💽

Codebook

This explains the fields of the database and the definitions of specific options.

Key information

Field	Sub-field	Definition
Incident ID	/	A globally unique identifier (GUID) assigned to each event. Multiple reports on the same incident are indicated through consecutive numbers in brackets at the end of the GUID, e.g. (1). The consolidated record for an incident is indicated with (main).
Short incident summary	/	A textual description of what happened for quick reference.
Event in review	/	When a detailed overview of an event has been published on Threatologist, this will link to it.
Exclude		Used to indicate that an initially suspicious incident is revealed to have no political dimension and there is credible source consensus on that, e.g. an explosion that turns out to be a gas leak

When an incident occurred

Field	Sub-field	Definition
Incident start date	/	Indicates the date when an event is reported to have started.
Incident finish date	/	Indicates the date when an event is reported to have finished.

Where an incident occurred

Field	Sub-field	Definition
Incident location republic	/	The federal administrative entity where an event occurred, e.g. Chechnya.
Incident location city	/	The city or population centre where an event occurred, e.g. Groznyy.
Incident location details	/	Any other details about a location
Latitude	/	The latitude (X-coordinate value) for where an event occurred.
Longitude	/	The longitude (Y-coordinate value) for where an event occurred.
Location specificity (single select)	Precise	Source provides sufficient information to enable precise geolocation of an incident, e.g. specifying the street or building number where an event occurred.
	Approximate	The source provides enough information to enable a rough location for an incident to be determined or a reasonable estimation to be made, e.g. stating an event occurred in a forest 5km from a specific village.
	Vague	The source provides general information that prevents any estimation being made, e.g. stating that an event occurred in a rayon.

What happened

Field	Sub-field	Definition
Incident type (multi-select)	Abduction	The kidnapping of an individual.
	Accident	An incident where there is explicit reference to an accident or the clear absence of an actor. Events of this type are only recorded if an incident is reported by other sources as belonging to another category (either as a result of conflicting reporting or reclassification when further information becomes available).
	Arson	An incident involving deliberate damage caused by fire.
	Attack	A deliberate and directed violent incident.
	Brawl	A mass fight where violence is multi-directional.
	Detention failed	Security services attempt to take an individual into custody, but the individual either escapes or is killed.
	Detention successful	Security services take an individual into custody.
	KTO	The imposition of a legal counterterrorism (KTO) regime. This is recorded separately from any special operations that may form part of it.
	Rally	A gathering of people for an identified purpose, e.g. a protest.
	Robbery	An act of larceny, usually involving force. Events of this type are only recorded if an incident is reported by other sources as belonging to another category (either as a result of conflicting reporting or reclassification when further information becomes available), or when they are explicitly linked to a political actor.
	Search	An individual or group carries out a search or raid of a location or person.
	Seizure	The security services capture weapons or IEDs not primed for use.
	Special operation	A security service operation that is temporally and geographically delineated and typically referred to explicitly as a special operation.
	Surrender	A person wanted by the security services voluntarily turns themselves into the authorities.
Weapons used (multi-select)	IED	An improvised explosive device, i.e. a container filled with incendiary material designed to cause harm or damage.
	Incendiary	A device other than an IED designed to cause fires, e.g. Molotov cocktails.
	Melee weapon	A handheld weapon used in hand-to-hand combat, including knives, swords, and bats.
	No weapon	The absence of a weapon is specified by a report.
	Projectile	Projectile explosives, including grenades, grenade launchers, and missiles
	Small arms	Firearms and other weapons using gunpowder.
	Suicide	The source specifies that the perpetrator died during an attack and intended to do so. Usually explicitly referred to as a suicide attack. When used in combination with vehicle, indicates that the suicide attack was vehicle borne.
	Thrown	Objects used as a weapon and projected through the air without the use of weaponry, e.g. rocks.
	Unclear	No weapon is specified or the report is unclear as to what weapon is used.
	Vehicle	The use of a vehicle as a weapon.

Who was involved

Field	Sub-field	Definition
Perpetrator type (multi-select)	Civilian	Not related to the security services, other state actors, or insurgents.
	Insurgent	Related to armed opposition to the state for ostensibly political reasons. This may be inferred from the nature of the attack, rather than indicating the involvement of a recognised insurgent group.
	Opposition	Related to systemic or organised non-systemic opposition activities.
	Other	Not captured by any of the other categories.
	Religious	Related to religious activities.
	Security services	Related to state security service organs.
Perpetrator group	/	A cross-reference to the Organisations database, where media reporting indicates a specific group is involved in an incident
Number of perpetrators	/	A numerical field indicating the number of people to carry out the incident.
Target type (multi-select)	Building	An incident is directed against a building or other facility. For all options, targets and victims are treated as synonymous; target does NOT mean the attack was consciously directed at them.
	Civilian	Not related to the security services, other state actors, or insurgents.
	Civil society	Related to human rights, non-governmental, or other civil society activities.
	Commercial	Related to commercial or business activities.
	Insurgent	Related to armed opposition to the state for ostensibly political reasons.
	Judiciary	Related to the judicial branch of the state.
	Media	Related to the activities of recognised media outlets.
	Medical	Related to the provision of medical assistance.
	Official	Related to a state ministry or agency not related to security,
	Opposition	Related to systemic or organised non-systemic opposition activities.
	Other	Not captured by any of the other categories.
	Person	An incident is directed against a person or persons.
	Religious	Related to religious activities.
	Security services	Related to state security service organs.
	Transport	Any form of public transport.
	Vehicle	An incident is directed against a vehicle.

The numbers

Field	Sub-field	Definition
Number of casualties (low)		A numerical figure indicating a lower range of how many people were reported across all categories as harmed during an incident.
Number of casualties (high)		A numerical figure indicating an upper range of how many people were reported across all categories as harmed during an incident.
Number killed (low)		A numerical figure indicating a lower range of how many people were reported killed during an incident.
Number killed (high)		A numerical figure indicating an upper range of how many people were reported killed during an incident.
Number injured (low)		A numerical figure indicating a lower range of how many people were reported injured during an incident.
Number injured (high)		A numerical figure indicating an upper range of how many people were reported injured during an incident.
Security services killed		A numerical figure indicating how many people explicitly identified as security service personnel were killed during an incident. If there is disagreement across sources over the number, this will be noted in Additional notes.
Civilians killed		A numerical figure indicating how many people explicitly identified as civilians were killed during an incident. If there is disagreement across sources over the number, this will be noted in Additional notes.
Insurgents killed		A numerical figure indicating how many people explicitly identified as insurgents, terrorists, or similar were killed during an incident. If there is disagreement across sources over the number, this will be noted in Additional notes.
Number detained		A numerical figure indicating how many people were detained during an incident

Everything else

Field	Sub-field	Definition
Incident linked to		A cross reference to incidents in the same database that the incident is reported as connected to. E.g. a special operation imposed after an insurgent attack.
Additional notes		A free text field for capturing any additional information relevant to the incident not recorded in other fields.
Sources		A cross reference to the ⛲Media archive database, indicating the origins of the information contained in the event record.

Incidents are treated as singular events if there is temporal and geographic continuity, and as separate events where there is a break in activities, multiple locations are involved, or there are qualitative differences between the events. Classification is based on the first action in a chain. For example, if a report indicates that the security services attempt to arrest an individual, that individual opens fire and is then killed in response, a single event will be recorded and the perpetrator will be coded as ‘security services’ and the event type as ‘detention failed’. If, in a similar scenario of an attempted arrest, the individual were to escape and an armed clash were to occur several days later, these would be recorded as separate events. In another example, if the security services were to conduct a special operation across multiple sites, each site would be recorded as a separate incident. KTOs are always recorded separately from other event types because they constitute a legal regime that has much broader applicability than, for example, a special operation that may be conducted while a KTO is in place. Because coding decisions can affect quantitative assessments of activity, a qualitative descriptor of incidents is always provided.