Methodology
How we turn open sources into findings you can act on.
Anyone can search. Intelligence is what remains after collection has been preserved, sources have been graded, competing explanations have been tested and a skeptical colleague has tried to break the conclusion. This is the method behind every Aldervane report.
Principles
Six rules that govern every case.
Our analysts come from law enforcement, journalism, finance and national security. These principles are the common standard that makes their work interchangeable and reviewable.
Question first
Collection starts only once the question is precise enough that we will recognize the answer. Vague tasking produces volume, not intelligence.
Evidence before inference
Nothing is cited unless it has been captured, timestamped and hashed. Inferences are labeled as inferences and kept separate from observed fact.
Competing hypotheses
For every significant judgment we write down the plausible alternatives and look for the evidence that would distinguish between them.
Independent challenge
Every attribution is reviewed by a senior analyst who did not work the case and whose job is to find the weakness before anyone else does.
Stated confidence
Every key judgment carries a confidence level and, where useful, a calibrated probability term. We never let certainty be implied by tone.
Reproducibility
A qualified examiner with our evidence bundle should be able to retrace every step and reach the same conclusion. If they could not, we have not finished.
The investigative cycle
Six stages, from question to debrief.
The stages overlap in practice, and analysis regularly sends us back to collection. What does not change is that each stage has a defined output and a named owner.
-
01 / Requirements
Define the question
The lead investigator works with the client to convert a concern into specific intelligence requirements, agree what a decisive answer would look like and set the legal and ethical boundaries. The request is screened under our standards before any collection begins.
-
02 / Collection
Collect lawfully and quietly
Specialists collect across the source categories the question demands, from corporate registries and court records to forums, onion services and public ledgers. All research runs through managed, non-attributable infrastructure so subjects are never alerted.
-
03 / Preservation
Preserve at the moment of capture
Every item is captured with its context, a UTC timestamp and a SHA-256 hash, and recorded in a tamper-evident audit log. Edited and deleted content is preserved in every version we observe.
-
04 / Processing
Resolve and grade
Identifiers are resolved into entities, foreign-language material is reviewed by native speakers and every source is graded separately for reliability and for the credibility of the specific information it provides.
-
05 / Analysis
Analyze and challenge
Analysts test competing hypotheses, check key assumptions and build timelines and link charts. A red-team reviewer then attempts to break every attribution. Findings that do not survive are not reported.
-
06 / Dissemination
Report and debrief
The client receives a finished report with key judgments, confidence levels, alternatives considered and an evidence bundle, followed by a debrief with the investigators who did the work.
Source evaluation
Two questions about every source.
A reliable source can be wrong about a particular fact, and an unknown source can be right. We therefore grade the source and the information separately, and report both with every citation.
| Grade | Meaning |
|---|---|
| A | Completely reliable. Authentic, trustworthy and competent, with a long history of accuracy. |
| B | Usually reliable. Minor doubts, but a history of mostly valid information. |
| C | Fairly reliable. Doubts exist, but the source has provided valid information before. |
| D | Not usually reliable. Significant doubts about authenticity or competence. |
| E | Unreliable. A history of invalid or fabricated information. |
| F | Cannot be judged. No basis yet for evaluating the source. |
| Grade | Meaning |
|---|---|
| 1 | Confirmed. Corroborated by independent sources and logical in itself. |
| 2 | Probably true. Not confirmed, but logical and consistent with other information. |
| 3 | Possibly true. Reasonably logical and agrees with some other information. |
| 4 | Doubtful. Possible, but not logical, and not corroborated. |
| 5 | Improbable. Contradicted by other information or illogical. |
| 6 | Cannot be judged. No basis yet for evaluating the information. |
Estimative language
Words that mean the same thing every time.
When our reports say "likely", they mean a specific range of probability. Every analyst uses the same scale, so a reader never has to guess how sure we are.
- Remote1-5%
- Very unlikely5-20%
- Unlikely20-45%
- Roughly even chance45-55%
- Likely55-80%
- Very likely80-95%
- Almost certain95-99%
Strong, independent evidence
The judgment rests on multiple independent lines of high-quality evidence from distinct source types, with no unresolved contradictions. It could still be wrong, but we would be surprised.
Credible but incomplete
The evidence is credibly sourced and plausible, but not corroborated well enough, or not independent enough, to warrant a higher level. Further collection could change it.
Fragmentary or questionable
The evidence is thin, poorly corroborated or from sources of uncertain reliability. We report it only when the client needs to know about a possibility.
Attribution standard
What it takes to name someone with high confidence.
Naming a person is the most consequential thing we do. It is also where open-source work most often goes wrong, usually because a single convincing pivot is mistaken for proof.
Confidence describes the quality of the evidence base. Probability describes how likely the judgment is to be true. We report both, because a client deciding whether to refer a case to police needs to know not only what we think, but how much weight that thinking can bear.
- At least three independent lines of evidence, drawn from distinct source types, that each connect the subject to the activity
- No unresolved contradictory evidence. Every inconsistency is explained or the confidence level drops
- The finding has survived red-team review by a senior analyst who did not work the case
- Every step can be reproduced from preserved, hashed evidence in the case bundle
Username matches, shared avatars and similar writing style are leads, not proof. On their own, none of them can support more than low confidence.
Structured analysis
Techniques that keep analysts honest.
Investigators are human, and humans see patterns that are not there. Structured techniques make reasoning visible, so it can be checked by colleagues, clients and courts.
- Analysis of competing hypothesesEvidence is scored against every plausible explanation, with the focus on what disproves a hypothesis rather than what supports it.
- Key assumptions checkUnstated assumptions are written down and tested, because they are where confident analysis quietly fails.
- Link and network analysisRelationships are charted with the evidence for each link attached, so weak links are visible rather than buried in a diagram.
- Timeline reconstructionEvents are sequenced from preserved timestamps, with clock and time zone issues resolved before conclusions are drawn.
- Red-team reviewA reviewer outside the case argues the strongest alternative explanation and must be answered with evidence, not confidence.
- Indicators and warningsFor monitoring programs, we define in advance the observable signs that would show a threat is escalating, and watch for them.
Operational security
Research the subject never sees.
A subject who knows they are being researched deletes evidence, changes behavior and sometimes retaliates. Protecting the investigation protects the client.
- Non-attributable infrastructure, isolated per case
- Research personas used only to observe, never to deceive people or engage subjects
- Strict separation between staff identities and research activity
- Analyst exposure to harmful material managed under our welfare program
Beyond attribution
A written test for every kind of finding.
Naming a person is one kind of conclusion. Our other disciplines reach different kinds, and each has its own published test for when a finding may be reported and what it may be called.
Five tests
An event is reported as verified only when its origin, place and time are established, independent sources agree and it fits everything else that can be observed.
Read the standard Supply chain linksThree grades
Every relationship on a supply map is graded confirmed, probable or possible, with the records behind it and the period they cover.
Read the standard Screening discrepanciesTwo types of signal
A discrepancy is reported only when signals of different types agree, and only after an analyst has looked for the innocent explanation.
Read the standard Leak and breach claimsFour conclusions
A claim is graded fabricated, recycled, third party or genuine from its samples, its seller and its history, without buying the data.
Read the standardMachine assistance helps our analysts read more material. It does not attribute, grade sources or write judgments, and its output is never cited as evidence. Our rules are set out in how we use AI in investigations.
Start an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.