Methodology (public, v0.1 draft)

This page explains how the observatory collects, verifies, classifies, and publishes. It is published so that anyone can check our work. It changes only by dated revision.

1. What we monitor

• Public platforms: X, TikTok (public), Facebook pages and public groups, YouTube, Telegram channels, public WhatsApp channels.
• Broadcast: selected national and regional radio, monitored by trained listeners with logged timestamps.
• Tip line: a Telegram tip line for the public and journalists. Tips are evidence leads, never published without verification.
• Official sources: IEBC, Communications Authority, ODPC, NCIC, courts, party and candidate official channels.

We do not monitor private conversations, closed groups we were not invited into as observers, or any data obtained by deception or unauthorised access.

2. Languages

English, Kiswahili, and Sheng. Every item records its language(s), including mixed-language content. Translations used in outputs are reviewed by a native speaker.

3. Evidence handling

• Every item is archived at capture: screenshot, page archive where possible, URL, timestamp (EAT), capturing analyst. Files are hashed (SHA-256) and stored with restricted access.
• Personal data is minimised. We record account handles only when necessary for coordination analysis; we do not profile private individuals.
• Retention: raw captures 12 months after the post-election report, then deleted unless subject to legal hold. A Data Protection Impact Assessment is on file with the ODPC registration.

4. Classification

Each item is tagged for: topic, language, county or region, platform, format (text, image, video, audio), and one or more of:

• Misinformation (false or misleading, no evident intent)
• Disinformation (false or misleading with evident intent or coordination)
• Coordinated inauthentic behaviour (see §5)
• Synthetic media (see §6)
• Hate speech or incitement (per NCIC guidance and the Constitution; human review mandatory)
• Legitimate political speech (recorded to measure baselines; never flagged publicly)

Automated triage (local language models) proposes tags. No public output rests on an automated tag alone. Every published item has passed two human reviewers with disagreement adjudicated by a third (the CivicCore double-review process).

5. Coordination signals

We look for combinations of: near-duplicate text across accounts (embedding similarity), synchronised posting cadence, hashtag co-occurrence patterns, account-creation bursts, fixed batch sizes, shared media hashes, and cross-platform seeding within short windows. Coordination is reported only when at least three independent signals co-occur, and it is described as “coordinated” without asserting who is behind it unless §7 applies.

6. Synthetic media

We assess provenance (original source, earliest appearance), reverse image and video search, audio and visual artefact review, and detector outputs. Detector outputs are a signal, not proof. We report “likely synthetic”, “inconclusive”, or “authentic per available evidence”, and we say which checks were run.

7. Attribution

Attribution follows threat-intelligence practice: infrastructure, behaviour, content, and timing evidence, with a stated confidence:

• Low: consistent with, but alternative explanations remain
• Medium: multiple independent lines of evidence, some alternatives excluded
• High: convergent evidence with alternatives excluded or a credible admission We never attribute to a named individual or organisation at low confidence in public. Legal review precedes any public attribution at medium or above.

8. Publishing

• Daily brief (subscribers, 07:00 EAT): verification status on every item: verified false, verified true, unverified, coordinated activity observed, likely synthetic.
• Weekly public digest: a selection of the above with methodology notes, on the site and mirrored to a public Telegram channel.
• Investigations: full method section, evidence appendix (defanged), confidence statement, right-of-reply record.
• Right of reply: any named organisation receives the finding and 48 hours to respond before publication, except where doing so would enable destruction of evidence, in which case the response is appended after.

9. Corrections

Errors are corrected in place with a dated note and listed on a corrections page. Material errors are announced through the same channels as the original.

10. Independence

Funding sources are published. No campaign, party, or candidate may fund or direct the observatory. Staff and volunteers sign a conflict-of-interest declaration. A review board of two journalists and one academic reviews methodology and a sample of outputs quarterly and publishes its notes. See the charter.

11. Limitations

Platform data access varies and can change without notice; coverage is not census-level; radio monitoring depends on volunteer capacity; detectors have known error rates on African languages and low-resource media. We state these limits in every output.