And how relying on information from the news can set you back.
(Click here to watch and listen to the video version of this blog entry)
Introduction
As the invasion of Ukraine by the Russian military unfolds, the world watches. Many of us want to do something but what? Do we, as individuals, hold any power over a nation such as Russia? A few years ago I would have said no but now, with examples such as Eliot Higgins, the founder of Bellingcat, and many others that gather, analyse and constantly verify data online, I say any of us can.
At the moment Twitter is flooded with the testimony of thousands (millions?) of Ukrainian people living through a quick and (somewhat) unexpected invasion of their homeland. There are images, videos, statements, etc, of the events. A huge crowd of OSINT and GEOINT experts and enthusiasts watches and tries to help in any way they can. Some are analysing the rockets, some the movement of troops, some the damage on Ukrainian soil. All for the same common goal: end the madness.
General Advice
I ask of anyone coming here to learn geolocation techniques to please be careful, do not share any information that might endanger the safety of the person who did the recording, be careful of who you are sharing your findings with, and most of all, do not give away any important information to the invaders, avoiding anything that might make their life easier such as current positions of troops and tanks for example. Be safe, be sensible.
The Video
For this tutorial I went to Twitter and found a video that had been posted earlier today, February 25, 2022. You can see the tweet below, archived here.
Download the video
First thing we need to do is to immediately download the video. This one has been viewed over 644K times by now and will probably not be deleted any time soon but in general is always best to save it just in case.
In order to do that I used savetweetvideo, an online Twitter video downloader. Simply copy paste the link of the video you found and select “Download”.
Afterwards you need to select the quality of the video. I have selected the best one because any detail help. It will then open the video on a new tab and then you just need to save it using the “save as” option.
Now that we have the video and it is not going anywhere we can go back and read the caption, comments, hashtags, anything that could give us a hint on where to look. The author mentions that the video features a bridge that has been bombed in order to prevent the advance of Russian tanks. She also informs us that the video was recorded in the North of Kyiv. This is extremely helpful and it will probably not take long to find it. We have to be aware however that sometimes the captions are missing, wrong or misleading in some way (sometimes on purpose, sometimes by accident).
Save the frames
So let’s be extra detailed and examine everything before drawing any conclusions. For that we need to look at the video, frame by frame.
There are two ways to achieve this, you either use an online tool or have one already installed in your computer. I will cover both techniques.
• Offline method: ffmpeg
I have been using ffmpeg, a multimedia framework that supports Linux, for quite some time. In general I rather keep things offline if I can, especially if dealing with sensitive or confidential information.
You can download this tool here: https://www.ffmpeg.org/download.html
Once it is installed you will need to run a command to save all the frames of the video. My desktop is running Linux so this is the command I use:
“ffmpeg -i nameofthevideo.mp4 img%04d.png -hide_banner”
Make sure you have created a new folder before hand so that all the images stay together in one place.
In case you are wondering, the “-i” stands for “input” followed by the name of the video. Then the “img%04d.png” defines the naming protocol of the images, they will start with “img” followed by 4 digits (increase this if you have longer videos) and saved as a png file format. The “-hide_banner” is just to hide any unnecessary information whilst running the program.
After running ffmpeg we’ll end up with 550 still images acquired from the frames of the video.
• Online method: ezgif
If for some reason you cannot or do not want to install ffmpeg on your machine you can just use an online tool for the same purpose. I have chosen to try ezgif, an online video to jpg image sequence converter.
The website is quite straightforward, just select the video you have downloaded and convert it to jpg just like the image below.
After collecting all the still images if you scroll to the bottom you’ll see the “download frames as ZIP” button. Save it to your computer and extract it to a folder.
I was curious and decided to see how many images it had gathered compared to ffmpeg. With only 184 items, totalling 9.1 MB, this is a huge difference from the previous technique which gathered 550 photos totalling over 929 MB. Literally 10 times more in terms of used space and almost 3 times more saved images. You can guess which had the better quality.
Create a panoramic image view
Now is the lengthy process of looking through the images and selecting a few that have the best chance of giving us useful information. These are the ones I have chosen.
We can put them all together to create a big panoramic view using photopea, an online image editor, similar to Photoshop.
This is the end result using the 5 images above.
Look for landmarks
With our panoramic view we can get a clearer idea of the area we are looking for.
There is a small river that goes underneath the bridge, on the right we can spot a corridor of purple street lights with some paved small lane. This is perhaps for pedestrians or a small bike lane although we can not see any bike markings on the road with such indication. As we move closer to the streetlights near the bridge we can spot a small sculpture, it kinda looks like a paper boat origami.
The bridge itself has a pedestrianised area on each side with guard rails separating it from the car lanes. The metal rails of the outside of the bridge are painted in yellow and blue colours, same as the Ukrainian flag, and the bars are horizontal.
All in all it seems that this was a four lane road, with 2 lanes on each side, divided in the middle by another guard rail.
Looking in the distance now we can spot 2 big billboards closer to the bridge and several more in the far distance.
There are many different buildings in the distance. At this point we don’t know if they are part of Kyiv or if Kyiv is actually behind the photographer. We just know that the bridge leads to Kyiv.
Focus on the details
With so much information you would think that it would have been extremely easy to find this bridge. You would be wrong.
The problem when big events are unfolding is that the media coverage is so big and at such a fast pace that quite often the amount of information will surpass the veracity of it. Images, videos and descriptions of events are dumped, many times copy pasted from other sources, on a strange snowball effect. At some point “everyone knows” about something that was simply not true.
This was what happened with this event. I started by just checking google maps around the Northern area of Kyiv, simply looking for a bridge over a small river. I found a few bridges but none of them matched. Then I turned to the news in search of more information. I was pointed in all sorts of directions, a bridge in Crimea, a bridge in Ivankiv over the riger Teteriv, a bridge over the Dnieper river, and so on.
At this point we can conclude that the news coming through are not a very reliable source of information and we should just trust what we can see and investigate on our own.
It’s time to focus on the details of our video and frames. What does the billboard on the left seen in the picture below say? Will it be useful at all?
I zoomed in as much as possible on it, and focused on the writing on the red side of the big sign. Using google translate, I managed to write down what (I figured) it says. What I got was “Бучі” which google translated to “Buchi”.
I put Бучі on google maps and was immediately taken to a town called Bucha (Бучі or Буча).
I looked around using the aerial view, searching for a small river with a highway-style bridge crossing it. I found one slightly South of the town.
Now it’s time (once again) to drop to street view and check out the area on google maps. One thing I immediately noticed is that the image was captured in April 2018, almost 4 years ago. This means that there might be some differences in regards to structures like buildings that could have been developed in the last few years.
At first glance it seems we have a match! But we still need to confirm all the landmarks before calling it a day.
These are the coordinates of the location of the image above: 50.4910, 30.2589.
Verify the claim
If we were to just state that this is the correct place without confirmation, we would have done exactly the same as most of the news outlets out there. We need data to prove our claim. So let’s get it.
I decided to use a nice new tool called BirdHunt that can filter tweets based on coordinates, allowing us to geolocate photos and even users.
The top result is shown below. It looks like the same bridge we saw on our original video but now with some more photos.
But what about the images shared? These are the photos I got from the tweet above. The most interesting by far is the middle one where you can see the fire of the bridge explosion in the distance.
From our original video we can deduct that the photo was taken from the top of this building. This gives us another dimension (and even better proof) that we are indeed in the correct place.
So let’s compare the image of the bridge after its destruction and a street view image. For the image at the top I have used a Mapillary street view screengrab as it was the most recent image of the area I could find. It was recorded in April 2019.
We can see many similarities. The guard rail that separates the 2 lanes on right to the pedestrian area, the horizontal metal fence with the top painted in blue and yellow. In the distance we can spot the 2 big billboards and the similar street lights in a neat row. At the bottom we also see the big power line and behind it, in the distance, a group of (probably) residential buildings.
We can even see how the hills in the distance match in terms of altitude and shape.
I wasn’t done and decided to dig even deeper and used the keywords “Bucha Irpin” on YouTube. I ordered the results by date and found a video of cyclists going around the area on an almost 2h video. I glanced at it and found 2 very interesting frames depicting something that I am hoping you will recognise.
Below you can see the purple (perhaps blue?) streetlights that we initially saw on our video and panoramic image.
As I keep following the cyclists I spot, at the end of that path, the “paper boat” sculpture in the middle of a grassy roundabout.
Satellite confirmation
Ideally we would now have a satellite confirmation. A bridge being destroyed is definitely something that would be visible using current satellite imagery available. Unfortunately at this point all the images I have seen are covered in clouds and do not offer the possibility of confirming this is the exact location (although I am very confident in my geolocation findings above). Within the next few days we will be able to re-check the satellite images and, at some point, there will be a visible image that will confirm this was, indeed, the exploded bridge.
I will be using Sentinel Hub EO Browser. It is free and easy to use.
Conclusion
With the constant stream of data dump during the ongoing Ukraine — Russia conflict, the viewers will be, sometimes inadvertently, fed incorrect information. If you want to know for sure where things are happening you will probably have to do it yourself. This was a (hopefully useful) tutorial on how to go from a twitter video with a claim to an actual, verified information, in a few short (?) steps.
I hope it was useful and you enjoyed the ride.
Thank you for reading!
~Sofia.
Sofia Santos | OSINT Analysis & Exercises 