A nonprofit applying for a city arts grant has a Form 990 on a public nonprofit-research site, and a council member wants the group's private donor roll. What is in-scope for PORP-style collection?
Select an answer to reveal the explanation.
Short Explanation
A public Form 990 is the charity's filed report card; a private donor roll is the locked cabinet. Use the filing class that is already published. Pretexting, breach replay, and fake auditor visits are not OSINT.
Full Explanation
If a nonprofit applying for a city arts grant has a Form 990 on a public nonprofit-research site and a council member wants the group’s private donor roll, in-scope PORP-style collection is the public charity filing already published for research, not non-public donor lists. Public filings are the report card; private donor rolls are the locked cabinet, and civic OSINT stays on the public side of that line. Obtaining the private donor spreadsheet by pretexting the development office fails as social engineering. Replaying donor-database credentials recovered from a breach dump fails as closed-source abuse. Door-to-door interviews of board members posed as grant auditors fails as impersonation outside OSINT. Exam caveat: some donor information may appear in public 990 schedules—use what is published, not what remains private. Operational check: retrieve the Form 990 from the public research site; cite filing year and URL; decline the private donor-roll request in writing with the public-source scope rationale for the grants file. In municipal practice, record the rationale in the case file so future staff know which control was chosen and which failure modes the rejected options would create for city services.