Being first is easy and worth very little. An alert that sends a convoy toward a roadblock because the footage was three years old has done more harm than no alert at all.
The cost of being first and wrong
In the twelve months to April 2026, our regional desks logged and tested 2,740 distinct claims during fast-moving events near client sites. Thirty-nine percent were false, old or filmed somewhere else. That figure is not a comment on any particular platform. It is what the first hours of any crisis look like.
False claims are not evenly spread. They cluster around the most alarming possibilities: an airport seized, a convoy approaching, a building on fire. Those are precisely the claims that prompt organizations to move people. A security team that acts on unverified reports is therefore most likely to be wrong at the moment when being wrong is most dangerous.
Five tests
Every claim that could affect a client decision is logged separately and put through the same five tests. A claim is reported as verified only when it passes all of them.
1. Origin
Where did this first appear, and who posted it? We trace a claim back through reposts to the earliest version we can find. Many claims fail here, because the earliest version turns out to predate the event it supposedly shows.
2. Place
Where was it recorded? Terrain, buildings, road layouts, signage and shop fronts are matched against satellite imagery and street-level photography. We require a specific location, not a plausible city.
3. Time
When was it recorded? Shadow direction and length, weather, vegetation, traffic and visible clocks or broadcasts are compared with records for the claimed time. Footage that is correctly located and wrongly dated is the most common trap.
4. Independent corroboration
Do sources that could not have copied each other agree? Two accounts that share the same clip are one source. A second camera angle, a local broadcaster with its own reporter, or sensor data such as a fire detection or a flight track counts as independent.
5. Consistency
Does it fit with everything else that can be observed? If an airport has been seized, scheduled flights should stop. If a highway is cut, traffic should back up. An event that leaves no trace anywhere else needs a very good explanation.
Four words, used the same way every time
Clients need to know at a glance how much weight a line in a report can bear. We use four status terms, and analysts may not substitute others.
| Status | Meaning | How a client should use it |
|---|---|---|
| Verified | Passed all five tests | Treat as fact for planning. |
| Unverified | Tested, with evidence neither confirming nor excluding it | Be aware of it. Do not act on it alone. |
| Not yet determined | Logged, with testing still under way | Wait for the next report, which will state a time. |
| False | Shown to be old, from elsewhere, staged or fabricated | Remove it from the picture, and tell colleagues who have seen it. |
Reporting falsehoods is as important as reporting facts. A site manager who has watched an alarming video ten times will not be reassured by its absence from our report. They need to be told that we saw it, checked it and can show where it really came from.
The five kinds of false footage
- Old. Genuine footage from a previous event in the same place, recirculated as new.
- Elsewhere. Genuine footage from a different city or country, attached to the current event.
- Miscaptioned. Genuine and current, with a description that changes its meaning: a military exercise described as an advance, a celebration described as a riot.
- Staged. Performed for the camera, sometimes by participants who want to exaggerate their strength.
- Generated. Produced synthetically. Still the least common in our casework, and growing.
The first three account for most of what we remove. They are also the easiest to disprove, because the original usually exists and can be found.
What can be done in the first two hours
Verification has a reputation for being slow. With preparation it is not. For clients with a program in place, our commitment is a first verified situation report within two hours of crisis tasking and escalation of critical verified events near a named site within 60 minutes.
Three things make that possible. The client's sites and routes are already mapped, so relevance is a matter of distance and not of reading every report. The analysts already know the place and its languages. And every claim goes through the same five tests in the same order, which means several analysts can work in parallel without disagreeing about what "confirmed" means.
A first report that lists three claims as verified, five as false and six as not yet determined is a good report. It tells the client exactly which information is safe to plan on, and it stops unverified footage from being treated as a reason to move.
From what happened to what happens next
A verified picture of the present is half of what a client needs. The other half is a view of the next few days, and that is a forecast, which carries more uncertainty than a verification.
We keep the two visibly separate. Forecasts use the probability terms from our fixed scale, and each comes with written indicators: specific, observable developments that would show the situation moving toward a worse outcome. A client reading "likely to remain confined to the capital for 72 hours" also sees the three things we are watching that would change that view.
Indicators have a second purpose. They make the forecast testable. When the period ends, either the indicators fired or they did not, and the forecast can be scored.
Scoring ourselves
Each quarter we review a sample of verified events against what later became established, and a sample of forecasts against what happened. In the most recent four quarters, 99.2 percent of events we reported as verified were borne out by later reporting. The exceptions were all errors of detail, such as a casualty count, and not of occurrence or location.
Forecasts are harder, as they should be. Of 214 forecasts scored in the same period, outcomes fell inside the stated probability range for 81 percent. We publish the method so that clients can ask us for the numbers and so that we cannot quietly stop counting.
What this standard does not do
It does not replace people on the ground. We work from open sources and do not run field agents or human sources. Where a decision needs direct observation, we say so. It also does not make the decision. We describe what is confirmed, what is open and what we expect. Whether to move people is a judgment for the client and the security provider responsible for them.