until verified, everything is both real and fake.
The internet is now a mix of humans, bots, sockpuppets-as-a-service, and AI-generated everything. The result is a messy ecosystem where ‘trust your eyes’ is terrible advice. This article breaks down a simple mindset: treat every piece of intel like Schrödinger’s cat — real and fake at the same time — and apply Zero-Trust principles to validate what matters. It’s not paranoia.
The modern dilemma
As technology and media evolve, digital and real life overlap, and we live in a constant stream of stimuli. What is real and what is not? It’s the question observers and investigators ask themselves every day.
You find a post. You wonder: is this from the same subject I’m researching? You cross-check before assuming. This must be John Doe; this one lives in LA too. Cross-check again. Validate again. But then you hit the wall — you can’t triangulate or narrow it down.
Switch to basic reasoning: John Doe in California. 749 people named John Doe in Los Angeles alone. Suddenly ‘John Doe + LA’ is nowhere near enough. You need more data points to match — or reject — the possibility that this post belongs to your John Doe. And even then: what if it looks like John Doe, sounds like John Doe, moves like John Doe? Do we actually know it is John Doe?
The modern threat landscape
Now add the modern layer: AI-generated articles, sockpuppet farms (sockpuppet-as-a-service), fake profiles, AI-generated video and images. The quality keeps improving. Often we don’t even notice something is synthetic, and it’s only getting harder.
We are influenced by everything we see and hear — especially emotions — but what if those emotions were engineered by the creator to manipulate us? As neutral observers, we have to guard against bias.
- AI-generated articles that pass as human writing
- Sockpuppet farms offering sockpuppet-as-a-service
- Fake profiles with convincing histories
- AI-generated video, images, and audio that fool even trained eyes
Schrödinger’s intel
The information in front of us is both real and fake until verified.
To avoid falling into paranoia or naïveté, borrow Schrödinger’s cat as a mental model. Especially with images, video, and audio: it’s fake, it’s real, it could be neither, it could be both. One thing is certain — it’s useless until we authenticate it.
This mindset keeps us from drifting into two dangerous extremes:
- ‘Everything is fake’ negativity
- ‘Looks real so it must be real’ delusion
By holding both possibilities at once — fake and real until proven otherwise — we can enjoy the search and do what we do best: analyse, verify, and piece things together. Treat information like it’s in Schrödinger’s box. Assume only one side and you risk missing real intel (the liar’s dividend) or spreading misinformation.
As spotting fakes becomes harder, maybe it’s time to flip the approach and borrow from Zero Trust. Instead of ‘spot the fake,’ the new game becomes spot the authentic.
The Zero-Trust OSINT framework
To validate information, we can adapt Zero-Trust pillars into OSINT practice:
| Pillar | OSINT application |
|---|---|
| Isolate the source Micro-segmentation | Treat every new piece of information as independent until verified. A ‘trusted source’ isn’t automatically valid. |
| Provenance & attribution Identity and Access Management | Who created this and why? Is this shown to me because of my digital fingerprint? |
| Continuous verification Continuous monitoring | Verified once doesn’t mean verified forever. Content changes. Society changes. Context shifts. |
| Multi-factor authenticity Multi-Factor Authentication | One proof is weak. Two or three proofs build strength. |
| OPSEC Encryption | Don’t leave traces. Methods evolve, fakes adapt. Protect your evidence and your chain of custody. |
| Policy enforcement | Not valid until proven valid. Not fake until proven fake. |
| Forensics & metadata Visibility and Analytics | Use tools to see what the eye can’t. There’s a lot hidden beneath the surface. |
The ethics imperative
If you’ve read this far, you might think: if I do this for everything, I’ll never finish an assignment or report. You’re right. That’s why ethics matter:
‘Avoid unnecessary collection of unrelated personal data, and be extra careful when preserving evidence.’ — OSINT Industries team
This is food for thought — not a doctrine. The point is not to treat every pixel as a threat. The point is to know which inputs matter, which deserve scrutiny, and which can be set aside without compromising the work.
Further reading: Why using AI for OSINT leaves a trail · What investigators see when they search you