Gotten a few questions today about how to talk about having more sources than you reveal in public and thoughts on communicating about it. Small thread on simple language to use. (1/x)
First and foremost words have meaning. It’s ok to use your own structure but know what it means, openly define it for your audience, and stick to it. I highly encourage reading the CIA’s estimative words of probability (2/x)
When you communicate an assessment and give it a rating (low, medium, or high probability as an example) it’s good to highlight key evidence that went into your assessment. But note that it wasn’t all that went into it. (3/x)
Example: “We assess with moderate confidence that THREATACTOR A and THREATACTOR B are the same team. Key to our assessment was code reusage in malware and overlap in targets. We have additional sources we are also not revealing at this time that are technical in nature” (4/x)
This helps the audience understand that your assessment isn’t based on one thing but that you’re valuing certain public info pretty highly. I also like noting if the sources you can’t discuss are technical (like other malware samples or incident response) or not. (5/x)
The goal is never to “prove” it to an audience. You may try to convince them or want their buy in. But intelligence assessments are evidence for a court case. And without revealing all details you can’t “prove” something anyway. (6/x)
A secondary goal is providing just enough insight into your process or key information to let others know you worked through the problem right. Consider it like math, showing your work regardless of the answer to show you understand how to do it. (7/x)
All in all I’m seeing more and more teams use confidence levels with their assessments. That’s awesome. You don’t have to reveal sources to be effective but make sure your process is open enough to not look like you only have 1 source (if that’s true). (8/x)
If you don’t have more than one source you’re definitely not at a high confidence rating. Folks don’t like using Low and Moderate because audiences turn off. Don’t inflate how often you use High confidence as a result. Keep it honest and train your audience over time. (9/9)
Aren’t evidence for a court case*
