Open source intelligence (OSINT)

The aim is not intrusion, but mapping the dependencies an adversary could infer from records that were never sensitive in isolation. Permits, tenders, job ads, planning portals; each published for legitimate reasons, each routine. Combined, they can describe a site’s quiet supports in surprising detail.

The examples are Dutch, for context.

A working process

A narrow, repeatable loop usually works better than a broad sweep. Pick the smallest interesting target, follow the dependency chain, and stop when the picture stabilises.

  1. Pick an anchor. A single site, narrowly defined: a radar station, an ammunition depot, a logistics hub.

  2. List its critical services. Electricity (typically medium voltage), cooling water, data connectivity, fuel supply, physical access, waste handling.

  3. For each service, find the public footprint.

    • Electricity: search Ruimtelijke Plannen for transformatorhuisje near the site, then trace which grid node feeds it.

    • Fuel: pipeline permits crossing nearby land, often filed as buisleiding brandstoffen.

    • Cooling: water-extraction permits via the local waterschap.

    • Data: fibre routes on PDOK, or municipal civil-works permits where new ducts are dug.

  4. Identify third-party dependencies. Tenderned awards for onderhoud hoogspanning or similar at the location, contractor LinkedIn tags (“worked at site X doing generator testing”), service-provider case studies.

  5. Build a dependency graph. A spreadsheet is enough: asset, service, provider, public source, observable weakness (e.g., “permit shows pipeline runs under public road, no evident redundancy”).

  6. Run the adversarial reframe. If the goal were to interrupt this site’s primary function for 48 hours, which single points does the public record already expose?

  7. Note what was never visible without aggregation. The structural finding tends to be the dependency chain, not any single document. This step is the one most often skipped.

Useful categories when scanning:

  • Physical dependencies. Power feeds, water and sewer, gas pipelines, district heating, fibre routes, backup generators, UPS locations.

  • Third-party dependencies. Maintenance contractors, cleaning, catering, security guards (and shift patterns), waste disposal, IT service desks, HVAC servicing.

  • Temporal patterns. Permit application dates, planned outages, roadworks near sites, vibration monitoring near pipelines (often used for leak detection but also a useful schedule signal).

  • Overlapping infrastructure. Military cables sharing a conduit with civilian lines, a radar installation and a factory drawing from the same substation.

  • Personnel hints. Job postings tied to a named site (e.g., “electrician for Volkel Air Base”), LinkedIn profiles of contractors, social media check-ins near sensitive locations.

  • Environmental data. Satellite imagery (free Sentinel-2) of construction pits, pipeline markers, substations inside restricted areas.

Dutch public sources

Spatial planning and permits

  • Ruimtelijke Plannen, permits for new buildings, pipeline routes, utility corridors. The portal remains available but is no longer being updated.

  • Omgevingsloket, the successor under the Omgevingswet. Coverage is incomplete and the new viewer (Regels op de kaart) does not yet match the old plan map for usability. The transition period runs to 2032, so during this window both portals are in scope and neither is canonical on its own.

  • Overheid.nl, publication platform for environmental permits, exemption decisions, and tender notices.

  • Tenderned, tender notices and awards, including maintenance and works contracts.

Underground assets

  • KLIC (Kabels en Leidingen Informatie Centrum). Cable and pipe data is released only in response to a location-specific request (an oriëntatieverzoek or graafmelding to the Kadaster), not through an open public map.

Geodata

  • PDOK (Publieke Dienstverlening Op de Kaart), base maps, soil data, infrastructure layers.

  • OpenStreetMap, user-contributed power lines, substations, pipelines, often unusually detailed in the Netherlands.

Water

Airspace and radar

Labour market

  • LinkedIn and Indeed, job ads specifying backup-generator maintenance, UPS battery replacement, or security-cleared electricians, often with a named location.

Visual reconnaissance

  • Google Maps and Street View, fence lines, camera positions, manhole covers, utility markers.

  • Company websites, where local technical service providers occasionally note “MoD contracts” alongside site photos.

Radarstation Herwijnen is one worked example, using a small subset of these sources.

Last reviewed: 2026-07-08.