Open Source Monitoring of NATO Trident Juncture Exercises

Russia’s massive annual military exercises, which are named after cardinal directions (e.g. Vostok for east, Zapad for west), garner a tremendous amount of international attention and intense scrutiny. While in some rare circumstances Russian military exercises parlayed into larger international conflicts, such as the July 2008 Kavkaz military exercises that were followed the following month by the Russo-Georgian War, they are usually just opportunities for Russia to showcase its military hardware, ensure its combat readiness, and practice various scenarios — the same as most other states’ and alliances’ military exercises. Meanwhile, from October 25 to November 23 of this year, NATO is carrying out its own military exercises, dubbed the “Trident Juncture Exercises,” in Norway and the North and Baltic Seas.

About 50,000 participants are involved, from all NATO members along with Norway’s neighbors of Finland and Sweden. With such a range of participants, there is an abundance of potential open source material to gather and analyze as related to these exercises. This article will provide some methodology to anyone interested in monitoring and analyzing the exercises, along with some basic findings on the exercises thus far.

Satellite Monitoring of Exercises

Much like the Russian Zapad exercises in Belarus in Russia, the NATO Trident Juncture Exercises are quite spread out, but with a few locations that have an especially high density of activity. A map provided by the Norwegian Armed Forces shows a rough estimate of the largest locations used to host the exercises throughout Norway:

The largest location detailed by this map is the Rena Camp in Hedmark County, followed by the Haltdalen-Røros-Brekken location in Trøndelag County — these two spots make a good starting location to begin monitoring the exercises. The Haltdalen-Røros-Brekke location is relatively spread out, as it is a winter training camp that specializes in teaching winter warfare to soldiers, making it a poor candidate to monitor with low-resolution satellite imagery.

The Rena Camp is the largest military camp in Norway, and is located just northeast of the small Norwegian town of Rena. The most recent satellite image of the camp on Google Earth is from July 2014. However, imagery from Planet Labs allows for the monitoring of large-scale changes during the lead-up to the exercises and the exercises themselves. The 25 October 2018 satellite image can be seen in a higher resolution here.

August 21 and October 25, 2018 (©2018 Planet Labs, Inc. cc-by-sa 4.0)

The “Nordland County” location in Bodø would be a good candidate for satellite monitoring, with sixty aircraft reportedly present for the training, but there is no imagery available on Planet Labs that is not without heavy cloud cover.

NOTE: If any of our readers have locations that they would like to have checked with Planet Labs imagery, please leave coordinates and possible dates in the comments of this article.

Social Media Monitoring of Exercises

Soldiers who take part in large-scale exercises, regardless of nationality, love to share photographs of their trip on social networks. While social network use is relatively restricted among Russian soldiers, thanks to a series of embarrassments in Ukraine in 2014-5 and recent legislation, it is hard to stop a 19-year-old conscript or new contract soldier from sharing photographs on Instagram of themselves in interesting locations surrounded by impressive military hardware. The same can be said for NATO exercises, which, when compared with the Russian and Belarusian Armed Forces during the recent Zapad exercises, has a much more open, public relations-focused mindset about their demonstrations of armed strength.

The first place to start to find participants sharing photographs and videos of the exercises is with popular hashtags, including #TridentJuncture and #NATO. The top results for these hashtags will be glossy, professional photographs shared by various press services, public figures, and official accounts, including from Lasse Løkken Matberg (arguably NATO’s most photogenic exercises participant), the official NATO Instagram account, and the official British Army account.

These official and press service accounts, while sometimes providing interesting tidbits of information, are not the subject of this article, as anyone with basic Google skills can easily find all of the materials from these accounts across all social and sharing platforms. Instead, we will highlight some interesting findings from accounts without blue check marks that could be useful, and detail search strategies to find useful information.

Downloading Full-Resolution Instagram Photographs

A photograph uploaded by Teleplan Globe, a small company assisting with Trident Juncture, shared a photograph of the “combat room” for the exercises. On its own, there is not a lot that can be gleaned from the photograph; however, by pulling the full-resolution copy of the photograph from Instagram, we can decipher the displays on the screens of the “combat room”.

(Source)

First, on Chrome, open up “Developer Tools” from the options.

Second, click the “Select an element in the page to inspect it” icon on the top-left of developer tools.

Third, highlight and then click the photograph that you want to pull in its highest-available resolution from the Instagram servers.

After clicking on the image, a line from the Elements part of developer tools will be highlighted, showing us where the web page is pulling the image from. You may need to expand (click the arrow facing right) near the <div class> field. Here, it is under the <div class=KL4bh”…> field, right above the “_9AhH0” line that was highlighted after we clicked the image.

Four URLs are visible here, indicating different resolutions. The URL that we are interested in is the final one, between “src=” and “style”. This JPG file is the photograph in the highest resolution available. Double-click this URL to highlight it, then copy-paste it into the URL field of your web browser.

The image will now appear in your browser and can be saved by right-clicking, rather than taking a screenshot at a lower resolution of the photograph on its Instagram page.

While the resolution of the photograph is not quite high enough to discern the text on the screens, we can still cross-reference the satellite imagery and CCTV footage visible in the “combat room.” For example, the port visible in the center of the photograph on two monitors is located in Stjørdal, east of Trondheim.

The satellite image on the right-most large screen is the same port, but at a rotated angle.

Finding Instagram Location Labels

With thousands of soldiers from dozens of countries in Norway, we cannot expect a uniform behavior with geotagging photographs. While many oversharing soldiers may use the correct geotag that Instagram provides, many — especially those who cannot understand Norwegian — will likely use incorrect location names.

For an accurate example of geotagging, a German soldier used the general “Haltdalen” geotag when conducting winter training near the Haltdalen Training Center.

After clicking on the hyperlink over Haltdalen, we can find all of the recent Instagram photographs using this geotag. However, this is the only one related to the exercises with this location.

Another photograph that we can discover through relevant hashtags (#TridentJuncture2018) is a Norwegian soldier drinking a bottle of Coke near “Hedmark” — a location with numerous photographs and videos showing military equipment and soldiers involved in the exercises.

This geotag, nevertheless, is extremely broad, ranging across hundreds of square kilometers. While the Haltdalen geotag was fairly narrow, as it is a single village in a very remote region, Hedmark encompasses a much larger area, and many photographs taken within this region use other geotags generated by Instagram other than “Hedmark.” There is no surefire method (that Bellingcat is aware of) to gather all geotags within a particular area, but one solution is via search for Instagram cross-posts on Twitter, with geotags added. This search will provide potential geotags that are provided to users uploading photographs within a certain radius, thus providing a list of likely geotags for relevant photographs.

Firs, grab the coordinates for an area that you are interested in. For us, the Rena Camp in Hedmark county is the most likely place that the geotagged “Hedmark” photos are coming from, meaning we should find the coordinates for this place. Be sure to use the decimal coordinates, without any degree symbols, as those are the only ones that work with Twitter searches. The fastest way to gather coordinates for a location is to navigate to it on Google Maps, then pull the decimal coordinates from the URL (or, alternatively, right click a spot, select “What’s here?”, and copy the coordinates).

With these coordinates, we need to conduct a Twitter search with the following query. If you have a Twitter account, you can do this by typing it into the “Search Twitter” field on the top-right of the user interface. Anyone, with or without a Twitter account, can enter the same search here.

geocode:XX.XXXXX,YY.YYYYY,RADIUS instagram.com
geocode:61.1499048,11.3966162,25km instagram.com

This search function looks for all tweets with location data at the entered coordinates, plus a radius, plus the word “Instagram.com”. Note that there are no spaces in the search query before Instagram.com, so delete any possible space between the X and Y coordinates.

We add Instagram to the search in order to find cross-posted photographs from Instagram that could have geotags on them, which will broaden our search capabilities in noting potential geotags that are used by soldiers and locals involved with or observing the NATO exercises near these coordinates. One of the search results seems promising — there is clear location data on Twitter, plus a link to an Instagram upload that the user presumably made.

The uploaded photograph has a geotag for “Rena, Norway”, which would not have come up if we were to only search for “Hedmark.”

Following the hyperlink on Rena, Norway, we find a motherload of geotagged photographs relating to the ongoing exercises.

While it would probably be easy enough to guess that photographs near the Rena military camp would be tagged Rena, Norway, we have to consider that users will use different languages and auto-suggested options that may not be the most obvious choices. For example, another photograph is in the results for our Twitter geocode search is seen below, and obviously is related to the Trident Juncture Exercises.

Clicking through to the Instagram upload, we see a geotag that uses Norwegian: “Regionfelt Østlandet” (Eastern Norway Region).

Like with the “Rena, Norway” hashtag, we can find many relevant photographs with this geotag, as seen below.

Some American soldiers participating in the area may use this geotag if it is an autosuggested option, but they also may not, as most probably do not know enough Norwegian to understand what it means. Under the same logic, they may choose incorrect hashtags, such as for a nearby hotel or park, if it were to be the first or second suggested option by Instagram for a geotag. By running a geocode search on Twitter, you can find some of these locations, and then check recently geotagged photographs for those locations to see if any interesting materials were incorrectly tagged.

Naval and Aircraft Monitoring of Exercises

With heavy naval and aerial components, it is easy to find and monitor the aircraft and naval vessels involved in ongoing NATO exercises in the North and Baltic Seas.

At each of the airstrips and ports used in the exercises (seen on the map on the third page of this document), we can look at current and historic data from a number of free and premium tracking sites, including Marine Traffic, ADS-B Exchange, FlightAware, and VesselFinder. Note that for many of these services, viewing real-time data is free, but a membership or fee can be required to view historical data.

For more information on tracking vessels and aircraft, see Bellingcat’s Online Investigative Toolkit here, which is frequently updated with new services (see the Transportation section, starting on Page 13).

Further Monitoring

If any of our readers have discovered any interesting findings, please share them in the comments of this post, or tweet at our account with them, and we will be sure to share them in updates to this article.