The one called "Threat Modeling", you map capabilities of the target, not it's intentions.

Thanks to parallel construction they will only say that a person of interest gave them access to the group, they won't disclose they constructively know who is in the group, who joined when, and decrypted messages from cloud infrastructure