Facilitator Notes & Model Answers — Lesson 02
For instructors and self-study · Model reasoning, not the only correct answers
Lab — model evidence/inference split
| Clause | Type |
|---|---|
| Phishing domain registered and used within 72 hours | Evidence (observed) |
| Malware is a variant of a publicly documented toolkit | Evidence (observed) |
| C2 activity 06:00–15:00 UTC | Evidence (observed) |
| "State-sponsored actor, Group Vega" | Inference |
| "on behalf of a foreign government" | Inference (weaker still) |
| "premeditated operation to disrupt regional energy supply" | Assertion of intent — unsupported by the evidence |
| "high confidence" | A confidence label, not evidence |
Why the attribution is fragile
- Shared toolkit — "publicly documented" means many actors can use it; it is weak evidence of a specific group.
- Forgeable time zone — working-hours clustering can be faked or reflect borrowed infrastructure.
- False flag — a capable actor can plant Vega's fingerprints deliberately.
- Intent overreach — nothing observed shows purpose; "to disrupt energy supply" is narrative, not evidence.
Evidence that would raise confidence: unique (non-public) tooling, operational security mistakes linking to known infrastructure, corroboration from independent collection, and a stated analytic confidence with reasoning.
Step 3 decision — what good looks like
A strong leader defers the public statement, asks for the evidence-vs-inference split and the basis for "high confidence," and notes that the costly action (public attribution) is exactly the kind of decision that should never rest on forgeable signals. Acting cautiously here is not weakness; premature public attribution that is later contradicted is a credibility loss.
Homework — model answers
Task 1
Strong questions: "What did we observe versus infer?"; "What is the stated confidence and on what basis?"; "What would change this assessment?" Bad answers look like a restated headline, an unstated confidence level, or "the vendor says so."
Task 2
Any explicit keep/fix/cancel is acceptable if tied to decision-relevance. The teaching point: a feed that has never changed a decision is a cancel-or-fix candidate regardless of how impressive its volume metrics are.
Task 3
Good answers name a concrete check — a devil's-advocate role, a required evidence/inference split, or a confidence-level field — rather than an exhortation to "be careful."