Public works wants a subpoena for an X handle's IP address as the first step in reviewing a public complaint. What should the OSINT researcher do first?
Select an answer to reveal the explanation.
Short Explanation
OSINT uses the shop window, not the locked storeroom. Grab the public timeline, media, and timestamps first. Subpoenas and preservation letters are civic legal tools, not the Fundamentals collection step.
Full Explanation
If public works wants a subpoena for an X handle’s IP as the first step in reviewing a public complaint, the OSINT researcher should first collect and preserve the handle’s already-public timeline, media, and metadata. PORP-style work uses the shop window before the locked storeroom: public artifacts are immediately available, auditable, and often sufficient to scope whether legal process is even warranted. Filing a preservation letter and skipping public collection until legal returns fails by delaying evidence capture of material that can vanish while process is pending, and it treats legal tools as a substitute for Fundamentals collection. Triggering a password-reset flow to confirm the handle’s email without a warrant fails as unauthorized access testing and identity probing outside open-source ethics. Asking a platform contact to pull backend logs off the books fails because informal closed-source access is not civic OSINT and may violate platform and legal boundaries. Exam caveat: subpoenas and preservation letters are legitimate civic legal instruments later; they are not the first OSINT move. Operational check: archive public posts, media, bio, and visible metadata with retrieval dates; summarize what the public record already shows; only then coordinate with counsel on whether IP process is needed.