A fire-department PIO intern googles a suspicious donation page from the station Wi-Fi without a research profile or other network-path control. What OPSEC issue should the intern recognize?

Collection from an identifiable civic network—such as station Wi-Fi—can expose the fire department to the target infrastructure; lab, VPN, or research-profile choices are part of OPSEC for a suspicious donation page. Assuming station Wi-Fi automatically anonymizes all searches is incorrect. Scanning the donation host from the station LAN to confirm malice escalates into active probing from a known civic network. Posting the donation URL on the department's public Facebook page so residents can test it crowdsources risk and may amplify a malicious lure. Exam caveat: urgent public warnings can be appropriate through official channels after triage, but raw unvalidated lure URLs should not be casually republished for crowd testing. Operational check: open the URL only in a controlled research environment with intentional network-path choices, capture indicators passively, and escalate technical validation to the proper security function if needed. Keep the civic purpose, method limits, and exhibit labels aligned so reviewers can see what was public-source work versus other authorities. Document residual uncertainty explicitly rather than implying completeness. Prefer reversible public methods and preserve exhibits that a second analyst can reopen without guessing.