DEV Community

jeffrey
jeffrey

Posted on

From Observation to Evidence: What a Defensible Exposure Record Needs

#exposuremanagement #evidence #zoomeye #methodology

From Observation to Evidence: What a Defensible Exposure Record Needs

The NCSC's summary of the May 2020 US sanction is a published national assessment. Work built on it should meet a comparable standard of documentation. An exposure count becomes evidence only when it is recorded in a way that another person can check.

What supported the counts used here

Every figure in this article came from a single collection session on 4 October 2026 through one search engine. The record below lists the artifacts that make the numbers checkable.
| Element | Value recorded |
| --- | --- |
| Query | Exact dork string, verbatim |
| Collection time | 2026-10-04, with timestamp per query |
| Engine | ZoomEye |
| Scope | Global or filtered, as stated per query |
| Outcome | Success or error, per query |
The primary source carried its own identifiers: title, publication date and URL.

Why each element matters

A count without its query cannot be reproduced. A query without a time cannot be compared later. A result without an outcome cannot be distinguished from a failure. A scope without a definition cannot be interpreted. Any missing element weakens the record.

Turning counts into defensible statements

This is where wording carries weight. "The fingerprint app="Huawei" matched 18,927,766 records on 4 October 2026" is defensible. "18.9 million Huawei devices are exposed" is not, because it converts a fingerprint match into a device claim and drops the date and the method.

Practical next steps

  1. Record query, time, engine, scope and outcome for every figure.
  2. State what a match does and does not establish.
  3. Keep the primary source's identifiers attached to the event.
  4. Review the record as if someone else must reproduce it.

Limitations

A well-kept record does not make an observation correct. It makes the observation auditable, which is a different and necessary property.

References

Top comments (0)