Investigations
How a public signal becomes evidence — and where we stop
An investigation is the part of the work that decides whether a finding is worth your attention. This page describes exactly how that decision is made, because a method you cannot inspect is not a method.
Method
Promotion between states requires a written reason
A signal does not become evidence because it looks convincing. It becomes evidence when its source, timestamp and provenance have been captured such that someone else could return to it. It becomes a verified incident only when an operator has reviewed it against stated criteria and recorded that review. Every promotion is written into the report, and every finding that failed to be promoted stays visible as a hypothesis rather than disappearing.
- 01
Registry check
Is the observed asset in fact yours? A large share of first-pass signals are your own legitimate properties, and removing them first is what keeps the rest meaningful.
- 02
Similarity qualification
For look-alike names and marks, similarity is measured and reported with its score. A high score is a reason to look, not a conclusion.
- 03
Liveness and reach
Is the asset live, parked or dormant? Does it have an audience? A dormant registration and an active cloned checkout are scored very differently.
- 04
Correlation
Independent observations that share infrastructure, imagery or behaviour are grouped into one case, so you see actors rather than a list of symptoms.
- 05
Evidence capture
Source URL, observation timestamp, retrieval method and a snapshot where that is lawful and technically possible.
- 06
Operator review
A human decides whether the criteria for a verified incident are met, and writes down the uncertainty that remains.
- 07
Recommendation
A prioritised, specific next action — including, where it is the honest answer, that no action is warranted.
Escalation
Where an investigation stops and something else begins
There are questions Guardian will not answer, and it is better to know that now than to discover it in a report you have paid for. In each of these cases we tell you what we found, state the boundary plainly, and recommend the kind of professional who can take it further.
- Determining the legal identity of an individual behind an observed asset
- Deciding whether a use constitutes infringement or another legal wrong
- Drafting or sending legal notices
- Submitting takedown requests without a specific written mandate for that request
- Any observation that would require access to a private or access-controlled space
- Any request whose purpose appears to be pressuring or exposing an individual