Public health asks an analyst to “find anyone named Maria at that restaurant” with no other public identifier. What should the analyst do?
Select an answer to reveal the explanation.
Short Explanation
A first name and a restaurant is a wish, not a starting handle. People OSINT needs a public identifier—email, phone, unique name-plus-context—or it just collects the wrong Marias. Private reservations and fake inspector badges are not OSINT.
Full Explanation
When public health asks an analyst to “find anyone named Maria at that restaurant” with no other public identifier, the analyst should refuse scattershot people-search until a public identifier such as a handle, email, phone, or unique name-plus-context exists. First name plus workplace is not a viable OSINT start and will attach the wrong people. Running every Maria in the county people-search and attaching all of them to the restaurant mass-false-attributes residents to a business. Scraping the restaurant’s private reservation system leaves public sources for non-public guest data. Interviewing kitchen staff while posing as an inspector without that authority is impersonation and social engineering, not OSINT. Exam caveat: PORP requires a public identifier before people-search pivots and forbids dragnet name matching, private reservation pulls, and fake-inspector pretexting. Operational check: ask public health for any already-public handle, email, phone, badge, or unique full-name context; decline the open-ended Maria task in writing; propose collection only after an identifier appears; and keep private systems and impersonation out of the plan. Public-health tasking becomes workable only after someone supplies a handle, email, phone, or distinctive full-name context already visible in public sources.