The 25-year-old’s alleged actions in the days after the attack suggest he was not exactly a criminal mastermind. The U.S. Attorney’s Office said Council conducted a series of suspicious internet searches, for phrases like “SECGOV hack,” “telegram swap,” “how can I know for sure if I am being investigated by the FBI,” and “What are the signs you are under investigation by law enforcement or the FBI even if you have not been contacted by them.”
A better title would have been "Man arrested by FBI for SEC hack had searched ‘How to know for sure if you are being investigated by the FBI’."That would eliminate the incorrect implication.
OP used the title from the article. Is that not convention?
Yes, it is. But when the article’s title is bad, that’s more than enough reason to break convention.
I don’t disagree that there could have been a better headline. As I said, it’s deceptive. But it’s also not inaccurate.