About this investigation

Surfaced HIGH-sensitivity assumptions around (a) the unextracted 8-K EX-99 exhibits as the source-of-truth for penalty / monitor / commodity facts (kj_003) and (b) the inferred boundary between FCPA Qatar conduct and AECA / ITAR conduct as two distinct conspiracies rather than overlapping. Both surfaced assumptions are LOW-confidence and become confidence-limiting factors on downstream judgments dependent on monitor identity or penalty quantum.

Generated two competing hypotheses to explain the converged enforcement footprint: H1 systemic multi-decade compliance failure (recidivism from 2001 In Re Raytheon Securities through 2024 DPA + Peneycad + Johnson FCA); H2 isolated incidents that matured in the same window by coincidence. H1 retains lower weighted inconsistency given the 1999-2024 span and the cross-business-unit concentration (defense electronics + engines + government contracts). H2 retained as the alternative inside kj_001.

Failure modes considered: (a) the 8-K exhibits when extracted reveal significantly smaller penalty / narrower monitor scope, weakening kj_003 expectation of materiality; (b) the OpenSanctions crime.traffick flag is replaced/relabeled upstream, removing the misreading risk in kj_005; (c) the Ekambram plaintiff dismisses on the pleadings, weakening the kj_002 'live exposure' inference. None of these failure modes invalidates the leading ACH hypothesis; all are confidence-limiting on specific judgments.

Adapted to legal-regulatory exposure rather than cyber attack surface — the recon evidence base captured no infrastructure / subdomain / credential / endpoint exposure. Red Hat instead surfaced six vectors describing how plaintiff bars, foreign procurement counterparties, competitor engine providers, FOIA litigants, and journalists can leverage the existing public exposure against RTX. Vector r_01 (expanded derivative theory) is the strongest by Admiralty-weighted evidence.