Knowledge Hub

At the same time, the amendment sharpens an important distinction that many people are unaware of: there is a separation between criminal information held in the criminal register and protected by law, and factual, public information found in open sources (OSINT), which is not part of the criminal register at all. It is precisely this distinction that makes OSINT-based background checks a more important tool today than ever before.

What did Amendment No. 10 change? The amendment adds a new mechanism of a “notice regarding the existence of a criminal record entry,” through the new Section 16A of the law. In certain cases, instead of disclosing the full content of the criminal record, the authorized body will receive a notice stating that a criminal record entry exists, in accordance with the arrangements set out in the law. In addition, this notice was defined as part of the term “criminal information.” The purpose of the amendment is to continue strengthening the principle of rehabilitation of offenders, while balancing the public interest against a person's right to rehabilitate.

What does it mean for employers? For most employers, the basic legal situation has not changed. Even today: an ordinary employer may not require a candidate to present a criminal record; it is prohibited to require a candidate to obtain information from the police on the employer's behalf; and only bodies expressly authorized by law may receive information from the criminal register, and only to the extent set by law. In other words, even after the amendment, most employers cannot base their decision-making process on the criminal register.

But this is where the common mistake begins. Quite a few people believe that if you cannot obtain a criminal record, you are not allowed to know anything about a candidate's past. This is not the correct interpretation. The law regulates access to the criminal register and to criminal information managed by the state. It does not prohibit locating factual information that has already been lawfully published in open sources. This is a very important legal distinction.

What is the difference between a criminal record and open information? A criminal record is information managed in the criminal register of the Israel Police, and access to it is regulated by law. By contrast, information such as judgments published in legal databases, official court publications, Israel Police spokesperson announcements, State Attorney's Office announcements, publications by regulatory authorities, credible news articles, tender and disqualification notices, liquidation, receivership or legal-proceedings documents, public business information, and publications of sanctions or international blacklists does not constitute “criminal information” as defined by law merely because it describes a criminal event or a conviction. This is public information that was lawfully published, and therefore it is not part of the criminal register itself. Of course, the use of such information must also be carried out in accordance with privacy protection laws, the prohibition of defamation, and the principles of relevance, proportionality and good faith.

This is where OSINT-based background checks come into the picture. A quality background check does not try to circumvent the law and does not try to obtain confidential information. On the contrary. It operates solely through public and lawful information sources. When professional OSINT is performed, it is sometimes possible to locate substantive information that is not accessible through the criminal register, for example: convictions published in judgments, involvement in fraud affairs that received publicity, indictments published lawfully, insolvency proceedings, significant civil proceedings, problematic business relationships, conflicts of interest, ties to high-risk companies or parties, indications of fraud or impersonation, and public behavioral patterns with occupational significance. Sometimes it is precisely this kind of information that gives the employer a broader picture than the mere existence of a criminal record.

Does this replace a criminal record? No. These are two entirely different tools. The criminal record is official state information. OSINT is not a criminal register and does not claim to be one. Its purpose is to identify indications of risk from public information that can be verified, cross-referenced and professionally assessed. Therefore, in many organizations, especially in sensitive positions, OSINT checks do not replace the checks prescribed by law, but rather complement them.

The practical meaning for employers: Amendment No. 10 continues the legislator's trend of strengthening the protection of people's privacy and the principle of rehabilitation. However, it does not eliminate employers' duty of care toward their employees, their customers and the organization. Therefore, the more restricted access to official criminal information becomes, the greater the importance of conducting quality background checks based on open, lawful, relevant and verified information.

The challenge for the employer today is not to obtain more information. The challenge is to know how to distinguish between information that may not be received and public information that is permitted, and even worth considering, as part of an informed decision-making process. It is also important to remember that any use of information originating in OSINT must be carried out in accordance with all relevant legislation, including the Privacy Protection Law, the prohibition of defamation, labor laws, and the principles of equality and proportionality. The mere fact that information has been published publicly does not automatically make it relevant or legitimate for every recruitment decision.

This story is not just a story about investments, crypto or the capital market.

It is a story about a failure of due diligence.

Many people think a background check is only meant for hiring employees. In practice, it is no less important when choosing a business partner, an investment manager, a supplier, an advisor, or anyone who is supposed to be given access to money, information or assets.

In this case, some of the information was completely available in open sources: a criminal conviction for fraud offenses; a lengthy prison term; historical media coverage; legal proceedings and rulings; and business and public information that can be located through professional searching.

The problem is that finding the information is not enough. You have to know how to connect the dots.

An OSINT-based background check is not just about collecting data. The real value lies in the analysis and in understanding what the information means for the purpose of making a decision.

When you assess a person who is meant to manage your money or make financial decisions, the question is not only "Did he have a prior conviction?", but rather: Did he disclose it fully? Are there additional warning signs? Are there gaps between the public image and reality? And are there patterns that recur over the years?

Ultimately, most major frauds don't begin with technological sophistication. They begin with trust.

And before extending trust, it is worth conducting a professional background check based on open information sources, in order to make an informed decision grounded in facts rather than in personal impression or charisma.

In my view, that's actually the easy part.

The real challenge begins the moment after we've found the information: are we certain it belongs to the person we're actually checking?

In a world where millions of people share similar names, use nicknames, maintain multiple digital profiles and sometimes leave only partial traces, it's very easy to fall into the trap of a "quick identification."

I often come across cases where investigators, recruiters or managers see a problematic profile online, an old article or a negative mention, and rush to draw conclusions.

But a professional background check is not an exercise in gathering information. It's an exercise in verifying identities.

Before drawing conclusions, you have to verify: is it the same person? Does the geographic location match? Does the timeline line up? Are there additional identifiers that connect the data points? And are there independent sources that confirm the link?

The greatest danger isn't missing negative information. The greatest danger is attributing negative information to the wrong person.

A mistake like that can lead to flawed hiring decisions, damage to the reputation of an innocent person, and even legal exposure.

That's why one of the most important principles in open-source intelligence (OSINT) work is: first you verify. Only then do you conclude.

That's the difference between gathering information and pursuing the truth.

At first it seemed completely credible. Photos, explanations, Google results, mentions on various sites including Wikipedia.

But the deeper I dug, the more I discovered that most of the story isn't grounded in anything at all. Some of the photos were wool sculptures by a Japanese artist. Others were images of entirely different species. And in practice, the only thing that truly exists is a single photograph of an unidentified moth taken in Venezuela (the image at the top left). There isn't even an official scientific recognition of such a species.

What's interesting here isn't the moth. It's the way information turns into "truth."

Today, search engines no longer rely solely on original sources. They are also fed by content created by AI, by automated summaries, by copying between sites, and by information that recycles itself again and again.

And what this means is that even if you try to do a "reverse trace" and check what the real source is, it becomes very difficult. Because at a certain point, the original source disappears, the information is copied hundreds of times, AI systems summarize erroneous information, and unverified content starts to look more credible than reality itself.

And this is precisely one of the great challenges in the world of background checks.

It isn't enough to know how to search for information. You need to know how to doubt information.

You need to understand: Who is the source? Is there any verification? Is this primary information or a copy? Is there a vested interest? And is everyone simply quoting one another?

In an era where AI can generate enormous quantities of convincing content, the ability to think critically becomes a critical professional asset.

This is exactly why professional background checks cannot rely solely on a quick Google search or on AI tools.

In the end, you still need people who know how to connect contexts, identify manipulation, understand what's missing from the picture — and above all, know when not to believe immediately something that looks credible.

The request was clear: locate the source of distribution, stop it quickly, and remove the content.

On the surface, this sounds like a classic open-source intelligence task. But that's exactly where the problem begins.

I want to share with you, with professional honesty, where OSINT is strong and where it simply isn't enough.

Where OSINT delivers real value: you can map how content spreads, identify groups, channels and distribution hubs, track recurring users across different platforms, and understand who is "pushing" the story forward. This provides a very important intelligence picture.

But here comes the critical limitation: you cannot identify with certainty who the person behind the account is, prove who created the content, access closed information (IP, devices, logs), or guarantee complete removal from the internet.

And when it comes to sensitive incidents, especially involving minors or privacy violations, the smallest mistake in identification can turn into a serious legal problem.

The real risk: the problem is not only technological - it is managerial. When you make promises like "we'll find who did it" and "we'll take everything off the web" without understanding the limits, that's a recipe for disappointment at best, and for damage at worst.

So what is the right thing to do in such cases? The right approach is always multidisciplinary: OSINT for mapping and understanding, DFIR for collecting evidence from devices and systems, legal support for approaching the platforms, damage control and prevention of repeated distribution, and continuous monitoring. Anyone who handles this alone, from a single angle, misses the picture.

The bottom line: open-source intelligence is a very powerful tool - but it is not magic.

Knowing what can be done is important. But knowing what cannot be done - that is what separates professional work from risk.

And this is exactly where many organizations fall short.

We live in an era of endless open information: forums, groups, leaks, small hints. But without real business context, without an understanding of what is relevant to a specific organization, it all turns into noise.

And this is not only in the cyber world.

It is exactly the same principle in the world of open-source intelligence.

I see it all the time: organizations think they need "more checks", "more sources", "more data". But the truth is the opposite. The real value comes from the ability to connect the dots.

For example: someone posts on a dark forum offering access to a system. They do not mention a company name. There are no clear keywords. Classic systems will not detect it. But if you understand the context, the type of system, the size of the company, the geographic location, the type of activity, suddenly it is no longer "general information". It is a very specific threat.

And now think about this in the context of insider threats.

Many times the threat does not start from within the organization. It starts outside, on the dark web, in forums, in groups. But it connects to people on the inside: an employee with access, a vendor with permissions, a candidate trying to get in.

Without a connection between external intelligence and an internal understanding of the organization, you miss the story.

And this is the truly important point: AI alone does not solve the problem. Relying on OSINT alone does not solve the problem.

Only a combination of real business context, human analysis that understands behavior, and technology that can operate at scale creates a real advantage.

Whoever keeps collecting information without understanding what is relevant to them will drown in the noise. Whoever knows how to connect the dots in time will identify the threat before it becomes an incident.

For organizations that conduct background checks based on open-source intelligence (OSINT), the question sometimes arises as to whether these regulations will make such checks impossible or undermine their effectiveness.

The professional answer is no.

Regulation changes the way in which the check is performed, but it does not eliminate the need for it, and it does not prevent the conduct of high-quality checks when they are carried out in a professional, lawful, and proportionate manner.

What is Amendment 13 to the Privacy Protection Law? Amendment 13 is intended to strengthen the enforcement capabilities of the Privacy Protection Authority and to align Israeli law with modern international standards. Among other things, the amendment grants the Privacy Protection Authority broader enforcement powers, significantly increases the level of financial sanctions, requires organizations to manage personal information more responsibly, increases the accountability of database owners and data processors, and strengthens the rights of data subjects. In practice, the implication for organizations is that violating privacy provisions may become a significant business, legal, and reputational risk.

How do privacy regulations affect background checks? The most common mistake is to think that privacy legislation prohibits the collection of information. In fact, most regulations around the world do not impose a blanket prohibition on collecting personal information. They require that collection be carried out on the basis of clear principles: a legitimate purpose, proportionality, transparency, data minimization, data security, and limited retention over time. In other words, the question is not "is it permitted to collect information?" but rather "what information is collected, why is it collected, and how is it used?".

The use of OSINT is not exempt from privacy laws. There is another mistaken perception according to which information published online is "free to use". The fact that information is found online does not negate the fact that it is personal information. For example: a LinkedIn profile, social media posts, news articles, business records, and forum content. All of these may be considered personal information and subject to privacy laws. Therefore, an organization conducting background checks cannot rely on the claim that the information was merely "public".

How can high-quality background checks be conducted in compliance with regulation?

Defining a clear purpose: A background check should be directly related to the risk that the organization seeks to mitigate. For example: detecting conflicts of interest, identifying past fraud, detecting behaviors that may harm the organization, examining reputational risks, and identifying problematic business relationships. Collecting information unrelated to this purpose may be considered a deviation from the principle of proportionality.

Collecting only relevant information: A professional check is not measured by the quantity of information collected but by the quality of the information. In many cases, an excess of information actually makes decision-making more difficult. The correct approach is to focus on information of genuine business value and to link it to the required risk assessment.

Using human analysts: One of the central problems in automated checks is the massive collection of information without context. A professional analyst knows how to distinguish between fact and opinion, cross-reference sources, identify errors in identification, understand cultural and linguistic contexts, and exercise judgment. Precisely in a world of stringent regulation, the value of the human element grows.

Transparency and consent when required: In recruitment processes or certain engagements, it is recommended to obtain explicit consent to conduct a background check. Even when the law does not fully require this, clear consent strengthens the legitimacy of the process and reduces legal risks.

Deletion of information and limited retention: One of the fundamental principles in most privacy regulations is limiting the duration of retention. After completing the check and making the business decision, one should examine whether there is justification for continuing to retain the information, whether the reports can be deleted, and whether only partial retention of the data is necessary. This approach reduces data security risks and lowers regulatory exposure.

The advantage of OSINT precisely in the age of privacy: Paradoxically, privacy regulations actually strengthen the standing of high-quality OSINT checks. In the past, many organizations relied on collecting information from numerous databases, some of which were legally problematic. Today, the emphasis is shifting to information gathered from open, lawful, documented, and verifiable sources. When the check is conducted professionally, it is possible to reach significant insights even without access to private or confidential information. In many cases, it is precisely the open information that provides the most important indications regarding behavior, business relationships, reputational risks, or conflicts of interest.

The key is Governance, not prohibition: The central message of Amendment 13 and of privacy regulations around the world is not "do not conduct background checks". The message is: conduct them responsibly. Organizations that build orderly work processes, adhere to proportionality, operate control mechanisms, and use professional analysts will be able to continue conducting highly effective background checks even under stringent regulation.

In fact, in a world where insider threats, fraud, AI-based impersonation, and conflicts of interest are becoming more complex, the need for professional background checks is only growing.

The new challenge is not to find information. The challenge is to know how to collect the right information, use it lawfully, and derive from it insights of genuine value for decision-making.

The core idea is simple but very profound: our body does not merely "express" emotions and thoughts, it also influences them, and sometimes even reveals them before the brain manages to control the message.

For years, body language was viewed as an "add-on" to communication. Today it is already clear that it is part of the thinking system itself. Sitting posture, hand placement, breathing rate, head movements, distance from the camera, use of space, micro-expressions, vocal changes, and even the manner of typing are all part of a behavioral information system.

In business profiling this is critical.

When we conduct a reliability assessment or try to identify the potential for an internal threat within an organization, we are not looking only for a "lie." It is far more complex. We are looking for incongruence.

The Embodiment Effect makes it possible to understand when physical behavior is not synchronized with the narrative a person is trying to produce. For example: a candidate who speaks confidently but whose body is in continuous defensiveness; an employee who declares commitment to the organization but reacts physically with stress when issues of authority, control, or loyalty arise; a manager who presents stability but shows abnormal signs of arousal around financial questions or internal conflicts; a remote candidate who produces "too perfect" eye contact, with an artificial response pace and communication patterns that suggest the use of external aids or real-time AI.

And here the new challenge enters: remote assessment.

In the era of hybrid work and Zoom interviews, some people think it is possible to "hide" behavior through a screen. In practice, the opposite sometimes happens.

The camera reduces background noise and forces us to focus on micro-behaviors: response delays, tone changes, eye darting, over-adjustments, unnatural listening, disconnects between voice and expression, motor freezing, and excessive use of calculated gestures.

Precisely in a remote environment, when you know what to look for, you can identify very significant indications of reliability, stress, concealment, manipulation, or internal conflict.

But it is important to state the professional truth: there is no "magic sign" that proves a lie. This is one of the biggest mistakes in the field.

Professional profiling is not built on myths of "touching the nose = lying." It is built on creating a behavioral baseline, identifying anomalies, cross-referencing information sources, analyzing context, understanding motivations, and reading dynamics rather than just isolated signs.

The Embodiment Effect is especially important in identifying internal threats within organizations, because people can control their words far more than their bodies. And in situations of stress, conflicting loyalties, a sense of threat, or concealment, the body almost always "leaks" information.

The future of the world of business profiling will not be based solely on technology nor solely on human intuition. It will be a combination of deep behavioral understanding, digital analysis, the use of OSINT, anomaly detection, and the human ability to read people even through a screen.

Because in the end, even in the era of AI, a person still leaves a behavioral signature.

These are three personality traits that may initially look like self-confidence, charisma, or assertiveness, but within an organization they can turn into a real internal threat: narcissism, which involves a need for admiration, a sense of superiority, and difficulty accepting criticism; manipulativeness (Machiavellianism), which means using people as tools to achieve goals, without much guilt along the way; and functional psychopathy, which involves extreme coolness, a lack of empathy, and the ability to carry out harmful actions without conscience.

The interesting part is that people with such traits don't always fail job interviews. On the contrary.

More than once they are very impressive. They know how to talk. They know how to sell themselves. They know how to identify other people's weaknesses. And they know exactly which persona the organization wants to see in front of them.

That's why I think one of the biggest challenges today in the world of insider threats is not only identifying a 'problematic past', but understanding patterns of personality and behavior that may turn into an organizational risk in the future.

This can manifest as leaking information, deliberately harming the organization, manipulating employees, creating a toxic culture, or simply making dangerous decisions without any empathy for the consequences.

It's clear that not every person with Dark Triad traits is a criminal or an insider threat. But when you combine access to sensitive information, pressure, ego, lack of oversight, and manipulative ability, you get a combination that managers must be aware of.

And this is exactly where the value of in-depth assessment, proper questioning, intelligence from open information sources, and identifying red flags before harm occurs comes into play.

Because in the end, the most dangerous threat in an organization is usually not the one who looks dangerous. It's the one who knows how to look perfect.

For example, there are cultures in which avoiding eye contact is a sign of respect. For others, it immediately raises questions. There are places where direct communication is seen as positive, while elsewhere it is perceived as rude.

And this is where biases come into play.

When we are not aware of them, we are not really analyzing the person. We are analyzing the gap between them and us.

In business profiling, this is especially critical. Decisions are made about people: candidates, partners, suppliers. An error in interpretation can lead to missing out on an excellent person, or worse, to failing to identify a real risk.

So what do we learn from this?

First of all, professional humility. Understanding that not everything that seems right to us truly is.

Second, context. Always asking: where does this person come from? Does the behavior fit with the culture they come from?

And finally, the right combination of analytical tools and human understanding. Without this, there is no real objectivity.

Anyone who works with people must understand cultures. Otherwise, they are simply guessing.

I remember a time when LinkedIn was a very "clean" place. Professional, calculated, a little sterile. Everyone wrote the same things, everyone sounded the same, and there was almost nothing there that truly revealed who the person behind the profile really was.

And then the enshittification began.

More personal posts. More politics. More extreme opinions. More provocations that gain exposure because the algorithm loves noise.

For anyone looking for a purely professional platform, this looks like deterioration. And to a large extent, it really is.

But from my perspective, something interesting happened here.

It is precisely this "out of place" content that begins to tell the real story.

When I check someone as part of a background check from open sources, I'm not just looking at what they do. I'm looking at how they think. How they react. What sets them off. Where their boundaries are.

And these things almost never showed up on the old LinkedIn.

Today they are there. In abundance.

A political post written without filters, an aggressive response to a professional discussion, a choice to join a provocative trend, these are no longer "noise" to me. They are signals.

What was once a barren wasteland in terms of understanding personality has become a gold mine of behavioral indicators.

So yes, LinkedIn has changed. And maybe not for the better for those looking only for professionalism.

But for those who understand how to read between the lines, it's a platform that tells far more truth than it did before.