Election Intelligence (ELECTINT): Intelligence Discipline Guide

An election is the most predictable high-risk event on any calendar: fixed date, known actors, published rules. Election intelligence is the discipline of working that predictability in advance rather than reconstructing it afterwards.

What Election Intelligence is as a discipline

Election intelligence is the structured study of electoral processes and the threats around them: the legal framework and calendar, boundary delimitation, voter register administration, candidate and party finance, the campaign information environment, voting and counting technology, results transmission, dispute resolution, and violence risk. It combines documentary analysis of law and procedure with monitoring of the campaign environment and post-event review of published results, always distinguishing administrative irregularity from deliberate fraud, and both from lawful outcomes that people dislike.

Sub-methods include legal and procedural mapping, observer report analysis, campaign finance tracing, results review at polling-station granularity, coordinated behaviour monitoring, and election-violence indicator tracking. In the cycle the discipline is calendar-driven: requirements are set months ahead, collection intensifies through the campaign, and analysis pivots after polling day to results integrity, complaint adjudication and the security environment around the announcement.

Why it matters

Only election intelligence answers whether an announced result is consistent with the process that produced it, where in the chain that process is weakest, and which actors have both motive and access at that point. For an operating business it answers the narrower but urgent questions: what happens to staff movement, contracts, licensing and public order around a specific date, and how long the disputed period is likely to last.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Late changes to electoral law, constituency boundaries or the calendar in the months immediately before polling day.
• Voter register anomalies such as registration growth detached from demographics, or high duplicate and absent-record rates.
• Polling-station results showing implausible turnout, missing distribution tails or suspiciously round vote figures.
• The results transmission architecture: who controls tabulation, and whether parallel counts and copies of station results are permitted.
• Campaign finance disclosures revealing undeclared spending, foreign funding or coordinated third-party expenditure.
• Coordinated inauthentic campaigning targeting candidates, election observers, journalists or the electoral administration itself.
• Deployment of security forces, curfews or network shutdowns timed around polling and results announcement.
• Observer accreditation restrictions, and the pattern of which organisations are excluded and when.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• National election management bodies — Official results, procedures, candidate lists and legal instruments, published at the granularity the law requires
• IFES ElectionGuide — Country election calendars, system descriptions and historic results for comparison across cycles
• International IDEA databases — Voter turnout, political finance and electoral system data covering most countries and decades
• OSCE ODIHR observation reports — Detailed methodology-based assessments of electoral process, administration, legal framework and campaign conditions
• EU Election Observation Mission reports — Independent mission findings and recommendations, often with station-level observation detail
• ACE Electoral Knowledge Network — Comparative reference on electoral administration, technology and dispute resolution practice
• ACLED — Geocoded election-related violence, protest and intimidation events with dates and actors
• National official gazettes — Authoritative text of electoral law, decrees, boundary changes and appointment of commissioners

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Build the calendar and legal baseline — Record every statutory date and the governing law, including nomination, campaign, blackout, polling, tabulation, complaint and inauguration windows.
2. Map actors and administration — Identify the commission, its appointment mechanism, the parties, the security agencies involved and the courts that will hear disputes.
3. Set integrity indicators early — Define observable indicators for register quality, finance transparency, media access and technology assurance before the campaign begins.
4. Monitor the campaign environment — Track finance disclosures, media coverage, coordinated campaigning and violence incidents against those indicators week by week.
5. Collect results at the lowest granularity — Gather station or constituency level results as published, preserving the original files and the time each was released.
6. Review process and statistics — Compare results against turnout norms and distributions, and test any anomaly against a plausible administrative explanation first.
7. Track the dispute phase — Follow complaints, recounts and court rulings to their conclusion, recording what was actually adjudicated rather than what was alleged.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

• Election Security & PSYOP
• Disinformation / IO

Operates on these data points

• Social Profile — A social media profile or online account page tied to a persona or identity.
• Keyword / Narrative — A search term, topic, hashtag, or narrative tracked across media and platforms.
• Domain Name — Human-readable address that maps to IP infrastructure via DNS.
• URL — Uniform Resource Locator pointing to a web resource.
• Username / Handle — Screen name or handle used across online platforms and services.

Related disciplines

• Government Intelligence — Government Structures, Policy, and Officials

Inside the platform: where Election Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• discipline.php?d=ELECTINT — Discipline hub
• source-catalog.php?disc=ELECTINT — Source catalogue filtered to this discipline
• url-profile.php — Domain Name profile
• search.php — Advanced search, filter and pivot
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Threat Hunt
• Auto-Collect Feeds
• Enrichment → Local
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Build the calendar and legal baseline is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Set integrity indicators early turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Track the dispute phase feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Election Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence interest in elections is almost entirely about stability and force protection rather than outcomes. Analysts track the electoral calendar, the geography of contested constituencies, historical violence patterns around registration, campaign, polling and results announcement, and the posture of security forces who may themselves be an actor. It feeds force protection planning, movement restrictions, base security posture and civil-military liaison, and supports assessment of whether a disputed result could escalate into unrest affecting partner forces. Constraints are severe: any activity that could be construed as influencing an election in a host nation is politically catastrophic, so collection stays on the security environment and reporting avoids characterising legitimate political preference.

🕵 National intelligence

National assessment work on foreign elections addresses political trajectory, interference by third states, and the risk of instability. Requirements are set months ahead against the electoral calendar, with collection intensifying through registration, campaign and the count. All-source fusion combines legal and procedural analysis, open reporting, information environment monitoring and diplomatic reporting. Handling is sensitive because assessments about an ally's or adversary's elections carry political weight, so sourcing transparency and separation of judgement from advocacy matter more than usual. Dissemination discipline includes avoiding predictions of outcome where the requirement is actually about process integrity and post-election stability.

👮 Law enforcement

Law enforcement engagement is with electoral offences: voter intimidation, bribery, impersonation, illegal campaign financing, tampering with materials, and violence around polling. Evidential standards apply as in any criminal matter, with chain of custody over ballots, logs and devices, and legal process for financial records or communications data. Complaints must be triaged against the statutory offence rather than against political grievance, and investigators must be visibly neutral because the perception of partisan policing damages the process as much as the offence. Coordination with the electoral management body is normally governed by protocol, and reporting timelines are compressed by statutory challenge periods.

🔍 Private investigation and corporate security

Private practitioners engage with elections mainly through political risk advisory, corporate contingency planning and integrity due diligence on politically exposed persons and their financing. Legitimate work covers calendar and scenario analysis, assessment of unrest risk to sites and staff, and open-source review of candidate backgrounds relevant to a commercial relationship. What a private actor may not lawfully do is collect voter register data in bulk where it is restricted, conduct covert monitoring of political activists, or undertake anything that constitutes campaigning, foreign political contribution or undisclosed political consultancy, which is regulated in many jurisdictions and criminal in some.

📰 Journalism and OSINT media

Newsrooms cover process as well as contest. The verification standard for any fraud claim is documentary: the specific legal provision alleged to be breached, the polling station or constituency concerned, the official result records, and corroboration from more than one observer or party agent. Publishing unverified fraud allegations damages the process and is very difficult to retract. Blackout rules on polls and results are legally binding in many jurisdictions. Right of reply extends to the electoral management body as well as to named individuals, and corrections after certification carry real consequences and must be prominent.

🌍 NGO, humanitarian and human rights

Election observation and civil society monitoring is the mature form of this discipline: accredited observation to a published methodology, parallel vote tabulation where lawful, long-term observation of registration and campaign conditions, and documentation of violations for accountability. Do-no-harm applies to observers, party agents and voters who may face reprisal, so identifying details are protected and reporting is aggregated where necessary. Practice is victim-centred where intimidation and violence occur. Duty of care includes security planning for observers on polling day and after the announcement, which is often the most dangerous period.

🎓 University and research

Researchers study electoral integrity, turnout, boundary effects, campaign finance and forensic detection of irregularities in results. Reproducibility depends on publishing polling-station level data, code and the specification of any statistical forensic test, since digit and turnout tests are highly sensitive to specification and to legitimate administrative practices. Ethics approval is required for interviews with voters, officials and observers, particularly where reprisal is possible. Voter register data is restricted in most jurisdictions and is rarely lawfully available for research without a specific statutory route, so aggregate published results are the normal basis.

Playbook: working Election Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Map the legal framework

Read the constitution, electoral law, regulations and the management body's procedures before anything else, and record what each stage legally requires: eligibility, registration, nomination, campaign rules, financing limits and disclosure, voting procedure, counting, transmission, tabulation, complaint and appeal. Note where practice is known to diverge from law. A good output is a stage-by-stage reference note citing the provision for each requirement. Stop when you can state, for any observed irregularity, which rule it would breach.

Phase 2 — Build the calendar

Construct the statutory timeline with every deadline: register closure, candidate nomination and challenge, campaign start and blackout periods, out-of-country voting, polling day, results transmission, certification, and the window for petitions. Add the practical dates such as materials distribution and observer accreditation. Slippage against this calendar is itself an early indicator. A good output is a dated calendar with responsible bodies named. Stop when the calendar covers through certification and the petition period, not only polling day.

Phase 3 — Assess the administration

Evaluate the electoral management body: its legal independence, appointment process, budget adequacy and timeliness, procurement of materials and technology, staff training, and its track record on publishing data. Administrative weakness produces irregularities that look like fraud and are routinely reported as such. A good output is a capability assessment distinguishing capacity problems from integrity problems. Stop when you can characterise the most likely failure modes of this specific administration rather than generic risks.

Phase 4 — Examine boundaries and the register

Review delimitation: when boundaries were last drawn, by whom, against what population data, and whether malapportionment or gerrymandering claims are supported by the numbers. Assess the voter register's provenance, audit history, deduplication method, and the transparency of additions and removals. Register integrity is where most systemic disputes originate. A good output is an evidenced assessment of register and boundary quality with the data actually examined. Stop when claims about the register are either supported by published audit data or explicitly marked unverifiable.

Phase 5 — Track candidates and finance

Map parties, candidates and their disclosed finances against the statutory limits and disclosure requirements. Trace donors where disclosure exists, and identify state resources being used for campaigning, which is the most common integrity problem in many systems. Cross-check candidate declarations against company registries and asset declarations where published. A good output is a finance picture with sourced figures and a clear statement of what disclosure regime permits and omits. Stop when the gaps in the disclosure regime are documented as findings in themselves.

Phase 6 — Monitor the information environment

Track the campaign narrative across broadcast, print, online and messaging platforms in the relevant languages, with attention to state media balance, political advertising transparency, and coordinated inauthentic behaviour. Use platform ad libraries and transparency data. Separate lawful partisan speech, which is not a finding, from coordinated manipulation and from foreign state activity. A good output is a monitoring baseline with named narratives and actors. Stop when the ordinary campaign is characterised, so anomalies later stand out.

Phase 7 — Assess technology and transmission

Where electronic registration, voting, transmission or tabulation is used, document what the system does, who supplied and certified it, whether source code and audit reports are published, whether a voter-verified paper record exists, and how results move from station to centre. Most disputes concern transmission and tabulation rather than the vote capture itself. A good output is a data-flow description with the audit and recount capability at each stage. Stop when you can say what evidence would exist if a specific manipulation occurred.

Phase 8 — Prepare violence indicators

Build an indicator set from historical patterns: locations and phases with prior violence, inflammatory rhetoric by named actors, security force deployments, arms availability, and grievance triggers such as disqualification of a popular candidate. Set thresholds and named owners. Post-announcement is usually the highest-risk phase, not polling day. A good output is an indicator and warning matrix with escalation routes. Stop when each indicator has an observer and a threshold rather than being a general concern.

Phase 9 — Observe or collect on the day

Where accredited observation is possible, deploy to a sampling design rather than to convenient locations, and use a structured checklist tied to the legal requirements identified earlier. Where observation is not possible, collect systematically from party agents, domestic observers, media and citizen reporting, recording provenance for each item. A good output is structured, comparable observation data rather than anecdotes. Stop collecting for the day only when closing, counting and transmission at observed stations have been covered.

Phase 10 — Analyse the results

Work at the lowest published level of granularity. Reconcile station-level results against register size and turnout, look for impossible values, unexplained uniformity, late-reporting outliers and inconsistencies between transmitted and tabulated figures. Treat statistical forensic tests as flags requiring documentary follow-up, never as proof, since administrative practice generates many of the same patterns. A good output is a list of specific stations and figures requiring explanation. Stop when each flag has been either explained or referred as an unresolved question.

Phase 11 — Distinguish irregularity from fraud

For every anomaly, state the competing explanations: administrative error, poor training, materials shortage, legitimate procedure you did not know about, deliberate manipulation. Establish which evidence discriminates between them, and whether the scale could affect the outcome, which is the question that matters legally in most petition regimes. A good output is a characterisation with the evidentiary basis and the materiality assessment. Stop before asserting fraud where you can only establish irregularity.

Phase 12 — Report and follow through

Publish or brief against the legal framework, with findings tied to specific provisions and evidence, and with the limits of the observation stated including where you could not observe. Provide a right of reply to the management body. Then follow the petition and certification process, because the adjudication of complaints is a key integrity indicator in its own right, and reporting that ends on polling night misses most of what matters. Stop when certification is complete and the complaint outcomes are recorded.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
IFES ElectionGuide	Open	Global reference on elections including dates, systems, results and institutional information by country.	Establishes the calendar, electoral system and past results baseline before any deeper legal or procedural work.
International IDEA	Open	Comparative databases on electoral systems, political finance, voter turnout and constitutional design across countries.	Provides comparative benchmarks for turnout, finance regulation and system design when assessing whether practice is unusual.
OSCE ODIHR election observation	Open	Needs assessment, interim and final observation reports with recommendations, covering participating states over many cycles.	Authoritative prior assessments of the same administration, and the recommendation follow-up record as an integrity indicator.
ACE Electoral Knowledge Network	Open	Practitioner knowledge base covering electoral processes, administration, technology, legal frameworks and comparative practice.	Reference for what a given procedure normally involves, which is essential before characterising an observation as irregular.
Venice Commission	Open	Council of Europe body publishing opinions and codes of good practice on electoral law and constitutional matters.	Benchmarks national electoral law against European standards and supplies the reasoning used in legal assessment.
Carter Center election reports	Open	Observation mission reports and methodology covering elections worldwide, including data-driven observation approaches.	Independent prior observation findings and a published methodology to align sampling and checklist design with.
National Democratic Institute resources	Open	Guidance and reports on election monitoring, parallel vote tabulation and domestic observer methodology.	Methodological reference for citizen observation and statistically valid sampling of polling stations.
European Union Election Observation Missions	Open	Final reports and recommendations from EU observation missions with detailed legal and procedural analysis.	Detailed prior legal framework analysis for a country, saving substantial work and identifying persistent weaknesses.
ACLED	Registration	Georeferenced political violence, protest and strategic development events with actor coding and dates.	Establishes the historical geography and timing of election-related violence to build indicators rather than assumptions.
V-Dem dataset	Open	Disaggregated indicators on elections, civil liberties and institutional quality with long time series by country.	Provides longitudinal context on whether electoral conditions have deteriorated or improved beyond a single cycle.
Platform political advertising transparency libraries	Open	Repositories of political and issue advertising with advertiser, spend, targeting summary and creative content.	Evidences campaign spending and messaging online, including advertisers not disclosed under national finance rules.
DSA Transparency Database	Open	Statements of reasons for content moderation actions taken by very large online platforms in the European Union.	Shows moderation activity around electoral content and provides a structured record for information environment analysis.
National electoral management body publications	Open	Official regulations, procedures, accreditation rules, candidate lists and polling-station level results where published.	The primary authority for what the process requires and the source of record for results analysis.
Inter-Parliamentary Union Parline	Open	Comparative data on national parliaments including electoral systems, composition and representation statistics.	Confirms institutional structure and seat allocation rules that determine how votes convert into outcomes.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Election Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• Structured observation checklist tied to statute — Converts legal requirements into comparable yes-no observations across stations. Limitation: only as good as the underlying legal mapping, and poorly designed checklists collect volume without diagnostic value.
• Parallel vote tabulation software — Aggregates results from a statistically valid sample of stations to give an independent projection. Limitation: requires a lawful basis, trained observers and a genuine random sample, or it produces authoritative-looking noise.
• Results reconciliation spreadsheets and scripts — Compare station-level results against register size, turnout and transmitted figures to flag impossible values. Limitation: flags require documentary follow-up and are routinely misreported as proof of fraud.
• Statistical forensic tests on digit distributions — Detect deviations from expected numeric patterns in reported results. Limitation: highly specification-dependent and generated by legitimate administrative practices, so they are screening flags only.
• Political advertising library search — Retrieves advertiser identity, spend bands and creatives for political messaging on major platforms. Limitation: coverage and definitions of political advertising differ by platform and country, leaving significant blind spots.
• Social listening and coordination detection tooling — Tracks narratives and identifies suspicious posting synchrony across accounts. Limitation: coordination is not automatically inauthentic, and organic campaign enthusiasm produces similar signatures.
• Incident reporting and mapping platforms — Collect and geolocate citizen and observer reports of irregularities and violence during polling. Limitation: submissions are self-selected and unverified, so raw counts misrepresent geography and severity.
• Archiving tools for candidate and party material — Preserve manifestos, statements and advertising that are commonly edited or deleted after polling. Limitation: requires collection during the campaign, since post hoc archiving usually finds the material already gone.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
• Auto-Collect Feeds — Pulls the registered feed set server-side on a schedule, recording per-feed status so a silently dead feed is visible.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Map the law before you observe anything. Without knowing the specific provision a procedure implements, an analyst cannot tell an irregularity from an unfamiliar but entirely lawful practice, and most false fraud reporting originates exactly there.
• Administrative failure and deliberate manipulation produce overlapping symptoms. Late materials, untrained staff and shortages generate the anomalies most often reported as fraud, so establish administrative capacity early to calibrate what you see later.
• The highest-risk period is usually between the close of counting and certification, not polling day. Resourcing that peaks on the day and collapses afterwards misses the phase where disputes turn violent.
• Work results at polling-station granularity or not at all. Constituency aggregates conceal the reconciliation failures that actually evidence a problem, and national-level statistical claims are almost never diagnostic.
• Statistical forensics flag, they do not prove. Digit and turnout tests are sensitive to specification and to lawful practices such as rounding, allocation rules and station consolidation, so every flag needs documentary follow-up.
• Materiality is the legal question in most petition regimes. An evidenced irregularity affecting far fewer votes than the margin matters for accountability but does not change an outcome, and conflating the two damages credibility.
• Distinguish lawful partisan speech from coordinated manipulation with care. Studying the former puts an analyst on the wrong side of freedom of expression and is also analytically useless, since ordinary campaigns are loud by design.
• Track the fate of previous observation recommendations. Whether an administration implemented what it was told last cycle is one of the most reliable indicators of good faith available, and it is published.
• Protect observers and party agents in reporting. Naming who reported what from a specific station can expose people to reprisal long after the story has moved on, so aggregate and delay where necessary.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Election Intelligence is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of reported irregularities characterised against a specific legal provision, rather than described as anomalies without a rule they would breach.
• Coverage achieved against the sampling design on polling day, including whether observed stations were a valid sample rather than an accessible convenience set.
• Share of statistical flags resolved through documentary follow-up, and the ratio subsequently found to have administrative rather than manipulative explanations.
• Time from results publication to completed station-level reconciliation, and the proportion of stations for which official data was published at that granularity at all.
• Implementation rate of prior observation recommendations by the electoral management body, tracked across cycles as a good-faith indicator.
• Accuracy of pre-election violence indicators, measured by whether triggered indicators preceded actual incidents and whether incidents occurred without warning.
• Rate of published corrections or retractions of integrity claims, tracked as a measure of verification discipline before publication.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Treating a statistical anomaly as proof of fraud with no identified mechanism, access or opportunity behind it.
• Importing assumptions from one country's electoral system into another with different rules and reporting conventions.
• Relying on partisan quick counts or exit polls as ground truth against official tabulation.
• Conflating administrative failure, under-resourcing and simple incompetence with deliberate, directed manipulation of the result.
• Analysing only national aggregates and missing the constituency-level effects that decide outcomes.
• Publishing unverified allegations during a tense count, which can contribute directly to violence.

Legal and ethical considerations

Election work touches political rights and personal safety. Respect blackout rules on publishing polls or results, avoid any activity that could be construed as campaigning or foreign interference, and keep personal data on candidates and officials proportionate to their public role. Voter register data is tightly regulated in most jurisdictions and rarely lawful to bulk-collect. Never publish fraud allegations before verification, and be aware that observation and monitoring may require accreditation under national law.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Election Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 5 data points, 2 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

How do you distinguish fraud from administrative failure?

By establishing what the correct procedure is, what capacity the administration actually has, and what evidence each explanation would leave. Missing materials, untrained staff, and late openings produce anomalies that look deliberate but stem from budget and logistics. Deliberate manipulation usually leaves a directional pattern: errors that favour one party consistently, discrepancies concentrated where the margin matters, or divergence between figures at the station and figures at the tabulation centre. Assess direction and materiality, seek the paper record, and state which explanation the evidence discriminates toward rather than asserting intent you cannot evidence.

Are statistical tests on results reliable evidence of manipulation?

They are screening tools, not evidence. Digit distribution, turnout clustering and last-digit tests are sensitive to how the test is specified, to the size and number of polling stations, and to lawful administrative practices such as station consolidation, allocation rules and rounding. Published analyses using the same data have reached opposite conclusions on specification alone. Use them to prioritise which stations to examine documentarily, then work the paper: result forms, reconciliation figures, party agent copies and observer records. Report the tests transparently including the specification, and never present a statistical flag as a finding of fraud.

Can private organisations lawfully monitor an election abroad?

Observation is normally a regulated activity requiring accreditation from the national authority, and unaccredited monitoring can be an offence. Beyond accreditation, several jurisdictions restrict foreign funding of election-related activity, and activity that could be construed as campaigning or as foreign political interference carries serious legal and diplomatic consequences. Voter register data is tightly controlled almost everywhere and rarely lawful to obtain in bulk. Analysis of published results, published law and open reporting is generally lawful. If the work involves any field presence, obtain accreditation through the established channel and follow the observation code of conduct.

What matters more, polling day or the period after?

Usually the period after. Polling day is heavily observed and comparatively well documented, while transmission, tabulation, complaint adjudication and certification receive far less attention and are where most disputes and most violence occur. Resource the post-election phase deliberately: track how results move from station to centre, whether the management body publishes at station level, how petitions are handled and within what timetable, and how security forces behave around the announcement. Reporting that concludes on polling night systematically misses the integrity questions that determine whether the result is accepted.

How should electronic voting systems be assessed?

By what evidence they leave behind rather than by their technical sophistication. Ask whether a voter-verified paper record exists, whether a meaningful risk-limiting audit or manual recount is possible, whether source code and certification reports are published, who supplied and certified the system, and how results are transmitted and authenticated. A system with no independent physical record cannot be audited, which makes disputes unresolvable regardless of whether manipulation occurred. Document the data flow from station to final tabulation, and identify at which point an alteration would be detectable and by whom.

How is unverified fraud allegation handled responsibly?

Treat it as a lead with a defined verification path and say publicly what you have and have not established. Identify the specific claim, the station or constituency, and the rule allegedly breached; seek the official record, the party agent copy and independent observer accounts; and give the electoral management body an opportunity to respond. Where the claim cannot be verified, say so explicitly rather than repeating it with attribution, since repetition alone confers credibility. Publishing unverified allegations damages confidence in a process that may be sound and is essentially impossible to retract effectively.

What should be protected in reporting to avoid harm?

The identities of observers, party agents, whistleblowing officials and voters who reported intimidation. Reprisal against these people is common and can occur long after the cycle. Aggregate to constituency level where station-level attribution would identify a reporter, delay publication of specific details until risk has fallen, and store contact details separately from analytic files with restricted access. Where violence has occurred, apply victim-centred practice: do not publish identifying details of survivors without informed consent, and consider whether the level of detail serves accountability or merely illustrates.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• International Covenant on Civil and Political Rights Article 25, establishing the right to genuine periodic elections by universal and equal suffrage and secret ballot.
• Declaration of Principles for International Election Observation and its Code of Conduct, governing observer independence, non-interference and methodology.
• Venice Commission Code of Good Practice in Electoral Matters, setting European standards on suffrage, equality, freedom, secrecy and procedural guarantees.
• OSCE Copenhagen Document commitments on democratic elections, against which ODIHR observation missions assess participating states.
• International IDEA political finance standards, governing disclosure, contribution and spending limits, and the use of state resources in campaigns.
• EU Digital Services Act obligations on very large online platforms concerning systemic risks to electoral processes, advertising transparency and data access.
• National electoral law and the regulations of the electoral management body, which are the operative standard against which any irregularity must be assessed.
• Data protection law as applied to voter registers and political opinion data, which is special category data in the EU and restricted in most jurisdictions.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. ElectionGuide — International Foundation for Electoral Systems. Global reference on election dates, systems and results by country
2. Electoral system and political finance databases — International IDEA. Comparative data on electoral design, turnout and campaign finance regulation
3. Election observation reports and methodology — OSCE Office for Democratic Institutions and Human Rights. Independent observation findings and recommendations across participating states
4. ACE Electoral Knowledge Network — ACE Project partners. Practitioner reference on electoral administration, law and technology
5. Code of Good Practice in Electoral Matters — European Commission for Democracy through Law (Venice Commission). European standards on electoral law and procedural guarantees
6. Election observation reports — The Carter Center. Independent observation findings and data-driven observation methodology
7. Parline database on national parliaments — Inter-Parliamentary Union. Comparative institutional data on parliaments and electoral systems
8. DSA Transparency Database — European Commission. Statements of reasons for platform content moderation decisions
9. ACLED political violence and protest data — Armed Conflict Location and Event Data Project. Georeferenced events used to build election violence indicators
10. V-Dem indicators on elections and civil liberties — V-Dem Institute, University of Gothenburg. Long time series of disaggregated democracy indicators

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: election calendars, integrity indicators and results-level monitoring for every jurisdiction you operate in. Explore the platform, or browse the rest of the library by following any tag above.