Chapter 12 — The Protocol

In 1981, after Peter Sutcliffe's conviction, the Home Office asked Sir Lawrence Byford to establish why the Yorkshire Ripper investigation had taken so long.

The answer was two failures happening at once, and they are the two failures this book has been circling from the first page.

The first was cognitive. Police gave excessive credence to hoax letters and an audio tape purportedly from the killer. That hypothesis became the organising frame, and evidence that pointed elsewhere was deprioritised — including tyre-tread matches, and inconsistencies across nine separate police interviews with Sutcliffe between 1976 and 1980. Tunnel vision, in its textbook form: not a failure to gather evidence, a failure to let the gathered evidence count.

The second was mechanical. The incident room was drowning in unprocessed information. Officers missed how many times Sutcliffe's car registration had already been logged in red-light districts. Byford's recommendations included standardised incident-room indexing and computerisation of records. [ESTABLISHED] (Byford report, released via FOI)

Read those two paragraphs together and you have the whole argument of this book in a single 1981 document. The machine failure and the mind failure are the same failure. The information that would have identified him was in the room. Nobody could hold enough of it at once to notice, so everyone fell back on the vivid story — and the vivid story was a hoax.

What the record says about narrowing

Three official inquiries, three countries, one diagnosis.

Byford (UK, 1981): a compelling false lead crowded out the evidence, compounded by an information system that could not surface what it already held.

Macpherson (UK, 1999), on the Stephen Lawrence murder: the investigation was "marred by a combination of professional incompetence, institutional racism and a failure of leadership by senior officers." The report gave the standing definition of institutional racism — the collective failure of an organisation to provide an appropriate and professional service to people because of their colour, culture or ethnic origin — and documented racist stereotyping of a witness, failure to make early arrests on available evidence, and bungled surveillance and identification procedures. [ESTABLISHED] (House of Commons Library)

Posthumus (Netherlands, 2005), on the Schiedam Park murder: a man was convicted despite the surviving child witness's description not matching him and tachograph data indicating he could not have reached the scene in time. The real killer later confessed and was confirmed by DNA. The report diagnosed confirmation bias and tunnel vision explicitly — investigators fixed on one suspect early and did not treat disconfirming evidence as sufficient to reopen the question. [ESTABLISHED] (Van Koppen, Blundering Justice)

Each case is different in its particulars. In each, an investigation narrowed early and then spent its remaining energy defending the narrowing.

The thing that has actually been shown to help

Eric Rassin's experimental work operationalised what the Dutch police literature calls verification bias: investigators disproportionately search for evidence that would confirm the current suspect rather than evidence that could disprove them. And the useful part — manipulations that push investigators toward falsification measurably reduce the bias in analogue studies. [ESTABLISHED] as an experimental finding. (Rassin; PLOS One, 2026)

Out of the Posthumus aftermath came the Scenario Reconstruction Method, built specifically to force alternative scenarios into consideration, and an instruction that Dutch complex-crime investigators formally apply devil's advocacy to the leading theory. [ESTABLISHED] that the methods exist; their field outcomes I could not measure. [ABSENT]

And the thing that has not

Here is where I have to disappoint the reader who came looking for a framework.

Analysis of Competing Hypotheses is the most popular structured analytic technique in the intelligence world. Richards Heuer's method: lay all plausible hypotheses in a matrix against every piece of evidence, score consistency, and select the hypothesis with the least disconfirming evidence rather than the most supporting. It is elegant, it is taught everywhere, and it is exactly the kind of thing this book's argument would seem to demand.

The controlled evidence is against it. Dhami's peer-reviewed evaluation and related studies found that ACH was ineffective at improving judgement accuracy, that it decreased the coherence of analysts' probability judgements, that trained analysts frequently did not follow its own steps, and that evidence it reduces confirmation bias is mixed at best — with some suggestion it increases inconsistency. In the same studies, plain statistical methods — coherentisation, aggregating independent judgements — produced large measured accuracy gains. [ESTABLISHED] (Dhami, 2019, Applied Cognitive Psychology)

I am including this against the interests of the chapter, because the alternative is to recommend a method that testing does not support and hope the reader never checks. The honest position is narrow: write down what would falsify your theory has experimental support. Fill in a large matrix does not.

What does have support, and sits oddly with everything the fiction taught us: aggregating several independent judgements outperforms structured deliberation by a single analyst. If you can get three people to assess a case without talking to each other first, that is worth more than any framework one of them could apply alone.

The protocol

Every Move in this book, in the order the work happens. This is the whole method and it fits on a page.

Before you look

1. Ask for the denominator. (Ch. 2) Get the number you intend to improve, as it stands, with its

definition. If it does not exist, building it is the first deliverable.

1. Blind yourself. (Ch. 3) Form your assessment of the material before learning who the suspect

is or what anyone else believes. If you already know, record that your view is context-exposed.

As you collect

1. Hash at acquisition. (Ch. 9) Before you read it, before you know it matters.
2. Write the lawful basis in the file. (Ch. 8) Source, whether it was publicly accessible without

circumventing a control, why you may retain it. At the moment of collection.

1. Ask where it came from, not whether it is fake. (Ch. 10) Provenance before analysis. If the

chain cannot be established, the finding is unverifiable, not false.

1. Record the first confidence, verbatim. (Ch. 11) Once, early, before any feedback.

As you reason

1. Name it an abduction. (Ch. 1) "My best explanation is X" — then write the two rivals you would

have to eliminate, before looking for support.

1. Write the proposition level on every link. (Ch. 5) Shared string, shared account, shared

operator, shared network. These are four different claims.

1. Demand a citation for every machine-produced sentence. (Ch. 4) No pointer, no source document,

no action.

1. Write the corroboration before you act on the match. (Ch. 6) Evidence obtained without

reference to the candidate.

1. Sort every claim by who would suffer if it were false. (Ch. 7) Docket, self-report, or

marketing.

1. Convert every figure into a rate before you use it. (Ch. 12) Period, issuer, denominator —

and, before any cross-country comparison, the three questions: same definition, same counting rule, same reporting propensity.

Before you conclude

1. Try to kill it. Spend a fixed, scheduled block searching only for evidence that would

disprove your leading theory, and write down what you find including when you find nothing. This is the one step with direct experimental support behind it, and the one every case in this chapter skipped.

Thirteen steps, and twelve of them are clerical. That is not an accident and it is not an apology. The history in Chapter 1 said the same thing: investigation advances by procedures that make ordinary practitioners less wrong, not by techniques that make brilliant ones more brilliant.

What the machine changes, exactly

Return to the spine.

Investigation fails where a human narrows too early. The machine's real gift is not intelligence — it is that it removes the need to narrow at all. And that gift is void the moment its output is treated as an answer instead of a lead.

Byford's officers narrowed because they had to. A human incident room in 1979 could not hold every lead in view, so it held the vivid one. That is not a moral failing; it is a capacity limit, and the tunnel vision followed from it.

The capacity limit is gone. A machine can hold a hundred and twenty thousand complaints in view at once and report which four hundred resemble each other. For the first time in the history of this work, premature narrowing is optional.

But notice what the machine does not do, because Chapter 6 is a list of people who did not notice. It does not narrow correctly. It produces candidates at a rate no human can corroborate, which means the narrowing still happens — it just happens faster, with less deliberation, and with the authority of a number attached. Geolitica narrowed 23,600 times. A detective narrowed onto Randal Reid in an afternoon.

So the final constraint, and it is the last sentence of the method:

The machine may widen the search. Only a person may narrow it, and only on the record.

On the record is doing real work in that sentence. It means the narrowing is written down, dated, attributed, with its reason and its rejected alternatives — so that it can be found later by someone who was not there, including a version of you who has learned something new.

The UK's Covenant asks for a human in the loop. Northumbria's researchers found that principle "often exists in name only." A human who signs off is not a safeguard. A human whose reasoning is legible, and therefore contestable, is.

The last thing

Every case in this chapter was solved eventually, by someone who went back to material that had been sitting in the file the whole time.

Sutcliffe's registration was already logged. The child witness in Schiedam had already given a description that did not match. Richard Buckland's false confession was already contradicted by DNA that had already been taken.

That is what this work actually is, most of the time. Not brilliance, and not new evidence. Going back through what is already there, with the willingness to find that the story everyone agreed on was wrong.

The machine makes that cheap for the first time. What it cannot supply is the willingness.

The Move — Schedule the falsification. Put a block in the calendar, before you begin, in which you will search only for evidence that your leading theory is wrong — and write down what you find, including the fact that you found nothing. Not "stay open-minded," which is a mood. A block, with a start time, and an output. It is the only step in this protocol that controlled studies directly support, and it is the step that would have changed the outcome in every named case in this chapter.

What would change my mind: if field trials showed that scheduled falsification blocks made no difference to investigative outcomes — as ACH's trials showed for the matrix — this protocol would lose its keystone and I would have to say so. The current support is analogue and experimental, not operational. I am recommending the best-supported step available, which is not the same as a proven one.