An outside researcher accesses a city system without permission, then claims an 'ethical' motive after publicly posting findings. How should the city treat that access?

Unauthorized access to a city system remains unlawful and outside approved research processes even if the outsider later claims an ethical motive and posts findings publicly. Responsible disclosure and ethical hacking require prior authorization: bug-bounty enrollment, written rules of engagement, or another explicit invitation that defines scope and handling. A press-release halo does not retroactively create permission or convert trespass into a penetration test.

Any claim of ethical intent automatically converting access into an authorized test is false; authorization is procedural and documented, not self-declared. Public posting of findings never grants retroactive permission under CompTIA exam framing or normal organizational policy—publication may aggravate harm and legal exposure. Ethical motive claims do not replace rules of engagement or written authorization; those documents are how municipalities distinguish helpful researchers from unlawful intruders.

Exam caveat: ethics without authorization is not authorized testing; ROE and written approval are mandatory. Operational check: publish a clear vulnerability disclosure policy and bounty channel for the city, train SOC analysts to validate claimed researchers against active authorizations, preserve evidence of unauthorized access, and engage legal counsel rather than assuming good intent from a public write-up alone.