Credible vs possible: how to read a threat warning

On 31 October 2026, the US Embassy in Moscow issued a security alert. It said the US government had information about a credible threat of an event that could cause mass casualties at the Tsaritsyno Museum-Reserve that day, and that it was coordinating with the Russian authorities. It told US citizens to stay away, avoid crowds, keep their phones charged and carry identification.

Later that day, Russia's FSB said, through the state news agency TASS, that it had received the US information and that "appropriate work is underway". The museum first said it was operating as normal, then closed "for technical reasons", and police closed the entrance.

That same evening, an "intelligence update" spread on LinkedIn. It described the same warning as a possible mass-casualty incident, said the likelihood of an attack was unknown, and cited secondary reporting. It did not link the embassy's alert, which was public the whole time, and it did not mention that the museum had already closed.

Nothing in that post was invented. But it changed the message. I'm not naming the author, because the problem is not one person. It is a pattern: alerts rewritten from someone else's summary, often with AI, and published for reach.

Why one word matters

"Credible" is a judgement by the people who hold the underlying information. "Possible" is a word you can apply to almost anything. Turning one into the other, while adding "likelihood unknown", quietly downgrades the warning.

That matters because people act on these words. A family office deciding whether a principal keeps a dinner booking, a travel manager deciding whether staff go out that night, or a parent deciding whether to take children to a park, will each decide differently on "credible" than on "possible".

Context makes the point sharper. In March 2024, the US Embassy in Moscow warned that extremists had imminent plans to attack large gatherings, including concerts. About two weeks later, the attack on Crocus City Hall killed more than 140 people. A specific, public warning from the same embassy deserves to be taken at its word.

How professionals grade a threat

Intelligence analysts separate two questions that casual reporting often blurs together.

• How reliable is the source, and how credible is the information? The Admiralty Code, used in NATO intelligence work, grades the source from A (completely reliable) to F (reliability cannot be judged) and the information from 1 (confirmed by other sources) to 6 (truth cannot be judged). An embassy alert is a primary source; a repost of a repost is not.
• How likely is it? The UK Government's probability yardstick gives each phrase a range, so that readers do not have to guess: a realistic possibility is roughly 40 to just under 50%, likely is about 55 to 75%, and highly likely about 80 to 90%. A writer who uses those terms can be held to them.

Neither system was applied in the repost. That is the real failure: not a false fact, but an unclear and unaccountable judgement.

The four-point check

Before you act on, or share, any "intelligence update", check four things:

1. Primary source. Can you click through to the original alert, report or statement? If the author had access to it and did not link it, ask why.
2. Graded confidence. Does it say how sure it is, and on what basis? "Possible" with no grading is not an assessment.
3. Time window and status. When is it valid, and what has changed since? A threat alert without a timestamp and an expiry is stale the moment it is posted.
4. Specific actions. What exactly should someone do, and for how long? "Avoid the area" is a start. Who should avoid it, which other places carry the same risk, and when to check in are the parts that protect people.

If any of the four is missing, it is not intelligence. It is content.

What a good alert looks like

Written that evening, a professional note would have led with the embassy's own word, credible; linked the alert; stated that the museum had closed; given a validity window; pointed out that an attacker could switch to another crowded place; listed concrete steps for people in Moscow; and said when the next update would come. It would have taken ten minutes longer to write, and it would have been far more useful.

The same discipline, tracing every claim back to its evidence, is the idea behind my research on documentation and residual liability and behind the tools I build.