Social Media OSINT

PORP · 50 questions

• A city public-information officer finds a public X post about a water-main break that copies the utility's live outage-map phrasing. What should the OSINT researcher do first?
• A transit authority wants to know whether a critic's X handle is a brand-new sock puppet or a long-running account. Which public artifacts should the researcher use first?
• Parks staff brief a quote-tweet as if the quoted sentence were written by the person who posted the quote. How should the OSINT report attribute that material?
• Emergency management needs wording from an X post that residents say was deleted after a storm warning. What counts as evidence in the OSINT report?
• A vendor's public X banner photo reverse-image-matches a completed streetscape in another city. How should the researcher treat that banner?
• The city clerk sees the same rumor about a permit freeze copy-pasted by a burst of newly created X accounts. What is the sound OSINT finding?
• Public works wants a subpoena for an X handle's IP address as the first step in reviewing a public complaint. What should the OSINT researcher do first?
• An X post about a public hearing carries a user-set location sticker that says "City Hall," but the photo shows landmarks from the county fairgrounds. What should the researcher trust for place?
• Procurement is reviewing a contractor who markets as a municipal specialist. How should the researcher use the contractor's public LinkedIn experience entries?
• Contractor due diligence finds a LinkedIn headline that still says "Director at City X" months after the person left that role. How should the researcher handle the headline?
• Economic development asks the researcher to scrape every LinkedIn connection of a chamber volunteer who is a private citizen. What collection scope fits civic OSINT?
• A LinkedIn recommendation for a vendor names a Riverfront Promenade rebuild that does not appear on the city's public project list. How should that mismatch be handled?
• An analyst is logged into a personal LinkedIn account while reviewing a vendor's public profile, and the vendor can see who viewed. What should the researcher do?
• Open-data staff find a public PDF resume that matches a vendor contact's LinkedIn profile except the employment dates differ by two years. What belongs in the report?
• A vendor's LinkedIn company page lists people who do not appear on the firm's public website roster. How should the researcher use that list?
• Sister-city staff see an "Open to work" banner on a contractor's public LinkedIn and want it logged as a security incident. How should the researcher treat the banner?
• A council member wants every public like on a critic's LinkedIn post named as a co-conspirator in a civic dossier. What should the OSINT report do?
• Code enforcement is forwarded a Facebook post showing a junk-filled yard. What is the public OSINT path?
• A Facebook event for a park concert lists an address that contradicts the parks department calendar. What should the report include?
• The fire public-information officer finds a Facebook profile using the department patch as an avatar and soliciting donations. What is the OSINT product?
• Housing staff find a Facebook page that claims to be the official housing authority, but the vanity URL differs by one letter from the real civic page. What should the researcher do?
• A vendor's Facebook check-in at City Hall is offered as proof the vendor attended a bid opening. How should the researcher treat the check-in?
• Library programming wants photos from a Facebook album of a branch opening. Some albums are friends-only. What may the researcher use?
• Public works sees a Facebook Marketplace listing that uses a photo of a marked city truck. What is the OSINT path?
• Parks staff want an Instagram geotag treated as exact coordinates for a playground inspection. How should the researcher treat the geotag?
• A procurement analyst reviewing paving bids notices that four competing city contractors post the identical crew-at-the-jobsite photograph on their public Instagram grids. What should that reuse be treated as?
• Tourism staff find a still-public Instagram highlight showing a mural the city has not unveiled. What is the correct OSINT handling of that highlight?
• 311 receives an Instagram close-up of graffiti with no street signs, storefronts, or other block context. What should the analyst do instead of inventing a location?
• The marina's public Instagram tags include a handle whose spelling matches the local-part of a dock-waitlist complaint email. How should that public tag be used?
• Historic preservation wants to measure a cornice from an Instagram photo that applies a heavy beauty filter warping the facade. What is the sound mensuration judgment?
• A TikTok of a flooded bike path includes audio of a unique school's public PA announcement. Besides the picture, what should the analyst treat as a place clue?
• Transit staff see a TikTok stitch that makes it look as if a bus driver confessed on camera. What should the analyst do before attributing those words?
• Solid-waste leadership wants to treat TikTok comments on a recycling video as a statistically valid citywide community survey. How should those comments be handled in an OSINT product?
• A viral TikTok labeled a city-worker leak is filmed in a generic office, and reverse image search of a wall poster hits a stock-background pack. What does that finding mean?
• The city subreddit has a post with a unique pothole photograph. Besides saving the image, what should collection of that Reddit artifact include?
• Public-works staff want the legal name of a Reddit user who posted a photo criticizing a paving job. The civic need is to find the failed curb in the picture. What is in OSINT scope?
• A Reddit AMA presenter claims to be a city engineer, but no matching LinkedIn profile or staff-directory entry can be found. How should that claimed role be treated?
• Deleted Reddit comments about a zoning hearing still appear on a public third-party mirror. How should the analyst cite them?
• An elections rumor appears first in a small city subreddit, then spreads with far more engagement on X. What should the civic rumor timeline identify?
• Public Snap Map-class content shows a crowd at a municipal reservoir. How should that ephemeral geo-social item be handled?
• A vendor's Snapchat brag reaches 311 only as a forwarded screenshot; the original snap is gone. What can the analyst honestly do with that artifact?
• Parks youth-program staff ask for Snapchat OSINT on minors at a skate park after a noise complaint. What is the correct collection boundary?
• The same unique illegal-dumping photograph appears on Instagram, on Reddit, and in a Facebook group screenshot. What should cross-platform correlation seek?
• A LinkedIn headline, an X bio, and an Instagram bio all use the same unusual municipal-project hashtag. What OSINT function does that rare string serve?
• The PIO wants one official social URL per platform, and OSINT has found look-alike city accounts on four networks. What in-scope product should the analyst deliver?
• A public Facebook post is later mirrored as a TikTok whose caption tells a different story. How should the TikTok caption be treated?
• A Reddit username matches an Instagram handle, but the display photographs differ. What does that handle equality mean?
• The city's real X account has been idle for months while a Facebook fan page posts official-sounding road closures. What should OSINT document?
• A city contractor's Instagram is public, but the matching LinkedIn profile is locked to connections. What is the correct OPSEC and collection choice?
• After capturing public posts on three platforms, the timestamps conflict with the claimed incident window. How should the OSINT report present that?