How to Build and Test Competing Hypotheses in OSINT

BY OSINT BLOG

Introduction: Why Competing Hypotheses Matter in OSINT

In open-source intelligence work, the ability to systematically evaluate competing explanations is critical. Cognitive biases—particularly confirmation bias—can lead analysts to favor information that supports their initial hypothesis while dismissing contradictory evidence. The Analysis of Competing Hypotheses (ACH) framework provides a structured methodology to counteract these biases and arrive at more defensible conclusions.

What is the Analysis of Competing Hypotheses (ACH) Framework?

Developed by CIA analyst Richards Heuer, the ACH framework is a systematic approach to hypothesis evaluation that focuses on disproving hypotheses rather than proving them. This counterintuitive approach—seeking evidence against hypotheses rather than for them—helps reduce cognitive bias and leads to more rigorous analysis.

The core principle: it is easier to disprove a hypothesis than to prove one. By systematically evaluating evidence against all competing hypotheses, analysts can identify which hypotheses are least consistent with the available evidence.

Step 1: Develop Hypotheses

Begin by identifying all reasonable hypotheses that could explain the available information. This step requires creativity and intellectual humility—avoid dismissing hypotheses simply because they seem unlikely. Include:

• The most obvious hypothesis
• Alternative explanations
• Hypotheses that contradict your initial assessment
• Hypotheses that seem unlikely but are logically possible

For example, in investigating a suspicious online account, hypotheses might include: (1) the account belongs to the person it claims to represent, (2) the account is a deliberate impersonation, (3) the account is a compromised legitimate account, or (4) the account is a bot or automated system.

Step 2: Gather Evidence

Systematically collect evidence relevant to each hypothesis. This includes:

• Positive evidence (information supporting a hypothesis)
• Negative evidence (information contradicting a hypothesis)
• Neutral evidence (information that doesn't clearly support or contradict)
• Absence of expected evidence (what you would expect to find if a hypothesis were true, but don't)

The key is to actively seek disconfirming evidence—information that would prove a hypothesis wrong.

Step 3: Evaluate Evidence Against Each Hypothesis

For each piece of evidence, assess its consistency with each hypothesis:

• Is this evidence consistent or inconsistent with this hypothesis?
• How strongly does this evidence support or contradict the hypothesis?
• What is the likelihood of finding this evidence if the hypothesis were true?

Create a matrix with hypotheses as columns and evidence as rows. Mark each cell as consistent or inconsistent.

Step 4: Refine and Test

Analyze the matrix to identify:

• Which hypotheses have the most inconsistent evidence
• Which hypotheses remain most consistent with all available evidence
• What additional evidence would help distinguish between remaining hypotheses

Rank hypotheses by their consistency with evidence, recognizing that the most likely hypothesis is the one with the least inconsistent evidence.

Common Mistakes in Hypothesis Testing

1. **Confirmation bias**: Seeking only evidence that supports your preferred hypothesis 2. **Insufficient hypotheses**: Failing to develop truly alternative explanations 3. **Weak evidence evaluation**: Not carefully assessing the strength and reliability of evidence 4. **Ignoring absence of evidence**: Failing to note when expected evidence is absent 5. **Premature closure**: Concluding analysis before thoroughly evaluating alternatives

Practical Case Study Example

Consider an OSINT investigation into a suspicious social media account claiming to be a journalist. Using ACH:

**Hypotheses:** 1. The account belongs to a legitimate journalist 2. The account is an impersonation by someone else 3. The account is a compromised legitimate account

**Evidence gathered:** - Account uses professional photos (consistent with H1, inconsistent with H2) - Account posts at unusual hours for the claimed timezone (inconsistent with H1, consistent with H2) - Account's writing style differs from known published work (inconsistent with H1, consistent with H2 and H3) - Account has no verification badge despite claimed prominence (inconsistent with H1, consistent with H2) - Account's network includes known associates of the real journalist (consistent with H1 and H3, inconsistent with H2)

After evaluation, H2 (impersonation) has the most inconsistent evidence, while H3 (compromised account) remains most consistent with the evidence.

Conclusion

The Analysis of Competing Hypotheses framework transforms hypothesis evaluation from an intuitive, bias-prone process into a systematic, defensible methodology. By actively seeking disconfirming evidence and maintaining multiple competing hypotheses throughout analysis, OSINT professionals can produce more rigorous, reliable intelligence products that withstand scrutiny and challenge.