REAL-WORLD INTERPRETIVE
One-sentence brief
Counterintelligence can protect people and institutions, but poorly bounded suspicion can also create false positives, retaliation, and self-confirming investigations.
REAL-WORLD INTERPRETIVE
INTELLIGENCE FOUNDATIONS
Counterintelligence: Leads, Hypotheses, and Due Process
A defensive approach to insider risk and hostile collection that separates access from action, anomaly from proof, and institutional concern from guilt.
LEVEL 1
ORIENTATION
Why this matters
REAL-WORLD INTERPRETIVE
Three key points
- Access creates opportunity, not proof.
- Canary or compartment markers are leads, not verdicts.
- Independent corroboration and appeal are essential.
LEVEL 2
WORKING BRIEF
Evidence, context, and limits
REAL-WORLD INTERPRETIVE
Insider-risk governance
Define protected assets, lawful monitoring, reporting thresholds, review authority, data retention, anti-retaliation safeguards, and appeal before a crisis occurs.
REAL-WORLD INTERPRETIVE
Access versus action
A person may have access without using it, act without the suspected access path, or appear in records because of routine work. Build explicit access, opportunity, and action timelines.
REAL-WORLD INTERPRETIVE
Anomaly versus proof
An anomaly is a deviation from a baseline. It can arise from error, maintenance, legitimate exception, compromise, deception, or incomplete data. Consequential conclusions require corroboration.
REAL-WORLD INTERPRETIVE
Competing hypotheses
Maintain several explanations, including innocent, procedural, technical, medical, organizational, and hostile possibilities. Record what evidence would increase or decrease each one.
REAL-WORLD INTERPRETIVE
Source and chain of custody
Preserve who collected evidence, when, how, under what authority, how it was transformed, who accessed it, and what may be missing. A technically genuine item can still be misleading outside context.
REAL-WORLD INTERPRETIVE
Institutional false positives
Pressure to find a culprit, protect leadership, close a case, demonstrate vigilance, or defend an existing theory can distort inquiry. Independent review and documented dissent reduce that risk.
LEVEL 3
COMPLETE DOSSIER
Limitations, game links, and review context
DISPUTED / MULTIPLE ACCOUNTS
Known limitations and gaps
- Public evidence about intelligence institutions is incomplete by design and often uneven across jurisdictions.
- Historical cases can illuminate methods but should not be treated as universal templates.
- Game examples are fictional abstractions and do not establish real-world facts.
GAME MECHANIC
RogueIntelligence.org connections
REAL-WORLD INTERPRETIVE
Glossary cross-reference
Terms are defined for this site’s evidence method, not as universal legal or clinical definitions.
LEVEL 4
RESEARCH EDITION
Sources, methods, and stable links
REAL-WORLD INTERPRETIVE
Linked reports
REAL-WORLD VERIFIED
Method and corrections
This page follows the public method for provenance, confidence, source independence, alternative accounts, limitations, review state, and visible correction.
NEXT
CONTINUE
Related learning
Intelligence FoundationsCovers and Legends: Identity Systems, Not Costume ChangesHigh-level literacy about official and non-official cover, why roles explain access, and how consistency is evaluated without teaching document fraud, evasion, or identity exploitation.Intelligence FoundationsIntelligence DisciplinesBalanced, high-level explanations of HUMINT, SIGINT, COMINT, ELINT, OSINT, GEOINT/IMINT, MASINT, FININT, CYBINT, TECHINT, and all-source fusion.Intelligence FoundationsThe Intelligence CycleA high-level model of how questions become collection, analysis, dissemination, and reassessment—and where institutions can fail. Learning pathEvidence Before AccusationPractice claim separation, competing hypotheses, corroboration, chain of custody, and due process.Learning pathCounterintelligence Without ParanoiaInvestigate leaks and insider risk without turning suspicion, diagnosis, or access into guilt.