A city public-information officer finds a public X post about a water-main break that copies the utility's live outage-map phrasing. What should the OSINT researcher do first?
Select an answer to reveal the explanation.
Short Explanation
Official-sounding language on X is a postcard, not a dare to start a shouting match. Save the post, the time, and the exact wording, then lay it next to the real outage map. Arguing from the city account is communications work, not OSINT.
Full Explanation
In a municipal public-information setting, a public X post that mirrors live utility outage-map phrasing is first a collection problem: the civic OSINT researcher captures the public URL, timestamp, and exact wording, then compares that language to the official outage map so the city has a dated, sourced artifact rather than an impression. That sequence preserves evidence that may later support communications, legal, or platform process while keeping the researcher inside open sources. Debating the poster from the official city account fails as an OSINT first step because engagement is a communications and escalation decision, not evidence capture, and it risks amplifying the claim. Demanding that the platform remove the post as criminal impersonation before any capture fails because takedown requests discard or delay the public artifact the report needs and leap ahead of preservation. Subpoenaing the handle’s IP address before saving public content fails because closed-source legal process is not the Fundamentals collection order; public timeline and wording come first. Exam caveat: platform removal and legal process may follow, but they are not substitutes for capturing what was already public. Operational check: save URL, time, and wording screenshots or archive captures; diff against the live official map; note matches and mismatches in the civic case file before any reply or legal request is drafted.