physical-and-technical-deception-craft

name	physical-and-technical-deception-craft
description	Review the physical and technical construction of a plant — staged sabotage, planted documents, funding, and channel choice; use when reviewing this facet of a deception or counter-deception case.
kind	skill
status	ready
provenance	{"principles":["P018","P037","P041","P044","P046","P081","P082","P084","P085"],"claims":["C00033","C00124","C00125","C00171","C00209","C00211","C00212","C00213","C00220","C00221","C00222","C00224"],"evidence":[],"source_anchors":[],"authored_from_digest":"96faf1855649cc32aea5717816f77ef23816cc130b7183cca37ab78f7179be3c"}

Physical And Technical Deception Craft

Purpose

Audit whether the physical and technical construction behind a plant — a staged sabotage, a corpse or courier carrying planted documents, a discovery site, an exfiltration channel, a funding trail, or a claimed exaggeration of strength — carries the signatures a deliberately engineered deception must show, or instead the tells of an under-built one. Because a target can physically examine what has been planted, disciplined craft leaves survivable, corroborating evidence rather than destroying it, documents a fabricated personality as exhaustively as a real one, and routes its funding and channel choices so they do not expose the arrangement. This skill reviews the collected evidence chain, or a proposed friendly construction, against that craft standard — it is a lens for recognising the adversary's toolkit in what has been found, not a set of instructions for building one.

When to use

• A reported explosion, fire, "accident," or act of sabotage sits in the case record, and it needs testing for whether it carries the signature of a deliberate, controlled plant rather than a genuine hostile or accidental event.
• A corpse, courier, or dead-drop artefact anchors a claim, and the personality and documents built around it — letters, tickets, identity papers — need checking for whether they are exhaustively real enough to be believed.
• Physical evidence reached the adversary, or reached the analyst, through a discovery, and the site and the path by which it was found need testing for whether they were engineered rather than merely convenient.
• Material is crossing an exfiltration channel neither side fully controls — a diplomatic bag, a neutral's routine mail — and the record needs checking for whether that channel is being actively exploited or only passively tolerated.
• A quantitative claim — an exaggerated strength figure, or a fall-of-shot / battle- damage report shaping an aim correction — needs testing for whether its size and direction are disciplined and plausibly aimed, or instead an overreach or an unexplained asymmetry that gives it away.
• A funding arrangement or a piece of adversary-supplied equipment sits in the record, and it needs tracing for exposure risk or for signs of recycled captured matériel.
• The case's mix of communication channels looks concentrated on one technology, and it needs checking against the alternatives it may have abandoned.

Procedure

1. Test any reported sabotage, fire, or "accident" for the staged-plant signature: check whether it left surviving physical evidence that actually points to the claimed cause, whether the narrative given to investigators and the press was consistently steered toward that intended explanation, and whether it would plausibly raise real-world vigilance as a side benefit; flag as suspect a "too effective" destruction that would erase the very evidence needed to credit it — whether the item under review is an incident attributed to the adversary or a friendly cover-story draft awaiting approval (P018).
2. Test any corpse-, dead-drop-, or courier-carried document trail for the documented-personality signature: check whether the man behind the papers is built out with real, exhaustively consistent personal letters, tickets, and identity documents, because the documents are only believed if the man is — a thin or generic backstory is the tell of an under-built plant (P041).
3. Test the discovery of any physical artefact for the planting-site signature: check whether the site is one the adversary could plausibly access yet a thorough forensic pass would struggle to fully unpick, and whether more than one plausible path led to its discovery; a single, forensics-friendly, fragile discovery path is a tell that the find itself, not just its contents, may be staged (P085).
4. Test any material crossing a channel neither side fully controls — a diplomatic bag, a neutral's routine mail — for whether the record shows it being actively exploited, with content deliberately seeded into it, rather than merely tolerated as an unstoppable leak, and check whether a well-placed neutral courier's traffic has been examined for secret writing piggybacked on the courier's own legitimate outgoing correspondence (P037).
5. Test any quantitative claim feeding an adversary's targeting or order-of-battle picture for calibrated bias: check a fall-of-shot or battle-damage record for an unexplained directional asymmetry — over-reported overshoots against suppressed undershoots, or the reverse — consistent with steering a correction, and check any exaggerated strength claim against a disciplined bound on the order of ten percent, enough to mislead without straining credulity, flagging both an absent bias where one would be expected and an implausible overreach (P044, P081).
6. Trace the funding and equipment plumbing behind a controlled operation: check whether payments cross currencies through a plausible commercial exchange that would not expose the arrangement to a hostile auditor, and check any adversary-supplied equipment in the record — wireless sets, weapons, currency — for whether it has been examined as possibly recycled captured matériel from the reviewer's own side (P082, P084).
7. Check the case's communication channel mix for over-concentration on one technology: because the contest between interception and evasion keeps shifting, flag a plan or an observed channel choice that has abandoned personal contact or secret writing in favour of wireless alone, or the reverse, as carrying unexamined single-technology risk (P046).

Inputs

• The case record or plan under review: any reported sabotage, fire, or accident, with what physical evidence survived and how investigators or the press explained it.
• Any planted document, courier, or corpse-carried personality, with the letters, tickets, and identity papers built around it.
• The discovery circumstances of any physical artefact: the site, who could plausibly access it, and the path or paths by which it was found.
• Any material known to be crossing an uncontrolled exfiltration channel — a diplomatic bag, a neutral courier — and what is known about its content and use.
• Quantitative claims feeding the adversary's picture: strength figures, fall-of-shot or battle-damage reports, and their apparent bias or bound.
• The funding arrangement behind the operation and any adversary-supplied equipment entered into the record.
• The case's mix of communication channels and technologies in use or proposed.

Output

Per finding: name the physical/technical construction flaw (an evidence-destroying plant, an under-documented personality, a fragile or single-path discovery, an unexploited or unexamined uncontrolled channel, an uncalibrated quantitative claim, an exposed funding or equipment trail, a single-technology channel mix), apply the correction (re-engineer the artefact to survive scrutiny without destroying its own evidence, thicken the backstop documentation, add a redundant discovery path, actively exploit or inspect the channel, recompute the bias or the bound, route funding through a plausible exchange, diversify the channel mix), state the residual uncertainty the correction leaves — including who could still be deceiving whom — and end with a concrete next step. Order findings highest-impact first. Never issue a bare go/no-go on the plant or the case; the corrected judgment and the residual risk are handed back to the operation's owner.

Anti-patterns to flag

• A staged sabotage so clean or so destructive that it erases the very evidence needed to credit it, or an investigation or press narrative that does not match what the physical evidence actually supports (P018).
• A planted document trail resting on a corpse or courier whose personality is thin, generic, or inconsistent — documents asked to carry more belief than the man behind them can support (P041).
• A physical find whose discovery path is single, fragile, or oddly convenient, with no redundant route by which it could plausibly have been found (P085).
• An uncontrollable channel — diplomatic bag, neutral courier — left unexamined and unexploited: tolerated as a leak rather than checked for seeded content or secret writing riding on it (P037).
• A fall-of-shot or battle-damage record with an unexplained directional bias never checked for whether it is steering, or being steered by, an aim correction (P044).
• A strength claim stretched far beyond a disciplined bound on the order of ten percent, risking either implausibility or a misjudged credulity threshold (P081).
• A funding trail or adversary-issued equipment accepted at face value, never traced for exposure and never checked against the possibility of recycled captured matériel (P082, P084).
• A channel mix concentrated on a single communication technology, with older alternatives — personal contact, secret writing — abandoned rather than preserved as fallbacks (P046).

References

See ../../references/deception-detection-principles-index.md for the full principle catalogue. For adjacent concerns, see the sibling skills: building-and-feeding-the-deception covers the credibility of the message content once the physical vehicle is sound; network-security-and-compartmentation covers how the agent or channel carrying this artefact is isolated from the rest of the network; counter-deception-and-the-mirror covers whether this same physical and technical craft is being turned back on the reviewer's own side.

Provenance

Derived solely from P018, P037, P041, P044, P046, P081, P082, P084, and P085 (J. C. Masterman, The Double-Cross System; distillation-only; see the frontmatter above for the full principle and claim id list).