From Individual Clues to Intelligence

An anonymous report. An unusual transaction. A name that appears in several case files. Every investigation begins with a lead. But not every lead leads to the truth. And not every piece of information that appears plausible stands up to scrutiny. The history of intelligence shows how consequential this distinction can be. Information has been mistaken for fact, warnings have been ignored and connections have gone unnoticed. The problem was not always a lack of information. Often, it was the failure to assess it correctly.

Turning individual leads into a reliable intelligence picture requires more than collecting data. It demands rigorous source assessment, independent verification and the ability to identify connections without jumping to conclusions. Seven cases illustrate what matters most.

Rule 1: Assess the source and the information separately

The case. In the late 1990s, an Iraqi defector codenamed Curveball comes to the attention of Western intelligence services. He reports the existence of mobile facilities for producing biological weapons in Iraq. His claims are passed to US agencies through Germany’s Federal Intelligence Service (BND). US intelligence never gains direct access to the source. In February 2003, his claims feature prominently in then US Secretary of State Colin Powell’s address to the UN Security Council. In 2004, the CIA formally concludes that Curveball’s reporting was fabricated.

The lesson. The plausibility of a claim does not establish the credibility of its source. Curveball’s statements became a central part of the intelligence assessment, even though US intelligence could neither question him directly nor independently verify his claims sufficiently.

In practice. Assess the source and the information separately. How reliable has the source been in the past? What interests might influence their statements? And can the specific claim be independently corroborated?

Rule 2: A Connection Is Not Evidence

The case. Paris, 1917. French counter-intelligence is investigating a suspected German agent operating under the codename H-21. The trail leads to Mata Hari, a Dutch dancer with contacts among military officers and diplomats from several countries. Intercepted German radio messages play a decisive role in identifying her. In October 1917, Mata Hari is executed for espionage on behalf of Germany. Whether she actually passed on militarily relevant information, and what value that information may have had, remains disputed to this day.

The lesson. Contacts, personal relationships and financial connections can raise legitimate questions. They do not, however, automatically establish intelligence activity or prove specific misconduct. In Mata Hari’s case, association, suspicion and actual intelligence activity were not sufficiently distinguished.

In practice. A business relationship, a shared corporate interest or a financial transaction is a connection, not proof of wrongdoing. What matters is the context, the purpose and the actual flow of information or money.

Rule 3: Uncomfortable Findings Deserve the Same Scrutiny

The case. In 2000, financial analyst Harry Markopolos begins alerting the US Securities and Exchange Commission (SEC) to irregularities in Bernard Madoff’s investment returns. His central argument: the consistently high returns generated by Madoff’s strategy were mathematically difficult to explain. In 2005, Markopolos submits a detailed analysis to the SEC. He repeatedly warns of potential fraud. Yet a meaningful investigation fails to follow for years. Madoff is not arrested until December 2008, after operating one of the largest Ponzi schemes in history.

The lesson. The warnings were early, specific and analytically sound. Nevertheless, they were not given the attention they deserved. Madoff’s reputation as a respected figure on Wall Street and the trust placed in established financial structures appear to have stood in the way of an impartial assessment.

In practice. A warning concerning your own leadership, a key client or a long-standing business partner must receive the same level of scrutiny as any other. The greater the potential consequences, the more important independent verification becomes.

Rule 4: Authority Is No Substitute for Verification

The case. From 2015 onwards, the Financial Times reports on irregularities at Wirecard. In 2019, allegations surrounding its Asian operations become more specific. By then, the company is listed on Germany’s DAX index, has audited financial statements and enjoys considerable political and economic standing. Rather than prompting a thorough examination of the allegations, the Financial Times’ reporting itself comes under pressure. Germany’s financial regulator, BaFin, imposes a short-selling ban on Wirecard shares and files a criminal complaint against journalists at the newspaper. In June 2020, Wirecard is unable to account for EUR 1.9 billion supposedly held in trustee accounts. The company subsequently files for insolvency.

The lesson. Reputation, stock market listings, audit opinions and regulatory oversight can create confidence. They are not substitutes for independently verifying specific facts. In the Wirecard case, critical warnings were not pursued with the necessary rigour for years.

In practice. Examine not only who confirms a piece of information, but also what that confirmation is actually based on. An audit opinion is no substitute for verifying a specific transaction or asset. What matters is whether the underlying facts can be independently established.

Rule 5: Count Independent Sources, Not Search Results

The pattern. A businessman is alleged to have been involved in a money laundering investigation several years ago. An OSINT search returns five results: two newspaper articles, a blog, an industry publication and an entry in an online encyclopaedia. At first glance, the allegation appears to have been confirmed by multiple sources. On closer inspection, however, all five publications trace back to the same news agency report. That report, in turn, is based on an allegation that was never independently confirmed.

The lesson. Multiple publications do not automatically represent multiple independent sources. When outlets reproduce one another’s reporting, they create the appearance of corroboration without adding any new information. In intelligence analysis, this phenomenon is known as circular reporting.

In practice. Trace information back to its original source. Establish who first published the claim, which sources support it and whether independent corroboration exists. Five search results may ultimately lead back to a single source.

Rule 6: Patterns Emerge Through Connections

The case. In April 2016, the International Consortium of Investigative Journalists (ICIJ), together with international media partners, publishes the Panama Papers. The investigation is based on more than 11.5 million documents from the files of Panamanian law firm Mossack Fonseca. An offshore company, a trustee or an international corporate structure is not necessarily illegal in itself. The significance of the Panama Papers emerged through the systematic analysis and linking of the underlying data. Shared directors, recurring addresses, interconnected companies and cross-border financial relationships revealed networks that would have remained difficult to identify by examining individual documents in isolation.

The lesson. The significance of information often only becomes apparent when it is considered alongside other findings. Recurring names, identical addresses and overlapping timelines can reveal connections that remain hidden when each piece of information is examined separately.

In practice. Analyse individuals, companies, beneficial owners, addresses, transactions and timelines together. What matters is not only what information is available, but also what relationships exist between the individual data points.

Rule 7: Be Clear About What You Don’t Know

The pattern. An industrial company’s whistleblowing system receives a report alleging that a supplier is submitting inflated invoices. An initial review identifies three red flags. The supplier is registered at the address of a tax advisory firm. Its invoices regularly fall just below the internal approval threshold. In addition, a purchasing manager was previously a shareholder in another company whose managing director now runs the supplier. Each circumstance could initially have a legitimate explanation. Taken together, however, they justify a more targeted investigation. What remains missing is evidence that money was transferred back to individuals within the company.

The lesson. Several red flags can establish a reasonable basis for further investigation without proving misconduct. A reliable intelligence picture must therefore make the limitations of the available information equally visible.

In practice. Clearly distinguish between three levels: What has been established? What can reasonably be inferred from the available information? And what remains unknown? The quality of an analysis is not measured by its ability to answer every question, but by its ability to distinguish verified findings from assumptions.

Conclusion: Facts First. Analysis Second.

All seven rules point to the same principle: information must be assessed and verified before conclusions are drawn. Curveball demonstrates the consequences of failing to properly assess a source’s credibility. Mata Hari illustrates how quickly associations can become grounds for suspicion. Markopolos represents the warnings that went unheeded despite sound analysis. Wirecard shows what happens when reputation and institutional trust take precedence over the verification of facts.

A reliable intelligence picture does not emerge from the accumulation of information alone. It is built through critical assessment, independent verification and the systematic identification of connections. For corporations, financial institutions, law firms and public authorities, this distinction is fundamental. Decisions must not only be based on available information. They must also be traceable, verifiable and defensible.

A single lead shows where an investigation should begin. Only rigorous analysis reveals what actually lies behind it.