There are two ways that snipers get highlights and lowlights:

Threat and Suspicion are correlated for the simple reason that spies like doing missions. When the sniper sees someone going to a middle statue late in the game, alarm bells should be going off. This person is very threatening: they’re potentially completing one mission (Inspect Statues), and could also potentially complete Swap. They’re also very suspicious, because spies love leaving Inspects for late in the game to avoid a highlight, and because they’d generally rather finish with a soft tell mission over a hard tell one.

It’s a basic fact of SpyParty that non-threatening and non-suspicious people make up the majority of most parties. Most AI are not completing missions (low threat) and are generally acting AI-like (low suspicion). Snipers who care to play behaviorally, then, can get a lot of lowlights if they pay attention to these low threat, low suspicion characters.

There are three pitfalls to taking those lowlights, however. Firstly, and most obviously: the spy can angle for one of these lowlights by deliberately mimicking unsuspicious behavior. Secondly, the sniper may miss things and lowlight for things that seem low threat, but aren’t. For example, they may lowlight someone for standing in one conversation for a long time, even though the spy might be timer flirting, or they may lowlight them for taking a drink, unaware that it has a fingerprint on it. Finally, any time spent watching people who aren’t being suspicious or threatening is time spent not watching people who are both.

The interesting decision, for the sniper, is how to deal with people who are Suspicious or Threatening, but not both. That’s the kind of ambiguity that gives snipers headaches.

Suspicious, But Not Threatening

The list of things that are potentially suspicious, but not threatening, is long. A partygoer may be very active, continually moving around, and they might repeatedly make decisions that provide minor benefits to themselves, such as rejecting a drink to keep their hands free or choosing to stand behind cover. They also might stand right next to the Ambassador, potentially with the intent to bug if you dare look away. And so on.

The concern with these characters is that we tunnel on them even if they’re not the spy. No matter what a suspicious partygoer does, a tunneling sniper’s confirmation bias can find reasons to continue suspecting them. If they become more threatening by taking a print or going to statues, the sniper says “Now they’re suspicious AND threatening!” If they do nothing, the sniper says “They know they’re caught, so now they’re trying to lay low.” This is a trap, but there are ways to avoid it: since you’ve been watching them, you should have a good understanding of what missions they could have completed, and you only have to shoot once they reach potential mission completion. And if a mission with a visible tell takes place, like a Purloin, you should already know (given that you’re watching them closely) whether they could be responsible, and consequently lowlight them if not. At their best, snipers can simply acknowledge their folly and stop tunneling.

Threatening, But Not Suspicious

AI-controlled characters, through bad luck or good framing, can sometimes potentially complete enough missions to reach the mission win countdown. Some snipers are willing to shoot on this condition alone, regardless of how suspicious the character is, and simply throw up their hands and blame bad luck when they are wrong. This is where tunneling is important: tunneling a high threat (but low suspicion) character allows you to watch for subtle things like flirts or animations, that the sniper might not otherwise find to be an efficient use of their attention. That attention is more justifiable for characters at high threat of mission completing.

For example, consider Inspect Statues on Veranda. One statue visit is not concerning, AI pick up statues all the time and Inspects cannot be completed in a single visit. Two statue visits (of different statue sets), however, is very concerning: that is both very threatening and very suspicious. Three visits is weird, because Inspects should already be done! The sniper should consider if maybe this is an incoming Swap, a fingerprint, or a cheeky flirt. Four visits? No spy is foolish enough to do four visits! Four visits may have exactly the same threat level as two visits, but to me, it’s significantly less suspicious 1.

So how does one deal with this very threatening (but unsuspicious) statue fiend? You could consider whether they take their time picking up and putting down the statues, as opposed to rushing through them like spies are prone to do, for one. You could also note whether they’ve had the opportunity to flirt between those visits, too. Factoring these sorts of things can delay your need to shoot, and potentially win you the game.

One underused option, in either situation, is to take highlights who are moderately threatening or suspicious, and instead of lowlighting them, simply neutral light them. This way you don’t tunnel on AIs as often, but you also won’t miss last ditch Bug attempts if they are the spy.

In conclusion, snipers should decide what it is they want to prioritize. Using your highlights only for threatening things like statue visits is fine, but understand that the meta for spies will then revolve around avoiding early statue visits to avoid that highlight. Highlighting for both Suspicious things and Threatening things will result in a large number of highlights, potentially devaluing all of them. Will you bother watching and lowlighting non-suspicious, non-threatening people, or just watch your suspects? There is not necessarily a right answer, but ask yourself the question, be confident in your decision, and go shoot some spies.

1 Five statue visits though, that’s a trolling spy and can be shot on sight. Six is right out.