write-the-intel-brief

# Write the intel brief The report is the only part of the investigation anyone else sees, so it is the only part that can be wrong in public. The failure that destroys credibility isn't a missed source — it's a sentence that reads as fact and is actually an inference. "The account is operated from Lisbon" versus "posting times cluster in UTC+0/+1, consistent with Iberian working hours." One survives cross- examination. ## Step 1 — Sort every claim into observation, inference, or assessment Three categories, never blurred, ideally visually distinct in the text. - **Observation** — what you saw, with source and timestamp. "The registry record retrieved 2024-03-11 lists A. Kestrel as director." - **Inference** — a logical step from observations, with the step shown. "The same registrant email appears on both domains, so they were registered by one party." - **Assessment** — your analytic judgement, carrying probability and confidence. "We assess it is likely the two companies are commonly controlled." Any sentence where you cannot say which category it belongs to is a sentence that has smuggled a conclusion into the evidence. Rewrite it. Verbs betray the category: *is, lists, shows* for observation; *indicates, implies* for inference; *we assess, we judge* for assessment. Watch out for "appears to be", which pretends to be observation and is inference. **Done when** every claim is tagged and no inference is written in the grammatical form of an observation. ## St...