News Intelligence (NEWSINT): Intelligence Discipline Guide

Reporting is evidence of what was published, by whom, when and sourced how. Treated that way it is one of the most reliable open collection streams available; treated as fact, it is where circular reporting begins.

What News Intelligence is as a discipline

News intelligence is the systematic use of media reporting as a collection stream: monitoring wires, national and local outlets, trade and specialist press, broadcast and vernacular-language media; assessing outlet ownership, funding and editorial independence; tracing claims back to their originating report; and building dated, attributable timelines. It differs from media monitoring for communications work because the output is an evidenced chronology and an assessment of sourcing quality, not a volume of clippings and a sentiment score.

Sub-methods include source-of-record identification, chain-of-citation tracing to the earliest report, local and vernacular collection where national coverage is thin, outlet ownership and funding assessment, corrections and retraction tracking, and archiving of articles that are later edited or removed. In the cycle it serves as both a broad collection layer and a tip-off mechanism, cueing targeted collection by other disciplines when a report contains something checkable.

Why it matters

News intelligence answers what was publicly reported and when, which matters legally as much as factually because it establishes notice, timelines and the state of public knowledge on a given date. It reaches local events that never enter any structured database, and it exposes the difference between many outlets reporting something independently and many outlets republishing a single agency story.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• The earliest datable report of a claim, and the source that report actually cites for it.
• Wire copy propagation, where dozens of apparently independent outlets are one agency story republished verbatim.
• Named sourcing versus anonymous attribution, and whether the reporter was demonstrably present.
• Outlet ownership, state funding and editorial control that shape both what appears and what never does.
• Corrections, updates and silent edits, detectable only by comparing archived versions of the same article.
• Local and vernacular reporting of incidents that never enters English-language coverage at all.
• Court and regulatory reporting that reveals filings before the underlying documents become publicly accessible.
• Coordinated timing of favourable or hostile coverage around a transaction, listing or announcement.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• GDELT Project — Global, multilingual news event and metadata stream for coverage baselining and propagation tracking
• Media Cloud — Open research platform for corpus-level analysis of online news coverage and attention
• Europe Media Monitor NewsBrief — EC Joint Research Centre near real-time multilingual news aggregation and clustering
• Internet Archive TV News Archive — Searchable broadcast transcripts and clips for verifying what was actually said on air
• National news agency public feeds — Wire copy at source, allowing you to identify which outlets simply republished it
• Common Crawl News dataset — Large archived corpus of news articles for retrospective and longitudinal analysis
• Internet Archive Wayback Machine — Versioned page captures exposing quiet edits, retractions and reporting that was later removed entirely
• Public service broadcaster archives — Long-run, well-indexed reporting archives with stable citation and correction practice

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Define entity and language scope — Set the subject, geography, time window and languages, since the decisive report is often not in English.
2. Tier the source list — Rank outlets by proximity to events, independence and sourcing practice, so corroboration reflects real independence.
3. Monitor and archive on capture — Run standing queries and archive each article at collection with URL, timestamp and full text before it can change.
4. Trace the citation chain — Follow each claim back through republications to the earliest report and identify what that report relied on.
5. Assess sourcing quality — Judge each report on named sourcing, reporter presence and document access rather than on the outlet's reputation alone.
6. Build the dated timeline — Assemble events with publication date and occurrence date recorded separately, each entry carrying its citation and archived copy.
7. Track corrections — Re-check key articles for updates and retractions, and revise the timeline when the underlying reporting changes.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Applied in these mission domains

• Threat Analysis
• Corruption & Governance
• Extremism & Radicalization
• Conflict & Humanitarian
• Biosecurity & Pandemic
• Election Security & PSYOP
• Disinformation / IO
• Risk Analysis

Operates on these data points

• Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
• Keyword / Narrative — A search term, topic, hashtag, or narrative tracked across media and platforms.
• Person / Name — A named individual — the subject of identity resolution and profiling.
• Domain Name — Human-readable address that maps to IP infrastructure via DNS.
• Company / Organization — A legal entity — corporation, LLC, NGO, or business.
• Social Profile — A social media profile or online account page tied to a persona or identity.
• Username / Handle — Screen name or handle used across online platforms and services.
• Video — A video file or stream — the core artifact for incident verification and chronolocation.
• Image / Photograph — A still image — carries EXIF metadata and is the primary artifact for visual verification.
• Location / Coordinates — A geographic point, place, or region — the basis of GEOINT analysis.

Related disciplines

• Disinformation Intelligence — Detecting and Analyzing Information Manipulation

Inside the platform: where News Intelligence lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• discipline.php?d=NEWSINT — Discipline hub
• source-catalog.php?disc=NEWSINT — Source catalogue filtered to this discipline
• search.php — Person / Name profile
• url-profile.php — Domain Name profile
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Threat Hunt
• Auto-Collect Feeds
• Enrichment → Local
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Define entity and language scope is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Monitor and archive on capture turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Track corrections feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses News Intelligence

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Open media is a primary and releasable collection stream for understanding the civil environment, local grievances, infrastructure status and the political context around an operation. Analysts build dated chronologies from wire, national, local and vernacular reporting, assess outlet ownership and independence to weight what they read, and use reporting to cue organic collection when a story contains something checkable. It supports the civil environment assessment, force protection and J2 baseline reporting. Constraints include recognising that local media may be state-controlled or coerced, that reporting from conflict zones is often second-hand, and that copyright and licensing limit reproduction in products.

🕵 National intelligence

Media reporting answers a substantial share of standing requirements outright and provides the unclassified backbone onto which classified reporting is fused. The value is in method rather than volume: source-of-record identification, chain-of-citation tracing back to the earliest report, and assessment of ownership and funding so that an outlet's reporting is weighted appropriately. Vernacular collection is where most of the differentiated value lies. Handling considerations include the fact that aggregation of open reporting can produce a classified judgement, and that database licences constrain retention and redistribution of full text.

👮 Law enforcement

Investigators use media reporting for lead generation, context and timeline construction, and occasionally as evidence of publication itself, such as in defamation or market manipulation cases. Evidential standards require the archived original with retrieval timestamp and hash, since articles are silently edited and removed. Reporting is hearsay for the truth of its contents in most systems, so it corroborates rather than proves. Journalistic source protection is legally recognised in many jurisdictions and applies to material held by newsrooms, so demands for unpublished material are subject to specific and demanding procedures.

🔍 Private investigation and corporate security

Corporate teams use news intelligence for due diligence, adverse media screening, litigation support and monitoring of counterparties and markets. The discipline is separating an evidenced allegation from a recycled one: adverse media hits frequently trace to a single origin repeated across dozens of outlets. A private actor must respect copyright and database licence terms, must not present unverified allegations as findings, and must recognise that repeating an allegation can be defamatory in many jurisdictions. Archive the exact wording relied on, because the source article may later be corrected or removed.

📰 Journalism and OSINT media

For journalists this is core craft: identifying the source of record, tracing a claim to its earliest reporting, assessing whether apparently independent outlets are recirculating a single origin, and recording corrections and retractions. Verification standards require going to the primary document or witness rather than relying on secondary reporting. Source protection covers unpublished material and contacts. Ethics require accurate attribution, right of reply before publishing allegations, prominent correction when wrong, and care that reporting an unverified claim, even to debunk it, does not give it currency.

🌍 NGO, humanitarian and human rights

Human rights and humanitarian organisations use media monitoring for incident documentation, early warning and pattern analysis where field access is limited. Practice requires care with reporting that may be state-controlled or coerced, and awareness that journalists in some contexts face severe risk for what they publish. Do-no-harm considerations include not repeating details that identify survivors or witnesses, and not amplifying reporting that stigmatises a community. Documentation for accountability requires dated archived copies, because reporting used to establish a pattern years later will frequently no longer be online.

🎓 University and research

Researchers use news corpora for content analysis, agenda-setting, framing and event data construction. Reproducibility requires documenting the source list, the collection window, the query specification and the deduplication method, since syndication inflates counts dramatically. Licensing constrains sharing of full text, so publish code, sampling frames and derived measures with document identifiers. Ethics considerations arise where reporting concerns identifiable individuals, particularly victims. Coder reliability must be reported for any manual classification, and machine classification requires validation against a human-coded sample.

Playbook: working News Intelligence end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Define the news requirement

State what the monitoring or research must establish: a chronology of an event, the emergence of a claim, coverage of an entity, or the state of the media environment itself. Attach the decision it supports and the languages and geographies in scope. Undefined media monitoring produces volume and no findings. A good output is a requirement naming the entities, the period, the languages and the deliverable. Stop when the requirement determines the source list rather than the reverse.

Phase 2 — Build the source list deliberately

Identify the outlets that matter: wire services, national outlets of record, local and regional papers, trade and specialist press, broadcast, and vernacular-language media including diaspora outlets. Include state media where relevant, treated as an indicator of official position rather than as reporting. Record why each source is on the list. A good output is a documented source list with roles assigned. Stop when local and vernacular coverage is included, since that is where differentiated value lies.

Phase 3 — Assess ownership and independence

For each significant outlet, establish ownership, funding, editorial control, political affiliation and any state or oligarchic connection, using company registries, media ownership research and press freedom reporting. This determines how you weight what the outlet publishes and whether apparently independent confirmations are actually related. A good output is an outlet profile note with sourced ownership. Stop when the outlets carrying your load-bearing claims have been profiled, not when the whole market has.

Phase 4 — Collect with provenance

Capture each article with URL, publication timestamp, retrieval timestamp, byline, outlet and the full text as retrieved. Save the rendered page, not just the text, because layout, corrections notices and datelines matter. Log searches that returned nothing. A good output is a corpus where every item can be traced to a retrieval event. Stop when collection covers the period and languages specified rather than when the volume feels sufficient.

Phase 5 — Archive against silent editing

Push copies to independent archives and retain local originals with hashes. Articles are edited without notice, paywalled retroactively, geoblocked and deleted, and the version you relied on must remain provable. Record both the archive URL and the local hash. A good output is dual preservation for every load-bearing article. Stop when nothing your chronology depends on exists only at the publisher.

Phase 6 — Deduplicate and trace citation chains

Collapse syndicated and republished copies, then trace each claim to its earliest identifiable report. Establish whether later outlets cite that report, translate it, or observed the event independently. This is the single most important step, because adverse media and corroboration counts collapse dramatically once syndication is removed. A good output is a citation chain per claim with the origin identified. Stop when you can state how many genuinely independent observations exist.

Phase 7 — Identify the source of record

For each fact, determine which body would be the authoritative source and whether the reporting derives from it: a court listing, a regulator announcement, a company filing, an official statement, or a named witness. Then go to that primary source. Reporting about a document is not the document, and the difference matters when the reporting is imprecise. A good output is a chronology where primary sources are cited directly. Stop when the load-bearing facts are anchored to primary records or explicitly marked as media-only.

Phase 8 — Build the dated chronology

Construct a timeline with each entry carrying the date of the event, the date of first reporting, the source, and the confidence. Distinguish when something happened from when it was reported, since the gap is frequently analytically important. Flag conflicting accounts rather than resolving them silently. A good output is a chronology a reader can audit entry by entry. Stop when every entry has a date, a source and a confidence.

Phase 9 — Weight and cross-check

Weight reporting by outlet track record, proximity to the events, whether the reporter was present, and whether sourcing is named or anonymous. Cross-check against non-media sources: registries, official publications, satellite imagery, event datasets. Where reporting and records conflict, prefer the record and note the discrepancy. A good output is a weighted assessment with the basis of weighting recorded. Stop before treating volume of coverage as a proxy for reliability.

Phase 10 — Track corrections and removals

Monitor for corrections, retractions, updates and quiet deletions on the articles you rely on. A retracted report that underpins a chronology invalidates it, and unnoticed retraction is a common failure in adverse media work. Compare archived and live versions periodically. A good output is a maintained correction log for load-bearing sources. Stop monitoring only when the product is retired, not when it is delivered.

Phase 11 — Handle allegations carefully

Where reporting carries allegations against named individuals or companies, record the exact wording, the attribution and the date, characterise it as reported rather than established, and note whether the subject responded. Repeating an allegation is itself defamatory in many jurisdictions, so the wording of your product is the exposure and the archived source is the defence. A good output is an allegation register with exact wording and status. Stop before converting a reported allegation into an asserted finding.

Phase 12 — Deliver with limits stated

Produce the chronology or assessment with the source list, the languages covered, the gaps, and the distinction between primary-sourced and media-only facts made explicit. Respect copyright by quoting briefly and citing precisely rather than reproducing text. Include the correction status of key sources. A good output is a product whose evidentiary basis is visible. Stop when a reader can tell which parts would survive if the media reporting were removed.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
GDELT Project	Open	Machine-coded global news event and tone dataset covering many languages with public query interfaces.	Finds early and vernacular reporting and shows how coverage propagated across outlets and languages over time.
Media Cloud	Registration	Open research platform for analysing online news content across large curated source collections.	Traces chains of citation and measures narrative penetration across national and local media systems.
Internet Archive Wayback Machine (archived)	Open	Historic snapshots of web pages including articles later edited, paywalled or removed.	Preserves and dates the exact article version relied on, which is essential when reporting is silently changed.
Conifer web archiving service	Open	High-fidelity on-demand web archiving producing browsable captures of dynamic pages, hosted by Rhizome.	Second independent archive for articles that resist other capture methods, reducing single-point preservation risk.
Reporters Without Borders World Press Freedom Index	Open	Annual assessment of press freedom conditions by country with detailed narrative on constraints on journalists.	Contextualises whether reporting from a country is likely to be free, constrained or state-directed.
Freedom House Freedom in the World	Open	Country assessments of political rights and civil liberties including media freedom sub-indicators.	Independent second measure of media environment conditions used when weighting domestic reporting.
Committee to Protect Journalists database	Open	Records of journalists killed, imprisoned or attacked, with case detail by country and year.	Indicates the risk environment for journalists, which bears directly on what domestic outlets can safely report.
Company registries and media ownership filings	Registration	Statutory records of media companies including shareholders, directors and filed accounts.	Establishes who actually owns and funds an outlet, which determines how its reporting should be weighted.
International Fact-Checking Network signatories	Open	Directory of fact-checking organisations committed to a published code of principles, with local language coverage.	Locates credible local verification capacity in the relevant language and provides prior checks on circulating claims.
National court listings and judgment databases	Open	Official records of proceedings, listings and published judgments naming parties and dates.	Primary source behind much legal reporting, allowing a claim to be anchored to the record rather than the article.
Official gazettes and regulator announcements	Open	Authoritative publication of appointments, decisions, enforcement actions and legal instruments.	The source of record behind most reporting on regulatory and governmental matters, and usually earlier than coverage.
ACLED	Registration	Coded political violence and protest events with dates, locations, actors and source notes citing media reporting.	Independent event baseline built from media, useful for cross-checking whether a reported incident is otherwise recorded.
ReliefWeb	Open	Aggregated humanitarian situation reports, assessments and press releases from responding organisations.	Non-media reporting on crisis events that frequently contradicts or predates media coverage from the same location.
Global Investigative Journalism Network resources	Open	Guides and reference material on investigative methodology, source assessment and cross-border research.	Methodological reference for chain-of-citation tracing, outlet assessment and verification practice.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against News Intelligence. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• News aggregation and alerting platforms — Deliver matched coverage across large source sets in near real time. Limitation: coverage of local and vernacular outlets is thin, which is exactly where differentiated value lies.
• Deduplication and near-duplicate detection — Collapses syndicated copies so genuine independent reports can be counted. Limitation: translated republication and heavy rewriting evade text-similarity approaches and inflate apparent corroboration.
• Web archiving services — Preserve and date the exact version of an article relied on. Limitation: paywalled and dynamically loaded articles archive poorly, and some publishers block archiving entirely.
• Machine translation with human review — Makes vernacular coverage tractable at scale across many languages. Limitation: it flattens hedging, register and idiom, so any quoted or load-bearing wording needs a competent human reader.
• Licensed news database services — Provide deep archives, transcripts and structured metadata not available on the open web. Limitation: licence terms restrict retention and redistribution, and coverage of local outlets remains uneven.
• Change monitoring on published pages — Detects silent edits, retroactive paywalling and deletion of articles under reliance. Limitation: requires the monitoring to be set up at collection time, since retrospective comparison is impossible without a baseline.
• Citation and link graph analysis — Maps which outlets cite which, revealing the origin of a claim. Limitation: many outlets do not link or attribute, so the graph understates dependence and overstates independence.
• Entity extraction and event coding — Structures large corpora into entities, dates and events for analysis. Limitation: extraction errors on names and places propagate silently into aggregate findings unless validated against a coded sample.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
• Auto-Collect Feeds — Pulls the registered feed set server-side on a schedule, recording per-feed status so a silently dead feed is visible.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Count observations, not articles. Three hundred adverse media hits routinely collapse to one original report once syndication, translation and aggregator republication are removed, and the collapsed figure is the honest one.
• The date of the event and the date of first reporting are different facts and both belong in the chronology. The gap between them is frequently the most informative element of a timeline.
• Go to the source of record. Reporting about a filing, a judgment or a regulator decision is a paraphrase, and the paraphrase is wrong often enough that anchoring load-bearing facts to the primary document is faster than defending them later.
• Assess outlet ownership before weighting the reporting. Two outlets that appear to confirm each other independently are frequently owned by the same interest or served by the same wire desk.
• Archive at collection or lose the version. Articles are edited without notice, retroactively paywalled, geoblocked and deleted, and a citation to a live URL is not evidence of what it said when you read it.
• Monitor for retraction on anything load-bearing. Unnoticed retraction of an underlying report is a routine failure in adverse media and due diligence work, and it invalidates everything built on it.
• State media is an indicator of official position, not a report of events. Treat it as evidence of what a government wants said, which is genuinely useful, and never as independent corroboration.
• Local and vernacular outlets report checkable detail that national coverage omits, often days earlier. A source list built only from major English-language outlets guarantees late, shallow and derivative collection.
• In products about named people, the wording is the legal exposure. Characterise allegations as reported and attributed, preserve the exact source language you relied on, and never let a reported claim harden into an asserted finding.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on News Intelligence is producing anything, and they are worth baselining before you change process or tooling.

• Ratio of unique originating reports to total articles collected on a given claim, tracked as the honest measure of corroboration after deduplication.
• Proportion of load-bearing chronology entries anchored to a primary source of record rather than to media reporting alone.
• Archive coverage rate: share of cited articles preserved to an independent archive with hash and retrieval timestamp at collection time.
• Detection rate for corrections, retractions and silent edits affecting sources under reliance, measured through change monitoring rather than chance discovery.
• Share of collection drawn from local and vernacular outlets in the relevant languages, as a measure of whether the source list reaches beyond wire coverage.
• Median lead time of first identified reporting relative to official confirmation, showing whether monitoring is genuinely early.
• Rate of client or editorial corrections attributable to reliance on recycled or retracted reporting, trended over time.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Counting republished wire copy as independent corroboration, the most common source of false confidence.
• Treating publication date as event date, which corrupts every timeline built from headlines.
• Missing vernacular-language reporting and concluding an event was never reported at all.
• Relying on aggregator summaries that strip attribution, caveats and the original sourcing language.
• Ignoring paywalled or archive-only reporting that contains the specific detail the assessment needs.
• Substituting a judgement about an outlet's politics for an assessment of that particular report's sourcing.

Legal and ethical considerations

Copyright limits how much text you may reproduce, so quote briefly, cite precisely and store full copies for internal analytical use under the applicable exception. Reporting about individuals remains personal data, and repeating an allegation can itself be defamatory in many jurisdictions, so attribute carefully and preserve the exact source wording you relied on. Respect paywall and database terms, and keep timestamped archived copies where the reporting may be relied on evidentially or challenged later.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for News Intelligence, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 data points, 8 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

How many adverse media hits does it take to establish something?

None, on their own. Volume of coverage measures syndication, not truth. Deduplicate, trace each item to its earliest identifiable report, and establish how many genuinely independent observations exist; the number is usually one. Then assess that origin: was the reporter present, is the sourcing named or anonymous, does the outlet have a track record, and does the claim rest on a document you could obtain yourself. A single well-sourced report from an outlet of record anchored to a primary document is worth more than a hundred republications, and the report should say so explicitly.

How do you tell independent corroboration from syndication?

By tracing the chain rather than counting. Look for shared distinctive phrasing, identical quotes with identical punctuation, the same errors reproduced, and publication timestamps clustering minutes after a wire release. Check whether later pieces cite or link the earlier one. Ownership matters too: outlets owned by the same group frequently share a desk. Genuine independence means a separate observation, meaning a different witness, a different photograph from a different position, or a document obtained separately. Where independence cannot be established, say so and lower the confidence rather than presenting a count.

Is a news article evidence?

It is evidence that something was published on a date, which matters in defamation, market abuse and regulatory contexts. For the truth of its contents it is generally hearsay and corroborates rather than proves. To use it at all you need the archived original with retrieval timestamp and hash, because publishers edit silently and remove articles. Where the story rests on a document, obtain the document; where it rests on a witness, seek the witness. Journalistic source protection is legally recognised in many jurisdictions, so unpublished material held by a newsroom is not readily obtainable.

How should state-controlled media be treated?

As authoritative evidence of official position and as unreliable reporting of events. That distinction makes it genuinely valuable: what a state broadcaster says reveals what the government wants believed, which timing and framing changes track, and which topics are absent. What it must never be is counted as independent corroboration alongside outlets it does not resemble in independence. Assess ownership and editorial control explicitly, record the assessment, and label such sources in the chronology so a later reader is not misled by the appearance of multiple confirming sources.

What do you do when an underlying report is retracted?

Treat everything built on it as invalidated until re-evidenced, and say so proactively. Check whether the retraction concerns the specific claim you relied on or a different part of the story, whether any other outlet reported it independently, and whether a primary source supports the fact regardless. Then correct the product, notify anyone who received it, and record the change. Unnoticed retraction is a common and serious failure in adverse media screening, which is why change monitoring on load-bearing sources should be set up at collection rather than left to chance discovery.

How much of an article can be reproduced?

Little, and the answer varies by jurisdiction. Copyright generally permits brief quotation with attribution for criticism, review or reporting, and many jurisdictions provide a research or private study exception covering internal analytical copies. Reproducing substantial text in a client deliverable, republishing full articles, or building a product on retained full text usually exceeds those limits, and licensed database terms add contractual restrictions on retention and redistribution. Quote briefly, cite precisely, retain full copies internally under the applicable exception, and check the licence before anything is redistributed externally.

How do you keep a monitoring programme from producing noise?

Anchor it to requirements and to entities rather than to keywords. Define what decisions the monitoring supports, build the source list to match including local and vernacular outlets, deduplicate aggressively, and review the output for findings rather than volume. Measure the programme on unique originating reports surfaced and on lead time against official confirmation, not on articles delivered. Prune sources that never produce a finding, and add local outlets that do. A monitoring feed that nobody reads because it is ninety percent syndication is a failed capability regardless of its coverage statistics.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• Copyright law and the quotation, reporting and research exceptions in the relevant jurisdiction, which govern how much text may be reproduced and retained.
• Defamation law in the jurisdictions of publication and of the subject, under which repeating an allegation can itself be actionable.
• International Fact-Checking Network Code of Principles, governing non-partisanship, source transparency and correction practice.
• Berkeley Protocol on Digital Open Source Investigations, setting preservation and verification standards for online material used evidentially.
• ISO/IEC 27037, governing collection and preservation of digital evidence including archived web content.
• Journalistic source protection provisions in national law and Article 10 of the European Convention on Human Rights, restricting compelled disclosure of unpublished material.
• Admiralty or NATO source grading, separating outlet reliability from the credibility of a specific report.
• Licensed news database terms of service, which contractually restrict retention, redistribution and derivative products built on full text.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. GDELT Project — GDELT. Machine-coded global news event and tone dataset across many languages
2. Media Cloud — Media Cloud. Open platform for analysing online news across curated source collections
3. Wayback Machine — Internet Archive. Public web archive used to preserve and date article versions (archived copy — the publisher moved or withdrew the original)
4. World Press Freedom Index — Reporters Without Borders. Annual country assessment of press freedom conditions
5. Freedom in the World — Freedom House. Country assessments of political rights and civil liberties including media
6. Database of attacks on the press — Committee to Protect Journalists. Records of journalists killed, imprisoned and attacked by country
7. Code of Principles — International Fact-Checking Network, Poynter Institute. Standards for transparency, non-partisanship and corrections in fact-checking
8. Investigative research guides — Global Investigative Journalism Network. Methodology for source assessment and cross-border investigation
9. ACLED political violence and protest data — Armed Conflict Location and Event Data Project. Media-derived event dataset with source notes for cross-checking
10. ReliefWeb — UN OCHA. Aggregated humanitarian reporting independent of commercial media

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: multilingual monitoring, citation-chain tracing and archived dated articles behind every timeline entry. Explore the platform, or browse the rest of the library by following any tag above.