Navigating the Russia-Ukraine War with OSINT technologies

Conversations with Data: #92

Do you want to receive Conversations with Data? Subscribe

379a931b 4f2b 46a3 86d6 c949e71914ff 2

Welcome to the latest Conversations with Data newsletter brought to you by our sponsor, a web hosting company that was established in Iceland to provide safe harbour for freedom of speech, free press and whistle-blower projects.

C0bd1d2d 9ae0 1929 939d 4832928111e9

Since the beginning of the Russia-Ukraine War, propaganda, misinformation, disinformation, and alleged war crimes have been rapidly shared online and across social platforms.

To understand how journalists are navigating this information war, we spoke with Eoghan Macguire, an editor at Bellingcat, Hayley Willis, a visual investigations reporter at The New York Times and François D'Astier, a journalist with AFP's digital verification team.

The panel explains how OSINT tools and techniques are used to verify and investigate the conflict, from using satellite imagery to weapons analysis and geolocation data.

Listen to the podcast on Spotify, SoundCloud, Apple Podcasts or Google Podcasts. Alternatively, read the edited Q&A with Eoghan Macguire, Hayley Willis and François D'Astier below. This conversation is an edited recording from our event in June 2022.

What we asked

What are the biggest challenges you've encountered when verifying information about this war in Ukraine?

Eoghan: I find it is very tricky to verify instances of potential civilian harm when they take place in rural areas with very few identifiable features. In most instances, if you have a strike in a city or a town where you do have identifiable features, you can do a geolocation or chronolocation investigation. After that, the tricky part becomes assigning responsibility. You can combine OSINT reporting and on-the-ground reporting to verify this. Of course, it is also possible to verify incidents with just OSINT, but it takes a lot longer.

Hayley: I would say the volume of content in this conflict coming is completely overwhelming. You're in hundreds of Telegram channels with hundreds of posts being sent a minute. The content people can dig into for this war is endless. Keeping up with that is a challenge. Adding on to that, there was another conflict in Ukraine back in 2014. This can make it difficult to verify what is from then and now. Deciding what is the most relevant and what is old is the biggest challenge.

François: The speed at which videos are being posted on Telegram makes it difficult to verify who shot a video or image. It's also hard to decipher who first posted the content. This is happening at a much faster rate than a few years before. For instance, back in 2019 most of AFP's verification work involved investigating content from Facebook and Twitter. You could find people more easily and understand the source of content much more quickly. The other challenge is things can take a lot of time, especially if you need to speak to a expert. For instance, it can take time to wait to hear back from a weapons expert on whether a missile is Russian or Ukrainian when verifying a strike. This can slow down your timeline in verifying content.


How do you manage your mental health when being exposed to violent content?

François: One of the hard parts when working in verification is to learn to disassociate and look after your mental health. Some of the images and videos are pretty rough to look at. And we aren't even on the ground, so you can imagine what reporters in the field are facing. It can be difficult to watch hours of disturbing footage, but this is useful and important work. That means you have to learn the coping mechanisms to handle this.

OSINT experts often have to use translation tools or rely on people with hard to find language skills. How do you go about that?

François: I definitely did not learn Russian. For very basic claims of information, I use translation tools. However, when it comes to verifying very specific signs or more complicated claims, I would go to AFP's crisis cell and ask them for more in-depth translation help.

Hayley: Google Translate is an open source investigators best friend. Most journalists have a specific beat or region they cover and that means they probably speak the language. I always say for visual investigations that our beat is visual evidence. That means we cover a variety of regions and topics, so we don't always speak the language. The New York Times is also lucky enough to have a Ukrainian journalist on staff. Of course, there are other reporters throughout the world who speak numerous languages, too.

Eoghan: At Bellingcat we have quite a few Russian and Ukrainian speakers who we can turn to. I don't speak Russian either, so Google Translate is also my best friend.

Daff5000 ca6c c619 c327 159ed647bed5

As an OSINT expert, what are your go-to tools for verification?

Eoghan: State of mind is more important than learning any one particular tool for this kind of visual investigation work. You need obsessive attention to detail and the ability to dig in and solve a problem. You also need to have the skills to sift through social media -- whether it is wading through hundreds of Telegram channels or searching for content on Twitter.

What satellite imagery tools do you use?

Eoghan: At Bellingcat, we subscribe to Planet, a paid subscription that provides daily satellite imagery. I also encourage people to use NASA Firms Data. This can help you understand whether a fire took place at a certain time or place and helps with verifying a video about a particular strike. These tools can help you dig into more detail and verify a claim further.

Hayley: At The New York Times, we work with Planet and Maxar, which are paid service providers for satellite data. However, there is publicly available satellite imagery as well. For instance, Google Earth, Satellites.Pro, Sentinel Hub and Google Street View.

What other tools do you use?

Hayley: For searching on Telegram, I use Telegago. You can search for private groups and channels. For any investigation involving chronolocation and geolocation, a simple spreadsheet is essential. I used Google Sheets to help keep track of what we are investigating.

Eoghan: One other tool I rely on is called SunCalc. It helps you with chronolocation or geolocation. It can help you figure out when something happened or get you closer to understanding when something happened.

François: For verifying old images, we use Google Image Reverse Search. We also use InVID for verifying videos.

Fbde7f71 17c6 85fe 1ce2 6b9058863db3

How are misinformation and disinformation evolving on social media when it comes to the war in Ukraine?

François: When it comes to misinformation and disinformation spreading online, I find that it starts on Telegram and then sifts through Twitter and mostly ends up on Facebook. You will see screenshots from Telegram groups on Twitter and Facebook mentioning these false videos. AFP also has a team on the ground in Ukraine who are collecting testimony and who can assist us with verification.

Hayley: Telegram is definitely where we are finding most of our content for verification. However, often we have found misinformation and disinformation first gets shared in very private groups and then spreads to Telegram groups. For instance, someone shares a video with a friend on WhatsApp and then that gets forwarded to another friend and so on. Later this will end up on Telegram and other social media channels.

Eoghan: We also notice Telegram has primarily been the platform for Bellingcat when covering this war. In addition to Twitter and Facebook, we've also seen content being posted on VK, the Russian version of Facebook. Another platform is TikTok. Bellingcat has been working with the Centre for Information Resilience, and all of our civilian harm data is on their Russia Ukraine Monitor Map. Leading up to the conflict, they were finding a lot of troop movements within Russia on TikTok.

De0e3959 bd7e 65cb 6378 121f41f48de2

Finally, how important is methodology with the work you do?

Eoghan: I would say transparency is baked into the DNA of Bellingcat. We're all about showing the method. We'll always try to be open with that and explain the methodology so people can retrace it. We aim to be fully transparent. That usually leads to very long articles, but I think that's useful in terms of providing a public service to people.

François: We're trying to explain step by step what we did for the investigation as much as we can. Hopefully, we have open sources or at least identifiable sources. The audience, in the best-case scenario, should be able to redo the exercise and arrive at the same conclusion. I do agree that sometimes it makes for a reading that's less artistic than the usual AFP report, but it still is necessary.

Hayley: I agree with everything that was said. I would also say in terms of methodology and transparency, something we're very careful of being very transparent about is what we don't know. In a conflict, it's practically impossible to know everything. There are so many facets to what's going on. This is particularly the case for our article verifying the Bucha massacre in Ukraine in March. We don't know how they were killed and by whom. What we do know is that Russia's statement that none of these people was killed while they were there is false. More investigation is needed on who did this.

Latest from

A journalist's portfolio is akin to one's pride. But what happens when broken links and defunct code riddle your life's work of interactive content? This is the dilemma news organisations and journalists face thanks to the rise of data journalism -- where complex interactive storytelling and dynamic data visualisations rely on distributed digital infrastructures. Professor Bahareh Heravi explores the possibilities for saving your content in her latest long read article. Read the article here.

Bd296083 46d8 814f 5432 968f848031b1

With summer here, there’s no better time to close the laptop and catch up on your reading. Our data journalism team has cherry-picked a collection of books that will refresh your expertise and reignite your passion for the field. Read the blog here.

F2958227 88e3 5eaf 71d9 673eac42bc42

Want to be on the podcast or have an idea for an episode? We want to hear from you. Don't forget to join our Discord data journalism server for the latest in the field. You can also read all of our past newsletter editions or subscribe here.


Tara from the EJC data team,

bringing you supported by Google News Initiative and powered by the European Journalism Centre.

PS. Are you interested in supporting this newsletter or podcast? Get in touch to discuss sponsorship opportunities.

subscribe figure