A housing-authority investigator is told that OSINT on a disputed application means hacking the applicant portal to read records that are not public. What is the correct response?

PORP methods stay inside lawful, publicly available collection. Unauthorized access to an applicant portal—whether framed as hacking, password guessing, or keystroke capture on a lobby kiosk—is exploitation, not OSINT, even when the housing authority owns the system. Ownership of infrastructure does not authorize investigators to bypass access controls under an OSINT label. Guessing applicant passwords and calling a successful login an open-source find misstates both consent and public availability and can create separate legal exposure. Installing monitoring software to capture keystrokes produces clandestine intercepts, not public-source artifacts suitable for an OSINT exhibit. The correct response is to refuse unauthorized access and limit collection to lawful public methods such as published notices, public court or recorder portals where applicable, and other openly obtainable records within policy. Exam caveat: separately authorized investigative or systems-admin actions may exist under other authorities, but they must not be rebranded as OSINT in the housing packet. Operational check: if obtaining the record requires circumventing a login, defeating a control, or instrumenting a device, stop and escalate for lawful process rather than filing the material under an OSINT exhibit label.