The PIO wants one official social URL per platform, and OSINT has found look-alike city accounts on four networks. What in-scope product should the analyst deliver?
Select an answer to reveal the explanation.
Short Explanation
Think of it as a fake-storefront map for the whole shopping street, not a photo of the one real shop. List every look-alike civic account you found, with URLs and captures. That inventory is the PIO's OSINT product—not a takedown kit or a dox.
Full Explanation
When the PIO wants one official social URL per platform and OSINT has found look-alike city accounts on four networks, the in-scope product is an impersonation inventory mapping look-alike civic accounts across platforms, with captured URLs. Inventory enables coordinated warnings and takedowns better than fixing one network while residents still hit fakes elsewhere. Delivering a takedown exploit against each impersonator host fails as offensive action outside OSINT. Providing only a single screenshot of the real X account while ignoring other platforms fails the PIO’s cross-platform need. Doxxing operators for legal names as the OSINT deliverable fails; public inventory of look-alike properties comes first, and identity unmasking may be a separate legal path if warranted. Exam caveat: inventory is descriptive; it does not itself remove accounts—PIO and counsel handle platform process and public messaging. Operational check: table each look-alike with platform, URL, capture date, differing contact details, and comparison to the official URL list; deliver to PIO for reporting and “official channels only” guidance to residents. In municipal practice, record the rationale in the case file so future staff know which control was chosen and which failure modes the rejected options would create for city services.