# SIGINT v4 Integration Plan

**Current:** v3 (12 threat actor categories, 10 patterns, 4-tier system)  
**Upgrade:** v4 (20 threat actor categories, 16 patterns, 4-tier + 4 composite triggers)

---

## Overview

The v4 JavaScript framework provides 8 additional threat actor keyword clusters + 6 new operational patterns + 4 composite trigger conditions. These are **drop-in additions** to your existing Python pipeline.

---

## Integration Points

### 1. Expand Threat Actor Categories (12 → 20)

**Current v3 in Python:**
```python
THREAT_ACTOR_QUERIES = {
    "evidence_destruction": [...],           # 12 keywords
    "emergency_authority": [...],            # 12 keywords
    # ... 10 more categories
}
```

**New v4 Categories to Add:**
- `narrative_sync` — Cross-outlet message convergence without wire source
- `preconditioning` — Threat scenario normalization before incident
- `false_flag_signatures` — CRITICAL severity indicators (drill same location, surveillance gaps, pre-drafted legislation)
- `electoral_erosion` — CRITICAL severity (voter roll purges, ballot challenges, certification disputes)
- `crackdown_scaffolding` — CRITICAL severity (domestic terrorism redefinition, detention expansion)
- `info_suppression` — Counter-narrative infrastructure (FISA journalists, prebunking, fact-checker campaigns)
- `conflict_bleed` — Foreign conflict weaponized for domestic suppression
- `tempo_distraction` — Manufactured pace (Friday news dumps, celebrity cycles, simultaneous crises)

**Action:** Add these 8 categories to `threat_actor_indicators.py` with 12 keywords each = +96 queries total (12 → 156 → 252)

---

### 2. Expand Operational Pattern Detectors (10 → 16)

**Current v3 Patterns:**
- 4 CRITICAL (simultaneous action, narrative lock, oversight evasion, legal rewrite)
- 6 HIGH (opposition suppression, authority consolidation, loyalty purge, info control, financial coercion, isolation)

**New v4 Patterns to Add:**
1. **`simultaneous_electoral_legal`** (CRITICAL) — 3+ voting-related filings across states within 14 days
2. **`preconditioning_plus_drill`** (CRITICAL) — Pre-conditioning signals + drill/exercise convergence within 30 days
3. **`narrative_velocity_spike`** (HIGH) — 5+ outlets same framing in 4 hours without wire source
4. **`story_burial_detection`** (HIGH) — High-signal story drops off all sources within 24h
5. **`conflict_domestic_pivot`** (CRITICAL) — Middle East escalation followed by domestic authority expansion within 72h
6. **`prebunking_without_event`** (HIGH) — Fact-checker campaign launches before triggering event exists

**Action:** Implement these in `signal_analyzer_v3_expanded.py` in the pattern detection loop

---

### 3. Add Composite Triggers (Auto-RED Escalators)

**New v4 Composite Triggers:**

1. **`acute_event_window`** (RED override)
   - Condition: narrative_sync + preconditioning + false_flag_signatures all active
   - Action: Switch to continuous monitoring (not 3x daily)
   - Real-world: Precursors to manufactured false flag (exercise, narrative prep, signature conditions converged)

2. **`vote_suppression_prep`** (RED override)
   - Condition: electoral_erosion + crackdown_scaffolding + tempo_distraction all active
   - Action: Document all electoral procedure changes with timestamps
   - Real-world: Multi-vector election interference pattern

3. **`dissent_neutralization`** (RED override)
   - Condition: info_suppression + conflict_bleed + tempo_distraction all active
   - Action: Monitor journalist/activist safety, archive all material
   - Real-world: Using foreign conflict to suppress domestic dissent

4. **`total_capture_signature`** (RED override)
   - Condition: 6+ threat actor categories active simultaneously
   - Action: Maximum alert, full emergency protocols
   - Real-world: Broad-spectrum institutional capture in progress

**Action:** Add to `assessThreatTier()` function — check these conditions BEFORE raw signal count. Any true = automatic RED escalation.

---

### 4. Add Temporal Anomaly Scorer

**Purpose:** Weight signals higher when published at anomalous times (news dump windows, holiday releases, etc.)

**Scoring Rules:**
- Friday 4pm+ ET (20:00 UTC): +0.8x multiplier
- Weekend policy/legal filing: +0.6x multiplier
- Holiday-adjacent (±24h): +0.5x multiplier
- Published within 2h of another high-signal story: +0.7x multiplier
- Cap: 2.5x maximum

**Action:** In collection pipeline, call `TEMPORAL_ANOMALY_SCORER.score(signal)` for each article. Store multiplier on signal object. Use in sorting/severity scoring.

---

### 5. Add Narrative Velocity Tracker

**Purpose:** Detect anomalously fast narrative spread (coordination without wire source)

**Metric:** "Hours to 5-outlet adoption"
- Extract key phrase from article
- Track spread across unique outlets
- Calculate `velocityScore = outlet_count / hours_to_spread`
- Flag if > 8 (anomalously coordinated)

**Output:** New dashboard alert type `NARRATIVE_VELOCITY` showing:
- Key phrase
- 5 outlet names + spread time
- Velocity score
- Whether wire source detected

**Action:** Call `NARRATIVE_VELOCITY_TRACKER.track(signal, signalHistory)` after deduplication. If `isAnomalous: true` → create alert card.

---

### 6. Update Threat Tier Logic

**Current v3 Assessment:**
```
6+ signals → RED
3-5 signals → ORANGE
1-2 signals → YELLOW
0 signals → GREEN
(plus: 3+ CRITICAL patterns → RED)
```

**New v4 Assessment:**
```
FIRST: Check composite triggers
  - If ANY trigger condition true → RED (override)

ELSE: Check CRITICAL pattern count
  - If 3+ CRITICAL patterns → RED

ELSE: Check raw signal count
  - If 6+ signals → RED
  - If 3-5 signals → ORANGE
  - If 1-2 signals → YELLOW
  - If 0 signals → GREEN
```

**Action:** Replace `assessThreatTier()` in analyzer with v4 version that checks composite triggers first.

---

### 7. New Dashboard Alert Card Types

**New card types for v4 signals:**

1. **NARRATIVE_VELOCITY** (⚡ Amber)
   - Shows: Key phrase, outlet count, hours to spread, velocity score, wire source detected

2. **COMPOSITE_TRIGGER** (🔺 Red)
   - Shows: Trigger name, label, recommended action

3. **TEMPORAL_ANOMALY** (🕐 Purple)
   - Shows: Anomaly reason, multiplier, original signal

4. **STORY_BURIAL** (📉 Gray)
   - Shows: Story headline, hours since last seen, concurrent distraction story

5. **CROSS_PILLAR** (🕸 Red)
   - Shows: Pillars involved, combination type, historical analog

**Action:** Add to dashboard card renderer. When v4 signals are detected, display new card types in briefing.

---

### 8. Add External Validator Links

**Purpose:** Cross-reference signals against authoritative external sources

**Current Watchlist:**
- EFF Surveillance Law (info_suppression)
- RCFP Press Freedom Tracker (info_suppression)
- CISA Election Threats (electoral_erosion)
- POGO Whistleblower Track (info_suppression)
- Brennan Center Voting Laws (electoral_erosion)
- MintPress News (false_flag_signatures)
- GDELT Event Database (ALL)
- OpenSecrets Lobbying (conflict_bleed)
- ProPublica Congress (crackdown_scaffolding)
- Just Security War Powers (conflict_bleed)

**Action:** Add sidebar "Validate this signal" with links to relevant sources per category.

---

## Implementation Order

### Phase 1 (High Impact)
1. Add 8 new threat actor categories → +96 queries (15-min)
2. Add 4 composite triggers to assessment logic (10-min)
3. Deploy — test on Edition Zero data

### Phase 2 (Medium Impact)
4. Add 6 new operational patterns (20-min)
5. Update threat tier logic with composite check-first (10-min)
6. Re-run analysis on Edition Zero

### Phase 3 (Enhancements)
7. Add temporal anomaly scorer to collection pipeline (15-min)
8. Add narrative velocity tracker after dedup (15-min)
9. Add new dashboard card types (30-min)
10. Add external validator sidebar (10-min)

---

## File Changes Required

### `threat_actor_indicators.py`
- Add 8 new categories to `THREAT_ACTOR_QUERIES` dict
- Result: 20 categories × 12 keywords = 240 queries (vs current 156)

### `signal_analyzer_v3_expanded.py`
- Import new pattern detectors from v4 JS (convert to Python)
- Add to `detect_operational_patterns()` function
- Replace `assessThreatTier()` with v4 version (composite check first)
- Add temporal scoring in collection phase
- Add narrative velocity tracking after dedup

### `index.html` (Dashboard)
- Add new alert card renderers for 5 new card types
- Add external validator sidebar widget

---

## Testing Strategy

### Test 1: Edition Zero v4 Re-Run
- Re-process existing 497 files with new 20 categories
- Should detect more nuanced signals in existing data
- Verify composite triggers don't create false positives

### Test 2: Narrative Velocity Simulation
- Inject 5-outlet story spread within 2 hours
- Verify velocity tracker detects and scores anomaly

### Test 3: Temporal Anomaly Injection
- Add Friday 4pm articles
- Verify 1.8x multiplier applied correctly

### Test 4: Composite Trigger Validation
- Activate all 3 pillars of `vote_suppression_prep` pattern
- Verify auto-escalates to RED

---

## Estimated Effort

| Component | Time | Complexity |
|-----------|------|-----------|
| New threat actor categories | 15 min | Low |
| New operational patterns | 20 min | Medium |
| Composite trigger logic | 10 min | Low |
| Temporal anomaly scorer | 15 min | Medium |
| Narrative velocity tracker | 15 min | Medium |
| Threat tier replacement | 10 min | Low |
| Dashboard card types | 30 min | Medium |
| External validators UI | 10 min | Low |
| **Total** | **125 min** | **Medium** |

---

## Risk Assessment

### Low Risk
- ✅ Adding new keywords (no change to existing logic)
- ✅ Composite triggers (check-first, doesn't break old logic)

### Medium Risk
- ⚠️ Pattern detector complexity (edge cases in timing/geography)
- ⚠️ Narrative velocity false positives (need tuning on real data)

### Mitigation
- Run Phase 1 on existing data first (Edition Zero)
- Tune pattern detectors on 24-hour production data before Phase 3
- Keep v3 code as fallback during Phase 2

---

## Post-Integration Status

**v4 Capabilities:**
- ✅ 20 threat actor categories (8 more specific + nuanced)
- ✅ 16 operational patterns (6 more with better temporal logic)
- ✅ 4 composite triggers (automatic RED escalation on multi-pillar patterns)
- ✅ Temporal anomaly scoring (weights time-based signal strength)
- ✅ Narrative velocity tracking (detects coordinated messaging spread)
- ✅ 5 new dashboard alert types (better analyst visibility)
- ✅ External validator links (cross-reference against authoritative sources)

**Result:** Significant increase in detection sensitivity for coordinated institutional capture patterns, especially false flag precursors, vote suppression infrastructure, and dissent neutralization operations.

**Next:** Deploy Phase 1 tomorrow after 06:00 UTC cron run.
