The Authority — How the Machine Decides Who Is Whom

TI-2026-068A · Series: 🧭 Ground Truth · TLP:WHITE · 2026-07-09

Every dossier says "this is that operator," "AS8075 is Microsoft," "these two IPs are the same hand." Behind each of those claims is a graph almost no reader ever sees. This is that graph — and, more importantly, how it decides.

📋 The Short Version

Attribution feels like a lookup: you ask "who owns this IP?" and a name comes back. It isn't. Behind every name in this publication is a reconciliation engine that takes 3,170,002 individual facts from 21 different sources, ranks those sources by how much they can be trusted, and resolves them into 943,692 entities — while keeping a record of every place the sources disagreed.

That last part is the point. A database that hands you one confident answer has thrown away the doubt. This graph does the opposite: 60,077 entities carry an open, recorded conflict, and only 13% of all entities are marked high-confidence. It tells you how much it doesn't know.

This dossier opens the box: the sources, the authority ladder, the adjudicator, and the shape of what remains contested.

Confidence: HIGH — every figure is a direct measurement of the resolution store itself.

1. What Sits Under Every Attribution

These entities are joined by 1,558,898 edges — registered_by (756k), announced_by (604k), located_in (115k), resolves_to (24k), alias (21k), and the rarer, more valuable ones: same_operator (3,308), shared_tooling (7,592), coordinates_with (180). Underneath the edges sit 3,170,002 raw source facts. When a dossier says "same operator," it is reading one of those 3,308 edges — itself the distillate of many facts from many sources.

2. The Authority Ladder

Sources are not equal, and the graph does not pretend they are. Each is assigned a priority that decides who wins when two sources disagree:

The ordering encodes a doctrine. The registry that allocated the resource outranks any feed that merely observed it. And notably, our own honeypot sits near the bottom (40) — deliberately. Local observation is evidence of behavior, not of identity; it is not allowed to overrule an RIR on the question of who a network is. A publication that let its own sensors define ground truth would be marking its own homework.

3. The Adjudicator

Between the raw facts and the final entity sits a reasoning layer. The re_resolution table records, for each entity, a verdict, the canonical name chosen, the model that decided, and — critically — the reasoning:

The merges are not silent. Each "these two names are the same company" decision carries a rationale and a model signature (claude-opus-4.8 or gemma3). That makes the graph auditable: when an attribution is wrong, the error traces to a specific verdict with a specific reason, not to an opaque collapse deep in a join.

4. It Keeps the Disagreement

Here is what separates this from a normal intelligence database. When sources conflict, the graph does not overwrite the losers with the winner. It records the conflict as first-class data. 60,077 entities (6.4% of all of them) carry an open conflict:

Most name conflicts are benign (accents, corporate suffixes). The interesting ones are org (10,813 disputes over ownership) and threat (12,561 disputes over character). The graph surfaces all of them with per-source values and confidences, so a downstream reader can see not just the answer but the argument.

5. Honest About What It Doesn't Know

The single most important number in the graph is the one a marketing database would bury: most of it is low-confidence.

774,087 entities (82%) sit at or below 0.1 confidence — overwhelmingly the 743k auto-generated subnet entities that exist as structural scaffolding. Only ~127,000 (13%) exceed 0.7 confidence. The human-meaningful identities — named orgs, resolved operators, registered domains — are a high-confidence minority riding on a large substrate the graph explicitly marks as uncertain.

This is the difference between calibrated and confident. Any honest consumer of the graph filters by confidence before quoting it. The graph makes that possible by never pretending the scaffolding is knowledge.

6. Worked Example — Agree It's Bad, Argue What Kind

The 12,561 threat conflicts are the most instructive, because they show a subtle failure mode: unanimous agreement on danger, genuine disagreement on category.

Take a family of live malware domains — claudverification-id.beer, bestwebchlen.cyou, biggestchlen.xyz, framesavecloudjs.beer, allplanetssame.cfd (cheap novelty TLDs, Slavic-slang naming, and a Claude-impersonation lure in the first). Every source flags them malicious. They cannot agree what type:

Is it a command-and-control node, a malware dropper, or a payload host? Depending on when in the kill chain you looked, it is all three — so the "conflict" is really the same infrastructure seen at different moments. A database that forced one label would erase that nuance. This graph keeps every label with its provenance, and the disagreement itself becomes a signal: this domain plays multiple roles.

7. Why This Matters

Attribution is only as good as its epistemics. A publication that names criminal infrastructure is making claims that reach real people and real networks. Those claims deserve machinery that (a) ranks its sources explicitly, (b) shows its reasoning, and (c) records what it isn't sure of. This graph does all three, and this dossier is the receipt.

It reframes every prior dossier. When 066B called the entity graph the "who is whom authority" that unmasks a forged identity, this is the authority it meant. When a dossier states an operator link at "medium confidence," that number is not a vibe — it is a position on the ladder in §2 and a verdict in §3.

It sets up the series. "Ground Truth" will now walk into the conflict layer one contested attribute at a time — who really owns the disputed 10,813 (org_mismatch), what the 12,561 threat-label fights reveal about kill-chain ambiguity, and where the graph's authority ladder is itself gamed. The method comes first because everything after it inherits the method.

A note on humility. The graph can be wrong. Its top source (RIR delegation) can be defeated by a network that lies to its own registry; its LLM passes can hallucinate a merge. What it cannot do is hide being wrong — every decision is a row with a reason. That is the whole design: not certainty, but traceable, calibrated, correctable doubt.

Investigation Metadata

Cross-references: TI-2026-042U (The Entity Web — 271K connections mapped, the same graph earlier) · TI-2026-066B (The Browser Costume — the graph as who-is-whom authority) · TI-2026-022F (The Geographic Liar — the 82 country conflicts) · TI-2026-023D (The Trust Chain — geographic discrepancy cascade) · TI-2026-047D (The Cartographers of the Web — self-declared registrant country).