Home

  • Geolocating an American bald eagle nest near NASA’s Kennedy Space Center

    Introduction

    Occasionally you may come across a photo that you need to geolocate but there are no distinct landmarks or features that can guide you. You might think that there is nothing to be done. Sometimes, even in those cases, geolocation is still possible, you just need to take a slightly longer route. This blog entry is an example of one of those situations.

    On February 10, 2023, NASA published a photo of an American bald eagle in a nest “near Kennedy Parkway North at NASA’s Kennedy Space Center”. According to the information provided by the space agency, the photo was taken on February 8, 2023 by Ben Smegelsky. I looked at the photo on Twitter and thought that the best way to spend a few minutes on a Saturday afternoon was to attempt to geolocate a nest on a tree somewhere “near Kennedy Parkway North at NASA’s Kennedy Space Center“. The photo can be seen in the tweet below.

    I did consider turning the challenge into an OSINT exercise but figured it would perhaps have been a bit too hard for beginners so here is the full explanation nevertheless.

    If you want to give it a go anyway stop reading here and go for it. Anything below this line will be an explanation on how I did it.

    Gathering data

    The first step in any geolocation is to look at the data and see if there’s anything we can use to help us navigate and find the correct coordinates. If there is not much to go by, the second step is to find more data.
    Looking at NASA’s tweet you can see a pine tree, an eagle and there’s an implication that there’s a nest underneath that eagle. It’s not possible to fully see the nest but if the person who took the photo claimed it was there, I believe it.
    The photo on its own is not enough. We need more information on this and, if possible, photos from other angles.

    I figured that the resident American bald eagles at a NASA Space Center would possibly attract some attention from visitors or staff. It is very likely that they have been photographed before. We just need to find those photos.

    I quickly googled “Kenned Parkway North eagle nest”. The second result was a photo on Wikipedia entitled “East in nest-by NASA”. Look at this beauty below!

    And what can we see in the distance? A building! A perfect photo for a geolocation. There’s a road visible on the right, highlighted in blue, and a building with interesting features, highlighted in red. We can use all of this to triangulate the nest.

    According to the Wikipedia article, the photo was shared in March 2008 but had been taken in 1992. The accompanying text mentioned how “the nest is particularly well-known because of its huge size and close proximity to a busy road“. Luckily for us we can already see the road so we already know the rough distance from it.

    If you are disappointed by the lack of American bald eagle chicks in the nest I got you! I also found a photo of the nest on an old NASA page. This time with one fluffy chick on it! The page was last updated in 2008 but I found the same photo on a website as early as July 2007 so who knows when it was taken.
    Nevertheless, here’s the happy family:

    Triangulating the location

    Now that we have a good idea of the whereabouts we should be looking for, let’s focus on the details to figure out where exactly the nest is located. We can see a building in the distance but there’s no shortage of buildings at NASA’s Kennedy Space Center and I am not a fan of looking through maps aimlessly.
    To speed up the process I just googled “NASA’s Kennedy Space Center buildings” and checked the “Images” tab hoping to find one similar enough to the one visible on the photo. It was quite straightforward. Almost all the results were of the “Vehicle Assembly Building” as seen below.

    You can compare the building seen in the distance of the 1992 photo of the American bald eagle’s nest (left), and the Vehicle Assembly Building at NASA’s Kennedy Space Center (right). They are clearly the same structure. The old photo had a different logo at the time but other than that it has not changed that much.

    Once I established which was the building I was after I simply searched for “Vehicle Assembly Building” on Google Maps and checked out the area. Fortunately there are various paths with streetview available. I navigated around until pegman was facing the general direction of the building seen in the 1992 photo. Below you can see how I tried to align the building’s entrance to figure out the cardinal directions of our target road. From that I deducted that the nest would be located South of the structure, and we would have to be facing North-East to see the Vehicle Assembly Building in the far distance.

    From there, and because the street going South had Google streetview, I started navigating and trying to really look at the trees by the side of the road. The available streetview was from 2012 but we know that the American bald eagles have been around since at least 1992 and their nests get reused each breeding season. It is very likely that the nest would be visible from the road (with a bit of luck, that it).
    I wanted to confirm that so I googled “kennedy parkway eagle nest” and checked “images”. I figured that if it was near the road and visible, other people would have attempted to see and perhaps haven taken photos of it. I was right and found a couple of photos taken from the road, as seen below.

    They led me to a Foursquare page with a gallery of 46 photos of the nest as seen from the road, all very similar to the ones above. There was no indication as to when they had been taken but it was good enough.

    I clicked a few of them and tried to memorise the pattern of trees so that I could easily spot it when moving along the road on Google’s streetview. Using that information and a general idea of how far the nest would be from the building, I quickly found the nest on a tree! The screenshot below highlights in red the building visible in the distance, the road we had seen at the beginning in blue, and the nest on the top of a tree. You can check it out for yourself using the following coordinates: 28.547877, -80.658811.

    Verifying the location

    But no geolocation is done without proper verification! Although the image above already established the likelihood that this is the correct nest, I always like to double and triple check all the information.
    First of all I wanted to confirm that there is no possibility of other nests in the area. I googled simple questions such as “are bald eagles territorial” and “do american bald eagles always use the same nest”. The answers were as expected, yes and yes. It is therefore highly unlikely that there would be another breeding pair in the same areas due to their territorial nature, and highly unlikely that this would have been an abandoned nest as they get reused each year.

    But I was not satisfied so I also checked if the nest seen in the streetview image was an American bald eagle’s nest. I searched for “American bald eagle nest tree” images and I found various photos. They are very similar in shape and size to the one seen on the NASA photo of the day. Below are two examples.

    Lastly, I wanted to compare the tree so I went on YouTube and searched for “eagle’s nest at kennedy space center”. The first result was a 3 years old video entitled “East Nest Along KSC Bus Tour”. Brilliant, exactly what I was looking for!
    I stopped the video at the 2 second mark and took a screenshot of the tree with the nest at the top (left image below). Then I compared it to the streetview screenshot I took (right image below) and looked at the branches. Below you can see a couple of the details highlighted. Also visible are the power lines in front of the trees.

    Mission complete. I am 100% sure this is the correct tree with the American bald eagle’s nest as seen in the NASA photo of the day on February 10, 2023.

    And with this we complete the geolocation. We explored how we found more information about the subjects featured on a photo and the possible location. Afterwards we examined the area and found the new landmarks. We analysed the features in the photo and triangulated the possible direction from which we would be able to see them all in the correct angles. Then we found more data to help us locate the exact tree. We ended by confirming that the tree indeed contained an American bald eagle’s nest and there was very unlikely to be an abandoned nest or in use by a different breeding pair. All the evidence put together pointed towards the nest we found being the one featured on NASA’s photo of the day of February 10, 2023.

    Conclusion

    Not having enough information visible in a photo should not stop you from attempting to still geolocate it. There are always ways to work around it and still accurately get to the coordinates.
    I hope this walkthrough was useful or at least entertaining.
    Thank you for reading.

    ~Sofia.

    , ,
    , ,

  • Geolocating IDPs in South Sudan by tracking down a Facebook user’s movements

    Introduction

    Every so often people approach me to help them with something OSINT related, either finding data, analysing something, or geolocating images or footage of an event. These type of requests have previously led me to go down some amazing rabbit holes so I am always happy to help. Occasionally, if the information is not too sensitive, I can even turn them into a blog post like the one I wrote on the geolocation of an old ISIS execution video in Iraq.

    At some point in 2022 someone asked me to geolocate a few photos, taken in 2016, showing internally displaced persons (IDPs) in South Sudan. I was given the name of a town (Kajo Keji) and a Facebook link to a post containing 15 images, all taken in the same location. After a (not so) quick look I realised that the photos had not been taken within the borders of Kajo Keji (according to Google Maps that is) so I had to use a different technique. Sometimes the best way to geolocate an image is to forget about it for a second and track down the movements of the person who took it. If you know where they went, you will be able to find out where they were at the time the photo was taken. This will narrow down your area of search a lot and, possibly, cut down the hours spent on the task.

    Please note that the person I tracked down was a civilian and in no way involved in the situation. Although this blog entry will be focused on explaining how I tracked their movements, I will keep their identity private and censor anything that may lead to others finding them. The purpose of this blog entry is to explain how I used features available on Facebook in order to help me geolocate photos of civilians escaping a conflict.

    Initial information

    As I have mentioned above, I was initially given the name of a town alongside the photos. Nothing else. But that was already filled with information. Unfortunately some of that information was unhelpful; sometimes that happens.
    The photos were all taken from the same exact spot. They depicted IDP’s either walking on the road or in vehicles, all headed in the same direction, towards the right of the person taking the photos.
    Below is the screenshot of the Facebook post. You can see how the person included a lot of information, underlined in red below. Unfortunately, none of it helped me geolocate the photos, but it helped me verify the coordinates once I had already found them.

    So what do we already know?

    • The Facebook user tagged their post as being in “Equatoria, South Sudan”.
    • The initial “kk” probably refers to Kajo Keji, the name of the town I was given.
    • The people were moving towards Uganda, which is 20 minutes away.
    • There’s a place called Kansuk “some kilometres from the town“.
    • The user is near their place of work.

    It all sounds great and you would think that with so much information it would be super easy to geolocate this. You would be wrong (don’t worry, I was too). Although the post is filled with information, it was all a bit unhelpful as I mentioned above.

    • The Equatoria region covers an area of almost 200,000 km2 and is almost a third of the entire area of South Sudan. It does not narrow it down at all.
    • The photos were not taken within the borders of Kajo Keji (I checked).
    • We don’t know if the “20 minutes away” is in driving or walking time.
    • I have no idea where Kansuk is and at this point I would rather not attempt to track down yet another town.
    • I don’t know where the person was working in 2016.

    After spending an embarrassing amount of time moving the camera around Kajo Keji on Google Earth Pro whilst muttering to myself “it must be here somewhere!” I decided to step back and think of a different way to solve this problem.

    Tracking down the user

    I did not know where the photos were taken but I knew that the person was near their workplace. If I could track down where they were working in July 2016 I could very easily narrow down my search, and figure out the correct coordinates. I could see that the person was (in 2022, when I geolocated this) a doctor in a hospital. Unfortunately for me they worked in Uganda, not South Sudan. According to their Facebook “About” page they lived in Uganda, studied in Uganda and worked in Uganda. But I know that at some point they were in South Sudan so I just had to find evidence of it!

    If you go to the “Check-ins” section on a Facebook user, some people will actually “geolocate” themselves whenever they go to places. It’s both amazing and creepy. Definitely a stalker’s dream.

    This user has apparently been actively (and publicly) announcing their location since the end of November 2013. I am both horrified at their lack of privacy and envious of the fact that they clearly do not have to care about these things.
    You can see a (very small) section of their check-in tab on Facebook. The similar colours represent the same location. At a quick glance we can tell that the user was in Uganda until March 17, 2016 (purple) and within the four days between then and March 21, 2016 (green) they left the country and arrived in South Sudan. They clearly liked the place marked in green as they kept going back to it.
    The closest “check-in” entry to the events on the photos (July 2016) was the location highlighted in blue where they claimed to have been on May 3, 2016. So let’s see what we can find about Lijo, South Sudan!

    Finding their workplace

    Luckily for us all of the entries on the “check in” section are clickable so I followed the “Lijo, South Sudan” link. I ended up on a tiny page with zero followers. The size did not matter because it still had a map! I can even spot “Kajo Keji” near the marker so it was clearly not too far from it.

    From there it was a matter of seconds until I found the place on Google Maps. The screenshot below shows the same marker (dark blue circle), in the same location, as seen above. And what do we see just a few hundred metres south of the marker? A medical facility! And who works in medical buildings? Many people, but also doctors!

    If my suspicions were true, then the photos of the IDPs would have been taken nearby. Time for Google Earth Pro!

    Verifying the location

    The reason why I needed to use Google Earth Pro instead of just Google Maps is because I was looking for an old image. Landscapes change all the time for a variety of reasons: war, natural disasters, urban development, etc. On Google Earth Pro you have the option to view historical satellite images. In this case I could try to find data from around July 2016 to ensure I got a good match for the photos I was trying to geolocate.
    You can see two satellite photos of the same area below. On the left, an image taken in March 2016, and on the right the same place in December 2020. Highlighted in red you can observe the clear difference in tree growth. It may not look like a big deal but trees are one of the best geographical features to go for when trying to geolocate with satellite imagery. They almost never move!

    With the suspected location and the satellite image from March 2016, it did not take long to figure out where the photos had been taken. Below, at the top, you can see two of the photos, taken and shared on Facebook on July 12, 2016, showing IDPs walking south, to the Uganda border. The bottom picture shows the satellite image from Google Earth Pro from March 2016. I have highlighted the different buildings in various colours. In front of the building you can see the two sets of trees, with red and blue arrows pointing at them. The building highlighted in green in the distance is the medical facility. The trees definitely helped!

    Distances between everything

    I want to give you an idea of the distances between the town I was given as a possible location of the IDPs on July 12, 2016, and the actual coordinates of the photos. The map below illustrates the various areas. In blue (purple?) I marked the border of the town of Kajo Keji as claimed by Google Maps. A few kilometres south of it you can spot a marker with a star. That was where the Facebook user “checked-in” on May 3, 2016. Only 500 metres south of it, with the camera marker, I found the exact location of where the photos were taken on July 12, 2016.

    According to Google Maps, the people would have taken a bit over 20 minutes by car to reach the border of Uganda from where they were seen on the photos on Facebook. As most people were on foot, they would have taken 3 hours to walk the same 15.7 kilometres.

    The answers to all our questions

    Now that we have figured out the coordinates and have seen where everything is in relation to one other we can attempt to answer the questions we had at the beginning.

    • The Facebook user tagged their post as being in “Equatoria, South Sudan”. – Correct, this section is part of Equatoria, South Sudan. It did not help me at all.
    • The initial “kk” probably refers to Kajo Keji, the name of the town I was given. – Probably does, it was not helpful.
    • The people were moving towards Uganda, which is 20 minutes away. – Mostly correct. It would have taken a bit over 20 minutes by car but most people were walking which would have taken then 3 hours.
    • There’s a place called Kansuk “some kilometres from the town“. – No idea, never found it. It did not help me at all.
    • The user is near their place of work. – Yes, the person was likely working at the medical centre across the street, visible on the photo.

    From checking out this user’s profile I found out that they were a doctor originally from Uganda that, between March and August 2016, worked on the medical centre a few kilometres south of Kajo Keji. Their photos were shared on Facebook at 6:20 am local time as they were waiting to start their work day. According to an article by the BBC, published on July 8, 2016, four days before the people were seen walking towards the Uganda border, a violent clash erupted in Juba, the capital of South Sudan. Heavy gunfire was reported between soldiers that were loyal to Riek Machar, South Sudan’s Vice-President, and soldiers loyal to Salva Kiir Mayardit, the country’s President. In the afternoon of July 12, 2016, on the same day that the photos were taken, the ceasefire between both parties was declared. As a result of the conflict 270 people died, and thousands fled, many by crossing the border to Uganda. The ones in the photos on Facebook were just a few of the many.

    Conclusion

    Sometimes the fastest way to geolocate a photo is to forget about it and instead focus on the person behind the camera. If we can track down their movements there’s a very good chance of being able to narrow down our search area. This will enable us to focus on a smaller area and get to the correct coordinates much faster.
    Would I have been able to geolocate the photos without tracking down the user? Most likely.
    Would it have taken me a lot longer? Absolutely.
    Why do the hard way when we can do it the smart way?

    I hope my explanation on how to use the check-in option on Facebook to track down people’s movements in order to geolocate their photos was useful.
    Thank you for reading!
    ~Sofia.

    P.S. Please don’t stalk people.

    , , , ,
    ,

  • How to geolocate remote villages in Afghanistan using reference maps

    Introduction

    Occasionally you will come across videos that will tell you exactly where they were filmed. You’ll get excited thinking that geolocating it will be extremely fast and easy. You jump to Google Maps, write the name of the village and nothing. Google has no idea what you mean.
    You try another similar word. Maybe another one? Nop, not happening.
    Fine! You can start with the province, move to the district and just find the village. Sorry, Google Maps can tell you the province but then you’re on your own. It has no idea where the district is located within that province and even if it did, the name you have does not match it.
    Ok, forget the district, you will just look for the specific village. You have the name, it must be somewhere! Nop, not a single village is labelled on Google Maps within the entire area of your search.
    What now?

    This exact scenario has happened to me a few times. If you are attempting to geolocate videos or photos in very remote areas of developing countries you will struggle with the lack of labelling. I wanted to show you how it can still be done, just with a few extra steps.

    The Video

    On December 18, 2022, Aamaj, an Afghan news agency, published a video on Twitter claiming that the “Taliban whipped three women and three men in Kapisa“, a province in the north-east of the country. The footage showed a large group of Afghan men in front of a building, probably in Kapisa. No public punishments were visible in the video but I was curious about the location.
    From watching the 21 second footage I can tell that it is near a mountain which would be useful if Afghanistan wasn’t made out of mountains! The building featured on the video had an interesting shape, with a bit of a curve on one of the sides but not many details visible. It will definitely be easy enough to verify from a satellite image but first we need to find the correct place. That is the tricky part.

    Below you can see the video shared on Aamaj’s Twitter account:

    Gathering more information

    Unless you have a week to waste, the name of a province is simply not enough to geolocate this video. We need to find more information about this incident. As it was a recent event, I simply searched for the name of the province, in Farsi (Kapisa, کاپيسا), on Twitter and checked all the results containing media. I quickly found the tweet seen below. The image looked like a screenshot of the video we just watched. The person that shared it also claimed it was filmed in Kapisa and was related to the whipping of people in public by the Taliban.
    However, this time, the tweet had some interesting information. It said: “The Taliban whipped four men and two women for various crimes in “Shirwani” market of Najarab district of Kapisa province.”

    The details on how many women and men were lashed were different but we don’t need to focus on that as we just want to know the location. Suddenly we know that this was (allegedly) in the Shirwani market of Najarab district in the Kapisa province of Afghanistan.
    Brilliant! Let’s Google that!

    Finding the district

    We can find the Afghan province of Kapisa without any issues by just typing کاپيسا (Kapisa) into Google Maps. Then we can start narrowing it down a bit. We can try to go with نجراب (Nijarab) which gets corrected by Google Maps to “Nijrab”. Close enough, probably the same place. We can keep going.
    Below is a screenshot of the district of Nijrab according to Google Maps. I simply searched for نجراب (Nijrab/Najarab), and کاپیسا (Kapisa), both words copy pasted from the tweet.
    I can assure you that, no matter how much you zoom in the area marked below on the map, there is not a single village labelled other than what we can see. A quick scan revealed that Shirwani, the name of the village we are looking for, is simply not anywhere to be seen.

    What now? Do we just zoom in and go through the entire area until we find a building that could match the shape of the one we are looking for? That would not only be a waste of time but also incredibly ineffective. I can already tell you that the village, and the building I geolocated, was not even located in the region marked above. I found the correct village over 20 Km to the west of the area that Google Maps claimed to be the Nijrab district in Kapisa.

    Finding the village(s)

    So if the village was not found on Google Maps how did I track it down? Just because it is not labelled on Google Maps does not mean it was not labelled somewhere else. If you are thinking about Yandex or Bing Maps you’re going in the wrong direction. Who best to know the location of small villages in developing countries other than people whose jobs depend on it? Perhaps people and/or groups that go to these countries and need to find a way to access these villages. Organisations that not only collect data, but also map and label locations, and write detailed reports that can be easily found and accessed online. I am talking about humanitarian relief non governmental organisations (a huge thanks to all their work!).

    I have often used maps from the Humanitarian Response website to find the names of small villages in various rural areas of developing countries. This website, part of the United Nations Office for the Coordination of Humanitarian Affairs, provides free and easily accessible reports on a variety of topics. For our specific geolocation we want to access their maps/infographics of Afghanistan. For that we can either select the “Afghanistan” option as seen below on the left, or the “Maps/Infographics” option on the right.

    For this tutorial let’s go with the “Maps / Infographics” option and then refine our search parameters to get all the available maps from the Kapisa province of Afghanistan, as seen below. There are only 2 files that match our criteria, one is entitled “Kapisa Province District Atlas”, and the other “Afg: Kapisa Province – Reference Map”. You can view them by simply clicking the “download button”. It will open the pdf file and you can zoom in quite a lot. It’s amazing!
    Below is the screenshot of how to find the document I used to geolocate the building in the video with the alleged lashings in Kapisa. At the search bar at the top I simply wrote “Kapisa” and then downloaded the second document on the list. It was published in 2014 but it is still extremely useful.

    Both documents contained the name and location of all the villages in this region and because it is in pdf format you can zoom in quite a lot without losing image quality. I have chosen to work with the “Kapisa Province Reference Map” document because you can see the topography of the area which will be extremely useful to us in a bit.
    If you zoom around a bit you will quickly spot a large word saying Nejrab, then a smaller word also saying Nejrab and an even smaller one saying Nijrab. At this point I just want to say: “Welcome to geolocating data in Afghanistan! If you are ever bored of easy geolocation challenges online try to find something in Afghanistan. You will never be bored again. It’s on a whole new level of difficulty.”

    Let’s examine our new map then. At first glance I would guess that the big Nejrab is the name of the district, the medium sized Nejrab is a large city, and the small Nijrab is a village. As the names of locations in Afghanistan are translated phonetically, it is very common for them to have different spellings. This unfortunately just makes our job harder (and more exciting).

    You may remember that, according to the tweet we found earlier, we are looking for a village named Shirwani, within the Najarab/Nejrab district of Kapisa province of Afghanistan. By scrolling around the area shown above, we can easily spot two areas that could be our village, as seen below. The reference map claims there is a village called Shairwani Payen and another one, further north, called Shairwani Bala, both names quite similar to Shirwani. They are also within the Nejrab region so there are very high chances one of them could be our location!

    The pdf document unfortunately does not provide satellite imagery (wouldn’t that be nice) so at this point we need to jump back into Google Maps or Google Earth Pro to find the building within the village. The problem is now locating the village since, as you may remember, this area is not labelled on Google Maps at all. But that does not mean we cannot triangulate its location based on the topography of the area.
    If you jump into Google Maps and choose to display the terrain layer you will be able to see the elevation and topography of the region. Using that information, alongside the roads seen in dashed lines in our reference map, we can quickly figure out where our villages are (probably) located.


    The map below illustrates how I triangulated and narrowed down my area of search fairly quickly. Highlighted in red you can see the road split, in green and dark blue you can see the shape of the mountains, similar in both maps. Using that information I figured out that the Shairwani Payen village was just north of the mountains highlighted in dark blue, whilst the Shairwani Bala village was east of the mountainous area highlighted in dark green. If you can read Farsi you may have noticed that the school in the middle of our Google Maps screenshot (with the “temporary closed” sign) is called “Qala Ghani Girls’ High School” (لیسه نسوان قلعه غنی). This would indicate that the location of the Qala Ghani village, also seen on our reference map, is around there. Its location is a bit off from map to map so I chose to base my search around the mountain range as it is less likely to be wrong (they don’t often move do they?).

    Finding the building

    Once we have a (limited) area of search we can switch to Google Earth Pro and scan one of the villages. We are looking for a long building near some mountains (ah!). We know that on one side of the building there is a small tower similar to a castle’s turret, and the other side of the building has a bit of an angle. It should be easy enough to spot on satellite imagery. And it was.

    I started around the area that I identified as Shairwani Bala, the northern of the two villages. I entered the coordinates on Google Earth Pro and changed the historical view to September 2018 as the other options did not provide an image clear enough. Below you can see how easy it was to spot the building (yellow arrow).

    Verifying the location

    Now that we have found our building, it is time to match all the details. For that we will compare the video where the Taliban were allegedly lashing people, and the satellite imagery from Google Earth Pro captured in September 2018. Below you can see how all the details match. Highlighted in orange on the right you can see the little turret like tower at the end of the building, highlighted in green is the tall tree behind the building, and the dark blue line highlights the unusual shape of the building.

    The image above therefore confirms that the video was recorded in the Shairwani Bala village, Nejrab district of Kapisa province in Afghanistan. The coordinates of the location are: 35.012852, 69.597979.

    Conclusion

    There are numerous open source tools that can help you navigate maps and find semi isolated and unlabelled areas of the globe. Humanitarian relief non governmental organisations do an amazing job going to developing countries, collecting data and mapping locations. Websites like the Humanitarian Response have a wealth of resources and data shared, for free, to all who want to access it. Sometimes you just need to know where to look for information.
    I hope this tutorial was helpful if you ever need to geolocate something in the middle of nowhere and Google Maps has no idea how to help you.
    Thank you for reading!

    ~Sofia.

    , , , , ,
    , ,

  • How to monitor oppressive regimes on Twitter using TweetDeck

    Introduction

    Open source data is all around us and there are endless ways to take advantage of it. Whilst there are many people working in OSINT who track down individuals, organisations, and/or locations, I do a wider version of that. My job involves monitoring, analysing and investigating conflict between countries, organised groups and/or civilians. For that I use a few techniques to gather evidence of war crimes, human rights violations, and the general “this country is being a bit naughty towards their population” data. I am sharing some of my techniques because the world needs more of us making sure oppressive regimes do not get away with it. So let’s learn how to monitor and collect evidence on Twitter using Tweetdeck.

    As there is a wealth of knowledge to be learned on this topic I wanted to keep it simple so that you can learn the basis and then expand that knowledge however you want (please don’t do anything illegal). Therefore this blog entry will only focus on how to monitor a specific country and on a small number of topics. For that we will be using a free Twitter web-based dashboard, Tweedeck.
    I have chosen to pick the Islamic Republic of Iran for this blog entry because it fits various criteria that will be useful for us: it is an oppressive regime, there is an ongoing conflict between the population and the regime, and it has a language I cannot read (I like a bit of a challenge).

    A quick note before we start. When investigating and collecting data on oppressive regimes you can expect to find content that may be distressing. I will not share any graphic content in this blog but if you put into practice what I will explain below, there is some chance you will see graphic content. Make sure you are comfortable with it before jumping from the theory to the practice.

    Twitter and TweetDeck as a monitoring tool

    Twitter is a huge social media platform where millions of users share content daily. Although many see it as a place to connect with others and share opinions, memes, or news, it is also a valuable tool for millions living under oppressive regimes. Twitter gives victims all over the world a platform to share evidence of the crimes committed against them. This can often be done in real time, and within the safety of anonymity. Eye witnesses can share footage, photos, and/or audio files in the hopes of it breaking out from the control of their oppressive regime.

    TweetDeck, a platform owned by Twitter, can be used as a dashboard to track down, in real time, any content, claim, and evidence shared by people anywhere in the world. This data is then collected, verified, and analysed by people like me, open source investigators trying to bring accountability to authoritarian regimes, and justice for its victims.
    Below you can see a (censored, sorry) sample of my working TweetDeck. I have between 17 to 32 columns at all times tracking down, in real time, everything that is happening within a certain country. The chances of seeing a dead body at any given day is 99%.

    Setting up your TweetDeck

    Let’s start from the beginning. If you go to TweetDeck.com, you will first need to login with your Twitter account so they both connect. Afterwards this is what you will see; a dashboard with a column for “Home”, one for “Notifications”, a column for “Messages” and the last with the “Trending” hashtags. As I am using a sock puppet account everything is blank.

    Let’s just start by removing all of the columns. I want a blank slate as none of it is of any use for us now.
    First we select the icon at the top right, highlighted in orange. This will bring up some options and at the bottom of the new window we have a “Remove” option, highlighted in dark blue. If we do it for all of the columns we will end up with a completely blank dashboard.

    Then it is time to start rebuilding it all over again. You can click the “+” button (highlighted in green below) on the left bar and select what type of column you want to add. There are only two types that are of any use to us: lists and searches.

    Lists vs Searches

    The difference between lists and searches is that on lists you are tracking down users and on searches you are tracking down content. You may have noticed on my working TweekDeck screenshot above that I have only one (visible) column with a list, highlighted in pink below, and a huge number of “search” columns, highlighted in yellow. This is because targeting content is much more useful when the goal is to gather evidence. However I am also very interested in what certain accounts have to say about certain topics so lists come in handy as well.

    Often in oppressive regimes people send their photos/footage/audio to trustworthy journalists or news agencies so that they share the evidence with their wider audience. The population benefits from the source protection, one of the main pillars of journalism ethics, and the news agencies benefit from the access to this exclusive content. For that reason one of my lists is composed of various journalists and news agencies that I know will share content that is often against their regime. In case you are wondering why they are allowed to spread content against their authoritarian nation, they are not. Many are imprisoned, tortured, and killed. Their courage in the face of their situation is commendable. It is because of many like them that we get to see the reality of how many countries treat their population.

    How to create a Twitter list and what to include

    In order to create the list you just need to follow the obvious steps. Click “+” and “add column”. Afterwards select the “List” option and “+ Create List”. Now comes the most important piece of information when creating lists. Mark it as private. This will ensure that no one knows who you have added or removed from your lists. These accounts will never be informed of your actions and you remain absolutely anonymous. If you were to have your list set to public, the accounts you add would receive a notification. This would enable them to quickly block your account and you would lose access to their content. We don’t want that. Sneaky is good.

    In addition to having a list with journalists and news agency accounts, I also find it very useful to have lists with “official government accounts”. Often when something big happens these will release “official statements” so having a column that gathers them all is very handy. They are useful in a situation where there is a claim against the government’s action (or inaction).
    Take Iran for example. Imagine there’s a protest and users online are claiming the government used violence to disperse the population. An official government account releases a statement denying any use of violence. One of our “search” columns then provides us with photos from a variety of angles with government bodies (police, military, etc), threatening and hitting civilians. We can then put all of these pieces of evidence together when writing an OSINT incident report. It is a bit like “I’m not saying you are lying, but we have proof that you are lying..”

    How to create a Twitter search string and what to include

    Unlike lists, the “search” option focuses on the content, not the user behind the tweet. Ultimately it will not matter if the piece of evidence is being shared by an account with thousands of followers, or by a brand new user with one tweet. If the keywords match our criteria, we will find it. And if we can find it we can archive, verify, and analyse the evidence.

    As mentioned in the introduction, I monitor and investigate naughty nations. I mostly gather and analyse evidence on a variety of topics from protests, assassinations, torture, executions, terrorist attacks, etc. It is quite a wide range of dark subjects but let’s start with a “lighter” topic for now and ease into the darker ones in a bit. Let’s go with protests.

    When searching for information on Twitter I find it easier to stick to the “where AND what” rule. So whatever string of keywords I choose to combine must have the specific location, and what I want to find in that location.

    Practical example

    • Where – Let’s pick the three most populated cities in Iran: Tehran, Mashhad, and Isfahan.
    • What – Now we add what we want to monitor there: protests.
    • Our search term will end up being something like “Tehran AND protest”, “Mashhad AND protest”, and “Isfahan AND protest”.

    Note: The “AND” is a boolean operator and must be written in all caps.

    But Iran doesn’t really have English as an official language does it? So let’s change all of this to Farsi, the country’s official language.

    • Tehran AND protest — becomes — اعتراضات AND تهران
    • Mashhad AND protest — becomes — اعتراضات AND مشهد
    • Isfaham AND protest — becomes — اعتراضات AND اصفهان


    We do not want to have a column per search or we will end up with far too many columns. So let’s put it all together on a longer string. For that we will introduce two new features: the parenthesis and the OR operator. The parenthesis will divide each section like a mathematical equation, and the OR will tell the search engine that you want to search for various options. A bit like giving someone a shopping list that says “white OR brown bread”. It means that you want to receive at least one of the options. You will be happy with either. Same applies here.
    You can tell Twitter’s search engine something like: (Tehran AND protest) OR (Mashhad AND protest) OR (Isfaham AND protest). This string will search for any of these options and give you the results that contain at least one of the criteria.

    Note: The “OR” is also a boolean operator and must be written in all caps.

    You can even improve the string a bit more to make it use less characters, as seen below.

    Our boolean search with the three Iranian cities and the word “protest” can go from this:
    (Tehran AND protest) OR (Mashhad AND protest) OR (Isfaham AND protest)
    (اعتراضات AND تهران) OR (اعتراضات AND مشهد) OR (اعتراضات AND اصفهان)

    Into this:
    (Tehran OR Mashhad OR Isfaham) AND protest
    (مشهد OR مشهد OR تهران) AND اصفهان

    Can you see how you will get the same results but the string is shorter and more concise? There is no need to repeat the word “protest” three times when we can just tell the search engine to circle through the cities one by one and see if it can find the name of the city plus the word “protest” on each tweet using a much smaller string.

    But we do not want to just monitor three cities do we? We want the entire country!

    Defining locations to monitor

    To obtain information about Iran as a whole we can focus on provinces. Iran contains 31 provinces so I gathered the list from Wikipedia to create a string that can cover the entire country. But suddenly there is a small issue. Some of the provinces’ names contain more than one word such as South Khorasan or Sistan and Baluchestan. If we put (South Khorasan AND protest) on Tweetdeck search it will give us results that match either South AND protest, Khorasan AND protest, or South Khorasan AND protest. It will not interpret South Khorasan as one string, but as two different keywords. We can solve that by adding the quotation marks to force the search engine to recognise “South Khorasan” as one entity.

    If we put all of the knowledge above together we can create our first search column targeting protests in any Iranian province.
    This is what it would look like in English:

    (Alborz OR Ardabil OR Bushehr OR “Chaharmahal and Bakhtiari” OR “East Azerbaijan” OR Isfahan OR Fars OR Gilan OR Golestan OR Hamadan OR Hormozgan OR Ilam OR Kerman OR Kermanshah OR Khuzestan OR “Kohgiluyeh and Boyer-Ahmad” OR Kurdistan OR Lorestan OR Markazi OR Mazandaran OR “North Khorasan” OR Qazvin OR Qom OR “Razavi Khorasan” OR Semnan OR “Sistan and Baluchestan” OR “South Khorasan” OR Tehran OR “West Azerbaijan” OR Yazd OR Zanjan) AND protest

    You can see above how we have several province names in quotes to keep the keywords unchangeable, we have the parenthesis keeping them all together in one set, we have the OR operator so that the search engine can circle through the list and see if any matches, and we have the AND operator to force the results to find the word “protest” within the tweet.
    And this is what it would look like in Farsi:

    (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND اعتراض

    We can then keep on adding terms to make it as inclusive as possible. We already have all the provinces but our only one term to match with them: protest. Let’s think of other ways we could see it referred to. I often just look at similar tweets to see what keywords they are using and add it to my search. In this case we can have a list of related keywords such as: protest (اعتراض), protests (اعتراضات ), demonstration (تظاهرات), uprising (قیام), march (راهپیمایی), and revolution (انقلاب).
    Let’s add the new keywords into our search string. This is how it will end up looking like:

    (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (انقلاب OR راهپیمایی OR قیام OR تظاهرات OR اعتراضات OR اعتراض)

    How to create a TweetDeck search column and what settings to use

    So let’s (finally!) test it on TweetDeck by starting a new “search” column and what we wrote above. You simply click the magnifier symbol on the left and copy paste the string to the search bar. This is what we’ll get:


    But there is a problem. I still can’t read Farsi and it would take me forever to translate all the tweets one by one. Fortunately I am not interested in any text, I want to see visual content. So let’s adjust this a bit by clicking the symbol highlighted as yellow below followed by the down arrow symbol, highlighted in red. Afterwards you’ll see the options in the middle picture below. By default the search column will show “all Tweets”. We can change this option to show “Tweets with any media”. This will ensure that all the results will have photos or videos.
    Suddenly our column (right image) is showing a video of a protest! The result below was from a protest today, December 17, 2022 (time of writing), in Tehran. Allegedly the protesters are shouting “Death to the dictator”. If you keep scrolling you will keep finding more and more videos and photos of protests from any of the 31 provinces in Iran. It’s a gold mine.

    Populating TweetDeck

    Once we know how to create a good search string, we can apply it to any other topics following the same formulae: where AND what.
    So what else would we want to monitor in a country with a history of being authoritarian and oppressive towards the population? I would start with the protests and arrests. Definitely throw in some torture and executions to monitor claims and collect evidence of human rights violations. As we know that the protests started with women we will also need to add a column on it. And then to end let’s just keep an eye on any mention of the regime from a negative point of view.
    In practical terms we would end up with these topics and these keyword variations:

    • Protests — protest (اعتراض), protests (اعتراضات ), demonstration (تظاهرات), uprising (قیام), march (راهپیمایی), revolution (انقلاب)
    • Arrests — arrested (دستگیر), taken away (برده شده), prison (زندان), kidnapped (ربودند, ربوده)
    • Torture & Executions — torture (شکنجه), execution (اعدام), murdered (کشته), sentenced (محکوم), corpse/dead body (جسد)
    • Protesters/Women — woman (زن), women (زنان), girl (دختر), girls (دختران), protester (معترض), protesters (معترضان)
    • Regime — regime (رژیم), dictator (دیکتاتور), tyrant (ستمگر), repressive (سرکوبگر)

    Now we need to combine our new keywords with the list of provinces.
    This is the final result for each:

    • Protests: (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (انقلاب OR راهپیمایی OR قیام OR تظاهرات OR اعتراضات OR اعتراض)
    • Arrests: (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (دستگیر OR “برده شد” OR زندان OR ربوده OR ربودند)
    • Torture & Executions: (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (محکوم OR کشته OR اعدام OR شکنجه OR جسد)
    • Protesters/Women: (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (دختران OR دختر OR زنان OR زن OR معترض OR معترضان)
    • Regime: (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (رژیم OR دیکتاتور OR ستمگر OR سرکوبگر)

    Let’s now populate our TweetDeck dashboard by creating one column per topic by simply copy pasting each of the strings above and select to show “Tweets with any media”. I also decided to create a final column with just the names of all the provinces just in case something pops up that I have not covered yet. This is how my TweetDeck looks once I am done. You can see various videos of protests, three in Tehran and one in the Kermanshah province. There’s also coverage of a prison riot in Kara, Alborz province, and a wreath with a photo of a young man allegedly kidnapped, tortured and killed by the government in Bandar Azali, in the Gilan province.

    Conclusion

    And this is how you start monitoring an oppressive regime for possible human rights violations. Twitter is an amazing platform used by many to publicly expose the inhumane activities of their government. The TweetDeck dashboard is, in my opinion, the best way to keep an eye on what millions of courageous people are sharing with the rest of the world. We just need to pay attention.
    The possibilities are endless and it is up to you what topics you want to monitor and what keywords you want to track down.
    As mentioned above, my working TweetDeck has a base of 17 columns but often that number goes much higher depending on what I am investigating. On average I would say I have around 22-25 columns in which I monitor what is happening in certain regions of the globe.
    I hope this tutorial was informative. This is just the tip of the iceberg but it is a great way to start creating your own monitoring stations. We do not need to wait for the media to give us the news, we can get them ourselves directly from the source.
    Stay safe out there.
    Thank you for reading.

    ~Sofia.

    , , , ,
    , ,

  • Geolocation of a torture chamber in Balakliya, Ukraine

    (Click here to watch and listen to the video version of this blog entry)

    Warning: Please be aware that, as the title indicate, this blog entry will cover the topic of torture. The focus will be on the geolocation of the building but I felt a warning was necessary. I will share a photo of the alleged torture chamber, and a video which will include an interview with a victim. The person appeared to be safe and visibly unharmed at the time of the interview but proceed with caution if you find this type of content distressing.

    Introduction

    With the retreat of the Russian troops from Kharkiv Oblast in the second week of September 2022, several occupied towns and villages were liberated. Similarly to what happened in Bucha, this resulted in the discovery of evidence left behind of the atrocities committed at the hands of the occupiers. According to a statement by Zelensky, the Ukrainian President, published on September 17, 2022, “more than ten torture chambers have already been found in the liberated areas of Kharkiv region”.
    Balakliya (Балаклія), a town located between Izyum and Kharkiv, that had been conquered by the Russian forces on March 3, 2022, and retaken by the Ukrainian military on September 9, 2022, was amongst them.

    The Torture Chamber

    On September 13, 2022, a photo of the inside of the alleged torture chamber in Balakliya was shared on Twitter. The image shows some text carved on the wall, and what it looks like a structure with two beds in a dark lit room.
    In case Twitter goes down and the image below doesn’t show up, here is a screenshot and the archived tweet.

    The Ukrainian Minister of Defence claimed on the following day that the text on the wall was a prayer but, as always, it is important to double check everything. As I can’t read Cyrillic I used Google Lens to help me out. I quickly screenshot the text from the tweet and dragged it to Google Images. Afterwards Google Lens just kicks in and you are given a few options underneath the image. You can either select “Text” to read the writings in the original language, or you can select “Translate” to have it translated to a language you understand. As you can see from the translation below, it struggled a bit but managed to do a pretty good job.

    Although it seems clear that this is the Lord’s Prayer, we can quickly do a triple check. For that you can click the “Text” option, then the “select all text”, and check the Google search results. The first result leads to a bible website with the prayer in Russian. It claims this passage is from Matthew 6:9-13 which is, as predicted, the Lord’s Prayer.
    It is not clear whether or not the text was there before the invasion, however, it is claimed by the Ukrainian Ministry of Defence that it was “carved on the wall by Ukrainian prisoners“.

    Gathering Additional Information

    As you may guess, geolocating a dark room would be a pretty hard task. In such cases you will need to dig for more information to get additional evidence that can help with the task at hand.
    For that I went to Google Images and searched for “Balakliya torture chamber”. I was hoping to spot images of the same room from a different angle and, with a bit of luck, more information about the location. I immediately noticed a similar photo with much better lighting where you can see the same wall with the prayer. The link leads to an article by The Guardian published on September 14, 2022, entitled “Ukraine’s officials claim to have discovered ‘torture chamber’ used by Russian troops“. We are on the right track!

    The news article mentioned how one of the town’s resident talked to the BBC about this torture chamber. The text contained a link to the BBC article, as seen below, so I followed it.

    The BBC article itself did not have any useful images that could help me geolocate this torture chamber however, it had enough information for me to keep digging. The article provided some extra keywords and details that, until now, I did not have. For example, now I had the name of the news correspondent that went to the town of Balakliya and talked to the people.

    Excerpt of the BBC News article entitled “Ukraine war: Accounts of Russian torture emerge in liberated areas”. Highlighted the name of the news reporter.

    I also know that, quite often, reporters will provide some little bit of extra information on their personal accounts and, most of them, will have a Twitter account. Time to test that theory. It was actually pretty straightforward to find the Twitter account of Orla Guerin as it is just her name, as seen below.

    At this point there are several ways to find out if she shared any tweets with information about this news story. You can either scroll through her tweets until you end up at around the date you know she was in Balakliya, you can use Twitter advanced search to narrow down your options by imputing her account name with either the date range or relevant keywords, or you can just Google it.
    I am a big fan of just googling everything. In order to find out if Orla Guerin mentioned the town of Balakliya in her tweets, I simply wrote “balakliya site:https://twitter.com/OrlaGuerin“. This search string will give me all the results containing the word “Balakliya” from Orla’s twitter account.

    The first result immediately takes me to a BBC News video at the liberated town of Balakliya. Within the first seconds of the footage the narrator says: “Ukrainian police lead us to a crime scene. It is inside their own former police station“. Great find!
    If the tweet below is not longer available, here is the archived video.

    We can confirm that we are, indeed, in the correct location, as Orla Guerin shows the viewers the wall with the Lord’s Prayer at the 0:49 min mark, as seen in the screenshot below.

    At this point we have very important information to help us geolocate this torture chamber. We know that it was located in the town of Balakliya and, according to this new found piece of evidence, it was inside the former police station.

    Geolocation

    Although we have enough to start looking at a map, we still need more because, what we have so far, is footage of the inside of the police station. There is some chance that, if we find the location of the police station on Google Maps, there won’t be any pictures of the inside of the building. And, even if there are, it is likely that the rooms would have looked very different prior to their conversion into an alleged torture chamber. As much as I would love for the Russian soldiers to submit evidence of war crimes to Google Maps, chances are they are not that stupid (one can still hope though).
    So we need to keep watching the video and see if we can spot an image of the outside of the building that could help us visually confirm the location on a map. And at the 1:43 min mark this is the frame we see below. The presence of a war crimes prosecutor (left) is seen near the alleged Police Station building (right) where a large group of people are gathering.

    The group of people are in the same location seen in the footage starting at the 1:04 min mark where investigators and the media are gathering near one of the torture victims. I will not share the screenshot of that time frame as there are many faces visible and people are entitled to their privacy but you are free to check for yourself that it is the same location in both time frames.
    Now that we know how (part of) the building looks like we can finally jump to Google Maps and search for the local police station.

    I tested and both “Balakliya Police Station” and “Балаклійський відділ міліції” (Ukrainian translation) leads to the same location so it seems that Google Maps is quite certain on this being the correct place.

    Unfortunately, as expected, there are no photos of the inside or outside of the building. However, if you grab the pegman (the little yellow figure) and drag it around you will see that there is an available panoramic photo around 76 metres from the police station, as seen below. It could be too far but it is always worth giving it a go.

    And as you can see from the screenshot below of the panoramic photo, it is not too far. The building can be spotted in the distance, if you are facing South-West.

    Verification

    At first glance it looks like the same building but let’s compare it to the one we saw in one of the frames of the BBC News footage. Below, on the left, a screenshot of the BBC News video (archived) at the 1:43 min mark, and on the right the zoomed in image of a panoramic photo near the building. It is a clear match. The design at the top of the police station building, highlighted in light green below, is exactly the same in both images. In addition to that we can also spot the presence of the two trees, one inside the gate, highlighted in pink, and a bigger one, highlighted in dark blue, on the right hand side of the building.

    We have therefore established that this is the correct place and the torture chamber in Balakliya was located in the former police station building at the 49.452032, 36.843793 coordinates. If we want to be even more specific, we can try to figure out, based on the BBC News footage, which part of the building the people were going in / coming out for the exact location of the torture rooms. At this point it is not necessary but if you want an extra challenge go for it, there are a few clues around.

    Conclusion

    Relying on just a photo is sometimes not enough to geolocate a piece of evidence. Often you will need to gather more data to establish a possible location and, later on, justify your findings. Without verification you don’t have a geolocation, you only have a guess.
    I hope this blog entry gave you some ideas on how to find that extra bit of information needed to prove, without any doubt, that you have the correct location.
    Thank you for reading!

    ~Sofia.

    , , , , , ,
    , ,

  • Are orphaned Ukrainian children being flown to Russia to be adopted?

    (Click here to watch and listen to the video version of this blog entry)

    Introduction

    Occasionally you will come across some video online that catches your attention and suddenly you want to know more about it. It happened today (September 17, 2022) as I spotted a reddit post sharing a 1-minute video claiming to depict orphan children being taken from Ukraine to Russia “for their own good“. I have previously investigated and written a report on the forced deportation of Ukrainian civilians to Russia so this is something that I was definitely interested in checking out.

    The Video

    Below is the screenshot of the video posted to the Ukraine subreddit on September 17, 2022. In case the post gets deleted, here is an archived version.
    The footage started with a clip of an aeroplane with the Russian flag allegedly carrying dozens of Ukrainian children. Based on their size and appearance I would say that their ages ranged between 5 and 12. The footage showed them being escorted out of the aeroplane accompanied by a few adults. The video then panned to a woman who claimed that “120 children have arrived on the territory of Moscow“. She added that the group would be spread out to 13 regions of Russia and there were already plans for a next batch of children.

    Screenshot of the reddit post showing a video of allegedly Ukrainian orphans being taken to Russia.

    Questions

    After watching the video I was interested in finding out the answer to a few questions:

    • Was this footage recent?
    • Were the children really Ukrainian?
    • Were they really orphans?
    • Were they really being taken to Russia?

    Basically I just wanted to know if the post caption and information on this video were reliable.
    For that we only need to use search engines.

    Searching for an image

    The first thing I noticed was a logo at the top right of the video. This indicated that it probably came from a news agency so we might be able to find it.

    Screenshot of the video. Red arrow points at the logo in the corner.

    I took a screenshot of the logo and did an image reverse search. I always go with the top-3 search engines: Yandex, Google, Bing. The results are always vastly different and if one doesn’t catch it the other one usually does.

    Yandex was, as expected, the best one as it is a Russian search engine. On the search results, seen below, you can immediately spot the “iz.ru”. This tells us that it is a Russian website and since we already have the web address we can just write it on the address bar and check it out.

    Going to “iz.ru” confirmed that this was indeed the correct website as the logo and colour scheme was everywhere. Now I just need to find the story about the Ukrainian orphans being taken to Russia.
    I don’t like wasting time scrolling around a website, especially as I can’t read Russian and I do not know if this was even recent footage. The video could be anywhere within the website.
    So let’s target our search.

    Searching in a website

    We know what we are looking for: Ukrainian children being taken to Russia; and we know where we are looking for it: iz.ru website. We also know that the website is, as expected, written in Russian so let’s quickly jump to Google Translate.
    I like to keep it simple so I translated what I knew from the video. I went with “ukrainian orphans”, “airplane”, and “moscow”. I always separate keywords / key phrases in different lines so that Google does not attempt to translate it as a complete sentence and mess it up. The result of the translation can be seen below.

    I did not want to search for “украинские сироты самолет Москва” as it would give me results from anywhere on the clearnet. I wanted Google to just provide me with results from the iz.ru website as that was my target location. For that I had to specify in the search bar the website by adding a “site:iz.ru” (no space between the “site:” and the “iz.ru”).

    The full search term was “украинские сироты самолет Москва site:iz.ru”.
    Below you can see how all the search results provided by Google are from the iz.ru website.

    The first link claimed to be an article published “1 day ago” and since I was expecting a recent news article with a video I went with that one.

    The news article

    I can not read Russian so I just used my very handy Google Translate chrome extension to translate the entire page to English.

    The news piece title said “Children’s Ombudsman Lvov-Belova brought more than 100 orphans from the DPR to Russia” and had a photo of the same lady we saw in the video. A quick google search with the name “Lvov-Belova” provided extra evidence that this was the same person. Below is a comparison between the woman seen in the reddit video (left) with a photo at the top of the IZ news article about the Ukrainian children being taken to Moscow (right).

    In fact, if you kept scrolling the news article you would see three videos. The first one where Ms Maria Llov-Belova talked to the camera as seen on the reddit footage, the second of the plane arriving with the children, and the third of what looked like a press conference.
    The news article claimed that the group was comprised of 125 Ukrainian orphans, between the ages of 3.5 and 17 years old, some disabled. According to the text they were taken from the Donetsk People’s Republic, and flown to Moscow on an aeroplane by the Russian Aerospace Force on September 16, 2022. They were allegedly given Russian citizenship and would be placed under guardianship of Russian families “in the near future“.

    Extra information

    Out of pure curiosity we could also check some of the footage details to confirm the information provided in the article and videos. The news piece claimed that the Ukrainian children arrived on an aeroplane by the Russian Aerospace Forces. Several clips from the second video provided useful details that confirmed that. You could see a couple of aircraft identifiers such as the aeroplane model (Ty-154M / Tu-154M) indicating that this was a Tupolev Tu-154M aircraft, and the registration number was “RA-85123” if you want to (attempt to) track it down. You could also see the children being greeted at the door by men in uniform. A google image reverse search of the insignia on their arms revealed that this was, indeed, a patch worn by the Russian airforce personnel.

    The answers

    Now that I have found where the video clips originally came from, read the information on the news article, and verified the content, I can answer the questions I had at the beginning, to the best of my knowledge:

    • Was this footage recent? – Yes, from September 16, 2022.
    • Were the children really Ukrainian? – Yes, from the Donetsk region.
    • Were they really orphans? – Yes, allegedly.
    • Were they really being taken to Russia? – Yes, Moscow initially.

    Conclusion

    This small search concluded that, unfortunately, it was true and orphan children were being taken from Ukrainian territory into Russia to be naturalised and adopted into Russian families. According to the article, many of the orphans had already been separated from their siblings.
    This was not the first group of children to be forcefully evacuated into Russian territory and, unfortunately, it would not be the last.

    Thank you for reading!
    ~Sofia.

    , , , , ,
    , ,

  • Geolocating school girls in Paktia, Afghanistan

    (Click here to watch and listen to the video version of this blog entry)

    Introduction

    So far I have been focused on writing about geolocations in Ukraine, which tend to not be too hard. I wanted to show how different things can be when there is no recent satellite imagery, google streetview, or local business photos to rely on. Therefore, for this blog entry I will be using a video of school girls protesting in a province in Afghanistan.

    The Video

    The footage I geolocated was published on Twitter on September 10, 2022, and depicted a large group of girls walking along a road. It does not present much information behind their actions so we will need to find that out ourselves. Context behind photos and videos can often help with geolocation.

    Unfortunately the tweet has since been deleted but I always plan ahead and saved a copy for myself alongside a screenshot of the original tweet (plus archived it!). Always remember to save your evidence for situations like these.

    Below is the video saved to my YouTube account. I suggest muting before playing it as it is quite loud and the sound won’t help with the geolocation anyway.

    Context

    Whilst in some online content the user will give a general area of where the event took place, sometimes you are not that lucky. The video above said nothing about its whereabouts so we need to look for clues elsewhere. The first thing you could do is look at the language used by the person sharing the video. Twitter is quite useful in terms of translations as it contains Google Translate embed so you can simply click the “Translate Tweet” button and see what it says in your selected language.

    When translating the text you will also find out, if you did not know already, which was the original language of the message. In this case, the tweet had been written in Pashto, one of the official languages of Afghanistan and Pakistan. Below is a map showing the areas in which Pashto is predominantly spoken.

    We can also quickly note that the tweet was shared by a pro-Taliban user as seen below. You can verify that by the presence of the Islamic Emirate of Afghanistan flag on their profile photo and the many Taliban men on their banner. That alone already leads me to believe that the user will most likely be sharing content from Afghanistan and not Pakistan.

    Now that we have some extra details we can just add it all together for a quick google search. Something like “Afghanistan girls street” is already enough for google to point you in the right direction, as seen below.

    And within a few minutes you went from not having any information about the video to knowing that this footage was probably of a girls’ protest against their school closure in Paktia, an Afghan province. The little preview of the news article from Al Jazeera even tells you that it happened in the city of Gardez.

    And here is the full context of this story:
    In March 2022, schools for female students above 6th grade were closed throughout Afghanistan denying girls access to formal education. After pressure from local people in Paktia, a province in the East of Afghanistan, bordering Pakistan, several girls’ schools reopened allowing girls to resume their education. Unfortunately, as this was done without the knowledge of the Taliban government, shortly after media coverage of the situation, the schools were ordered to be closed again.
    On September 10, 2022, as many girls in Paktia found out that their school gates had been closed again, they marched the streets in protest against the decision. The 29 second video shared on Twitter shows dozens of girls, wearing their school uniform, walking along a street in Gardez, the capital of the province of Paktia.

    Geolocation

    Now that we already have a city to focus on we can try to see if there are any details in the footage that would help us narrow down our search even more.

    There’s a few things we can see in the video that may help us geolocate the footage but, as you may have already noticed, there is very little to go with. The video shows dozens of school girls walking on a wide paved road, there’s a long building across the street and in front of it a row of tall trees. Right at the end of the video the person filming pans to their side of the road where you can see an interesting building behind the girls and more tall trees next to the road. We already know that this protest happened in Gardez which is a big city. There is quite a large area to cover in search for big roads with trees and buildings. Or is it?

    As mentioned, at the 13 second mark you can spot a tall and interesting building on the side of the road where the person filming is standing. At first glance it looks quite a modern structure and, because it is very tall compared to the surroundings, we might be able to spot it somewhere else.

    In Afghanistan, like other similar countries, Google streetview is almost non-existent. In addition to that there is a very limited amount of panoramic images or user generated content available on Google Maps to help geolocate data. But there is a great tool you can use instead: YouTube!
    If you were expecting something obscure I must disappoint. YouTube is great to find (high quality!) footage of almost every single big city in Afghanistan. They either come in the form of drone footage (seriously!), dashcams, or local reporters talking to street vendors. I cannot overstate how amazing YouTube is to find current and high quality footage of streets in Afghanistan.

    I simply searched for Gardez in Farsi (ګردېز) and got several useful results of the city, one of which the video highlighted below.

    The video had been submitted in November 2020 and was about how the ancient building of Bala Hesar in Gardez was in danger of collapsing. Absolutely nothing to do with school girls’ protests but I wasn’t after that anyway. I wanted to look at buildings. See if you can spot the one from the footage of the Afghan girls on the frame below, taken at the 19 second mark.

    And here it is the building I was looking for. Below, on the left, the partial image from the girls protesting footage, and on the right the image from the YouTube video. The same building.

    So now that we know that the building is somewhere in Gardez we still need to locate it. Luckily for us the YouTube video gave us a pretty good view of the city and, not only showed an iconic monument, it also named it for us in the title as “Bala Hesar”. This will be quite easy now.

    We can simply locate the name of the monument in the description of the video (“ګردېز بالاحصار” which translates to “Gardez Balahisar/Bala Hesar”), and ask Google to point it out for us on Google Maps.

    Now we can jump to Google Earth Pro with the coordinates so that we can rotate the camera easily to locate the monument, and afterwards try to spot the building seen in the girls video. It doesn’t take too long to find the specific shape of the monument wall (red) and line it in a way that I can see the street next to it (green).

    Now that I know the general direction where the building from the school girls video should be, I can just navigate slowly until I track it down. You can see it highlighted in dark blue in the image below.

    If we really zoom in on the building and check the various satellite images from all the historical photos available on Google Earth Pro, we can really get an idea of the shape of the structure. Below are the four best images.

    As always, after geolocating something we need to verify it in order to establish without reasonable doubt that this is, in fact, the correct location of the school girls video.

    Verification

    Comparing the frame from the school girls’ protest (top) and a satellite image taken of the area in October 2018 (bottom) we can establish that this is indeed the same location. The shape and details of the building match (purple), the specific tree with an interesting outline (blue) also matches and, if you were to locate the nearest high school you would find out that there are a few nearby, one of which is a girls’ school from the direction where the girls were coming from.

    Comparison between the details of the protesting school girls’ frame (top), with the historical satellite image from Google Earth Pro (bottom).

    Final coordinates of where the girls were seen in the protesting video in Gardez, Paktia province of Afghanistan on September 10, 2022: 33.601136, 69.226070.

    Conclusion

    YouTube can be your best friend when Google is not there for you (as if they are not owned by the same company). I hope you remember to give it a go whenever you need to find footage from locations where streetview is not available as I can almost guarantee that someone, somewhere, filmed something nearby. The trouble is going through endless videos looking for very specific buildings but I like the challenge that comes with it and I hope you do too.

    Thank you for reading!

    ~Sofia.

    , , , ,
    ,

  • Geolocation of an old ISIS execution video in Iraq

    (Click here to watch and listen to the video version of this blog entry)

    Introduction

    Every so often people reach out to me online and ask for help with something OSINT/GEOINT related. I am always happy to help, especially because it often ends up with me learning something new along the way. Recently I was asked to assist in finding a pool in Mosul, Iraq. I was not given any more information at first so I gave some pointers on how to do it and got curious. Next thing I know I am being given a link to an old YouTube video with some clips where a pool is visible. It turns out it was not just an ordinary pool but one where an ISIS group put prisoners in a metal cage and lowered them into the water to drown them. If you are uncomfortable with this sort of content please skip this blog entry. I made sure to keep the details and photos as minimally impactful as possible but the reality of it might still be too much for some people, and that is ok.
    This blog entry contains an explanation on how I went from that initial clip to finding the exact location of the featured pool in a few hours. I will not skip the parts where I got lost and went off track as this is not a tutorial on how to do it but an explanation on how I did it. Geolocating and investigating data is not always a straightforward path and it is important to embrace the mistakes we make along the way.

    I have also not included any links or coordinates to anything due to the nature of the content.

    The Video

    As mentioned above, I was given a YouTube link with clips of the ISIS execution. The video itself was surrounded by adverts, and had several details covered by text and banners so I really needed to find something clearer and better quality. Below is a screenshot of the footage to give you some idea of what I am attempting to describe.

    Screenshot of the ISIS execution YouTube video I received.

    As you can imagine the first point of action was to try to find a much better quality of the ISIS execution footage to see if there are any details I could use to help me geolocate this pool in Mosul, Iraq. Long story short, I did find the full video and managed to save it to my computer. If I was not already on some list I am pretty sure I am now!

    Unfortunately the footage itself had very little detail on the surroundings but that never stopped me. I gathered six screenshots that I felt contained relevant information of the pool and area around it in order to help me find its location. Below are the images I saved. I censored them but you can still get an idea of what I was working with.

    Screenshots of the ISIS execution video.

    Although at first glance there is not much to start with, if we look closely there are a few useful details that will definitely help me verify the location (once I find it!).
    The top image on the left is, in my opinion, the best one so let’s really look into it.
    Below you can see all the information I gathered from that one screenshot.

    Screenshot of the ISIS execution video with details highlighted.

    1 – Corner of a building with a roof that overhangs. It has vertical markings on it and seems to be grey in colour.
    2 – Cream / orange coloured building. There seems to be some sort of “T” shape marking on it. Some tall vegetation or a small tree in the front.
    3 – Narrow path surrounding the pool. A small wall behind, made of vertical bricks. Dark blue and slightly aged. Contains vegetation behind it, probably grass.
    4 – Circular shape that goes into the pool. Could be a small structure in the pool such as a fountain or statue, or the border of the pool. The pool in the video will either not be straight edged or will contain something in it.
    5 – Pool ladder on the same side as the building (1), a few metres from it.
    6 – Tall wall, definitely over 2 metres high. Privacy or protection? There’s some patterns on it.
    7 – Big tree. It wouldn’t be interesting if I was looking at the Amazonian Forest but as my target is, allegedly, located in Mosul, a huge city in a semi arid climate location, this is quite striking as trees can be seen on satellite imagery.

    Gathering Information

    As I have mentioned in many of my geolocations before, I do not particularly like going straight to Google Maps / Earth Pro and start scanning the area without having first an idea of “where”, “when” or “what” I am looking for. I already have the “what” but not the “when” or “where”. Mosul is the second biggest city in Iraq and would take quite some time to scan the entire place. Instead I would rather spend some time collecting more data about this incident. Things also change a lot over time so the “when” is vital as well.

    The When

    In order to find out when this incident happened I started trying to find out when it was first mentioned / shared online.
    I compiled a few descriptive keywords of what I was watching in the footage and googled them. I mostly used a variety of combinations of the words “ISIS”, “Daesh”, “cage”, “prisoners”, “pool”, “Mosul”, “Iraq”, in several different languages (never stick to just English!). Afterwards I collected all the articles, videos, online mentions, and started noting down the dates. Although the most mentioned date of the event was June 23, 2015, I actually found an article with screenshots, allegedly published in May 2015.
    A little trick I use when looking at dates of published articles online is to inspect the page code as the author could very easily claim the article was published on a date that does not match your evidence.
    Below is one of the articles about the ISIS execution, in Arabic, published on June  23, 2015. You can verify the date by right clicking the page and selecting “inspect”. Afterwards either search for the word “published” or start typing “201” or “202” for the correct decade. According to the source code, the article screenshot below was published on June 23, 2015 at 17:30 in a country with a timezone +3 GMT.

    Verification of the date of a published article by inspecting the source code.

    At this point I am confident enough that it mostly likely happened in May/June 2015. I could not find any other mention of it earlier than that, and I could not fully verify the May 2015 date so I am going to work with the assumption that it happened within that month. It is good enough.

    The Where

    Now begins the fun part where I needed to find the actual location. The earlier the articles the more reliable they will be as the media has not engaged yet in a very long Chinese Whispers / Telephone game of telling and retelling a story until you end up with very little reliable facts. Almost all the articles that I found from June 2015 mentioned the incident happening in an area of Mosul called “Al-Faisaliyah”.
    I jumped to Google Maps and tried to search for “منطقه الفیصلیه موصل” (Arabic) which literally translates to “Al-Faisaliyah district, Mosul”. I was expecting Google to provide me an area but instead I got a specific coordinate.

    Google Maps result of where “Al-Faisaliyah” in Mosul is located.

    It was not exactly what I was looking for but I can work with it. I decided to verify that this area is at least the correct one. For that I went onto YouTube and searched once again for “منطقه الفیصلیه موصل”. The top video is about shop owners in the Al-Faisaliyah area in Mosul protesting against a decision to remove their stores to expand the road. I figured that if I could geolocate that video I could at least confirm that Google Maps is pointing to the correct place.

    YouTube search result when looking for the Al-Faisaliyah area in Mosul.

    And that is how I ended up doing a geolocation within a geolocation. Fun times. 
    I will spare you the details about that one but here is the verification of my (not shared) coordinates.
    In the figure below you can see a screenshot of the video (top) and a Google Maps image from a car dash camera in the area (bottom). It is a very good match. It is also around 170 metres from where Google Maps told me Al-Faisaliyah area was located so well done Google.

    Verification of the geolocation of the YouTube video of the Al-Faisaliyah area in Mosul.

    This is where I realised I could have saved myself the trouble and just paid attention to the map the first time around. I noticed that the area was not called “Al-Faisaliyah” on Google Maps but just “Faisaliyah”. This might be obvious for Arabic speakers but I did not realise that the “Al” was removable. Live and learn.
    Another useful thing in Google Maps is that (almost) everything is clickable. That means that if I click that “FAISILIYAH” word as seen on the image below, I will get additional information.

    Map of Mosul where it is possible to see the Faisiliyah area.

    And here is, according to Google Maps, the Faisiliyah area in Mosul.
    I had to remove the satellite view as it was too colourful to actually see the red border around the area.

    Faisiliyah area of Mosul according to Google Maps.

    Now that I can clearly see the delimitations of the area I just started scanning it around. The pool looks big enough that it would be visible from satellite view so how hard can this be?
    A bit of a spoiler half way through; the pool is not even in the Al-Faisaliyah area of Mosul. Keep reading though.
    I looked around for a while but got nothing. A few pools here and there but no clear match. This is that point in a geolocation where you start second guessing the entire thing. Was this even in Mosul? Iraq? Wrong date? Where did I go wrong?

    Second guessing everything

    First thing I did was then trying to assess whether ISIS was even in Mosul in May/June 2015. I then tried to find videos of them in the area and see if I could perhaps geolocate them. At that point I wondered if I really wanted to be added to more watch lists. The answer is no. One day I will travel abroad again and I do not want to be interrogated at the border so there’s that. I was also trying to minimise the exposure to graphic images during this investigation so perhaps I needed another strategy.

    New theory

    I stopped and thought about it for a bit. Mosul is a big city but there is not that many pools around. Where are pools located? Hotels? Rich people’s houses? 
    I went with the hotel theory first since I can’t just ask Google Maps to point out rich people’s houses in Mosul. 
    On Google Maps I wrote “فنادق الموصل” which literally translates, from Arabic, to “Hotels Mosul”. I was presented with the list, as seen below.

    Hotels in Mosul according to Google Maps

    Starting from the top I checked every single one of them in search of the presence of an outdoor pool, especially in the Al-Faisaliyah area in case I had missed something (I didn’t). I got nothing but then realised something very important; the city of Mosul has changed a lot in the last years so it is possible that there were hotels at the time that are no longer in operation or vice versa. Google Maps will only give me the current results so time to think of an alternative on how to go about this theory. I also wanted to confirm that ISIS was in Mosul around May / June 2015 so I googled that.

    I quickly found a very interesting article from the Wall Street Journal about how ISIS took over a luxury hotel in Mosul as their base in June 2015. Screenshot of the article with an embedded video below.

    Screenshot of a Wall Street Journal article about ISIS taking over a hotel in Mosul in 2015.

    Before you get as excited as I was I just want to let you know our target pool was not even in a hotel so contain your expectations.
    I scanned this specific hotel and surroundings so many times on Google Earth Pro, changed the dates over and over again to compare the satellite imagery from around June 2015 but found no traces of an outdoor pool that matched the one I saw in the ISIS video. Back to square one?

    Next Theory

    Ok, the hotel theory is likely wrong so I had to think about where else would a pool be? Perhaps in a University? Sometimes they have a Sports Complex with pools so I decided to go for it. My theory was not that strong so I just quickly searched “mosul university pool” and checked Google Images. I figured that it was not worth translating as I was not too sure on that anyway.
    The result I got can be seen in the screenshot below. It is probably too small to notice but I immediately spotted an interesting image, highlighted in red.

    Google Images results when searching for “mosul university pool”.

    And here is the (censored) image I found. I am sure you can already spot the similarities to the screenshot from the ISIS video but I have marked them all. Number 4 and 6 were out of frame and number 5 slightly hidden but I can confirm it was there.

    Comparison between the photo found on Google Images and the screenshot from the ISIS execution video.

    What now?

    That was it! I had the place! Kinda. I still did not know where it was located though…
    My excitement did not dwindle though. I was definitely in the right direction at last!

    I read through the page that had the photo(s) to see if I could get any information about the location. As luck had it the photo was of an American military base in Iraq and they were extremely vague about the location. In fact, apart from being in Iraq I got nothing else regarding the whereabouts. That is ok because now I had the name of the base and I can work with that.
    I want to clarify that the only reason I am publishing this information is because the photo is over 15 years old, the Americans left Iraq 11 years ago and this base has long been abandoned.

    Finding the Pool

    So I set off trying to find information about the base using the codename I found on that page with the photo of the army personnel jumping into the pool. It did not take me long to track an article from 2015 with a vague description of its location.
    The sentence I saw said something like “FOB (Forward Operation Base) FakeName sat on the “CardinalDirection” side of Mosul, Iraq, along the “CardinalDirection” of the Tigris River”.
    Perfect, I can work with that too.
    From there I jumped into Google Earth Pro, set the historical view to August 2015 and navigated around using the cardinal directions I just read. Shortly after I got it. 

    Here is the pool at last.

    Satellite image of the pool in August 2015.

    Verification

    After tracking down the location it is time to verify it so let’s really look at the satellite imagery and see if we can match it with what we are expecting to see.
    Below you can see the same tree highlighted in green, the wall next to it in pink, the corner of the building in blue, and that circular shaped area of the pool that sticks in, highlighted in red. It is a very good match.

    Verification of the geolocation of the pool used by ISIS to execute prisoners in 2015.

    Conclusion

    And this is how I went from a small clip from YouTube to the coordinates of the pool where in May / June 2015 ISIS drowned five prisoners, in the span of a few hours. I am not willing to share the coordinates of the actual pool but I can confirm it was indeed in Mosul, Iraq.
    I hope you managed to learn something along the way. 
    Thank you for reading!

    ~Sofia.

    , , , ,
    ,

  • Geolocation of hidden footage of a Russian filtration camp

    (Click here to watch and listen to the video version of this blog entry)

    One of my OSINT reports entitled “Deported Civilians: How civilians are illegally deported to Russia” was published at the Centre for Information Resilience website amongst many other brilliant pieces of work from my colleagues. I spent weeks (months!) collecting and analysing data in order to accurately portrait the reality of the Ukrainian refugee population under Russian control, from the moment of their capture until they were taken to Russian soil, often against their will.

    Whilst gathering data for the investigation I found hidden footage of the inside of a Russian filtration camp in Bezimenne, Donetsk Oblast. The process of geolocating the videos was fairly simple, straightforward and took me less than 5 minutes but it involved using a technique I have not yet covered on my blog so I have chosen to write a tutorial on it.

    The footage

    The first time I came across the hidden footage of a Russian filtration camp in Ukraine was on a telegram channel. The telegram message, shared on May 5, 2022, contained 3 different videos, all of the inside of an alleged filtration camp in Bezimenne, Donetsk Oblast, and was followed by a text only message with information about the life inside the facilities.

    As I can’t embed telegram videos on my blog I have chosen to replace it with a YouTube alternative, published on the same day, containing the 3 original videos merged into one footage. The description of the video on YouTube also contained the information found on the additional telegram text message.

    If you watch the footage below you’ll notice that it’s mostly indoors apart from a couple of instances in which the person filming approached the window. That scene, lasting around 10 seconds, between the 2:32 and the 2:42 minute mark, gives me enough information to successfully geolocate the alleged Russian filtration camp.

    Hidden footage of a Russian filtration camp in Bezimenne, Donetsk Oblast.

    Geolocation

    The first step of any geolocation should be to get as much information about the potential location before starting. There’s no point of opening Google Maps immediately if we have no idea what we are looking for.

    The telegram text and the description of the YouTube video, which contain the exact same information, mentioned a few important things. As the text is in Ukrainian I quickly copy paste it to Google Translate and get it translated to English. It says that the men were taken from Mariupol so we know it’s likely near that area. It names the village as “Nameless” in English, or “Безимяне” in Ukrainian, the original language. Lastly, the text mentioned a school in the village. There’s no name given to the school but we can find that fairly quickly later on.

    First thing we need to do is locate this village on Google Maps. Interestingly enough if you try to just put “Безимяне” on Google Maps you’ll be directed to the wrong place. Unfortunately there’s a place in Donetsk Oblast that Google insists it’s the correct location. Google is sometimes unhelpful like that. Luckily for us we already have enough information by now to figure out the correct village on our own. We know that it’s a Russian filtration camp therefore it will be in Russian controlled territory, we know it’s near Mariupol and, if you are like me and can spot a coastline at a glance, you would have noticed that in those 10 seconds by the window you can see the sea in the distance. So let’s explore the map of Ukraine between the city of Mariupol towards the Russian border, focusing on coastal villages.

    And seconds later you have your village as seen in the image below. Mariupol on the left highlighted in a green rectangle, Bezimenne spelled “Безіменне” instead of “Безимяне” highlighted in a red oval, and the Russian border which starts at the blue arrow.

    Map showing the location of Mariupol (green square), Bezimenne (red oval), and the Russian border (blue arrow).

    Now we just need to find the local school. I always keep it simple and just searched for “Безіменне школа” which literally translates to “Bezimenne school” on Google Maps. There’s only one result in this small coastal village so a great place to start.

    Location of the Bezimenne school according to Google Maps.

    Now that we have established a possible location of the footage we need to verify it. If it is not correct we will need to retrace some steps and figure out what went wrong; if it is correct we need to provide evidence of our findings.

    Verification

    Looking again at the 10 seconds of the footage where the person filming approaches the window you can see the frame below. This entire frame is enough to be able to geolocate the Russian filtration camp. We know we are at least on the second floor because we saw the person climbing up two flights of stairs. The building on the left is lower than where we currently are standing, the roof is flat and there’s something made of metal(?) on it. There’s also some tall windows on the side of the building and a row of trees across from it that, with a bit of luck, we will be able to spot from a satellite image.

    Screenshot from Russian filtration camp video showing the view from the window.

    Now that we have analysed the image and know what to expect let’s jump into Google Earth Pro to verify if the school that Google Maps pointed to in Bezimenne is the correct one.
    At first glance, and looking at the image below, it looks very promising. There’s a flat roof, a row of trees next to it and it’s clearly facing the coastline.

    Satellite image of the Bezimenne school.

    There are a few other details that I would like to confirm before immediately verifying this geolocation. No detail is too much!
    I would like to view that small metal structure on top of the flat roof, the windows on the side, and the height of the building to confirm that the section where the person was filming is actually higher than the rest. How can we do that with Google Earth Pro if this is the satellite image available?
    That’s where the historical imagery option comes in handy. I use it very often when geolocating and it’s extremely useful.

    At the top toolbar you’ll see an icon with a little clock and an arrow, as highlighted below. When you click on it a bar will show up with the available dates of the satellite images taken of the area.

    Google Earth Pro historical imagery icon, highlighted in fuchsia.

    The interesting thing about satellite images is that, depending on the slight tilt of the satellite at the time, the images change a tiny bit each time as they can be off nadir. This is great when attempting to figure out the height of buildings for example, or analyse one of the sides.
    So if we play with the dates a bit we can get enough evidence for all the details we were looking for.

    Starting with the side windows. They are visible on the June 2019 (left) and October 2015 (right) versions as seen below.

    Examples of historical images where the side windows are visible.

    Next we can verify the little metal structure at the corner of the flat roof. It is easily seen below, highlighted in light blue, on the June 2019 (left) version, as well as the May 2018 (right) version.

    Examples of historical images where the metal structure on the roof is visible.

    Finally, let’s confirm that the building where the person was filming was indeed at a higher level than the flat roofed building with the metal structure as seen above. The image from March 2016 (left) and the image from December 2015 (right), provide evidence for this claim. The section highlighted in purple below allows us to verify that there is indeed at least one extra row of windows above, likely indicating an extra floor.

    Examples of historical images where the extra floor is visible.

    And we’re done! We checked enough details to establish beyond reasonable doubt that this is indeed the location where the hidden footage showing forced civilian captives was filmed. Below is the image I used on the “Deported Civilians: How civilians are illegally deported to Russia” report to confirm my findings. I used the June 2019 satellite image from Google Earth Pro (left) and rotated the photo to face the same angle as the frame from the filtration camp video. Coordinates: 47.102124, 37.942215.

    Geolocation of the Bezimenne school where Ukrainian civilians were being kept against their will. 47.102124, 37.942215

    Conclusion

    When trying to verify locations it is often useful to use the historical satellite imagery data on Google Earth Pro as it (usually) provides several off nadir images. These pictures, all put together, can paint a very realistic picture of buildings and structures, that otherwise, would be either too hard or impossible to verify.
    I hope this brief explanation on how to use this option was useful to anyone wanting to learn more about geolocation techniques.
    Thank you for reading!

    ~Sofia.

    , , , , , , ,
    , , ,

  • How to do a small OSINT investigation

    (Click here to watch and listen to the video version of this blog entry)

    Introduction

    With an overall increase in people’s interest in OSINT either as a tool to fight disinformation, part of the reconnaissance phase of ethical hacking, or as an aid in the investigation of possible war crimes, we have come to witness a surge in videos, articles, podcasts, etc, on the topic. For most of it, the focus tends to be the tools needed to get the job done. But the job is not done with the tools, it’s done with your brain. The tools are just there to help you gather the (open source) data that you will still need to verify, analyse and, later on, turn into intelligence. This can be in the style of a report, an article, a book, or any other form of wider dissemination of your findings.

    In this blog entry I will take you along a small OSINT investigation focused on the Russia – Ukraine conflict, starting from the data collection, going past the verification process, followed by the analysis of the findings, and finally the report writing of the intelligence gathered.

    The Title

    Ideally when you start an investigation you should have a very clear idea of what you want to find out. It’s much harder to find the answers when you don’t have the questions.
    This could be something complex like “Are the mass graves in Bucha a result of the attacks on civilians or a byproduct of the limited access to healthcare and emergency services in a war zone?“, or something simple like “How many churches were shelled in Mariupol in the month of April 2022?“.
    Sometimes you start with the question and will have to try to find the data needed to answer it, and sometimes you come across the data and a question immediately pops up. Either way, for you to start an investigation you need a clear and well defined question, whether that question comes before or after you have access to that data, that’s up to the circumstances.

    The Data

    The Centre for Information Resilience, alongside Bellingcat and GeoConfirmed, have been collecting, verifying and sharing geolocated data on Russian military activities in and around Ukraine on an online map entitled “Russia-Ukraine Monitor Map” since January 2022. As of December 2022, the map has been moved to EyesOnRussia.org. As one among dozens of people involved in this massive project, it is both thrilling and daunting to see how much the database has grown in the past months. This impressive product is available, for free, to anyone who wants to see, interact with, or use it for their own intelligence reports (please credit our work though). Below on the left you can see the first map, used from January to December 2022, and on the right the new map in use from December 2022 onwards.

    I have selected this public database as the data source for our little OSINT investigation as it is widely accessible, easily verifiable, and I know how much sweat and tears was put into it. Definitely more tears than sweat in my case, I tend to work sitting down.

    So if we go to the map, this is what we would see below. There’s a world map and at the centre is Ukraine where hundreds of markers point at the various geolocated data. All these markers are organised in several categories, such as “Civilian Casualty“, “Russian Firing Positions”, “Munitions”, among many others. A box on the map contains information about the Russia-Ukraine Monitor Map as well as some links.

    In the left image below you can see how on the old map used to include an item count which is not present on the new map. At the time of writing (May 2022) there were almost 4000 logged entries, all geolocated and verified by the team. The number grew exponentially by the time the new map, seen on the right, was introduced.

    On the old map, when you clicked on “Basemap” on the top right, you could change the style of the map. For this blog entry I had selected to put it in “Pirate” style because I like to amuse myself with the little things in life.
    This option is no longer available on the new map which is, in my humble opinion, a huge tragedy! You can however select between “default”, “classic”, or “Earth” style, as seen highlighted in red on the right image below.

    But now something interesting happened. Once I zoomed out enough I realised that there’s some peculiar markers across Russia, almost creating a line between Ukraine and the far East of Russia, all the way to the shores of the Sea of Japan or East Sea. What could this be?

    And that is how I ended up with an idea for a small investigation for this blog.
    We’ll be looking at these markers on the map and try to understand what was happening, when it happened, why it happened, and what intelligence can we get from it. It won’t be anything ground breaking or worth a Pulitzer, but it will be a nice overview of how an OSINT investigation progresses from data to intelligence.

    On the left image you can see the markers on the “old map” versus the same markers, on the “new map” on the right.

    When you click on one of the markers on the map you can read more information about the geolocated incident. I started with the furthest marker from Ukraine, in East Russia, not too far from China and North Korea. Once you click on it you can see a preview of the data, a link to the source, some brief description of the event and the coordinates (among many other details).

    If you then keep checking the markers highlighted across Russia, you’ll quickly realise that they are all showing similar content (military vehicles transported in trains) from around the same time (January and February 2022).
    We’re lucky that the amount of data for this specific investigation is fairly small and we can check every single entry quite quickly, but sometimes that is not the case.

    The EyesOnRussia map has a few options that we can use to filter the data. We can easily tell by clicking on the markers across Russia, they were all from events recorded between January and February 2022. We can therefore remove anything else from the map to clear up our view a bit.
    We can do this using two different filter options; first we narrow by location on the map, and then we narrow by date.
    Below are the steps to narrow down by location. Start by clicking the “Draw on map” symbol just above the “1” circle. Then select “Rectangle”, next to the “2” circle, and click on the map to mark the first corner as seen next to the “3” circle. Afterwards simply drag the cursor until you are happy with the borders of your search and select the “Only Events in Map Frame” option on the left, next to the “4” circle. Even though the other markers are still visible on the map, they are no longer on the list of events on the left.

    Afterwards we will narrow down our search to the desired date range: start of January to end of February 2022. We can do this by either manually selecting the range on the left column, highlighted in red below, or by dragging the bar seen where the blue arrow is pointing until you reach the correct time frame.

    We are only interested in the Russian military movements as that is the category of all the markers across Russia so let’s select the “Russian Military Presence” on the left bar.

    Once you’re done with all the filters, simply click inside the rectangle so it goes from a dashed line to a solid line. Afterwards you will be able to see that the list of events, on the left bar and at the bottom, now only contains those that fit the criteria. They are all between start of January and end of February 2022, and they are located within the selected area. If you click on any of the events on the left you can quickly see the data, coordinates of the geolocation, and more details of the event.

    Now that we have access to all the relevant data it’s time to move to the next step in an OSINT investigation.

    The Verification

    Data is only good if we are able to verify it.
    As we already have the footage and the coordinates we can quickly double check that they were correct before adding the data to our report. Last thing we want to do is build an entire investigation and draw conclusions around incorrect or misleading data.

    I selected the video previously shown, from the very far East of Russia, uploaded to Twitter on January 12, 2022, and quickly checked the area around google maps to confirm we have the correct geolocation (44.604920, 132.824411).
    On the left we can see a frame of the video at 0:41min and on the right a photo I found on google maps of the train station in Spassk-Dalny, a town in Primorsky Krai. The blue building is a clear match. The photo was clearly taken between the big pole and the building. In fact, at the very beginning of the footage we can see the pole and the fence, both also visible on the google maps photo on the right.

    As we don’t have too much data to analyse we can easily do this to every single piece of footage we plan on using.
    Once finished we can move on to the next stage of an OSINT investigation.

    The Analysis

    Now it’s time to answer the question “What intelligence can we get from all of this?“.
    At this point we have answered the “when” (January & February 2022), the “what” (trains taking military Russian vehicles to the Ukrainian border), the “why” (preparing for an invasion), we are just missing the intelligence so let’s get some.

    We know that all our entries involve trains so I searched for a map showing Russian train routes. I found a good one by simply searching “Russia train routes” on google images. It depicts the different lines in various colours so we could easily identify which route go where. Afterwards I placed the new image with 50% opacity on top of our data map to see if I could spot any interesting pattern. Unsurprisingly we can see how the markers on the map match the Trans Siberian Express route, starting all the way at Vladivostok, and going across the country, before stopping at the border with Ukraine. At some point this line also connects with the Trans Mongolian Express, although there’s still two markers on the far East that can only match the Trans Siberian route, nothing else.

    Fig. Russian train routes map layer on top of the Russia-Ukraine Monitor map on the old maphub.

    So now you must be thinking “So what? It’s obvious that the Russian government would be using the Trans Siberian Express route to move military vehicles from the far East to the Ukrainian border.” And you are right, it was an obvious choice; but that also means that it was predictable and predictability in war is deadly.
    What could we possibly do with such information? We could do what I just did in 5 minutes; now that we have the names of the cities from where the trains are passing through we can search for live cameras pointing at the train tracks. Let me show you how fast it is.

    A quick google search for railway cameras takes me to railwebcams.net, a website dedicated to “railroad, trams and station webcams worldwide“.
    At the top of the website I chose “Rail Webcams By Country” and then selected Russia from the list.

    Fig. Screenshot of the homepage of the railwebcams website.

    I’m particularly interested in Vladivostok, the last (or first) station of the Trans Siberian route at the very far East of Russia, just a few kilometres from the Chinese and North Korean border. Luckily for us they have 3 webcams in that city, the first of which pointing at train tracks. Aren’t we lucky?

    Fig. Screenshot of the page on railwebcams website showing the railway cameras located in Vladivostok, Russia.

    If you click on the “Cam 1” you’ll be able to have a very clear view of the tracks, live and available 24h a day. Below is a screenshot I took when I visited the link.

    Fig. Screenshot of the live webcam from railwebcams in Vladivostok on May 15 (already May 16 in East Russia).

    As a precaution I checked that this webcam is pointing at the train tracks in Vladivostok and not a different location, incorrectly labelled (always verify everything!).
    Below is a screenshot I took from a google streetview image at the following coordinates in Vladivostok: 43.112896, 131.903364.
    We can see the same streetlamp, the same building on the “left” side of the tracks, the similar benches and the same patterned floor. It’s clearly the same location. If you use the coordinates and check google maps you can turn around and see the bridge as well.

    Fig. Screenshot of the streetview from google maps in Vladivostok, at the same location as the live webcam.

    As this is an example of an OSINT investigation, and I don’t want to end up with enough information to write a book, the “analysis” stage will have to be hypothetical. Let’s imagine that this was happening in February 2022 and you were doing everything I did so far. You could, for example, compile a decent list of similar webcams, all pointing at places where Russian military vehicles were seen being transported in trains en route to Ukraine, record them and then analyse the content. Perhaps gathering what sort of vehicles were being taken and where? This sort of data, before invasion, would have been very exciting (and useful) to have and analyse. The interesting thing is that, as we have seen, this (geolocated) footage was available at the time. Anyone, literally anyone with an internet connection, could have gathered, analysed and written a very useful report on it. Perhaps someone did.


    You could end up with a very detailed list of exactly what tank models were being sent where, how many trucks were going to a specific town, how many refuel trucks accompany each battalion, what rocket launcher models the Russians have and where they are deployed.
    Perhaps you could even check satellite imagery of certain areas around specific cities. Imagine that you were following a train route and suddenly there’s vehicles that you hadn’t seen before en route. They weren’t there in city A but suddenly they were when they went past city B. Now you have a good range of places to search to see if you could spot where they were kept. You could even keep track of the number of vehicles taken over time by periodically checking the satellite images of the area.

    I can quickly show how easy it is. Let’s jump on the map again and see if we can spot any trains near Vladivostok (clearly my newest favourite city in East Russia). Below you can see how there’s indeed a video of military vehicles being loaded onto trains on March 2, 2022, in the Khabarovsk Krai province, where Vladivostok is located.

    And because everything on this map is geolocated we can just grab the coordinates (46.808484, 134.254594), put them on a map and check the surroundings. We know the vehicles were being loaded so they were probably near the tracks. Within a few seconds we can spot the military base on google maps as seen below. The arrow shows the train tracks, the orange circle the coordinates and the dark blue rectangle the military base.

    Fig. Google maps screenshot showing the area where the vehicles were being loaded on the trains, near Vladivostok.

    Zooming a bit more allows us to check out some of the Russian military vehicles in more detail.

    Fig. Close up of the military base near the train station.

    You could now start tracking this section using free, or paid, satellite tools, depending on the level of detail you’re looking for.

    The available OSINT investigations using data from EyesOnRussia map are endless and only limited by your own imagination. We are certainly not lacking in data.

    The Report

    Once you’re done with the analysis of your data, it’s time to write a nice report on your findings. What was your conclusion? How did you reach it? What data did you use? How did you verify it? Why should we trust it?
    All of these are questions that need answering. An OSINT investigation should be transparent. You are there to look at the facts, verify, analyse and report your findings.
    The report stage might be the most important of them all. You might have discovered something absolutely groundbreaking and, even better, you have undeniable proof of your claims; but if you are not able to explain your process and adapt your knowledge to your audience, all that work was for nothing.

    What is your audience interested in and how much detail do they want? Will they be able to understand what you are trying to convey? Does it matter to them? Why should they listen to what you have to say?
    When writing a report I would always advise to throw in some nice maps, graphics, screenshots, videos, whatever other visual aids you can get. It helps people understand what you’re trying to explain and makes it easier to digest if the content is too complex. The majority of the population will not be as well versed in open source intelligence as you are so it’s your job to make the knowledge attainable.

    Conclusion

    OSINT investigation is an exciting field of work. It takes work, a lot of attention to details and a fair amount of persistence to, not only get the intelligence behind the data, but to also be able to explain and share it with others.
    I hope my little (it was definitely not little) tutorial gave you inspiration for an investigation, the tools to collect the data and the motivation to just go for it.
    Thank you for reading.

    ~Sofia.

    , , , , ,
    , ,

Website Powered by WordPress.com.

Up ↑

%d bloggers like this: