A public-health inspector's work email appears in a third-party conference attendee PDF. What should the analyst record as the finding?
Select an answer to reveal the explanation.
Short Explanation
Conference lists leak work emails like a name tag left on a table. Capture who published it and when. Seeing the address is not a key to the inbox.
Full Explanation
When a public-health inspector’s work email appears in a third-party conference attendee PDF, the analyst should record the listing itself—source, date, and published address—without assuming inbox access. Publication of an address is exposure of a contact string, not proof of mailbox control or message content. Claiming the analyst can now read the inspector’s inbox because the address is public confuses knowing a destination with possessing credentials or interception capability. Asserting that a live mailbox password was recovered from the PDF as a “standard OSINT byproduct” invents secrets the attendee list does not contain and misleads health leadership about what OSINT delivered. Treating the finding as authorization to send spoofed health-department mail from that address is impersonation, not research, and can erode public trust in official health communications. Exam caveat: PORP email findings document published strings and sources; they never imply inbox access, recovered passwords, or spoofing rights. Operational check: archive the PDF URL or file hash, extract only the relevant row, note conference name and year, brief stakeholders that the finding is contact exposure only, and route any OPSEC follow-up for the inspector through official channels.