NORPHLUCHS

Psychological Awareness for Analysts

The news hit like a bombshell: “Jan Marsalek, former Wirecard executive, exposed as a Russian spy!” This was the headline on the morning when investigators and journalists uncovered the secret identity of the man once celebrated as a rising star in Germany’s financial world. But how was Marsalek’s double life uncovered in the first place?

These were not traditional agents, but investigators using Open Source Intelligence (OSINT). They sifted through news channels, analyzed his networks, and connected seemingly unrelated pieces of information. These included Telegram chats with Bulgarian agents, digital evidence of espionage missions, and traces of his identity changes.

This article highlights five common cognitive biases that can influence our perception and explains why professional distance and clear evaluation frameworks are so critical in OSINT investigations.

Midnight in Vienna: An OSINT analyst feverishly tracks Jan Marsalek’s digital footprints. Every new clue could be a breakthrough, or a dead end. But what if it isn’t missing data, but the analyst’s own cognitive bias that obscures the truth? What psychological effects might influence such analyses, and how can we counteract them?

Initial Research

The analyst suspected early on that Marsalek was connected to Russian intelligence services. As a result, he focused his investigation on clues in Telegram channels, contacts with Eastern European actors, and Russian-language leaks. Clues about Marsalek’s earlier activities in Southeast Asia were ignored, as they did not fit his initial hypothesis. What happened here?

Confirmation Bias: The tendency to select or interpret information in a way that confirms existing assumptions or beliefs, while disregarding contradictory evidence.

Tools

By relying solely on familiar tools like LinkedIn, Google Dorks, and Maltego, the analyst neglected platforms such as Telegram, VK, or regional databases. The analysis was strongly Western-centric and missed relevant content accessible only through alternative sources.

Selection Bias / Law of the Instrument (Tool Bias): A systematic error where the selection of data sources is not representative of the whole often caused by habitual use of familiar tools or platforms. Many analysts rely too heavily on known tools or methods, even when they are not optimal for the current investigation.

Early Findings

In the first situation report, a possible stay by Marsalek in Minsk was mentioned. This information shaped the rest of the analysis. The analyst interpreted all subsequent clues in light of this assumption and considered other geographic leads, such as to Beirut or Istanbul, as less credible.

Anchoring Bias: The tendency to rely too heavily on the first piece of information received (the “anchor”) and to interpret all later information in relation to it.

Experience and Intuition

The analyst was regarded internally as particularly experienced in geopolitical networks. In this case, he skipped a structured evaluation of his sources and instead relied on his intuition. Only during the review did it become clear that he had overvalued several unreliable sources.

Overconfidence Bias: Analysts overestimate their own abilities or the reliability of their data sources, particularly when they have accumulated some experience. This can lead to premature, seemingly “certain” conclusions, while warnings or uncertainties are ignored.

Loss Aversion

The analyst had spent days building a dossier on Marsalek’s network in Moldova. When new evidence emerged suggesting an entirely different escape route, he ignored it. The effort already invested acted as a psychological barrier to exploring a new path.

Sunk Cost Fallacy: The tendency to stick to a decision or analysis simply because a great deal of time, effort, or resources has already been invested, even when new evidence suggests a change of course.

Cognitive biases often influence background checks and digital investigations without being noticed. Bias awareness is not only crucial for OSINT analysts but also strengthens decision-making in HR, fraud investigations, insurance. In fact, in any field where careful, fair, and transparent analysis is required.

A simple framework involves always considering at least two alternative explanations, ensuring a variety of sources, and regularly questioning one’s own assumptions as a team. This is an effective way to reduce bias in any area of analysis.