Geolocation and chronolocation: proving where and when

A video arrives with a claim attached: this happened here, yesterday. The pixels prove neither part. Geolocation is the craft of establishing where an image or video was produced. Chronolocation establishes when. The two get worked together, because a place without a time is rarely worth much, and both run on comparison and patience rather than exotic tooling.

Geolocation: fixing the where

Everything in frame is a clue to place. Terrain and skyline give the horizon a shape that can be matched. Architecture and street furniture, lamp posts, kerbs, bus shelters, barrier designs, differ between countries and often between municipalities. Signage carries a language and sometimes a phone code. Vegetation narrows climate. Road markings are more national than most people expect. The method is comparison against reference imagery: candidate locations get tested against satellite views and street-level photography until the camera position can be reproduced, or the candidate dies. A real match is not "this looks similar". A real match is a spot on the map from which every visible feature lines up, and it should survive a hostile reviewer trying to break it. Where this sits among the imagery disciplines is covered in our glossary entry on GEOINT and IMINT.

Chronolocation: fixing the when

Time leaves marks of its own, and they are hard to fake in combination.

• Shadows. Direction and length put the sun at a position that occurs only at certain dates and times for a known location.
• Weather. Conditions in frame can be checked against historical weather records; rain on a day the records call dry is a loud contradiction.
• Season. Foliage and snow cover narrow the calendar.
• Clocks and print. Visible clocks, timetables and dated posters speak plainly, once checked as belonging to the scene.
• Metadata. Platforms usually strip EXIF on upload; where it survives, it records the device's local settings, which can be set wrongly. It corroborates, it does not decide.
• First appearance. The earliest version of the content found online caps how recent the event can be.

Single clues suggest, combinations establish

One consistent clue is a hypothesis. Several independent ones that agree are a conclusion, provided each was checked rather than assumed. The write-up matters as much as the finding: a defensible conclusion states what was checked and what could still be wrong. The known failure modes justify the caution. Recycled footage presented as new is the commonest, a fixture of conflict reporting, where an old clip resurfaces within hours of every incident; a reverse image search that finds the same frame three years earlier ends the analysis on the spot. Mirrored images defeat lazy matching because the whole scene flips, signage included. And some scenes are staged: the place is real, the event is not, which is why place and time get checked against each other and against independent reporting.

There is a standard for this

For accountability work the craft has a written reference: the Berkeley Protocol on Digital Open Source Investigations, published by the UN Office of the High Commissioner for Human Rights with the Human Rights Center at UC Berkeley. The first edition launched in 2020 and appeared in print in 2022. It sets professional standards for verifying online material in accountability contexts, including how conclusions and their limits get recorded. Commercial casework benefits from the same bar: a geolocation that would not survive that level of scrutiny should not leave the building. Verification is also only half the evidential story. Preserving the material so a finding survives disclosure is covered in chain of custody for open-source evidence.

Frequently asked questions