building-and-feeding-the-deception

name	building-and-feeding-the-deception
description	Review the material fed to the adversary and how the deception is built; use when reviewing this facet of a deception or counter-deception case.
kind	skill
status	ready
provenance	{"principles":["P003","P009","P023","P029","P032","P039","P051","P057","P058","P066","P067","P068","P075","P090","P094"],"claims":["C00006","C00020","C00040","C00042","C00122","C00136","C00140","C00145","C00146","C00147","C00148","C00152"],"evidence":[],"source_anchors":[],"authored_from_digest":"2a6765ca05f97c45a586fe005a81fd627f9a9f58ea72bf21ee83534bccf70386"}

Building And Feeding The Deception

Purpose

Review the material a case feeds to its target and the discipline behind how that material is built and delivered, using Masterman's construction rules not as a playbook to follow but as the signature set a professionally run deception leaves behind in the evidence: verifiable seeding, credibility earned over a long truthful record, corroboration spread across many small and separately-sourced reports, and survivability under hostile scrutiny. The material under review may be a friendly plan or double-agent case awaiting its go-ahead, or a channel of uncertain control, where the working question is whether it is being fed a consistent, buildable story and whether its corroboration is too neat to be organic. This skill audits that construction and feed discipline in whatever material is presented to it; it never drafts, improves, or runs the deception itself.

When to use

• Draft or already-sent material aimed at a target needs checking for whether its conclusion is left to be deduced from a flow of genuine-looking reporting, rather than stated outright.
• A source's, channel's, or plan's credibility rests on a claim the target cannot yet check, and it is unclear whether a truthful track record or a verifiable seed underwrites it before the unverifiable part is trusted.
• A picture of the target's own forces, dispositions, or capabilities was assembled from many small facts, and it needs checking for whether those facts were left for the target to connect rather than handed over as one assertion.
• A channel of uncertain control is reporting in a way that looks suspiciously well-corroborated, well-timed, or plausible, and the analyst wants to test whether it is being fed a consistent, buildable story rather than reporting organically.
• Material touches something the target can independently verify, and whether the checkable parts were shaded or paired with one controlled falsification — rather than left fully exposed or fully fabricated — needs testing.
• Feed material was, or will be, collected through an interview, a tasking, or an agent's social access, and whether the collection method itself would tip the source to what the material is for needs checking.
• A double-agent case or deception plan's ability to sustain a channel long-term is in doubt — whether it has a clear policy and steady supply of usable feed material, or is already starved.

Procedure

1. Establish what is under review: the specific material said to be fed (a report, a plan's drafted product, a channel's traffic), who the target is, and whether the case is a friendly plan awaiting commitment or a channel whose control status is itself in question. Fix this before judging whether the construction is sound, suspicious, or simply absent.
2. Check whether the material's central claim is ever stated to the target outright, or whether it is left to be deduced from a flow of genuine-looking reporting the target already trusts; where a controlled channel is involved, check that it answers rather than volunteers, steering the target's future questions through the answers it gives rather than declaring the point itself (P003).
3. Confirm the credibility scaffolding behind any unverifiable claim: a long period of truthful, checkable reporting should precede it (P051), and a verifiable true report or an advance scoop the target cannot yet confirm but later will should be seeded ahead of the notional material, so the checkable parts carry the unverifiable ones (P029, P032). Treat the absence of this scaffolding as a finding in itself — a claim with no earned credibility behind it.
4. Weigh the corroboration pattern: a conclusion resting on many small, mutually corroborating reports from separately-sourced channels is more typical of a professionally built case than one explicit claim (P058). Where the material is a channel of uncertain control, ask the mirror question directly: is this channel being fed a consistent, buildable story, and is the corroboration too neat, too convenient, or too well-timed to be organic reporting?
5. Where the material builds a picture of the target's forces, dispositions, or capabilities, check that it is assembled from concrete, checkable facts — unit identifications, locations, assembly areas, corroborating logistics such as rail movement schedules obtained through plausible social access — left for the target to connect, rather than delivered as a single asserted conclusion (P009, P090).
6. Test whether the material would survive a thorough, skeptical review at the level of every phrase and every corroborating detail (P039), and check that the case accounts for the full overhead behind any item reaching the target: obtaining the material is only half the task, since most of what is collected does not clear an approving authority and the remainder must be plausibly reworked and approved before it is sent (P057).
7. Where the material reports on something the target can independently verify, check that it stays substantially accurate while shading only the details under control, minimising damage and suppressing actionable specifics (P066); and where the target can cross-check a single attribute such as timing or location, check that a real event is paired with the one falsified attribute the target will use for its own correction, rather than either a wholly exposed truth or a wholly fabricated event (P067).
8. Check whether the case accounts for what it does not control: an uncontrolled parallel source also reaching the target should be modelled, with the material's own reporting counter-biased against its effect, rather than ignored (P068); and a notional claim — such as a fictitious minefield — that happens to be corroborated by an unrelated real event should be flagged as a high-value coincidence to examine rather than accepted at face value, whichever side benefits from it (P094).

Inputs

• The specific material said to be, or proposed to be, fed to the target — a report, a plan's drafted product, or a channel's traffic — and where it sits in a larger flow of reporting.
• The channel's or plan's track record: how long it has been reporting, and how much of that record is independently checkable.
• Any claim in the material the target can, or will be able to, independently verify (a fact, a timestamp, a location), and what the material states about it.
• The wider corroboration picture: how many separately-sourced reports support the same conclusion, and whether their independence from each other and from the channel under review is established.
• Whether the material under review is a friendly plan or case awaiting commitment, or a channel whose control status is itself in question.
• Any known uncontrolled parallel source, chance real-world event, or approval and production process the material has passed, or will need to pass, through.

Output

Per finding: name the construction or feed flaw — a conclusion announced rather than deduced, a claim resting on no earned credibility, corroboration too sparse or, in the mirror direction, too neat to be organic, an order-of-battle picture handed over whole instead of assembled from disconnected facts, a checkable detail left fully exposed or fully fabricated instead of shaded or paired with one controlled falsification, an uncontrolled source or a corroborating coincidence left unexamined, or feed material collected in a way that would tip off the source — and the principle it violates. Apply the correction (embed the claim in genuine traffic and let the target deduce it; build or demand a truthful record and a verifiable seed before trusting the unverifiable part; require corroboration from several small, separately-sourced reports rather than one explicit claim; pair a checkable event with one controlled falsification rather than leaving it fully exposed or fully fabricated; model an uncontrolled parallel source and counter-bias against its effect; flag a too-convenient corroborating coincidence for scrutiny instead of accepting it at face value; route collection through a cover premise). State the residual uncertainty the correction leaves — including who could still be deceiving whom — and end with a concrete next step. Order findings highest-impact first. Never close with a bare go/no-go: the corrected judgment and the residual risk belong to the case's owner, not to this review.

Anti-patterns to flag

• A conclusion stated to the target outright instead of embedded in a flow of genuine reporting for the target to deduce, or a controlled channel volunteering the point instead of steering toward it through its answers (P003).
• Material run, or a channel trusted, with no clear policy for the steady feed material it needs to survive — a case treated as acquired before anyone could nourish it (P023).
• A claim resting entirely on unverifiable material, with no truthful track record and no verifiable seed or advance scoop established ahead of it (P051, P029, P032).
• A strategic conclusion asserted as one explicit claim instead of built from many small, separately-sourced, corroborating reports — or the opposite failure: corroboration so tidy and so convenient it reads as manufactured rather than organic (P058).
• An order-of-battle or capability picture handed over as a single assertion instead of assembled from concrete, checkable facts the target is left to connect (P009, P090).
• Material accepted without testing it against a thorough, skeptical review at the level of every phrase and corroborating detail, or a case that treats obtaining the feed as the whole task and skips the approval and rework overhead behind it (P039, P057).
• A verifiable report left fully exposed instead of shaded, or a cross-checkable attribute — timing, location — left wholly accurate instead of paired with the one controlled falsification (P066, P067).
• An uncontrolled parallel source noted but never modelled or counter-biased against (P068).
• A chance real-world event that happens to corroborate a notional claim treated as face-value proof instead of flagged as a coincidence needing scrutiny, whichever side it favours (P094).
• Feed material collected through an interview or tasking that would reveal to the source what it is for, instead of running through a cover premise (P075).

References

See ../../references/deception-detection-principles-index.md for the full principle catalogue. For adjacent concerns, see the sibling skills: assessing-enemy-trust-and-belief judges the belief this feed is meant to produce once it lands with the target; counter-deception-and-the-mirror turns this same construction discipline around to test whether the analyst's own side is the one being fed; turning-and-running-a-controlled-agent covers the agent-level mechanics — recruitment, motive, day-to-day control — that carry this feed to its target.

Provenance

Derived solely from P003, P009, P023, P029, P032, P039, P051, P057, P058, P066, P067, P068, P075, P090, and P094 (J. C. Masterman, The Double-Cross System; distillation-only — see the frontmatter above for the full principle and claim id list).