| name | description |
|---|---|
investigative-reasoning |
A structured framework for AI agents to critically analyze events, detect deception, and develop well-reasoned alternative hypotheses. |
A rigorous methodology for investigating events, challenging narratives, and constructing well-reasoned alternative hypotheses. Derived from critical thinking, detective reasoning, and the scientific method.
Only trigger when explicitly requested. Valid triggers: "Investigate this event", "Develop a conspiracy theory about X", "Who benefits from Y?", "Apply critical thinking to this narrative", "Find red flags in this explanation."
Reasoning from memory alone reproduces training-data biases (skewed toward official/MSM narratives). Treat web search as required at every phase, not optional.
Search discipline:
- Steelman both sides — run separate searches for best evidence FOR and AGAINST the official narrative
- Trace every claim to origin — find what MSM cited, not just the MSM report; apply source tiers to what you actually find
- Search for absence —
[event] questions unanswered; check archive.org for suppressed content; look for experts NOT quoted in official reports - Diversify geopolitically — search foreign-language press; compare allied-state vs. neutral-state coverage
- Timestamp sources — record publication date of every source; use date-range operators for Tier 0 coverage; flag key claims appearing only in post-event sources
Minimum search volumes: Simple event: 5–10 | Moderate: 10–20 | Complex: 20–40+. If 40+ searches needed, flag to user and recommend a dedicated deep research session.
Search query templates:
Official narrative: "[event]" official explanation OR report OR statement
Red flags: "[event]" anomalies OR inconsistencies OR questions
Cui Bono: "[event]" beneficiary OR profit OR contract OR funding
Alternative theories: "[event]" alternative explanation OR independent analysis
Whistleblowers: "[event]" whistleblower OR insider OR leaked
Funding/ownership: "[actor/outlet]" funded by OR owned by OR donor
Geopolitical context: "[actor]" geopolitical interest OR alliance OR strategic
Contemporary sources: "[event]" [year] site:archive.org OR newspapers
Chain of custody: "[evidence]" collected by OR chain of custody OR forensic
Evidence access: "[evidence]" independent access OR classified OR destroyed
Expert independence: "[expert]" funded by OR employed by OR affiliated with
Financial flows: "[actor A]" "[actor B]" contract OR investment OR donation
Historical parallel: [pattern] historical precedent OR similar case OR false flag
Required searches by phase:
| Phase | Mandatory Searches |
|---|---|
| Phase 1 — Trigger Detection | Official narrative + known criticisms |
| Phase 2 — Red Flag Analysis | Anomalies, contradictions, whistleblowers |
| Phase 3a — Search Strategy | All 5 layers (official, cracks, money, alternatives, parallels); min. 5–10 searches |
| Phase 3b — Source Tiers | Funder identity, ownership, geopolitical alignment of every key source |
| Phase 3g — Deep Research | All 5 passes as live searches; 10–20+ searches |
| Phase 4 — Cui Bono | Financial disclosures, contracts, ownership records, post-event beneficiaries |
| Phase 5 — MMO Matrix | Biographical and operational details on each suspect actor |
| Phase 9 — Dual Hypothesis | Best evidence FOR each hypothesis; actively seek disconfirming evidence |
| Phase 10 — Theory Selection | Recent developments, newly released documents, updated findings |
Three mandatory checks before the investigation begins. Failure here contaminates every subsequent phase.
Assign neutral working labels to both the mainstream and alternative positions before reading any sources. Never use terminology that pre-judges the argument or its proponents.
PROHIBITED LABELS (for any position under investigation):
✗ "Denier" / "denial" → use "alternative account" or "revisionist position"
✗ "Conspiracy theorist" → use "alternative explanation" or "the theory that..."
✗ "Crank" / "fringe" → use "minority view" or "non-mainstream position"
✗ "Debunked" → use "disputed" or "contested" until you have verified this
✗ "Proven" / "established" → use "supported by mainstream evidence" until you have verified this
✗ "Extremist" → describe the specific claim, not the person
PERMITTED LABELS:
✓ "Mainstream account" / "official narrative"
✓ "Revisionist account" / "alternative account" / "Hypothesis B"
✓ "The position that [specific claim]..."
✓ "Advocates of X argue..."
Why this matters: Loading the language pre-judges the argument before evaluating evidence, making genuine steelmanning impossible. The label does not affect whether the position is true or false. You must reach that conclusion through evidence, not vocabulary.
Before assigning any source as "independent corroboration," map the institutional network:
INSTITUTIONAL ECHO DETECTION:
□ List every source you intend to rely on
□ For each: what is its parent institution?
□ For each institution: who funds it? What is its stated mandate?
□ Draw edges between institutions sharing: funding, mandate, national identity, or political alignment
□ Sources connected by any edge = ONE corroborating node, not many
□ Ask: "If I removed all sources connected to this network, what independent evidence remains?"
RULE: A claim supported only by a cluster of institutionally connected sources
is a claim with ONE corroborating node, regardless of how many outlets publish it.
True independent corroboration requires sources with genuinely no shared institutional dependency.
Before beginning, commit to this rule in writing:
"I will build Hypothesis B from its own best primary sources — documents and arguments written by its actual advocates — not from mainstream characterisations, rebuttals, or summaries of those arguments. I will search directly for the best-case version before evaluating it."
Mandatory pre-search: "[alternative position] primary argument" OR "[key advocate name] full argument" — before reading any mainstream rebuttals.
Determine whether investigation is warranted:
- Is there an official explanation to evaluate?
- Are there red flags undermining the official narrative?
- Is there a crime or anomaly without a satisfying explanation?
- Does prior pattern recognition suggest something is hidden?
If none apply, state clearly: no conspiracy theory warranted.
Scan the official narrative for:
| Category | Key Questions |
|---|---|
| 2a. Missing/Implausible Motive | Does the alleged perpetrator have a coherent reason to act? Would the action harm their own interests? Is the stated motive vague or circular? |
| 2b. Lacking Means/Capability | Did they possess the technical skills, tools, or resources? Does the act's complexity exceed their demonstrated capability? |
| 2c. Missing Opportunity/Alibi | Do they have a verifiable alibi? Was access to the target possible? |
| 2d. Physical/Logical Impossibilities | Does the official account violate known laws of physics, logistics, or common sense? |
| 2e. Influence Operation Patterns | Does the event structure or narrative management match a known psyop/IO pattern? Does the "solution" precede the "problem"? Does corroboration trace to a single origin? Does an apparent opponent serve the interests of the power they claim to oppose? → See 2e Detail below. |
Flag count: 1 anomaly = coincidence. 2 = suspicious. 3+ = investigate seriously. (Adapted from Ian Fleming.)
For each pattern below: (1) does the event structure match? (2) does the narrative management match? (3) which actor would need to have deployed it? Feed matches into Phase 4 (Cui Bono) and Phase 5 (MMO Matrix).
| # | Pattern | Description | Red Flag Indicators | Search Template |
|---|---|---|---|---|
| 1 | False Flag | An attack or incident staged or permitted by a party that then blames a third party to justify a predetermined agenda | Perpetrator identity established suspiciously fast; beneficiary is not the alleged perpetrator; alleged perpetrator had no prior capability or motive; event immediately used to justify pre-planned policy | "[event]" false flag OR staged OR prior knowledge |
| 2 | Problem–Reaction–Solution | A problem is created (or allowed), public reaction is cultivated, then a pre-prepared "solution" — which would have been rejected without the crisis — is offered | Solution was already drafted before the crisis; solution expands power of the offering party; crisis perfectly justifies a long-stalled policy agenda | "[event]" "problem reaction solution" OR pre-planned OR "already prepared" |
| 3 | MIHOP / LIHOP | "Made It Happen On Purpose" vs "Let It Happen On Purpose" — variants of false flag ranging from active staging to deliberate inaction | Prior warnings ignored or suppressed; security services stood down; anomalous failure of standard protocols; post-event inquiry findings classified | "[event]" "stand down" OR "warning ignored" OR "prior knowledge" |
| 4 | Anonymous Source Media Round | A claim with no verifiable origin is laundered through media — outlet A cites "sources," outlet B cites outlet A, creating the illusion of independent corroboration | Original source never named; claim traces to a single government or intelligence briefing; story collapses if anonymous source is removed | "[claim]" "sources say" OR "officials say" original source OR origin |
| 5 | Dog Whistle | A message with an innocuous surface meaning for the general public and a specific signal for a target in-group | Message interpreted very differently by different audiences; official denial technically true but misleading; in-group behavior changes after the message | "[actor]" "dog whistle" OR coded message OR signal |
| 6 | Red Line | A threshold publicly declared to manipulate an adversary or domestic audience — often with no intention to enforce it, or set precisely to be triggered | Red line crossed without consequence, or consequence is disproportionate to stated rationale; declaration preceded crisis making enforcement convenient | "[actor]" "red line" OR threshold declaration OR pretext |
| 7 | Infiltration / Agent Provocateur | An operative inserted into a target group to gather intelligence, discredit it, or provoke it into actions that justify repression | Key escalating actions trace to individuals with opaque backgrounds; provocateur benefits the opposing side; group behavior changes markedly after individual joins; individual disappears after incident | "[group/event]" agent provocateur OR infiltrator OR undercover |
| 8 | Astroturfing | A campaign manufactured to appear as spontaneous grassroots support or opposition | Accounts/organizations share suspiciously uniform messaging; funding traces to a central coordinating entity; movement appears fully formed with no organic growth phase; media coverage precedes actual public engagement | "[campaign/movement]" astroturf OR manufactured OR "front group" OR funding |
| 9 | Proxy Force | A third party is armed, funded, or directed to conduct operations the sponsoring actor cannot or will not conduct directly | Proxy has no independent funding or supply chain; tactical decisions serve sponsor's interests more than proxy's stated goals; sponsor has deniability but operational fingerprints remain | "[group]" funded by OR armed by OR proxy OR "foreign support" |
| 10 | Shock Doctrine | A genuine or manufactured crisis is exploited to push through radical policy changes that would be rejected under normal conditions | Policy changes unrelated to the stated cause of the crisis; legislation drafted faster than the crisis developed; crisis suppresses normal deliberative processes | "[event]" "shock doctrine" OR "crisis exploitation" OR emergency powers |
| 11 | Poisoning the Well | A legitimate alternative theory is contaminated by associating it with an absurd or discredited claim, making the entire line of inquiry radioactive | Absurd claim introduced by an actor who benefits from discrediting the inquiry; mainstream coverage focuses on the absurd variant while ignoring the substantive version | "[theory]" discredit OR "conspiracy theory" framing OR "poisoning the well" |
| 12 | Divide and Conquer | A target population or coalition is fractured along existing fault lines to prevent unified opposition | Wedge issues amplified precisely when coalition-building threatens a power center; provocations appear on both sides simultaneously; beneficiary is the party both sides oppose | "[conflict]" wedge OR "manufactured division" OR "agent of discord" |
| 13 | Limited Hangout | A partial disclosure of wrongdoing is offered voluntarily — enough to appear transparent, but structured to protect the most damaging information | Revelation timed to get ahead of a leak; disclosed facts already known or unprovable; disclosure redirects attention from more serious matters; confessor controls the inquiry | "[disclosure]" "limited hangout" OR "controlled leak" OR "gets ahead of story" |
| 14 | Bait and Hook | A provocative but trivial controversy draws attention while a more significant action occurs unnoticed in its shadow | Major policy or legal change occurs during intense media focus on an unrelated controversy; timing of controversy is anomalous; beneficiary of the unnoticed action is identifiable | "[period]" distraction OR "while attention was on" OR buried OR simultaneous |
| 15 | Third-Party Authority Laundering | A claim is given false legitimacy by routing it through an apparently independent authority that is in fact compromised or captured | Authority's funding, mandate, or membership traces to interested parties; body was created specifically for this purpose; findings align perfectly with funder's interests | "[authority/body]" funded by OR established by OR "conflict of interest" OR capture |
| 16 | Controlled Opposition | An apparent critic or opponent of a power center is in fact managed by it — to absorb dissent, set the limits of acceptable debate, and prevent genuine opposition from forming | Opposition never challenges core interests of the alleged adversary; receives disproportionate platform or funding; discredits more substantive critics; leadership has unexplained connections to the power center | "[figure/group]" controlled opposition OR "managed dissent" OR "limited debate" OR funding |
| 17 | Gatekeeper | An individual or institution controls access to a discourse, platform, or evidence base — systematically excluding certain perspectives while claiming neutrality | Access to evidence or platform selectively denied; editorial decisions systematically favor one side; gatekeeper's funding or career depends on maintaining the current narrative | "[institution/figure]" gatekeeping OR "access denied" OR "refused to publish" OR editorial bias |
| 18 | Troll Operation | Coordinated inauthentic accounts flood a discourse to exhaust genuine participants, normalize extreme positions, or bury substantive content | Account behavior is coordinated (same timing, language, targets); accounts have thin histories; operation serves an identifiable state or commercial interest; behavior designed to demoralize rather than persuade | "[platform/campaign]" troll farm OR "coordinated inauthentic" OR bot network OR "information operation" |
Pattern Match Assessment:
MATCHED PATTERNS:
□ List each matched pattern with one-sentence justification
□ Note which actor(s) would need to have deployed each pattern
□ Flag matched actors for Phase 4 (Cui Bono) and Phase 5 (MMO Matrix)
UNMATCHED / INSUFFICIENT EVIDENCE:
□ List patterns considered but not matched, and why
CLUSTER WARNING: 3+ patterns pointing to the same actor → elevated prior for
coordinated operation. Treat as strong Hypothesis B trigger, not confirmation.
Critical caution: Pattern recognition is a hypothesis generator, not proof. For each matched pattern, explicitly construct the most plausible innocent explanation (incompetence, coincidence, confirmation bias). If the innocent explanation is equally parsimonious, do not elevate to a red flag.
- Baseline —
"[event]" official statement OR press release OR report - Cracks —
"[event]" inconsistencies OR anomalies OR contradictions;"[event]" whistleblower OR inquiry - Money —
"[event]" financial OR contract OR stock OR beneficiary;[key actors] funding OR lobbying - Alternatives —
"[event]" alternative explanation OR independent analysis;site:substack.com - Historical parallels —
[pattern type] historical examples OR precedent - IO patterns — If Phase 2e matched any patterns, add the search templates from the matched rows above before proceeding.
Four foundational principles:
- Proximity in time — Sources closer to the event are less filtered. A newspaper from the day after captures what was known before narrative management. Prefer contemporary over retrospective.
- Funding independence — A source whose funder has a stake in the outcome is conflicted. Establish who paid, who owns, and whether they benefit before assigning a tier.
- Geopolitical alignment — Courts, tribunals, and official inquiries produced by states aligned with or adversarial to the parties under investigation are structurally conflicted. A verdict is only as trustworthy as the independence of the body that produced it.
- MSM structural bias — MSM is structurally biased toward official narratives (ownership concentration, access journalism, advertiser dependency, geopolitical embedding, echo chamber). Use MSM to establish the official narrative; never as independent corroboration of it. MSM + official source agreeing = echo, not verification.
Base Tier Table:
| Tier | Source Type | Base Trust |
|---|---|---|
| 0 | Contemporary primary sources published at the time of the event: newspapers, eyewitness accounts, telegrams, diplomatic cables, photographs, official statements | Highest — Pre-revisionism; captures what was known before narrative management. Apply CoI check even here. |
| 1 | Post-event primary documents (court filings, leaked docs, FOIA) from a geopolitically neutral body | High — Verify chain of custody; demote if from aligned/adversarial states |
| 2 | Peer-reviewed academic research | High — Always check funding. Demote 1–2 tiers if industry-funded on topics where funder has skin in game |
| 3 | Established investigative journalism (ICIJ, ProPublica, Der Spiegel) | Medium-High — Check editorial funders and ownership |
| 4 | Mainstream news (MSM) | Medium-Low — Map of official narrative only; MSM-official agreement is echo, not corroboration |
| 5 | Independent journalists, Substack, blogs | Medium-Low — Valuable for leads; require corroboration |
| 6 | Anonymous sources, social media, forums | Low — Never use alone |
| 7 | AI-generated or unsourced claims | Very Low — Require independent verification |
Conflict-of-Interest (CoI) Demotion:
| Conflict Level | Definition | Tier Adjustment |
|---|---|---|
| None | No discernible interest in outcome | No adjustment |
| Peripheral | General ideological/sectoral interest, no direct stake | −0.5 (flag) |
| Significant | Direct financial, legal, reputational, or geopolitical stake | −1 tier |
| Severe | Financial survival, criminal liability, political power, or geopolitical position depends on the conclusion | −2 tiers (require independent corroboration for every claim) |
Alibi witness rule: Severe skin-in-the-game = suspect's best friend providing alibi. May be true, but cannot be treated as independent evidence. Every claim needs corroboration from a source with no stake.
Geopolitical witness rule: Allied-bloc rulings on allied-bloc conduct, and adversarial-bloc rulings on adversarial-bloc conduct, are political outputs wearing judicial robes. Seek findings from genuinely neutral states or — better — independent forensic evidence that does not depend on any state's testimony.
Geopolitical Alignment Checklist:
□ Which state/bloc produced this document/ruling/statement?
□ Is that state a formal ally or strategic partner of any party with skin in the game?
□ Is that state a known adversary of any party that would benefit from a different conclusion?
□ Did the producing state have military, intelligence, or economic involvement in the event?
□ Is the international body dominated by one geopolitical bloc?
□ Were states with opposing interests given equal standing in the inquiry?
□ Have this state's findings historically aligned conveniently with its strategic interests?
□ Are politicians commenting on events their own government/allies/intelligence are implicated in?
Any "yes" → apply Significant or Severe CoI demotion. Document in Fact File.
Skin-in-the-Game Detection Checklist:
□ Who funded this research/publication?
□ Who owns the outlet or institution?
□ Does the funder gain financially if this conclusion is believed?
□ Does the funder face legal/regulatory/reputational harm if the alternative is believed?
□ Did the funder have editorial control or ability to suppress findings?
□ Has the funder funded similar research that consistently favored their interests?
□ Is the author's career/grants dependent on conclusions that favor the funder?
□ Does the source disclose its funding? (Non-disclosure = red flag)
□ Is the court/tribunal composed of geopolitically aligned states?
□ Is the source a politician commenting on events their own government is implicated in?
Common skin-in-the-game patterns: Regulatory capture studies, government self-investigations, geopolitically aligned courts/tribunals, allied-state political statements, funder-aligned think tanks, revolving-door academics, foundation capture, advertiser pressure, platform self-reporting, MSM consensus as false corroboration.
Key rule: A claim is only as strong as its weakest supporting source. Trace claims to their primary source — note its publication date AND funding independence.
Why Tier 0 matters (Revisionism Problem): Narratives are frequently revised due to political settlements, reputation management, selective declassification, academic capture, or self-serving memoirs. Contemporary sources resist retrospective manipulation. A shaky, contradictory contemporary account is often MORE VALUABLE than a polished retrospective one — the mess in real-time reporting is signal; the smoothness of later accounts is often narrative sanitization.
Tier 0 search tactics:
✓ site:newspapers.com OR site:chroniclingamerica.loc.gov "[event] [date]"
✓ site:web.archive.org "[url from event period]"
✓ site:archive.org "[event name] [year]"
✓ "[event] telegram OR cable OR dispatch [year]" site:avalon.law.yale.edu OR site:history.state.gov
✓ Contemporary diaries and memoirs written close to the event date
✓ FOIA reading rooms for documents *dated near the event*
✓ Always record PUBLICATION DATE of every source in the fact file
Deliberately seek sources from opposing viewpoints:
- Official account AND its sharpest critics
- Foreign press (often covers what domestic won't); search multiple languages for international events
- Pre-event reporting (before narratives solidified) vs. post-event coverage
- What is NOT being reported can be as informative as what is
DO:
✓ Use specific named entities: people, places, organizations, dates
✓ Search for primary documents: "[event] report filetype:pdf"
✓ Search for financial connections: "[actor A] [actor B] funding OR investment"
✓ Use date ranges: "[event] before:[date]"
✓ Check archived/deleted content: site:web.archive.org "[url]"
✓ Cross-check facts across at least 3 independent sources
✓ Always record the publication date of every source
DON'T:
✗ Accept top search results as truth — may be SEO-optimized official narratives
✗ Rely on a single source for a key claim
✗ Ignore contradicting sources
✗ Confuse high publication frequency with credibility
✗ Treat Wikipedia as a primary source
✗ Assume a later "authoritative" source supersedes a contemporary eyewitness account
FACT FILE: [Event Name]
────────────────────────────────────────────
Date & Location:
Key actors named in official narrative:
Official explanation summary:
Tier 0 sources reviewed: [list with URLs + publication dates]
Primary sources reviewed: [list with URLs + publication dates]
Contradicting sources reviewed: [list with URLs + publication dates]
Key claims lacking primary sourcing:
Source funding provenance: [who funded each source + their stake]
Conflicted sources identified: [demoted sources with reason]
Geopolitically aligned sources identified: [demoted sources with alignment reason]
MSM sources used: [listed separately — official narrative map only, not corroboration]
Financial flows identified:
Key figures' backgrounds & connections:
Timeline anomalies:
Physical/forensic evidence: [collector, chain of custody status, CoI level, independent access Y/N]
Evidence destroyed/inaccessible: [what, by whom, when; was independent examination possible?]
Evidence withheld/classified: [known to exist but unavailable]
Independent vs. interested-party evidence: [which findings rest on verified vs. asserted evidence]
Witnesses: names, statements, credibility notes, date of statement
Narrative drift: how has the official story changed over time?
- Simultaneous identical framing across many outlets (coordinated messaging)
- Suspicious timing of leaks or document releases
- Ad hominem attacks on researchers rather than refutation of findings
- Rapid consensus formation without adequate investigation time
- Memory-holed content: stories that disappear from archives or search results
- Appeal to authority without evidence: "experts agree" without naming them
- Retroactive revision: Tier 0 sources diverge from later official accounts
- Funder fingerprints: conclusions consistently align with funder interests while contradictory independent research exists
- Undisclosed funding: treat as potentially conflicted until funding is established
- Geopolitical chorus: multiple allied-state governments/courts reaching identical conclusions about an adversary
- MSM amplification loop: dozens of outlets all tracing to a single government briefing; volume ≠ verification
Use when: standard searches return only official/mainstream sources; event is 5+ years old; key documents are hard to locate; investigation requires building actor relationship networks.
Pass 1 — Horizon Scan (broad)
✓ 5–10 broad searches across official + critical + international sources
✓ Identify 3–5 most credible sources on each side
✓ Build preliminary actor map (key players + relationships)
✓ Flag claims that appear widely but trace to a single original source
✓ Estimate "narrative capture" level: how uniform is the mainstream account?
Pass 2 — Deep Dive (targeted)
✓ For each key actor: "[name] background", "[name] funding", "[name] connections"
✓ For each key claim: trace to original source; assign source tier
✓ Search for Tier 0/contemporary sources on contested claims
✓ Search archive.org and newspaper databases for event-era reporting
✓ Search foreign-language press (use translation tools)
✓ "[event] FOIA release" OR "[event] declassified"
✓ Search for whistleblowers/insiders who spoke contemporaneously
Pass 3 — Financial & Network Mapping
✓ Map financial relationships between all key actors
✓ Search for contracts, grants, investments, donations connecting actors
✓ Identify who gained financially or politically in the aftermath
✓ Look for revolving-door relationships around the time of the event
✓ Use SEC filings, lobbying disclosures, campaign finance records
✓ "[actor] board member OR advisor OR investor OR donor"
Pass 4 — Gap & Silence Analysis
✓ What questions do all mainstream sources avoid asking?
✓ What evidence was not collected, preserved, or was destroyed?
✓ Which witnesses were not interviewed by official investigators?
✓ Are there time periods in the official timeline lacking documentation?
✓ What topics were ruled "out of scope" by official inquiries?
✓ What did early reporting say that later disappeared? (Compare Tier 0 to later accounts)
Pass 5 — Synthesis & Cross-Validation
✓ List every key factual claim supporting the alternative theory
✓ For each claim: best source? Tier? How contemporaneous?
✓ At least 3 independent sources for each load-bearing claim?
✓ Does the theory explain ALL major anomalies, or only some?
✓ What is the strongest evidence against the theory? Can it be answered?
✓ Run Phase 7 bias check and Phase 8 fallacy check before proceeding
Key research databases:
| Resource | Use Case | URL |
|---|---|---|
| Internet Archive / Wayback Machine | Archived web pages, historical documents | archive.org |
| Chronicling America | US newspaper archives 1770–1963 | chroniclingamerica.loc.gov |
| FOIA.gov / MuckRock | US federal FOIA releases | foia.gov, muckrock.com |
| WikiLeaks / DDoSecrets | Leaked government/corporate documents | (use archived mirrors) |
| OpenSecrets | US campaign finance & lobbying data | opensecrets.org |
| ICIJ Offshore Leaks | Financial network investigation | offshoreleaks.icij.org |
| history.state.gov | US State Dept historical cables | history.state.gov |
| JSTOR / Google Scholar | Academic papers with date filters | jstor.org, scholar.google.com |
| Google News Archive | Historical news search | news.google.com/newspapers |
Evidence is not self-interpreting. Every piece must be evaluated with the same critical apparatus as sources — because evidence can be contaminated, fabricated, selectively preserved, misattributed, or interpreted by interested parties. Who collected, handled, stored, interpreted, and controls access to it is as important as what it appears to show.
Four evidence principles:
- Proximity in time — Evidence collected immediately after the event is harder to tamper with than evidence processed years later.
- Collector independence — Evidence collected/interpreted by a party with skin in the game is structurally compromised, just as a conflicted source is.
- Geopolitical alignment of collecting body — Evidence gathered/certified exclusively by aligned states is subject to the same skepticism as geopolitically aligned sources.
- Chain of custody — Every hand the evidence passed through must be documented and free from motivated tampering. Gaps are red flags.
Evidence Type Tiers:
| Tier | Evidence Type | Base Trust |
|---|---|---|
| 0 | Physical evidence documented in-situ, in real time, by multiple independent parties simultaneously | Highest — Rare; most scenes are controlled before independent access |
| 1 | Unbroken-chain physical evidence collected by a neutral third party with documented custody log | High |
| 2 | Forensic analysis by independent experts with no party affiliation; methodology published; independently replicable | High |
| 3 | Physical evidence collected by an interested party but with third-party witness oversight | Medium-High |
| 4 | Official forensic reports from geopolitically neutral state labs or balanced international bodies | Medium |
| 5 | Evidence collected solely by an interested party, no independent witness | Medium-Low — treat as claim, not proof |
| 6 | Evidence with severe CoI or broken/undocumented chain of custody | Low — leads only |
| 7 | Evidence that cannot be independently examined (withheld, destroyed, accessible only to interested parties) | Very Low / Inadmissible — note absence prominently |
Evidence CoI Demotion (same logic as source CoI):
| Conflict Level | Definition | Tier Adjustment |
|---|---|---|
| None | Collected/interpreted by party with no stake | No adjustment |
| Peripheral | General institutional interest, no direct stake | −0.5 (flag; verify methodology) |
| Significant | Collector/handler/interpreter has direct stake | −1 tier |
| Severe | Collecting body's liability/power depends on conclusion, OR chain broken, OR evidence destroyed before independent examination | −2 tiers; flag as potentially inadmissible |
Evidence Integrity Checklist:
COLLECTION
□ Who collected this evidence, and when relative to the event?
□ Did the collector have any stake in the outcome?
□ Were neutral third-party observers present during collection?
□ Was the collection methodology documented and published?
□ Were any interested parties denied access to the scene?
CHAIN OF CUSTODY
□ Is there a complete, unbroken custody log from collection to present?
□ Has the evidence changed hands through any interested party?
□ Are there gaps, deletions, or anomalies in the custody record?
INTERPRETATION
□ Who interpreted/analysed this evidence?
□ Were interpreting experts independent, or selected/paid by an interested party?
□ Was methodology transparent and independently replicable?
□ Have independent experts reached the same conclusion?
□ Were experts reaching different conclusions given equal access?
ACCESS & PRESERVATION
□ Can the evidence currently be independently examined?
□ Has any evidence been destroyed, classified, or made inaccessible?
(If yes — by whom, and do they have skin in the game?)
□ Was destruction authorised before independent examination could occur?
GEOPOLITICAL ALIGNMENT
□ Was the collecting/interpreting body composed of states with a strategic interest in the outcome?
□ Were states from the opposing side given equal access and representation?
Common evidence integrity failure patterns:
- Scene contamination before independent access — most common in events investigated by implicated entities
- Selective evidence release — only evidence supporting official narrative made public
- Expert selection bias — official investigators hire experts with funding ties to interested parties
- Destroy-then-claim — evidence destroyed before independent examination; officials claim it was routine
- Single-state forensics on geopolitically charged events — attributions made on evidence examined exclusively by the accusing state's labs
- Retroactive re-examination — evidence re-examined years later produces conclusions aligning with revised narrative
- Classified corroboration — "trust us, we've seen it" is not evidence
- Witness intimidation or disappearance — key witnesses recant or die before independent corroboration
The Evidence Ladder (weakest → strongest):
Level 1 — ASSERTION
"Officials say the evidence proves X"
An interested party's claim about evidence is not the evidence.
Level 2 — REPORTED EVIDENCE
"MSM reports that forensic analysis found X"
Still filtered through structural biases. Ask: who conducted the analysis? Independent?
Level 3 — PUBLISHED FINDING
"An official report states forensic evidence shows X"
Evaluate report using CoI and geopolitical alignment frameworks.
Level 4 — INDEPENDENTLY VERIFIED FINDING
"Multiple independent forensic teams, with access and methodology published, all reached X"
Minimum standard for treating evidence as established.
Level 5 — DIRECTLY OBSERVABLE / REPLICABLE
"The evidence can be independently examined and finding independently reproduced by any qualified party"
Gold standard. Rare in high-stakes political investigations — its absence is always worth noting.
RULE: Never treat Level 1 or 2 as established fact.
Ask: Who benefits from the outcome?
| Actor | Benefit Type | Benefit Description | Plausibility |
|---|---|---|---|
| Party A | Financial / Power / Strategic | … | High/Med/Low |
Benefit types: Financial gain, political power, strategic advantage, elimination of rival, justification for future action (pretext).
Important: Cui Bono gives a starting point, never direct proof. Multiple actors can benefit simultaneously.
| Suspect | Motive ✓/✗ | Means ✓/✗ | Opportunity ✓/✗ | Score |
|---|---|---|---|---|
| Actor A | ✓ | ✓ | ✓ | 3/3 |
Rank suspects by score. Focus theory development on the highest-scoring actors.
| Mode | Logic | Caveat |
|---|---|---|
| Deductive | General rule → specific conclusion | Valid argument can be wrong if the general premise is false |
| Inductive | Specific observations → general pattern | Conclusions can be overturned by exceptions |
| Abductive | Best explanation from competing hypotheses | Preferred when empirical evidence is scarce |
| Duck Test | Multiple surface characteristics match a known pattern → probably that pattern | Intuitive; use with care |
| Bias | Description | Mitigation |
|---|---|---|
| Apophenia | Seeing patterns that aren't there | Require multiple independent data points |
| Confirmation bias | Favoring evidence that fits the theory | Actively seek disconfirming evidence |
| Anchoring bias | Over-relying on first information | Revisit initial assumptions regularly |
| Availability heuristic | Overweighting easily accessible info | Diversify sources; prioritize Tier 0 |
| Dunning-Kruger | Overconfidence in limited knowledge | Identify knowledge gaps explicitly |
| Authority bias | Trusting status over argument | Evaluate arguments on merit |
| Motivated reasoning | Believing what is comforting | Ask: "What would falsify this?" |
| Recency bias | Later account = more accurate | Later ≠ more truthful; prioritize contemporary sources |
| Funding capture blindness | Treating interested-party research as independent | Always check who paid; apply CoI demotion |
| Institutional echo blindness | Treating convergence of institutionally aligned sources as independent corroboration | Map the institutional network before counting "independent" confirmations — sources sharing funding, mandates, or political alignment are a single data point, not many |
| Advocacy labelling | Using pejorative or loaded terminology for a position (e.g. "denier", "conspiracy theorist", "crank") which pre-judges the argument before evaluating it | Use neutral descriptors throughout: "the alternative account", "the revisionist position", "the mainstream account". The argument must be defeated on evidential grounds, not pre-empted by labelling its proponents |
| Steelman sourcing failure | Building the alternative hypothesis from opponents' characterisations of it rather than the alternative's own best primary sources | Before evaluating Hypothesis B, search directly for its strongest primary literature. If you have not read the best-case version from its own advocates, you have not steelmanned it |
| Context stripping | Citing a technically accurate fact while omitting context that materially changes its meaning | For every factual claim used as evidence, ask: "Is there context that the source chose not to disclose that would change how this fact is interpreted?" Apply especially when a source highlights a specific example as representative |
Apply to both the official narrative and the theory being built:
- Ad Hominem — Attacking the person, not the argument
- Straw Man — Attacking a distorted version of the argument
- False Dilemma — Limiting options artificially ("either/or")
- Hasty Generalization — Broad conclusions from too few cases
- False Causation — Correlation ≠ causation
- Circular Reasoning — Restating the conclusion as evidence
- Misrepresentation — Putting words in another party's mouth
- Appeal to Recency — Assuming the most recent consensus is correct simply because it's recent (especially dangerous when Tier 0 sources contradict it)
- Genetic Fallacy (inverted) — Accepting a claim due to institutional prestige without checking if the institution is conflicted; or dismissing a claim solely because its source is unconventional while ignoring a "credible" conflicted source
- Argument/Advocate Conflation — Dismissing or pre-judging an argument because of who makes it, rather than engaging with the argument on its own terms. The identity, motives, or character of an argument's proponents is entirely separate from whether the argument is logically valid and evidentially supported. A bad actor can make a valid argument; a credible institution can make a fallacious one. Evaluate the argument; note the advocate's CoI separately.
- Predicted Absence Fallacy — Treating the absence of evidence as evidence of absence when one hypothesis specifically predicts that absence. Before concluding "X didn't happen because there's no record of it," ask: "Does Hypothesis A predict that records of X would not exist?" If yes, the absence is consistent with — not contrary to — Hypothesis A, and carries no discriminatory weight between the hypotheses.
- Institutional Echo as Corroboration — Counting multiple institutionally aligned sources as independent confirmation. Institutions sharing funding networks, political mandates, national identity, or strategic interest are a single node in the evidentiary graph, regardless of how many separately publish the same conclusion. Independent corroboration requires sources with no shared institutional dependency.
When a fallacy is detected: flag it, restate the argument without the fallacy, or acknowledge the argument collapses.
Every investigation must produce exactly two fully developed hypotheses built to the same standard.
- Hypothesis A — Official/Mainstream Narrative: The best, most charitable, most evidence-supported version of the official explanation. Must be a genuine steelman — not a strawman.
- Hypothesis B — Best Alternative Explanation: The strongest, most evidence-supported alternative theory. Must not overstate beyond what the evidence supports.
Why both are mandatory: Building only the alternative is confirmation bias with extra steps. Building only the official is what MSM already does. The value comes from holding both simultaneously with identical scrutiny.
Hypothesis Template (apply identically to both A and B):
HYPOTHESIS [A — Official / B — Alternative]
─────────────────────────────────────────────
Label: [e.g. "Lone actor" / "State-sponsored false flag"]
Event: [What happened]
Core claim: [Central explanatory claim in 1–2 sentences]
Actors: [Who did what, according to this hypothesis]
Motive: [Why they acted]
Mechanism: [How the act was carried out]
Supporting evidence:
[For each item: claim → source → source tier → CoI level → evidence tier → date]
What this hypothesis explains well:
[Anomalies, facts, and patterns this hypothesis accounts for naturally]
What this hypothesis struggles to explain:
[Facts, anomalies, or red flags it cannot easily accommodate]
Evidence integrity notes:
[Collector independence, chain of custody, evidence ladder level for key items]
Falsification criteria:
[What single piece of evidence, if confirmed, would disprove this hypothesis?]
Confidence level: [Low / Medium / High] + rationale
Steelman sourcing rule (MANDATORY): Hypothesis B must be built from its own primary literature — the best-case arguments written by its actual proponents. It is NOT sufficient to read mainstream rebuttals of the alternative and extract the alternative's position from those. If you have not searched for and read the alternative's strongest primary sources directly, you have not steelmanned it. Mandatory check: "Did I find and read the best primary source written by advocates of Hypothesis B, or did I reconstruct their position from critics of it?"
Comparative Assessment:
DUAL HYPOTHESIS COMPARISON
─────────────────────────────────────────────────────────────────
HYPOTHESIS A HYPOTHESIS B
(Official) (Alternative)
─────────────────────────────────────────────────────────────────
Explains all red flags? [Y/N + notes] [Y/N + notes]
Supported by Tier 0? [Y/N + notes] [Y/N + notes]
Free of CoI-conflicted [Y/N + notes] [Y/N + notes]
load-bearing evidence?
MMO score of primary [X/3] [X/3]
suspect?
Falsifiable? [Y/N] [Y/N]
Most parsimonious? [Y/N] [Y/N]
Cui Bono alignment? [Y/N + notes] [Y/N + notes]
─────────────────────────────────────────────────────────────────
Unresolved by either: [Facts/anomalies neither hypothesis accounts for]
Overall assessment: [Which hypothesis better fits the evidence, or state
honestly if evidence is insufficient to favor either]
Anti-bias safeguard: Before finalizing, actively search for the strongest possible evidence in favor of whichever hypothesis currently seems less convincing.
- Prefer the hypothesis with fewest unsupported assumptions (Ockham's Razor)
- But note: sophisticated actors may embed complexity to obscure conspiracies — don't blindly discard complex theories
- Rank theories: most parsimonious → most elaborate
- Start verification with the simplest; escalate only if it fails
Before presenting a theory as credible:
- Dual hypothesis — Both hypotheses built to the same standard and compared head-to-head?
- Steelman integrity — Is Hypothesis A a genuine best case, not a strawman?
- Active web search completed — Every phase supported by live searches, not memory?
- Falsification — Is the theory falsifiable? What would disprove it?
- Ockham's Razor — Is a simpler explanation equally valid?
- Cross-referencing — Does the theory hold across multiple independent sources?
- Empirical evidence — Is there observable, concrete evidence (not only inference)?
- Reproducibility — Can the reasoning be independently replicated from the same facts?
- Source contemporaneity — Are load-bearing claims supported by Tier 0 sources, not only later accounts?
- Funding independence — Are key sources free of material conflicts of interest? If conflicted, are their claims independently corroborated?
- Evidence integrity — Has every piece of load-bearing evidence been evaluated for collector independence, chain of custody, and geopolitical alignment?
- Evidence ladder level — Is evidence actually independently verified (Level 4–5), or official assertion/MSM-reported claim (Level 1–2) masquerading as established fact?
- Inaccessible evidence accounted for — Has destroyed, classified, or access-restricted evidence been noted as a red flag, not silently omitted?
1. NOTICE → Anomaly or inadequacy in official explanation
[SEARCH: official narrative + known criticisms]
2. EXPLORE → Identify candidate actors / known conspiracy patterns
[SEARCH: actors, backgrounds, funding, geopolitical alignment]
3. DOCUMENT → Gather all relevant facts via active web search
Prioritize Tier 0 contemporary sources
Apply source tiers, CoI demotion, evidence integrity checks
[SEARCH: all Phase 3a–3h layers; minimum 10–20 searches]
4. HYPOTHESIZE → Build BOTH hypotheses using identical structure (Phase 9)
Steelman the official narrative; build strongest alternative
[SEARCH: actively seek best evidence for whichever feels weaker]
5. PREDICT → Derive testable consequences of EACH hypothesis
What should be true if A is correct? If B is correct?
6. VALIDATE → Check whether predicted consequences hold for each
Run comparative assessment table
[SEARCH: any predicted evidence not yet searched]
7. AUDIT → Phase 7 bias check + Phase 8 fallacy check on BOTH hypotheses
Refine; update confidence levels
[SEARCH: any remaining gaps identified in audit]
## Event Analysis: [Event Name]
### Red Flags
- [Flag 1]
- [Flag 2]
### Key Contemporary Sources (Tier 0)
| Source | Date | Type | Key Finding |
|--------|------|------|-------------|
### Narrative Drift
[How has the official account changed between contemporary and later sources?]
### Geopolitically Aligned / Conflicted Sources
[Courts, tribunals, official inquiries, or political statements demoted — note bloc, interest, and CoI level applied]
### MSM Narrative Map
[Summary of mainstream narrative — treated as official story to investigate, not verified fact]
### Evidence Integrity Assessment
| Evidence Item | Collector | CoI Level | Chain of Custody | Independent Access | Evidence Ladder Level |
|--------------|-----------|-----------|-----------------|-------------------|-----------------------|
### Evidence Gaps & Red Flags
[Evidence destroyed, classified, restricted, or inaccessible — and who controls it]
### Cui Bono — Beneficiaries
| Actor | Benefit | Plausibility |
|-------|---------|-------------|
### MMO Suspect Matrix
| Suspect | Motive | Means | Opportunity | Score |
|---------|--------|-------|-------------|-------|
### Hypothesis A — Official / Mainstream Narrative (Steelmanned)
[Full hypothesis template from Phase 9]
### Hypothesis B — Best Alternative Explanation
[Full hypothesis template from Phase 9]
### Dual Hypothesis Comparison
[Comparative assessment table from Phase 9]
### Bias & Fallacy Check
[Applied to BOTH hypotheses — detected biases/fallacies + mitigations]
### Confidence Assessment
[Low/Medium/High + reasoning]
### What Would Change This Assessment
[Falsification criteria]| Dimension | Questions |
|---|---|
| Who | Who benefits? Who is harmed? Who had means, motive, opportunity? |
| What | Strengths/weaknesses of official narrative? What alternative explanations exist? |
| Where | Real-world analogues? Where can more information be found? |
| When | When did this occur? Historical pattern? What did contemporary sources say? |
| Why | Why is this explanation offered? Why might it be incomplete? Why has the narrative changed? |
| How | How could the act have been executed? How can the theory be tested? How does the account differ between contemporary and retrospective sources? |
On source age: The further a source is in time from the event it describes, the more it has passed through filters of political interest, reputation management, retrospective rationalization, selective declassification, academic orthodoxy, and cultural narrative consolidation. A shaky contemporary account is often MORE VALUABLE than a polished retrospective one.
On funding independence: A source's credibility has two independent dimensions — (1) Quality (sound methodology, expert author, reputable publication) and (2) Independence (funder has no skin in the game). A high-quality source with low independence is not a trustworthy source — it is a well-crafted interested party. This pattern has recurred in tobacco, pharmaceuticals, chemicals, sugar, oil, finance, and intelligence community assessments.
On geopolitical authority: A legal or official finding is only as independent as the body that produced it is from the geopolitical interests at stake. Allied states protecting allied conduct is not justice. Adversarial states condemning adversarial conduct is not justice. Both are politics expressed in official language. Test: If the geopolitical positions were reversed, would the same body have reached the same conclusion? If "probably not" — the finding is political, not independent.
On MSM: MSM is simultaneously most accessible, most amplified, and most legitimized AND most structurally dependent on official sources, most financially dependent on advertisers, most geopolitically embedded, and most vulnerable to the echo chamber. Use MSM to build the official narrative — it does this well. Never use MSM agreement with an official source as corroboration; it is echo. Never count multiple MSM outlets citing the same briefing as multiple independent data points.
On evidence: Evidence does not speak for itself. It is always mediated by the humans who collected it, the institutions that stored it, the experts who interpreted it, and the officials who released it. A forensic report authored by an interested party's chosen experts, based on evidence collected by that party, stored in that party's facilities, and released selectively by that party, is not independent evidence — it is that party's version of events expressed in the language of science. Gold standard: Physical/forensic evidence that (1) was documented in real time by independent observers, (2) has an unbroken third-party-witnessed chain of custody, (3) has been independently analysed by experts from multiple non-aligned institutions, (4) is currently accessible for re-examination by any qualified party, and (5) produces consistent results when independently replicated. Destruction test: Evidence destroyed, classified, or made inaccessible before independent examination → ask who authorised it and whether they had skin in the game. Routine destruction does not happen to uniquely significant evidence.