A planner at City Hall wants to know how many buildings in Kibera have more than one storey. It is not an unreasonable question. It bears on drainage, on fire access, on how many people are actually there. She cannot answer it, and neither can anyone else in the building. The question is not hard because the answer is secret. It is hard because nobody has ever written the answer down.
For most of the last two years this body of work has argued that African institutions are failing for want of operational data infrastructure rather than for want of integrity. This paper is the first one where I can put a number on what closing part of that gap actually costs — because we closed it, for one dimension, in one city, and the closing produced a result I did not expect.
In plain terms: we replaced guessed building heights with heights measured from satellite imagery across Nairobi. It worked. But it also revealed that two datasets which both describe themselves as "measured" disagree with each other by nearly seven metres — and that the one everybody treats as authoritative is probably the worse of the two.
Three states an institution's data can be in
It is useful to separate three things that get collapsed into the word "digital".
Legible means the thing can be seen. A building exists in a dataset with a location and a shape. Someone asking "what is there?" can get an answer.
Navigable means the thing can be traversed and interrogated in context. Not a row in a table but a place you can move through, adjacent to other places, at a scale a human can reason about.
Writable means the thing can be changed by the people it describes. A resident who can see that the model has their building at one storey when it has three can say so, and that correction lands somewhere that matters.
Almost all civic technology in this region stops at legible, calls itself a platform, and waits. The gap between legible and navigable is mostly engineering. The gap between navigable and writable is mostly institutional, which is why so little of it exists.
What the twin is now
The Nairobi twin now holds 1,384,206 real building footprints across the metro, streamed tile by tile so that the whole city is walkable without the whole city ever being in memory. Footprints come from Overture Maps, which merges Google's Open Buildings, Microsoft's ML-derived footprints, and OpenStreetMap.
Until recently every one of those buildings was rendered as a box, because the pipeline reduced each real footprint polygon to its minimum rotated rectangle before storing it. That was a defensible shortcut and a real loss: an L-shaped block, a courtyard building, or an angled plot boundary all became rectangles. The footprints now survive to the renderer, simplified only as far as needed to keep tiles small.
More importantly, the heights changed.
0.3 percent to 73.6 percent
Overture carries a surveyed height for 4,231 of the 1.38 million buildings in the metro. That is 0.3 percent. For the remaining 99.7 percent, earlier versions of this twin estimated height from a heuristic: distance from the central business district, multiplied by a land-use factor. Buildings near the core were assumed taller. Nothing about any individual building was observed. The estimate was labelled as an estimate and colour-coded by confidence, which is the honest minimum, but it was still fundamentally a guess dressed in a gradient.
Google's Open Buildings 2.5D Temporal dataset changed what was possible. It provides building heights derived from satellite imagery across Africa, South Asia, South-East Asia and Latin America, annually from 2016 to 2023, at roughly 4-metre effective resolution, under CC BY 4.0 and ODbL.
The twenty-five source rasters covering greater Nairobi total 9.65 GB at their native half-metre tiling. We did not download them. They are Cloud-Optimized GeoTIFFs, so the pipeline reads only decimated windows over HTTP range requests and mosaics them into a single 16 MB raster at the dataset's true effective resolution. Then it samples that raster inside each building's real footprint polygon and takes the median.
The estimator was chosen by measurement rather than by taste. Validated against the buildings where Overture carries a surveyed height, taking the median of the pixels inside the footprint beat both the 90th percentile and the maximum. Using the maximum sounds appealing — you want the roof, not the ground — but it is noise-sensitive and it was the worst of the three.
The result:
| Height source | Before | After |
|---|---|---|
| Surveyed | 4,231 (0.3%) | 4,231 (0.3%) |
| Measured from imagery | — | 1,014,865 (73.3%) |
| Informal-settlement assumption | 89,028 | 13,499 |
| Distance-and-land-use guess | 1,290,947 | 351,611 |
Nearly three quarters of the city now stands at a height that something actually looked at. The remaining quarter splits into two honest failures: 298,557 buildings read below two metres in the raster, which at 4-metre resolution mostly means structures too small for the grid to resolve, and 66,553 fall outside raster coverage entirely. Those are still guesses, still labelled as guesses.
The result I did not expect
Having built the thing, I validated it against the only ground truth in the dataset — Overture's own surveyed heights — and got a mean absolute error of 6.84 metres.
My first instinct was to write that up as a finding about the raster. Google publishes a 1.5-metre mean absolute error for this dataset, with the caveat, in their own documentation, that it was evaluated in the Global North only. Here was a Nairobi number four and a half times worse. It is a tidy narrative: the Global South gets the worse model again.
It is also wrong, and it took a citation to catch it.
A 2025 paper in Scientific Reports evaluated building-height datasets against ICESat-2 satellite laser altimetry — a reference with roughly half a metre of uncertainty — for Nairobi, Kathmandu and Quito. For Nairobi it puts Open Buildings Temporal at 2.49 metres mean absolute error, better than the authors' own deep-learning model at 7.02 metres, with a tendency to overpredict by around 2.2 metres.
So the raster is roughly two and a half metres off against laser altimetry, and roughly seven metres off against Overture's surveyed heights. Both cannot be true of the raster. The difference is the ground truth.
I checked the obvious mechanical explanation first. My mosaic resampled half-metre pixels onto a 4-metre grid by averaging, which would dilute roof heights with surrounding ground and could plausibly account for the gap. So I rebuilt the entire metro mosaic using nearest-neighbour sampling instead and re-ran the validation. The results were identical to two decimal places. That rules out resampling, and incidentally confirms what the dataset documentation implies: the half-metre rasters are upsampled from a 4-metre native signal, so the two resampling strategies are reading the same underlying numbers.
Which leaves the conclusion I did not want. Two sources that both describe themselves as measured disagree by 6.84 metres, and the one with independent laser-altimetry validation is the satellite raster, not the surveyed attribute. Much of that gap is more likely error in Overture's height field — which inherits from OpenStreetMap contributors, from modelled values, and from sources of varying provenance — than in the imagery.
What this does to the design
The twin ranks height sources by confidence: surveyed beats imagery beats heuristic. That ordering was written before this result and it is now only partly defensible.
It remains right in one specific place. The raster caps at 100 metres. Nairobi has towers well past that — Overture has Times Tower at 150 metres — so for the tall core, the surveyed value is the only one that can be correct. Everywhere else, the ordering rests on an assumption that "surveyed" means "better", which this measurement does not support.
I have not changed the precedence yet, because changing it on one comparison against a ground truth of unknown provenance would be trading one unexamined assumption for another. It is recorded in the pipeline as a known open question, and both figures — the 6.84-metre disagreement and the 2.49-metre validated error — ship inside the tile store's metadata, so the distinction travels with the data instead of living in someone's memory.
That is the actual lesson, and it generalises well beyond building heights.
Provenance is the product
An operating layer that stores values is not enough. An operating layer has to store where each value came from and how much to trust it, because the moment you have two sources you have a conflict, and the moment you have a conflict you need a rule, and the rule is only as good as the provenance you kept.
This is not an abstract concern for institutions in this region. A water utility reconciling a meter reading against a billing record, a health system reconciling a paper register against a digital entry, a county reconciling a land record against a survey — these are all the same problem. Two sources, both authoritative-sounding, disagreeing. Most institutional software resolves this by picking one silently. The twin now refuses to: every building in the model carries a visible marker of how its height was arrived at, and the disagreement between sources is recorded rather than smoothed away.
An institution that cannot say why it believes a number cannot defend that number, cannot improve it, and cannot delegate it. Provenance is not metadata hygiene. It is the precondition for an institution being able to reason about its own data at all.
The next direction
The twin is legible and navigable. It is not writable, and that is the whole remaining distance.
What writable would mean concretely: the resident who can see their building modelled at one storey when it has three can correct it, and that correction enters a queue that a real institution reads. Not a suggestion box. A record with provenance — who said so, when, on what basis — that sits alongside the satellite-derived value and the surveyed value as a third source with its own confidence tier, and that the merge rule has to reckon with.
This is where the argument in The Operating Workforce and The Personal Operating Layer has been heading. The reason it has not been built is not that the interface is hard. It is that a write layer implies an institution on the other end that has agreed to read it, and that agreement is an institutional fact, not a technical one.
I am not going to pretend that agreement exists. What this paper claims is narrower and, I think, more useful: we now know what the read side costs. Roughly three quarters of a city's building heights can be moved from guesswork to observation using free, openly licensed data and a pipeline that fits in 16 megabytes. The obstacle to a legible city was never the imagery. The measurement is available, it is good, and it is better than some of the sources we have been treating as authoritative.
The obstacle is on the write side, and it is institutional. That is the next paper, and it will require an institution willing to be the first one to answer.
