Sources & coverage
What we collect, and what we leave alone.
Coverage claims are easy to inflate and hard to check. This page sets out the kinds of source our analysts work with, the languages they read them in, the regions our desks cover and the categories of information we will not touch, however useful they might be.
Source families
Eight families of source, one rule for all of them.
We organize coverage by category and not by named service, because the places that matter change constantly. The rule does not change: publicly available or lawfully obtained information only.
Social and community platforms
Where people speak in public, and where most threats, campaigns and scams first become visible.
- Public posts, profiles and video
- Forums and imageboards
- Public messaging channels and groups
- Review, marketplace and classified sites
Corporate and legal records
The paper trail that ownership, disputes and insolvency leave behind, read in the original language.
- Company registries and filings in 140+ jurisdictions
- Court dockets, judgments and insolvency records
- Property and land records
- Procurement awards, grants and official gazettes
Trade and movement
Records of what moved, from where, to whom and by which route.
- Shipment and customs records
- Vessel positions and port calls
- Aircraft positions and registrations
- Product certifications and registrations
Internet infrastructure
The technical records that tie websites to each other and, sometimes, to the people who built them.
- Domain registration history and passive DNS
- Certificate transparency logs
- Hosting, tracking and advertising identifiers
- Web archives and app stores
Financial traces
Public records of money and of the people who are restricted from moving it.
- Public blockchains
- Sanctions and watch lists
- Regulatory registers and enforcement actions
- Published accounts and securities filings
Closed and criminal spaces
Observed through non-attributable infrastructure. We watch and preserve. We never buy, sell or take part.
- Onion services and markets
- Leak and extortion sites
- Paste sites and breach indexes
- Closed forums that admit observers
Imagery and sensors
Sources that show what happened without relying on anyone's account of it.
- Commercial satellite imagery
- Street-level and user-published imagery
- Fire detections and weather records
- Network connectivity measurements
News, academic and official
Published reporting and records, weighed for what each outlet and institution has got right before.
- News and broadcast in 41 languages
- Academic, patent and grant records
- Job boards and recruitment advertising
- Government statements and notices
Languages
41 working languages, each with a second reader.
A working language is one in which we have at least two native or near-native analysts. That is the minimum needed for a cited translation to be checked by someone who did not write it, and for slang, dialect and coded terms to be read as their authors meant them.
Machine translation is used to help analysts find relevant material faster. Anything cited in a report is translated by a native speaker, and the original text is preserved beside the translation in the evidence annex.
Regional desks
Six desks that know the places they cover.
Each desk combines country analysts, language specialists and a geospatial analyst. They write the baseline assessments, verify events against client footprints and support investigations that reach into their region.
Americas
Organized crime and extortion risk, election cycles, regulatory change and the registries and court systems of North, Central and South America.
Europe
Sanctions and trade controls, corporate ownership across many registries, protest movements and cross-border fraud.
Middle East and North Africa
Conflict monitoring, maritime routes, state-linked companies and the verification of imagery from fast-moving events.
Sub-Saharan Africa
Site and route security for extractive and infrastructure projects, political transitions and local-language broadcast monitoring.
South and Central Asia
Recruitment and labor networks, corporate groups with opaque ownership, unrest and connectivity shutdowns.
East Asia and Pacific
Manufacturing supply chains, trade data, technology transfer risk and regulatory notices read in the original.
What we leave alone
Useful is not the same as permitted.
Some information would make our work easier and our findings faster. We do not collect it, because how evidence was obtained decides whether anyone can rely on it.
These limits apply to every engagement and every client. They are enforced by our standards committee, and a client cannot instruct us to cross them.
Not in our coverage
- Private accounts, private messages and anything behind a login we were not given
- Stolen data offered for sale. We observe the listing and never buy the contents
- Information obtained by intrusion, interception or bribery
- Anything that requires deceiving a person into providing it
- Bulk personal data about people who are not relevant to the question
- Health, beliefs and other protected information, unless directly relevant and lawful to process
Source governance
How a source earns its place.
A source category is added only after it has passed four checks, and it is removed when it stops passing them. In the past twelve months we added 96 categories and retired 41.
-
01 / Propose
An analyst makes the case
What the source contains, which questions it would help answer and what it adds beyond the sources we already hold.
-
02 / Review
Legal and ethics review
Whether access is lawful in the places we work, what terms apply and whether collection could harm people who are not subjects.
-
03 / Grade
A reliability baseline
The source is tested against known facts and given a starting reliability grade, which every later use can raise or lower.
-
04 / Re-check
Quarterly review
Sources that have changed their terms, degraded in quality or stopped being lawful to access are retired.
From coverage to answers
Which sources answer which question.
Coverage is not an answer. An answer comes from reading several kinds of source against each other. These are the combinations we reach for most often.
| The question | Sources that usually answer it | Where to read more |
|---|---|---|
| Who really owns this company? | Registries, court and insolvency records, gazettes, property records | Seeing through nominee directors |
| Who operates these websites? | Registration history, certificates, passive DNS, tracking identifiers, web archives | One tag, 212 domains |
| Are these accounts one operation? | Creation dates, posting schedules, image reuse, shared infrastructure | Seven signals |
| Is this breach claim real? | Leak sites, breach indexes, file metadata, seller history, public ledgers | Verify before you panic |
| Who supplies this factory? | Shipment records, certifications, tenders, registries, local press | Past tier one |
| Where and when was this filmed? | Satellite and street-level imagery, weather records, shadows, broadcast archives | Verified, not viral |
| Is this candidate who they say? | Registries, credential registers, code and publication history, web archives | The candidate who is not there |
Start an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.