Le Khoa: Inside the Old Hard Drive — When an Investigative Journalist Must Learn to Trust Cold Numbers

I begin this piece with a file named BULE_2837_FINAL_FINAL_v3.xlsx. Last modified: 23:47, June 11, 2026 — the night before a V.League 1 promotion play-off. Inside is a payroll for 28 players, a hidden column containing 11 transfer lines with no employee codes, and a cell with a hasty English note: 'check with agent H.'

I am not writing this to tell my own story. I am writing it because over the past three months I have received more than forty emails from young reporters asking the same question: How do you know a leaked document is real? That question has never had a simple answer, and with the mid-season transfer window entering its final stretch, I think it is time to offer a concrete standard rather than general advice.

Context: The 2026 transfer market is drowning in a new kind of noise

The current transfer window looks unlike any period I have tracked since 2026. Transfer rumors used to come from three sources: agents, local press, and social media accounts connected to clubs. Now there is a fourth — language models trained on old transfer data, generating rumors that sound plausible but have no origin.

A concrete example. On January 28, 2026, an account with 340,000 followers posted that a V.League 1 club was negotiating with a 24-year-old Brazilian striker, a fee of 1.8 million USD, a three-year contract. The information was detailed: player name, former club, release clause. I cross-checked against my personal database — a tracking file of 1,247 Brazilian players who have played in Southeast Asia since 2026 — and the name did not exist. Not that the player did not exist, but that the player had never been registered with any federation.

This is why I built a three-layer verification process for any transfer information: the first layer is the player's existence in federation registration databases, the second is the validity of the figure against the league's average salary, and the third is the trace of money in public corporate records. Skip any layer, and I do not publish.

Core Analysis: Three samples, not two

In doping investigations, the most basic principle independent laboratories follow is never concluding from two samples. Sample A and Sample B may both return negative, but the difference between them — collection time, storage temperature, chain of custody — is where the truth lies. I learned this principle in 2026 while working with a leaked document from a Moscow laboratory.

That document showed 37 test samples from the Russian national team before the 2026 World Cup had abnormal testosterone ratios. But what took me three months to verify was not the testosterone figure — it was the file modification dates. All 37 samples were edited within the same time window: from 02:14 to 02:47 on the morning of June 14, 2026. No laboratory processes 37 samples in 33 minutes at two in the morning, unless someone is deliberately synchronizing timestamps.

Money trail technique: From bank statement to shell company structure

This is the part I most want young reporters to remember. When I investigated the collapse of a club in Tianjin in 2026, I did not start with player testimony or club press releases. I started with a bank statement from a former executive who agreed to provide documents on condition of anonymity.

The statement contained a transfer of 4.7 million RMB on March 19, 2026, listing the recipient as a company called 'Tianhe Sports Co., Ltd.' I checked public corporate registration records and found this company was established on February 7, 2026 — six weeks before receiving the money — with registered capital of 100,000 RMB and a registered address matching a photocopy shop in Hebei District.

From there, I reconstructed the entire chain: three shell subsidiaries established within four months, all receiving money from the club, all forwarding money to a personal overseas account, and all dissolved within six months of receiving funds. A total of 11 million RMB vanished through this structure. The club declared dissolution over unpaid wages — while the money trail showed the funds had not disappeared, they had simply been moved elsewhere.

Contrarian Point: Not every leaked document is trustworthy — but not for the reason you think

After years of working with leaked documents, I have realized the most common mistake young reporters make is not trusting fake documents too much. The most common mistake is trusting real documents too much.

A document can be real — correct date, correct signature, correct seal — and still present a distorted version of the truth. In the 2026 case involving a 23-year-old Belgian winger of Congolese descent, I received 14 pages of entirely authentic medical documents. The player had been treated with growth hormone for a knee injury since 2026. The documents were real. But the documents did not show the most important thing: the player had failed to declare properly to the anti-doping authority, and the hormone was used outside the permitted therapeutic window.

Real documents can mislead more than fake ones, because we tend to stop checking once authenticity is confirmed. My principle: document authentication is the first step, not the last. After authentication, I still must ask the second question — what does this document not say?

Lessons from the transfer market: A contract has one page, but the annex is the story

During transfer windows, reporters typically focus on the transfer fee figure. That is a mistake. The transfer fee is the public number, agreed by both parties for publication. What is not public is the payment structure: what percentage is paid upfront, what percentage is performance-based, sell-on clauses, release clauses, and most importantly — who is the agent actually receiving the commission.

A player announced at a fee of 1 million USD may actually cost 1.6 million USD when all ancillary payments are counted. And a player announced at 800,000 USD may have a lower total cost if the contract structure is simpler. This is why I always read the annex before the main page. The main page is for the public. The annex is for those who actually want to know the truth.

Call to responsibility: Building a personal database as an act of self-defense

I do not expect young reporters to copy my method. I expect them to build their own. A personal database of doping cases since 2026, a money-trail tracking file for clubs, a comparison table of league average salaries — these do not require complex technology. They require time, discipline, and patience.

But above all, they require an ethical decision: refusing to publish when evidence is insufficient. In a market where speed is treated as the highest value, the decision to slow down is a professional act, not weakness.

The stadium is spotless. But in old hard drives, in contract annexes, in Excel files modified at two in the morning — that is where the real match takes place. And that is where the investigative journalist must learn to read.