Open-data staff want a script that requests a vendor website every second to automate website OSINT. What judgment should the analyst apply?
Select an answer to reveal the explanation.
Short Explanation
Automation is not a license to knock on the door a thousand times a minute. Professional OSINT is polite: slower requests, bounded scope, and a city that can explain the traffic. Hammering looks like an attack.
Full Explanation
OSINT automation must remain gentle enough that a municipality can defend it. When open-data staff want a script that requests a vendor website every second, the analyst should throttle to polite, rate-limited collection rather than hammering the site. High-rate scraping can degrade service, trigger defenses, and resemble an attack even when pages are public.
Increasing the rate until the vendor WAF becomes a useful signal treats defensive alerts as a research goal and escalates abuse. Ignoring load, terms, and robots because scripts have no ethics rejects professional norms for civic collectors. Replacing the script with a scan of the vendor's mail servers switches from website observation to infrastructure attack surface probing outside PORP website OSINT.
Exam caveat: 'public website' does not mean 'unlimited automated load'; politeness and bounded scope are part of the method, not optional courtesy.
Operational check: set delays/limits, bound the URL list to the civic question, document robots/terms awareness, monitor for error/WAF signals as a cue to slow further, and avoid mail-server scanning. In municipal practice, keep the wording tied to public artifacts, retrieval dates, and the authorized civic question so peers can re-perform the work without guessing intent.