write-the-intel-brief

Write the intel brief

The report is the only part of the investigation anyone else sees, so it is the only part that can be wrong in public. The failure that destroys credibility isn't a missed source — it's a sentence that reads as fact and is actually an inference. "The account is operated from Lisbon" versus "posting times cluster in UTC+0/+1, consistent with Iberian working hours." One survives cross- examination.

Step 1 — Sort every claim into observation, inference, or assessment

Three categories, never blurred, ideally visually distinct in the text.

• Observation — what you saw, with source and timestamp. "The registry record retrieved 2024-03-11 lists A. Kestrel as director."
• Inference — a logical step from observations, with the step shown. "The same registrant email appears on both domains, so they were registered by one party."
• Assessment — your analytic judgement, carrying probability and confidence. "We assess it is likely the two companies are commonly controlled."

Any sentence where you cannot say which category it belongs to is a sentence that has smuggled a conclusion into the evidence. Rewrite it. Verbs betray the category: is, lists, shows for observation; indicates, implies for inference; we assess, we judge for assessment. Watch out for "appears to be", which pretends to be observation and is inference.

Done when every claim is tagged and no inference is written in the grammatical form of an observation.

Step 2 — Attach source, timestamp, and an archived copy to every claim

A claim with no source does not go in the report. Not in a footnote, not "multiple sources" — the specific one, per claim.

Each source needs: the URL or the tool and its exact query; the UTC date-time you retrieved it; the source-reliability grade (see investigate-anything); and an archive reference. Live URLs rot, and hostile subjects delete. Archive everything you cite, at the moment you cite it, using read-deleted-pages — cite the snapshot alongside the live URL, and keep a local copy too, since public archives can themselves be removed on request.

For anything that might become evidence, add chain of custody: who collected it, when, with what tool and version, and a cryptographic hash of the stored file (sha256sum file on Linux, shasum -a 256 file on macOS). Record the hash in the report, keep the original untouched, and work on copies. A screenshot with no hash, no timestamp and no capture method is worth very little; the underlying HTML, headers, and image files are worth more.

Done when every retained claim has source, retrieval timestamp, grade, and archive reference, and evidentiary items also have hashes.

Step 3 — Lead with the judgements

Assume the reader stops after the first half page — because they will. BLUF: the answer to the objective question first, in plain language, with its probability and confidence. Then the two or three judgements that carry the decision. Background, method and detail come after, for the reader who needs to audit you.

A key judgement is one sentence, one judgement, with its estimative term, its confidence, and the reason compressed to a clause. If a judgement needs a paragraph of setup to make sense, it isn't a judgement yet.

Done when the objective question is answered in the first paragraph, and the answer would still be defensible if nothing else were read.

Step 4 — Use the probability ladder, and only it

"Possibly" everywhere is how a report says nothing at length. Standardise on one ordered set of terms and use them consistently:

almost certainly · highly likely · likely · roughly even chance · unlikely · highly unlikely · remote

Rules that make it work: never use a term outside the ladder; never mix in a numeric percentage in the same sentence as a word, since readers anchor on the number; never use "possible" as an estimate, because everything not excluded is possible; and print the ladder in the report so the reader maps words to ranges the same way you did. Full table with ranges, the near-synonyms to avoid, and worked rewrites: reference/estimative-language.md.

Probability and confidence are different axes. Probability is how likely the judgement is to be true. Confidence is how good the evidence underneath it is — source quality, corroboration, and the presence of gaps or plausible deception. You can legitimately write "highly likely, low confidence": the evidence points strongly one way but rests on a single unverifiable source. That sentence is honest and useful. Collapsing the two into one word is not.

Done when every assessment carries one ladder term and a stated confidence level, with the reason for the confidence given.

Step 5 — Write the negative findings

Juniors delete these because they feel like failure. They are frequently the most useful content in the report: they are what stops the next analyst repeating the work, and in due diligence and pre-employment contexts the absence of adverse findings is the deliverable.

State what you looked for, where you looked, and what you did not find — distinguishing "checked, absent" from "could not check". "No sanctions or enforcement listings for the subject in the OFAC, UK, and EU consolidated lists, checked 2024-03-11" is a finding. "No adverse media found" without naming the sources searched, the languages, and the date range is not a finding, it is a shrug. Record rejected leads and candidates too, with the reason for rejection.

Done when searched-and-empty, could-not-check, and rejected-candidate items are each written up with scope and dates.

Step 6 — Document method and gaps

Reproducibility is what separates an intelligence product from an opinion. Record the tools with versions, the exact queries and dorks, the databases and their coverage dates, the languages searched, and anything that shaped the result: rate limiting, geo-restricted content, paywalls, a persona's access level, deleted material recovered only from archives.

Gaps go in the body, not buried at the end: what could not be established, why (no public registry in that jurisdiction, platform requires authentication, records are sealed), and what would close it — a records request, a subpoena, a site visit. Naming the closed source is a service to whoever reads it.

Done when another analyst could re-run the collection from the report alone and get the same result, and every unanswered objective question has a named reason and a route.

Step 7 — Minimise, redact, and format for the audience

Collect broadly, publish narrowly. Remove everything not needed for the objective — especially data about uninvolved third parties who appeared in the collection: family members, neighbours, co-residents at an address, bystanders in photographs, unrelated people sharing the subject's name. Redact rather than delete where the item explains a reasoning step, and say what was redacted and why, so the redaction itself is auditable. Never publish full national-ID numbers, payment card numbers, credentials, or plaintext passwords from breach data; reference them by type and partial value. Keep the unredacted case file separately, encrypted, under the retention limit in ../../ETHICS.md.

Then match the format to the reader:

Audience	Shape
Client or executive	One-page BLUF, judgements with probability and confidence, business implication, no tool names in the body
Incident responder	Judgements plus a machine-usable indicator table (selectors, first/last seen, confidence) and the raw artefacts
Legal or regulatory	Observation-only body, inferences separated and labelled, chain of custody and hashes per exhibit, method appendix, nothing redacted without a log
Internal handover	The graph from graph-the-network, the collection plan with what was and wasn't done, and every dead end

Template with all sections, and the evidentiary variant: reference/report-template.md.

Done when the report contains no third-party data the objective doesn't need, and the format matches the named audience.

Where this goes wrong

• Inference laundering. An inference stated on page 2, repeated as background on page 5, cited as established on page 8. Watch for your own claims re-entering as facts.
• Confidence inflation from volume. Forty low-grade items feel like a lot. Grade quality, not count; check for circular reporting before any corroboration claim.
• The hedge that means nothing. "It cannot be ruled out that" is true of everything. Either estimate it or drop it.
• Screenshots as evidence. Trivially forged and easily misread. Cite the archived original; use a screenshot only as an illustration next to it.
• Report written from memory. Reconstructing sources afterwards produces citations to pages that no longer say what you remember. Cite as you collect.
• The wrong-person catastrophe. Everything above is fine and the subject is the wrong human being. Restate the discriminators in the report and show which evidence ties the findings to that individual specifically.
• Distribution. Once sent, it is copied forever. Mark handling, name the recipients, and assume onward sharing.

Confidence grading

• High confidence — multiple independently collected sources, at least one authoritative primary record, consistent, no plausible deception, no material gap.
• Moderate confidence — credible sourcing with partial corroboration, or a gap that does not touch the core judgement.
• Low confidence — single source, unverifiable sourcing, significant gaps, or a live possibility of manipulation. Still publishable — say why it is low and what would raise it.

State the confidence next to the judgement, not in a preamble the reader skips.

Worked example

Objective: does the supplier share control with a barred entity?

BLUF: "It is likely (moderate confidence) that Nordvale Trading and the barred entity share beneficial control."

Observation: both filings name the same accountancy firm; both domains resolve to a registrant email admin@ke-holdings.example (retrieved 2024-03-11, archived). Inference: a shared registrant email indicates one registering party. Assessment: likely common control — moderate, not high, because the beneficial owner is undisclosed in that jurisdiction and a nominee arrangement remains untested.

Negative finding included: the shared home address reported by three people-search sites was traced to one broker feed carrying an identical misspelling; recorded as circular and excluded. Redacted: two co-residents at that address, unrelated to the objective. Gap named: UBO register is non-public; a formal request would close it.

Pivots

The report is the terminal product; it consumes rather than produces selectors. Take the entity map from graph-the-network, the archived copies from read-deleted-pages, and the scope statement from investigate-anything. Unresolved indicators go back to the workflow that produces them.

Legal notes

An OSINT report about a living person is personal data in its own right, and the subject may have access rights to it in some jurisdictions — write every line as if the subject will read it, because they may be entitled to. Reports likely to be used in proceedings need the evidentiary format from Step 7 and unbroken custody; a report assembled loosely and reformatted later cannot recover custody it never had. Breach-derived material carries its own handling constraints — see what-leaked-about-you — and quoting credentials into a report can itself be unlawful processing.