Working on triage methods for large communication sets, I keep coming back to a handoff problem that doesn't get much airtime: the moment cryptographic recovery succeeds and the linguistic problem begins.
A takedown-scale corpus (think EncroChat or Sky ECC proportions) lands as plaintext: hundreds of thousands of messages, a dozen languages, thousands of participants, no single device owner to anchor the analysis. The technical recovery disciplines have done their job. Now someone has to answer the only question the case team actually has: which conversations do we read first?
The reflexive move is keyword search built from the case brief. In my experience it fails in both directions at this scale, too broad and you're handed a hundred thousand hits; too narrow and you miss the case material entirely, because participants have often already adapted their language (codewords drifting into slang, operational-security instructions, deliberate obfuscation — especially post-takedown, when they know the platform is burned).
I've been working on a layered alternative: a source-cited lexicon pass for the first cut, then behavioural/co-occurrence signals to catch the adapted exchanges keywords miss, producing a ranked reading order rather than a binary hit list, with each flag traceable to why it was raised.
But I'm genuinely curious how teams handle this in practice today:
- When a decrypted network-scale set lands on your desk, what's your actual first move? Case-brief keyword lists? Sampling? Participant-first prioritisation? Something more structured?
- The question that interests me most: if a defence team later asks "why wasn't this thread reviewed earlier?" What does your answer look like? Is there a documented rationale behind your triage order, or does it live in the examiner's head?
Happy to compare notes with anyone working the same problem.
/Andreas