(Click here to watch and listen to the video version of this blog entry)
Introduction
On June 24, 2023, the world watched as, in a sudden turn of events, Yevgeny Prigozhin, the head of the Wagner Group, called for a rebellion in Russia. As his convoy of mercenaries allegedly headed to the Russian capital, videos appeared on social media depicting excavators digging up roads in an alleged attempt to halt their progress. I geolocated one of those videos.
I employed the same technique I previously showcased in my OSINT Exercise #009 video walkthrough. It is a very simple method but perhaps “hiding in plain sight”. I wanted to highlight it in this blog entry as it can be very effective in speeding up a geolocation and, ultimately, an OSINT investigation by narrowing down the search area. With a bit of critical thinking and Google Maps, geolocating the footage featuring excavators digging a road somewhere “near Moscow” was not as difficult as it first appeared.
The video
A video was shared on Twitter on June 24. It depicted two excavators digging on a two-lane road “to make roadblocks“. According to the person sharing the footage, the scene was filmed in Lipetsk. It is not clear if they mean Lipetsk the city or Lipetsk Oblast. We will find out either way.
Below is the screenshot of the tweet containing the video. If it gets removed from Twitter, here is an archived version.
Analysing the footage
Although the video is only a few seconds long, the person filming pans around the area showing a few helpful key features. You can see below, highlighted in blue on the left, a sign in the distance, possibly indicating the border of a town or region, and a connecting road coming from the right hand-side, highlighted in light green. In the image on the right, filmed with the excavators on their back, you can spot a strange looking column on the side of the road, highlighted in red.
These features could be found almost anywhere, and without more information, we would spend a very long time scanning the entire Lipetsk region. No one wants that.
However, we are not done analysing the video. In a poor attempt at click-baiting, “you’ll never guess which was the most important detail seen in the footage.”
It was the traffic (click-bait is just not for me, I tried).
Google Maps traffic feature
On Google Maps, you can select various layers. Among them, you can see “traffic”. This layer allows you to check “Live traffic” or “Typical traffic” by selecting specific days of the week and time.
On the OSINT Exercise #009 video walkthrough, I explained how one could use this feature to identify busy roads at a specific time of the day in order to narrow down possible search areas. This time I used the “Live traffic” option to help me find the coordinates of the excavators seen in the footage.
But first, we still need to refine our region a bit to avoid spending too long checking all busy roads within the Lipetsk region (there were a lot).
Narrow down the area of search
So far, we have established that the video was likely recorded in Lipetsk. But as I have mentioned, there were many videos being shared online. It is always useful to gather as much data as possible before starting to look at a map. The more information you have, the faster it will be to discard incorrect locations and focus on the most likely one.
As Twitter was full of videos of the situation in Russia due to the Wagner Group rebellion, I figured it was as good a place as any to start looking for even more information.
I quickly created a little search string that contained the following:
moscow AND (excavator OR digging OR dug) filter:videos
The string above requests Twitter to give us any videos that match specific criteria: they must have the word “Moscow” combined with either the word “excavator”, the word “digging”, or the word “dug”.
(If you are interested in learning more about how to create these types of search strings, check out my blog entry entitled “How to monitor oppressive regimes on Twitter using TweetDeck“.)
Using the search string mentioned above, I got a very long list of similar videos to the one I was attempting to geolocate. Among them was one that contained subtitles, as seen below.
According to the subtitles, the person filming allegedly says: “I’m standing in front of the Chepuinsky district.”
Great, we have a district name! The bad news is that there’s no such thing as a Chepuinsky district.
Fear not; Wikipedia came to the rescue with a list of districts in Lipetsk. According to the “Administrative divisions of Lipetsk Oblast” page, there is a district called “Chaplyginsky (Чаплыгинский)”. The word looked similar enough to Chepuinsky that we can infer that perhaps the subtitles were attempting to write Chaplyginsky phonetically and ended up with Chepuinsky.
Either way, time to check out this Chaplyginsky district in Lipetsk Oblast.
Geolocating excavators in Chaplyginsky district
At this point, we have various important pieces of information that we can use to narrow down our search within the Chaplyginsky district:
- The Wagner Group convoy was headed towards Moscow
- The person filming claimed they were “standing in front of the Chepuinsky district“
- There was traffic congestion due to the excavators on the road
It is reasonable to think that the military convoy would be travelling on main roads. We also know they were coming from the South as there were multiple reports of the mercenaries having crossed Voronezh, South of Lipetsk Oblast.
Putting all the information together, we can easily reach the conclusion that the video was likely filmed in the section highlighted in the figure below.
- The road seen on the map faces the South – North direction headed to Moscow
- The area highlighted could be referred to as “in front of the Chaplyginsky district” since it is right on the border.
As for the last point on our previous list, will we be able to see traffic congestion in the area, indicating the presence of a road disruption?
Yes, Google Maps showed a bright red and orange section on the road, just before the district border, dotted in red. Unfortunately, I did not think to take a screenshot at the time as I did not envision writing a blog entry on it, so the figure seen below was of the area almost 24h later. However, it is still possible to observe traffic on the road, highlighted by Google Maps traffic feature in red and orange.
Now that we have a very good idea of whereabouts the excavators might have been on June 24, we can analyse the area on Google Maps.
We are expecting to see a sign in the distance, likely the one indicating the start of the Chaplyginsky district. We also need to find a road connecting to the two-lane path from the right-hand side, close to the sign. Interestingly enough, if you check the area on Google Maps without the satellite view, you will miss the road on the right, as seen below.
If you zoom in close enough to where the two roads merge, you will be able to spot something that could very well be a sign, possibly indicating the start of the district, as seen below.
Additionally, we are also expecting to find a strange looking column on the left-hand side of the road, facing South, further back towards the location where the person was filming. It could perhaps be the small structure seen below on Google Maps satellite view.
Verifying the location
With enough evidence pointing us towards this exact point on the road, we can simply grab pegman and drop it on the road. It is always easier to verify information when Google streetview is available.
We can start with dropping the little yellow person facing North and checking the road and the sign in the distance. You can see in the figure below how the features match. On the left is a screenshot from the video containing the excavators digging the road, and on the right is a screenshot from Google streetview facing the sign indicating the start of the district.
If we then face South, we will be able to spot that strange looking column on the side of the road. Below you can see the comparison between the scene at the excavators’ footage on the left, and a screenshot of the area on Google streetview on the right.
We have therefore concluded, with no margin of doubt, that the video allegedly filmed on June 24 showing excavators digging the road leading up to Moscow, was recorded in Lipetsk Oblast. The person recording the scene was just outside the Chaplyginsky District, at the following coordinates: 53.069132, 39.873101.
Conclusion
The Google Maps traffic feature is extremely useful when attempting to narrow down an area of search. It can make the difference between scanning an entire stretch of road or immediately being able to focus on a very specific point. Knowing how to use this feature can make a difference between spending hours on a geolocation, or a few minutes. This blog entry explained how I used the “Live traffic” feature on Google Maps to geolocate a video shared on June 24 depicting two excavators digging a road in Lipetsk Oblast, Russia. These heavy construction equipment were allegedly attempting to stop the advances of the Wagner Group mercenaries, reportedly en route to Moscow.
If you want to check out an explanation of how I used the “Typical traffic” feature instead on Google Maps I suggest checking my OSINT Exercise #009 video walkthrough on YouTube (perhaps you can give it a go attempting to solve the exercise first, if you haven’t already).
Thank you for reading!
~Sofia.
Sofia Santos | OSINT Analysis & Exercises 