START Terrorism Research: Intelligence Source Guide

START at the University of Maryland publishes the Global Terrorism Database and a family of radicalisation datasets built by human coders from open sources. It is the standard quantitative baseline for terrorism event analysis, and its discontinuities are as important as its contents.

At a glance

Source	START Terrorism Research
Category	Conflict, Crime & Human Security › Terrorism & Violent Extremism
Homepage	https://www.start.umd.edu/
Machine interface	`https://www.start.umd.edu/gtd/`
Format	`HTML`
Access	Open — no account required
Disciplines	Open Source Intelligence, News Intelligence
Mission domains	Extremism & Radicalization

Radicalization & terrorism datasets (PIRUS/GTD). — as catalogued in the platform’s own source registry.

The National Consortium for the Study of Terrorism and Responses to Terrorism (START) is a university-based research centre at the University of Maryland, originally established as a Department of Homeland Security Center of Excellence. It is not a feed and not an alerting service. It is a publisher of research datasets, codebooks and reports, of which two matter most to an intelligence practitioner. The Global Terrorism Database (GTD) is an event-level dataset of terrorist incidents worldwide, beginning in 1970 and running to 2020 in the public release, containing well over two hundred thousand incidents, each coded across roughly a hundred and thirty variables covering date, location, perpetrator, target, tactic, weapon, casualties, outcome and the sources used to code it. Profiles of Individual Radicalization in the United States (PIRUS) is a person-level dataset of individuals who radicalised to violent and non-violent extremism in the United States, coded from public records across demographic, social, ideological and behavioural variables. Around these sit smaller collections and portals — extremist crime data, group-level relational data, and periodic overview reports — plus the codebooks, which are the actual intellectual product. Everything is distributed as downloadable files and static web pages. There is no API in the sense the rest of this catalogue uses the word.

The analytical job GTD does that no operational feed does is provide a long, consistently coded historical baseline. Operational reporting tells you what happened this week. GTD tells you whether this week is unusual against fifty years of coded incidents in the same country, using the same inclusion criteria and the same tactic taxonomy. That is what makes it the substrate for trend analysis, risk scoring, base-rate estimation and the academic literature that policy is written from — the Global Terrorism Index and a very large share of published quantitative terrorism research are derived from it. PIRUS does a different and rarer job: it is one of the few systematically coded, individual-level datasets on radicalisation pathways, which means it can support statements about the distribution of characteristics across a population of radicalised individuals rather than the anecdotal reasoning that dominates the field. For an analyst, the practical value is calibration. When a report claims a tactic is rising, a region is deteriorating or a profile is typical, GTD and PIRUS are where you check whether the claim survives contact with a coded population. They are also where you discover, repeatedly, that apparent trends are artefacts of how the data was collected.

Who publishes it, and why that matters

START is an academic centre funded through government research grants, principally from the US Department of Homeland Security, alongside other federal and philanthropic sponsors. That funding model shapes the product in ways you should reason about explicitly. Grant funding is periodic and competitive, so dataset maintenance is not guaranteed between award cycles; GTD's update cadence has been irregular and the public series has not moved forward every year. Academic incentives favour methodological transparency — the codebooks are unusually candid about limitations, which is a genuine strength — but they do not favour operational timeliness, and nothing here is designed to support a decision this week. A US government sponsor also means the framing of what counts as terrorism, and which forms receive dedicated coding effort, reflects US policy interest even though the coding rules are applied globally. None of this makes the data unreliable. It means the data is a research artefact with a research lifecycle, and you should confirm the current status, coverage window and terms directly on the START site before designing anything around it rather than assuming continuity from a previous download.

Provenance is the first question to ask of any dataset and the one most often skipped. Who collects it, what their incentive is, whether they publish a methodology, and whether they correct the record when they get something wrong all bear directly on how much weight a finding drawn from it can carry.

What a record actually contains

The fields you will be working with, what each one means, and whether it is something you can pivot on. Read the meanings carefully — more analysis is wrecked by misreading a field than by failing to find one, and a field that looks like an observation is often an inference.

Field	Type	What it means	Pivot value
`eventid`	string	GTD's incident key, constructed as the date in YYYYMMDD form followed by a sequence number for that day. It encodes the coded date, so a change in the date changes the key.	Join key across GTD releases, and the identifier used by derived datasets and published research.
`iyear / imonth / iday`	int	Coded date of the incident. Month and day are set to zero when the source reporting did not establish them, which is common in early years and in poorly reported conflicts.	Temporal aggregation; but zero-valued components must be handled explicitly, not silently coerced to the first of the month.
`country / region`	enum	Coded country and world region of the incident using GTD's own numeric taxonomy, which reflects the political geography at the time of coding rather than a current ISO list.	Country dashboards and regional aggregation, after mapping GTD codes to ISO 3166 yourself.
`provstate / city`	string	First-order administrative division and city as named in the source reporting. Transliteration is inconsistent across decades and coders, and 'Unknown' is a frequent legitimate value.	Geocoding and administrative rollup, but only after fuzzy matching and manual review.
`latitude / longitude / specificity`	float	Geocoordinates with an explicit precision indicator. Specificity records whether the point is the actual location, the nearest settlement, or only a province or country centroid.	Mapping and spatial analysis — but filtering on specificity is mandatory, because centroid-coded events cluster on administrative centres that never saw an attack.
`crit1 / crit2 / crit3`	int	The three supplementary inclusion criteria: political, economic, religious or social goal; intent to coerce or intimidate an audience beyond the immediate victims; and action outside the bounds of legitimate warfare.	Defining your own operational definition of terrorism by filtering on criteria combinations rather than accepting GTD's default inclusion.
`doubtterr`	int	A flag indicating the coders had doubt that the incident meets the definition of terrorism at all. A substantial share of records carry it.	Sensitivity analysis: any headline count should be reported with and without doubtful events.
`alternative`	enum	When doubt exists, the competing classification the coders considered — insurgency or guerrilla action, other crime, inter-communal conflict, state actor violence, or lack of intentionality.	Reclassifying events into a conflict-studies framing, and reconciling GTD against ACLED or UCDP which use different unit definitions.
`gname / gsubname`	string	Perpetrator group as named in reporting, with subordinate or aliased naming where recorded. 'Unknown' is the single most common value in many country-years.	Actor profiles, but only after alias resolution — the same organisation appears under multiple names across decades.
`claimed / claimmode`	int	Whether responsibility was claimed and by what mechanism. Claim status is a reporting fact, not a verification of authorship.	Attribution confidence weighting; separating claimed from attributed events before any actor-level analysis.
`attacktype1 / targtype1 / weaptype1`	enum	Primary tactic, target category and weapon category, each with up to three coded values per incident plus free-text detail on the specific target.	Tactic and target-set profiling for an actor or theatre; the free-text target field is where the genuinely useful specificity lives.
`nkill / nwound / nkillter`	int	Fatalities and injuries, with separate counts for perpetrators where reported. Missing values are genuinely missing, not zero.	Severity analysis; never sum a column containing nulls treated as zeroes.
`scite1 / scite2 / scite3 / dbsource`	string	The citations the coder relied on and which collection effort produced the record. This is the provenance field, and it is the one most analysts never open.	Source-quality assessment, and detecting collection-regime discontinuities by watching dbsource change.
`INT_LOG / INT_IDEO / INT_MISC / INT_ANY`	int	Whether the incident was international in logistics, ideology or other respects — perpetrator nationality differing from the location of the attack, and related distinctions.	Cross-border and transnational analysis, and separating domestic from externally directed activity.

Coverage — and what is not in it

GTD's public series covers 1970 through 2020 with global geographic scope, and contains well over two hundred thousand coded incidents. Its most important structural gap is 1993, for which the original data was lost by the organisation collecting it at the time and has never been fully reconstructed; only aggregate country totals are available for that year, and any time series crossing it must handle the hole explicitly rather than interpolating over it. Coverage density is a function of open-source reporting, so it is deep where a free press operated and thin where it did not: the Northern Ireland troubles, Western Europe, Latin America and South Asia are richly covered, while Soviet-era Central Asia, parts of Africa and periods of tight information control are sparse in ways that reflect reporting rather than reality. The coding regime changed hands several times — real-time wire-service collection through the late 1990s, then two successive retrospective academic efforts, then in-house collection at START from 2012 using a much broader automated open-source sweep with manual review. Each handover changed what was found. The 2012 transition in particular produced a step increase in recorded events that is a methodological artefact overlaid on a real deterioration, and the two cannot be cleanly separated. PIRUS covers individuals in the United States only, across a long historical window extended in successive releases, and is a sampled dataset rather than a census of everyone who could have been included.

Known blind spots

Absence of evidence here is not evidence of absence. These are the conditions under which START Terrorism Research will not show you something that is nevertheless real:

The 1993 data is gone. Any analysis spanning the early 1990s has a one-year hole that will silently distort trend fits, moving averages and change-point detection unless you handle it as missing rather than as a low year.
Events that were never reported in open sources do not exist in GTD, which systematically under-counts violence in closed societies, remote areas and periods of censorship — precisely the environments where an analyst most needs a base rate.
State violence is largely excluded by design. GTD codes sub-national actors, so repression, extrajudicial killing and military action against civilians are absent or appear only as the 'state actor' alternative classification on doubtful records.
The collection-regime handovers mean cross-era comparisons are unsafe. A rise in coded events after 2012 partly measures a change in how hard the coders looked, and no published correction fully separates the artefact from the signal.
Attribution is reporting-derived. 'Unknown' dominates perpetrator coding in many theatres, and where a group is named, the naming reflects what journalists wrote rather than an evidentiary finding — so actor-level counts understate unattributed activity and overstate the prominence of groups that issue claims.
The public series stops well short of the present. GTD is not a current-awareness source, and using it to characterise the past two or three years will either fail outright or force you onto a different dataset mid-series.
Geocoding precision varies enormously and is only visible if you read the specificity variable. Events coded to a province centroid create phantom hotspots on administrative capitals that no analyst reviewing a heat map would question.
The inclusion definition is contested and consequential. Insurgent attacks on military targets, communal violence and criminal violence with political overtones sit at the boundary, and reasonable analysts using ACLED or UCDP definitions will produce materially different counts for the same conflict.
PIRUS is United States only and sample-based. It cannot support statements about radicalisation in other countries, and it cannot support prevalence claims about the underlying population without accounting for how the sample was drawn.

Write the blind spot into the product. A statement that something “was not observed in START Terrorism Research” is defensible; a statement that it “did not happen” is not, and the difference is what survives cross-examination.

Access, licensing and what you may do with it

Access model: Open — no account required

Access is by download from the START website rather than by query. GTD has historically required agreeing to terms of use and providing registration details before the full dataset file is released, with a web-based search interface available for browsing individual incidents without downloading. PIRUS and the other datasets are distributed as files with accompanying codebooks. The practical workflow is to download once, ingest into your own store, and re-check the site periodically rather than attempting to synchronise. Read the codebook before the data. It is not optional documentation: the variable semantics, the missing-value conventions and the collection-regime history are only stated there, and every serious error made with this dataset traces back to someone who opened the spreadsheet first. Confirm the current terms, release version and coverage window on the site at the moment you download, and record the version and download date alongside the data, because published research citing 'the GTD' without a version is frequently irreproducible for exactly this reason.

Licence

GTD has been made available for non-commercial research and educational use under terms of use accepted at download, with commercial use requiring separate permission from the University of Maryland. That distinction is the one that catches private-sector users: an internal risk model built for a client, a commercial risk score, or a product feature derived from GTD counts is not obviously non-commercial, and the safe assumption is that it is not. The terms have been revised more than once and the exact wording governs, so read the current agreement at the point of download rather than relying on a description of it — including this one. Attribution requirements apply to any published use. PIRUS and the other datasets carry their own terms, which are not automatically the same as GTD's. If your intended use is commercial or borderline, contact START before building rather than after; the centre is accustomed to licensing enquiries and a written answer is cheap insurance.

Rate limits and fair use

There is no API to rate-limit. The etiquette question is about scraping the web search interface, which you should not do: the bulk file exists precisely so that you do not have to, and hammering a university research centre's public interface to reconstruct a dataset they will give you as a download is both rude and slower. If you need repeated access, download once and refresh on a schedule measured in months, because that is the timescale on which the data actually changes. Cache the codebook alongside the data with the same version stamp.

Licensing changes, and it changes without warning. A dataset that was free for research this year may not be free for commercial or evidential use next year. Confirm the current terms before you build a dependency on it, and record the terms you relied on alongside the data — the licence in force at the time of collection is part of the provenance.

Collecting it

How START Terrorism Research is actually pulled, in the order you would set it up. Prefer the bulk or export interface over per-item lookups wherever one exists: it is kinder to the publisher, faster for you, and gives a reproducible snapshot rather than a series of point-in-time answers you cannot reconstruct later.

Method	Format	Cadence	Notes
Bulk dataset download	CSV	check quarterly; the underlying release changes far less often	The only sensible route for analysis. Take the whole file, ingest it, and version it. Partial extracts lose the ability to recompute denominators.
Codebook retrieval	HTML	with every data download	Pull and archive the codebook for the exact release you took. Variable definitions and coding conventions have changed between versions and the old codebook is the only way to interpret an old extract.
Web search interface	HTML	ad hoc	Appropriate for checking a single incident or confirming how a specific event was coded. Not a collection method, and not something to automate.
Report and publication monitoring	HTML	periodic	START's overview reports and research briefs frequently document methodological changes before they are reflected in a codebook revision. Read them as change notifications.
Derived index tracking	HTML	annual	The Global Terrorism Index and similar derived products publish on their own cycle from GTD inputs; watching them tells you which GTD release the wider policy conversation is currently using.

Ingesting it into the platform

Every step below is idempotent and cursor-based: interrupt one and it resumes from where it stopped rather than duplicating rows or losing progress. Collection is recorded per source, so a feed that quietly stops publishing shows up as a stale timestamp instead of silently thinning your coverage.

Register the dataset with its version — Create the entry in sources.php with the release identifier, download date and coverage window recorded as source metadata, so that every derived record carries the provenance of a specific release rather than a generic 'GTD' label.
Import the bulk file — Use import.php for the file rather than the feed collector in collect.php — this is an episodic bulk artefact, not a polled feed, and treating it as a feed produces spurious change detection on every re-import.
Preserve missing-value semantics — During ingest.php, map GTD's coded absences distinctly: unknown month and day, unrecorded casualty counts and unattributed perpetrators must remain distinguishable from zero and from empty string, because every downstream aggregate depends on that distinction.
Normalise geography without discarding precision — Map GTD country codes to ISO 3166 and carry the specificity variable through to the event record, so that country.php and theater.php views can exclude centroid-coded events from any spatial claim.
Resolve actor names to entities — Run alias resolution over the perpetrator field before creating actor entities, so that decades of variant spellings and successor organisations collapse onto stable records in actor-profile.php rather than proliferating near-duplicates.
Segment by collection regime — Tag every record with the collection effort that produced it from the source-database field, and expose that tag in analytics.php so that any time series crossing a handover renders the discontinuity instead of hiding it.
Build the historical baseline layer — Load the coded events into timeline.php as a background series against which current reporting is compared, explicitly labelled as ending at the dataset's coverage boundary rather than at today.
Cross-reference against current-event sources — Use correlate.php to align GTD incidents with conflict-event and news-derived sources for the overlapping years, which both validates the join keys and quantifies how much each dataset sees that the other does not.

Registered sources and their last-collected state are listed in sources.php, and the scheduled chain that keeps them current is in automation.php.

How it is wrong, and how to tell

Every dataset is wrong in characteristic ways. Knowing which ways is the difference between using a source and being used by one, and it is the part of source evaluation most often skipped because it is the part that takes work.

Judge GTD on coding discipline, which is high, rather than on completeness, which is structurally limited and honestly documented. The variables are defined precisely, the coders were trained against a written manual, inter-coder consistency was a stated concern, and the codebook states its own limitations more candidly than most commercial products state their strengths. Within a single collection regime and a single well-reported country, the data is trustworthy at the level it claims: an incident record reflects what open sources reported, coded consistently. The weaknesses are not errors so much as boundaries. Completeness tracks press freedom. Attribution tracks what journalists were told. Casualty figures track initial reporting, which is systematically noisy and often never corrected in the record. And the collection-regime discontinuities mean that the dataset's own internal comparability — the thing that makes a long time series valuable — is weaker than its length suggests. The right posture is to use GTD for structure and calibration, to state the release version in anything you publish, and to treat any conclusion that depends on comparing pre-2012 with post-2012 counts as provisional until you have shown it survives a regime-controlled analysis.

Characteristic false positives

Centroid geocoding creates attacks that never happened where the map says. An event coded only to a province appears at the province's administrative centre, and an unfiltered heat map will show a hotspot on a city that was never attacked.
Casualty counts freeze at first reporting. A figure coded from a wire story on the day is not revised when the toll is later corrected, so severity is systematically noisy and sometimes badly wrong in either direction.
'Unknown' perpetrator is read as 'no group involved'. Analysts filtering to named groups silently drop the majority of events in some theatres and then describe the remainder as the threat picture.
The doubtful-terrorism flag is ignored. Headline counts that include doubtful events are not comparable with counts that exclude them, and published figures rarely say which convention they used.
Multiple related incidents are counted as one or as many depending on coding rules that changed. Coordinated attacks and the related-event linkage produce different totals depending on how you unnest them, and both conventions appear in the literature.
The 2012 collection change is read as a real surge. The step in the series is partly methodological, and a trend model fitted across it will attribute an artefact to whatever geopolitical explanation is currently fashionable.
Zero-valued date components are coerced. Importing month and day as integers without handling the unknown convention places thousands of events on the first of the month or the first of the year, creating seasonal patterns that are pure artefact.
Group names are treated as stable identities. The same organisation appears under transliteration variants, successor names and media shorthand across fifty years, and naive grouping by the name field both fragments large actors and merges unrelated ones.

None of these make the source unusable. They make it a source that requires corroboration before an assertion built on it goes into a product, which is true of every source and admitted by few.

Ageing

The event records themselves do not age — a coded 1987 incident is as valid today as when it was coded, subject to the caveat that it was never revised after initial reporting. What ages is the dataset's relevance to the present and the interpretive layer around it. The coverage boundary moves only when START releases an update, so the gap between the dataset's end and today grows continuously, and an analysis built on 'the most recent GTD data' becomes an analysis of the past without anyone changing a word. Actor entities age fastest: groups dissolve, rebrand, merge and are proscribed under new names, so the perpetrator field describes the naming conventions of the period rather than a current organisational reality. A stale usage looks like a briefing that cites GTD-derived rates as current risk, or an actor profile whose tactic distribution is drawn entirely from a period before the group's operational transformation. Detect it by rendering the dataset's coverage boundary on every chart and by refusing to let a GTD-derived figure appear in a current-threat assessment without an explicit as-of date.

What this source feeds

A source is only worth what it lets you conclude. These are the disciplines that collect through it, the mission domains it serves and the data points it yields — every one is a tag, so you can follow any thread from here into the rest of the library.

Collected by these intelligence disciplines

Serves these mission domains

Extremism & Radicalization

Yields these data points

How each sector uses START Terrorism Research

The same dataset is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The records are shared — the constraints, thresholds and outputs are not.

🎖 Military and defence

For area assessment and force protection planning, GTD supplies the historical base rate that intelligence preparation of the environment needs and that current reporting cannot provide: what tactics have been used against what target sets in this district over decades, what the seasonal and event-driven rhythms look like, and how a group's methods evolved. Use the tactic, weapon and target variables to build a threat profile for a specific route or installation type rather than a country-level narrative. The critical discipline is the exclusion of state actor violence and the treatment of insurgent attacks on military targets, which sit on GTD's inclusion boundary — in a counter-insurgency environment the dataset will show you a partial view of the violence, and pairing it with a conflict-event dataset that codes state and battle violence is not optional. Never let a GTD-derived rate stand as a current threat level; it is a prior, and current reporting is the update.

🕵 National intelligence

The value to national intelligence is calibration and challenge rather than collection. When an assessment claims a tactic is diffusing, an actor is escalating, or a region is deteriorating, GTD is where the claim is tested against a coded population using a fixed definition. It is also the strongest available corrective to availability bias: analysts systematically over-weight the incidents they have read about, and a base rate drawn from fifty years of coding is the cheapest way to notice. The methodological caution is that GTD's inclusion criteria embed a particular definition of terrorism, and where your organisation's definition differs — on state-sponsored violence, on attacks against military targets, on communal violence — you must recode from the criteria flags rather than accept the default population. Treat the codebook as a source document and cite the release version in any product that carries a GTD-derived figure, because a reader who cannot reproduce your denominator cannot check your conclusion.

👮 Law enforcement

For law enforcement, PIRUS is usually the more relevant artefact than GTD. It supports population-level statements about the characteristics, pathways and behavioural indicators associated with individuals who radicalised in the United States, which is the empirical grounding that prevention and threat-assessment programmes are supposed to rest on. The essential caution is directional: a dataset of people who did radicalise cannot tell you the rate at which people with a given characteristic will radicalise, because the denominator is absent. Using such distributions as screening criteria inverts the inference, produces overwhelming false positives against any realistic base rate, and in most jurisdictions raises immediate legal problems where the characteristics correlate with religion, ethnicity or protected political belief. Use it to inform structured professional judgement and to challenge assumptions, not to build a profile. GTD's role in a law enforcement setting is historical context for a specific threat type or target class, not case support.

🔍 Private investigation and corporate security

Corporate security and private investigative work uses GTD mainly for site and travel risk: what has historically happened to this class of facility, in this city, and how the pattern has moved. That is a defensible use and produces better-grounded advice than the country-level risk ratings that circulate commercially, most of which are themselves derived from this data with a proprietary wrapper. Two constraints govern. First, the licence: non-commercial terms and a commercial deliverable are in tension, and a client-facing risk product built on GTD needs a licensing answer before it needs a methodology. Second, the coverage boundary makes GTD unsuitable as the sole basis for a current-threat statement to a client who will act on it this week — present it explicitly as historical base rate and pair it with current reporting.

📰 Journalism and OSINT media

For investigative and data journalism, GTD is the dataset that lets you check a political claim about terrorism against a coded record, and the codebook is what lets you do it honestly. The most valuable stories from this data are usually about the data: which events are counted, which are not, how the count changes when the inclusion criteria are varied, and how the collection-regime handovers shape the trend lines that politicians cite. If you publish a chart, publish the release version, state whether doubtful events are included, and show the 1993 gap rather than smoothing it — every one of those choices changes the picture and a reader who cannot see them cannot evaluate the claim. Avoid the standard error of describing GTD as a record of terrorism; it is a record of what open sources reported and coders classified, which is a different and more interesting thing.

🌍 NGO, humanitarian and human rights

Human rights, humanitarian and peacebuilding organisations use GTD for historical context in country analyses, conflict sensitivity assessments and programme risk planning. Its exclusion of state violence is the dominant limitation for this community: in most of the environments where an NGO is working, state and para-state violence against civilians is a large share of the harm, and GTD is close to silent on it by design. Pair it with datasets that code state actors, political violence against civilians and one-sided violence, and be explicit in any published analysis that the terrorism series measures one category of actor. For staff-security planning, the tactic and target variables are genuinely useful — attacks on aid workers, vehicles and compounds are coded as target types — but the coverage boundary means the recent years that matter most for a current security plan are the ones GTD does not cover.

🎓 University and research

This is a research dataset first, and the academic community is its primary constituency; a very large fraction of the quantitative terrorism literature runs on GTD. The methodological obligations are correspondingly strict. Cite the release version and download date. Handle 1993 as missing. Control for the collection-regime changes or restrict your window to a single regime. Report results with and without doubtful events. Do not use the geocoordinates without conditioning on the specificity variable. For radicalisation research, PIRUS supports individual-level modelling that almost nothing else does, but its sampling design and the absence of a comparison population impose hard limits on causal and predictive claims — the honest studies are descriptive and comparative rather than predictive. Ethics review is warranted for PIRUS work because the records concern identifiable individuals compiled from public sources.

Playbook: working START Terrorism Research end to end

A repeatable sequence from first pull to finished product. Each phase states what you are trying to establish, not merely what to click — the objective is a defensible chain of reasoning, not a completed checklist.

Phase 1 — Decide whether you need a baseline or an alert

This source answers 'is this unusual, and against what' — never 'what happened last night'. If the question is current, GTD is the wrong tool and using it will produce a confidently obsolete answer. Establish at the outset whether your deliverable needs a historical prior, and if so, whether the dataset's coverage boundary is close enough to the present to be useful.

Phase 2 — Read the codebook before touching the data

Open the codebook for the exact release you have and read the sections on inclusion criteria, collection history and missing-value conventions. Everything that goes wrong with this dataset goes wrong because someone skipped this step. Record the release identifier where your analysis can cite it.

Phase 3 — Define your own population from the criteria flags

Do not accept the default set of included events. Decide explicitly whether your analysis counts doubtful events, attacks on military targets, and incidents whose alternative classification is insurgency or communal violence, then filter on the criteria variables to build the population your question actually needs. Document the filter as part of the method.

Phase 4 — Establish the reporting-density context

Before drawing any conclusion about where violence is concentrated, characterise where the reporting was. Compare event density against press-freedom conditions and against a second conflict dataset for the same window. A country that looks quiet may simply have had no reporting reaching the coders.

Phase 5 — Segment the series by collection regime

Split your time series at the collection handovers and inspect each segment separately before joining them. If a trend only exists across a handover, you have found an artefact. If it exists within regimes as well, you have found something real and can say so with justification.

Phase 6 — Condition every spatial claim on geocoding precision

Filter to events geocoded at an actual-location precision before mapping, and render the excluded events separately as an unlocated count. A map that silently includes centroid-coded events will show hotspots on provincial capitals and will be wrong in exactly the way that survives peer review.

Phase 7 — Resolve actors before counting them

Build an alias table for the perpetrator names in your slice, collapsing transliterations, successor organisations and media shorthand onto stable entities, and keep the raw string alongside the resolved identity. Then examine how much of your population is unattributed, and state that share whenever you present actor-level findings.

Phase 8 — Reconcile against an independent event dataset

For any overlapping period, join GTD against a conflict-event source and quantify the disagreement: events in one and not the other, casualty figures that differ, attributions that conflict. The disagreement rate is your realistic uncertainty band, and it is almost always larger than analysts assume.

Phase 9 — Build the actor or theatre profile

With a defined population and resolved actors, characterise the tactic, target and weapon distribution for your subject and how it changed over time. This is where the dataset earns its keep — a capability trajectory drawn from coded incidents is far more defensible than one assembled from remembered reporting.

Phase 10 — Bridge to the present deliberately

Explicitly hand off from the historical baseline to current-awareness sources at the coverage boundary, and mark the seam in the product. Never let a chart run to the present edge when the data stops years earlier; the visual implication is a falsehood even when the numbers are correct.

Phase 11 — Stress-test the finding against definitional variation

Recompute your headline result under two or three alternative inclusion definitions. If the direction of the finding flips when doubtful events are included, or when insurgent attacks on military targets are counted, that fragility is the most important thing you learned and belongs in the product.

Phase 12 — Publish with provenance and archive the inputs

Record the release version, download date, filter definitions and alias table alongside the output in cases.php and reports.php, and keep the raw file. A GTD-derived figure whose population definition is not recoverable is not reproducible, and irreproducible figures acquire a life of their own once they leave your desk.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

What to pair it with

No single source carries a finding. These are the datasets that corroborate, extend or contradict this one — and a source that contradicts is worth more than one that agrees, because it is the only thing that will tell you when you are wrong.

Source	Relationship	What it adds
ACLED	extends	Codes political violence, battles, riots and violence against civilians including state actors, on a near-current cadence. The single most important companion, because it covers the categories GTD excludes and the years GTD has not reached.
Uppsala Conflict Data Program	corroborates	Long-running academic conflict datasets with rigorously documented inclusion rules for state-based, non-state and one-sided violence. Use it to cross-check GTD counts and to see how differently a different definition partitions the same events.
GDELT	extends	Machine-coded global news event stream with no coverage boundary. Vastly noisier than GTD and not a substitute for it, but it fills the recency gap and can surface events for manual review.
Global Terrorism Index	extends	An annual derived index built on GTD data with additional weighting and analysis. Useful for seeing how the underlying data is being interpreted in policy discussion, and for the country narratives.
Europol TE-SAT	corroborates	Annual EU terrorism situation and trend report drawing on member state law enforcement reporting rather than open sources. A genuinely independent check on GTD's European coverage, with a very different collection basis.
Combating Terrorism Center at West Point	extends	Analytical publications and primary-document collections that provide the organisational and doctrinal context an event dataset cannot carry.
International Centre for the Study of Radicalisation	extends	Research on radicalisation pathways, foreign fighters and online mobilisation that contextualises PIRUS-style individual-level findings outside the United States.
RAND Corporation	corroborates	Long-standing terrorism research programme including historical incident data collection with different inclusion rules, useful as a definitional counterpoint for the pre-2010 period.

Legal, ethical and operational constraints

The binding constraint is contractual rather than statutory: GTD is released under terms of use accepted at download that restrict use to non-commercial research and education, with commercial use requiring separate permission. Building a commercial risk product, a client deliverable or a paid analytical service on the data without that permission is a licence breach, and the fact that the data concerns public events does not change it. Attribution obligations apply to publication. Beyond licensing, PIRUS raises data-protection considerations in several jurisdictions because it comprises records about identifiable individuals, compiled from public sources but nonetheless personal data — processing it in Europe or the United Kingdom requires a lawful basis and, given the ideological and religious variables, engages the special-category provisions. Ethically, the sharper problem is inferential: individual-level radicalisation data invites profiling, and profiling on characteristics correlated with religion, ethnicity or political belief is unlawful in many settings and unsound in all of them. Use these datasets to test hypotheses and calibrate judgement. Do not use them to select people for attention.

Operational security

The exposure here is low but not zero. Downloading GTD has historically required registration, so your organisation's interest in the dataset is known to the publisher, and in a university setting that record is subject to ordinary institutional and legal process. Use of the web search interface reveals the specific incidents, groups and countries you queried to whoever holds those logs. Neither is likely to matter for most work, but if the fact of your interest in a particular actor is itself sensitive, take the bulk download once from infrastructure you are comfortable attributing and do all subsequent querying locally — which is the correct engineering approach regardless. The greater operational risk is downstream: a report that cites specific GTD event identifiers reveals precisely which incidents shaped your assessment, which is more informative to a reader than most analysts intend.

Two rules that hold regardless of jurisdiction. Collection that is lawful is not automatically proportionate, and a dataset assembled for one purpose does not carry consent for another. Where the records concern identifiable people, the question is not only whether you may hold the data but whether holding it serves the purpose you are accountable for.

Is it earning its place?

Sources accumulate. Feeds get added during an incident and are never reviewed again, and a decade later the pipeline is carrying dead weight that nobody dares remove. These are the measures that show whether START Terrorism Research is contributing anything, and they are worth baselining now so the answer is available later.

Share of your analytical products that state a GTD release version and population filter — anything below complete means you are shipping irreproducible figures.
Proportion of events in your working slice geocoded at actual-location precision, tracked per country, as the honest denominator for any spatial claim.
Unattributed share of events in your population, reported alongside every actor-level finding, as the direct measure of how much of the picture attribution analysis cannot see.
Disagreement rate against an independent conflict-event dataset for overlapping years, which is your realistic error bar and should be recomputed for each theatre rather than assumed.
Number of findings whose direction changed under alternative inclusion definitions during stress-testing, as a running measure of how definitionally fragile your analytical line is.
Gap in years between the dataset coverage boundary and the date of the product it supports, tracked so that the drift into obsolescence is visible rather than gradual.
Count of downstream products that cite a GTD-derived figure without an as-of date, treated as a defect rate to be driven to zero.

Beware of volume. Indicator counts rise easily and say almost nothing. Unique contribution — findings this source produced that no other source in your stack would have — is the measure that matters, and it is usually far lower than anyone expects.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

The codebook is the source, not the spreadsheet. Analysts who read it produce different and better work than analysts who infer variable meanings from column names, and the difference shows up in every published chart.
Always report the population definition alongside the number. 'Terrorist attacks in country X in year Y' is not a well-defined quantity until you have said whether doubtful events, insurgent attacks on military targets and unsuccessful attacks are in or out.
Treat a change in the collection-regime field as a hard break in the series. Fit trends within regimes and compare regimes explicitly; do not run a single model across a handover and then explain the step change geopolitically.
Filter on geocoding specificity before you map anything. This single discipline eliminates the most common visually persuasive error in the entire field.
Distinguish claimed from attributed. A claim is an assertion by an organisation with reasons to make it; an attribution is a coder's reading of press reporting. Neither is a finding, and conflating them inflates the apparent coherence of actor behaviour.
Casualty figures are first reports. If a number matters to your conclusion, go back to the cited sources in the citation fields and check whether the toll was later revised — the dataset will not have been.
Use GTD to challenge your own narrative, not to illustrate it. Its highest-value application is discovering that a pattern you were confident about does not appear in a coded population, and analysts who only use it for supporting charts are wasting it.
Never present a GTD-derived rate as a current threat level. Draw the coverage boundary on the chart, and hand off explicitly to current sources beyond it.
For PIRUS, hold the direction of inference fixed. The dataset describes people who radicalised; it says nothing about the probability that a person with a given profile will. Every misuse of individual-level radicalisation data begins with that inversion.

Questions analysts actually ask

Can I use GTD to tell me what is happening now?

No. The public series ends years before the present and is not designed for current awareness. Use it as a historical baseline and hand off to conflict-event and news-derived sources for the recent window, marking the seam explicitly in your product.

Why does GTD disagree with ACLED on the same conflict?

Because they code different populations with different inclusion rules and different unit definitions. GTD codes terrorist incidents by sub-national actors; ACLED codes political violence including state actors, battles and riots. The disagreement is informative rather than an error in either, and quantifying it is a useful exercise in its own right.

What actually happened to 1993?

The original records for that year were lost by the organisation collecting the data at the time and were never fully reconstructed; only aggregate country-level information is available. Treat the year as missing data, not as a low year, and make sure every chart shows the gap.

Is the increase in events after 2012 real?

Partly. The 2012 transition to in-house collection at START used a much broader automated open-source sweep than the preceding efforts, which mechanically increased the number of events found. That overlays a period of genuine deterioration in several theatres. No published correction cleanly separates the two, so treat cross-handover comparisons as unsafe.

Can I use this in a commercial risk product?

Not without permission. The terms of use restrict the data to non-commercial research and education, and a client deliverable or paid product falls outside that. Contact the University of Maryland about a commercial licence before you build; the answer may well be yes, but it needs to be in writing.

How reliable are the casualty numbers?

They reflect what was reported at the time, usually early in an incident, and are not systematically revised afterwards. Use them for order-of-magnitude and comparative work, not as authoritative tolls, and go back to the cited sources when a specific figure carries weight.

Should I use the latitude and longitude fields?

Only in conjunction with the specificity variable. A large share of events are geocoded to a settlement, province or country centroid rather than an actual location, and mapping them unfiltered produces hotspots on administrative centres that no attack ever touched.

Does GTD cover state violence and repression?

Essentially no. Its definition targets sub-national actors, so state repression, extrajudicial killing and military action against civilians are outside scope, appearing at most as an alternative classification on doubtful records. For those categories you need a conflict dataset that codes state actors.

Can PIRUS be used to identify people at risk of radicalising?

No, and attempting it is both statistically invalid and legally hazardous. The dataset contains only people who did radicalise, with no comparison population, so it cannot produce a rate. Applied as a screening profile against a general population it would generate false positives at overwhelming rates, on characteristics that are frequently protected in law.

Standards, formats and interoperability

What this source speaks natively, and what it has to be translated into before a partner can consume it. Work that arrives in a recognised format is easier to defend, easier to hand over and easier to automate against:

GTD's inclusion definition — intentional, violent or threatened violence, by a sub-national actor, plus two of three supplementary criteria — is a formal operational definition and should be quoted rather than paraphrased when it governs your population.
The GTD variable taxonomy for attack type, target type and weapon type is a de facto standard in quantitative terrorism research, and mapping other datasets onto it is a common and useful normalisation step.
ISO 3166 country coding is not what GTD uses natively; mapping its internal country and region codes to ISO is a required ingest step for interoperability with everything else in the catalogue.
PIRUS variable structure follows the radicalisation literature's common constructs, which makes its variables comparable in principle to other individual-level datasets built on the same conceptual framework.
The platform exports GTD-derived events and actor entities in STIX 2.1, MISP, CSV, JSON and JSONL, so a historical baseline can travel into the same case and reporting structures as current indicators.
Nothing in this dataset is model-generated. Every record was coded by a human against a written manual from cited open sources, and the platform preserves that provenance rather than substituting inference for it.
Where GTD records feed country-level scoring in country-risk.php, the derivation is arithmetic over coded events with the population filter recorded, not an opaque index.

References

Primary documentation and authoritative references for this source. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

National Consortium for the Study of Terrorism and Responses to Terrorism (START) — University of Maryland. The centre itself: dataset listings, research publications, current project status and the contact route for licensing questions.
Global Terrorism Database — START, University of Maryland. The dataset home, with the codebook, terms of use, download route and web search interface. Read the codebook here before doing anything else.
ACLED — Armed Conflict Location & Event Data Project. The essential companion dataset for state actors, battles and violence against civilians, and for the years GTD does not cover.
Uppsala Conflict Data Program — Uppsala University. Rigorously documented conflict datasets with explicit inclusion rules. The best available demonstration of how much a definition changes a count.
GDELT Project — GDELT. Machine-coded global news events, useful for bridging GTD's recency gap and for understanding what automated coding does and does not capture.
Vision of Humanity — Institute for Economics and Peace. Publisher of the Global Terrorism Index, the most widely cited derived product of GTD and therefore the version of this data that reaches policymakers.
Europol — European Union Agency for Law Enforcement Cooperation. Publisher of the annual EU Terrorism Situation and Trend Report, built from member state law enforcement reporting — a genuinely independent basis for checking European coverage.
Combating Terrorism Center — United States Military Academy, West Point. Analytical publications and primary-source collections providing the organisational context that event coding necessarily strips out.
International Centre for the Study of Radicalisation — King's College London. Radicalisation and foreign-fighter research outside the United States, the natural comparative context for PIRUS-based findings.
RAND Corporation — RAND. Long-running terrorism research including historical incident collection under different inclusion rules, useful as a definitional counterpoint.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this source: it ingests the coded event history as a versioned baseline layer, preserves the collection-regime and geocoding-precision flags through to analysis, resolves perpetrator names onto stable actor entities, and renders the dataset's coverage boundary on every timeline so that a historical prior is never mistaken for a current threat picture.. Browse the full source catalogue, or follow any tag above into the rest of the library.