Outcome: Frame an AI-assisted cybercrime investigation with lawful authority, human accountability, proportionality, hypotheses and explicit prohibited uses.

Case: Project Trinetra begins with a fictional complaint involving executive impersonation, a malicious document, suspicious cloud access and a disputed audio message. The team wants to upload everything to a public AI assistant.

Tools: AI use-case charter, Authority matrix, Human-review plan

Outcome: Prepare, minimise, de-identify, preserve and govern investigative data for approved AI environments without changing source evidence.

Case: Project Trinetra includes original emails, logs, audio, images and KYC-like records. The team needs an approved derivative set for AI analysis without weakening evidence integrity.

Tools: Evidence register, Data-minimisation plan, Secure workspace checklist

Outcome: Design structured prompts and grounded workflows that produce traceable leads, extracts and drafts rather than unverified conclusions.

Case: Analysts receive inconsistent answers because prompts mix facts, instructions and desired conclusions. They must build structured, source-bound tasks.

Tools: Prompt protocol, Output schema, Grounding test

Outcome: Apply AI to synthetic text, image, audio, video and document triage while retaining originals, provenance and human validation.

Case: Project Trinetra has multilingual chats, scanned invoices, call audio, screen recordings and images. AI may accelerate triage but cannot replace source inspection.

Tools: Triage queue, OCR and transcript validation, Multimodal finding log

Outcome: Use AI to support analysis of synthetic endpoint, network, cloud, identity, email and malware artefacts without executing unsafe outputs.

Case: A malicious attachment, identity alerts, DNS records, endpoint events and cloud logs contain useful signals plus adversarial content. AI is used only in an isolated synthetic lab.

Tools: Artefact schema, Detection hypothesis log, Code-safety checklist

Outcome: Use AI-assisted OSINT, entity resolution, timelines and graph analysis with lawful collection, source grading and alternative explanations.

Case: Public posts, domains, companies and usernames appear connected to Project Trinetra. Several are common names, reposts or AI-generated profiles.

Tools: Collection log, Entity-resolution matrix, Source-graded graph

Outcome: Assess suspected deepfakes and synthetic media through preservation, metadata, provenance, signal testing, contextual corroboration and qualified reporting.

Case: A disputed executive voice note and altered video are central to Project Trinetra. Online detectors disagree and one file has valid provenance metadata.

Tools: Media preservation log, Provenance validation record, Synthetic-media opinion matrix

Outcome: Investigate AI-enabled phishing, impersonation, fraud, malware and influence operations without reproducing harmful capability.

Case: Project Trinetra combines AI-written phishing, cloned voice, automated reconnaissance, malicious code assistance and mule recruitment.

Tools: Typology map, Indicator-to-evidence matrix, Harm-control plan

Outcome: Test AI workflows for hallucination, bias, prompt injection, data leakage, poisoning, drift, excessive agency and tool-use risk.

Case: The Project Trinetra evidence pack contains hidden instructions, poisoned reference text and ambiguous regional-language data. The model also has optional tools with excessive permissions.

Tools: Threat model, Red-team test set, Risk treatment register

Outcome: Create reproducible AI audit trails, validation records and disclosure-ready reports that separate evidence, model output and examiner opinion.

Case: Prosecutors and reviewers ask how Project Trinetra AI outputs were created, tested and distinguished from evidence. The team has partial logs and several edited summaries.

Tools: Validation plan, AI audit trail, Disclosure schedule

Outcome: Complete and defend an end-to-end synthetic AI-assisted cybercrime investigation using Project Trinetra evidence.

Case: A fictional organisation reports executive voice impersonation, a malicious invoice, compromised cloud identity, multilingual chats, synthetic profiles and a disputed video. The evidence pack also contains prompt injection and contradictory records.

Tools: Capstone case file, Expert report, Oral defence