Write the intel brief

The report is the only part of the investigation anyone else sees, so it is the

only part that can be wrong in public. The failure that destroys credibility

isn't a missed source — it's a sentence that reads as fact and is actually an

inference. "The account is operated from Lisbon" versus "posting times cluster

in UTC+0/+1, consistent with Iberian working hours." One survives cross-

examination.

Step 1 — Sort every claim into observation, inference, or assessment

Three categories, never blurred, ideally visually distinct in the text.

• Observation — what you saw, with source and timestamp. "The registry

record retrieved 2024-03-11 lists A. Kestrel as director."

• Inference — a logical step from observations, with the step shown. "The

same registrant email appears on both domains, so they were registered by one

party."

• Assessment — your analytic judgement, carrying probability and confidence.

"We assess it is likely the two companies are commonly controlled."

Any sentence where you cannot say which category it belongs to is a sentence

that has smuggled a conclusion into the evidence. Rewrite it. Verbs betray the

category: is, lists, shows for observation; indicates, implies for

inference; we assess, we judge for assessment. Watch out for "appears to be",

which pretends to be observation and is inference.

Done when every claim is tagged and no inference is written in the

grammatical form of an observation.

Step 2 — Attach source, timestamp, and an archived copy to every claim

A claim with no source does not go in the report. Not in a footnote, not

"multiple sources" — the specific one, per claim.

Each source needs: the URL or the tool and its exact query; the UTC date-time

you retrieved it; the source-reliability grade (see investigate-anything); and

an archive reference. Live URLs rot, and hostile subjects delete. Archive

everything you cite, at the moment you cite it, using read-deleted-pages —

cite the snapshot alongside the live URL, and keep a local copy too, since

public archives can themselves be removed on request.

For anything that might become evidence, add chain of custody: who collected

it, when, with what tool and version, and a cryptographic hash of the stored

file (sha256sum file on Linux, shasum -a 256 file on macOS). Record the hash

in the report, keep the original untouched, and work on copies. A screenshot

with no hash, no timestamp and no capture method is worth very little; the

underlying HTML, headers, and image files are worth more.

Done when every retained claim has source, retrieval timestamp, grade, and

archive reference, and evidentiary items also have hashes.

Step 3 — Lead with the judgements

Assume the reader stops after the first half page — because they will. BLUF:

the answer to the objective question first, in plain language, with its

probability and confidence. Then the two or three judgements that carry the

decision. Background, method and detail come after, for the reader who needs to

audit you.

A key judgement is one sentence, one judgement, with its estimative term, its

confidence, and the reason compressed to a clause. If a judgement needs a

paragraph of setup to make sense, it isn't a judgement yet.

Done when the objective question is answered in the first paragraph, and

the answer would still be defensible if nothing else were read.

Step 4 — Use the probability ladder, and only it

"Possibly" everywhere is how a report says nothing at length. Standardise on one

ordered set of terms and use them consistently:

**almost certainly · highly likely · likely · roughly even chance · unlikely ·

highly unlikely · remote**

Rules that make it work: never use a term outside the ladder; never mix in a

numeric percentage in the same sentence as a word, since readers anchor on the

number; never use "possible" as an estimate, because everything not excluded is

possible; and print the ladder in the report so the reader maps words to ranges

the same way you did. Full table with ranges, the near-synonyms to avoid, and

worked rewrites: [reference/estimative-language.md](reference/estimative-language.md).

Probability and confidence are different axes. Probability is how likely the

judgement is to be true. Confidence is how good the evidence underneath it is —

source quality, corroboration, and the presence of gaps or plausible deception.

You can legitimately write "highly likely, low confidence": the evidence points

strongly one way but rests on a single unverifiable source. That sentence is

honest and useful. Collapsing the two into one word is not.

Done when every assessment carries one ladder term and a stated confidence

level, with the reason for the confidence given.

Step 5 — Write the negative findings

Juniors delete these because they feel like failure. They are frequently the

most useful content in the report: they are what stops the next analyst

repeating the work, and in due diligence and pre-employment contexts the

absence of adverse findings is the deliverable.

State what you looked for, where you looked, and what you did not find —

distinguishing "checked, absent" from "could not check". "No sanctions or

enforcement listings for the subject in the OFAC, UK, and EU consolidated lists,

checked 2024-03-11" is a finding. "No adverse media found" without naming the

sources searched, the languages, and the date range is not a finding, it is a

shrug. Record rejected leads and candidates too, with the reason for rejection.

Done when searched-and-empty, could-not-check, and rejected-candidate items

are each written up with scope and dates.

Step 6 — Document method and gaps

Reproducibility is what separates an intelligence product from an opinion.

Record the tools with versions, the exact queries and dorks, the databases and

their coverage dates, the languages searched, and anything that shaped the

result: rate limiting, geo-restricted content, paywalls, a persona's access

level, deleted material recovered only from archives.

Gaps go in the body, not buried at the end: what could not be established, why

(no public registry in that jurisdiction, platform requires authentication,

records are sealed), and what would close it — a records request, a subpoena, a

site visit. Naming the closed source is a service to whoever reads it.

Done when another analyst could re-run the collection from the report alone

and get the same result, and every unanswered objective question has a named

reason and a route.

Step 7 — Minimise, redact, and format for the audience

Collect broadly, publish narrowly. Remove everything not needed for the

objective — especially data about uninvolved third parties who appeared in the

collection: family members, neighbours, co-residents at an address, bystanders

in photographs, unrelated people sharing the subject's name. Redact rather than

delete where the item explains a reasoning step, and say what was redacted and

why, so the redaction itself is auditable. Never publish full national-ID

numbers, payment card numbers, credentials, or plaintext passwords from breach

data; reference them by type and partial value. Keep the unredacted case file

separately, encrypted, under the retention limit in

[../../ETHICS.md](../../ETHICS.md).

Then match the format to the reader:

Audience	Shape
Client or executive	One-page BLUF, judgements with probability and confidence, business implication, no tool names in the body
Incident responder	Judgements plus a machine-usable indicator table (selectors, first/last seen, confidence) and the raw artefacts
Legal or regulatory	Observation-only body, inferences separated and labelled, chain of custody and hashes per exhibit, method appendix, nothing redacted without a log
Internal handover	The graph from graph-the-network, the collection plan with what was and wasn't done, and every dead end

Template with all sections, and the evidentiary variant:

[reference/report-template.md](reference/report-template.md).

Done when the report contains no third-party data the objective doesn't

need, and the format matches the named audience.

Where this goes wrong

• Inference laundering. An inference stated on page 2, repeated as

background on page 5, cited as established on page 8. Watch for your own

claims re-entering as facts.

• Confidence inflation from volume. Forty low-grade items feel like a lot.

Grade quality, not count; check for circular reporting before any

corroboration claim.

• The hedge that means nothing. "It cannot be ruled out that" is true of

everything. Either estimate it or drop it.

• Screenshots as evidence. Trivially forged and easily misread. Cite the

archived original; use a screenshot only as an illustration next to it.

• Report written from memory. Reconstructing sources afterwards produces

citations to pages that no longer say what you remember. Cite as you collect.

• The wrong-person catastrophe. Everything above is fine and the subject is

the wrong human being. Restate the discriminators in the report and show which

evidence ties the findings to that individual specifically.

• Distribution. Once sent, it is copied forever. Mark handling, name the

recipients, and assume onward sharing.

Confidence grading

• High confidence — multiple independently collected sources, at least one

authoritative primary record, consistent, no plausible deception, no material

gap.

• Moderate confidence — credible sourcing with partial corroboration, or a

gap that does not touch the core judgement.

• Low confidence — single source, unverifiable sourcing, significant gaps,

or a live possibility of manipulation. Still publishable — say why it is low

and what would raise it.

State the confidence next to the judgement, not in a preamble the reader skips.

Worked example

Objective: does the supplier share control with a barred entity?

BLUF: "It is likely (moderate confidence) that Nordvale Trading and the

barred entity share beneficial control."

Observation: both filings name the same accountancy firm; both domains resolve

to a registrant email [email protected] (retrieved 2024-03-11,

archived). Inference: a shared registrant email indicates one registering party.

Assessment: likely common control — moderate, not high, because the beneficial

owner is undisclosed in that jurisdiction and a nominee arrangement remains

untested.

Negative finding included: the shared home address reported by three

people-search sites was traced to one broker feed carrying an identical

misspelling; recorded as circular and excluded. Redacted: two co-residents at

that address, unrelated to the objective. Gap named: UBO register is

non-public; a formal request would close it.

Pivots

The report is the terminal product; it consumes rather than produces selectors.

Take the entity map from graph-the-network, the archived copies from

read-deleted-pages, and the scope statement from investigate-anything.

Unresolved indicators go back to the workflow that produces them.

Legal notes

An OSINT report about a living person is personal data in its own right, and the

subject may have access rights to it in some jurisdictions — write every line as

if the subject will read it, because they may be entitled to. Reports likely to

be used in proceedings need the evidentiary format from Step 7 and unbroken

custody; a report assembled loosely and reformatted later cannot recover

custody it never had. Breach-derived material carries its own handling

constraints — see what-leaked-about-you — and quoting credentials into a

report can itself be unlawful processing.