How do you detect circular reporting across three vendor write-ups of one campaign?
answer
- many copies, one origin
- count first-hand observations, not links
- shared typos and identical indicator order
- sort by publication time
- confirmation needs an independent observer
basics
~20 sTrace every report back to a first-hand observation. Compare indicator lists, screenshots, dates and repeated errors; check publication order and citations. If all three descend from one original write-up, you hold one source, not three, and corroboration was never earned.
solid answer
~50 sCircular reporting is when several apparently independent reports all descend from a single origin, so repetition gets mistaken for confirmation. I test each write-up by asking what its author observed themselves: an incident-response engagement, their own telemetry, their own sample. Then I look for shared fingerprints, an identical indicator list in the same order, the same screenshot, the same date error or typo carried forward, and I check the publication chronology and citations, including the case where the trail runs blog to aggregator to ISAC circulation and back to a vendor round-up. If everything traces to one blog, the credibility grade cannot be "confirmed by other sources"; it stays a single-source claim and my confidence stays low no matter how many times I have now read it. Genuine corroboration is a second party with its own observation, not a second party with a citation.
go deeper
Know the term and the shape of the problem: repetition is not confirmation. Be able to say you would look for the original write-up before treating three links as three sources.
An interviewer expects the detection method: trace to first-hand observation, compare indicator lists and repeated errors, sort by publication time, and follow citations through aggregators and member circulations.
Show what you do with the finding, collapsing copies to one graded entry, stating single-source status explicitly in the assessment, and naming the specific corroboration that would raise confidence.
Own the intake discipline that prevents your own team from becoming a link in the chain: provenance tagging on every item, and a rule that nothing you circulated can return as corroboration of your own judgement.
## What circular reporting is Circular reporting is the appearance of independent confirmation created by a single origin being re-published, summarised and re-summarised until the copies outnumber the original. It is the dominant evidence-hygiene failure in open-source threat intelligence, because the ecosystem is built to amplify: a vendor writes up a campaign, an aggregator condenses it, an ISAC circulates the condensation to members, a journalist reads the circulation, a second vendor cites the journalist in a quarterly round-up, and a fourth party now sees four sources agreeing. The damage is precise. In a two-axis grading scheme the top credibility grade means *confirmed by other sources*, and that grade is meaningless unless the other sources are independent. Circular reporting inflates credibility, which inflates the confidence attached to the published judgement, which is what an executive actually acts on. ## The test that decides it For each supporting report, ask one question: **what did this author observe first-hand, and would they have written this had the original never existed?** First-hand observation looks like: an incident-response engagement the author ran; a sample the author reverse-engineered; telemetry from the author's own sensors; a takedown notice the author filed; a leak-site listing the author archived themselves. Everything else is repetition. Repetition is not worthless — it tells you what the community believes — but it is not evidence about the world. ## Fingerprints of a shared origin - **An identical indicator list, in the same order**, including the same padding entries. Independent observations almost never produce identical sets; each observer sees a different slice. - **A propagated error**: a mistyped hash, a wrong date, a misspelt company name, a domain with a transposed character. An error is a marker. If three reports carry it, they carry it from one place. - **The same screenshot or the same phrasing**, especially a distinctive metaphor for the tradecraft. - **Chronology**: sort by publication timestamp. The later items usually contain no fact absent from the earliest one; that absence of new detail is itself the signal. - **Citations, including missing ones**: report B cites A; report C cites B without saying so; the ISAC bulletin has no citation at all because the author considered it common knowledge by then. - **Laundering through a private channel**: a journalist's direct message or a peer's Slack note feels like a new source, but the person may simply be describing what they read this morning. Ask them where it came from. ## What to do with the finding Collapse the copies to one entry in your holdings, record the origin, and grade it as the single source it is. Then say so explicitly in the assessment: *"Three public write-ups describe this campaign; all trace to one vendor blog of 3 March, and we have no independent corroboration."* That sentence is doing real work, because the reader's instinct on seeing three links is that the claim is settled. The correct response is not to dismiss the claim. A single first-hand vendor report from a competent team is often the best information that will ever exist about a campaign. The response is to keep confidence proportionate and to name what would actually raise it: a second organisation seeing the same activity in its own logs, a peer in your sector confirming from their own identity provider, the original author sharing the underlying artefacts. ## The mirror-image trap You can also become a link in someone else's chain. If your own product repeats an external claim, mark it as repeated and cite the origin, and never let a claim you passed on come back as external corroboration of your own assessment. Teams that do not tag provenance on intake reliably confirm themselves within a quarter. ## Where it bites hardest Breach claims about *your own* company. A public claim naming you gets copied across news aggregators within hours, and the volume of coverage feels like escalating evidence when nothing has been added since the first post. The count of articles is a measure of interest, never of truth.
- A peer messages you the same claim privately. Does that count as a second source?Only if they observed something themselves. A private channel feels like independent access but usually carries the same public write-up one hop later. Ask directly: did you see this in your own telemetry, or did you read it? If they read it, they are a copy, and the fact that they trust it tells you about sentiment in the community rather than about the campaign.
- What does genuine corroboration of a campaign look like?A second party with its own observation surface reporting the same behaviour: another organisation seeing the same sign-in pattern in its own identity provider, a second responder finding the same tooling in an unrelated engagement, a hosting provider confirming the infrastructure. The tell is that the second party's account contains details the first one did not have, because they were looking from somewhere else.
- How do you keep from becoming a link in someone else's circular chain?Tag provenance on intake and carry it into anything you publish: mark repeated claims as repeated, cite the origin rather than the intermediary, and never accept a claim you yourself circulated as external corroboration. Without provenance tags a team quietly confirms its own reporting within a quarter, and nobody can reconstruct why afterwards.
Four newspapers running the same wire story is not four witnesses. It is one witness and three photocopiers.
saying these in an interview costs you the question
- Counts reports instead of first-hand observations
- Treats an ISAC circulation as an independent source
- Says three vendors agreeing makes the claim confirmed
- Dismisses a single-source claim as automatically false
- Ignores publication order when weighing agreement
- Never records where an intake item originally came from