How should uncertain findings be expressed?¶

Uncertain findings should be expressed using language that reflects the strength and limits of the evidence.

Evidential caution: that cautious language weakens an investigation.

What this means¶

Useful distinctions include:

confirmed;

strongly supported;

supported;

consistent with;

possible;

not established;

contradicted;

unknown.

what evidence supports the finding;

what evidence is missing;

whether the conclusion depends on an assumption;

what further evidence could resolve it.

Avoid using technical terms as substitutes for certainty.

For example:

“Beaconing was observed” may be confirmed.

“Interactive command and control occurred” may be supported.

“The named person operated it” may remain unproven.

Likewise, do not present every theoretical possibility as equally likely.

The report should identify the most supported explanation while preserving credible alternatives.

Where provider or specialist interpretation is relied upon, state that dependency.

Confidence language should be applied consistently across the investigation. If similar evidence is described as confirmed in one section and merely possible in another, explain the difference. A conclusion can also change as new evidence arrives, so preserve the reasoning and date of each assessment.

================================================================================

What to check or do next¶

• Investigators should explain:
• Do not use vague phrases such as “clearly” or “obviously” without showing the evidence.

Evidential limits¶

It does not.

Clear uncertainty improves accuracy and defensibility.

what alternative explanation remains;

Uncertainty should not be placed only in footnotes. If a central conclusion depends on incomplete logs, an unverified provider interpretation or an inferred link, that limitation should appear beside the conclusion and in the operational summary. The operational takeaway is:

Match the wording of each conclusion to the actual evidential strength, and explain the limits and alternatives rather than hiding uncertainty.