Measured, reported, counted once: how events are counted

Three kinds of evidence

Everything on Boring News comes from one of three kinds of source, and the site keeps them apart.

• Measured: records made by instruments or automated monitoring. Earthquakes come from the US Geological Survey catalogue, which collects readings from seismic networks around the world^[1]. Storms, floods, eruptions and fires come from NASA's Earth Observatory Natural Event Tracker, known as EONET^[2]. Internet outages come from Cloudflare Radar, which watches traffic across its network^[3].
• Official: lists and statistics published by public institutions, such as central bank exchange rates or the US Cybersecurity and Infrastructure Security Agency's catalogue of software flaws known to be used in attacks^[4].
• Reported: news articles found through the GDELT Project, which monitors print, broadcast and online news in more than 100 languages^[5].

On the events list, measured events carry the tag “Measured”. Events that come from news reports carry the tag “Reported, unconfirmed”.

The list and the indexes do not use identical filters. The events list shows earthquakes of magnitude 5.5 and above from the past seven days, while the React index counts only those of magnitude 6 and above. The list is there to show what happened; the index counts a fixed, comparable measure.

Why a seismometer outranks a headline

A seismometer records ground motion whether or not anyone writes about it. A headline records that a newsroom decided a story was worth writing. Both are useful, but they answer different questions. How many articles an event produces depends on where it happened, which languages the local press writes in, what else is in the news that day and how many outlets reprint the same agency copy.

That is why the site ranks its evidence. Instruments and official statistics are trusted in full. Indicators built from news reports count at 60% when the site works out how reliable an index is, as explained in How to read a 0 to 100 reading.

Measured does not mean perfect. Entries in the USGS catalogue are versioned, a preferred version is chosen, and the catalogue keeps a list of deleted events^[1], so a magnitude can change in the hours after it first appears. NASA says EONET should not be treated as an official source for precise locations or times^[2]. Cloudflare describes the outages in its Outage Center as notable drops in traffic that have generally been corroborated with third-party information, such as an operator's status page^[3]. The label says how the evidence was gathered. It does not say the evidence cannot be wrong.

What “Reported, unconfirmed” means

Reported events come from news articles. On the events list, they are stories from the past 24 hours on topics GDELT tags as high impact, such as armed conflict, that enough different websites in enough countries carried, as set out below. The Be Safe index also counts reports for each edition's area, such as GPS jamming, drones and damage to undersea cables, but those are counted in the index, not listed as events.

“Unconfirmed” means Boring News has not checked the claim against an instrument or an official record. It does not mean the report is doubtful; many will be accurate. It means the evidence is a headline, and the site shows whose headline it is. Each reported event links to the outlets that carried it, so you can read them and judge. The title shown is the headline most of the outlets in the group used. The site does not copy article text.

How headlines are grouped into one event

A single incident can produce dozens of articles. To list it once, headlines are grouped by their wording and timing. These are the rules the code follows:

• Each headline is reduced to its meaningful words. It is put in lower case, punctuation is removed, words of one or two letters are dropped, and common filler words such as “the”, “says”, “after”, “reports”, “live” and “video” are dropped. A final “s” is removed from words longer than four letters, so “flights” and “flight” match.
• A headline with fewer than two meaningful words left is set aside.
• Only the past 24 hours are grouped. A headline joins an existing group when it shares at least two meaningful words with the headline that started the group, and those make up at least half of the shorter of the two word lists.
• A headline is always compared with the group's first headline, so a group does not drift to a different story as it grows.
• The same web address is counted once, and several articles on one website count as one outlet.
• A reported story is listed only when it passes the bar described below.

Two examples. “Drone spotted over Riga airport, flights delayed” becomes drone, spotted, riga, airport, flight, delayed. “Riga airport flights delayed after drone sighting” becomes riga, airport, flight, delayed, drone, sighting. Five of six words are shared, so they are one event.

“Estonia reports GPS interference near Narva” and “Latvia reports GPS interference over Baltic Sea” share only gps and interference, two words out of five. That is 40%, below the threshold, so they stay separate. Here that is right, because they describe different places. The same rule would also split one story told by two outlets in different words.

Where grouping applies and where it doesn't

Grouping applies only to lists of events: the events list and “What matters today” on the home page. It does not apply to index scores.

The news-based indicators in the indexes (armed conflict reports, sanctions and trade reports, hybrid incident reports and cyber attack reports) count articles, not events. GDELT publishes a list of the English-language articles it has seen every 15 minutes, 96 lists a day^[9]. Every two hours the site reads the new lists and counts, for each indicator, the articles whose headline matches its search words. Each day's value is the number of matching headlines per list read that day, times 96: an estimate for the whole day, even when some lists could not be read. The current day (UTC) is left out until it is complete. The seven-day total of that value is what gets ranked, counted only once seven full days are in.

• One widely syndicated story can raise an indicator as much as several separate incidents.
• Headlines that use the search words in passing count too. The hybrid search for the Baltic states looks for words such as “drone” alongside a place name, so a headline about drone deliveries in Latvia counts. An article whose headline does not use the words is not counted, whatever its text says.
• The counts are English-language only, in every edition. GDELT keeps a separate list of articles it has translated from other languages, and the site does not read it yet.
• The counts began when this method started, with four lists a day (at 00:00, 06:00, 12:00 and 18:00 UTC) filled in for the last 30 days, so news-based indicators are ranked against a shorter history than the others for now.

What reaches the home page

The events list shows everything the sources report. The home page shows only events of global weight from the past 24 hours, under “What matters today”. A magnitude 5 earthquake far from anyone stays on the events list. Most days nothing passes, and the home page says: “Nothing of global weight in the last 24 hours. That is the usual state.” It says that only when a recent copy of GDELT's lists could be read, covering at least 72 of the 96 lists of the past 24 hours. If not, it says world news reach couldn't be checked, and shows measured events as usual. The daily email does the same.

• An earthquake counts when its magnitude is 7.5 or more, or when the USGS PAGER system, which estimates deaths and economic losses after significant earthquakes^[7], gives it an orange or red alert. Both come from the USGS real-time feed of the past day^[8]. USGS's “significant” list is based on a significance score that a strong earthquake far from anyone can reach, so it is not used on its own here.
• A news story counts when at least 40 different websites, in at least 8 different countries, carried it in the past 24 hours. A website's www and non-www addresses count once, and several copies on one website count once. The country of a website comes from GDELT's list of news outlets by country^[6]; a website not on that list adds no country.
• Measured events come first, strongest first, then news stories by how many websites carried them. At most 5 are shown.

News stories are counted from GDELT's own article lists, not from searches.

• Every two hours, the site reads GDELT's new 15-minute lists of English-language articles^[9]. It keeps the articles GDELT tags with war and armed conflict, natural disasters, stock markets, epidemics, cyber attacks, power cuts, elections, impeachment, sanctions or terrorism.
• The articles from the past 24 hours are grouped into stories by their headlines, using the rules above.
• For each story, the site counts the different websites that carried it and the countries of those websites. Only these counts go through the bar. The home page keeps the 30 stories carried by the most websites, and shows up to ten of each story's websites with their own headlines and links.
• Each list is read once and kept for 24 hours, so a story's counts cover the whole day, not a sample of it.

The bar is hard to reach on purpose. The method has limits: two different stories with similar headlines can be counted as one, which can push them over the bar; only English-language articles are read; and an agency story reprinted by differently named websites counts once per website.

When it happened versus when it was reported

The events list files each event under the day it happened when the source says, and otherwise under the day it was first reported. The index counts use the same dates. All times are in UTC.

• Earthquakes: the origin time in the USGS catalogue.
• Natural events: the date of the first position recorded for the event in EONET. NASA notes that these times are usually midnight UTC unless the original source gave a specific time^[2], so the hour shown is often not meaningful.
• Internet outages: the start of the outage as recorded by Cloudflare Radar.
• Exploited software flaws: the date CISA added the flaw to its catalogue. A flaw is added once there is reliable evidence it is being exploited and clear guidance on fixing it^[4]. Attacks may have started weeks or months earlier. These feed the Be Safe index only and do not appear on the events list.
• News reports: when GDELT last saw an article in the group, so a story stays on the list while it is still being reported. This is report time. The event itself may have happened earlier.

Where a source gives both times and they are more than six hours apart, the events list shows both. None of the current measured sources gives a separate report time, so in practice each entry shows one time.

Known errors

Automatic counting makes mistakes. These are the ones to expect.

• Two incidents merged. “Drone sighting closes Vilnius airport” and “Vilnius airport reopens after drone sighting” share four of five meaningful words and become one entry. That is usually right. Two separate sightings at the same airport a day apart would be merged as well.
• One incident split. Headlines that use different words share too few words to match, so one event can appear as two entries.
• Missing articles. Only English-language articles are read, and only those GDELT tags with one of the topics above. GDELT sometimes publishes a list late; it is read on a later run. If the schedule stops for more than five hours, or fewer than 72 of the past 24 hours' 96 lists have been read (after a long gap, for example), the home page says world news couldn't be checked, and the events list shows no reported events until it runs again. Reported events cover only the past 24 hours.
• Wrong-sense matches. Search terms do not understand context. An article about a football club facing sanctions matches the word “sanctions”.
• Revisions. Earthquake magnitudes and outage records can change after they are first listed.
• Gaps. If a source does not answer, its events are missing for that time. Internet outages need a Cloudflare access key and are absent without one.

For how these counts become index scores, see How it works. For the licence and owner of each source, see Sources.