Surveillance Today

Before anything else in this paper: what the Fourth Amendment says, and why it was written.

Every story in this issue asks the same question. The answer was written down in 1791.

“The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”

Fourth Amendment to the Constitution of the United States, ratified December 15, 1791.

Why it was written

Before the Revolution, British customs officers in the colonies carried writs of assistance: open-ended warrants that let them search any house, shop or ship, at any time, with no named suspect and no judge reviewing the reason. In Boston in 1761, the lawyer James Otis argued against them in court. He called the writ “the worst instrument of arbitrary power, the most destructive of English liberty,” and said that “a man’s house is his castle.” He lost the case. John Adams, who was in the courtroom, later wrote that “then and there the Child Independence was born.”

When the new country wrote its Bill of Rights, it wrote the cure into the Fourth Amendment. A search needs a reason, probable cause. The reason must be sworn under oath. A warrant must come from a judge. And the warrant must say exactly where and what: the place to be searched, the persons or things to be seized. Each requirement is the opposite of searching everyone, just in case.

The promise under the flag

Americans pledge allegiance to a flag “with liberty and justice for all.” The Declaration of Independence names “Life, Liberty and the pursuit of Happiness.” The Fifth Amendment promises that no person shall “be deprived of life, liberty, or property, without due process of law,” and after the Civil War the Fourteenth Amendment held every state to the same promise. Due process means the government follows fair, known rules before it takes anything from you, and answers for itself before a judge.

Together they describe one idea. The freedom to live your own life rests on the government leaving you alone unless it has a reason it can state, prove and defend.

The law has followed the technology

In 1967, in Katz v. United States, the Supreme Court held that the government needed a warrant to record a man’s calls from a public phone booth: “the Fourth Amendment protects people, not places.” In 2014, in Riley v. California, all nine justices held that police need a warrant to search a phone, because phones “hold for many Americans ‘the privacies of life.’” The Chief Justice’s instruction was one line: “get a warrant.” In 2018, in Carpenter v. United States, the Court held that police need a warrant to obtain a phone’s location history, which it called “a detailed chronicle of a person’s physical presence.” And in June 2026, in Chatrie v. United States, the Court held that police “invade a cell-phone user’s reasonable expectation of privacy when they access his Location History,” the phone records behind so-called geofence warrants. “It does not matter,” the Court added, “if the time period scrutinized was only two hours.”

The Supreme Court has not yet ruled on license-plate readers that log every passing car (on October 1 a federal judge in Oklahoma applied Chatrie to one; see the front page), on searching Section 702 data for Americans without a warrant, or on spyware that enters a phone without the owner’s knowledge. Those are the questions in the pages that follow.

How to read this issue

Read every story against the words above. Who is being searched? On what suspicion? With whose warrant? And who answers for it afterward?

The founders had a name for searching everyone in case: the general warrant. It is what they wrote the Fourth Amendment to forbid.

No warrant, no judge, no notice: how Americans end up in the foreign-spy database

Section 702 was written to watch foreigners. The court's own declassified opinions show whose names the FBI actually ran: protesters, campaign donors, crime victims, a senator — and a judge who complained about the police. The law lapsed in June. The collection never stopped.

Consider how it works, step by documented step — for an American who has done nothing.

You drive to Home Depot; a pole camera reads your plate and logs the time and direction (the machinery on this issue's front page). You attend a candlelight vigil; a fusion center writes it up — in Austin, such reports went to the CIA and ICE (the fusion-center story, below). You donate to a congressional campaign; in the declassified record, 19,000 donors were run through the FBI's warrantless foreign-intelligence database in substantially one batch. You email a cousin, a client, a colleague overseas. If anyone on the thread is among 349,823 foreign targets, your words are collected "incidentally" and stored — and the target nexus is thinner than it sounds: for years the agency also swept communications that merely mentioned a target's email address or phone number — in the body of the message, not on the address line — a practice halted in 2017 only after the court found violations. What interception doesn't capture, the government has bought: location and communications records purchased from commercial data brokers, with no legal process at all — a practice confirmed in the intelligence community's own declassified 2023 report. And then, one day, an analyst types your name into what has been gathered, and hits enter.

At no step were you suspected of anything. And every step above is documented — not about a character, but about real, counted Americans, in the government's own audits and the surveillance court's own opinions. The rest of this story is that record.

Here is the design, as written. Section 702 of the Foreign Intelligence Surveillance Act, enacted in 2008, lets the government collect the communications of foreigners abroad through American companies, without an individual warrant; the statute says the targets must be non-Americans outside the United States. It was renewed in 2012, 2018 and, in April 2024, for two years, after an amendment to require a warrant before searching Americans' communications failed on a 212-to-212 tie. Two short stopgaps followed this spring. After the House rejected a third, 198 to 218, on June 11, 2026, the law lapsed at the end of June 12 — and collection continued anyway, under annual certifications the surveillance court approved in March 2026. By the Brennan Center's reading, they run to March 17, 2027.

That is the law on paper. Everything that follows is the practice, from the government's own declassified record.

Whose names were run through the data

"…reasonably likely to retrieve foreign intelligence or evidence of a crime."

The FBI's standard for searching the database. Everyone below was brought in under it.

In May 2023, a FISA Court opinion was declassified. It documented more than 278,000 improper FBI queries of Section 702 data in and around 2021 — searches that violated the government's own querying rules. Among those whose identifiers were run through the warrantless database, per the opinion and its coverage: people arrested at the George Floyd protests, January 6 suspects, and roughly 19,000 donors to a congressional campaign. Further declassified filings added a United States senator, a state senator, and a state judge who had complained to the FBI about civil rights violations by a local police chief.

Read the standard above again: it is disjunctive. The second prong contains no foreign element whatsoever — a purely domestic crime theory, about anyone whose communications sit in the store, satisfies it, with no warrant and no judge. The foreign target is the justification for collecting; it is not the criterion for searching. The declassified record shows queries that failed that standard run not only on the people above but on crime victims and people named in police reports. Two cautions the numbers require: queries are not people — one person can be queried many times, and the 19,000 donors were substantially a single batch decision — and the 278,000 figure was reached largely by sampling, meaning the court was estimating, not exhaustively counting. Averaged out, it is roughly 760 improper queries a day for a year.

None of these people was a foreign target. The statute forbids targeting Americans. The queries were run anyway, were ruled improper only after the fact, and reached the public only through declassification — not through any of the official statistics above. The statute defines who may be targeted; the declassified queries show who was actually looked up.

The official account

Against that record, here is what the government publishes about itself.

The fall from millions to thousands is real, and it follows reforms. But note what every figure in that table is: a count reported by the agency it measures, of queries the agency itself ran, against data already in its hands. None of the violations described below appeared in any annual statistical report. They became public only when the surveillance court's own opinions were declassified.

The court has said where the problems were. In 2022 the Foreign Intelligence Surveillance Court documented "extensive improper querying of Section 702 data by FBI personnel."

Who approves a target

No judge approves any individual Section 702 target. The court approves annual program-level certifications — categories and procedures. The individual decisions are made by executive-branch analysts applying internal rules, checked by internal reviews, with violations reported to the court afterward. And one number has never been produced at all: how many Americans' communications are swept in "incidentally" because they communicated with one of the 349,823 targets. Oversight bodies and members of Congress have asked for that estimate for years. The government has declined to produce one.

When the watching becomes a case: "parallel construction"

Suppose the look finds something — or something an analyst reads as something. The intercept cannot appear in court without exposing the method. The documented solution has a name inside the government: parallel construction. In 2013, Reuters obtained documents from the DEA's Special Operations Division showing agents were trained to conceal where an investigation actually began — to "recreate" the investigative trail from a clean source. In practice, per the documents and the agents Reuters interviewed: the intelligence is handed to a highway officer, who follows the car and waits for a turn-signal violation. The arrest report records a routine traffic stop. The surveillance that started the case never appears — not to the defendant, not to the defense, and in some cases not to the judge. One federal official told Reuters the practice was used "every day," and was "decades old, a bedrock concept." A former agent put it more plainly: "It's just like laundering money — you work it backwards to make it clean."

Two pieces make every visible step of this lawful. The Supreme Court held in Whren v. United States (1996) that a pretextual stop — one whose stated reason is not its real reason — does not violate the Fourth Amendment. And Human Rights Watch's 2018 report Dark Side documented the technique across federal and local agencies, concluding that a defendant cannot challenge evidence whose origin he is never permitted to learn.

This is the answer to "I've done nothing wrong." The question was never whether you did something wrong. It is that the apparatus can watch first and justify afterward: the disjunctive standard admits you, the query finds something to read as a crime, and parallel construction rebuilds the story of how you were caught — so the watching never has to defend itself in a courtroom.

The channel the numbers never count

The April 2024 renewal did something no query statistic will ever register: it expanded the definition of an "electronic communications service provider" that the government can secretly compel to assist. Under the Brennan Center's analysis of the amended text, the new language reaches businesses and individuals with access to equipment on which communications travel or are stored — the landlord, the IT contractor, the repair technician, the shop that offers Wi-Fi. Anyone served with such a directive is bound by a gag order and forbidden from disclosing it to anyone. Sen. Ron Wyden called the provision "one of the most dramatic and terrifying expansions of government surveillance authority in history," warning it could conscript the people who install and maintain ordinary communications equipment into secret service as collectors.

The Justice Department answered with an assurance letter promising to apply the power only to a narrow class of data-center-type providers. Critics from the Brennan Center to Senator Wyden noted that a policy letter does not amend a statute: the broad language is what remains law, available to this administration and every one after it. On the other side, analysts at the Cato Institute argued the alarm was overstated. The reader has the text, the letter, and both readings.

What stays true

Access to Americans' communications in this data does not require a warrant. Oversight is mostly internal. The annual statistics count targets and queries; they do not, and cannot, disclose who has been compelled to assist or how broadly — disclosure is precisely what the gag orders forbid. When the watching becomes a case, the record of how it began can be rebuilt to conceal it. And the lapse showed that the program does not depend on Congress to act in any given month.

Coming soon: THE QUERIES, EXAMINED — who got looked up, on what justification, and the number the government refuses to produce: how many Americans sit in the database right now. If your name was ever run, no one told you. No one is ever told. That is the story.

The rooms built after September 11 were audited once. The Senate could not find the money.

A 2012 bipartisan review counted 77 centers the federal government promoted, 68 it could confirm were working, and a price somewhere between $289 million and $1.4 billion.

After the 2001 attacks, the Department of Homeland Security funded state and local "fusion centers": rooms where analysts from police agencies, and sometimes private companies, combine data and pass reports up and down. The subcommittee released its report on October 3, 2012. Here is what it found.

Most of what the centers produced concerned drug and human smuggling and ordinary crime, not terrorism. Senior officials publicly called the centers a "centerpiece" of counterterrorism while internal assessments showed gaps. DHS could not give the subcommittee an exact accounting.

The decade since

The most comprehensive review since is the Brennan Center for Justice's December 2022 report, Ending Fusion Center Abuses. Working from DHS's own surveys, it found that while 94 percent of fusion centers named counterterrorism among their top priorities, only 16 percent of their analysts were counterterrorism specialists. Of roughly 100,000 suspicious-activity reports submitted to the national initiative between 2010 and 2017, DHS said about a third had a "nexus to terrorism" — and only 2.3 percent furthered an FBI investigation or involved anyone on a watch list.

The same report documented what the centers watched instead. The Austin, Texas fusion center created intelligence reports on a Juneteenth celebration, a meditation circle, and candlelight vigils for victims of police violence, and shared them with agencies including the CIA and ICE. An analysis of five years of suspicious-activity reports from Mall of America security and local police in Minnesota found 65 percent involved people of color. In 2020, a breach at a fusion center contractor — "BlueLeaks" — exposed 269 gigabytes of law enforcement records spanning 24 years. One fusion center leader, asked about verifying what the centers pass along, said: "If we set as a threshold that we are going to independently verify every piece of information that goes out, then we would be sharing almost no information."

The legal standard that was supposed to prevent this — a 1980 federal regulation, 28 C.F.R. Part 23, requiring reasonable suspicion of crime before intelligence is kept on anyone — was, the report found, quietly worked around after 2001 so that reports on innocuous behavior could flow anyway.

So ask who the rooms were built to watch. They were sold as a defense against terrorism. By DHS's own figures, 2.3 percent of the suspicious-activity reports furthered an FBI investigation or involved anyone on a watch list. The other 97.7 percent were reports on people tied to no investigation and no watch list, and those reports were not thrown out. By the FBI's own retention schedule, as reported to the Government Accountability Office, a report found to have no nexus to terrorism is deleted from the shared eGuardian system after 180 days and then retained in the FBI's Guardian and Sentinel systems for thirty years; reports kept in eGuardian stay there, searchable by every participating agency, for up to five years. The Senate found that most of what the centers produced concerned drug and human smuggling and ordinary crime. The Brennan Center found reports on people doing nothing illegal at all: a Juneteenth celebration, a meditation circle, candlelight vigils for victims of police violence. The terrorism label was on the door. The work inside was something else.

Next week in Issue No. 2: the full investigation — inside the fusion centers, who sits in the room, and what they watch.

The people who run the tools keep saying the same thing

Police chiefs, an inspector general, federal appeals courts and the Justice Department have each said, about their own piece of the apparatus, that it touches constitutional rights and needs limits.

Each is an official body acknowledging, in public, a limit that should apply to the thing it runs or reviews. One goes further: the Fourth Circuit held that tracking a phone this way is a search, though it spared the detectives because the right had not been clearly established. Taken together they describe a system whose operators state the limit and then set it aside. In Los Angeles, the inspector general recommended suspending new plate readers, and the Police Commission approved more over that recommendation.

It is in use. ICE’s director certified spyware that enters a phone without a click, ten weeks after the contract closed.

Under the order he cited, “operational use” means remote entry into a device without the owner’s consent, to take its contents, record its calls or track its location. The maker, founded in Israel, is now American and preparing to trade on Nasdaq. ICE has not said what legal authority it uses, or against whom.

The contract closed out on January 20, 2026. On April 1, ICE’s acting director told Congress he had certified the tool’s “operational use.” A closed contract is the end of a purchase. The certification is about use.

The product is called Graphite, made by Paragon Solutions, a company founded in Israel. It is what the industry calls “zero-click” spyware: it reaches a phone without the owner opening a link, a message or a file, and without the owner doing anything at all. In June 2025, the University of Toronto’s Citizen Lab reported forensic evidence, “with high confidence,” that two journalists — the Italian reporter Ciro Pellegrino and a European journalist who asked not to be named — had been targeted with Graphite through an attack delivered over iMessage. In March 2026, prosecutors in Rome and Naples reported that the phones of the journalist Francesco Cancellato and two immigration activists showed traces of infection from the same night, December 14, 2024.

In December 2024, Paragon was bought by REDLattice, an American company owned by a U.S. private-equity firm, and its American unit was merged into it. REDLattice has announced it will go public through a merger expected to close around the end of the year. When it does, shares in the company that owns Graphite’s maker will trade on Nasdaq, open to any investor.

ICE is not a distant agency in this. It is one of the agencies that local intelligence flows to. Fusion centers, where city and county police share information with federal agencies, have passed their reports to ICE: in Austin, reports on a Juneteenth celebration, a meditation circle and candlelight vigils went to ICE and the CIA (the fusion-center story, above).

What “operational use” means

On April 1, 2026, ICE’s then-acting director, Todd Lyons, answered an October inquiry from Rep. Summer Lee of Pennsylvania and two other Democratic members of the House Committee on Oversight and Government Reform. They had asked who could be targeted with the spyware and what legal basis allowed its use inside the United States. Lyons wrote that, “in response to the unprecedented lethality of fentanyl and the exploitation of digital platforms by transnational criminal organizations,” he had approved Homeland Security Investigations’ “use of cutting-edge technological tools that address the specific challenges posed by the Foreign Terrorist Organizations’ thriving exploitation of encrypted communication platforms.” He wrote that he had “certified that HSI’s operational use of the specific tool does not pose significant security or counterintelligence risks, or significant risks of improper use by a foreign government or foreign person.”

“Use to gain remote access to a computer, without the consent of the user, administrator, or owner… to access, collect, exploit, extract, intercept, retrieve, or transmit the computer’s content,” or to record its audio or video calls, or to track its location.

Executive Order 14093, Section 5(i): the definition of “operational use.”

That is the order Lyons was certifying under. Its definition is the definition of what he approved: entering a device remotely, without the owner’s consent, to take its contents, record its calls or follow it.

The certification answers the order’s two tests: risk to the security of the U.S. government, and risk of “improper use by a foreign government or foreign person.” Both look at the vendor and at foreign actors. Neither asks whom ICE itself will target.

The letter does not name the product; it refers to “the specific tool.” It names the targets as foreign terrorist organizations, fentanyl traffickers and transnational criminal organizations. It says “any use of the tool will comply with constitutional requirements” and will be coordinated with ICE’s Office of the Principal Legal Advisor. It does not say what legal authority ICE relies on to enter a phone: a judge’s warrant, a wiretap order, or something else. Rep. Lee said the response lacked substantive answers. “They are moving forward with invasive spyware technology inside the United States,” she said.

Cooper Quintin, a technologist at the Electronic Frontier Foundation, said the letter “doesn’t rule out ICE using an administrative subpoena to deploy this malware against people living in the United States.” An administrative subpoena is issued by the agency itself. No judge signs it.

“No relationship,” seven weeks after “operational use”

The question put to the government was whether ICE is using the spyware. The answer was about which companies ICE is doing business with. Those are different questions. The answer to the second says nothing about the first.

A tool does not need a relationship to keep working. By the contract’s own description, ICE bought “a fully configured proprietary solution including license, hardware, warranty, maintenance, and training.” Hardware stays in ICE’s possession. Whether the license had an end date is written in the contract file, one of the records Audit Veritas has asked for.

Nor does a relationship with the maker have to be direct. Julie Mao, an attorney at Just Futures Law, told NPR the closeout “raises more questions than answers”: the services could have been “rolled into a different contract, potentially with a third party that bundles various services together.” And ICE is not the only federal buyer. The New York Times reported in 2022 that the Drug Enforcement Administration used Graphite; the DEA did not respond to NPR’s questions about the status of that contract.

Then there is the sale. The contract was paused under an executive order whose tests weigh foreign control and foreign misuse. While it was paused, Paragon’s American unit became part of an American company. Then the pause was lifted. ICE has not said what its review found, or whether the change of owner was the reason.

DHS’s other answers: “DHS is not going to confirm or deny law enforcement capabilities or methods,” and, “Like other law enforcement agencies, ICE employs various forms of technology while respecting civil liberties and privacy interests.” Asked whether ICE uses a different spyware vendor, the department declined to answer.

“No relationship” is a statement about a business partner. “Operational use” is a statement about a phone. Only the second describes what happens to the person on the other end.

What “closed out” means

A closeout is the last administrative step of a federal contract: the payments are reconciled and the file is closed. A closeout notice records that the paperwork is finished. It is not a record that software was returned, a license ended, a capability disabled or collected data destroyed. Whether any of that happened is the first thing this desk has asked for.

Who owns the tool now

REDLattice, which bought Paragon in December 2024 in a deal reported at more than $500 million, with total proceeds that could exceed $1 billion depending on performance, describes its business as “lawful intercept, vulnerability research and intelligence acquisition solutions that help U.S. and allied government agencies.” It is headquartered in Chantilly, Virginia. Paragon was founded in Israel in 2019 by intelligence veterans including Ehud Schneerson, a former commander of the Israeli military’s signals-intelligence Unit 8200; former Prime Minister Ehud Barak is an investor. Its customers include the military’s Joint Special Operations Command, which has reported spending more than $11 million on REDLattice products.

On September 28, 2026, the company announced a merger with Bold Eagle Acquisition Corp. that would list it on Nasdaq around the end of the year as REDL, at a $1.25 billion valuation. It reported $267 million in revenue for the year ending June 2026, up 29 percent, a contracted backlog of $200 million and an active pipeline of $1.5 billion, from “more than 100 customers across 23 countries,” according to the announcement; the investor presentation it filed with the SEC the same day says “30+ customers.” AE Industrial Partners will remain the largest shareholder. Under the agreement, Israel remains the company’s hub for research, development and innovation. The announcement does not name its government customers.

A request already twenty months old

On February 6, 2025, Cooper Quintin filed a public records request with ICE, through the site MuckRock, for the Paragon contract, its invoices, audit reports, and usage logs for Graphite. ICE acknowledged it a week later, citing “numerous documents that will necessitate a thorough and wide-ranging search.” Federal law gives an agency twenty working days to decide, thirty in unusual circumstances. As of this issue, the request is listed as awaiting a response.

American police have gone to Israel by the thousand. The records now show some of what they were taught.

The trips are documented, and so is part of the curriculum: social-media monitoring, a session on the “Muslim mindset,” methods one police grant request called “battle proven.” Which American practices trace to which trip is what the records requests now ask.

What is documented

Since 2002, private groups, including the Anti-Defamation League and the Jewish Institute for National Security of America, and a Georgia State University program, have taken more than a thousand mostly senior American law enforcement officials to Israel, according to JTA in 2022. Federal homeland security grants have paid for some of it: one count, from Reason in 2022, is $480,466 since 2015, over 80 percent of it for Israel. A 2015 ADL participant booklet lists a senior ICE official.

Officers have described what they saw. After a 2017 ADL trip, Ventura County Sheriff Bill Ayub said he admired systems that "record and track people's movements and listen in on conversations," software "a little more invasive than you would see here in the US," that let authorities "track known dissidents or known criminals."

In August 2026 a two-year records investigation by Prism reported training materials from the Advanced Security Training Institute, a nonprofit that takes U.S. police to Israel. They included social-media monitoring, sessions on a "Muslim mindset," and informant recruitment. A 2018 Austin police grant request to FEMA described "battle proven" Israeli methods. In September Prism published trip notes that told American officers: "It is a propaganda war with the spokesman as the key."

The question the causation debate leaves out

Defenders of the trips note, correctly, that American police violence long predates them, and no document shows a trip caused a specific practice. That is the wrong test. The question is not where the violence came from. It is what departments are taught to add to it, and who pays.

One record, in order. In June 2005, a District of Columbia police commander named Cathy Lanier returned from a police trip to Israel organized by the Police Executive Research Forum. “No experience in my life has had more of an impact on doing my job than going to Israel,” she told The Washington Post. In 2007 she became the city’s police chief. In June 2008, her department sealed off the Trinidad neighborhood with vehicle checkpoints, turning away drivers who could not show a “legitimate reason” to enter. In July 2009, a federal appeals court ruled on the checkpoints: “It is apparent that appellants’ constitutional rights are violated.”

The record continues. In 2016 Lanier left the department to become the National Football League’s chief security officer, responsible for security at every NFL stadium and the Super Bowl. In August 2024 the league’s security office put facial authentication into all 30 NFL stadiums for credentialed workers, media and staff; some teams also use it on ticket holders. At this year’s Super Bowl, in February, she briefed reporters alongside the Department of Homeland Security’s federal coordinator for the game. Those face scans are run by a private league, not a government, so the Fourth Amendment does not reach them.

What the court decided is the point. The checkpoints were seizures: police stopped every driver at the cordon, with no suspicion of any of them, to deter crime in general. The Supreme Court had held in 2000, in City of Indianapolis v. Edmond, that a checkpoint whose purpose is ordinary crime control violates the Fourth Amendment. The appeals court applied that rule: “citizens have a right to drive upon the public streets of the District of Columbia or any other city absent a constitutionally sound reason for limiting their access.”

That is the question under every story in this issue. A plate reader records every passing car, with no suspicion of any of them. The FBI searched Section 702 data on Americans with no warrant. ICE certified spyware that enters a phone without the owner’s consent, under an authority it will not name. Stop everyone, search everyone, and justify it later if anyone asks. The Trinidad cordon is the one case here where a court looked, and answered.

The deepening

The House's defense authorization bill for 2027 would set up a U.S.–Israel defense technology cooperation initiative covering artificial intelligence, cyber defense and co-production (Section 219); the Senate's version is narrower. Critics told Time (Aug. 6, 2026) it would be harder to unwind than an annual aid vote. As of October 9 the bill was still stalled in the Senate, which returns after the November election. Palantir announced a strategic partnership with the Israeli military in January 2024 on undisclosed terms. Microsoft said on Sept. 25, 2025 that it had disabled some services to an Israeli military intelligence unit after press reports, and added: "We do not provide technology to facilitate mass surveillance of civilians."

Coming in Issue No. 3: the exchanges in full — the programs, the money, the participants, and the record on both sides.

The rules this paper is written under

Every figure in this issue is tied to a named source, listed at the foot of its story. A finding belongs to the body that made it: when this paper says a Senate committee, a court, or an inspector general found something, it means exactly that, and where a government, department, or company disputes a finding, the dispute is printed beside it.

Where the evidence stops, the story says so. Claims in circulation that we have not yet traced to a primary source — on any side of this subject — are held out of print until we can. When we get something wrong, the correction is listed in this page's Corrections box, with the date we found it.