OSINT Foundations and OPSEC

PORP · 50 questions

• A city clerk's public-records unit is asked to pull everything on a paving vendor, including a non-public utility billing screen the clerk can open in the city's internal CIS. Which approach correctly treats the work as OSINT?
• A transit authority fraud analyst finds a contractor spreadsheet on a public paste site that appears to have been leaked without authorization. How should the analyst treat that file when deciding what counts as OSINT?
• Parks and recreation leadership calls every web search intelligence and wants a folder of unsourced links dropped into the weekly briefing. What should the analyst deliver instead?
• A county assessor asks an analyst to skip documenting sources because everyone already knows the GIS portal. What should the analyst do?
• Emergency management wants social-media rumors about a washout treated as confirmed road closures on the public map. What should the OSINT analyst do first?
• A housing-authority investigator is told that OSINT on a disputed application means hacking the applicant portal to read records that are not public. What is the correct response?
• Procurement wants a due-diligence pack on a new snow-plow vendor built only from the vendor's marketing site. What should the OSINT analyst do?
• A library consortium privacy officer asks whether reviewing a contract cataloger's public LinkedIn profile for a vendor-conflict check is OSINT or spying. What is the correct judgment?
• Code enforcement wants the analyst to friend a property owner under a fake identity so private photo albums become visible. What should the analyst do?
• The city attorney asks whether FOIA responses the city itself already issued can be reused as OSINT in a vendor review. How should the analyst treat those records?
• A port-authority analyst starts collecting web pages before anyone writes the question the report must answer. What should happen first?
• Public-health permit staff want sit-down interviews of restaurant owners counted as OSINT for a permit-review packet. How should the analyst classify that work?
• A 311 manager wants the analyst to use the city's sealed juvenile-case files, arguing that staff already have access, while building an OSINT memo on a contractor. What is the correct scope decision?
• Economic-development staff treat a paid data-broker dump as open source because the city purchased it. What distinction should the analyst make?
• The elections office wants campaign-finance PDFs from the state disclosure site used in a vendor conflict check. How should those files be treated?
• Stormwater staff ask whether satellite imagery on a public map layer is OSINT or classified ISR. What is the correct classification?
• A municipal broadband team wants OSINT on a pole-attachment contractor and also wants the analyst to scan the contractor's exposed remote-desktop service. What should the analyst do?
• A city GIS analyst pastes findings into a personal chat app with no URLs or timestamps. What note practice should replace that habit?
• Permitting staff screenshot a vendor site but crop out the address bar. Why is that a problem for OSINT evidence?
• Fleet management asks the analyst to keep findings in memory until Friday instead of writing notes during collection. What should the analyst do?
• A parks investigator pastes an entire public Facebook thread into Word without marking which comment is the actual finding. What should the notes do instead?
• The water department's analyst overwrites yesterday's notes in the same file so earlier versions vanish. What practice should replace that habit?
• A convention-bureau researcher uses a shared staff login for all collection so nobody can tell who captured what. What should the research log do?
• Animal-control staff save only the thumbnail of a lost-pet flyer and later cannot read the phone number. What capture standard should they use?
• Public works wants last year's dead links left in a live report with no retrieved-on date. Why should the analyst record retrieval dates?
• A county recorder OSINT analyst stores investigation notes, screenshots, and research logins in the same browser profile used for personal online banking. What should the analyst change first?
• A city open-data team bookmarks forty vendor-research tabs and treats that folder as the case file. What should the OSINT analyst use instead?
• A municipal court clerk doing public-docket OSINT finds a scanned exhibit that includes full Social Security numbers and pastes those numbers into a team Slack channel used for research notes. What should the clerk do instead?
• Recycling-program staff screenshot a public map of alleged illegal dumping but do not record coordinates, layer names, or the map URL. What should their notes include so another analyst can re-find the place?
• A sister-city program intern translates a foreign vendor's public webpage in the browser and saves only the English translation in the case file. What should the intern keep as well?
• A parking-authority analyst runs OSINT from a personal phone that is still logged into private social apps. What OPSEC problem does that create?
• Building-inspection leadership wants analysts to accept every cookie banner on target vendor sites while signed into the city's main domain account. What should the analyst do instead?
• A fire-department PIO intern googles a suspicious donation page from the station Wi-Fi without a research profile or other network-path control. What OPSEC issue should the intern recognize?
• The historic-preservation office stores sock-puppet passwords in the same shared spreadsheet as the public website CMS credentials. What credential-hygiene change is required?
• A city communications analyst creates a research sock-puppet account using their real municipal email address. Why is that a failure?
• Code enforcement wants one long-lived uber research account reused on every platform and every case for years. What reuse risk should the analyst flag?
• A transit analyst logs into a sock-puppet account from the same browser profile that holds personal shopping logins. What contamination problem does that create?
• Parks staff name a research account DumpingCaseWestPark after the exact investigation. What naming approach should they use instead?
• The library IT lab virtual machine used for OSINT is never snapshotted or reset, and malware from a sketchy event-flyer site persists into the next case. What lab-hygiene practice is missing?
• A procurement analyst uses their real face as the sock-puppet avatar so the account looks trustworthy. What should the analyst do instead?
• Public-works researchers argue that sock-puppet accounts are always illegal, so they plan to log in as a named city official to reach private vendor portals instead. What distinction should they apply?
• A marina office wants the OSINT analyst to friend boat owners and chat them for slip numbers. What collection method stays in PORP scope?
• County GIS builds the OSINT lab on the same laptop that runs the production parcel-edit database. What isolation requirement should the candidate insist on?
• A 311 research account follows only the five people named in a complaint, making the persona obviously a watcher. What behavior-hygiene change is needed?
• The city manager tells an analyst to disable all note-taking so a Discord OSINT drill goes faster. What should the analyst defend?
• Occupancy-licensing staff install random OSINT toolbars from a blog into the city's main Chrome browser. What lab-software hygiene should they follow instead?
• A grants-office researcher reuses the city's email password on a sock-puppet account. What uniqueness rule should they follow?
• Bike-share investigators want to collect OSINT from a cafe laptop with full-disk encryption turned off because OSINT is just websites. What lab protection should they apply?
• A tourism-board intern live-tweets each step of an active OSINT investigation from a personal handle. What OPSEC rule does that break?
• The solid-waste director asks whether a well-run sock puppet plus a thorough notebook can replace a written OSINT report. What should the analyst answer?