Overview
Every case runs through the same five stages. Each stage below is one BPMN diagram with three swimlanes: what Michael does, what Claude does, and the outside systems both of them touch. The letters on the round link events connect the diagrams.
How to use the diagrams. Each diagram plays once when you scroll to it. Press Play to run it again, Step to advance one shape at a time, or click any shape to read what happens there, which Berkeley Protocol section it covers, the files it produces, and an example from our cases. The lane buttons fade the other two lanes.
Pull the latest files, read the case page, assess risk, map where the case lives online, plan the inquiry and set up the folder.
Open diagram ASearch, run the five preliminary checks, capture the collection minimum, then hash, archive and commit. Blocked sites go to Michael.
Open diagram BSource, technical and content analysis. A finding needs two independent sources or one primary source before analysis goes further.
Open diagram CPick the channel, draft with sources and limits, check the ground rules and style, then Michael reviews and sends.
Open diagram DLog and freeze what was sent, tidy every case folder, check hashes, push, and recheck the case page each month.
Open diagram EUnverified findings go back to B. Michael's edits go back to the draft. A recheck that turns up new information starts B again.
See the recheckRounded boxes are work. White: Claude. Gold: Michael. Grey dashed: an outside system, such as a website or GitHub.
Thin circle: start. Thick circle: end. Lettered circle: jump to that diagram. Double circle with a clock: timer.
A diamond with an X is an exclusive gateway: exactly one outgoing path is taken. The question sits beside it; each path is labelled.
Solid arrow: the order of work. Dashed arrow: information passing to or from an outside system. Gold: the path the token has run.
Prepare the case
Before collecting anything, the Protocol asks for a threat and risk assessment, a map of where the case lives online, a written plan, a resilience plan and a data policy. Here those happen in four tasks, starting the moment Michael shares a case link.
Collect and preserve
The first four steps of the Protocol's investigation cycle: online inquiries, preliminary assessment, collection and preservation. Anything a site blocks goes to Michael for a read-only check; anything that fails the preliminary checks is logged and left uncollected.
Verify and analyse
Verification runs the Protocol's three analyses in order. A finding that can't reach two independent sources or one primary source goes back to collection instead of forward to analysis.
Report and send
Reporting follows the Protocol's written-reporting standard: sources, confidence and limits stated plainly. Claude drafts and checks; Michael approves and sends. The token runs the revision loop once to show it.
Close the loop
Sent drafts are frozen, every case folder is tidied and its hashes rechecked, and the work goes to the private repository. A monthly calendar reminder starts the recheck; its outcome decides whether the case rests, reopens at B, or closes.
Berkeley Protocol coverage
Each chapter of the 2022 edition (HR/PUB/20/2), where it happens in the diagrams, and whether it was already part of the workflow or added on 18 October 2026 when this map was drawn.
| Section | What the Protocol asks | Where it happens | Status |
|---|---|---|---|
| Frameworks | |||
| II | Professional, methodological and ethical principles (fourteen in total) | Ground rules 1–9, FACT / CLAIM / INFERENCE labels, journal and verification logs. See section 08. | Covered |
| III | Legal framework, including the right to privacy and data protection | Rules 2, 4 and 6. No bypassing bot checks or logins (KARK, Cloudflare). Only people the authorities or press have named. | Covered |
| IV | Security: minimum standards, assessments, infrastructure, user conduct | A4 risk assessment. Private repository, GitHub noreply email, read-only HITM checks, no accounts that notify the people viewed. | Covered |
| V · Preparation | |||
| V.A | Digital threat and risk assessment | A4. Risks to the people in the case, to Michael and to the investigation, recorded with the risk level. | Added 18 Oct |
| V.B | Digital landscape assessment | A5. Where the case lives online: outlets and languages, official pages, the person's own channels, blocked sites. | Added 18 Oct |
| V.C | Online investigation plan | A5. Research question, source checklist, HITM checklist. | Covered |
| V.D | Resilience plan and self-care | Ground rule 8, checked in A4. | Covered |
| V.E | Data policies and tools | A6. Collect only what the question needs; private repo as the store; tools recorded per source. | Added 18 Oct |
| VI · Investigation process | |||
| VI.A | Online inquiries | B1. Several search tools; search-engine summaries are leads, never sources. | Covered |
| VI.B | Preliminary assessment: relevance, reliability, removal, safety, subsequent duties | B4 and B5. Relevance and reliability were already checked; removal risk, safety and subsequent duties are new. | Added 18 Oct |
| VI.C | Collection: URL, HTML source, full-page screenshot with date and time, metadata, context, collection data, hash | B6. Screenshots and the collected-by and tool columns are new; URL, HTML, metadata and hashes were already kept. | Added 18 Oct |
| VI.D | Preservation: chain of custody, evidentiary and working copies, storage, backup, fixity | B7 and E2. Hashes, Wayback, git and three copies were in place; named copy roles and the monthly fixity check are new. | Added 18 Oct |
| VI.E | Verification: source, technical and content analysis | C1–C4. The two-source rule was in place; the named Berkeley checks are now a checklist. | Covered |
| VI.F | Investigative analysis on working copies | C5. Discrepancies, gaps, competing hypotheses where useful, red team. | Covered |
| VII · Reporting and annexes | |||
| VII.A | Written reporting | D1–D6. Sources with archive links, confidence, what isn't known; Michael approves. | Covered |
| VII.B–C | Oral and visual reporting | Not used for submissions. This page is the workflow's visual report. | Covered |
| Annex I–IV | Templates: investigation plan, threat and risk, landscape, online data collection form | Case README (plan, risk, landscape) and sources.csv (collection form fields). The collector IP address is optional and noted only when a case may reach court. | Partly |
| Annex V | Validating new tools | Tools are checked against known results before use, as the rewritten Wayback script was against live captures. | Partly |
| Source: Berkeley Protocol on Digital Open Source Investigations, OHCHR and UC Berkeley Human Rights Center, New York and Geneva, 2022. Section letters follow its table of contents. | |||
The fourteen principles in practice
The Protocol groups its principles into three sets. Each line says how this workflow meets it.
- Accountability: every source logged with who collected it and the tool used; every session in the journal.
- Competency: named methods (Admiralty grading, ACH, Berkeley checks); tools validated before use.
- Objectivity: several search tools; competing hypotheses; red team before writing up.
- Legality: passive research only; no bypassing access controls (rule 2).
- Security awareness: private repo, noreply email, read-only checks that leave no trace for the people viewed.
- Accuracy: FACT, CLAIM and INFERENCE labels; two independent sources or one primary.
- Data minimization: collect only what the question needs; failed items logged as not collected; private photos not stored.
- Preservation: local copy, hash and Wayback capture at the moment of collection; monthly fixity check.
- Security by design: evidentiary copies separate from working copies; three copies in two kinds of storage.
- Dignity: no contact with family; light-touch edits to family-written pages; no graphic media unless essential.
- Humility: unknowns marked as unknown; errors corrected openly with dated notes (rule 9).
- Inclusivity: local and local-language sources sought, not only national or US outlets.
- Independence: findings go to the people who can act; no advocacy or public campaigns.
- Transparency: no fake personas; methods and sources shown in every submission.
Ground rules
Checked before every phase. If a step would break one, the work stops and the compliant option is offered instead.
Independent research, never unilateral action. Every real lead ends as a tip to the agency, the site, or the FBI for a US citizen abroad.
Public sources. No logging into others' accounts, no fake personas, no scanning or hacking, no paid people-search, no leaked data.
No contact with suspects or witnesses and no uninvited contact with family. Never confront anyone.
Name only people the authorities have named. Theories go to the case discussion, never public social media.
No visits to scenes, suspects' areas or conflict zones. With armed groups or suspects at large, report and step back.
With charges pending, analysis goes privately to the agency, never anywhere public.
FACT, CLAIM or INFERENCE on every note. An inference never turns into a fact.
Session limits, breaks, and no graphic media unless it's essential to a finding.
Evidence, hashes, sent drafts, journal entries and pushed history are never altered. Corrections are added on top, dated.
The goal is verified, well-sourced, useful information in the hands of people who can act on it. Only investigators and prosecutors close a case; a volunteer's value is careful research, clean data and good tips.