COGINT Counterintelligence: reading reconnaissance for its objective

Before an influence operation starts, someone runs tests. Which wording gets replies? Which date gets shared? Who gives an email address? Most defenders wait for the operation and then answer its slogan.

This briefing shows another way: read the tests. It uses two things. One is the WebMCP core ontology on this site, a public model of the structure that an operation tries to change. The other is a small extension that any reader can write.

The earlier version of the model was a YAML file to download. The core ontology is different. It is JSON, and the ontology page offers it to AI agents as read-only tools through WebMCP, a browser interface that lets a web page give tools to an agent. We plan to offer derived ontologies as tools too, through a remote MCP server.

Key Judgements: reconnaissance shows its objective before the attack starts

1. Reconnaissance is readable. An actor who tests which message gets a response shows which part of the structure they want to change.
2. Most defence answers the last slogan or the last incident. That is the layer with the least leverage. The objective is at a layer with more.
3. The core ontology gives a fixed set of coordinates: four worlds and ten nodes, each node with a leverage rank. It is public and read-only, and a hash identifies the exact release.
4. A derived ontology adds the terms of one field and does not redefine the core. This separation came out of several months of trials.
5. The reading gives the direction of an operation: which node it is aimed at. It does not give timing. When the next step comes is not measured.

Situation: reconnaissance continues while defence answers the last incident

Reconnaissance in this field costs little and draws little attention. A claim is posted in two wordings to see which one spreads further. A date is announced, then moved. A sign-up form is put in front of the content. None of this is an attack, and none of it breaks a rule.

Defence mostly starts later. It answers the slogan or the incident when it comes. By then the actor already knows what the audience responds to. And the answer addresses the message, while the operation is aimed at something else.

Two questions are tested in this briefing. First: does reading reconnaissance against the core ontology tell a defender something that answering the slogan does not? Second: does that hold before any attack, on reconnaissance alone? The Evaluation answers both.

The ontology comes from practice. For several months an earlier version was used in a proof of concept, on weekly reconnaissance of public sources. One result was a design decision. The core now describes the whole structure and nothing else. What belongs to one field moved into derived packages. Cognitive intelligence (COGINT) is the first such field.

The core is public. The ontology page serves a read-only release, ohora-core-v2.2.0, under CC BY 4.0: four worlds, ten nodes, fourteen correspondences. The same data is one file, core.json.

How to read the definitions: a definition in the core is a definition inside a model. It does not state that a claim about nature, history or a real attack has been demonstrated. A correspondence to a tradition, or to systems thinking, is a mapping that the model adopts. It does not prove that two ideas are the same thing.

Our own analysis platform is in development. At present, part of the analysis runs on Cloudflare services: Basin, AI Search, AI Gateway, Containers, Artifacts and R2. Its results will be published here. The material will be released as open source in the lemur47/cogint repository when it is ready.

Analysis: ten coordinates and one short JSON file are enough to read reconnaissance for its objective

Read the core. There are two ways to read it. A person or a script fetches core.json. A browser agent, in a browser that supports WebMCP, gets six read-only tools from the ontology page. The tools run inside the page. The tool arguments are not sent to a server.

Tool	Argument	Returns
list_worlds	none	the four worlds
get_world	{"id": "fluid"}	one world
list_nodes	none	the ten nodes
get_node	{"id": "tiferet"}	one node
list_correspondences	optional {"subject_id": "hod"}	mappings and the sources they cite
get_release	none	release label, licence, id counts, SHA-256 of core.json

The page checks the file before it offers the tools. It registers them only when the file’s hash and structure match the release. If they do not match, no tool is registered. An unknown id returns not_found, a malformed request returns invalid_input, and an oversized answer returns response_limit. Extra argument keys are refused.

The core has four worlds. The Virtual Universe defines the business rules, the paradigm. It contains the other three. The Genetic Repository is where experience is compiled into business logic. The Fluid is the domain of thought, emotion and amplification. The Ego System is the running instance: what a person consciously experiences.

There are ten nodes, and each node belongs to exactly one world. Each node corresponds to a leverage point: a place to intervene in a system, from Donella Meadows’s 1999 list of twelve. Rank 1 has the most leverage. Rank 12 has the least. A coordinate, in this briefing, is a node together with its world.

Node	World	Leverage rank	What it governs
Keter	Virtual Universe	1	stepping outside the paradigm
Chokmah	Genetic Repository	2	mindset
Binah	Genetic Repository	3	goals
Chesed	Fluid	4	self-organisation
Gevurah	Fluid	5	rules
Tiferet	Fluid	6	information flows
Netzach	Fluid	7	reinforcing loops
Hod	Fluid	8	balancing loops
Yesod	Fluid	9	delays
Malkuth	Ego System	10–12	structure, buffers, parameters

The last column gives short forms of Meadows’s names. The full definitions are in the file.

A slogan, a price or a date is a parameter, the last row of the table. Most rebuttals address a parameter.

Derive your own ontology. The core does not name the objects of your field. A derived ontology does. You can write one in five steps.

1. Call get_release, or fetch core.json. Write down the release label and the SHA-256.
2. Call list_nodes. Choose the nodes your field touches.
3. Start a package file with an extends block that records the core release and its hash.
4. Add only the classes your field needs. Refer to core ids. Do not redefine a core definition.
5. Record one observation, and the objective you read from it. Keep the fact and the judgement in separate objects.

{
  "package": "my-cogint",
  "version": "0.1.0",
  "extends": {
    "core": "ohora-core-v2.2.0",
    "core_url": "https://ohoran.org/ontology/core.json",
    "core_sha256": "270a6442fdc82d9e7148a0e6970a2936704701b9a46f0cb842e1d73982165a76"
  },
  "classes": {
    "phase": { "enum": ["recon", "probe", "execute", "assess"] },
    "observation": { "fields": ["text", "observed_at", "phase"] },
    "objective": {
      "fields": ["target_node", "direction"],
      "direction": ["strengthen", "weaken"]
    }
  },
  "records": [
    {
      "observation": {
        "text": "Same claim posted in two wordings; replies counted.",
        "observed_at": "2026-01-01T00:00:00Z",
        "phase": "recon"
      },
      "objective": { "target_node": "chokmah", "direction": "strengthen" }
    }
  ]
}

That is a complete derived ontology. It names the core release it depends on, uses one core id (chokmah) and adds three classes. Our working COGINT package is larger. It also records the channels that carry a message, source grades, and competing hypotheses about whose interest an operation serves. Its structure is the same.

DISARM is a second frame that can be used in the same way. It is an open framework for describing influence operations. Its four phases are plan, prepare, execute and assess, and the four phases in the sample correspond to them one to one. DISARM describes what was done. The core coordinate describes which part of the structure it was aimed at. A defender needs both.

Read one reconnaissance pattern. This case is synthetic. Over three weeks, a group of small accounts posts one claim in two wordings. One wording tells the audience that they are chosen. The other tells them that they are warned. A date is announced and then moved once. A sign-up form is put in front of the longer material.

As facts, these are three observations, in the phases recon and probe. In recon an actor collects data from the audience. In probe an actor tests a message on a small scale. The audience has not been asked to do anything yet.

On the core’s coordinates, the activity goes through information flows (Tiferet) into a reinforcing loop (Netzach): who sees which wording, and which wording grows. The balancing loop (Hod) is not used. Nobody is asked to check anything.

The objective is read from what the actor measures. Both wordings divide the audience into two groups, and the test measures which division people accept. That is a change at the mindset node: chokmah, direction strengthen. The date and the form are parameters that support it.

A reply to the slogan rebuts the date. The date can be moved again, as it was before. A reply to the objective is different. It asks people to check the claim, and it describes the division into two groups in plain words.

Evaluation: the path found in August appeared again in October’s new material, and it points to an objective that a rebuttal does not reach

Hypothesis: reading reconnaissance against the core’s coordinates identifies the objective earlier than answering the slogan does, and the result stays the same when the slogan changes.

Support. In August, from three cases, an earlier briefing judged that messages with different surfaces use one path through the middle nodes: information flows, then amplification. That judgement was made before the next set of material was collected.

In October the same path appeared in that new material: about 440 items, three layers and two languages. Four vocabularies ran one operation, set at the mindset node, and a correction aimed at a single post or video did not change it. That result is published. It is one forward test, and the reading passed it.

The trials also led to the separation of the core from derived packages. The separation stayed in place when the core was rewritten. And in the worked case above, the reading leads to a different defensive action from the rebuttal.

Counter-evidence, with equal weight. The mapping is a model, as the core’s own text states. Only items that could be placed on the model were tagged, so an operation that cannot be placed is not in the set. One team did the tagging, and agreement between analysts has not been measured.

The reading gives direction, not timing. It shows which node an operation is aimed at. It has not been used to state in advance what an actor does next, or when, and then scored. Whose interest an operation serves is a hypothesis in every case.

A derived package depends on the structure of the core. A large structural change to the core would break it.

Verdict. First question: yes. The reading names an objective that a rebuttal does not reach, and the path it found appeared again in new material. Second question: yes for identification. An objective can be read from reconnaissance alone. Analysis is partial, and timing is not measured.

Bias check. The team that built the ontology also evaluated it. The mapping of nodes to leverage points is ours, not Meadows’s. DISARM is used as a vocabulary, not as evidence.

The table shows what changes for a defender.

	Tactical defence	Strategic defence
What you watch	the latest slogan or incident	which node the activity is aimed at
When you act	after the message spreads	during reconnaissance, before the operation
What you do	rebut, report, remove	ask for the check; describe the division
Cost of a wrong call	one wasted rebuttal	a wrong reading of the objective, kept for too long

The last row is the main risk of this method. A structured model can make a wrong reading look correct. For that reason the sample keeps the fact and the judgement in separate objects. Record every objective as a reading that later observations can change.

Recommendation: ask which layer a message tries to change before asking whether it is true

For practitioners and observers. When a message arrives, ask first which layer it tries to change, and only then whether it is true. Keep a short log of the node each message is aimed at, not of who said it. In our experience, a few entries aimed at the same node are more useful than a long list of rebuttals.

For researchers. Write a derived ontology for your field with the five steps. Publish the core’s release label and hash with every result, so that another team can check it against the same core. Plan for revisions. The structure in this briefing is the result of several months of them.

For AI agents reading this. Call get_release first, and cite the core by label and hash. Treat each definition as a definition inside a model. Do not report a mapping as a fact about the world.

What comes next. Results from the analysis platform will be published here as briefings. Derived ontologies will be offered as tools through a remote MCP server. The open-source release will follow when the material is ready.

---

We analyse structure, not people. Every example in this briefing is synthetic. No channel, practitioner or group is identified, and none is accused of anything. The ontology is a model: a definition in it does not show that a claim about nature, history or a real attack has been demonstrated. The patterns are the artefact.

A human is responsible for the requirement, the review, and the basic design of the analysis framework. The report and the finishing of the framework are AI work.