The public-information officer asks to strip every username from a report about a public account impersonating the city library. What identifier practice should the analyst follow?
Select an answer to reveal the explanation.
Short Explanation
Need-to-know is a highlighter, not a black marker over the whole page. The public impersonation handle is the subject—you have to leave that visible or the report is a riddle. Extra private people do not belong in the margins.
Full Explanation
Reports should include identifiers required to understand and re-perform the finding and exclude surplus personal data. When the PIO asks to strip every username from a report about a public account impersonating the city library, the analyst should keep the public handle that is the subject of the finding and omit unrelated private people's identifiers. Need-to-know is a highlighter, not a black marker over the whole page.
Removing the impersonation handle so the finding cannot be understood or re-checked makes the report a riddle. Publishing the library director's personal login and home address for extra context adds sensitive data unrelated to explaining a public impostor account. Replacing all names with random letters so nobody can tell which account was impersonating prevents verification.
Exam caveat: minimize doxxing risk for uninvolved private parties while preserving the public subject identifier that is the point of the case.
Operational check: retain the impersonation handle and public profile URL, redact unrelated private persons and home/login details, and confirm a peer can still re-find the impostor account from the report. Keep municipal wording calibrated to what public sources actually show, and record retrieval dates so peers can re-perform the work.