Geolocating IDPs in South Sudan by tracking down a Facebook user’s movements

Introduction

Every so often people approach me to help them with something OSINT related, either finding data, analysing something, or geolocating images or footage of an event. These type of requests have previously led me to go down some amazing rabbit holes so I am always happy to help. Occasionally, if the information is not too sensitive, I can even turn them into a blog post like the one I wrote on the geolocation of an old ISIS execution video in Iraq.

At some point in 2022 someone asked me to geolocate a few photos, taken in 2016, showing internally displaced persons (IDPs) in South Sudan. I was given the name of a town (Kajo Keji) and a Facebook link to a post containing 15 images, all taken in the same location. After a (not so) quick look I realised that the photos had not been taken within the borders of Kajo Keji (according to Google Maps that is) so I had to use a different technique. Sometimes the best way to geolocate an image is to forget about it for a second and track down the movements of the person who took it. If you know where they went, you will be able to find out where they were at the time the photo was taken. This will narrow down your area of search a lot and, possibly, cut down the hours spent on the task.

Please note that the person I tracked down was a civilian and in no way involved in the situation. Although this blog entry will be focused on explaining how I tracked their movements, I will keep their identity private and censor anything that may lead to others finding them. The purpose of this blog entry is to explain how I used features available on Facebook in order to help me geolocate photos of civilians escaping a conflict.


Initial information

As I have mentioned above, I was initially given the name of a town alongside the photos. Nothing else. But that was already filled with information. Unfortunately some of that information was unhelpful; sometimes that happens.
The photos were all taken from the same exact spot. They depicted IDP’s either walking on the road or in vehicles, all headed in the same direction, towards the right of the person taking the photos.
Below is the screenshot of the Facebook post. You can see how the person included a lot of information, underlined in red below. Unfortunately, none of it helped me geolocate the photos, but it helped me verify the coordinates once I had already found them.

So what do we already know?

  • The Facebook user tagged their post as being in “Equatoria, South Sudan”.
  • The initial “kk” probably refers to Kajo Keji, the name of the town I was given.
  • The people were moving towards Uganda, which is 20 minutes away.
  • There’s a place called Kansuk “some kilometres from the town“.
  • The user is near their place of work.

It all sounds great and you would think that with so much information it would be super easy to geolocate this. You would be wrong (don’t worry, I was too). Although the post is filled with information, it was all a bit unhelpful as I mentioned above.

  • The Equatoria region covers an area of almost 200,000 km2 and is almost a third of the entire area of South Sudan. It does not narrow it down at all.
  • The photos were not taken within the borders of Kajo Keji (I checked).
  • We don’t know if the “20 minutes away” is in driving or walking time.
  • I have no idea where Kansuk is and at this point I would rather not attempt to track down yet another town.
  • I don’t know where the person was working in 2016.

After spending an embarrassing amount of time moving the camera around Kajo Keji on Google Earth Pro whilst muttering to myself “it must be here somewhere!” I decided to step back and think of a different way to solve this problem.


Tracking down the user

I did not know where the photos were taken but I knew that the person was near their workplace. If I could track down where they were working in July 2016 I could very easily narrow down my search, and figure out the correct coordinates. I could see that the person was (in 2022, when I geolocated this) a doctor in a hospital. Unfortunately for me they worked in Uganda, not South Sudan. According to their Facebook “About” page they lived in Uganda, studied in Uganda and worked in Uganda. But I know that at some point they were in South Sudan so I just had to find evidence of it!

If you go to the “Check-ins” section on a Facebook user, some people will actually “geolocate” themselves whenever they go to places. It’s both amazing and creepy. Definitely a stalker’s dream.

This user has apparently been actively (and publicly) announcing their location since the end of November 2013. I am both horrified at their lack of privacy and envious of the fact that they clearly do not have to care about these things.
You can see a (very small) section of their check-in tab on Facebook. The similar colours represent the same location. At a quick glance we can tell that the user was in Uganda until March 17, 2016 (purple) and within the four days between then and March 21, 2016 (green) they left the country and arrived in South Sudan. They clearly liked the place marked in green as they kept going back to it.
The closest “check-in” entry to the events on the photos (July 2016) was the location highlighted in blue where they claimed to have been on May 3, 2016. So let’s see what we can find about Lijo, South Sudan!


Finding their workplace

Luckily for us all of the entries on the “check in” section are clickable so I followed the “Lijo, South Sudan” link. I ended up on a tiny page with zero followers. The size did not matter because it still had a map! I can even spot “Kajo Keji” near the marker so it was clearly not too far from it.

From there it was a matter of seconds until I found the place on Google Maps. The screenshot below shows the same marker (dark blue circle), in the same location, as seen above. And what do we see just a few hundred metres south of the marker? A medical facility! And who works in medical buildings? Many people, but also doctors!

If my suspicions were true, then the photos of the IDPs would have been taken nearby. Time for Google Earth Pro!


Verifying the location

The reason why I needed to use Google Earth Pro instead of just Google Maps is because I was looking for an old image. Landscapes change all the time for a variety of reasons: war, natural disasters, urban development, etc. On Google Earth Pro you have the option to view historical satellite images. In this case I could try to find data from around July 2016 to ensure I got a good match for the photos I was trying to geolocate.
You can see two satellite photos of the same area below. On the left, an image taken in March 2016, and on the right the same place in December 2020. Highlighted in red you can observe the clear difference in tree growth. It may not look like a big deal but trees are one of the best geographical features to go for when trying to geolocate with satellite imagery. They almost never move!

With the suspected location and the satellite image from March 2016, it did not take long to figure out where the photos had been taken. Below, at the top, you can see two of the photos, taken and shared on Facebook on July 12, 2016, showing IDPs walking south, to the Uganda border. The bottom picture shows the satellite image from Google Earth Pro from March 2016. I have highlighted the different buildings in various colours. In front of the building you can see the two sets of trees, with red and blue arrows pointing at them. The building highlighted in green in the distance is the medical facility. The trees definitely helped!


Distances between everything

I want to give you an idea of the distances between the town I was given as a possible location of the IDPs on July 12, 2016, and the actual coordinates of the photos. The map below illustrates the various areas. In blue (purple?) I marked the border of the town of Kajo Keji as claimed by Google Maps. A few kilometres south of it you can spot a marker with a star. That was where the Facebook user “checked-in” on May 3, 2016. Only 500 metres south of it, with the camera marker, I found the exact location of where the photos were taken on July 12, 2016.

According to Google Maps, the people would have taken a bit over 20 minutes by car to reach the border of Uganda from where they were seen on the photos on Facebook. As most people were on foot, they would have taken 3 hours to walk the same 15.7 kilometres.


The answers to all our questions

Now that we have figured out the coordinates and have seen where everything is in relation to one other we can attempt to answer the questions we had at the beginning.

  • The Facebook user tagged their post as being in “Equatoria, South Sudan”. – Correct, this section is part of Equatoria, South Sudan. It did not help me at all.
  • The initial “kk” probably refers to Kajo Keji, the name of the town I was given. – Probably does, it was not helpful.
  • The people were moving towards Uganda, which is 20 minutes away. – Mostly correct. It would have taken a bit over 20 minutes by car but most people were walking which would have taken then 3 hours.
  • There’s a place called Kansuk “some kilometres from the town“. – No idea, never found it. It did not help me at all.
  • The user is near their place of work. – Yes, the person was likely working at the medical centre across the street, visible on the photo.

From checking out this user’s profile I found out that they were a doctor originally from Uganda that, between March and August 2016, worked on the medical centre a few kilometres south of Kajo Keji. Their photos were shared on Facebook at 6:20 am local time as they were waiting to start their work day. According to an article by the BBC, published on July 8, 2016, four days before the people were seen walking towards the Uganda border, a violent clash erupted in Juba, the capital of South Sudan. Heavy gunfire was reported between soldiers that were loyal to Riek Machar, South Sudan’s Vice-President, and soldiers loyal to Salva Kiir Mayardit, the country’s President. In the afternoon of July 12, 2016, on the same day that the photos were taken, the ceasefire between both parties was declared. As a result of the conflict 270 people died, and thousands fled, many by crossing the border to Uganda. The ones in the photos on Facebook were just a few of the many.


Conclusion

Sometimes the fastest way to geolocate a photo is to forget about it and instead focus on the person behind the camera. If we can track down their movements there’s a very good chance of being able to narrow down our search area. This will enable us to focus on a smaller area and get to the correct coordinates much faster.
Would I have been able to geolocate the photos without tracking down the user? Most likely.
Would it have taken me a lot longer? Absolutely.
Why do the hard way when we can do it the smart way?

I hope my explanation on how to use the check-in option on Facebook to track down people’s movements in order to geolocate their photos was useful.
Thank you for reading!
~Sofia.

P.S. Please don’t stalk people.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

Website Powered by WordPress.com.

Up ↑

%d bloggers like this: