Open-source research means finding, reading and combining information that is already published and lawfully available to anyone who looks. A company register, a sanctions list, a court's own cause list, a shipping notice, a photograph somebody posted publicly.
That is the whole of it. Three things it is not:
It is not access. If reaching the information requires a password you were not given, a CAPTCHA you worked around, or a rate limit you evaded, it is not open source. It is unauthorised access, and in most jurisdictions that is an offence regardless of what you found.
It is not purchase from a broker. A dataset offered for sale by somebody who will not say where it came from is not a source. Leaked and scraped personal data circulates commercially and is often presented as "OSINT". The association does not use it, and neither should you: it poisons everything downstream, because you cannot show a court where a fact came from.
It is not a conclusion. Finding a record is finding a record. A person appearing on a wanted list is a person on a list — nothing about that record establishes that they did what the list says, and nothing about a matching name establishes that it is the same person.
The line matters practically, not only ethically. Work that crosses it cannot be shown to anybody. It cannot go into a report, be handed to a prosecutor, or be cited to a journalist, because the first question is always "where did this come from" and there is no answer that survives it.