A fusion-center briefing covers recording vishing-style authorized test calls. What legal consideration should testers articulate?
Select an answer to reveal the explanation.
Short Explanation
Some places need everyone on the line to agree before you hit record. City logo stickers and AI scripts do not erase consent law. Check the jurisdiction and the ROE first.
Full Explanation
Fusion-center briefings on recording vishing-style authorized test calls must articulate that recording may require two-party consent depending on jurisdiction, so testers must follow applicable law and ROE. Some U.S. states and other jurisdictions require all-party consent to record calls; government affiliation or an authorized test charter does not automatically erase those rules. Legal compliance is part of ethical municipal SE operations, not an afterthought.
Claiming recording is always legal worldwide if the city logo appears in an email signature is false—logos do not create consent. Saying consent laws never apply to government testers regardless of jurisdiction invents an immunity that testers should not assume. Asserting two-party consent rules can be ignored when AI writes the call script confuses script authorship with wiretap/consent compliance.
Exam caveat: jurisdiction-sensitive recording rules are a classic legal-control item. When unsure, obtain counsel guidance, prefer non-recorded metrics, or use explicit consented recording workflows documented in ROE.
Operational check: before any recorded vishing test, determine governing consent law with counsel, encode recording rules in ROE, configure tools accordingly, and if consent cannot be obtained lawfully, use alternative evidence (tester notes, timing, help-desk tickets) instead of illegal recordings.