Camera online

Ukraine invasion unfolds online as detectives document conflict

Analysts and researchers provide real-time updates on Russia’s military assault on Ukraine using open source intelligence

By Umberto Bacchi

TBILISI, Feb. 25 (Thomson Reuters Foundation) – When data enthusiast Oliver Alexander saw online security camera footage showing military trucks on a Ukrainian road hours after Russia launched the military assault, he noticed a familiar detail.

“You could see they had diagonal lines painted on them, which was spotted on units based in Crimea. So you could tell they were from there,” Alexander told the annexed Crimean Peninsula by phone. by Russia.

The 28-year-old took photos and posted them to Twitter, marking where they were taken and giving his followers an idea of ​​how fast Russian forces were moving north.

His tweet was part of a torrent that has been uploaded in the last 48 hours by internet sleuths using a practice known as open source intelligence (OSINT) to document the Russian invasion.

“(OSINT) has been deployed in a truly phenomenal way in a way that we have never seen before,” said Justin Crow, a researcher at the University of Sussex in Britain, whose work focuses on the social media intelligence, referring to the conflict in Ukraine.

Moscow unleashed the biggest attack on a European state since World War II on Thursday, shocking the world and prompting tens of thousands to flee their homes.


The OSINT sector has exploded in recent years with the development of tools to aid in data analysis, and is now populated by journalists, activists, researchers and avid hobbyists – who often work together to try to check the information.

The job involves gathering publicly available resources, such as videos and photos on social media, and looking at them through “a real-time magnifying glass,” Crow said.

This could include, for example, analyzing metadata to find out when and where a video was taken or cross-referencing images with satellite photos to verify locations and contextualize images, he said.

“The role (of OSINT) is really to clarify information for the general public because … governments already have that capability in-house,” Crow said.

Before the missiles started hitting Ukraine, OSINT detectives played an important role in keeping tabs on the military buildup that led to the invasion, assessing troop deployments with satellite imagery.


When Russia invaded this week, their main goal was to try to document and make sense of the events unfolding on the ground, said Alexander, a Danish financial analyst with a passion for analyzing data.

“Now probably the most important thing that (OSINT) can be used for is documenting civilian casualties,” he said.

Clips circulating online include videos appearing to show a tank rolling over a moving car as well as footage of a cyclist hit by an explosion and an unexploded rocket falling in a residential area.

On Friday, the prosecutor of the International Criminal Court (ICC), Karim Khan said his court could investigate possible war crimes in Ukraine.

The United Nations said it had reports of at least 127 civilian casualties – 25 killed and 102 injured – “caused by shelling and airstrikes”.

“We will strive to ensure that all open source evidence is collected, archived and made accessible to any responsible body that needs it, including the ICC,” wrote Eliot Higgins, founder of OSINT news outlet Bellingcat, on Twitter.


open source website Oryx holds a record of vehicles, aircraft and equipment destroyed or captured by Russian or Ukrainian forces – based on images available online.

Debunking false claims and propaganda has also been central to the work of OSINT detectives.

When pro-Russian separatists in eastern Ukraine released a video purporting to show a foiled sabotage operation last week as Western intelligence services accused Russia of seeking a pretext to attack, sleuths online were quick to suggest it was a fake.

The clip’s metadata said it had been filmed a few days earlier, while audio analysis revealed that the sound of gunfire and explosions had been taken from a YouTube video of Finnish military exercises, according to Bellingcat.

The flurry of content appears to have been too much for Twitter’s content moderators to digest, who have been involved in their own effort to spot false and misleading information.

Numerous old clips showing past military actions reportedly appeared on the social media platform since Thursday, with captions claiming the images showed current events.

On the eve of the Russian invasion, the social media company suspended a dozen OSINT accounts, including Alexander’s, in what it later called a mistake.

“We have been proactively monitoring emerging stories that violate our policies and, in those instances, we have taken enforcement action on a number of accounts in error,” Twitter said in a statement.


Yazidis in Iraq want Big Tech held accountable for Islamic State crimes

Content moderation in conflict zones: what role for big tech?

Illegal bitcoin miners in Abkhazia face a new threat from thieves

Our standards: The Thomson Reuters Trust Principles.