The report is the only part of the investigation anyone else sees, so it is the only part that can be wrong in public. The failure that destroys credibility isn't a missed source — it's a sentence that reads as fact and is actually an inference. "The account is operated from Lisbon" versus "posting times cluster in UTC+0/+1, consistent with Iberian working hours." One survives cross- examination.

Three categories, never blurred, ideally visually distinct in the text.

Any sentence where you cannot say which category it belongs to is a sentence that has smuggled a conclusion into the evidence. Rewrite it. Verbs betray the category: is, lists, shows for observation; indicates, implies for inference; we assess, we judge for assessment. Watch out for "appears to be", which pretends to be observation and is inference.

Done when every claim is tagged and no inference is written in the grammatical form of an observation.

A claim with no source does not go in the report. Not in a footnote, not "multiple sources" — the specific one, per claim.

Each source needs: the URL or the tool and its exact query; the UTC date-time you retrieved it; the source-reliability grade (see ); and an archive reference. Live URLs rot, and hostile subjects delete. Archive everything you cite, at the moment you cite it, using — cite the snapshot alongside the live URL, and keep a local copy too, since public archives can themselves be removed on request.

For anything that might become evidence, add chain of custody: who collected it, when, with what tool and version, and a cryptographic hash of the stored file ( on Linux, on macOS). Record the hash in the report, keep the original untouched, and work on copies. A screenshot with no hash, no timestamp and no capture method is worth very little; the underlying HTML, headers, and image files are worth more.

Done when every retained claim has source, retrieval timestamp, grade, and archive reference, and evidentiary items also have hashes.

Assume the reader stops after the first half page — because they will. BLUF: the answer to the objective question first, in plain language, with its probability and confidence. Then the two or three judgements that carry the decision. Background, method and detail come after, for the reader who needs to audit you.

A key judgement is one sentence, one judgement, with its estimative term, its confidence, and the reason compressed to a clause. If a judgement needs a paragraph of setup to make sense, it isn't a judgement yet.

Done when the objective question is answered in the first paragraph, and the answer would still be defensible if nothing else were read.

"Possibly" everywhere is how a report says nothing at length. Standardise on one ordered set of terms and use them consistently:

Rules that make it work: never use a term outside the ladder; never mix in a numeric percentage in the same sentence as a word, since readers anchor on the number; never use "possible" as an estimate, because everything not excluded is possible; and print the ladder in the report so the reader maps words to ranges the same way you did. Full table with ranges, the near-synonyms to avoid, and worked rewrites: reference/estimative-language.md.

Probability and confidence are different axes. Probability is how likely the judgement is to be true. Confidence is how good the evidence underneath it is — source quality, corroboration, and the presence of gaps or plausible deception. You can legitimately write "highly likely, low confidence": the evidence points strongly one way but rests on a single unverifiable source. That sentence is honest and useful. Collapsing the two into one word is not.

Done when every assessment carries one ladder term and a stated confidence level, with the reason for the confidence given.

Juniors delete these because they feel like failure. They are frequently the most useful content in the report: they are what stops the next analyst repeating the work, and in due diligence and pre-employment contexts the absence of adverse findings is the deliverable.

State what you looked for, where you looked, and what you did not find — distinguishing "checked, absent" from "could not check". "No sanctions or enforcement listings for the subject in the OFAC, UK, and EU consolidated lists, checked 2024-03-11" is a finding. "No adverse media found" without naming the sources searched, the languages, and the date range is not a finding, it is a shrug. Record rejected leads and candidates too, with the reason for rejection.

Done when searched-and-empty, could-not-check, and rejected-candidate items are each written up with scope and dates.

Reproducibility is what separates an intelligence product from an opinion. Record the tools with versions, the exact queries and dorks, the databases and their coverage dates, the languages searched, and anything that shaped the result: rate limiting, geo-restricted content, paywalls, a persona's access level, deleted material recovered only from archives.

Gaps go in the body, not buried at the end: what could not be established, why (no public registry in that jurisdiction, platform requires authentication, records are sealed), and what would close it — a records request, a subpoena, a site visit. Naming the closed source is a service to whoever reads it.

Done when another analyst could re-run the collection from the report alone and get the same result, and every unanswered objective question has a named reason and a route.

Collect broadly, publish narrowly. Remove everything not needed for the objective — especially data about uninvolved third parties who appeared in the collection: family members, neighbours, co-residents at an address, bystanders in photographs, unrelated people sharing the subject's name. Redact rather than delete where the item explains a reasoning step, and say what was redacted and why, so the redaction itself is auditable. Never publish full national-ID numbers, payment card numbers, credentials, or plaintext passwords from breach data; reference them by type and partial value. Keep the unredacted case file separately, encrypted, under the retention limit in ../../ETHICS.md.

Then match the format to the reader:

graph-the-network

Template with all sections, and the evidentiary variant: reference/report-template.md.

Done when the report contains no third-party data the objective doesn't need, and the format matches the named audience.

State the confidence next to the judgement, not in a preamble the reader skips.

Objective: does the supplier share control with a barred entity?

BLUF: "It is likely (moderate confidence) that Nordvale Trading and the barred entity share beneficial control."

Observation: both filings name the same accountancy firm; both domains resolve to a registrant email (retrieved 2024-03-11, archived). Inference: a shared registrant email indicates one registering party. Assessment: likely common control — moderate, not high, because the beneficial owner is undisclosed in that jurisdiction and a nominee arrangement remains untested.

Negative finding included: the shared home address reported by three people-search sites was traced to one broker feed carrying an identical misspelling; recorded as circular and excluded. Redacted: two co-residents at that address, unrelated to the objective. Gap named: UBO register is non-public; a formal request would close it.

The report is the terminal product; it consumes rather than produces selectors. Take the entity map from , the archived copies from , and the scope statement from . Unresolved indicators go back to the workflow that produces them.

An OSINT report about a living person is personal data in its own right, and the subject may have access rights to it in some jurisdictions — write every line as if the subject will read it, because they may be entitled to. Reports likely to be used in proceedings need the evidentiary format from Step 7 and unbroken custody; a report assembled loosely and reformatted later cannot recover custody it never had. Breach-derived material carries its own handling constraints — see — and quoting credentials into a report can itself be unlawful processing.