Five OSINT capabilities, each with a method and published work behind it

Public sources used

• ACLED
  Geolocated conflict, protest and actor-level events across all 54 states
• UCDP
  Long-term conflict baselines for historical comparison
• Insecurity Insight
  Incidents affecting aid and healthcare personnel
• Local and national media
  First indication of localised events before wider pick-up

How the work is done

1. Define the unit of analysis: country, admin area, corridor or single site.
2. Pull current events, then compare frequency and actor mix against the multi-year baseline.
3. Separate confirmed events from single-source claims before any rating moves.
4. Translate the pattern into a threat statement with a UK-scale rating and a confidence word.

What this cannot settle

• Event datasets carry reporting lag and are denser where media presence is stronger.
• Absence of recorded events is not evidence of safety in low-coverage areas.

Threat, vulnerability, exposure, impact and mitigation with rated registers.

Public sources used

• UN OCHA / HDX
  Operational presence, needs and administrative boundaries
• ReliefWeb
  Situation reports and agency updates
• IOM DTM
  Displacement tracking and population movement
• UNHCR
  Refugee and returnee statistics
• FEWS NET
  Food-security and drought indicators that precede displacement

How the work is done

1. Ingest operational presence and needs records with their source and collection date attached.
2. Read co-location as observation, never as proof of causation or of coverage quality.
3. Avoid summing disaggregated needs figures; report them by sector and dataset instead.
4. Convert the picture into access constraints, movement implications and staffing exposure.

What this cannot settle

• Datasets describe reported activity, not verified delivery on the ground.
• Coverage gaps concentrate exactly where access is hardest, so absence of records means little.

Stored OCHA HDX and IATI records with per-country counts and provenance.

Public sources used

• Copernicus Sentinel
  Optical and Sentinel-1 radar imagery, usable through cloud and at night
• NASA FIRMS
  Fire and thermal anomaly detection for incident corroboration
• USGS
  Earthquake and geophysical hazard data
• Google Earth Pro
  Historical imagery, infrastructure and route analysis
• GDACS
  Disaster alerting for rapid tasking of imagery checks

How the work is done

1. Fix the location and the time window from the reporting before opening any imagery.
2. Prefer radar where cloud, smoke or darkness would defeat optical scenes.
3. State the acquisition date of every scene used, and what changed between scenes.
4. Record what imagery cannot settle: intent, casualties, attribution.

What this cannot settle

• A thermal detection is heat, not an attack; it needs a second, independent line of evidence.
• Free imagery revisit rates and resolution limit what can be resolved at site level.

Geospatial and early-warning layers labelled by source and collection layer.

Public sources used

• Bellingcat Online Investigation Toolkit
  Verification tradecraft and tooling
• Google Lens / reverse image search
  Establishing whether an image is recycled
• InVID / WeVerify
  Video keyframe extraction and reverse-search workflow
• SunCalc
  Shadow and sun-position checks against a claimed time
• OpenStreetMap
  Feature matching for geolocation

How the work is done

1. Trace the earliest publication of the material before assessing its content.
2. Reverse-search stills and keyframes to rule out recycled imagery.
3. Match fixed features to imagery or mapping; confirm time with shadow and weather checks where possible.
4. Record the chain and the residual doubt, then assign a confidence level.

What this cannot settle

• Verification establishes place and time far more reliably than it establishes responsibility.
• An unverifiable claim stays labelled reported, and does not move a rating on its own.

A to D reliability with the fact, reported and assessed separation applied throughout.

Public sources used

• GDELT
  Large-scale media monitoring and narrative shift detection, as a tripwire only
• ISS Africa
  African security, governance and organised-crime research
• International Crisis Group
  Conflict and political-dynamics analysis
• OpenSanctions
  Sanctions, PEP and entity screening
• OCCRP Aleph / OpenCorporates
  Company, ownership and public-record research

How the work is done

1. Treat a media-volume spike as a prompt to look, never as a finding in itself.
2. Test the signal against official advisories, primary documents and institute research.
3. Screen counterparties and intermediaries before commitments, and record what was checked.
4. Set out plausible 6 to 18 month pathways with explicit confidence, plus the indicators that would separate them.

What this cannot settle

• Media attention measures coverage, not ground truth or severity.
• Corporate and sanctions records are uneven across jurisdictions; a clean screen is not a clearance.

Tiered public-source register with reliability, cadence and coverage notes.