A wrongly attributed answer circulated for weeks with no record of who saw the source chip: what can you honestly claim about impact?

## The question behind the question When a claim has been travelling under somebody else's name, the first thing asked of a lead is a number. How many people saw it. The honest answer is that the product measured the answer, not the reading of it, and that is a structural gap rather than an oversight to apologise for. Handling this well is mostly about refusing to invent the missing number while still being useful. ## What you can legitimately state - **A window.** Roughly when the planted page became reachable and when it stopped being fetched or cited. Both ends are approximate, and the earlier end is usually softer than the later one. - **An upper bound on displays.** How many answers in that window could have carried the chip, from whatever the product does record about answers produced on that topic. - **The artefact.** What the page declared about itself and what the strip rendered, if the fetched text was retained. This is the part that makes the account credible to anyone outside the team. Every one of these is a ceiling, and each should be spoken as a ceiling. 'At most this many answers could have shown it' is a defensible sentence; the same number without the qualifier is not. ## What you must decline to claim Reach, belief and repetition. Nobody recorded who glanced at the strip, who clicked through, who came away persuaded, or who forwarded the claim onward with the institution's name attached - and it is that last step, outside your product entirely, where the harm actually accumulates. A lead who supplies a confident figure here has manufactured the most quotable line in the incident, and it will outlive every caveat attached to it. The corresponding discipline is to say plainly that **no evidence of spread is not evidence of no spread**. The absence of a click record is an absence of measurement. People will hear those as the same sentence unless you separate them explicitly. ## The disclosure call This is the judgement that is genuinely yours, and it is uncomfortable because the injured party is not your customer. An institution's name was fixed to a claim it never made, in a surface readers treat as verification. Arguments on each side, both real: - **For telling them.** They carry the reputational cost, they may already be fielding questions about a statement they never issued, and they are the only party who can correct the record on their own channels. Telling them late, after they have discovered it another way, converts a technical failure into a relationship failure. - **For hesitating.** Disclosure with no bound on reach may amplify a claim that was barely seen, and you will be handing over an account you cannot quantify. That is a reason to be careful about *how* you tell them, not a reason to stay silent. The common failure is deciding this on the basis of the missing number - waiting for reach data that is never going to exist. Decide it on the strength of the artefact instead, since what you can show is that a page declaring their name carried a claim they did not make and was cited beside your product's answer. ## Bug or design limit The other call is whether this is a defect the organisation owns or an accepted property of the product. Rendering provenance that a fetched page declares about itself is not an implementation mistake; it is what the surface has always done, and it has been shipping in that shape since launch. Deciding it is a limit means saying so on the record and accepting that the next one is foreseeable. Deciding it is a defect means owning what changes and who funds that, in a product where text is the only thing that leaves and the surface is the entire user-facing value. Either answer can be defended. What cannot be defended is leaving it undecided, because an undecided call becomes a per-incident argument every time, and each argument restarts from the same missing number. ## What a red-team programme should take from it One durable lesson: for a class where the harm lands outside your product and outside your telemetry, the measurement you wish you had is not one you can collect after the fact. That should shape what you claim in advance about what a programme can detect, rather than being discovered again during the next incident with an executive waiting for a figure. ## How to answer Give the two things you can state and label them ceilings; name the three things you cannot and refuse to estimate them; separate unmeasured from zero out loud; then move to the two decisions that are actually yours - telling the impersonated institution, and settling whether this is a defect or an accepted limit.