How Conflict Signal verifies an incident

Most conflict trackers answer the question "what is being reported?" This one tries to answer a narrower and more useful question: what actually happened, in a place we can point to?

Those are not the same question, and the gap between them is where almost all bad conflict data lives. A headline saying strikes have "escalated" is reporting. It is not an event. A minister condemning an attack from a podium in another country is reporting. It is not an event there.

Here is what a report has to survive before it becomes a marker.

1. It must describe one concrete action that already happened

The first filter rejects the entire category of things that read like conflict news but describe no discrete event: diplomacy, speeches, threats, allegations without a concrete incident, analysis, live-update roundups, procurement announcements, and military exercises.

It also rejects headlines phrased as questions. "Will Iran retaliate?" is not an incident, and a classifier that scores it on keywords alone will happily place it on a map.

The practical test is whether the text describes a single armed action that has already occurred, rather than a category of actions, a plan, or a reaction to one.

2. It must name a place the action physically happened

This is the filter that does the most work, because place names in conflict reporting are overwhelmingly not the location of the event.

Consider where a country name can appear in a single sentence of wire copy:

• the dateline the reporter filed from
• the publisher's own name
• the nationality of the casualties
• the nationality of the attacking force
• the operator of a base, or the flag of a ship
• a diplomatic meeting or the name of an agreement
• a previous, unrelated attack referenced for context

None of those position an event. "Islamabad" in "the Islamabad memorandum" is not an airstrike location, and a system that treats every place name as a coordinate will scatter markers across capitals that had nothing happen in them.

So the requirement is specific: the text must state the armed action and its physical place in the same clause. Everything else is marked as context and is barred from positioning the event.

We never use a country centroid

If reporting only establishes a country — not a city, town, base, airport, port, or explicit coordinates — the event gets no coordinates at all rather than a pin in the country's geometric middle.

This is a deliberate loss of coverage. Centroids look like data and are not: they invent a precision the source never claimed, and they cluster unrelated events into a fake hotspot in the middle of a country. A missing pin is honest. A wrong pin is worse than nothing.

The same rule governs trajectories. Drawing a line requires two explicitly named physical endpoints. "The US struck Iran" does not establish a launch point on US soil, so no arc is drawn.

3. At least two independent reports must agree

A single report is a claim. Corroboration is what turns it into a verified alert.

An alert fires when two or more reports describe the same event within 120 minutes and 50 kilometres of each other. Both bounds matter: without the time window, an anniversary retrospective corroborates a fresh strike; without the distance bound, two unrelated incidents in one large country merge into one.

Confidence is then reported as what it actually is — the number of independent sources and their timestamps. There is no invented confidence percentage, no modelled probability, and no casualty estimate beyond what sources state.

4. Republished wire copy cannot corroborate itself

This is the check that separates real corroboration from the appearance of it, and it exists because we measured the failure in our own production data.

A single wire story is routinely republished, byte-for-byte, across many domains. Over one recent week, ten stories in our feed appeared under identical headlines on multiple different sites. One example ran simultaneously on three domains that are all part of the same syndication network.

Counting distinct publisher names, that story looked like three independent sources — enough to push it to high severity. It was one newsroom, reprinted three times.

So corroboration is now counted as the lesser of two numbers: distinct outlets, and distinct normalised headlines.

sources = LEAST(distinct outlets, distinct normalised headlines)

Three copies of one story score LEAST(3, 1) = 1 and fire nothing. Two outlets that each wrote their own headline score LEAST(2, 2) = 2 and corroborate normally. The rule can only ever lower a count, never inflate one.

What this deliberately does not claim

Being explicit about the limits is part of the method:

• We are an aggregator and verifier, not a primary reporter. Every incident carries its originating outlet and article URL. Where you can, cite the outlet.
• Air-raid siren coverage is Ukraine only, from the official civil-defence feed. Alerts are shaded across whole administrative regions under warning — they are not located strikes.
• Satellite thermal anomalies are reference data, not conflict events. NASA FIRMS detects heat. Wildfires, agricultural burning and industrial flares all register the same way as a munition strike.
• Aircraft and vessel positions come from public transponder and AIS data. Coverage is uneven, and military assets frequently do not broadcast. Absence of a track is not evidence of absence.

Why the bar is set here

Every filter above costs coverage. Rejecting country-only reports loses real events. Requiring two independent sources means a genuine single-source scoop does not fire an alert.

That trade is intentional. A monitoring tool that shows fewer events, each of which you can trace to named reporting and a place that was actually named, is more useful than one that shows everything and leaves you to work out which half is real.