Standards & Ethics
What we will do, what we will not, and how you can check.
Intelligence is only as valuable as the way it was obtained. These standards apply to every engagement, every analyst and every client, without exception. We publish them so that clients, courts and the people we research know exactly where our lines are.
Core commitments
The lines we hold on every case.
We always
- Use publicly available or lawfully obtained information
- Screen every request for purpose, legitimacy and proportionality
- Preserve, timestamp and hash every item we rely on
- State our confidence and the alternatives we considered
- Subject every attribution to independent red-team review
- Minimize information collected about people who are not the subject
- Delete case data 90 days after closure unless a legal hold applies
We never
- Access private accounts, devices or systems without authorization
- Use pretexting or deception to obtain information from anyone
- Contact, engage or provoke the subject of an investigation
- Buy stolen data or make payments to criminal actors
- Accept fees that depend on reaching a particular finding
- Resell, repurpose or pool client data across engagements
- Report a name we cannot support with evidence
Client screening
We decline roughly one in seven requests.
Before any collection begins, every request is reviewed against four questions. Requests that fail any of them are declined, and the reason is recorded.
-
01 / Purpose
Is the purpose legitimate?
Protecting people, assets, markets or legal rights qualifies. Curiosity, leverage over individuals and retaliation do not.
-
02 / Client
Is the client who they say?
We verify the identity, authority and ownership of every new client before accepting instructions.
-
03 / Proportion
Is the scope proportionate?
The intrusion into anyone's life must be justified by the seriousness of the concern, and no wider than needed.
-
04 / Harm
Could our work cause harm?
We assess the risk that findings could endanger a subject, a source or a third party, and how it can be controlled.
- Locating private individuals for personal or domestic reasons
- Monitoring journalists, activists, lawful protest or political opposition
- Identifying whistleblowers who used protected reporting channels or reported to authorities
- Profiling employees or candidates beyond lawful, role-relevant checks
- General monitoring of a workforce, or screening anyone without their knowledge
- Opposition research on private citizens
- Work for political parties, candidates or campaigns
- Any request where we cannot verify the client or their authority
Collection rules
How we collect, and where we stop.
Open-source does not mean anything goes. These rules govern every source category and every discipline, including the parts of the internet, and of our own work, that most firms prefer not to discuss.
Lawful sources only
We use information that is publicly available, lawfully accessible or provided by the client with authority to share it. Where access requires agreeing to terms, we respect them.
Observe, never deceive
Our research personas exist to protect the investigation, not to trick people. They observe public and semi-public spaces. They do not befriend, message or elicit information from anyone.
Dark web boundaries
We observe illicit markets and forums to understand threats. We never purchase stolen data, pay criminal actors or take part in illegal activity, and we handle exposed personal data under strict minimization.
Screening is never covert
People we screen are told what will be checked and why. Checks are limited to what the role justifies, applied the same way to everyone in that role, and exclude private accounts and protected characteristics.
Insider matters need a trigger
We do not monitor workforces. Work concerning an employee starts from a specific indication of harm, is scoped with counsel and tests the innocent explanations first. A person's background or opinions is never a trigger.
Machine assistance is bounded
Machines help analysts read more. They do not attribute, grade sources or write judgments, their output is never cited as evidence and client data is never used to train them. We do not use face recognition to name anyone.
Evidence and data
Integrity for the evidence. Restraint with the data.
- Hashed at captureEvery item is timestamped and SHA-256 hashed when collected, and hashes are re-verified at export.
- Chain of custodyWho collected what, when and how is recorded automatically and travels with the evidence bundle.
- Third-party minimizationInformation about people who are not relevant to the question is not retained or reported.
- Fixed retentionCase data is deleted 90 days after closure unless a client legal hold or legal obligation requires otherwise.
- Compartmented accessAnalysts see only the cases they work on. Every access is logged and reviewable.
- Subject rights respectedRequests from individuals under applicable data protection law are handled by our Data Protection Officer.
Independence
The answer is not for sale.
Our fees are fixed at scoping and never depend on what we find. Clients are paying for the truth as the evidence shows it, and sometimes that is not the answer they hoped for.
When a finding points away from a client's expectation, the report says so plainly. When evidence is insufficient, we say what it would take to reach a firmer conclusion, and whether that is achievable lawfully.
Analyst welfare
Protecting the people who do the work.
Investigating exploitation, violence and extremism means seeing material most people never will.
Exposure is planned and limited, tools blur and mute harmful media by default, analysts rotate off the most difficult casework, and confidential counseling is available to every member of staff.
Oversight
How these standards are enforced.
Every engagement reviewed
Chaired by our General Counsel, the committee screens new engagements, rules on difficult requests and can stop any case at any stage.
Logged, then checked
Collection activity, evidence handling and access are logged automatically and sampled by the standards team every month.
An outside view each year
Independent counsel reviews our policies and a sample of closed cases annually, and reports to our board.
Start an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.