A city procurement analyst is vetting a “local IT support” vendor that claims every technician lives in the county. Public job ads on the vendor’s careers page and job boards list every opening in another metro. What should the analyst do with that OSINT?

Public job advertisements are a core business-OSINT surface for municipal procurement because they show where a vendor actually recruits, which can contradict a bid claim that every technician lives in the county. When careers-page and job-board geography point to another metro while the proposal insists on local staffing, the correct civic product is a sourced due-diligence finding: cite the URLs, the stated work locations, the bid language, and the retrieval date so purchasing can weigh the mismatch. That observation stays inside publicly available artifacts and supports an accountable city purchasing process without converting research into intrusion or pretext.

Ignoring the ads because hiring copy is supposedly never OSINT misunderstands business intelligence: recruitment posts are marketing, but they are still public evidence of operating geography and labor markets. Port-scanning the careers subdomain to prove a honeypot shifts from observation into network attack tradecraft and does not answer the staffing claim. Calling listed applicants under a city-clerk pretext is interactive deception outside PORP collection and creates unnecessary privacy and ethics exposure for the city.

Exam caveat: job-ad geography is a due-diligence flag, not courtroom proof that no local staff exist; vendors may recruit remotely while still employing some in-county technicians. Calibrate language as contradiction of the claim as published, not as a finished staffing census.

Operational check: archive or screenshot the job ads and careers page, record timestamps, quote the local-staffing sentence from the bid packet beside the ad locations, and route the sourced packet to procurement—not to scanning or pretext teams.