A water-utility ROE addresses AI-assisted OSINT for an authorized assessment. Which rule best protects residents?
Select an answer to reveal the explanation.
Short Explanation
You protect the residents you serve by keeping their private data off the table, even when it might make a phishing test feel more realistic. Make privacy a firm ROE boundary, not something an AI tool can waive.
Full Explanation
Water-utility and other municipal ROE for AI-assisted OSINT should explicitly forbid scraping private resident data from leak sites, even when that data seems useful for phishing realism. Ratepayers are the public the agency serves; harvesting their breach-dump PII for lure craft expands privacy harm and conflicts with minimization and duty-of-care expectations. Encouraging AI to mine leaked resident records for more convincing phishing lures fails because tactical convenience does not override privacy and legality. Hoarding resident breach dumps indefinitely under a “training” label launders retention of sensitive third-party PII. Claiming privacy limits apply only to employees and never to ratepayers inverts civic responsibility and ignores broader privacy obligations. Exam caveat: Forbidding leak-site resident PII is not the same as forbidding all OSINT on public municipal records about services or infrastructure. Employee-targeted authorized security testing still needs its own ethics rules and must not casually import resident dossiers. Counsel may impose stricter rules than minimum criminal law, so follow the ROE. Practical check: Search the ROE and data-handling annex for an explicit ban on leak-site and resident PII collection; configure AI tools and analyst checklists to reject such sources; and audit reconnaissance notes for resident identifiers that should be purged and reported as a process incident if found.