What our words mean

How likely something is, said in fixed words. They come from ICD 203, the US intelligence community's standard for analysis. We use only these words, never softer ones. Each word means the range beside it: a brief that says "likely" means 55 to 80 percent. How sure we are of the evidence is a separate thing: confidence.

How strong the evidence is behind a judgment. Confidence is about the evidence, not the odds. It always comes with one reason. It never rises because more people are talking.

HIGH

Two or more independent sources graded B2 or better, a full baseline, and no sign that anyone is gaming a source.

MODERATE

One good source and a full baseline, or two weaker sources that agree.

LOW

One source, a thin baseline, crowd reports alone, or a source under suspected manipulation.

Every source carries a grade of one letter and one number, like B2. The letter says how reliable the source is. The number says how credible its report is. The grade shows on the source's receipt.

B2 or better

A letter of A or B and a number of 1 or 2. HIGH confidence needs two such sources.

Status line

The one word at the top of the home page, STATUS: NORMAL, ELEVATED or MAYDAY, with one sentence. A rule sets it from the scenarios and convergence alerts, not a person. An editor can hold it for up to 24 hours with a signed note, and the note shows on the page.

NOT SET YET

The status line has no status yet, because the rules have not run. We show no status word until they do.

NORMAL

No scenario has reached its ELEVATED count, and no convergence alert is active. At a Mayday Index site, NORMAL means its food places are not past the bar for that hour and weekday.

ELEVATED

A scenario has reached its ELEVATED count of signs lit, about half its signs, from two or more modules. Each scenario's page gives its count.

MAYDAY

The top status. A convergence alert is active, or a scenario has reached its MAYDAY count, most often all its signs but one. At a Mayday Index site, MAYDAY means its food places ran past the bar for two readings in a row, half an hour apart. A site's MAYDAY does not set the status on its own.

Convergence alert

The same place or the same stock flagged by two or more modules within 72 hours. For example: pizza, news events and a jump in a prediction market in the same city. It is the only alert that goes to the top of the home page. While one is active, the status is MAYDAY. It and a MAYDAY status are the only things on the site shown in red.

Alert

What we raise when a number runs past its bar: past it for two readings in a row, or far past it once. Each module sends at most 5 alerts a day. The rest are logged on the track record, not sent.

Bar

The line a number must cross to light a sign or raise an alert. Each bar is set against the number's own normal, its baseline.

Holidays and events

At a Mayday Index site in the US, the bar goes up on a US federal holiday. At any site, it goes up on a date our events calendar lists for that site. We keep no holidays for other countries, so a site outside the US gets a higher bar only on a listed date. A busy kitchen on those days is expected.

Baseline

What normal looks like for one number, from its own history: the same place, the same weekday, the same hour. We keep 52 weeks of history, and the last 8 weeks count most. We say how far from normal a number is in words: 3× busier than a normal Tuesday night.

Baseline score

On detail pages, how far a reading sits from its baseline. 0 is normal. The bigger the number, the further from normal. A number under 0 is below normal.

WARMING UP

A baseline with fewer than 40 readings of history. It cannot alert yet. A Mayday Index site needs 8 weeks of reports before it can alert.

STALE

Data older than it should be: a source past its freshness goal, a count not checked lately, or yesterday's Morning Desk after 7 AM Eastern when today's is not signed yet. We stamp it STALE and say how old it is. Stale data never looks fresh.

NO DATA

A Mayday Index site with fewer than 3 food places reporting in the last 45 minutes. NO DATA is not zero: we cannot say how busy it is.

NOT ANSWERING

The data for a page, or a part of one, did not come back when we asked for it, or it came back in a shape we could not read. We show none of that data rather than old data. Try again in a minute.

Scenario

A named situation, such as a US military strike abroad, with a short list of signs. There are 6 scenarios. Intelligence analysts call this an indications and warnings matrix.

Module

One part of the site with one kind of data: Mayday Index, Sky Watch, Follow the Money, World Pulse and Homeland Baseline. A scenario counts toward the status only with lit signs from two or more modules.

Sign

One thing a scenario watches, wired to one number, such as tankers in the air over a region. Each sign has a bar.

LIT

The sign's number crossed its bar.

NOT LIT

The number did not cross its bar.

NOT EVALUATED

We had no data we could use to judge the sign. It is not the same as NOT LIT: a sign we cannot see is never read as quiet. A sign is NOT EVALUATED when:

• the rules have not judged its scenario yet, so every one of its signs waits
• its source has not run lately, or sent no readings lately
• its source's newest run broke its data contract: until a run keeps it, nothing from that source can light the sign or show it is quiet
• its baseline is still warming up, there is not enough history yet to measure a move, or its number has no baseline rule yet
• it needs two or more numbers to agree, such as two markets, and too few have fresh data
• it needs an editor's mark and has none that counts: no mark yet, the last one is too old, or an editor cleared it
• it has more than one part, and none of them can be judged

Signs lit

How many of a scenario's signs are lit, such as "4 of 7 signs lit". Each scenario sets how many it takes to count as ELEVATED and as MAYDAY.

Likelihood ratio

How much more often a sign lit before a real event than on a normal day. Counts of signs lit are for reading. These ratios are for the status line.

Other explanations

What else could explain a scenario's lit signs, and what would confirm each. When a scenario counts, its page shows these before the count.

Key assumptions

What a scenario takes as given. For a strike: late-night activity at command sites means planning, not a budget deadline or a drill.

Collection gaps

What we cannot see: classified movements, encrypted messages, anything not on a public feed, and any source that is down. Each scenario page lists its own.

Mayday Index

A busyness score for the food places that feed a command center. Every half hour we compare how busy each place is with a normal night for that hour and weekday. A site's index is the middle score of its places that reported in the last 45 minutes. 0 is a normal night.

Site

A command center we watch, such as the Pentagon, with a ring of food places around it.

ABOVE

A site past the bar for one reading: much busier than normal for that hour. On the map its square is filled. Past the bar for two readings in a row is MAYDAY.

Crowd report

A tap on one of four buttons on a food place's page: "It's dead", "Normal", "Busy" and "It's slammed". No login. One report per place per day. A reading uses the middle report, not the average. Crowd reports are graded D4, so on their own they give LOW confidence. Each site's page says what we keep.

Follow the Money

Stock trades by public filers in defense, cyber, utilities, energy and shipping, scored by how oddly timed they are. We use only filings the law already makes public.

Filer

A member of Congress, or an officer, director or large holder of a company we watch, in their public role.

Trade score

Points from 0 to 100 for how oddly timed a trade is. Six factors add up to it. The receipt under each score shows every factor.

The six factors of the trade score

FACTOR	UP TO	WHAT EARNS POINTS
Timing	35	A trade within 10 trading days before a dated event in the same sector, such as a contract award or a committee hearing. Closer scores higher.
Committee	20	The filer sits on a committee that oversees the stock's sector.
Size	15	The trade's size against the filer's own past trades.
Instrument	10	Options and short positions score above common stock.
Late filing	10	Days past the legal deadline for the filing.
Clustering	10	At least 3 filers in the same stock in the same week.
Total	100	The trade score.

Timing flag

A trade that scores 50 or more, with some timing points. It is the only label we put on an odd trade. A timing flag is a statistical observation about public filings. It is not a finding of wrongdoing.

Null rate

How often any trading day sits that close before such an event by chance. It shows beside the timing points.

10b5-1 plan

A trading plan set up in advance. A Form 4 has a box for it. A trade with the box checked gets no timing points. Congressional filings have no such box, so their plan status is unknown.

Return

What the stock did after the trade. It is shown as a fact and never scored.

Amended

The filer changed a filing. The trade gets a new score, and the card says amended, with the date.

Sky Watch

Watched government aircraft in the air, and the FAA's flight restrictions with their reasons. Positions are at least 5 minutes old, and we never guess where a plane is going.

ADS-B

The public signal most aircraft send with their position. Military aircraft often fly without it, or with it blocked. A quiet map is never evidence of nothing.

Normal for this hour

Whether it is usual for that class of aircraft to be in the air at this hour, against a year of history.

National command

The airborne command posts: E-4B and E-6B.

Executive transport

Aircraft that carry the President and senior officials: VC-25, C-32, C-37, C-40.

Tankers

Air refueling tankers: KC-135, KC-46, KC-10. More tankers than normal over the Atlantic or the Gulf is a classic sign before a strike.

ISR

Intelligence, surveillance and reconnaissance aircraft: RC-135, E-3, RQ-4, P-8.

Strategic airlift

Heavy transports that move forces across oceans: C-17 and C-5.

Flight restriction

A Temporary Flight Restriction from the FAA: airspace closed over a place for a time, with a stated reason. Most are routine. Only security and national defense reasons can light a sign.

NOTAM

An FAA notice to pilots. Some close airspace or warn of missile activity.

World Pulse

Where in the world news events run off their normal, with prediction markets and the US sanctions list beside the map.

GDELT

A project that reads the world's news every 15 minutes and codes each event it finds by place. News volume is not the same as events on the ground.

Prediction market

A market where people trade on a question, such as whether a strike happens. We read the price, never the volume. A move of 15 points or more in 24 hours is flagged MOVED.

Sanctions list

The US Treasury's OFAC list of companies, vessels, aircraft and people under sanctions. A new name on it is an event. People added are counted, never named.

Homeland Baseline

Slow US security trends, kept for context, not as a warning. We count software flaws added to CISA's list of flaws attackers use, US ransomware victims, and CISA advisories. Water and industrial control incidents, drone incursions, watchlist hits at ports and threats against officials have no free feed yet. We do not collect them.

Receipt

Where a number came from: its source, when we fetched it, and the raw payload behind it. Every number on the site links to one, so a reader can check our math.

Raw payload

The file a source sent us, exactly as we got it. We store it before we read it, and we keep it for good.

SHA-256

A fingerprint of a raw payload, taken when it arrives. The receipt page checks the file against it, so a changed file shows.

Mayday Desk

The serious half of the site, named so a brief can be quoted without the pizza.

Morning Desk

A short daily brief, about 200 words, published by 7 AM Eastern. A language model drafts it from the last 24 hours of alerts and readings. An editor approves or edits it, and signs it, before it goes out. Its parts:

• What we see: The facts from our data, each number linked to its receipt.
• What we assume: What the judgment takes as given.
• What we judge: One judgment, with one odds word and a confidence with its reason.
• What this means for you: What the judgment means for a reader.
• Reported, unconfirmed: A big claim that is spreading but not confirmed: who made it, what they cite, its grade, and what would confirm it. It never lights a sign. It shows only when there is one.

NO BRIEF YET

No Morning Desk brief has been published yet. An editor signs each one before it goes out.

HELD BACK

A brief that did not pass our checks when the page read it, so we do not show it. For example, it had a number with no receipt, a word the site never prints, or an odds word not in the ICD 203 table.

LLM receipt

The public record of how a brief was written: the prompt and its version, the model, what it read, what it wrote, what the editor published, and who approved it and when. Anyone can compare what the model wrote with what went out.

Editor

A person, or our ops agent, who approves the brief and can hold the status. Editors show by a handle, never an email.

Veto window

When the ops agent approves a brief, it goes out 15 minutes later, so the owner can stop it first. A person's approval goes out at once.

Track record

Every alert we ever fired, and whether a public event matched it within 48 hours, marked by an editor with a link. Nothing is deleted from it.

Precision

Of the alerts an editor marked, the share an event matched. We would rather miss a quiet event than cry wolf, so precision comes first.

Recall

Of the real events, the share we caught. A missed event has no alert to mark, so recall comes from the backtest.

False alarm

An alert that no public event matched. Our goal is under one per Mayday site per month.

Backtest

A replay of past data through our rules, using only what was public at each moment, to show what the site would have said.

Freshness goal

How old a source's newest data may get. The status page shows one word for each source. MET: its newest data is within the goal. MISSED: it is not, or its newest run failed. OFF: it waits for the owner, for a key or an agreement. A source that has not run shows NO RUN YET.

NO RUN YET

A source that has not run yet, so we cannot measure it against its freshness goal. The count over the status page's table calls it NOT RUN.

Lag

How long ago a source was last read cleanly, a read that found nothing new included.

Errors

The share of a source's runs in the last day that failed.

Data contract

What each source must deliver on every run: at least a set number of rows, and no rows we had to drop. The status page says when a source's newest run broke it. Until a run keeps it again, that source's signs are NOT EVALUATED and it cannot light one.