Detecting disputed threat intelligence stories with the Anchored Narratives Theory
Applying a criminal evidence theory to regular mainstream news stories or threat intelligence
Disclaimer: The views, methods, and opinions expressed at Anchored Narratives are those of the author and do not necessarily reflect the official policy or position of my employer.
Background
In the Threat and Analytics team that I manage, we need to process a lot of information from multiple sources every day. Some of these sources are cyber threat intelligence stories shared via social media or mainstream media outlets. The sheer amount of (dis)information we need to process is huge and constant. Simultaneously, one of our core responsibilities is to provide our stakeholders reliable information and a clear course of action, proactively.
So how do you assess if a piece of intel is credible? What criteria could you use to distinguish between a disinformation campaign or a fake news story? I have seen many stories reported by media outlets that later appeared to be baseless and/or untrue but never saw them retracted. A telling example of such a story is an alleged supply chain attack on Super Micro that Bloomberg published in 2018. Apple and Amazon allegedly were also compromised. The story is still online, whereas evidence for the story has never been provided. The information security community has never found any evidence for the story. Other indicators that should raise red flags when reading these stories are quotes like the ones below:
"Has been reported"
"Officials briefed on intelligence reports"
“People familiar to the matter“
”Anonymous sources”
”Unnamed sources close to the investigation”Why should we believe these stories? These stories or scoops might have on a company's reputation or an individual can be tremendous. Are those producers of these stories ever held accountable? I would be lying if I’d say I have never been the victim of some media manipulation narrative that I believed. To counter being subject to these “fake news” stories, I usually apply a popular theory on criminal evidence, called the Anchored Narratives Theory (ANT). It is often used in criminal (digital) forensic investigations, but it can be applied to threat intelligence or as a technique for media deconstruction. This article will outline the theory and apply it briefly to an old case that went to the Supreme Court (Hoge Raad) in the Netherlands. I’ll reuse work from an old thesis (in Dutch) and update it where it is needed.
In subsequent articles on this website, ANT will be used as a framework to assess news articles or investigative cyber reporting on their evidential value. After applying ANT to those relevant “big stories,” sometimes it becomes obvious that many of those stories lack detail and context and could also be assessed as news with a different objective or fake news. So let’s start.
Forensic Investigations
Investigation happens after a crime or event. Its purpose is to establish the cause of the crime through truth-finding. Finding the truth can be seen as finding out what potentially happened.
The investigation is, therefore, often a reactive process. In the book “Recherche Portret” by C.J. de Poot and others, a crime is seen as a problem that must be solved.1 It is stated: “Problem-solving can be regarded as a process consisting of several phases or states. There is always an initial state, such as the unsolved crime, and an end state or goal, such as the solved crime.”2 Criminal Investigation begins with a thorough analysis of the problem. Only then are actions taken. Given the complex problems such as crimes, what actions to take must first be thoroughly analyzed to achieve the desired result. C.J. de Poot et al. indicate: “This selection process is driven by heuristic knowledge - a plan, a strategy, a scheme or a script that the solver has based on previous experiences with a similar problem or based on the training he has. enjoyed. This process is repeated until the final goal has been achieved: as a result of the initiated actions, a new problem situation always arises ”.3 Each time, subsequent actions must be reinterpreted to assess whether the set end goal has already been achieved.
Interpretation of problems
Solving crimes can thus be seen as an iterative process in which actions taken are compared repeatedly about the final goal. "Perception is interpretation, and people are poorly aware of their interpretation."4 Or that they make interpretations in the first place. Research by Chi, among others, has shown that how new complex problems are interpreted has to do with previous similar problems.5 “We use the characteristics of a problem to link it to problems with similar characteristics that we have encountered before. This link is the basis for the activation of a scheme. A scheme can be seen as a knowledge structure developed based on experiences in a particular domain. This experiential knowledge is organized in a diagram in such a way that all relevant knowledge that has been built up in the past in this domain can be used in the interpretation of new experiences. Schematics thus function as perception and interpretation frameworks.”6 New events are observed based on such a schedule. For example, every person has his own frame of reference and thus perceives events selectively. New observations are processed in such an existing scheme. There is a risk in this. Besides, people who have a lot of experience solving certain problems, such as experts, have a different approach than less experienced people. After all, they have a different frame of reference. Also, important information is recognized by people earlier when they have been in contact with the same information more often.
Another risk is that remarkable information is recognized and remembered better than non-remarkable information.
Reconstruction of events
One of the first phases in the criminal investigation after detecting a crime is reconstructing the investigation's events. Events are not random or isolated. A crime can be viewed as part of a general pattern or schedule of events. Some events are causally related to each other. For example, an argument can lead to a fight.
Besides, events are also connected in other ways. For example, a firearm purchase does not lead to a robbery, but people do recognize a firearm's purchase as part of a robbery pattern.7
People do make use of such science to interpret and reconstruct events. People tend to relate successive events.
For the reconstruction of events in a criminal investigation, you depend on the information that is known about the crime. For example, some crimes can be easily reconstructed from the stories of the victims.
When there are no witnesses, the whole story of the crime must be reconstructed from observable consequences. Of course, traces of the victim and the perpetrator remain. More and more traces are left in daily traffic. Events can be reconstructed, for example, in computer systems, recorded camera images, telephone print data, mobile phone location data, or data from financial transactions.
This reconstruction of events is investigated in the search process of a criminal investigation based on the crime story's core elements.8 In the event of a robbery, the core elements consist of the victims, descriptions of the perpetrators, loot was taken, offenses committed, a place of action, and a time at which the offenses were committed.
The observable consequences of the crime are, as it were, placed in a framework of the story with various core elements. These core elements of the story largely determine the search areas for the (search) actions to be performed. “The core elements that determine the mainline of the story are: 'Who plays a role in this story?', 'Where and when did this story take place?' and "What act actually happened?"9 The research actions can be classified into so-called search lines. "Search lines are investigative steps that are taken to establish a link between the information found in a specific search area and the event that is being investigated or to be able to establish a link between known and unknown information about a crime."10. During the investigation, these search lines must be investigated to fill in the story further and get as close as possible to a true story.
As the criminal investigation progresses, the story is further elaborated (reconstructed) based on the (search) actions, statements of witnesses or suspects, neighborhood investigation, technical investigation, digital forensic investigation, observations, wiretapping, etc., how the crime has been accomplished.
"Investigations are thus to a greater or lesser extent dominated by a reconstruction phase, in which (part of) the story that has taken place must be reconstructed, and a verification phase in which information is sought to prove this story."11 New information is used in the criminal investigation to test a reconstructed story and further expand, adjust, and reconstruct it.
Of course, crimes don't just happen. They need an initiator, the culprit(s). In this way, you could say that the perpetrator and the crime are linked and must therefore be a suspect at the end of the criminal investigation.
Stories
Why are stories important? Stories help us understand relevant events. As mentioned above, a lot of research has happened on why people like stories. The majority of criminal investigations can be explained like a good story based on the investigators' proof in their report. Everything in the story or scenario should be accurate. A story or a scenario contains a central action and a scene that helps us understand that action. Such a scenario can contain more elements and could be categorized under the following elements of a story: scene, motive, action, actor, and consequences.12 A scenario can tell a whole story, but it can also be a simple statement where a lot of information is left out. For example, Daniel sends an angry e-mail to a friend. Such a statement holds implicit information like Peter is a man and using an e-mail client to produce the e-mail. The statement also lacks detail and raises many questions. Every story or criminal case begins with a starting point or a certain state of affairs.
Anchored Narratives Theory
So what is the Anchored Narratives Theory? An investigator reconstructs the crime's events to be investigated based on the clues also found by answering the crucial questions above. This reconstruction is also called 'the story' or scenario. In most cases, the clues are not immediately sufficient to make the story drawn up as credible. The clues, and the relationship between the clues and the reconstruction, must be supported by other evidence in a recursive process. This usually means that a story or scenario contains sub-stories or sub-scenarios. At one point, the evidence is so strong that reasonable people no longer question it. The theory is displayed below in figure 1.
“These sub-scenarios, when accepted, form the evidence in the case that in the end are anchored in generally accepted knowledge about the world. Not all sub-scenarios are anchored in world knowledge, because sometimes sub-scenarios are accepted with proper vetting its veracity”.13 See the middle strand in figure 1.
Crombag et al. state, among other things, that:
“Stories consist of hierarchies of nested sub-stories. This also applies to evidence such as documents and witness statements: with every piece of evidence, there is a story containing information about its evidential value.
The decision-maker is free to decide at any level of the hierarchy of sub-stories whether he will accept or reject that story and everything above it as true.
Accepting a (partial) story as true is done by taking a general rule as true, under which the (partial) story to be accepted as true can be subsumed. These general rules form the (partial) story's anchors: the subsuming of a concrete (partial) story under such a rule forms its anchoring.
The deeper the decision-maker descends in the hierarchy of narratives, the more specific the general rule should serve as an anchor.
The more specific the general rule for which one is anchored, the safer the anchorage is, the more confidence one can have in the decision to accept that rule as true or to reject it as too unlikely.
A person who has an interest in a decision other than that taken can defend himself against a decision taken in this way in two ways: either contest the general validity of the rule that serves as an anchor or argue that this is an exception.
The higher the level of the hierarchy of the sub-stories on which a decision is made, the more general the general rule for which one is anchored and the unsafe or riskier the decision.”14
From the above, it can be concluded that the sooner one anchors, the greater the chance of a wrong decision. When the decision is taken at an increasingly lower level when one descends deeper into the hierarchy of sub-stories, more evidence is gathered, and less risk is run. The decision then offers more certainty.
Crombag et al. further state about their theory:
“We present the evidence decision as subsumption of the concrete case under a general rule, thus as a deductive reasoning process. However, the deductive character of the logic used is largely apparent: the thought process's starting point is not the general rule. The starting point is the concrete case or part of it. One wonders whether a generalization can be conceived of which the concrete case could be an example and trust the validity. People are very adept at this: it is how we explain all kinds of unexpected events that happen to us or that we observe. People don't like an incomprehensible world. So they usually look for and find an explanation for everything in the form of a generally applicable rule.”15
Besides, Crombag et al. indicate: “An additional risk arises because people usually do not explicitly realize what the general rule for which they are anchoring is. It usually remains unspoken and therefore usually ill-considered.”16
Crombag et al. argue that: "Anchors are attached to facts of general knowledge that do not require proof."17 In criminal proceedings, frequent use is made of 'facts of common knowledge.’ They then give examples of these so-called 'facts of general knowledge'’ summarized below:
Witnesses under oath rarely lie.
Witnesses who have an interest in lying often do so.
Witnesses who have had plenty of time and opportunity to observe a crime are usually not mistaken.
When two witnesses independently declare the same thing, they are usually telling the truth.
Most mentally disabled people cannot lie.
Suspects who confess at any point usually tell the truth.
Sometimes a suspect's confession is untrue.
Once a thief, always a thief.
Women who claim to have been raped rarely lie.
The forensic laboratory rarely makes mistakes.18
The police rarely commit fraud when drawing up official reports.”19
According to ANT, the investigation process is aimed at arriving at a credible and anchored story. If the criminal investigation is started with a credible story, the detectives must look for evidence. If a story of mediocre quality is started, it must first be transformed into a credible story.7
This process has been referred to by Crombag et al. as anchoring the story in reality.20 So once the evidence is so strong, the problem is considered solved. The reconstruction of events during a forensic investigation is displayed below in figure 2.
The 7 golden W questions
To make the story a credible story, the story of a crime must be reconstructed based on the 7 golden W questions.21
This concerns the following questions: “
Who can be associated with the crime?
What exactly happened?
Where did the crime take place, and where are traces left?
What was the crime committed with?
How did the crime take place?
When did the crime take place?
Why did the crime take place? ” (For example, what is the cause, motive of the crime)
When these questions can be answered, one speaks of a story of sufficient quality, and the ultimate goal of the investigation process has been achieved, and the crime has been proven for them. A criminal investigation will then have resulted in a suspect or person involved (under civil law). If an answer can be given to the above questions, the suspect or person's motive must also become clear. But what drives a perpetrator? Why did someone commit the crime? The same questions can, of course, be leveraged from a threat intelligence perspective or breaking news stories. But what kind of criteria for evidence must these stories be based on?
Criteria for evidence
In the theory of Crombag et al., the narrative should be reconstructed based on evidence. But what criteria must evidence meet? Schum argues that evidence has three core properties, namely relevance, credibility, and probative force.22 These properties of evidence are not orthogonal, and the proof is relevant and credible if it has probative value.
Relevance
For the relevance of evidence, the detective or investigator should ask himself whether there is a relationship between the evidence found and the crime and whether the evidence contributes to the investigation's main thesis.
Credibility
After it has been decided that the evidence matters, the investigator or decision-maker should consider whether he/she can believe what the evidence states.
To determine the credibility of evidence, a distinction must be made between tangible evidence and witness evidence. There are different criteria for its credibility for both types of evidence. The following criteria apply to witness evidence, 1) the credibility of the witness, 2) the objectivity of the witness, and 3) the witness's powers of observation.
For tangible evidence, the so-called pieces of conviction apply, for example, the weapon that would have been used in a robbery, DNA evidence, documents and files (digital evidence), etcetera.
The main criteria for tangible evidence, according to Anderson et al., are authenticity, correctness, and reliability.23 The detective or investigator must verify the authenticity of the evidence. Anderson et al. list three dangers to the authenticity of the evidence, namely:
the evidence may have been deliberately manipulated to mislead;
errors may have arisen in evidence or data by performing investigative actions, such as securing, transporting, and analyzing the evidence;
the witness or expert confirming the authenticity of the evidence may misinterpret or misunderstand the evidence.
The evidence's reliability and correctness properties apply how correct is what is represented by a particular research method. Something is generally considered reliable if the study's outcomes are consistent and produce the same results repeatedly.
Weight of evidence
After the evidence's relevance and credibility have been determined within a criminal investigation, the final characteristic must be determined, namely the weight of evidence. According to Anderson, objectively determining the power of evidence is the most complicated feature of the aforementioned three.24 Schum states that all conclusions based on evidence have a certain degree of probability.
He cites five reasons for this”:
evidence is always incomplete (we never have it all to be completely sure);
more than one conclusion is usually possible;
evidence is often ambiguous or inaccurate;
evidence often contradicts each other;
evidence comes from sources that can have any degree of credibility.”25
Now we understand the Anchored Narratives Theory and the criteria for evidence, let’s apply it to a legal case that eventually made it to the Supreme Court in the Netherlands
The case of the fake Versatel press release
The Versatel case was a mainstream news story that affected the stock price of a company called Versatel in the Netherlands in July 2005.26 The original press release (below) was obtained from the court trial and has been translated from Dutch into English.27
During the night of 14 juli 2005, two men sent eighteen forged press releases to news agencies by e-mail. The press release states that there are takeover talks between the companies Talpa, Deutsche Telecom and Versatel. None of the press releases turns out to be true. After publication of the news story,stock prices of Verstal rose and that was exactly what the gentlemen had in mind. One of them had bought call options in advance. These events have been reconstructed by conducting a criminal investigation and digital forensics. The digital forensic investigation determined that the sender addresses had been misused and the email was not sent by the said press officers but from a hotel. The hotel porter recognized one of the suspects, a well-known former lawyer in the video images.Now assume the following: You are a journalist, you work the night shift, and you receive the below email with a press release from Versatel on the night mentioned.
This press release states takeover talks are underway between telecom company Versatel, Deutsche Telekom, and investor Talpa. The email was prepared by the regular Versatel press officers and seemed authentic.
Is this a credible story? Versatel was a listed company, and there were takeover plans by some interested parties. This is, of course, big news. But how reliable is this story?
From the field of investigation or auditing, you could argue that reality is the norm. The above story should be tested by anchoring the story in reality with evidence about the indicated events. Let's consider how the journalist can decide.
The first thing the journalist considers is: "The telecom companies are merging because that is stated in an e-mail with the press officers of these companies as the sender."
He could settle for that. In that case, the anchoring of his consideration is apparently the general rule: "The message in an email from a press officer of a telecom company is usually true."
If the journalist is a little more critical, he may wonder whether this anchorage is sufficient. Then he can make the anchoring a bit more solid with more specific rules.
The first general rule contains two assumptions: 1) the email comes from the telecom company's press officer, and 2) What the telecom company's press officer writes is true.
Both assumptions can be anchored in reality by descending a level below the original level. For example, the journalist can call the press officer to ask if the e-mail message is correct. Then assumption 1 is anchored in the more specific assumption: "If someone says on the phone that an email is from him, then that email is from that person."
The second assumption can be anchored in another consideration, such as: “I know this press officer as a reliable man. Announcements from this press officer are usually true. ”
The journalist could also investigate whether the press release is authentic or whether the press release is forged. The authenticity of the press release could have been established by the journalist, among other things, by examining the so-called e-mail headers of the message.
By examining the email header, the journalist could determine that the sender addresses have been manipulated. The email messages were not sent from Versatel's network but from a website called ‘www.shitzooi.nl.’
For example, the journalist could descend ever deeper to gather evidence to make the final (evidence) decision and anchor the story in reality, in this case, publish or not publish. In the final verdict and after the criminal investigation, it became clear that two people, one of them an ex-lawyer, were involved, where one also bought call options and confessed.
Eventually, the criminal investigation was anchored with credible evidence by investigating the traces and obtaining more details. Of course, these news stories are much more time-critical. After the main news agencies shared the initial fake press release in the Netherlands, they retracted the story the same day by following up with the press officers, and the press release was retracted. However, the result of the fake press release did raise the stock price of Versatel by 5% that day. If the journalist applied some simple verification tests, it could have resulted in an interesting investigative journalism piece.
In this case, the evidence, a confession of one of the suspects, digital evidence, and video footage has been overwhelming and very compelling in the suspects' guilty scenario. The only thing that eventually was not proven in court was price manipulation, as one of the subjects bought call options that lasted 5 days.28 In contrast, this scam was already discovered on the first day by the news agency.
To make stories or scenarios and their evidence stronger, it is important to investigate an alternative scenario. For example, others forced the two suspects in the Versatel case to draft the fake press release and send the e-mail. Searching for evidence for such an alternative scenario can also be seen as falsification.29 If the falsification has been properly conducted and no information has been found that proves the alternative scenario, this may actually make the originally found evidence stronger. It actually makes the suspect’s scenario more likely. Any failed attempt at falsification supports the suspect scenario.
Conclusion
In this article, I have shared the Anchored Narratives Theory, the criteria for evidence and applied it to the case of the famous fake Versatel press release that raised its share price for a day. ANT, as demonstrated, can easily be applied to threat intelligence reports or as a media deconstruction methodology. Of course, news travels fast, but evidence, especially for breaking news or any other story that has a potential risk on the reputation of a company or individual, should have strong, anchored evidence, similar as in criminal cases.
Normally where the evidence in a criminal case is less telling and has a lot of media coverage, the investigation is prone to error. In these criminal cases, the alternative scenarios are not properly investigated and could lead to wrongful convictions. An alternative scenario, in this case, could have been that others forced the two suspects to draft and share the fake press release by e-mail, where others would have benefitted from the scam. By investigating such an alternative scenario, evidence might be getting stronger or weaker for the relevant scenario. Basically, it becomes a comparison of which scenario is the preferred scenario given the evidence. The same method can be applied to breaking news stories or threat intelligence. This could result in fewer scoops or breaking news as many of the breaking news stories are usually based on “sources familiar to the investigation.” The problem with these stories is that the sources “familiar to the investigation” are not going on the record to adjust that story. So from a threat intelligence perspective, it is important to understand who benefits from these publications. With ANT, it becomes straightforward to detect disputed threat intelligence stories.
This method will be applied to subsequent recent threat intelligence or main news articles on this website. Reach out if you doubt a certain threat intelligence story that is worth exploring.
Bibliography
Anderson, T. J., Schum, D. A., & Twining, W. L. (2005). Analysis of evidence (2nd ed.). Cambridge: Cambridge University Press.
Binder, D. A., & Bergman, P. (1984). Fact investigation: From hypothesis to proof. St. Paul, MI: West.
Chi, M. T. H., Feltovich, P. J., & Glaser, R. (1981). Categorization and representation of physics problems by experts and novices. Cognitive Science, 5, 121-152.
Crombag, H. F. M., Van Koppen, P. J., & Wagenaar, W. A. (1992). Dubieuze zaken: De psychologie van strafrechtelijk bewijs [Dubious cases: The psychology of criminal evidence]. Amsterdam: Contact.
Van Koppen, P. J., & Mackor, A. R. (2020). A scenario-approach to the Simonshaven case. Topics in Cognitive Science, 12, 1132-1151.
Pennington, N., & Hastie, R. (1993). The story model for juror decision making. In R. Hastie (Ed.), Inside the jury: The psychology of juror decision making (2nd ed., pp. 192-221). Cambridge: Cambridge University Press.
Popper, K. R. (1963). Conjectures and refutations: The growth of scientific knowledge. London: Routledge & Keagan Paul
De Poot, C. J., Bokhorst, R. J., Van Koppen, P. J., & Muller, E. R. (2004). Rechercheportret: Over dilemma's in de opsporing [Detectives' portrait: On dilemma’s in police investigations]. Alphen aan den Rijn: Kluwer.
Schum, D. A. (2005). A Wigmorean interpretation of the evaluation of a complicated pattern of evidence: Technical report, http://tinyurl.com/2a3elq.
Wessel, I., & Wolters, G. (2017). Het geheugen van getuigen: Herinneren, vergeten en vergissen [The memory of witnesses: Recall, forget and mistake]. In P. J. Van Koppen, J. W. De Keijser, R. Horselenberg & M. Jelicic (Eds.), Routes van het recht: Over de rechtspsychologie (pp. 493-511). Den Haag: Boom juridisch.
Wolters, G. (2002). Herinneren door getuigen [The memory of witnesses]. In P. J. van Koppen, D. J. Hessing, H. Merckelbach & H. F. M. Crombag (Eds.), Het recht van binnen: Psychologie van het recht (pp. 397-415). Deventer: Kluwer.
C.J. De Poot, R.J. Bokhorst, P.J. Van Koppen & E.R. Muller (2004) Rechercheportret: Over dilemma's in de opsporing. Alphen aan den Rijn: Kluwer, chapter 1
Ibid, p. 24
Ibid, p. 25
I. Wessel & G. Wolters (2017) Het geheugen van getuigen: Herinneren, vergeten en vergissen[The memory of witnesses: Recall, forget and mistake]. In: P.J. Van Koppen, J.W. De Keijser, R. Horselenberg & M. Jelicic (red.), Routes van het recht: Over de rechtspsychologie (pp. 493-511). Den Haag: Boom juridisch
M.T.H. Chi, P.J. Feltovich & R. Glaser (1981) Categorization and representation of physics problems by experts and novices. Cognitive Science, 5, 121-15C.J. De Poot, R.J. Bokhorst, P.J. Van Koppen & E.R. Muller (2004) Rechercheportret: Over dilemma's in de opsporing. Alphen aan den Rijn: p. 26
C.J. De Poot, R.J. Bokhorst, P.J. Van Koppen & E.R. Muller (2004) Rechercheportret: Over dilemma's in de opsporing. Alphen aan den Rijn: Kluwer, p 29
D.A. Binder & P. Bergman (1984) Fact investigation: From hypothesis to proof. St. Paul, MI: West
C.J. De Poot, R.J. Bokhorst, P.J. Van Koppen & E.R. Muller (2004) Rechercheportret: Over dilemma's in de opsporing. Alphen aan den Rijn: Kluwer p. 43
Ibid., p. 43
C.J. De Poot, R.J. Bokhorst, P.J. Van Koppen & E.R. Muller (2004) Rechercheportret: Over dilemma's in de opsporing. Alphen aan den Rijn: Kluwer p. 61
Ibid, p. 65
Ibid, p. 62
Ibid, p. 47
N. Pennington & R. Hastie (1993) The story model for juror decision making. In: R. Hastie (red.), Inside the jury: The psychology of juror decision making (2nd ed., pp. 192-221). Cambridge: Cambridge University Press
Peter J. van Koppen, Anne Ruth Mackor, 2019, A Scenario Approach to the Simonshaven Case, p. 1137
H.F.M. Crombag, P.J. Van Koppen & W.A. Wagenaar (1992) Dubieuze zaken: De psychologie van strafrechtelijk bewijs. Amsterdam: Contact, p. 72-73
Ibid, p. 73
Ibid, p. 74
Ibid, p. 75
The judicial lab has been called NFI (Dutch Forensic Institute) since 1999
H.F.M. Crombag, P.J. Van Koppen & W.A. Wagenaar (1992) Dubieuze zaken: De psychologie van strafrechtelijk bewijs. Amsterdam: Contact, p 75
H.F.M. Crombag, P.J. Van Koppen & W.A. Wagenaar (1992) Dubieuze zaken: De psychologie van strafrechtelijk bewijs. Amsterdam: Contact, chapter 3
C.J. De Poot, R.J. Bokhorst, P.J. Van Koppen & E.R. Muller (2004) Rechercheportret: Over dilemma's in de opsporing. Alphen aan den Rijn: Kluwerp. 373
D.A. Schum (2005) A Wigmorean interpretation of the evaluation of a complicated pattern of evidence: Technical report, http://tinyurl.com/2a3elq
T.J. Anderson, D.A. Schum & W.L. Twining (2005) Analysis of evidence (2nd ed.). Cambridge: Cambridge University Press p. 64
Ibid, p. 71
D.A. Schum (2005) A Wigmorean interpretation of the evaluation of a complicated pattern of evidence: Technical report, http://tinyurl.com/2a3elq
Website: https://www.trouw.nl/nieuws/vals-persbericht-over-versatel-beroert-beurs~b7c019e5/ accessed on 6 March 2021.
LJN case: AZ3564, https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:PHR:2014:507, Accessed on 6 March 2021,
Popper, K. R. (1963). Conjectures and refutations: The growth of scientific knowledge. London: Routledge & Keagan Paul