Talking Tradecraft Part 3: How Experienced Investigators Think

Lessons from the practitioners who helped shape Insights Investigator

Every investigation starts the same way: with uncertainty. The facts are incomplete. The signal is buried in the noise. The most important pieces of information are often the ones you haven't found yet.

Yet experienced investigators consistently arrive at better conclusions than less experienced analysts working with the same information. The difference is in how they think.

For this final installment of the Talking Tradecraft series, we spoke with current and former intelligence practitioners, investigators, and law enforcement professionals across Babel Street to understand how they approach investigations, avoid common mistakes, and transform information into actionable intelligence.

Their backgrounds vary, but their advice was remarkably consistent: great investigations are built on disciplined thinking, not just better tools.

In part 1 of our series, we explored our leaders’ views of tradecraft and what it means in the agentic AI era.

In part 2, we discussed how Babel Street incorporates tradecraft into Insights Investigator workflows.

Here in part 3, we spoke with our practitioners to learn the rules they follow for sound investigative tradecraft.

Start with the investigative question, not the data

One of the clearest themes that emerged from our conversations is that experienced investigators do not begin with databases. They begin with a problem.

Multiple practitioners described investigations as exercises in understanding intent before collecting information. Ryan Shidaker compared investigations to the scientific method, “I try to think of everything like the scientific method. You always have that hypothesis that you're trying to solve.” As with any science, “The better questions you can ask, the better results you're going to get.”

Rebecca Rumptz expressed a similar idea from a law-enforcement perspective, where she noted, “Investigations come from leads or sources. You must have an initial basis of suspicion.”

Whether the objective is assessing risk to an executive, investigating suspicious activity, analyzing emerging geopolitical developments, or understanding a potential threat, effective investigations begin by clearly defining the question. The experienced investigators we spoke with don't start with data. They start with purpose.

Follow the evidence, not a fixed investigative process

Investigations rarely follow a predetermined path; they evolve as new information emerges. Several practitioners described investigations as a series of pivots in which each discovery creates new investigative opportunities.

Spencer Milligan explained, “No matter what sort of data you're starting with, there is an entry point into the investigative process.”

A seemingly insignificant fact may become the key that unlocks an entirely new line of inquiry. A company may lead to a person. A person may lead to an online identity. An online identity may reveal relationships, business interests, or indicators of risk. Spencer called these points the “golden eggs” that lead to the next avenue of inquiry.

The lesson is simple: investigations are not linear. Experienced analysts understand how to move from one clue to the next while continually reevaluating where the evidence leads.

Cast a wide investigative net, then narrow deliberately

Another recurring theme was the importance of balancing broad collection with focused analysis. Ethan Cravens said that he liked to cast a wide net at first to build his understanding of the situation. By examining a broad set of information sources, investigators gain context before narrowing their attention to the signals that matter most.

For example, an analyst monitoring a developing event may initially examine social media activity, news reporting, public communications, and regional sources before focusing on specific actors, narratives, or threat indicators.

Only after understanding the broader information environment do experienced investigators begin aggressively filtering and refining. They know that narrowing too early can cause them to miss the piece of information that changes everything.

Never trust your first investigative conclusion

Nearly all our experts stressed that skepticism is a core investigative skill. Pat Butler said this most succinctly, “Good tradecraft is a lot like good analysis in that it does not accept an answer just because I got there quickly or it makes sense.”

He emphasized that the most damaging mistakes often occur not because analysts fail to find information, but because they stop looking too soon. Strong investigators don't simply gather evidence that supports their conclusion. They actively search for information that challenges it. They seek competing explanations. They test assumptions. They remain skeptical until the evidence justifies confidence.

Understand the target's perspective during investigations

Tradecraft also requires something that is increasingly difficult to automate: understanding how other people think. Tim Carr emphasized that one of the biggest mistakes for anyone, particularly those just learning intel, is they're still evaluating things on how they would think. Instead, he argues investigators must understand subjects on their own terms, “How do they think, not how I think they should think.”

Whether analyzing a threat actor, fraud operation, criminal organization, influence campaign, or geopolitical competitor, investigators must consider the incentives, constraints, and motivations of the people involved.

According to Tim, the question isn't whether you would behave a certain way. The question is whether they would.

Why evidence validation matters more than answers

The most effective investigators place enormous emphasis on validating sources and understanding where information originated. Rebecca was particularly emphatic on this point as she said, “It can't be, ‘I heard,’ ‘I think,’ ‘This AI told me this happened.’”

This is particularly true for law enforcement where evidence must stand up in court. Rebecca stated, “It will always come back to the information that was cited rather than how it was found.”

This principle has become even more important as organizations adopt AI-enabled investigative workflows. The value of a conclusion depends on the ability to explain and defend how it was reached.

A citation is essential, but citation alone is not validation. Strong investigative tradecraft also asks where the information came from, how reliable the source is, whether the context supports the claim, whether the information is current enough to matter, whether independent sources corroborate it, and whether any conflicting evidence complicates the conclusion. Only then can an investigator express an appropriate level of confidence in what the evidence supports.

What great investigators have in common: investigative tradecraft principles

There’s a consistent pattern as to what makes a great investigator. They:

• Start with the question, not the data
• Follow evidence rather than assumptions
• Pursue multiple investigative pathways
• Challenge their own conclusions
• Understand context and intent
• Validate what they find

This discipline becomes increasingly important as organizations face larger volumes of information, more complex risk environments, and greater pressure to make decisions quickly. Tradecraft is the differentiator.

From investigative tradecraft to Insights Investigator

These same investigative principles played an important role in shaping Insights Investigator. As the product team worked to develop the platform, they engaged experienced practitioners across the company to understand how skilled investigators frame questions, evaluate evidence, pursue leads, and challenge assumptions.

Pat Butler describes expertise as a decision tree developed through experience, “If I see this, I then branch and do this. If I see that, I go over here.” The broader objective is to make those hard-earned investigative habits more accessible. He explained, “Tradecraft is understanding that decision tree well enough that we can apply automation and give a more junior investigator the benefit of that underlying decision tree.”

Our development team worked to capture investigative best practices from experienced practitioners across Babel Street. According to Jesse Bennetter, “By observing them solve investigative problems, we better understood how they operate within our products.”

Those insights helped shape how Investigator approaches complex questions, identifies relevant information, and supports investigative workflows—not as a replacement for the investigator, but as a tradecraft-imbued assistant designed to help structure the work.

At the same time, the platform benefits from Babel Street’s data strategy. By drawing from a broad ecosystem of public, commercial, and mission-relevant data sources, Insights Investigator helps users move beyond isolated searches and explore the relationships, context, and signals that matter within an investigation.

The system also incorporates safeguards designed to reinforce good investigative discipline. As Andrew Alach explained, “We compel the system to never try to draw immediate conclusions from the sources it finds.”

In practice, that means agents should be designed to frame an investigative plan, pursue multiple branches of inquiry, challenge initial conclusions, seek corroboration, and surface gaps in the evidence. They can help keep the investigation disciplined and transparent, but they should not be treated as the final authority.

Validation and final judgment still belong with the human investigator. The agent can organize the path, expose what is known and unknown, and make investigative reasoning easier to inspect. The investigator remains responsible for deciding whether the evidence is sufficient, whether confidence is warranted, and what the intelligence ultimately means.

Because ultimately, technology supports the investigation; it doesn’t replace the investigator. Technology can accelerate collection. AI can improve efficiency. Data can broaden visibility. But tradecraft remains what transforms information into intelligence.