UK incident monitoring methodology

Purpose

UK Flashpoint is an independent monitoring tool for significant incidents, disruption and national resilience in the United Kingdom. It is designed to make sourced reports easier to follow. It is not an emergency service, an official government record or a claim of comprehensive UK coverage. See current source coverage and limitations.

How incident discovery works

In normal full-discovery mode, scheduled core incident discovery uses GDELT event data. A bounded Bing News RSS safety net searches selected high-significance topics that can be missed by the core feed. Configured police, Fire and Rescue Service, government, transport, union and organiser sources are polled through separate source-specific lanes.

These discovery routes are complementary. A source being reachable, an article appearing in a search feed or an event appearing on an organiser calendar is not enough to create a public incident. Organiser calendars and other future-event listings are treated as leads only: planned-event leads cannot directly enter incident or social publication.

Source hierarchy

We prefer first-party and official evidence from police, Fire and Rescue Services, government bodies, transport authorities and other responsible organisations. Reputable news reporting can discover or corroborate events. Configured third-party livestream metadata can provide situational-awareness leads but is not incident evidence by itself.

An official police or Fire and Rescue Service feed may itself provide sufficient evidence when it contains a stable record identity, a valid publication timestamp, an explicit UK location and a concrete current event. Access to a linked article is treated as additional enrichment rather than an absolute requirement. Where only limited official-feed details are available, the public record is written conservatively and missing facts are not inferred.

Validation and Workers AI

Deterministic checks run before AI validation. They reject unsupported locations, retrospective or court-only reports, routine low-significance material, foreign events presented as UK events and other candidates that do not satisfy the incident policy.

Candidates from ambiguous discovery routes, including Bing safety-net records and some GDELT records, can then pass through constrained Workers AI semantic validation. The model receives bounded source evidence and must return a strict structured decision consistent with supported facts. It cannot override deterministic location, timing, canonical-event or factual-consistency rules.

Low-confidence decisions, manual-review decisions, malformed responses, schema mismatches and model failures are quarantined rather than published. Structured official incidents with sufficiently strong deterministic evidence can bypass AI validation. AI is therefore a validation layer, not a source of incident facts.

Incident inclusion

The incident dashboard includes events judged significant enough for national or regional situational awareness. Routine crime reports, weak mentions, commentary, ordinary service disruption and a livestream simply being online are not enough. Candidate evidence passes through relevance, event, location, severity, duplication and promotion checks before publication.

Public records remain visible for 30 days from their best supported occurrence or start time. Retracted records are hidden. Publication or creation time is used only as a fallback where an occurrence time is unavailable.

Canonical events and deduplication

Multiple reports about one real-world event should become one canonical incident. Source URLs and candidate records are retained as provenance while matching uses stable source identity, time, place, event facts and existing canonical relationships to prevent duplicate public entries.

Later reporting can add evidence, correct facts or update a canonical incident without creating a second event. Updates do not extend the incident's 30-day visibility window. Where evidence shows that a public record is false, duplicated or no longer valid as a separate incident, it can be retracted or consolidated rather than silently left in the feed.

Time fields

Occurred is the best known event or start time. Published is when a source first published its report. Updated records the latest material change to the incident record. Sources may report an event late, so these times can differ.

Severity and motive

Severity is based on documented harm, scale and immediate significance, not the amount of attention an event receives. Motive is recorded only where evidence supports cautious wording; unknown or disputed motives remain unknown. Classifications may change when better evidence becomes available.

Public incident categories

The primary public categories are Protest, Disorder, Violence, Fire and Emergency. The category describes the main incident rather than every secondary development within it. Protest covers demonstrations, marches, rallies, vigils and pickets where protest remains the main event. Disorder covers significant public-order disorder or disruption where that becomes the main incident. Violence covers incidents principally defined by serious physical violence. Fire covers qualifying major fires and wildfires. Emergency covers other qualifying major emergencies such as explosions, major transport accidents and critical-infrastructure incidents. The underlying event type remains more specific. Political motive suspected is presented as a secondary marker where supported by evidence.

Location and map coverage

A city, locality, region and coordinates are recorded only when the evidence supports them. An incident without confirmed coordinates remains in the timeline but not on the map. Some reports identify only a broad area, so city and map coverage is deliberately incomplete rather than filled with guesses.

Freshness and source health

Core incident discovery is scheduled every 15 minutes. The incident dashboard reports the health and latest successful completion of the core discovery path rather than pretending that every configured source is always available.

In normal full-discovery mode, the public discovery-health badge follows the core GDELT discovery lane. Bing safety-net, organiser and other optional-source failures remain operationally visible but do not by themselves make the public incident feed appear degraded. LAST COMPLETE refers to the latest successful core discovery completion. If the enabled core path becomes stale or unavailable, the public status changes accordingly.

If discovery is deliberately operating in a restricted coverage mode, health follows the core source enabled for that mode. Existing public incidents remain available while source health changes.

Activity Level

Activity Level is an experimental incident-only summary. It uses the public incident dataset and the actual current time. It considers incident, serious and moderate counts during the latest rolling 24-hour period, affected UK regions and the daily average from the preceding rolling 29-day comparison window.

HIGH applies for at least two serious incidents; at least six incidents at 2.5 times the baseline; or at least ten incidents across five regions. HEIGHTENED applies, unless HIGH applies, for one serious incident; three moderate incidents; at least four incidents at 1.5 times the baseline; or at least five incidents across four regions. Otherwise the level is NORMAL.

Ratio-based rules are used only when the comparison window contains incidents across at least seven distinct day buckets and its daily average is greater than zero. UNAVAILABLE is used only when trustworthy incident data cannot be loaded.

Systems dashboard

The Systems dashboard is separate from the incident feed. It combines structured resilience signals such as official warnings, transport disruption and other monitored system conditions using source-specific lifecycle and freshness rules. A Systems signal does not automatically become an incident, and incident Activity Level is calculated from the incident dataset rather than from Systems records.

Live Coverage

Live Coverage embeds or links selected third-party livestreams for situational awareness. UK Flashpoint does not control those streams and does not necessarily endorse their commentary. Stream metadata is checked separately from incident evidence, and a stream does not create an incident merely because it is live.

Qualifying new livestreams can generate a separate live-coverage alert pointing users to the Live Coverage page. This alerting path does not bypass incident validation or create an incident record.

Social publication

Social publishing is downstream from the public incident and livestream systems. Eligible new canonical incidents can be prepared for publication to UK Flashpoint's configured social channel, while livestream alerts use their own separate eligibility rules.

Social copy may use bounded Workers AI generation with factual checks and a deterministic fallback. Social generation cannot change the canonical incident facts, and a social-delivery failure does not alter or remove the underlying public incident.

Coverage limitations

Public beta coverage has gaps in structured official data and uneven local-source availability. Publishers and official bodies can report events late; sources can block automated access; reports may be incomplete or wrong; incidents evolve; and automated discovery can still produce omissions or false positives. City and map coverage are incomplete. UK Flashpoint does not claim comprehensive UK coverage.

Corrections

Submit a factual correction through the corrections form. Include the incident and supporting official or reputable sources where possible.

Public-beta status

UK Flashpoint is in public beta. Methodology, source coverage, validation rules and classifications will continue to change as operational evidence is reviewed.