Chapter 26 — Threat intelligence and OSINT: methods II
Lesson map
Lesson 26 published. Map, example, EX076.
flowchart TD
N0["Learning outcomes"]
N1["26.1 Two letters, two questions"]
N2["Lab — grading and use"]
N3["26.2 Reading the result"]
N4["26.3 Decision rules"]
N5["26.4 Reasons"]
N6["26.5 Re-grading"]
N7["26.6 Grading OSINT"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX076"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["26.1 Two letters, two questions"]
N2["Lab — grading and use"]
N3["26.2 Reading the result"]
N4["26.3 Decision rules"]
N5["26.4 Reasons"]
N6["26.5 Re-grading"]
N7["26.6 Grading OSINT"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX076"]
[Learning outcomes]
|
v
[26.1 Two letters, two questions]
|
v
[Lab — grading and use]
|
v
[26.2 Reading the result]
|
v
[26.3 Decision rules]
|
v
[26.4 Reasons]
|
v
[26.5 Re-grading]
|
v
[26.6 Grading OSINT]
|
v
[Worked example] --> [Exercise EX076]
Learning outcomes
You will (1) grade sources and information with the Admiralty system; (2) decide how graded items may be used; (3) separate source reliability from information credibility; (4) record grading reasons.
26.1 Two letters, two questions
The Admiralty (NATO) system grades source reliability from A (completely reliable) to F (cannot be judged) and information credibility from 1 (confirmed) to 6 (cannot be judged). A reliable source can pass on doubtful information; an unknown source can report something confirmed by other evidence.
Keeping the two grades separate stops the reputation of a source from making weak information look strong. Amara grades every item that reaches analysis and records the two grades in the database, so later reviewers can see how the judgment was formed.
Lab — grading and use
"""Lab 6 (ch 26): combine source reliability (A-F) and information credibility (1-6) into a handling rule."""
items = [("I-1", "B", 2), ("I-2", "E", 3), ("I-3", "A", 5), ("I-4", "C", 3), ("I-5", "F", 6)]
for iid, rel, cred in items:
if rel in "AB" and cred <= 2:
rule = "use for action"
elif rel == "F" or cred == 6:
rule = "cannot judge - seek corroboration"
elif cred >= 5 or rel == "E":
rule = "hold - low confidence"
else:
rule = "use with caveat"
print(iid, rel + str(cred), rule)
Run with python3 lab_admiralty.py. Verified output:
I-1 B2 use for action
I-2 E3 hold - low confidence
I-3 A5 hold - low confidence
I-4 C3 use with caveat
I-5 F6 cannot judge - seek corroboration
26.2 Reading the result
I-1 is B2 — usually reliable, probably true — use for action. I-2 (E3) and I-4 (C3) are both possibly true, so the source decides: I-2's source is unreliable, so it is held, while I-4's is fairly reliable, so it is used with a caveat. I-3 is A5 — completely reliable source but improbable information — hold until checked; even good sources make mistakes. I-5 is F6 — cannot be judged on either axis.
Amara writes each decision next to the grade with a one-line reason, so the security lead can see why I-3 waits despite its excellent source, and adds the date of the next check. The F6 item is not discarded: it is stored and checked again if other sources mention it.
26.3 Decision rules
The lab encodes simple rules: act on combinations of A–B with 1–2; caveat C with 3; hold anything with E or 5; F6 needs more information. Teams agree their rules in advance so grading drives consistent decisions.
Amara's team writes the rules into its procedures so that every analyst grades and decides the same way. Rules are reviewed after a quarter by checking how often held items later proved true and how often acted items proved false. If the rules hold back too many useful items, they are adjusted, and the change is recorded with the evidence that justified it.
26.4 Reasons
Write why: "B — HSSC has been accurate in 18 of 20 past items" is reviewable; "B — seems fine" is not.
Amara keeps a simple record of each source's past accuracy, so reliability grades rest on counts rather than impressions. Credibility reasons name the evidence: confirmed by internal logs, consistent with a second source, or unconfirmed. A reviewer reading a grade months later can then understand it without asking the original analyst, who may have moved on. The record is updated after each item.
26.5 Re-grading
Grades change as evidence arrives. Keep history so later reviewers know what was believed when.
Amara's database stores each grade with the date and reason, and a new grade is added rather than overwriting the old one. When an E3 item is later confirmed by HCHT's own logs, its credibility rises and the action changes, and the record shows both states. That history matters in reviews: an analyst who held an item that later proved true acted correctly on what was known at the time.
26.6 Grading OSINT
Open sources range from official advisories to anonymous posts. A national agency advisory might rate B; an anonymous social-media claim, E or F until corroborated. Grade the specific author or channel, not "the internet", and remember that a reliable outlet can still repeat someone else's unverified claim.
Amara applies this when two news sites repeat an anonymous claim. Amara grades the outlets that repeated it as reliable for their own reporting but traces the claim itself to its anonymous origin, which keeps its credibility low. The item stays on hold until an independent source confirms it, and she records which outlets carried it in case it spreads further.
Worked example
A post on a public forum claims HCHT data is for sale. Source: unknown poster (F). Information: no sample, unverifiable (6). Amara records F6, does not alarm management, and asks HSSC whether any member has corroborating information. HSSC reports similar unverified claims about several trusts. The item stays F6 with a note.
Synthetic case. The post is invented.
Errors and limits
Grades are judgments, not measurements. Two analysts may disagree; discuss.
Exercises
- EX076 — A5 decision. Why does the lab hold I-3 even though its source is A? Rubric: 3 = information improbable (5); reliable sources can err; verify; 2 = partial; 1 = should act; 0 = none.
- EX077 — Grade the forum post. Grade the forum claim and explain each letter/number. Rubric: 3 = F6 with reasons for both; 2 = grade only; 1 = wrong; 0 = none.
- EX078 — Good reason. Write a reviewable reason for grading a source B. Rubric: 3 = evidence-based track record; 2 = vague evidence; 1 = opinion; 0 = none.
Synthesis
Grade source and information separately, decide by agreed rules, record reasons and re-grade as evidence changes.
Continue studying — chapter 26 of 40
← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →