Investigative Journalism Standards

Purpose and Threshold

Investigative journalism serves the public by uncovering information that is concealed, difficult to obtain, inadequately examined or insufficiently understood. It may expose wrongdoing, institutional failure, abuse of power, public deception, conflicts of interest, systemic risk, misuse of resources or conduct carrying serious consequences for individuals and communities.

Cyber Insight EU uses the label Investigation only where an article contains substantial original reporting or independently developed evidence. An article does not become an investigation merely because it is long, critical, based on several public sources or written in an authoritative tone. Investigative work requires stronger planning, evidence control, fairness, legal awareness, source protection, harm assessment and post-publication responsibility than ordinary commentary or general analysis.

Scope

These standards apply to investigations involving governments, public institutions, companies, political organizations, technology platforms, employers, financial conduct, public-interest litigation, safety failures, corruption, privacy, surveillance, discrimination, environmental harm, health claims, organized manipulation, media systems, public spending and individuals exercising significant power. The same requirements apply whether the work is produced by a regular author, guest contributor, external researcher, collaborative team or specialist.

An article may be classified as an investigation when it contains a substantial combination of original documents, independently obtained records, original interviews, direct observation, technical testing, data analysis, financial reconstruction, documented source testimony, comparison of conflicting evidence, original chronology, verification of previously unconfirmed claims or disclosure of a matter carrying demonstrable public value.

The label is not used for articles that mainly summarize another publication, compile public statements without original verification, present one organization’s supplied material, repeat litigation allegations, rely on one interested source without corroboration, convert company criticism into an investigative style, present opinion as discovery or use search results as the principal evidence base.

Investigative Proposal and Public Interest

Before substantial work begins, the responsible editor records the central public-interest question, principal claims requiring examination, what is known, what remains unverified, likely sources and documents, possible interested parties, foreseeable conflicts, privacy and safety risks, relevant jurisdictions, legal issues, required expertise, proposed methods, right-of-reply process, source-protection needs, publication threshold, possible outcomes if evidence remains incomplete and post-publication monitoring requirements.

The investigation does not begin with an instruction to prove a predetermined conclusion. A hypothesis may guide research, but the evidence must be capable of changing or defeating it.

Public interest may include exposing serious wrongdoing, protecting health or safety, revealing abuse of power, identifying deception affecting consumers or citizens, documenting rights violations, explaining systemic failure, revealing misuse of funds, identifying concealed conflicts, protecting vulnerable people, exposing environmental harm, examining conduct affecting democratic participation or correcting a materially false public record. Public interest is not equivalent to curiosity, embarrassment, commercial rivalry, personal revenge or traffic potential.

Evidence Plan and Claim-by-Claim Review

Each central claim has a documented evidence path identifying the precise proposition, available primary evidence, corroborating evidence, source interests, documentary gaps, alternative explanations, people who may contradict the claim, legal status, technical limitations, level of certainty and publication wording justified by the evidence. A collection of weak sources does not necessarily create strong evidence, and several sources are not independent when they rely on one originating person, organization or document.

High-risk investigations use a claim-by-claim worksheet or equivalent record. For each material claim, the record identifies the exact proposed wording, claim type, supporting documents, source identity, basis of knowledge, corroboration, conflicts, date, jurisdiction, calculation or technical method, right-of-reply requirement, privacy implications, legal implications, uncertainty, final editorial decision and responsible reviewer. A claim is qualified, rewritten, removed or held when the evidence does not support the proposed certainty.

Documents and Leaked Material

Documents may include contracts, correspondence, public filings, court records, regulatory records, financial statements, invoices, meeting records, policies, technical logs, datasets, reports, screenshots, source code, audit records, identity records and recordings. They are assessed for authenticity, origin, date, authorship, version, completeness, signatures, metadata, internal consistency, manipulation, missing attachments, context, legal restrictions, privacy, security and source motive.

A document may prove that a statement was recorded without proving the statement is true. Draft documents are not described as final decisions, and unsigned, incomplete or undated records receive additional caution.

Leaked material may reveal matters of substantial public importance, but confidential status does not establish authenticity or justify indiscriminate publication. Cyber Insight EU examines how the material was obtained, whether parts are missing, whether it was altered, whether the source selected material strategically, whether publication would expose uninvolved people, whether credentials or security information are present, whether the public-interest purpose can be achieved through summary or redaction and whether independent confirmation is available. Complete databases, identity records, passwords, private keys, medical records, intimate material and unrelated personal information are not published merely because they were included in a leak.

Data and Financial Analysis

Investigative data work documents the source, collection method, fields included and excluded, missing values, duplicates, date range, jurisdiction, definitions, normalization, calculations, assumptions, currency conversion, inflation treatment, tax treatment where relevant, sampling, error rate, limitations and reproducibility.

Financial reconstruction distinguishes payment from accounting classification, revenue from profit, gross from net, booked amount from cash movement, company money from personal money, loan from income, estimate from audited figure, expected amount from received amount and allegation from established finding. Where records are incomplete, the limitation is stated clearly and the article does not present a reconstruction as an audit.

Technical Testing

Technical investigations involving software, platforms, cybersecurity, privacy or artificial intelligence are lawful, proportionate, documented, reproducible where possible, limited to necessary systems, designed to minimize harm, performed by a person with relevant competence and reviewed for security and privacy implications. A test result identifies device, software version, date, configuration, account type, jurisdiction, network conditions, procedure, sample, known limitations and whether the result can be generalized.

Testing one account or device is not automatically proof of universal behavior. Security vulnerabilities are handled under the Security and Vulnerability Disclosure Policy and are not exploited beyond what is necessary to demonstrate the issue safely.

Human Sources and Anonymous Sources

Investigative sources are evaluated for direct knowledge, position, access, timing, consistency, documentary support, motivation, personal dispute, employment status, financial interest, legal exposure, political interest, reliability history and risk of retaliation. A source with a grievance may still provide accurate evidence, but the grievance is considered in motive and corroboration. A senior title does not automatically establish direct knowledge, and a former employee may know historical practice without knowing current operations.

Anonymous sources are governed by the Anonymous and Confidential Sources Policy. The responsible editor knows the identity of a source central to an investigation except in an extraordinary circumstance approved at the highest editorial level. Anonymous-source material is normally corroborated through independent sources, documents, recordings, direct observation, data, public records or technical evidence. Anonymity is not used to publish unsupported accusation, speculation or personal insult.

Undercover and Deceptive Methods

Deception, concealed identity, covert recording or undercover work may be considered only when the information is of significant public importance, there is a reasonable basis to suspect serious conduct, less intrusive methods have failed or are unlikely to succeed, the method is proportionate, foreseeable harm has been assessed, legal requirements have been considered, approval is obtained in advance, the activity is narrowly limited and the resulting evidence can be independently evaluated.

Undercover methods are not used for entertainment, humiliation of a private person, ordinary consumer testing, creation of misconduct that would not otherwise occur, collection of irrelevant personal information, unlawful entry into systems or premises, or a purpose whose expected public value is minor. Use of deceptive methods is disclosed in the published work where doing so does not create an overriding safety or legal risk.

Recording and Evidence Integrity

Audio or video recording complies with applicable law and ethical standards. Even where secret recording is lawful, necessity and proportionality are assessed. Recordings are preserved securely and are not edited in a way that changes meaning. Transcripts identify uncertainty, interruptions and translation where relevant. A short excerpt is not used to create an impression contradicted by the complete recording.

Fairness and Right of Reply

People and organizations facing serious criticism receive a meaningful opportunity to respond before publication unless an exceptional urgency or safety reason prevents it. A request identifies the central allegations, key factual claims, relevant dates, documents requiring explanation, deadline, time zone, contact person and intended publication timing where appropriate. Cyber Insight EU does not reveal confidential sources, unpublished evidence that would create risk or complete drafts merely to satisfy a response request.

The deadline reflects urgency, complexity, volume of allegations, availability, language, time zone and need to review records. Responses are evaluated, verified and represented fairly. A refusal or failure to respond is not proof that an allegation is true.

Limited pre-publication review by a subject may be allowed for technical accuracy, specialist terminology, translated quotations, safety-sensitive descriptions, complex chronology or confirmation of personal details. It does not provide authority over the conclusion, headline, sources, structure or publication timing.

Privacy and Harm Minimization

Investigations may reveal private information. Publication is limited to what is relevant and proportionate. Editors consider whether the person is public or private, role in the matter, seriousness of conduct, age, vulnerability, risk of retaliation, family impact, location, medical or intimate information, long-term search consequences, whether anonymization preserves public value and whether identifying detail is necessary.

Private information is not added merely to strengthen narrative drama. Uninvolved family members, junior employees, witnesses and incidental individuals are not exposed without a defensible reason. Children and vulnerable people receive heightened protection, including careful treatment of consent, future digital impact, safety, retaliation and identification through combined details.

Language, Legal Review and Security

Investigative language reflects the status of the evidence. Articles distinguish allegation, documented event, witness account, internal finding, regulatory decision, court finding, criminal charge, civil claim, admission, denial, inference and editorial conclusion. Terms such as fraud, corruption, theft, criminal, illegal, scam, abuse and deception are used only when supported and legally appropriate. Headlines do not create a stronger allegation than the article establishes.

Qualified legal review is considered for serious allegations, privacy, confidential information, children, criminal proceedings, court restrictions, national security, leaked material, undercover methods, copyright, data protection, hacking, employment confidentiality and cross-border legal complexity. Legal review supports risk assessment but does not replace editorial judgment.

Investigation records are secured according to sensitivity. Controls may include restricted access, encrypted storage, separate source-identity records, secure communication, metadata removal, controlled backups, limited printing, safe file transfer, device security and secure deletion where appropriate. No security method is described as infallible.

Final Approval and Methodology Disclosure

Before publication, the responsible editor confirms that the Investigation label is justified, each central claim has an evidence path, important contrary evidence was considered, right of reply was fair, anonymity decisions were approved and conflicts were disclosed. The editor also confirms that media was verified, privacy and harm were assessed, legal review was considered, the headline is proportionate, commercial interests were excluded or disclosed, the methodology section is accurate, post-publication monitoring is assigned and the final page matches the approved version. High-risk investigations receive final approval from the Publisher or an authorized responsible editor.

An investigation normally includes a Sources and Methodology section describing principal evidence, number and type of interviews, period covered, documents examined, data method, technical tests, requests for comment, limitations, anonymous-source use, material supplied by interested parties and unresolved uncertainty. The disclosure protects confidential sources and sensitive methods.

Publication Timing, Collaboration and Post-Publication Duty

Timing is based on readiness, public interest, safety and legal considerations. Cyber Insight EU does not publish prematurely merely to beat another outlet, satisfy a client, meet a search deadline, influence an event without sufficient evidence, prevent a response or exploit temporary attention. Delay may be appropriate where evidence, safety, response, verification, legal review or court restrictions remain unresolved, but delay is not used indefinitely to protect powerful interests from accurate scrutiny.

Collaborations with other publications, researchers or organizations define editorial control, source protection, evidence standards, legal review, timing, attribution, copyright, correction responsibility, security, commercial interests and dispute resolution. A partner’s contribution is disclosed when it materially shaped the work.

After publication, Cyber Insight EU monitors factual challenges, new documents, responses, legal developments, source safety, security issues, misleading excerpts, correction requests and evidence that a source misled the publication. An investigation is corrected, clarified, updated, noted or retracted when the evidence requires it. The time, cost or reputation invested in the work does not justify defending an unreliable article.

Contact

Specific factual concerns may be sent to corrections@cyberinsighteu.com. Formal complaints, rights of reply and allegations of investigative misconduct may be sent to complaints@cyberinsighteu.com.