Investigate the matter without creating a second harm.

Prepare the file before you search.

• Legitimate purpose
• Legal and contractual authority
• Necessity and less-intrusive alternatives
• Data minimization plan
• Source and account security
• Threat model
• Right-of-reply and correction process
• Retention and deletion date

1. 01

   State the public-interest purpose

   Define the decision, harm, institution, or verifiable claim at issue. Exclude curiosity, retaliation, humiliation, and identity exposure from scope.

2. 02

   Apply legality and access controls

   Use public or authorized access only. Respect sealed records, authentication, license terms, court orders, and statutory restrictions.

3. 03

   Minimize collection

   Collect the least sensitive data needed. Generalize location, redact identifiers, separate contact information, and avoid re-identification across unrelated systems.

4. 04

   Secure the work

   Use unique passwords, multifactor authentication, patched devices, phishing resistance, protected backups, restricted sharing, and cautious handling of unknown files and macros.

5. 05

   Test identity and inference

   Require multiple consistent identifiers and record uncertainty. Never convert similarity or proximity into accusation.

6. 06

   Review publication harm

   Separate necessary proof from unnecessary PII, offer a meaningful right of reply, review legal and safety risks, and avoid live location or operational details that create danger.

7. 07

   Correct and retire data

   Publish a correction route, date material changes, preserve the evidentiary record appropriately, and delete sensitive working data when its justified retention period ends.