This lab uses public incident reporting and sanitized synthetic artifacts for defensive OSINT training. Real incidents are referenced for educational context only. The interactive data is fictionalized and must not be used to identify, contact, expose, or accuse real people.
Four Competing Stories
Test four explanations with inconsistency rather than by counting supporting evidence.
Synthetic training evidence that stays internally consistent. Check the repository history, the timestamps, the hashes and the agreement between sources. Never extend the scenario to real people or infrastructure.
01Incident summary
By this point almost any artifact can be made to back a favorite story if you read it alone. The maintainer theory has a witness impression. The DNS-failure theory has a real address change. The copycat theory has loud public posts. The automation-token theory has the least dramatic story of the four, and it still has to survive the full evidence matrix.
02Analyst mission
Check every hypothesis against the evidence that would disconfirm it. Pick the least inconsistent one. Assign confidence and say what would change it.
03Review the evidence
Evidence route
Open the public repository and preserve these records before you draw a conclusion.
| Indicator Type | Evidence path | Analytical Context |
|---|---|---|
| ACH matrix | evidence/act-4/competing-hypotheses.csv | Compare the contradictions across the four explanations. |
| Final timeline shell | evidence/act-4/final-timeline.csv | Test the order of events before you use causal language. |
This table shows file paths and Git refs in the public evidence repository. None is a live scanning target.
04Tasks
4 steps- 01
Write out all four hypotheses before you choose one.
- 02
Judge the evidence on consistency and inconsistency, not on a vote count.
- 03
Pick the least inconsistent hypothesis and assign confidence.
- 04
Name one plausible new artifact that would change the judgment.
05Log your findings
Evidence Notebook
Use this panel to log individual threads of evidence. Your entries are saved locally in this browser only.
No evidence records logged yet.
06Write the report
Report Drafting Board
# CSINT Incident Lab Report ## Research Question Check every hypothesis against the evidence that would disconfirm it. Pick the least inconsistent one. Assign confidence and say what would change it. ## Summary No analyst summary provided yet. ## Fact - No forensic facts recorded in the notebook. ## Signal - No analytical signals logged. ## Inference - No alternative explanations recorded. ## Recommendation - No next-pivot recommendations recorded. ## Confidence Low ## Limitations No limitation notes entered. ## Source reliability Not assessed. Annotate each source with its reliability tier before publishing. ## Information validity Not assessed. Confirm whether each item is directly observed, reported, or inferred. ## Missing context Not recorded. List what data is missing or could not be verified from public sources. ## Next safe steps - No next safe steps specified. ## Sources used - No source references listed. --- Generated at: pending