A tourism-board intern live-tweets each step of an active OSINT investigation from a personal handle. What OPSEC rule does that break?
Select an answer to reveal the explanation.
Short Explanation
Live-tweeting the investigation is a play-by-play from the sideline that tells the subject someone is looking. Personal handles are still public. Keep the fact of the work off social media until an authorized public report is the product.
Full Explanation
Do not broadcast the fact of an active civic OSINT case from a personal account. A tourism-board intern who live-tweets each investigation step from a personal handle reveals targets, methods, and timing to anyone watching, breaking OPSEC. Claiming personal posts are required so the public can verify the intern's hours confuses timesheets with operational disclosure. Live-tweeting sock-puppet passwords so followers can help watch the persona is credential exposure. Mirroring the same play-by-play on the official tourism account amplifies the leak under an institutional banner. Exam caveat: after-action public communication may be appropriate when authorized; real-time personal narration of active collection is not. Operational check: keep investigation status off personal and unofficial channels; route any public messaging through an approved PIO process after the collection window. Keep the civic purpose, method limits, and exhibit labels aligned so reviewers can see what was public-source work versus other authorities. Document residual uncertainty explicitly rather than implying completeness. Prefer reversible public methods and preserve exhibits that a second analyst can reopen without guessing.