A library consortium assumes staff LinkedIn OSINT is automatically in scope for a municipal web engagement. What is the sound professional stance?
Select an answer to reveal the explanation.
Short Explanation
Public posts are still people and policy territory. Just because a profile is visible does not mean the engagement green-lit digging through staff pages. Check the RoE and privacy expectations first — passive does not mean permissionless.
Full Explanation
Rules of engagement and scope govern recon techniques as well as active exploitation. Public availability of LinkedIn data does not automatically authorize aggressive collection or profiling for a specific engagement. Aligning OSINT activities with written RoE and organizational privacy expectations avoids ethical and contractual surprises. Phishing prohibitions and legality myths are separate issues from whether the technique was approved.