Verification & Fact-Checking: How to Know What You Know

At 6:40 on a Tuesday morning a photograph reaches a newsroom: a brown river carrying away a footbridge, a crowd on the bank, a caption saying this is the town of Marlow, today. It has been shared four thousand times. It is vivid, it fits the weather forecast, and a well-meaning editor could publish it in two minutes.

A verifier asks different questions. Who took it? Is this the first time it appeared, or the fortieth? Does the bridge exist? Does the light fit the time of day? Does anyone with no stake in the story say the same? None of this needs special software. It needs a method and a willingness to say "not yet" in public. Journalism's own textbook calls verification the essence of the craft: what separates it from rumour, entertainment and propaganda.

Every photo, source, document and town in this piece is invented, so the methods can be practised without touching a real person. This describes professional practice and isn't a guide to targeting anyone: the ethics section is part of the method, not an extra.

A claim is a bundle: count the independent sources

"The Harbor Bridge reopens Friday" feels like one fact. A verifier splits it: who says so, how would they know, and who else knows independently? The last question catches the commonest failure in news, circular reporting: five outlets repeating one unnamed official look like five confirmations and are one.

The rule of thumb in reporting is two independent sources, or one document you can check. "Independent" is the hard word: it means each source has its own route to the fact, not that each has its own logo. A report that cites another report adds nothing but reach.

Fact-checking grew into its own institution out of this. Dedicated outlets now operate on every inhabited continent: for example Snopes (US, 1994), Chequeado (Argentina, 2010) and Africa Check (2012, with offices in South Africa, Nigeria, Kenya and Senegal). Many publish under the International Fact-Checking Network's code of principles, run from the Poynter Institute since 2015, which asks for non-partisanship, transparent sources and methods, and open corrections. Fact-checkers check claims; the newsroom's verification desk checks material. Same discipline, different input.

Without JavaScript: five items repeat the claim, but they trace back to only two origins, an unnamed official and a city press release. That is two confirmations at most, and the unnamed official is a source you still cannot check.

Confidence comes in steps, not a switch

Professional verifiers rarely say "true" or "false" about a piece of material on first look. They say how far up a ladder it has climbed. Different organisations use different words, but the rungs are similar: unverified, plausible, probably genuine, verified. Each rung is earned by evidence that a stranger could re-check.

The classic checklist for a piece of user-generated content has four tests: provenance (is this the original, and who made it?), source (can I reach the person, and does their history fit?), date (when was it made?), location (where?). Add independent confirmation and you have the working ladder below. Saying the rung out loud ("we have the location and the date, but could not reach the photographer") is more honest than a headline that hides the gap.

The Bellingcat investigators' work on the shooting down of Malaysia Airlines flight MH17 over eastern Ukraine (17 July 2014) is the best-known case of this ladder in public: videos of a missile launcher on a convoy were placed on a map by matching buildings, road signs and a petrol station, and their dates by social-media posts. A Dutch court later convicted three men in absentia (17 November 2022) in a criminal case that relied on a wide body of evidence, of which open-source material was one part.

Without JavaScript: a rule of thumb. Original file + location + date + independent confirmation = verified. Three of those = probably genuine. Two = plausible. Fewer, or a screenshot of unknown origin = unverified, so do not state it as fact.

Images and video: find the first appearance

The commonest fake is not a forgery. It is a real picture with the wrong caption: an old flood, another country, a film set. So the first question about any image is "where did this first appear?"

Reverse image search (tools such as Google Lens, TinEye and Bing Visual Search, which differ in coverage) takes a picture, finds copies and sorts them by date. The earliest copy, not the most popular one, is your lead. If the "today" photo turns up three years ago, you have your answer, and a lesson about caption laundering.

For video, grab still frames and search those, then look for cuts, music added later, watermarks from other platforms and a dubbed voice that does not match the lips. Metadata (the camera, time and sometimes place stored inside a file) is a clue and nothing more: most platforms strip it on upload, and it is easy to edit, so a verifier treats it as a lead to be checked against something else. Then geolocation: compare what is visible (a ridge line, a shop sign, the shape of a bridge) with satellite imagery and street-level photos. It is detective work on landmarks, never on people.

Without JavaScript: the earliest sighting is a stock-photo library entry dated 4 June 2019, about six years before the claimed event, and it names a different river. The photo is genuine; the caption is false.

Shadows, sun and the clock: placing a photo in time

Light is a free witness. A vertical object of height h casts a shadow of length L, and the sun's elevation above the horizon satisfies tan(elevation) = h / L. Measure the shadow-to-height ratio in a photo and you know the sun's elevation, which depends on three things: latitude, date and time of day. This is chronolocation: if you trust the place, the shadow constrains the time; if you trust the time, it constrains the place.

Two cautions. Solar time is not clock time: time zones, daylight saving and longitude shift the clock by up to hours. And the same elevation occurs twice a day, once in the morning and once in the afternoon, so shadow direction (west in the morning, east in the afternoon) breaks the tie. A single photo gives a range of possibilities, not a stamp.

Without JavaScript: at latitude 40° N around 21 March, a shadow 1.4 times the object's height happens at about 9:16 solar time in the morning and 14:44 in the afternoon.

AI-generated media: why "spot the fake" is a losing game

Synthetic images, audio and video are now cheap. Early fakes had tells: extra fingers, garbled signs, glassy eyes. But those tells are artefacts of a generation of models, and they fade as the models improve. The harm is real: in March 2022 a fake video of Ukraine's president telling soldiers to surrender circulated before it was debunked, and in early 2024 a Hong Kong finance worker at the engineering firm Arup was reported to have been tricked into transferring about US$25 million after a video call with deepfaked colleagues.

The honest position among verifiers is that pixel-level detection cannot carry the weight. Meta's 2020 Deepfake Detection Challenge, with more than two thousand participants, found that the best model reached only about 65% accuracy on a held-out test set designed to resemble the real world; detectors also tend to get worse on kinds of fakes they were not trained on. So newsrooms lean on what has always worked: source, context, corroboration. Where was the person? Do the other cameras agree? Who benefits from the clip? Does the official channel confirm?

A second approach is provenance: instead of proving a file fake, prove where a real one came from. The C2PA standard (the Coalition for Content Provenance and Authenticity, founded in February 2021 by Adobe, Arm, the BBC, Intel, Microsoft and Truepic) attaches signed "Content Credentials" showing the capture device and edits. It tells you about origin, not truth, and the information is lost if a file is re-processed. Treat it as a helpful label.

Detectors also have a base-rate problem, which is the arithmetic below. Even a good test produces mostly false alarms when real fakes are rare.

Without JavaScript: with 2% fakes and a detector that is 90% sensitive and 90% specific, of 1,000 images about 18 fakes are caught and about 98 real images are wrongly flagged, so only about 16% of flagged images are fake.

OSINT ethics: you could, but should you?

Open-source intelligence means using public material to establish facts. The same skills (matching a window to a satellite image) can verify a massacre or stalk a neighbour. Professional codes (Berkeley Protocols for digital open-source investigations, first published by the UN human rights office and UC Berkeley in 2020, are one) make the difference explicit.

• Verify events, not private individuals. Placing a conflict video is accountability; working out where an ordinary person lives from their photos is not journalism.
• Minimise harm. Blur faces, plates and house numbers of bystanders and victims, unless naming them is the public-interest point.
• No getting round locks. No guessing passwords, bypassing paywalls or logging into accounts. Public means public.
• Mind your own footprint. Don't make contact from a personal account, and don't expose a source by what you ask.
• Show your method. Publish how you did it so others can check you, with the personal details left out.
• Beware the crowd. After the Boston Marathon bombing in April 2013, online sleuths wrongly named innocent people, including a missing student whose family was then harassed; he had in fact died weeks earlier. Crowd-sourced "investigation" without editors is how that happens.

Without JavaScript: the rule is to verify events and not private people, to minimise harm, to stay within what is public, and to hold anything that cannot be confirmed.

What a graduate just sees

• Five outlets quoting one official are one source with five logos.
• The first appearance of a picture matters more than its popularity.
• A caption can be false while the picture is real, and that is the common case.
• Shadows give a range of times and places, not a single answer, and solar time is not clock time.
• "The detector says fake" is weak; where it came from and who confirms it is strong.
• Say how sure you are, in words a reader can check, and correct in the open.
• Verify events, not private people.

Where it shows up next

• Data Journalism (35/97): the same questions asked of a spreadsheet: where did it come from, what does it count?
• Investigative Journalism (35/98): a leak is a document that must be verified before anything is built on it.
• Journalism Ethics (35/95) and Media Law & Press Freedom (35/96): corrections, harm and the cost of being wrong in print.
• In the world: human-rights groups documenting abuses, insurers checking claims, courts weighing digital evidence, and anyone deciding whether to forward a video.

If you want to go deeper

• 📘 Textbook. Bill Kovach and Tom Rosenstiel, The Elements of Journalism (Crown; several editions), whose chapter on "the discipline of verification" is the standard statement. Craig Silverman (ed.), Verification Handbook (European Journalism Centre, free online), is the practical companion.
• 📘 Gentler. Claire Wardle and Hossein Derakhshan, Information Disorder (Council of Europe, 2017, free), a clear map of mis-, dis- and mal-information.
• 🌐 Free course. First Draft's training material (its archive now sits with the Information Futures Lab at Brown University) and Bellingcat's free guides; the Knight Center for Journalism in the Americas runs free online courses (including in Spanish and Portuguese) on verification.