Video: Data Point Intelligence Guide

A video is not evidence of what its caption claims. It is a container of measurable facts, and those facts are what survive scrutiny.

Understanding the Video as an intelligence artifact

A video data point is a discrete media file or stream: a container such as MP4, MOV or WebM, or an HLS manifest, wrapping encoded video and audio tracks plus timing and metadata structures. The container records how the file was produced, including encoder identity, bitrate, frame rate, resolution, track ordering and sometimes creation timestamps or GPS. The pixels record a scene: terrain, architecture, signage, weather, uniforms, vehicles and sound. Analytically, a video is a claim that something occurred at a place and time, and every component of it is independently testable.

Variants matter more than most analysts expect. An original camera file carries maker-specific atoms and full metadata; a platform copy has been transcoded, stripped and re-muxed; a screen recording of a re-upload preserves almost nothing but pixels. Live streams arrive as numbered segments with server timestamps. Frame rate, rolling-shutter artefacts, letterboxing and burned-in watermarks persist through re-encoding and become fingerprints of the distribution chain.

Why it matters

Video anchors an incident to physical ground truth. Geolocating a single frame converts an unverifiable claim into a coordinate; chronolocating shadows and weather converts it into a timestamp. Video also exposes capability such as weapon systems, vehicle variants, unit insignia and industrial equipment that no text report reliably conveys. In fraud, extremism and trafficking casework the same file recirculates for years, so identifying the earliest instance establishes provenance and often the original uploader.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Encoder and muxer strings in container metadata that identify the capture device, editing suite or platform transcoder used at each generation.
• Sun azimuth and shadow length in a geolocated frame, which constrain capture time to a window of minutes on a given date.
• Skyline, roofline and antenna arrangement that match satellite and street-level imagery to a specific building footprint.
• Language, dialect and background audio such as sirens, bells or public address announcements indicating region and time of day.
• Rolling shutter distortion and frame rate that reveal whether footage was slowed, sped up or recorded off a screen.
• Burned-in channel watermarks stacked in layers, showing the order of republication across channels and aggregators.
• Vehicle plates, unit markings, road furniture and utility pole design that narrow the country and often the province.
• Weather and vegetation state in frame, tested against historical observations for the claimed location and date.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• InVID / WeVerify plugin — Keyframe extraction, reverse image search across engines and metadata reading directly in the browser.
• ExifTool — Reads container metadata, encoder strings, creation dates and GPS tags from original camera files.
• MediaInfo — Reports codec, bitrate, frame rate, track layout and muxing application for generation analysis.
• FFmpeg and ffprobe — Extracts frames, stream structure, timestamps and audio for independent forensic examination.
• Google Earth Pro — Historical satellite imagery timeline confirming whether structures existed at the claimed date.
• SunCalc — Sun azimuth and elevation for any coordinate and date, used to test shadow-based timing claims.
• Copernicus Browser (Sentinel-2) — Free recent satellite imagery for cloud cover, flooding and terrain change near the claimed date.
• Wayback Machine and archive.today — Snapshots of hosting pages that bound the earliest public appearance of the file.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Preserve the original — Download the highest available rendition, hash it with SHA-256, and record source URL, capture time and collector before any processing.
2. Profile the container — Run ExifTool and MediaInfo to capture encoder strings, timestamps and codec parameters that separate original capture from platform transcode.
3. Establish earliest appearance — Reverse-search extracted keyframes and query archives for prior uploads, then order copies by watermark stacking and quality loss.
4. Geolocate — Identify fixed features such as terrain profile, buildings and signage, and match them against satellite and street imagery until a coordinate is confirmed.
5. Chronolocate — Compare shadow direction and length, vegetation state and weather against solar calculations and historical observations for that coordinate.
6. Pivot to actors — Extract uniforms, insignia, vehicles, plates and equipment, then link to units, operators or businesses through open registries and prior reporting.
7. Publish with confidence levels — Record every match with imagery citations, state an explicit confidence level, and note what remains unverified.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

• Social Media Intelligence — Intelligence from Social Platforms and Networks
• News Intelligence — Media Reporting as an Intelligence Source
• Disinformation Intelligence — Detecting and Analyzing Information Manipulation
• Threat Actor Intelligence — Tracking Adversary Groups Over Time
• Human Intelligence — Information from People, Ethically Obtained

Investigated in these domains

• Extremism & Radicalization
• Conflict & Humanitarian
• Disinformation / IO

Pivots to these data points

• Image / Photograph — A still image — carries EXIF metadata and is the primary artifact for visual verification.

Inside the platform: where Video lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• datapoint.php?dp=dp_video — Data point hub
• domain.php?d=extremism — Extremism & Radicalization dashboard
• domain.php?d=conflict — Conflict & Humanitarian dashboard
• disinformation.php — Disinformation / IO dashboard
• search.php — Advanced search, filter and pivot
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Enrichment Runner
• Enrichment → Local
• Correlate Infrastructure
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Preserve the original is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Establish earliest appearance turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Publish with confidence levels feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Video

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence analysts use video to convert claims into observable fact for intelligence preparation of the environment and force protection. A geolocated frame fixes a coordinate; visible equipment, insignia and vehicle variants feed order of battle and capability assessment; shadow geometry fixes a time window. Product lines include J2 situational updates, battle damage assessment inputs, and route and site studies supporting movement planning. Constraints are strict. Single-source imagery of unknown provenance does not satisfy targeting standards and must be caveated as such. Commercially sourced or publicly available video still attracts handling rules once fused with classified holdings. Record the collection method and the hash so the product survives scrutiny by the legal adviser and the targeting board.

🕵 National intelligence

National intelligence treats video as a collection stream tasked against standing requirements rather than as incidental material. Analysts fuse it with imagery, signals and human reporting to confirm presence, activity and capability at a named location. The discipline is provenance: record the acquisition path, note whether the file is an original, a platform transcode or a re-upload, and carry that judgement into the assessment. Publicly available information retains its origin marking when it enters classified systems, and mixing it with sensitive holdings raises the classification of the resulting product. Dissemination should use analytic confidence language consistent with community standards so consumers can separate observed fact from inference drawn from pixels.

👮 Law enforcement

For law enforcement the question is admissibility, not interest. Seize or download the highest available rendition, hash it on acquisition, log the collector, time and source URL, and work only on a verified copy. Where the original resides with a platform, use a preservation request followed by a production order, warrant or mutual legal assistance request rather than relying on a downloaded copy alone. Geolocation and chronolocation findings should be documented so an independent examiner can reproduce them from the same frames. Video supports charging decisions by placing an offence at a location and time and by identifying vehicles, weapons or participants, but attribution of the person who filmed it requires separate evidence.

🔍 Private investigation and corporate security

Corporate security and private investigators use video in fraud, asset tracing, counterfeit and insider-risk work: confirming that a claimed site exists, that stock was moved, or that a claimant is misrepresenting an injury. Verification standards should match litigation, because a video introduced without provenance is easy for opposing counsel to discredit. A private actor may not intercept communications, install covert cameras on premises they do not control, obtain footage through pretext, or conduct persistent surveillance of an individual without a lawful and documented basis. Buying footage from an unnamed intermediary creates chain-of-custody problems that usually make the material worthless. Keep a written instruction from the client defining scope and purpose.

📰 Journalism and OSINT media

Newsrooms should treat every user-generated clip as unverified until earliest appearance, location and time are independently established. Reverse-search keyframes before investing in geolocation; a recycled clip from an earlier conflict is the most common failure. Contact the uploader where safe, but never expose a source by publishing an account handle, filename or metadata that identifies them. Publish the verification method alongside the claim so readers can audit it, state explicitly what remains unconfirmed, and put findings to named parties for right of reply before publication. Apply graphic-content policy deliberately: blur identifiable bystanders and victims, and do not republish material whose main effect is to spread the perpetrator's message.

🌍 NGO, humanitarian and human rights

Human-rights documenters collect video for accountability, which means preservation standards must anticipate a tribunal years later. Follow the Berkeley Protocol: document the acquisition, hash the file, keep an unaltered master, and record an analysis log separate from the evidence. Work victim-centred. Obtain informed consent where subjects are identifiable and reachable, minimise re-traumatisation by limiting who views graphic material, and rotate staff through review work with clinical support available. Do-no-harm assessment comes before publication: consider whether identifying a location, a witness or a survivor exposes anyone to reprisal. Where footage evidences serious international crime, route it to an established archive or investigative body rather than amplifying it publicly.

🎓 University and research

Researchers using video corpora need an ethics approval that addresses identifiable persons, graphic content and researcher wellbeing before collection starts. Document sampling frames honestly: platform search returns are not representative, and deletion biases any corpus toward material that survived moderation. Reproducibility rests on releasing hashes, metadata and coding schemes rather than the files themselves, since redistribution usually breaches platform terms and may be unlawful for some content. Report inter-coder agreement for any human-coded variable such as location confidence or weapon identification. Cite the archive and the accession identifier, and state clearly which findings derive from the visual record and which from accompanying claims.

Playbook: working Video end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Scope and tasking

Establish what question the video is expected to answer before touching it. A file that supports a location claim, an actor claim and a timing claim demands three different lines of work with different standards of proof. Write the specific question, the confidence level the consumer needs, and the deadline. Identify legal and safeguarding constraints at this point, particularly whether the material may depict minors, victims of serious crime or graphic injury, and set handling rules accordingly. A good output is a one-paragraph tasking note that a reviewer can hold you to later.

Phase 2 — Acquire and preserve

Download the highest available rendition using a method you can describe in writing, and capture the hosting page as well as the media file. Compute SHA-256 for every artefact, record collector identity, system clock time, time zone and source URL, and write these into an evidence log at the moment of collection rather than afterwards. Store an unmodified master read-only and generate a working copy for analysis. Where the material may support prosecution, send a platform preservation request immediately, because retention windows are short and account deletion destroys server-side evidence.

Phase 3 — Container and codec profile

Run ExifTool and MediaInfo over the master and record encoder strings, muxing application, creation and modification atoms, frame rate, bitrate, resolution, colour primaries and track ordering. This establishes generation: a maker-specific atom set indicates an original camera file, while a uniform platform encoder profile indicates a transcode. Note the absence of fields as well as their presence, and state explicitly that stripped metadata is a property of the distribution pipeline rather than evidence of manipulation. The output is a technical profile table that anchors every later provenance claim.

Phase 4 — Earliest appearance

Extract keyframes and reverse-search them across multiple engines, then query web archives and platform search for prior uploads. Order every located copy by resolution, watermark stacking, aspect ratio and compression artefacts to build a distribution tree. The objective is a defensible floor on first publication and, ideally, the original uploader. Stop when additional searching returns only copies already placed in the tree. If an earlier instance predates the claimed event, halt verification and report the recycling finding rather than proceeding to geolocation.

Phase 5 — Geolocation

Identify features that cannot be moved: terrain profile, ridgelines, building footprints, roof furniture, road geometry, utility pole design, signage and vegetation lines. Match against satellite imagery, street-level imagery and open mapping until you have at least three independent coincident features. Record the coordinate, the match features and the imagery dates used. A single distinctive building is a lead, not a confirmation. Good output is an annotated frame beside an annotated satellite view with the matched features numbered, so a reviewer can check the work without repeating the search.

Phase 6 — Chronolocation

Use shadow direction and length against solar azimuth and elevation for the confirmed coordinate to bound capture time. Corroborate with weather observations, snow or flood extent, vegetation state, construction progress visible in historical satellite imagery, and any visible clock, signage or event. State the result as a window with an explicit confidence level rather than a point in time. Where the video shows only interior scenes or overcast conditions, say that chronolocation is not possible from the imagery and rely on provenance and archive timestamps instead.

Phase 7 — Content exploitation

Systematically extract identifiable content: uniforms, insignia, weapon and vehicle variants, licence plates, unit markings, company logos, phone numbers and spoken language or dialect. Transcribe and translate audio, noting background sound such as sirens, calls to prayer, public address announcements or aircraft. Each extracted item becomes a separate pivot with its own confidence rating. Keep identification of equipment separate from attribution of the operator: seeing a vehicle type establishes presence of a type, not the identity of the unit operating it.

Phase 8 — Manipulation and synthesis assessment

Test physical consistency rather than hunting compression artefacts. Check that shadows agree with a single light source, that reflections and perspective are coherent, that audio and lip movement align, and that frame timing is uniform where it should be. Look for splice points at scene changes and for duplicated frames indicating loops. Check for C2PA or other content credentials if present. Conclude with a statement of what the evidence supports, and be explicit that inability to detect manipulation is not proof of authenticity.

Phase 9 — Corroboration and fusion

Attach the video to an event record and test it against independent artefacts: other videos of the same scene from different angles, satellite imagery for the date, flight or vessel tracks, official statements, and contemporaneous reporting. Multiple clips of one incident are the strongest form of corroboration because they can be cross-referenced spatially. Note contradictions rather than discarding them. The output is an event entry that lists every supporting and conflicting source with its own provenance line.

Phase 10 — Reporting and confidence

Write the finding as a claim, the evidence for it, and an explicit confidence level with the reasoning for that level. Separate observation from inference in the text itself. Include the frame references, coordinates, imagery dates and hashes so the work is reproducible. State what was tested and failed to confirm, not only what succeeded. Where the material is graphic or identifies vulnerable people, apply the publication policy agreed in the scoping phase and record the decision and who made it.

Phase 11 — Archive and handover

Deposit master files, hashes, analysis logs and the final product into a managed archive with access control and retention rules. Where the material may evidence serious crime, hand it to the appropriate authority or an established accountability archive with a written transfer record, and note what you retained and why. Purge working copies from analyst endpoints. Schedule a review date for retention, since holding graphic or personal material indefinitely without a stated purpose is difficult to justify under any data-protection regime.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
Berkeley Protocol on Digital Open Source Investigations	Open	International standard for collecting, preserving and analysing open source digital information for legal accountability.	Defines the preservation, hashing, logging and analysis workflow that makes video usable by a tribunal.
Human Rights Center, UC Berkeley	Open	Research centre that co-authored the Berkeley Protocol and publishes open source investigation methodology.	Source of training material and case studies on video verification for accountability work.
InVID and WeVerify verification plugin	Open	Browser toolkit for keyframe extraction, multi-engine reverse search, magnification and metadata reading.	First-pass triage for earliest appearance and obvious recycling before deeper analysis is committed.
ExifTool	Open	Reads and writes metadata across image, video and container formats including maker-specific atoms.	Extracts encoder strings, creation atoms and GPS tags that separate original capture from platform transcode.
MediaInfo	Open	Reports container structure, codec parameters, bitrate, frame rate and muxing application for media files.	Builds the generation profile used to order copies within a distribution tree.
FFmpeg and ffprobe	Open	Command line toolchain for decoding, transcoding, frame extraction and stream inspection.	Extracts keyframes, timestamps and audio tracks for independent examination without altering the master.
Copernicus Data Space Ecosystem	Registration	Free Sentinel optical and radar imagery archive with a browser interface and download API.	Confirms cloud cover, flooding, fire scars and terrain change near the claimed capture date.
OpenStreetMap	Open	Open global map database covering roads, buildings, land use and street furniture.	Supplies building footprints and road geometry for matching fixed features in a frame.
SunCalc	Open	Solar position calculator giving azimuth and elevation for any coordinate, date and time.	Converts shadow direction and length in a geolocated frame into a capture time window.
Internet Archive Wayback Machine (archived)	Open	Archive of web pages and embedded media captured over three decades.	Establishes that a hosting page and its embedded video existed before a given date.
archive.today	Open	On-demand page snapshot service that captures rendered pages including dynamic content.	Preserves social posts and hosting pages that platforms delete during or after an incident.
C2PA content credentials specification	Open	Open standard for cryptographically bound provenance manifests attached to media files.	Checks whether a file carries verifiable capture and edit history, and validates the signing chain.
Bellingcat open source investigation guides	Open	Published casework and methodology on geolocation, chronolocation and video verification.	Reference technique library and worked examples for training and for justifying method choices.
Global Investigative Journalism Network resource centre	Open	Curated tool and technique guides for investigative reporters across many languages.	Keeps the verification toolset current as platforms and reverse-search engines change behaviour.
Syrian Archive and Mnemonic	Open	Archives that preserve and verify conflict video for accountability, with published verification methodology.	Model for long-term preservation practice and a route for handing over conflict footage.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Video. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• ExifTool — Definitive metadata reader across containers and maker notes. Limitation: platform transcodes strip almost everything, so absence of fields is common and uninformative.
• MediaInfo — Fast container and codec profiling for generation analysis. Limitation: reports what the muxer wrote, which a determined editor can rewrite entirely.
• FFmpeg and ffprobe — Frame extraction, stream inspection and lossless remuxing. Limitation: careless invocation re-encodes and destroys the artefacts you were trying to measure.
• InVID and WeVerify plugin — Browser-based keyframe extraction and multi-engine reverse search. Limitation: reverse search coverage of video frames remains poor outside major platforms.
• Google Earth Pro with historical imagery — Timeline of satellite imagery for testing whether structures existed at a claimed date. Limitation: revisit intervals in rural areas can span years.
• Copernicus Browser — Free recent Sentinel imagery for weather, flooding and terrain corroboration. Limitation: ten metre resolution cannot resolve individual buildings or vehicles.
• SunCalc and equivalent solar calculators — Shadow-based timing for any coordinate and date. Limitation: requires an accurate geolocation first and fails entirely under overcast or indoor conditions.
• Hashing and evidence logging tooling — SHA-256 hashing with structured capture of URL, collector and time. Limitation: only as good as the discipline applied at the moment of collection.
• Whisper-class speech recognition — Transcribes and translates audio tracks to surface place names, dialects and commands. Limitation: hallucinates on noisy or overlapping speech and needs human review.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Establish earliest appearance before geolocating. Analysts routinely spend a day fixing a coordinate for a clip that turns out to be four years old and from another country, which the reverse search would have shown in ten minutes.
• Three independent coincident features is the working threshold for a confirmed geolocation. One distinctive minaret or billboard is a lead. Publishing on a single feature is how competent teams get corrected in public.
• Treat metadata absence as a property of the pipeline, never as a signal of manipulation. Every major platform strips and re-muxes on upload, so a clean original and a doctored file can look identical after distribution.
• Mirrored uploads defeat reverse image search and invert shadow logic simultaneously. Always run both orientations, and check whether text in frame reads correctly before trusting any solar calculation.
• Multiple clips of one incident from different angles are worth more than any single-file forensic technique, because they can be cross-referenced spatially and cannot be jointly fabricated cheaply.
• Separate the identification of equipment from the attribution of the operator. Recognising a vehicle variant tells you a type was present. It says nothing about which unit was driving it or under whose orders.
• Write the analysis log as you go, not afterwards. A reconstructed log is visibly reconstructed, and in accountability work an examiner will ask when each observation was made and by whom.
• Record what you tested and could not confirm. Products that only list successful matches invite the assumption that everything else was checked and passed, which is rarely true.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Video is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of published video claims that survive independent re-verification by a second analyst without changes to the coordinate or time window.
• Median time from acquisition to hashed preservation, which should be minutes rather than hours given typical platform deletion rates.
• Share of investigations where recycled or misattributed footage was identified before geolocation effort was committed.
• Corrections issued per hundred published video-derived findings, tracked over time and by analyst.
• Percentage of archived items with complete provenance records: hash, source URL, collector, collection time and method.
• Number of items successfully handed to accountability bodies or law enforcement in a form they accepted without rework.
• Reduction in analyst exposure hours to graphic material through triage automation and rotation, measured alongside wellbeing check-ins.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Platform transcoding strips original metadata; a missing GPS tag says nothing about authenticity, only about the pipeline the file passed through.
• Recycled footage from earlier conflicts or disasters is the most common failure mode; verify earliest appearance before investing in geolocation.
• Mirrored or flipped video defeats reverse image search and reverses shadow logic, so always test both orientations.
• File creation timestamps usually reflect download or export rather than capture, and are trivially edited.
• Synthetic and generated video no longer fails naive visual checks; rely on provenance and physical consistency, not artefact hunting.
• A geolocated frame proves where, not who filmed it or why; attribution always requires separate corroboration.

Legal and ethical considerations

Handle video under a documented lawful basis, particularly where it depicts identifiable individuals, minors or serious injury. Preserve originals with hashes and an unbroken chain of custody, and work only on copies. Respect platform terms when downloading, and do not republish graphic or exploitative material simply because it is public. Where footage may evidence serious crime, route it to the appropriate authority or an established archive rather than amplifying it, and minimise the personal data you retain.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Video, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 5 intelligence disciplines, 3 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

The video has no GPS metadata. Does that mean it was faked?

No. Every mainstream platform transcodes uploads and strips container metadata as a matter of routine, so the overwhelming majority of circulating video carries no location tags regardless of authenticity. Metadata absence tells you the file passed through a distribution pipeline, nothing more. Conversely, present GPS tags are not proof either, because they can be written by any editor. Base location findings on visible fixed features matched against independent imagery, and base timing on solar geometry and corroborating observations. Use metadata to establish generation and pipeline, not to adjudicate authenticity.

How do I handle footage that may show a war crime?

Preserve first and analyse second. Download the highest rendition, hash it, log the acquisition, and store an unaltered master with restricted access. Follow the Berkeley Protocol for the analysis log and chain of custody. Do not publish graphic material to make a point; assess whether identifying the location, the filmer or surviving witnesses could expose anyone to reprisal. Route the material to a competent authority, a national war crimes unit or an established accountability archive with a written transfer record. Limit who on your team views the material and provide clinical support, because vicarious trauma is a real occupational hazard.

Can current tools reliably detect AI-generated video?

Not reliably enough to base a publication decision on. Detector performance degrades sharply on compressed, re-uploaded and short clips, and generators improve faster than detectors. Treat detector output as one weak signal among many. The durable approach is provenance and physical consistency: establish where the file first appeared and who published it, check that shadows agree with a single light source, that reflections and perspective are coherent, and that audio matches articulation. Where content credentials under C2PA are present and the signing chain validates, that is stronger evidence than any statistical detector.

What is the difference between an original and a platform copy, and why does it matter?

An original camera file carries maker-specific atoms, full sensor metadata and the device encoder signature. A platform copy has been transcoded to a uniform profile, re-muxed, often resized, and stripped of metadata. The distinction matters because only an original supports device-level claims, and because generation order lets you build a distribution tree and identify the earliest publisher. Practically, if you can reach the uploader lawfully and safely, requesting the original file is the single highest-value step available. If not, work from the best rendition you can obtain and label it accurately as a platform copy.

How precise can chronolocation actually get?

With a confirmed coordinate, clear ground shadows and a visible vertical reference, a window of roughly fifteen to thirty minutes on a known date is achievable. Without a shadow reference you are usually limited to a part of day. Corroborating evidence tightens this: weather observations, snow line, flood extent, construction progress in satellite imagery, and visible events such as a broadcast on a screen. Always report a window rather than a point, state the inputs, and be explicit that solar geometry gives time of day, while date usually comes from independent corroboration rather than from the imagery itself.

Is downloading video from a platform lawful for investigators?

It depends on jurisdiction, purpose and the platform's terms. Terms of service are contractual rather than criminal in most places, but breaching them can end your access and can be raised in litigation. Law enforcement should use preservation requests and production orders for anything intended as evidence rather than relying on a scraped copy. Human rights and journalistic collection generally proceeds on public-interest grounds with a documented lawful basis and minimisation. What is not defensible anywhere is accessing private accounts, using deceptive profiles to obtain restricted content, or retaining illegal imagery.

How should we store graphic video safely?

Encrypt at rest, restrict access by named role rather than by team, and log every access. Keep the master immutable and separate from working copies. Apply a retention schedule with a review date and a documented purpose for continued holding. Blur or clip derived versions used for wider circulation so most staff never see the raw material. For material depicting minors in exploitative contexts, do not retain at all: report to the designated national body and follow their instruction, because possession is a criminal matter regardless of investigative intent.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• Berkeley Protocol on Digital Open Source Investigations, which sets the international methodology for collection, preservation, verification and analysis of open source media for legal accountability.
• ISO/IEC 27037, governing identification, collection, acquisition and preservation of digital evidence including the requirement to work on verified copies.
• ISO/IEC 27041 and 27042, covering assurance of investigative method and the analysis and interpretation of digital evidence.
• C2PA content credentials specification, defining cryptographically signed provenance manifests for capture, edit and publication history of media.
• SWGDE best practice guidelines for digital and video evidence, widely relied on in United States forensic testimony.
• Do No Harm principles as applied in humanitarian and human rights documentation, governing publication decisions where subjects face reprisal risk.
• ICD 203 analytic standards, requiring explicit confidence expression, source characterisation and separation of observation from judgement in intelligence products.
• Editors' codes and broadcast regulation on graphic content and right of reply, which govern publication of violent or identifying footage.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. Berkeley Protocol on Digital Open Source Investigations — UN Office of the High Commissioner for Human Rights and UC Berkeley Human Rights Center. The reference methodology for open source digital evidence in accountability proceedings.
2. Human Rights Center digital investigations programme — University of California, Berkeley. Research and training on open source video verification for legal accountability.
3. C2PA specification — Coalition for Content Provenance and Authenticity. Open technical standard for tamper-evident media provenance manifests.
4. ExifTool documentation — Phil Harvey. Reference for metadata tags across image and video container formats.
5. MediaInfo — MediaArea. Open tool and documentation for container and codec parameter reporting.
6. Copernicus Data Space Ecosystem — European Space Agency and European Commission. Free Sentinel satellite imagery archive used for corroborating scene conditions.
7. Bellingcat investigation methodology — Bellingcat. Published casework demonstrating geolocation and chronolocation technique.
8. Mnemonic archives — Mnemonic. Preservation and verification of conflict-related video for accountability use.
9. Wayback Machine — Internet Archive. Web archive used to establish earliest public appearance of hosting pages and media. (archived copy — the publisher moved or withdrew the original)
10. Scientific Working Group on Digital Evidence publications — SWGDE. Best practice documents for handling, examining and testifying to digital and video evidence.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: ingests, hashes and enriches video artifacts, linking frames to geolocation, incidents and earlier appearances. Explore the platform, or browse the rest of the library by following any tag above.