Before You Begin — Investigator Orientation
What this curriculum teaches, how long it takes, and how to get the most out of it
Companion Guide, Symbol Reference & Investigation Worksheets
Student Companion Guide
The Investigator’s Field Reference — quick-reference tables, checklists, and decision frameworks for all nine lessons. Download once and keep alongside your worksheets.
Download PDF →
MAG Vetting Symbol Reference
Gang, extremist, and threat indicator symbols for use during OSINT review in Lesson 2. Print and keep alongside WS-1.
Download PDF →
WS-1 — OSINT Collection Worksheet
Public records, social media, threat indicators, and findings summary. Used throughout Lessons 1–2. Print one per candidate.
Download PDF →
WS-2 — References and Interview Worksheet
Reference conversation notes, interview structure, and behavioral observations. Used in Lessons 3–4. Print one per candidate.
Download PDF →
WS-3 — Assessment and Recommendation Worksheet
Final assessment document integrating both vetting tracks. Used in Lessons 4–8. Do not open until post-interview self-assessment is complete.
Download PDF →
Before Lesson 1. This orientation lesson is for anyone stepping into the Vetting Officer role for the first time. You do not need any investigation background to complete this training — but you do need to understand what you are about to learn and why it is structured the way it is. This lesson takes approximately 20 minutes. Complete it before moving to Lesson 1.
This curriculum will take you from no investigative experience to a professionally structured vetting process. It draws on the same doctrine used by military intelligence collectors, law enforcement background investigators, and counterintelligence professionals — adapted for a civilian preparedness context. You do not need a badge or a clearance to apply these methods. You need discipline, documentation, and the willingness to be consistent even when consistency is inconvenient.
Why Vet? The Cost of Getting It Wrong
The Operational Case — Not the Philosophical One
Most MAGs do not vet. They admit people based on personal connection, shared interest, and the intuition that someone “seems solid.” This works until it doesn’t — and when it fails, it fails catastrophically.
Here is what actually happens to groups that skip vetting:
The member who shows up until it costs something
The most common MAG failure is not a spy or an infiltrator. It is a person who seemed reliable during low-stakes activities — training weekends, planning meetings, group chats — and then disappeared when a real commitment arrived. A cache that was supposed to have six months of supplies for eight people has supplies for three, because two members never contributed what they committed to. During an actual activation, you discover your medical officer hasn’t maintained their certification. The security rotation falls apart because three of the five people who signed up for it stopped responding.
None of these people were hostile. They were simply never assessed for the one thing that matters: whether their commitment would survive cost. Vetting surfaces this before the group depends on them.
What an insider can do that an outsider cannot
An unvetted member knows where your group meets, who is in it, what your cache location is, what your communications protocols are, and how your activation plan works. A person who joins your group under false pretenses — or whose loyalties shift after admission — has everything an external adversary would need and cannot obtain on their own.
This is not a hypothetical. The Camp X SOE training materials document case after case of resistance networks penetrated not by sophisticated intelligence operations but by a single trusted insider who either was placed or was turned. The SOE’s conclusion, after losing entire networks to this failure mode, was that source validation — vetting — is the primary security measure, not a secondary one.
What one member’s history can do to the rest
A member with an undisclosed prior domestic violence restraining order, an active warrant, or a history of extremist advocacy creates legal exposure for every other member of the group. In some jurisdictions, knowing association with certain individuals or organizations has legal consequences. Your group’s operational security, communications, and physical location are all potentially exposed the moment a member becomes the subject of law enforcement attention for matters unrelated to the group.
Vetting does not make your group invisible to law enforcement. It does ensure that you have applied a documented, principled process to the people you admitted — which is the difference between a group that exercised reasonable care and one that did not.
You do not discover these problems during planning. You discover them at activation — when the medical supplies are not where they were supposed to be, when the member with the critical skill is unreachable, when a dispute between two members who were never compatible fractures the group at the worst possible moment. By then, the cost of the unvetted admission has already been paid. Vetting is the only intervention that happens before the cost is incurred.
The question vetting answers is not “is this person a threat?” Most candidates are not threats. The question is: Is this person who they say they are, and will they strengthen the group under real conditions? Those are two different questions, and both require a structured process to answer. The curriculum that follows teaches you that process.
What You Are About to Learn
This nine-lesson curriculum teaches a complete member vetting process from first principles. By the end of Lesson 9, you will be able to plan and execute a full vetting investigation — from building a collection plan through writing a defensible assessment — using the same doctrinal frameworks that professional investigators use.
The curriculum is organized in two tracks that run sequentially:
Security Vetting (Lessons 1–4) answers the question: Is this person who they say they are, and do they represent a security risk? You will learn how to build an investigation plan, search public records and social media systematically, elicit information from references without tipping your hand, and conduct a structured interview using professional deceit detection frameworks.
Character Assessment (Lessons 5–8) answers the question: Is this a person of good character who will strengthen the group? You will learn what records cannot tell you, how to assess character through dedicated reference interviews, how to use scenario-based questions to surface reasoning quality rather than stated values, and how to synthesize both tracks into a single defensible written assessment.
Certification (Lesson 9) tests your judgment against four real-seeming scenarios with documented ground truths. You write your assessment before seeing the answer. The gap between your judgment and the professional standard is your training data.
What a Full Investigation Looks Like
The Timeline a New Investigator Should Expect
One of the most common novice errors is treating vetting as a task to complete as quickly as possible. A rushed investigation is worse than no investigation because it produces a false sense of security. Here is what a professionally conducted investigation actually takes:
From referral to recommendation: 3–6 weeks
Days 1–3: Build your EEI collection plan. Write your specific questions for this candidate. Do not start searching anything until your plan is complete. A plan written in 30 minutes prevents a week of disorganized collection.
Days 4–10: OSINT collection (Lesson 2 content). Public records, social media, alternative platforms, threat indicator review. Plan for 4–8 hours of actual work spread over several days — record searches take time, some platforms require careful review, and you need time to document everything properly as you go.
Days 10–14: Reference conversations (Lesson 3 content). Background references first, then character references. Three to five reference conversations of 20–30 minutes each. Allow time between calls to document observations before memory degrades. Do not rush these into one afternoon.
Day 14–21: Schedule and conduct the interview (Lesson 4 content). The interview itself takes 75–90 minutes. Add 30 minutes immediately after for writing behavioral observation notes while your memory is fresh. Do not schedule the interview until OSINT and references are complete.
Days 21–28: Write the assessment (Lessons 5–8 content). The assessment is not a form to fill in — it is an analytical document. Plan for 2–3 hours to write it well. Complete the post-interview self-assessment first. Draft, then review against the confidence language standard before finalizing.
If any of these steps feel too slow, re-read the briefed reference problem in Lesson 1. One sequence break can cost you the entire investigation’s value.
What This Training Is Not
This curriculum teaches professional investigative methodology applied to a civilian preparedness context. It does not license, authorize, or train you to conduct law enforcement activity, licensed private investigation, or any regulated background screening (such as pre-employment screening under the FCRA). Everything in this curriculum uses publicly available information and voluntary conversation. If you are ever uncertain whether a specific step crosses a legal line in your jurisdiction, stop and consult a lawyer before proceeding.
This training also does not make you infallible. Professional investigators with decades of experience make assessment errors. The frameworks here substantially reduce error rates for a first-time investigator — they do not eliminate them. Lesson 9 will show you the specific ways that even a competent, well-intentioned investigator can miss critical findings. That is intentional. Knowing your failure modes is how you guard against them.
How to Study This Curriculum
Read each lesson before you need it, but practice with real material
Complete the lessons in sequence. Each lesson builds on the previous one. Lesson 3 (reference elicitation) will not make full sense until you have done Lesson 2 (OSINT), because references are used to probe what OSINT found. Do not skip ahead.
Do the field practice exercises. Reading about elicitation does not teach you to elicit. The field practices are where the learning actually happens. If you cannot do a partner exercise, use the solo alternative — the cognitive work is what matters, not the format.
Use the worksheets while studying, not just during investigations. WS-1, WS-2, and WS-3 are not just operational forms — they are the structure that makes the doctrine concrete. Fill in a practice version of WS-1 while studying Lesson 2, using a public figure as your practice subject. You will understand the lesson differently after you have tried to complete the form.
Do not read Lesson 9 ground truths until you have written your assessments. This is the only rule in this curriculum that cannot be bent. The calibration value is entirely in the gap between your committed judgment and the professional standard. Reading the answers first is the same as not doing the exercise.
Return to earlier lessons. After completing Lesson 4, re-read Lesson 1. After completing Lesson 8, re-read Lesson 5. The material means something different after you have practiced it than it does the first time through.
The Doctrine Behind This Curriculum
You will encounter references throughout this curriculum to specific doctrinal sources. You do not need to read them to complete this training — the relevant content has been extracted and adapted for you. But understanding what they are explains why the methods here are structured the way they are.
FM 2-22.3 — Human Intelligence Collector Operations
The U.S. Army’s primary doctrine for Human Intelligence (HUMINT) collectors — the professionals who gather information through direct human interaction. This is the professional standard for source validation, elicitation, structured interviewing, and deceit detection. It is a publicly available document. When this curriculum refers to “FM 2-22.3 Chapter 9,” it means specific doctrine on detecting deception that the U.S. Army teaches its intelligence professionals. You are learning the same frameworks they learn — applied to a different context. Read the source document →
Camp X SOE Training Manual (STS 103)
The training manual from the Special Operations Executive’s Camp X facility in Canada, which trained Allied intelligence operatives during World War II. The sections on agent recruitment, source handling, and motive assessment are directly relevant to evaluating candidates for any group where trust and loyalty matter. This is historical doctrine that has proven durably applicable across contexts. Read the source document →
AR 530-1 — Operations Security
U.S. Army Operations Security regulation. The OPSEC principles here apply directly to investigation security: protecting your methodology, controlling what you reveal, and understanding that the investigation itself can be a collection target for a sophisticated adversary. Read the source document →
A Note on Language — Key Terms You Will See Repeatedly
This curriculum uses precise language drawn from professional investigative and intelligence doctrine. Most terms are explained when they first appear, but a few show up so often that you need them before Lesson 1.
BLUF — Bottom Line Up Front. Every lesson opens with a BLUF box that states the single most important thing to take from that lesson. Read it first. Return to it after you finish. If you only remember one thing from a lesson, it should be the BLUF.
EEI — Essential Element of Information. A specific question your investigation must answer. Not a category (“employment history”) — a specific question (“Can the candidate’s claimed eight years of Army service be independently confirmed?”). Lesson 1 teaches you how to build them.
OSINT — Open Source Intelligence. Information gathered from publicly available sources: court records, social media, property records, forum posts. Everything in this curriculum’s collection phase uses OSINT only — no hacking, no private databases, nothing that requires a badge or a court order.
Elicitation — Drawing out information through conversation without the other person knowing they are being used as an information source. Not deception — it is asking questions in ways that produce honest, unguarded responses. Lesson 3 teaches the specific techniques.
Legend — A fabricated background story constructed in advance, with supporting evidence placed where an investigator will find it. The legend-builder counts on you checking — and finding exactly what they put there. Lesson 1 covers this in detail.
Baseline — A person’s normal behavior when relaxed and telling the truth. Established in the first 15 minutes of an interview before any probing begins. Deviations from baseline are what you look for — not absolute behaviors, but changes from that person’s own normal.
Activation — The moment your MAG moves from normal operations into an active emergency response. Used throughout this curriculum to describe the conditions your group members will face when their skills, reliability, and judgment matter most.
Source — In this curriculum, a “source” means a person who provides information: a reference, a candidate, or anyone you interview as part of an investigation. It does not imply the person knows they are a source.
Other terms are explained as they appear. The full glossary is in the Student Companion Guide. Look up unfamiliar terms rather than skipping over them — precision of language is precision of method.
Group sessions and facilitated training
This curriculum is designed for self-directed study, but it is also available as an instructor-led course — particularly suited for MAGs who want to train a Vetting Officer as a group, run the calibration scenarios with facilitated debrief, or integrate vetting training into a wider group preparedness program.
Contact fortunefavorstheprepared@protonmail.com for group training options.
Read each profile, then answer the question immediately below it before moving on.
Candidate Profile A — Raymond Holt, 51
Retired corrections officer. Referred by a founding member after meeting at a county emergency preparedness fair. Raymond reached out the same evening with a detailed email explaining his qualifications, his concerns about current events, and a list of skills he could contribute. He has already researched the group’s general area of operations and suggests a first meeting within the week.
Candidate Profile B — Destiny Carr, 34
Freelance graphic designer, referred by a current member’s spouse. Destiny was introduced socially at a cookout. The referring member describes her as ‘exactly the kind of person we need.’ She has been mentioned to two other members in casual conversation before any vetting decision was made. She has no expressed interest in operational roles — she wants to help with communications and design.
Candidate Profile C — Thomas Wren, 44
Former military, now a high school history teacher. Self-referred — found the group through a publicly visible social media post. His initial message is measured, asks thoughtful questions about what the group is looking for, and explicitly states he understands vetting is required. He has not pressed for a timeline.
| Answer all Knowledge Checks correctly to unlock Lesson 1 |
| ← All Nine Lessons |