Most "people search" tutorials end where the real work begins. They show you how to type a name into a free aggregator, screenshot the result, and call it intelligence. That's not OSINT. That's typing.
Public records — the actual ones, filed with governments — are where investigations live or die. Court dockets, corporate registries, voter rolls, property deeds, marriage certificates, vehicle titles, campaign donations, aircraft ownership. None of it is glamorous. All of it is admissible.
What "public records" actually means in PERSINT
In the PERSINT taxonomy, public records sit under PERSINT.PUBLICRECORDS — the sub-direction that covers government-filed documents about a person or the entities they touch. Court, voter, real-estate, business, marriage, criminal, vehicle, and tax records. Each is a different filing system, often a different jurisdiction, and almost always a different access regime.
The myth: there is one big database. The reality: public records are a thousand portals held together with FOIA requests, county clerks, and stubbornness.
The US stack — county-level, federal, and the FOIA backbone
In the US, the foundation is local. Property records, marriage and divorce filings, criminal dockets — most of that lives at county or state level. There is no national index. You learn the jurisdiction first, then the portal.
For federal court records, the canonical source is PACER, which holds more than one billion documents filed across all federal courts. PACER charges $0.10 per page, capped at $3 per document, and that paywall has spawned an entire counter-economy. The most useful piece of it is CourtListener by the Free Law Project — combined with the RECAP browser extension, it mirrors purchased PACER filings into a free public archive that now contains tens of millions of PACER documents. If your target has been sued or has sued anyone in federal court since the early 2000s, you can usually find the docket without paying PACER a cent.
For paid-tier coverage of state courts and adjacent records, UniCourt, LexisNexis, and Westlaw are the heavyweights. They are expensive, and the price buys normalized data, not exclusive access — almost everything in them was already public somewhere.
For campaign-finance pivots, FEC.gov publishes raw filings and OpenSecrets' donor lookup makes them searchable by name, employer, occupation, and ZIP. A single donation record routinely surfaces a target's home city, employer, and self-described profession in one row — facts they may not have published anywhere else.
Aircraft are an underused pivot. The FAA Aircraft Registry exposes owner name, address, make, model, and tail number for every US-registered civil aircraft. If your target owns or part-owns a plane, the registry will tell you — though under 49 USC § 44114(b) the FAA is rolling out a withholding process for owners who request privacy, so coverage in 2026 is not what it was in 2016.
Vehicles are a different beast. The Driver's Privacy Protection Act walls off most DMV data behind 14 enumerated permissible uses — journalism is one, but it requires standing and documentation. Don't pretend bulk DMV access is a civilian OSINT tool. It isn't.
FOIA — the legal pivot
When a record exists but isn't online, FOIA is the lever. Federal agencies are statutorily required to respond within 20 business days. Almost none of them do. The Defense Department's FOIA backlog grew 42% to over 30,000 cases by the end of fiscal 2025, and the trend in 2026 is worse, not better.
MuckRock is the operator-grade tool here. It files, tracks, and timestamps requests across all 50 states and every federal agency, publishes the responsive documents, and maintains an archive of hundreds of thousands of pages of previously released records. Search MuckRock before you file. Someone has probably already asked your question and gotten the answer.
Outside the US, the equivalents are the SAR (Subject Access Request, UK GDPR) and DPA requests under national data-protection laws. Different scope, same principle: you can compel the production of records that aren't published.
The EU stack — GDPR walls, but registries stay open
In the EU, GDPR limits what private aggregators can serve. National registries are a different matter — they're statutory, and most of them are still free at the point of use.
UK Companies House is the gold standard. Free, no login, full filing history, plus the People with Significant Control register launched in April 2016. The PSC register is not a beneficial-ownership register in the strict sense — researchers have flagged for years that it records control rather than economic benefit, and accuracy depends on companies self-declaring honestly. Still, for resolving who runs a UK shell, it's the first stop.
France's equivalent is Sirene/INSEE, which covers 31 million entities and is updated daily — free, with an open API. Note that the standalone sirene.fr site closed in December 2025; INSEE is consolidating distribution on data.gouv.fr. Germany publishes corporate filings via Bundesanzeiger, and the E-Justice EU portal is the pan-European entry point for cross-border registry queries.
Aggregators — when one country isn't enough
People hop jurisdictions. So do companies. That's where aggregators earn their keep.
OpenCorporates is the largest open database of companies in the world — over 200 million companies across 140 jurisdictions, normalized into a single schema. If you're following a director who has been quietly incorporating LLCs in Delaware, Wyoming, the Isle of Man, and Cyprus, OpenCorporates is the only reasonable starting point.
OCCRP Aleph is the investigative-journalism layer on top. It cross-references corporate registries, sanctions lists, court filings, and document leaks across more than 200 countries — over 400 million documents and entities from 200+ datasets at last public count. Access is free for journalists and researchers via an OCCRP application.
For offshore entities specifically, the ICIJ Offshore Leaks Database aggregates the Panama Papers, Paradise Papers, Pandora Papers, Bahamas Leaks, and the original Offshore Leaks. More than 810,000 offshore companies, foundations, and trusts linked to people in 200+ countries. It does not contain bank statements or correspondence — just the entity-and-officer skeleton. That's enough to disprove a denial.
Techniques that actually move investigations
Tool lists are easy. Pivots are what separate operators from notetakers.
- Jurisdictional triangulation. Your target's LLC dissolves in Florida. Three months later a near-identical LLC appears in Delaware with one different officer. OpenCorporates' name and director searches across jurisdictions surface those hops; a county-level filing search confirms them.
- Marriage-record combo. A marriage license carries the spouse's full legal name, often parents' names, and a date. Combined with vital-records portals via the USA.gov vital-records guide, it builds family graphs no social-media scrape will give you.
- Vehicle-title pivots. Where DPPA permits — and only where it permits — bulk DMV files and lien filings expose co-owners and creditors. Outside those permissible uses, leave it alone.
- Donation pivots. One $250 contribution at OpenSecrets typically yields city, employer, and occupation. Two contributions at different addresses give you a move date.
- Aircraft and vessel ownership. Planes are FAA-registered; large boats are documented with the US Coast Guard. Both are public, and both surface owners that LLC layers were supposed to hide.
- FOIA stacking. One FOIA produces a record. The records produced reference other records. You FOIA those next. Repeat. This is how investigative reporting actually grinds forward.
People worth following
Public-records OSINT moves fastest in three communities: investigative journalists, FOIA hackers, and government-data nerds. The shortlist worth your follow:
- @MuckRock — FOIA filings, FOIA wins, FOIA outrage, daily.
- @ICIJorg — offshore-leaks updates and the database that powers them.
- @OCCRP — cross-border corruption investigations driving Aleph dataset additions.
- @OpenSecretsDC — campaign-finance signal in a sea of noise.
- @cyb_detective, @intelschool, @inteltechniques — the working operator's reading list.
Reality check
Public records are not magic. They are slow, fragmented, and full of typos. A name in PACER can be misspelled three different ways across three filings. A property record can list a corporate owner whose registered agent is another corporate owner whose registered agent is a P.O. box. Sirene says one thing, Bundesanzeiger says another, and neither has been updated in eight months.
That's the work. Anyone who tells you public-records OSINT is a click-and-export workflow has either never run an investigation or is selling you a SaaS subscription. The operators who get answers learn the jurisdictions, file the FOIAs, follow the registry hops, and double-check every name against three sources.
Pick one record type. Pick one jurisdiction. Run a real query against a real target. That's how you learn this. Everything else is content marketing.