Observational Information Gathering

The subject gathers sensitive, restricted, or operationally relevant information by observing others as they perform tasks, access systems, or handle data. This behavior allows the subject to obtain knowledge that is not formally available to them through their assigned role, access permissions, or authorized channels.

Observation may occur in both covert and overt forms, and the boundary between the two is often fluid.

Covert observation involves the subject acquiring information without the awareness of the observed individual. This includes:

• Viewing credentials as they are entered (shoulder-surfing)
• Observing screen content from adjacent or rear positions
• Using reflections, positioning, or timing to capture sensitive data
• Repeated proximity during authentication or system interaction events

Overt observation involves the subject obtaining information through socially facilitated or procedural means, often under a legitimate or benign pretext. This includes:

• Requesting demonstrations of systems or workflows outside their role requirements
• Asking colleagues to walk through processes involving sensitive data or privileged actions
• Positioning themselves as curious, collaborative, or in training to gain visibility
• Attending or inserting themselves into activities without a defined business need

The information gathered may include:

• Authentication credentials or authentication patterns
• System navigation paths and access points
• Sensitive datasets or document locations
• Operational procedures, controls, or workarounds

This behavior serves as a foundational preparatory technique, supporting a wide range of downstream actions including unauthorized access, impersonation, data exfiltration, or policy circumvention.