Part 5: OPSEC for AI-assisted OSINT

Operational security for AI-assisted OSINT: the Berkeley Protocol principles, the new ways AI tools leak who you are and what you want, and the habits that stop it.

5.1 Principles and the Berkeley Protocol

Operational security in OSINT is a habit before it is a toolset. You gather information from public sources without revealing who you are, who you work for, what you are looking for, or how. AI tools add a new channel for all four to leak.

The Berkeley Protocol on Digital Open Source Investigations remains the reference standard. It was published by the UN Human Rights Office and the Human Rights Center at UC Berkeley. Its security chapter asks four things of investigators. Manage attribution so that nothing identifies you, your organisation, your sources or your intent. Expect to be observed and act consistently with your online persona. Work from secure environments. Keep personal and professional activity apart.1 It was written in 2020 and has not been revised for the AI era, so the rest of this Part extends it.

5.2 Technical safeguards, identity and data handling

  • Network. Use a VPN and, where it fits your threat model, Tor. Understand what each hides and from whom before you combine them.
  • Isolation. Research in a virtual machine or a dedicated device. Keep a separate browser profile for each persona.
  • Personas. Research accounts should be built and maintained with the same care as a real identity, and never mixed with your own.
  • Communications. Use end-to-end encrypted messaging (Signal) and encrypted email (Proton Mail) with sources and colleagues.
  • Storage. Keep findings local and encrypted. Decide a retention period and delete on schedule. Limit who can read the case.
  • Metadata. Strip location and device data from anything you upload anywhere, including to an AI assistant.

5.3 Where your prompts go

Every prompt you send to a cloud assistant is stored somewhere, for some time, under some terms. Four things can happen to it.

It can train the next model. ChatGPT, Gemini, Le Chat and Grok consumer accounts use chats for training by default with an opt-out. Claude consumer accounts asked users to choose in 2025, with a five-year retention period for those who said yes. Even opted-out chats can be used if they are flagged for safety review.23 Enterprise and API accounts at all these vendors are excluded. Part 2.1 has the detail.

It can be kept for years. Default retention starts at 30 days for deleted chats at most vendors. It runs to 18 months for Gemini’s Keep Activity, three years for Gemini chats sampled for human review, and five years for Claude chats used for training.45

It can be produced in court. The 2025 OpenAI preservation order covered Free, Plus, Pro and Team accounts and API customers without zero-data-retention terms. Users in the EEA, UK and Switzerland were exempt, as were Enterprise and Edu customers. The order ran from 13 May to 26 September 2025 and was formally terminated on 9 October 2025. Everything preserved during that window remains available to the plaintiffs, and 20 million de-identified conversations were ordered produced.678 This was civil discovery between private parties, not government surveillance, and it is the kind of thing that can happen to any vendor.

It can end up on the open web. In July 2025 more than 4,500 ChatGPT conversations that users had marked “discoverable” appeared in Google results.9 In August 2025 hundreds of thousands of shared Grok chats were indexed the same way.10 In June 2025 the Meta AI app’s Discover feed showed users’ conversations in public without many of them realising.11

There is no professional privilege for any of this. As OpenAI’s chief executive put it, “we haven’t figured that out yet”.12

Government purchase of commercially available data, including data brokers’ records, remains a live concern in the United States. The Fourth Amendment Is Not For Sale Act passed the House in April 2024 and has not become law.13

5.4 Recommendations

  1. Put anything that identifies a target, a source or a case on a local model or an enterprise account. Everything else is optional; this is not.
  2. On consumer accounts, turn model training off, turn memory off, and use temporary or incognito chats for case work.
  3. Use a case-dedicated account for cloud assistants rather than rotating your personal account.
  4. Anonymise before you paste. Replace names, vessel identifiers and company numbers with placeholders and keep the key offline.
  5. Write generic queries. “How do shell companies in jurisdiction X typically layer ownership” rather than “is Company Y a shell”.
  6. Assume permanence. If you would not want a prompt read aloud in court, do not send it to a cloud service.

Footnotes

  1. OHCHR and UC Berkeley Human Rights Center (2022; first published 1 December 2020). Berkeley Protocol on Digital Open Source Investigations, HR/PUB/20/2. https://www.ohchr.org/sites/default/files/2024-01/OHCHR_BerkeleyProtocol.pdf ; UN Digital Library record, https://digitallibrary.un.org/record/3973652 ; project page, https://humanrights.berkeley.edu/programs-projects/tech-human-rights-program/berkeley-protocol-digital-open-source-investigations. Accessed 2026-10-09.↩︎

  2. Anthropic (28 August 2025). “Updates to Consumer Terms and Privacy Policy.” https://www.anthropic.com/news/updates-to-our-consumer-terms. Accessed 2026-10-09.↩︎

  3. Anthropic. “Privacy Policy”, effective 10 September 2026. https://www.anthropic.com/legal/privacy. Accessed 2026-10-09.↩︎

  4. Google. “Gemini Apps Privacy Hub.” https://support.google.com/gemini/answer/13594961. Accessed 2026-10-09.↩︎

  5. Anthropic Privacy Center (updated 1 July 2026). “How long do you store my data?” https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data. Accessed 2026-10-09.↩︎

  6. The New York Times Co. v. Microsoft Corp. et al., No. 1:23-cv-11195-SHS (S.D.N.Y.), now part of In re OpenAI, Inc. Copyright Infringement Litigation, No. 1:25-md-03143. Preservation order of 13 May 2025 (Wang, M.J.). Order text: https://cdn.arstechnica.net/wp-content/uploads/2025/06/NYT-v-OpenAI-Preservation-Order-5-13-25.pdf. OpenAI’s explanation of scope: “How we’re responding to The New York Times’ data demands”, https://openai.com/index/response-to-nyt-data-demands/ (updated 22 October 2025). Accessed 2026-10-09.↩︎

  7. Willison, S. (23 October 2025). “OpenAI no longer has to preserve all of its ChatGPT data, with some exceptions.” https://simonwillison.net/2025/Oct/23/openai-no-longer-has-to-preserve/ ; Engadget (October 2025), https://www.engadget.com/ai/openai-no-longer-has-to-preserve-all-of-its-chatgpt-data-with-some-exceptions-192422093.html. The termination order was entered on 9 October 2025 and ended the duty as of 26 September 2025. Accessed 2026-10-09.↩︎

  8. Bloomberg Law (5 January 2026). “OpenAI Must Turn Over 20 Million ChatGPT Logs, Judge Affirms.” https://news.bloomberglaw.com/ip-law/openai-must-turn-over-20-million-chatgpt-logs-judge-affirms ; ABA Journal, https://www.abajournal.com/news/article/chatgpt-creator-must-turn-over-20m-chat-logs-in-copyright-litigation-federal-judge-says. Accessed 2026-10-09.↩︎

  9. Fast Company (30 July 2025). “Google is indexing ChatGPT conversations.” https://www.fastcompany.com/91376687/google-indexing-chatgpt-conversations ; Search Engine Journal, https://www.searchenginejournal.com/openai-is-pulling-shared-chatgpt-chats-from-google-search/552671/. Accessed 2026-10-09.↩︎

  10. TechCrunch (20 August 2025). “Thousands of Grok chats are now searchable on Google.” https://techcrunch.com/2025/08/20/thousands-of-grok-chats-are-now-searchable-on-google/ ; Forbes Australia, https://www.forbes.com.au/news/innovation/xai-published-hundreds-of-thousands-of-grok-chatbot-conversations/. Accessed 2026-10-09.↩︎

  11. Mozilla Foundation (June 2025). “Meta: help users stop accidentally sharing private AI conversations.” https://www.mozillafoundation.org/en/campaigns/meta-help-users-stop-accidentally-sharing-private-ai-conversations/. Accessed 2026-10-09.↩︎

  12. TechCrunch (25 July 2025). “Sam Altman warns there’s no legal confidentiality when using ChatGPT as a therapist.” https://techcrunch.com/2025/07/25/sam-altman-warns-theres-no-legal-confidentiality-when-using-chatgpt-as-a-therapist/. Accessed 2026-10-09.↩︎

  13. Brennan Center for Justice (2026). “Section 702 of FISA: 2026 resource page.” https://www.brennancenter.org/our-work/research-reports/section-702-foreign-intelligence-surveillance-act-fisa-2026-resource-page. Accessed 2026-10-09.↩︎