Following the Evidence Through an Influence Investigation

A question small enough to answer

A search for evidence should be allowed to end with an unresolved question. That is an uncomfortable starting point for a publication about influence operations, where the temptation is to arrive with a culprit and work backward. It is a useful discipline for ContraLume: decide what would count as evidence before deciding what story to tell.

A historical, assistant-assisted exploratory exercise prepared for ContraLume offers a practical example. It searched a defined slice of an archived Tenet Media transcript collection for a particular narrative. The result was limited: the screened passages contained no identifiable discussion matching the targeted attack or blame narrative. This article explains that finding and the boundaries around it. The exercise involved no interviews, access to private communications, or independent audio/video verification. Pilot methods and claim ledger, C01 and C07.

The starting point was a September 2024 federal indictment. Prosecutors alleged that RT employees secretly financed and directed a U.S. content company. Paragraph 37(c) describes a request, on or about March 23, 2024, for a creator to cover the previous day’s Moscow concert-venue attack while blaming Ukraine and the United States. It also records an alleged response expressing willingness to cover it. Indictment, paragraphs 1–2 and 37(c), pages 1 and 25.

These are allegations in a charging document, not findings of guilt. DOJ’s announcement explicitly states that defendants are presumed innocent unless proved guilty in court. This article examines those historical allegations; it does not establish any later case disposition. DOJ announcement, September 4, 2024, opening and concluding paragraphs.

The research question was deliberately narrower than the criminal case: could a specified set of public transcripts supply an identifiable example of the requested attack-related narrative? That question leaves separate questions about funding, knowledge, editorial control, and audience response to their own evidence.

Define the material before counting it

The source was version 2 of a public dataset by Laura Kurek, Kevin Zheng, Eric Gilbert, and Ceren Budak. It contains 560 records of videos from Tenet Media’s Rumble channel, with metadata and transcripts. The associated paper frames the collection around the federal case; the indictment itself uses the anonymous label “U.S. Company-1.” The exercise followed that research framing without independently resolving the indictment’s anonymous identities. Dataset, creators and description; research paper, Introduction; indictment, paragraph 1.

The downloaded file’s checksum matched the value published on Zenodo. That check helps establish which file was analyzed. It cannot establish whether every transcription is accurate. The pilot selected records whose stored calendar dates ran from March 15 through March 29, 2024, inclusive: 34 records, each with a nonempty transcript. Comments were excluded. Dataset, Files; pilot ledger, C04–C05 and reproduction steps.

The first search used Moscow, Crocus, Ukraine, ISIS, Islamic State, and words beginning with terror. Eleven records contained at least one match. Across those records, the screen found 22 terror-stem occurrences and six Ukraine occurrences; the other four expressions returned none. These counts describe what the search retrieved. Classifying the passages required reading the surrounding text. Pilot ledger, C06 and primary patterns.

In the retrieved contexts, Ukraine appeared in discussions of foreign aid and gender, voting, and war policy. Terror-related language included domestic policing, immigration, a subway shooting, and the Baltimore bridge collapse. None of those passages supplied an identifiable match to the targeted Moscow-attack narrative. Those descriptions classify the transcript contexts; they do not endorse the speakers’ underlying claims. Pilot ledger, C07 and record-level classifications.

Broader follow-up searches used variants concerning Russia, venues, militant groups, violence, attacks, and shooting. The reviewed matches remained unrelated to the target incident. Broad terms also produced ordinary false positives: a stem intended to retrieve Crocus picked up footwear, while a Russia-related stem picked up the name Russell. The exact expressions and returned locations are preserved so another reader can inspect the choices. Pilot ledger, C08 and supplementary retrieval locators.

Dates and duplicate passages change the story

One result illustrates why a publication date needs context. A record dated March 24 contains an immigration-and-policing passage also present in a March 21 record. A March 28 record repeats a Ukraine-related passage in a March 22 record about gender and war policy. The repeated passages were checked in the archived transcript strings. Their appearance in later records cannot, by itself, demonstrate a new response to the Moscow attack. Pilot ledger, C09 and duplicate-passage locators.

The dates have another limitation. Twenty-four selected records carry a date-time string without a timezone, set to midnight; ten include timezone-aware timestamps. All four records dated March 22 fall in the first group. That metadata cannot reliably place those four uploads before or after the attack on the same day. Nor does an upload date establish when a conversation was recorded. Pilot ledger, C10 and 34-record inclusion list.

A further boundary comes from the indictment itself. Paragraph 37(b) separately alleges that attack footage was posted to X. This pilot examined Rumble transcripts and did not test that separate allegation. Conflating an alleged footage upload with an alleged request for a creator’s commentary would blur two different claims. Indictment, paragraph 37(b), pages 24–25; pilot ledger, scope.

Write the result at the size of the evidence

The defensible finding is this: in a keyword-assisted review of 34 available Tenet Rumble transcript records dated March 15–29, 2024, no identifiable Moscow/Crocus-attack discussion or corresponding Ukraine/U.S.-blame passage was found in the reviewed contexts. Pilot ledger, C07–C08.

That conclusion leaves material gaps. The exercise did not review every transcript end to end, verify the original recordings, inspect on-screen text, or search every platform and date. Unanticipated wording or transcription errors could defeat the searches. The absence of a retrieved passage therefore cannot disprove the prosecution’s allegations or establish what every creator said. It also supplies no finding about anyone’s knowledge, intent, or effect on an audience. Pilot ledger, review coverage and limitations.

The next useful step, if this question warrants further work, would be a separately scoped search of relevant output on other platforms, followed by verification against original recordings. Any proposed match would need an identifiable publication, a reliable date, the surrounding exchange, and a clear account of who was speaking. A request, a reply, a published item, and an audience effect should each have their own evidentiary record.

Keep the qualification when the format changes

For ContraLume, the editorial lesson is practical: preserve the connection between a claim and the evidence that supports it. A source link should lead to the relevant document, with the page, paragraph, record, or timestamp close enough that a skeptical reader can check the claim.

The same standard should guide an article, a podcast script, and a social post. In a podcast, the allegation and its limits should be spoken, with precise links in the show notes. A short post should retain the scope of a negative finding. If there is too little room for an essential qualification, the claim needs narrowing before publication.

The companion verification and corrections checklist is a draft for editorial approval, not an already-adopted public promise. It proposes a claim-by-claim source check, a separate review of headlines and clips, and visible corrections wherever an error has traveled. The aim is a body of work whose strongest conclusions remain checkable, and whose unresolved questions remain honestly unresolved.