<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: investigation-attribution
description: >-
  Investigation and attribution techniques based on Bellingcat open-source
  intelligence methodology. Covers geolocation, chronolocation, financial
  analysis, corporate entity research, satellite imagery, vehicle tracking,
  social network analysis, conflict zone investigation, maritime tracking,
  sanctions screening, deepfake detection, and cross-platform identity
  correlation. Enables structured investigative workflows that produce
  court-admissible, peer-reviewable findings with full chain-of-evidence
  documentation.
domain: cybersecurity
subdomain: investigation-attribution
tags:
  - osint
  - bellingcat
  - geolocation
  - chronolocation
  - financial-investigation
  - corporate-research
  - satellite-analysis
  - vehicle-tracking
  - social-network-analysis
  - conflict-investigation
  - maritime-tracking
  - sanctions-screening
  - deepfake-detection
  - identity-correlation
  - attribution
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1593", "T1596", "T1589", "T1591", "T1592"]
  frameworks: ["Bellingcat Investigation Toolkit", "Berkeley Protocol", "MITRE ATT&CK", "OSINT Framework"]
---

# Investigation & Attribution

## When to Use

Activate when the operator asks about open-source investigations, geolocation
of imagery, chronolocation, financial record analysis, corporate entity mapping,
satellite imagery analysis, vehicle identification, social network graphing,
conflict zone documentation, maritime vessel tracking, sanctions compliance,
deepfake detection, or cross-platform identity correlation.

Mode: `[MODE: RECON]` for intelligence gathering; `[MODE: INCIDENT]` for active
investigation; `[MODE: PRIVACY]` for data handling compliance.

## Prerequisites

| Requirement | Install |
|---|---|
| ExifTool | `sudo apt install libimage-exiftool-perl` or `brew install exiftool` |
| Google Earth Pro | Desktop install from google.com/earth |
| Python 3.10+ | For agent tooling and analysis scripts |
| GDAL/OGR | `pip install gdal` for geospatial processing |
| NetworkX | `pip install networkx` for graph analysis |
| Selenium | `pip install selenium` for web scraping workflows |

## Quick Reference

```bash
# Extract EXIF geolocation from image
exiftool -gpslatitude -gpslongitude -DateTimeOriginal photo.jpg

# Calculate sun position for chronolocation
node agent.js sun-position --lat 48.8566 --lon 2.3522 --date 2026-03-15 --shadow-length 2.5

# Query OpenCorporates for entity
node agent.js corporate-lookup --name "Acme Holdings Ltd" --jurisdiction gb

# Track vessel via AIS data
node agent.js vessel-track --mmsi 211234567 --start 2026-01-01 --end 2026-03-01

# Build social network graph from collected data
node agent.js social-graph --input contacts.json --output graph.gexf

# Screen entity against sanctions lists
node agent.js sanctions-check --name "John Doe" --lists OFAC,EU,UN

# Analyze image for deepfake artifacts
node agent.js deepfake-scan --input suspect_video.mp4 --method ela

# Correlate identities across platforms
node agent.js identity-correlate --username "target_user" --platforms twitter,telegram,vk
```

## Workflow

### Investigation Lifecycle

```
1. SCOPE       — Define investigation question and legal boundaries
2. COLLECT     — Gather open-source materials with chain-of-custody
3. PRESERVE    — Archive with hashes, timestamps, Wayback snapshots
4. ANALYZE     — Apply technique-specific analysis (geo, chrono, financial)
5. CORROBORATE — Cross-reference findings across independent sources
6. ATTRIBUTE   — Build attribution chain with confidence levels
7. DOCUMENT    — Produce structured report with evidence appendix
8. VERIFY      — Peer review, counter-hypothesis testing
```

### Evidence Preservation Protocol

Every piece of collected evidence must include:

```
EVIDENCE-ID    : E-2026-0001
Source URL     : https://example.com/post/12345
Collection Time: 2026-03-18T09:00:00Z
SHA-256        : a3f2b8c9d1e4...
Archive URL    : https://web.archive.org/web/20260318.../
Collector      : [analyst handle]
Method         : Manual screenshot + HTTrack mirror
Notes          : Original post visible at time of collection
```

### Bellingcat Verification Framework

Apply the following to every claim:

| Check | Question |
|---|---|
| **Provenance** | Where did this material originate? |
| **Source** | Who created or uploaded it? What is their track record? |
| **Date** | When was it created? Does metadata match claimed date? |
| **Location** | Where was it captured? Do landmarks/shadows/signs confirm? |
| **Motivation** | Why was this shared? Who benefits from this narrative? |

### Finding Report Format

```
[INVESTIGATION-001]
Confidence : High | Medium | Low
Sources    : [count] independent sources corroborate
Methodology: [techniques applied]
Location   : [coordinates if applicable]
Timeframe  : [established date range]
Attribution: [entity/individual with confidence level]
Evidence   : [evidence IDs supporting finding]
Counter    : [alternative hypotheses considered and eliminated]
```

## Techniques

| # | Technique | Description |
|---|---|---|
| 1 | performing-geolocation-analysis | Determine location from imagery using landmarks, shadows, signage |
| 2 | conducting-chronolocation-investigation | Establish time/date from shadow analysis, sun position, metadata |
| 3 | analyzing-financial-records | Trace financial flows through public records and filings |
| 4 | performing-corporate-entity-research | Map corporate structures, beneficial ownership, shell companies |
| 5 | conducting-open-source-satellite-analysis | Analyze freely available satellite imagery for change detection |
| 6 | performing-vehicle-tracking-analysis | Identify and track vehicles from imagery and open data |
| 7 | conducting-social-network-analysis | Map relationships and influence networks from social media |
| 8 | performing-conflict-zone-investigation | Document events in conflict zones using open-source evidence |
| 9 | analyzing-shipping-and-maritime-data | Track vessels using AIS, port records, and satellite imagery |
| 10 | conducting-sanctions-screening | Screen entities against OFAC, EU, UN, and national sanctions lists |
| 11 | performing-deep-fake-detection | Detect AI-generated or manipulated media using forensic analysis |
| 12 | conducting-cross-platform-identity-correlation | Link identities across platforms using behavioral and metadata signals |

## Verification

```bash
# Verify ExifTool installation
exiftool -ver

# Verify Python dependencies
python3 -c "import networkx; import requests; print('Dependencies OK')"

# Run agent self-test
node agent.js --self-test

# Validate evidence hash
sha256sum -c evidence_manifest.sha256
```

## References

- [Bellingcat Online Investigation Toolkit](https://docs.google.com/spreadsheets/d/18rtqh8EG2q1xBo2cLNyhIDuK9jrPGwYr9DI2UncoqJQ)
- [Berkeley Protocol on Digital Open Source Investigations](https://www.ohchr.org/en/publications/policy-and-methodological-publications/berkeley-protocol-digital-open-source)
- [MITRE ATT&CK — Reconnaissance Tactics](https://attack.mitre.org/tactics/TA0043/)
- [OSINT Framework](https://osintframework.com/)
- [Bellingcat Geolocation Guide](https://www.bellingcat.com/resources/how-tos/2014/07/09/a-beginners-guide-to-geolocation/)
- [SunCalc — Sun Position Calculator](https://www.suncalc.org/)
- [OpenCorporates API](https://api.opencorporates.com/)
- [MarineTraffic API](https://www.marinetraffic.com/en/ais-api-services)
- [Sentinel Hub — Satellite Imagery](https://www.sentinel-hub.com/)
- [OFAC Sanctions Search](https://sanctionssearch.ofac.treas.gov/)
