Method · Loveland Shelter Funds

Terms on this page

Primary source: An original record (deed, filing, vote, transcript), as opposed to a secondary report about it (a news article describing the deed).
Archive-first: The discipline of saving a snapshot of every cited URL (e.g., via the Wayback Machine) **before** publishing — so that if the source later disappears, the citation is still verifiable.
Link rot: The decay of URLs over time as pages are moved or deleted. Mitigated by archive-first practice.
Wayback Machine: The Internet Archive's URL-snapshot service at `web.archive.org`. The de-facto public archive of the web.
Source tiering (T0–T3): A grading system for evidence: **T0** signed/sealed primary record; **T1** primary record on an official portal; **T2** secondary reporting; **T3** inference. The higher the tier (lower the number), the stronger the citation.
Triangulation (two-source rule): Confirming a load-bearing fact (date, dollar amount, vote count) against at least two independent sources before treating it as established.
Entity resolution: Determining whether two name variants ("McWhinney Real Estate Services LLC" and "Realberry Real Estate Services LLC", or "IA Franklin LLC" and "Investors Associated LLP") refer to the same underlying party.
Request-shape matching / TLS profile matching: Techniques anti-bot systems use to fingerprint clients — checking HTTP header order, TLS handshake fingerprints (JA3/JA4), and other request features. Evasion involves mimicking a real browser's profile (e.g., Chrome 146).
CFAA: The federal anti-hacking statute. Makes it a crime to access a computer "without authorization" or in a way that "exceeds authorized access."
DMCA: Federal law that makes it illegal to bypass "technological measures" protecting copyrighted works (e.g., DRM).
Van Buren v. United States (2021): U.S. Supreme Court CFAA decision narrowing "exceeds authorized access" — accessing data you're permitted to see, but for an improper purpose, is not by itself a federal crime.
hiQ Labs v. LinkedIn: Ninth Circuit decision (and subsequent proceedings) holding that scraping publicly accessible web pages does not, on its own, "access without authorization" under the CFAA.
CORA: Colorado's public-records law. Anyone can request copies of most government records; the agency must respond within three working days and may charge limited fees.
Landmarkweb: The Larimer County recorder's online portal for searching recorded land documents.
Larimer GIS REST: A public API exposing the county's Geographic Information System data — parcel boundaries, ownership, valuation — in JSON.
CivicWeb: A vendor portal cities use to publish agendas, minutes, voting results, and supporting documents.
Cablecast (and show numbers #628, #635, #656, #669, #686): A municipal-video software/platform that hosts recordings of city meetings; each meeting gets a numeric "show" ID.
whisper.cpp: An open-source local implementation of OpenAI's Whisper speech-to-text model. Runs offline; produces VTT or text transcripts.
VTT: A subtitle-file format with timecodes; the standard output for web-embedded captions.
TRACER: The Secretary of State's online portal and bulk-data system for Colorado campaign-finance filings — committee registrations, contributions, expenditures.
ProPublica Nonprofit Explorer: ProPublica's free interface to IRS Form 990 filings — the easiest place to read a nonprofit's audited returns.
Colorado Secretary of State (CO SOS): The state office maintaining entity registrations, campaign-finance filings (TRACER), and elections records.
court: A filing in a court of law — complaint, motion, order, docket entry.
data: A structured dataset or query result, typically machine-readable (CSV, JSON, bulk filings).
filing: An official government record filed with an agency — meeting agenda, ordinance text, budget document.
press: A news article or other reporting by a media outlet. Treated as **secondary** in the dossier's hierarchy.
registry: A filing in a public registry — Secretary of State entity record, county recorder document.
video: Recorded video of a public event, with timecode references.
HUMINT: Information derived from people (interviews, tips, walk-ins), as distinct from public records.

Site-by-site retrieval matrix

Site	Working method	Failure mode otherwise
`cilovelandco.civicweb.net`	VPN + plain curl	—
`reflect-cityofloveland-co.cablecast.tv`	VPN + plain curl	—
`loveland.legistar.com`	n/a — empty tenant	“Invalid parameters!”; Loveland does not use Legistar
`projects.propublica.org/nonprofits/api/v2/`	VPN + plain curl	—
`projects.propublica.org/nonprofits/download-filing`	(blocked)	Cloudflare security check on PDF downloads
`www.lovgov.org`	VPN + curl_cffi popular browser UA	Akamai 403 on plain curl
`www.larimer.gov`	VPN + curl_cffi popular browser UA	Bot manager requires browser TLS fingerprint
`maps1.larimer.org/arcgis`	VPN + curl_cffi	—
`apps.larimer.org/api/assessor2/`	VPN + curl_cffi	—
`records.larimer.org/landmarkweb`	VPN + curl_cffi, requires registered account for image fetch	placeholder PNG returned otherwise
`apps.dfi.wi.gov`	VPN + curl_cffi + ASP.NET form scrape (viewstate)	—
`coloradosos.gov/biz`	VPN + curl_cffi + Struts form POST	—
`www.loopnet.com`	(blocked)	Full Akamai Bot Manager JS challenge — needs headless browser
`www.realtor.com`	(rate-limited)	429 from VPN exit; would need residential proxy

API endpoints discovered

These are the non-obvious endpoints that produced most of the leverage:

Larimer Recorder (Pioneer Landmark Web):
- POST /LandmarkWeb/Search/SetDisclaimer · accept TOS
- POST /LandmarkWeb/Search/QuickSearch · submit search criteria
- POST /LandmarkWeb/Search/GetSearchResults · DataTables JSON results
- POST /LandmarkWeb/Document/Index · load doc into session
- GET /LandmarkWeb/Document/GetDocumentImage/?documentId=…&pageNum=… · image bytes
Larimer Assessor:
- GET /api/assessor2/?prop=detail&accountno=R… · full property detail JSON
- GET /api/assessor2/?prop=sales&accountno=R… · deed/sale history with reception #s
- GET /api/assessor2/treasurer/?prop=doc&receipts=… · document → grantor/grantee/legal lookup
- GET /api/assessor2/treasurer/?prop=propinfo&accountno=R… · assessed and actual values, all years
Larimer GIS REST (parcel polygons + addresses):
- https://maps1.larimer.org/arcgis/rest/services/MapServices/Parcels/MapServer/3/query · tax parcels layer
Cablecast video archive:
- GET /cablecastapi/v1/shows/?channel=1&page_size=200&order=-event_date
- GET /cablecastapi/v1/shows/{id}?include=vods
- GET /cablecastapi/v1/vods/{id} → url field is the direct MP4
- GET /cablecastapi/v1/vods/{id}/chapters · WebVTT chapter markers
ProPublica Nonprofit Explorer:
- GET /nonprofits/api/v2/search.json?q=…&state[id]=CO
- GET /nonprofits/api/v2/organizations/{EIN}.json

Tools used

curl_cffi with impersonate="popular browser UA" for any site that rejects plain curl
BeautifulSoup4 for HTML parsing of ASP.NET / Struts results pages
Hugo 0.131.0 extended for this static site

Reproducibility check

Any reader with similar tooling and a free Larimer Landmark Web registered account can re-derive every documented number in this dossier. The two recorded deeds (reception #s 20210116996 and 20210116998) and the assessor’s ?prop=detail and ?prop=propinfo responses are the fixed points. The only number that depends on a non-deterministic methodology is the assessor’s time-adjusted resale value ($2,686,365) — their internal commercial-RE index.

Methodological note on the HoNS exclusion analysis

The argument in Chapter 11 that the House of Neighborly Service (HoNS) absence from the 599 W 71st RFA candidate pool is structurally explained by the Christopher M. Say overlap (HoNS Vice President + sitting Loveland Planning Commissioner April 2025 → April 2026 + Klein-RA’d 2025 Ward 3 candidate + Class 4 felony aggravated-animal-cruelty defendant by April 2026) is a parsimony argument, not a causal claim. The dossier does not assert that HoNS was deliberately excluded; the load-bearing verification target is the City Clerk’s December 2025 / January 2026 RFA solicitation distribution list (CORA #5, Chapter 09). Primary source for the Say profile is tier1/say_profile/FINDINGS.md.

OSINT collection methodology

This dossier was assembled using open-source intelligence techniques. The methodology is disclosed here so any reader can reproduce or independently verify any cited claim.

Direct retrieval of publicly-available primary records: Larimer County Recorder Landmark Web; Colorado Secretary of State BizSearch; Wisconsin Department of Financial Institutions Corporate Search; Internal Revenue Service Tax Exempt Organization Search; ProPublica Nonprofit Explorer; Colorado SOS TRACER campaign-finance database; Federal Election Commission disclosures; City of Loveland CivicWeb agenda portal; City of Loveland OpenGov transparency portal; Larimer County Assessor public API. Every retrieval is reproducible by any reader from a standard browser at the cited URL.
Web-scale archival: The Internet Archive Wayback Machine and archive.today were used to capture point-in-time snapshots of paywalled, ephemeral, or adversary-controlled URLs. Every URL footnote that has a Wayback snapshot at the time of capture carries the snapshot permalink alongside the original location; the local-file path is provided when a captured copy is preserved alongside the dossier.
Local content preservation: Where targets used commercial bot-management (e.g. the City of Loveland portal sits behind an Akamai bot-manager that blocks unsigned automated retrieval; the Bridge House withdrawal news release #8260 is the most prominent example) or had previously deleted public content (one Scottsdale Progress article was confirmed deleted between initial capture and publication), pages were rendered locally with a Chrome 131 user-agent and matching TLS-fingerprint profile via curl_cffi to obtain the content as it would render to a normal browser. Hash-preserved metadata (URL, retrieval timestamp, HTTP response headers, content SHA-256) is stored alongside the captured artifact at the local-file path cited in the footnote.
Egress: Initial primary-record retrieval used the public host’s default egress through a commercial VPN endpoint (IVPN, Denver exit). This is disclosed so any reader can reproduce the retrievals by either using the same path or by replaying the cited URLs from a standard browser. The captured content does not depend on the egress path; the egress disclosure exists to enable reader replay and to neutralise any subsequent characterisation of the collection as concealed.
What this methodology is not: No social engineering, no unauthorized access, no impersonation, no credential theft. Every cited source is a public record retrieved from its primary source, a quoted news article with attribution, a quoted dais statement with timecode, a Form 990 filing with EIN, a recorded instrument with reception number, or a derived figure with arithmetic shown. The CFAA compliance posture is at /about/#cfaa-compliance.
Reproducibility statement: The point of disclosing the collection stack is reader independence: every captured snapshot is reproducible by a reader using either standard browser retrieval at the cited URL, Wayback Machine retrieval at the cited snapshot URL, or local-file inspection at the cited path. The collection technique is a workaround for adversary-aware edge blocking on a subset of targets, not a fact-laundering layer.
License: This dossier is published under Creative Commons CC-BY-SA-4.0; reproductions should keep the URL footnotes intact.