Source Attrition Rate (SAR)
How fast a threat's supporting network is being dismantled. Close the sources, not the messenger.
Formula
Thresholds & Bands
| Band | Range | State |
|---|---|---|
| Effective | ≥ 60 | ok |
| Partial | 35-60 | warn |
| Failing | < 35 | crit |
Why This Metric Matters
Source Attrition Rate measures the Directorate's ability to neutralize threats at the root by dismantling the information networks that sustain hostile actors. Silencing a single journalist or activist is a temporary measure if their source network remains intact — another actor will simply inherit the contacts and continue the investigation. High SAR ensures that when a threat is engaged, its supporting infrastructure of informants, document leakers, and sympathetic insiders is systematically closed, rendering the threat actor isolated and unable to substantiate future claims against Directorate operations.
Threshold Justification
The 60% effective threshold was derived from PANACEA's network-resilience modeling, which demonstrated that hostile information networks lose operational coherence when more than half their key nodes are compromised or closed within a single cycle. Below 35%, the attrition rate is insufficient to outpace the threat actor's ability to recruit replacement sources, resulting in a net expansion of the hostile network despite active countermeasures.
Historical Context
SAR was initially difficult to measure, as the Influence Operations division lacked a systematic methodology for mapping source networks during the Directorate's first year of operations. A standardized network-analysis framework was deployed in Q3 2024, yielding the first reliable SAR measurements at approximately 40%. Targeted investment in social-engineering capabilities and VITALNET-derived contact mapping raised the metric above 60% by Q2 2025, where it has since stabilized.
Collection Method
SAR is calculated per operational cycle by the Influence Operations division. For each active threat case, a source-network map is maintained within the Synaptic Data Fabric, cataloging identified sources by type — insider, document holder, technical contact, media intermediary. Sources are marked as closed when they have been rendered non-functional through any approved method, including employment termination, relocation, legal action, discreditation, or voluntary cooperation agreements. PANACEA computes the cycle-over-cycle attrition percentage and cross-references it with the threat actor's observed output to validate effectiveness.
Known Failure Modes
Source-network maps are inherently incomplete; unidentified sources will not appear in the attrition denominator, inflating SAR by understating the total network size. Sources marked as closed may resume cooperation through encrypted or anonymized channels that evade VITALNET monitoring, producing false-positive closures that degrade the metric's predictive value. Additionally, SAR does not distinguish between high-value sources with access to classified material and peripheral contacts, meaning a high attrition rate may reflect the closure of low-value nodes while critical sources remain active.