Investigators choose OSINT when the answers likely sit in public data, and surveillance when real-world activity, presence, or physical capability must be proven. Many Ontario files use both in sequence. The right path depends on the legal question, not on which tool sounds more dramatic.
Clients often ask for cameras first. Sometimes that is correct. Sometimes it burns budget watching an empty driveway while open sources already show the subject working across town. A short decision framework saves money and protects relevance.
If you are still deciding whether any fieldwork belongs on the file at all, see who needs surveillance in an investigation. For how physical observation is actually run and priced, see how private investigators conduct surveillance.
For open-source programs, use the OSINT investigations hub. For physical observation, use tracking and surveillance. Social-platform-heavy work may also route to social media investigations when that narrower channel is enough.
What question are you actually trying to answer?
- Who is this person or company in the public record? Start OSINT.
- Is the person performing activities inconsistent with claimed limits? Lean surveillance.
- Where does the person go during claim or work hours? Surveillance, often after OSINT narrows addresses.
- What network of accounts and domains supports a scam narrative? OSINT first.
- Did the subject enter a specific premises on a date? Surveillance or lawful video collection planning.
Write the question in one sentence before you buy hours. If you cannot, you are not ready to choose a method.
When is OSINT the better first move?
OSINT is stronger when identities, histories, associates, or online operations are unclear. It scales. It can be done quietly. It produces source-backed exhibits without putting an investigator on a street corner yet.
Ontario investigators deciding between OSINT and surveillance start with the burden of proof the file needs. Open-source intelligence can establish links, timelines, and leads with court-usable documentation when captures are dated and sourced. Surveillance establishes what a person did in the physical world at particular times. Investigation Hotline uses both under Ontario licensing rules and will say when one method cannot answer the question. A confidential consult often reframes “we want surveillance” into “we need proof of X,” which then selects the cheaper sufficient path. Since 1988 that discipline has mattered more than any single tool.
- Map what is already public
- List gaps that only physical observation can close
- Run OSINT to shrink geography and schedules
- Deploy surveillance against remaining gaps
When should you go straight to surveillance?
Go straight to observation when the identity is known, the addresses are solid, and the dispute is about what the person can do with their body or where they spend time. WSIB activity verification, some cohabitation patterns, and certain safety concerns often look like this. Even then, a light OSINT pass on vehicles and secondary addresses still helps.
How do the methods fail when misused?
OSINT fails when analysts overclaim from thin posts or ignore date context. Surveillance fails when teams watch the wrong location because nobody checked open sources. Both fail when clients demand illegal shortcuts.
- OSINT misuse: treating a tagged photo as proof of residency
- Surveillance misuse: one afternoon clip offered as a complete pattern
- Combined strength: OSINT finds the second address, surveillance confirms overnight patterns
Budget and timeline trade-offs
OSINT can often deliver an interim memo faster when sources cooperate. Surveillance quality depends on subject predictability. A person with erratic movements needs more calendar coverage. Ask for a phased budget: discovery OSINT, then targeted surveillance days, then a decision gate.
Rushing straight to multi-day surveillance because it feels decisive is a common waste pattern. Equally wasteful is endless open-source scrolling with no fieldwork when the live question is physical capacity or overnight presence.
Legal and practical limits on both paths
Neither path allows trespass, unlawful tracking devices, or hacking. Surveillance must respect private spaces. OSINT must respect platform terms and privacy expectations around non-public data. Court-usable documentation requires restraint in both lanes.
Choosing OSINT or surveillance is not a branding preference. It is an evidence-design choice. Start with the proposition counsel must prove. If the proposition is relational or historical and likely public, fund open-source work first through the OSINT hub. If the proposition is contemporaneous physical conduct, fund surveillance with enough shifts to show pattern. If both are live, sequence them and write the handoff criteria in the retainer so the file does not wander. That is how professional investigators in Ontario keep methods matched to outcomes.
Practical examples without invented case stats
- Support cohabitation: OSINT for addresses and associates, then overnight surveillance pattern
- Corporate principal diligence: OSINT-heavy, surveillance rare
- Claim activity: surveillance-heavy after confirming likely daytime locations
- Online scam persona: OSINT-heavy unless a local meetup appears
How counsel should brief the method choice
Give the element to prove, the known addresses, the deadline, and any sealed or sensitive constraints. Ask explicitly whether a quiet OSINT phase should precede cameras. Ask what “enough” looks like so fieldwork stops when the proposition is answered.
- State the proposition in pleading language where possible
- Identify what would change strategy if proven
- Set a budget gate after discovery
- Require dated source notes for OSINT and timed logs for surveillance
Hybrid files and handoff criteria
Write the handoff rule before work starts. Example: if OSINT confirms two likely overnight addresses, surveillance begins on those addresses for three nights, then we reassess. Without a rule, teams either under-observe or wander.
Also decide what ends the engagement. If one method answers the proposition, stop. Extra days of watching after the question is resolved are vanity hours.
- Discovery OSINT with a fixed hour budget
- Handoff memo naming locations and schedules
- Targeted surveillance against named gaps
- Decision gate with counsel before more spend
Client communication during mixed methods
Clients should receive interim updates that say which method is active and why. Surprise invoices for a method they thought was optional create conflict. Clarity is cheaper than remediation. Ontario licensing still governs both lanes, so neither path becomes an excuse for unlawful shortcuts when the other path feels slow.
Risk, privacy, and neighbour optics
Surveillance in residential areas creates neighbour attention if poorly planned. OSINT avoids that optic but cannot prove physical presence on a given night. Choose with both proof needs and practical risk in mind.
Counsel should also consider whether findings will be challenged as selective. Pattern coverage usually beats a single dramatic clip. OSINT exhibits usually beat anonymous printouts with no capture date.
- Proof need first
- Privacy and legality second
- Budget and calendar third
- Optics and subject sensitivity fourth
That order keeps Ontario files defensible. Reversing it produces either illegal shortcuts or expensive theatre. Investigation Hotline will push back when a requested path cannot answer the stated proposition.
If you are still unsure after reading this guide, bring the proposition to a consult and ask for a sequenced plan in writing before any fieldwork or deep open-source spend begins.
Quick chooser for common Ontario file types
- WSIB activity consistency: surveillance first after light address OSINT
- Hidden related companies: OSINT first
- Cohabitation pattern: OSINT for addresses, then overnight surveillance
- Online persona attribution: OSINT first, surveillance only if local meetup risk appears
- Judgment debtor lifestyle: mixed methods with enforcement counsel directing priorities
Print that chooser into your intake notes. Then confirm with Investigation Hotline so the plan matches the live facts rather than a generic template.
Use the chooser as a starting point, then pressure-test it against your actual addresses, deadlines, and proof burden. The best Ontario files are sequenced on purpose, with OSINT and surveillance each doing only the work they are good at, under licensed methods and clear reporting standards.
If both methods may be needed, ask for a written sequence with budgets and handoff criteria before any team deploys. That single planning step prevents the most common waste pattern in Ontario investigative files: cameras first, questions later. Put the sequence in the retainer so everyone knows when OSINT stops and when surveillance starts. Revisit the sequence if the legal proposition changes mid-file.
Ask for a method recommendation, not a package name
Call Investigation Hotline at +1 416-205-9114 or use the contact page. Describe the decision you must make. We will recommend OSINT investigations, tracking and surveillance, or a sequenced blend.
To learn more, contact Investigation Hotline at
