labPublications
-
Analysis of competing hypotheses. Contradictions decide
Richards Heuer's method weighs every explanation against the data at once and counts the evidence against each. The lab uses it for the step of the cycle at which no fewer than two hypotheses are weighed.
-
The forecast register. How a forecast is checked by its outcome
A lab forecast is recorded before its date arrives, and after the date the outcome is recorded, whatever it is. The accumulated outcomes show how well the words of the scale match what happens.
-
The source and the message. Two grades instead of one
Every message in the lab's work gets two marks. A letter grades the reliability of the source, a digit the credibility of the message itself, and neither is derived from the other.
-
Two gates. A check before the work and a review before the release
The lab's work cycle has nine steps, and two of them are gates. Without the legal and ethical check the work does not start; without an independent review the result is not released.
-
The weak signal. From an observation to an indicator
A weak signal is early, imprecise information about a possible change. The lab keeps such information in one register for every horizon, and a signal worth watching gets an indicator.
-
Words of probability. Why the lab's conclusions carry no percentages
Probability in the lab's notes is written as a word from a fixed scale. The scale has seven words, each with its own range, and confidence in the grounds is stated separately.
-
Kinds of dossier. Three levels of the same work
A dossier can be an information, an operational or an intelligence dossier. The levels differ in how far verification went and what may be stated at each.
-
Logical errors in open-source investigation
An error in an investigation arises more often in the step from data to conclusion than in the data itself. Eight such errors, with examples and with what the method holds against each.
-
OPSEC. What leaves an investigator's machine
A request to a source tells it the subject of interest. The security of an investigation begins with an account of who learns what with every action.
-
Reporting. How to document the results of an investigation
A report on an investigation is built as a chain from source to conclusion, in which every link carries its source and every gap has a name.
-
Stylometry. An indicator, not proof
Comparing texts by manner of writing helps to check a hypothesis about an author. It cannot establish the author, and the report says so in plain words.
-
An email address as a record. What it says and what it does not
An address in a public document is a source, not evidence. Covered here: what can lawfully be read from it, how it is recorded, and what belongs to the subject of the work.
-
Why an investigation template draws no relations
Three investigation templates for three classes of work. They carry roles and verification tasks, but not a single relation.
