An attribution is a claim that a specific person or organization is responsible for specific activity. Our clients act on those claims. They freeze accounts, dismiss employees, file referrals and brief ministers. A claim with consequences like that needs a standard of proof, and the standard needs to be written down.
Why "probably" is not good enough
Words like "probably", "possibly" and "we believe" feel precise to the writer and mean wildly different things to readers. Ask a room of experienced professionals what probability "a serious possibility" implies and the answers will range from below 20 percent to above 80. When a finding travels from an analyst to a security director to a board, every reader quietly substitutes their own number.
Vague language also protects the writer at the reader's expense. A report that says a subject "may be linked" to a fraud cannot be wrong, which means it cannot be useful. We would rather be precise and occasionally wrong in a measurable way than vague and never accountable. That is why our reports separate three things that are often blurred together: how good each source is, how likely each judgment is, and how much confidence we have in the evidence underneath it.
Two questions about every source
Every item of information that supports a judgment is graded on two independent axes. The first is the reliability of the source: based on its track record, its access and its potential motives, how much do we trust where this came from? The second is the credibility of the information itself: regardless of who said it, is it confirmed, consistent and plausible?
Keeping the two axes apart matters. A highly reliable source can pass on a rumor. An anonymous forum account with no track record can post a document that is independently verifiable down to the file hash. Collapsing both questions into one score hides exactly the distinction an analyst needs to see.
| Grade | Source reliability | Grade | Information credibility |
|---|---|---|---|
| A | Completely reliable. No doubt about authenticity, trustworthiness or competence; a history of complete reliability. | 1 | Confirmed. Independently corroborated by other sources, logical and consistent. |
| B | Usually reliable. Minor doubts; a history of mostly valid information. | 2 | Probably true. Not confirmed, but logical and consistent with other information. |
| C | Fairly reliable. Some doubts; has provided valid information in the past. | 3 | Possibly true. Not confirmed, reasonably logical, agrees with some other information. |
| D | Not usually reliable. Significant doubts about authenticity or competence. | 4 | Doubtful. Not confirmed, possible but not logical, no other information on the subject. |
| E | Unreliable. A history of invalid information or clear reason to distrust. | 5 | Improbable. Not confirmed, illogical or contradicted by other information. |
| F | Reliability cannot be judged. Too little is known about the source. | 6 | Truth cannot be judged. Insufficient basis to evaluate. |
Most open sources start at F. An unfamiliar website or a new account has no track record, and it would be dishonest to pretend otherwise. That is not a problem as long as the information can be raised to a 1 or 2 through corroboration. A great deal of good open-source work consists of turning F-graded sources into confirmed information.
Words that mean numbers
When we state how likely something is, we use a fixed vocabulary, and each term maps to a range. Analysts may not substitute synonyms. A reader who sees "likely" in any Aldervane report, on any case, in any year, can rely on it meaning the same thing.
| Term | Probability range | How it reads in a report |
|---|---|---|
| Almost certain | 95 to 99 percent | The accounts are almost certainly operated by the same individual. |
| Very likely | 80 to 95 percent | The leaked file very likely originated from the contractor's workstation. |
| Likely | 55 to 80 percent | The nominee is likely aware of the scheme's purpose. |
| Roughly even chance | 45 to 55 percent | There is a roughly even chance the network resumes activity after takedown. |
| Unlikely | 20 to 45 percent | The author is unlikely to have the capability to act on the threat. |
| Very unlikely | 5 to 20 percent | It is very unlikely the images were captured on the claimed date. |
| Remote | 1 to 5 percent | The chance of an innocent coincidence across all four identifiers is remote. |
We deliberately leave no term for zero or one hundred percent. Open-source evidence can be overwhelming, but it is never omniscient, and a report that claims certainty has stopped doing analysis.
Confidence is not probability
Probability answers the question "how likely is this to be true?". Confidence answers a different question: "how good is the evidence base we are reasoning from?". The two move independently. We might judge it very likely that two accounts share an operator, but hold only moderate confidence in that judgment because it rests on a narrow set of behavioral signals that a careful adversary could imitate.
Every key judgment in our reports carries both. We express confidence on three levels:
- High confidence means the judgment rests on multiple independent, high-quality lines of evidence, and we have actively tried and failed to find a better explanation.
- Moderate confidence means the evidence is credible and consistent but has gaps: fewer independent lines, reliance on behavioral inference, or plausible alternatives we could not fully exclude.
- Low confidence means the evidence is thin, fragmentary or of uncertain provenance. We report low-confidence judgments only when the client needs to know about a possibility in order to decide what to investigate next, and we label them clearly as leads.
What earns high confidence at Aldervane
For an attribution, which names a person or organization, high confidence is not a matter of analyst instinct. It requires four conditions, all of which must be documented in the case file before the word "high" can appear in a report.
- At least three independent lines of evidence from distinct source types. Three social media profiles are one source type. A social profile, a corporate filing and a blockchain flow are three. Independence means that no line was derived from another.
- No unresolved contradictory evidence. If anything in the collection points away from the subject, it must be explained, not ignored. An unexplained contradiction caps confidence at moderate.
- A passed red-team review. A senior analyst who did not work the case attempts to break the attribution, starting with the strongest alternative explanation.
- Reproducibility from preserved evidence. Every step must be reproducible by an independent examiner using our captured, hashed evidence, without needing the live internet to cooperate.
Of the 412 attributions we have made with a known downstream outcome since 2014, 91 percent were later confirmed by a court, regulator or law enforcement action. We track the other 9 percent just as closely. Most were moderate-confidence judgments, which is exactly what that label is meant to warn about.
Five ways attributions go wrong
Our review checklist exists because the same failures recur across the field. These are the ones we test for on every case.
Circular reporting
Five articles naming the same suspect look like five sources. Often they are one source repeated: a single original claim, copied and paraphrased. We trace every claim back to its origin and count origins, not mentions.
The single-pivot chain
An attribution that reaches a person through a long chain of single links is only as strong as its weakest link. If the chain runs from a domain to an email to a username to a profile, and the username match is coincidental, everything downstream collapses. We look for convergence: several separate paths that arrive at the same person.
Username coincidence
Distinctive-looking usernames are less unique than they appear. Before relying on a username match, we estimate how common the string is, check whether the accounts' creation dates, languages and interests are consistent, and look for at least one non-username link.
The time-zone fallacy
Activity patterns that fit a working day in one time zone are suggestive, not conclusive. Schedulers, shift work and deliberate misdirection all distort them. We use timing as supporting context and never as the basis for naming anyone.
Anchoring on the first suspect
When a client arrives with a suspect in mind, the risk is that the investigation becomes a search for confirming evidence. We run structured analysis of competing hypotheses on every attribution, scoring evidence by how well it discriminates between explanations rather than how well it fits the favorite.
The red-team review
The review is adversarial by design. The reviewer receives the evidence annex and the draft judgment, not the investigator's narrative, and is expected to argue the strongest case against the conclusion. Typical challenges include an alternative operator, a shared tool or template, a compromised or borrowed account, a deliberate false flag, and simple coincidence.
Findings that do not survive are not reported, or are reported at a lower confidence with the unresolved challenge stated plainly. In our field note on infrastructure pivoting, the reviewer's alternative, that many operators had bought the same template kit, was a serious one. It was rejected only because the shared payment rails could not be explained by a kit.
The reviewer's job is not to improve the report. It is to stop the wrong one from leaving the building.
What this means when you read our reports
Every Aldervane report opens with key judgments. Each one states the judgment, the probability term, the confidence level and the evidence it rests on, with references to graded, hashed items in the evidence annex. A typical key judgment reads:
The 212 domains are almost certainly operated by a single individual, Subject A (high confidence). This judgment rests on a shared analytics container, shared payment accounts and a single consolidation wallet across all domains, and a recovered registrant record linking the earliest domain to Subject A (Annex B, items 14 to 61).
If you disagree with a judgment, you can follow it to the evidence and test it yourself. That is the point. Intelligence that cannot be checked asks for trust. Intelligence that can be checked earns it.