OSINT Research Hub › OSINT Tradecraft
OSINT, Ethics and the Law in Canada
Where lawful open-source research ends in Canada and New Brunswick: private investigator licensing, the Criminal Code, privacy law, platform rules and an ethical code.
Read this first
This guide explains the main legal boundaries that shape open-source research in Canada, with a focus on New Brunswick. It is general information, not legal advice. Laws change and their application depends on the facts, so check the current text of any law that matters to your work and speak with a lawyer when in doubt.
“Public” does not mean “fair game”. Information can be publicly reachable and still be unlawful or unethical to collect, combine or publish.
Private investigator licensing in New Brunswick
New Brunswick’s Private Investigators and Security Services Act (S.N.B. 2011, c. 209) defines a private investigator to include a person who investigates and furnishes information about the character or actions of a person, or searches for offenders, missing persons or property (section 1). Section 6 prohibits acting as, or presenting yourself as, an agent or agency without a licence.
The Act exempts several groups (section 2), including a person who receives no pay or other reward for the services. It has no general exemption for journalists, bloggers or researchers. That is why this hub publishes open research and education only, and never accepts payment to investigate a person.
Criminal Code lines you must not cross
- Intercepting private communications (section 184): listening to, recording or reading communications not meant for you, including through spyware or hidden recording devices.
- Unauthorized use of a computer (section 342.1): logging into accounts that are not yours, guessing passwords, or getting around access controls, even when the door seems open.
- Criminal harassment (section 264): repeatedly following, watching or communicating with someone in a way that causes them to fear for their safety.
- Voyeurism (section 162): covert observation or recording of a person where there is a reasonable expectation of privacy.
Passive collection of information that is openly published stays well away from these lines. Anything that involves deception, access you were not given or covert monitoring of a person does not.
Privacy law
The federal Personal Information Protection and Electronic Documents Act (PIPEDA) governs how organizations collect, use and disclose personal information in the course of commercial activities. It does not apply to collection for journalistic, artistic or literary purposes (section 4(2)(c)), but courts read that exemption narrowly, so do not treat it as a blanket permission. Collect the least personal information you need, keep it secure and delete it when you are done.
Platform rules and deception
Most platforms prohibit automated scraping and fake accounts in their terms of service. Breaking those terms is not automatically a crime, but it can get your accounts banned, expose you to civil claims and undermine the credibility of your findings. Pretexting (pretending to be someone you are not to obtain information) crosses from research into deception and can amount to fraud or impersonation.
Our code of conduct
- Do no harm. The public interest must clearly outweigh any harm from publishing.
- Research institutions, events and public figures in their public roles, never private individuals.
- No minors, no home addresses, no family members who are not part of the story.
- Collect only what the research question needs, and protect what you hold.
- Give the subjects of serious allegations a chance to respond.
- Cite sources, disclose AI assistance, and correct errors openly.