How Investigators Use Online Evidence to Expose Possible War Crimes

They discovered important details about the missile launcher that brought down Malaysia Airlines Flight MH17 in Ukraine. They identified neo-Nazis in the 2017 “Unite the Right” rally in Charlottesville, Va., and unmasked Kremlin hit squads. And now they have documented the use of cluster bombs, which are banned in many countries, in Ukraine. For their investigations, staff at the international collective Bellingcat use only freely available material from the Internet—including video footage and photographs from social media posts. Bellingcat was founded in 2014 and is funded by private donations, foundations and educational seminars that are offered by the organization.

In an interview with Spektrum der Wissenschaft, the German-language edition of Scientific American, Bellingcat staff member Johanna Wild provides insights into her work and reports on current findings in Russia’s war against Ukraine.

What type of online research does your team do?

At Bellingcat, we use the term “open-source research.” We understand this to mean investigative research of all accessible online sources. This includes images, videos or conversations in social networks. We also evaluate satellite images or various databases on the Web. So we don’t work like traditional journalists who conduct interviews or get a picture on-site. Most of the time, we sit in front of the screen in very different countries. Our core team now consists of almost 30 people. It’s quite small, but we work very intensively with quite a few volunteers who help us with the research. Without the help of the online community, we could do much less. That’s why we offer workshops to train more and more people in open-source research.

How did the Bellingcat staff get started in this field?

I started in local journalism and then, a good 10 years ago, moved on to supporting local journalists in conflict and postconflict areas—for example, in Yemen, Rwanda, Burundi and the Democratic Republic of the Congo. But some topics were difficult to cover journalistically because, for example, I was not allowed to travel to certain areas for security reasons. For this reason, I specialized in online research in order to still be able to report—even without being on-site.

People come from very different backgrounds. One colleague was previously in the military. One colleague was originally a police officer. Some previously worked for NGOs [nongovernmental organizations]; others were analysts. The different expertise helps us enormously in our research. We are united by the fact that we want to use open-source research to uncover abuses such as war crimes or human rights violations around the world. But we also deal with environmental issues, right-wing networks and conspiracy theories.

When you research Russia’s war on Ukraine, what are you looking for?

We search the Internet for freely available photographs, videos and other social media entries in order to deduce what is really happening on the ground. For example, we come across videos that show troop movements or the transport of military equipment. Especially earlier in the conflict, that was relevant. Now we are more likely to ask questions like “Where are there attacks, and against whom are they directed? What weapons are being used?” There are heaps of material on the Web about that. That’s because the vast majority of people in Ukraine have constant access to the Internet. They observe something, take photographs or videos with their smartphones, and post them online. In the Yemen conflict, which we are also researching, the situation is completely different. There, a much smaller part of the population is permanently online.

What have you uncovered in Ukraine so far?

In our research, we focus mainly on attacks against civilians and civilian infrastructure. For example, we have concrete evidence that schools and hospitals were hit by cluster bombs in the very first days of the war, killing civilians. Cluster bombs consist of numerous smaller explosive devices. When they are dropped or shot down, they spread aimlessly over a large area. In the process, they often hit civilians or at least civilian infrastructure. This is why more than 100 countries have ratified an agreement that they will not use this cruel weapon. Unfortunately, both Russia and Ukraine are not among them.

Photographs and video footage clearly prove that cluster munitions were used over civilian areas in Ukraine. This does not prove who launched the explosive devices. Nevertheless, we were able to use our analysis to show from which directions the bombs came. And these strongly point to the Russian side as the origin. In fact, Russia has already used the cluster bomb tactic in the 2014 Ukraine war. Moreover, it is very unlikely that Ukraine would drop cluster bombs in its own country.

Russia also used cluster bombs in the Syrian war.

Exactly. In fact, we had focused there on researching and documenting the use of cluster bombs. We were able to gather evidence that Russia was using the munitions then as well. For this kind of research, it helps that we have people with a past in the military who know the details of such weapons systems intimately.

There have been recent reports about the potential use of vacuum bombs in Ukraine. Do you have any information on that?

No. We have not seen any evidence online so far of the explicit use of vacuum bombs, but we cannot rule them out either. The projectiles release a combustible aerosol when they explode, which ignites a firestorm and removes oxygen from the air, creating a vacuum. The heat and blast wave destroy everything within a radius of hundreds of meters. People can suffer the most severe internal injuries as a result.

How do you verify that photographs and videos are not fake?

“Geolocation” plays a particularly important role here—i.e., determining the geographical location where a photograph or video was taken. To do this, we examine details of the recordings. For example, buildings and their arrangement in relation to one another, road markings or vegetation. Ultimately, anything that can be seen on satellite images, with which we then compare the recordings, can be significant. And of course, we try to determine the approximate date of the image: Does it possibly originate from a previous conflict?

We find that the very first photographs that appear online after an event are often genuine. Then, as the incident becomes better known to the public, more and more posts with false information appear. For example, users often share images from other conflict zones that they found somewhere online.

How can people learn about your research findings?

Normally, we report on our findings in articles and link to the analyzed material. Specifically in the Ukraine war, we enter the verified locations with the associated online material into a digital map. The respective incidents are color-coded depending on the operation. Green means military equipment is being transported; red means civilians were attacked or there were military casualties. When I click on such an item, I see the corresponding social media post about it. Anyone can find out more here—but the map is mainly aimed at journalists.

What does the name Bellingcat mean?

The expression goes back to a medieval fable: “Belling the Cat.” In the fable, mice are thinking about how to make a cat harmless. They decide to put a bell around its neck so that they will be warned as soon as the cat approaches. Bellingcat wants to research relevant topics, even if they are complex or challenging. The goal is to provide the public with sufficient information about grievances in the world.

This article originally appeared in Spektrum der Wissenschaft and was reproduced with permission.