A library consortium assumes staff LinkedIn OSINT is automatically in scope for a municipal web engagement. What is the sound professional stance?
Select an answer to reveal the explanation.
Short Explanation
Public posts are still people and policy territory. Just because a profile is visible does not mean the engagement green-lit digging through staff pages. Check the RoE and privacy expectations first — passive does not mean permissionless.
Full Explanation
Even when staff LinkedIn pages are public, a library-consortium engagement should not treat social OSINT as an automatic free-for-all. Passive collection still needs to align with the agreed rules of engagement, privacy expectations, and any municipal HR or legal constraints captured at kickoff. Public availability does not waive all privacy expectations or grant unlimited harvesting, profiling, or follow-on social engineering. Passive recon still deserves RoE review; absence of phishing messages does not mean every OSINT tactic was pre-approved. Likewise, claiming social-media OSINT is illegal in every jurisdiction overstates the law and would incorrectly ban legitimate, in-scope passive research. Exam caveat: if the engagement is strictly web-application testing with no people-targeting clause, keep staff OSINT out unless a written change expands scope. Operational check: ask the municipal legal or security contact whether staff-profile OSINT, doxing-style aggregation, or spear-phish priming is authorized, then document the answer in the RoE before collecting civic employee data for the consortium. In municipal operations, record the decision and residual risk in the engagement notes so future civic responders understand which control or boundary was honored and which failure modes the rejected approaches would create for public services. Re-check the same control at the next maintenance window or retest cycle.