During a breaking event — a disaster, protest, or security incident — open sources surface signals faster than official channels, but also faster than the truth can catch up. This method builds real-time situational awareness while holding the line against disinformation: verify before you amplify.
What you'll need
- A defined event, location, and timeframe to monitor
- Social monitoring tools from the Social Media category
- Mapping tools from the OSINT Maps category to plot reports
Steps
- Define your collection in advance. Decide the keywords, hashtags, accounts, and geographic area you will watch, so you are filtering signal rather than drowning when the event breaks.
- Monitor broadly for detection. Track your terms across platforms to catch early reports — open sources often surface an event before official confirmation, buying response time.
- Set a verification gate. Trust nothing until it clears a check: reverse-search any footage for provenance, geolocate claimed locations, and assess the account sharing it. Reused or miscaptioned media is rampant in a crisis.
- Corroborate across independent sources. Confirm each claim against a second, differently-sourced report before treating it as real (corroboration).
- Map verified reports continuously. Plot only confirmed reports on a shared map, colour-coded by type, so scale, direction, and gaps are visible at a glance.
- Label and communicate honestly. Keep a strict distinction between "reported" and "confirmed", and never present the former as the latter. State uncertainty openly to anyone relying on your picture.
Common pitfalls
- Amplifying before verifying. In a live event this can waste resources or cause harm — the cardinal rule is verify first.
- Improvising collection. Without a pre-set plan you drown in noise exactly when clarity matters most.
- Ignoring an account's history. Sources that reliably spread false claims will do so again — weight them accordingly.
Verify your result
You are monitoring effectively when your shared picture contains only corroborated reports, each labelled by confidence and plotted in place and time, and when your "reported" and "confirmed" categories never blur. Preserve evidence as you go, since crisis content is deleted quickly.