Five Intake Red Flags

Core idea

Investigations succeed or fail at intake, before they begin. These five red flags do not mean reject the case, they mean fix the intake before scoping, so the investigation is anchored properly. Each flag has a specific fix.

Components

• Vague or shifting objectives (“we want everything on this person,” or a goal that keeps changing) -> Fix: refuse to scope until a concrete, written objective is agreed in the language of investigation goals. Both blockchain and OSINT datasets are essentially infinite, so a clear end-point is essential.
• Incomplete or missing evidence (no addresses, screenshots, timestamps, communications) -> Fix: produce an evidence gap list; triage cannot proceed until gaps are filled or the objective is revised to match the evidence that exists.
• Unrealistic expectations (attribution assumed guaranteed, perfect mixer/hidden-service tracing, overnight results) -> Fix: reset expectations early with examples of what is and isn’t reachable, in writing.
• Conflicting stakeholder interests (legal wants minimal evidence, compliance wants intelligence, leadership wants attribution) -> Fix: identify every stakeholder and document the primary audience for the deliverable; secondary outputs come later.
• Hidden constraints (undisclosed deadlines, jurisdiction issues, resource limits) -> Fix: ask explicitly on day one about deadlines, budget caps, legal authority, jurisdictions.

When to use

On first contact with a new case, before agreeing scope or beginning analysis.

Example

A client says “give us everything on this person” and changes the goal mid-conversation, flag vague/shifting objectives and refuse to scope until a written objective is agreed.

Related

Intake Triage Checklist, The Scope Triangle, Translate Stakeholder Wants into Investigable Questions, Case Tractability: When to Decline