How we work
Our method, in our own words. It is built on openly published analytic standards and open-source investigation guidance. We do not have, and do not claim to use, any agency's internal or classified methods.
Ground rules
- Public, lawfully accessible sources only: government data, regulatory filings, court and agency records, news, and public posts by organizations and public officials.
- No hacking, leaked or breached data, paywall circumvention, or pretexting (pretending to be someone else to get information).
- No tracking or profiling of private individuals. Companies, public officials acting in their public role, and public bodies are in scope.
- Every claim links to a source we actually collected, and we keep the source facts separate from our judgments (ICD 203).
- We record our work: what we searched, when, and what came back (Berkeley Protocol).
The intelligence cycle
- Requirements: the client's question, decisions and deadline, written as specific intelligence requirements.
- Collection: scripted pulls from public feeds and APIs, each stored with a timestamp and source URL.
- Processing: deduplication, geotagging, translation if needed, and source grading.
- Analysis: structured techniques (below) and likelihood and confidence language.
- Dissemination: a BLUF (bottom line up front) brief, a dossier or an alert, sized to the client's decision.
- Feedback: the client tells us what was useful, and the requirements are updated for the next cycle.
Source reliability and information credibility (Admiralty-style code)
Every item carries a two-part code, for example A1. The letter grades the source. The number grades the specific piece of information. They are scored separately.
| Source | Meaning | Typical examples |
|---|---|---|
| A | Completely reliable | Official primary records: SEC filings, NWS alerts, Federal Register, city open data |
| B | Usually reliable | Established newsrooms with editorial standards |
| C | Fairly reliable | Trade press, press releases, aggregator or AI summaries, organization posts |
| D | Not usually reliable | Anonymous accounts, partisan blogs |
| E | Unreliable | Sources with a record of fabrication |
| F | Cannot be judged | New or unknown sources |
| Info | Meaning |
|---|---|
| 1 | Confirmed by independent sources or the primary record itself |
| 2 | Probably true; consistent with other information |
| 3 | Possibly true; not yet corroborated |
| 4 | Doubtful |
| 5 | Improbable |
| 6 | Cannot be judged |
Headline-only news items (we read the headline and feed metadata, not the full article) are capped at credibility 2.
Likelihood words (ICD 203) and confidence
| Phrase | Probability |
|---|---|
| almost no chance / remote | 1–5% |
| very unlikely / highly improbable | 5–20% |
| unlikely / improbable | 20–45% |
| roughly even chance / roughly even odds | 45–55% |
| likely / probable | 55–80% |
| very likely / highly probable | 80–95% |
| almost certain(ly) / nearly certain | 95–99% |
Likelihood is how probable we think something is. Confidence (high / moderate / low) is how solid the evidence and reasoning behind that judgment are. ICD 203 asks analysts to state both and to keep them apart.
Structured analytic techniques we use
Key Assumptions Check
Before a judgment goes out, we list the assumptions it rests on, test each one ("what would have to be true?"), and flag any that are weak. From the CIA Tradecraft Primer's diagnostic techniques.
Analysis of Competing Hypotheses
For contested questions, we put every reasonable explanation in a matrix and score the evidence against each one. We favor the hypothesis with the least evidence against it, not the most for it.
Indicators & Signposts
For each judgment we name observable signs that would confirm or overturn it, then watch for them. These feed the Watch List in every brief.
Quality of Information Check
We grade each source and corroborate the key facts against primary records, for example a news report against the SEC filing it describes.
Devil's Advocacy / What If?
For high-stakes calls, a deliberate challenge to the leading view, plus "what if it already happened?" backcasting.
Verification (Berkeley / Bellingcat)
Source provenance, archive capture, cross-checking dates and locations, and documenting the chain of collection so findings can be reproduced.
Published references
- CIA, “A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis” (March 2009): https://www.cia.gov/resources/csi/static/Tradecraft-Primer-apr09.pdf
- ODNI, Intelligence Community Directive 203, “Analytic Standards” (Jan. 2, 2015, as amended): https://www.odni.gov/files/documents/ICD/ICD-203.pdf
- ODNI, “Objectivity” overview of the IC Analytic Standards: https://www.odni.gov/index.php/how-we-work/objectivity
- UN OHCHR & UC Berkeley Human Rights Center, “Berkeley Protocol on Digital Open Source Investigations” (2022 ed.): https://www.ohchr.org/sites/default/files/2024-01/OHCHR_BerkeleyProtocol.pdf
- Bellingcat, Online Investigations Toolkit: https://bellingcat.gitbook.io/toolkit
- Bellingcat, Guides & How-Tos: https://www.bellingcat.com/category/resources/how-tos/
These public documents shaped our method. The wording and the specific grading scheme on this page are ours. The six-point Admiralty-style reliability and credibility code is a widely used open convention, not something taken from any one of the documents above.