The Importance of OSINT: Misinformation and Verification of Conflict Media

On the 25 February 2016 a video (Video 1) was posted in the video site “Liveleak.com” titled “Shelling of Checkpoint in Ukraine” with the description “Reports suggest the pro-Russian separatists fired on the Police checkpoint in Yasinovataya, Ukraine”. It is just one video amongst the huge amount of information produced and posted on the internet daily, and not hugely remarkable. However, it can be used as a good example of the power, and limitations of OSINT, as well as the kind of misinformation that has become a feature of the internet. It is vital to counter this rampant misinformation, whether it is to establish a more truthful narrative, or to prevent innocent people being accused of terrorist acts as happened after the Boston Bombings. Therefore this OSINT investigation will critically examine this video and the information connected to it and establish what we can and cannot ascertain from this video using open source techniques. It will include an analysis of the video itself, working out where and when it was filmed, and establishing what happened during the event. It will then use OSINT to provide context to the video, and establish the veracity of its description.

Analysing the video

Summary: The 24 second video, shot from a dashcam, shows someone driving down what appears to be a motorway. There are then several explosions, both on the road and on the roof of a building further along the road. The driver stops and the video ends.

When was the video taken?

The description of the video makes no mention of date, however the dashcam shows a watermark indicating the date as 24th February 2016 (Figure 1). Liveuamap.com, which records and roughly locates events in conflict zones, registers this event as happening on 25/02/2016 while the video was uploaded to LiveLeak on 25/02/2016. Therefore we can say that this happened on, or before the 25/02/16 and, on the balance of probability, on the 24/02/16 as shown in the timestamp in Figure 1.

Figure 1

Where was the video taken?

The video mentions the location as “Yasinovataya”, a town to the north east of Donetsk. It clearly happens on a major motorway junction, with offset directional signs above the carriage-ways, and near a building with a distinctive pyramid shaped roof.

Figure 2

There is only one location with all these distinctive features near Yasynuvata, a checkpoint at 48°06′47.7″N 37°48′05″E, south west of Yasynuvata (also known as Yasinovatskiy or Yasinovataya, depending on language and spelling). No other traffic post with this configuration could be located within a 10 km radius of the town.

Figure 3

It is extremely unlikely that there is another location with this arrangement of the building, post, signs and the junction itself. Wikimapia marks this building as a stationary traffic post, which fits the description given by the video. This geolocation shows that the video took place at this checkpoint beyond reasonable doubt.

Analysing the event

During the video there are four distinct explosions: two are seen on the motorway, one is a direct hit on the building and the fourth is heard off camera. These explosions come from at least two different weapons systems.

Figure 4 : Explosion 1

Figure 5 : Explosion 2

Figure 6 : Explosion 3

In Figure 5 you can see some kind of projectile in the frame before the explosion itself. This is clearly some kind of direct fire weapon system, requiring line of sight onto the target, and obviously accurate, if the building was the target. Given the single shot, time of flight, and appearance of the projectile, we can make an educated guess it is some kind of rocket, but can confirm no more than that.

Explosions 1 and 3 are much smaller and seem inaccurate. Their positioning next to the barriers also suggest they come from an indirect weapons system, arching in their projectile. The fences and barriers to the right of the motorway would prevent a direct-fire weapons system from placing projectiles in those locations unless they were firing directly down the motorway, which in this instance seems very unlikely. This would immediately suggest either an 82 mm mortar line or an AGS 17 30mm grenade launcher. The explosions seem small for an 82mm mortar, and appear more akin to an AGS 17. However, this cannot be established with any degree of certainty.

Analysing the context

So far we have established that this is an attack with two different weapon systems, on a traffic police post near Yasynuvata. This is consistent with the video description. In the next section we will examine the context of the video and expose the inaccuracies of the information posted with the video.

According to liveuamap.com the identified location is registered as the front lines of the Ukraine conflict and has been in separatist hands since the around the second Battle for Donetsk Airport on 27/09/14. The incoming rocket also appears to come from the right hand side, or North-West, the direction of the Ukrainian lines. Both these facts suggest it is Ukrainian, rather than separatist forces, firing on the checkpoint.

The question of who is firing at who, and why, is confirmed from a video posted on 08/03/2016 on Youtube (Video 2). Video 2 shows what are reportedly separatist soldiers (or “Putin’s Orcs” according to a crowd-sourced translation of the video description) firing from a hardened fighting position near Yasinovatskiy at a location that is suspiciously similar to the checkpoint shown in the first video. Examination of Video 2 shows road markings and lamp-posts which suggest the fighting position is built on a substantial road. The configuration of the lampposts is indicative of at a least a four-lane road and matches with the configuration of the lampposts in Video 1.

Figure 7 : (Video 2)

Figure 8 : (Video 2)

Figure 9 : (Video 1)

Figure 10 shows a closer comparison of the two locations, including the pyramid-shaped police post and a distinctive semi-circular structure on the side of the police post.

Figure 10

Figure 11 even shows damage to the roof of the police post that is consistent with the attack shown in Video 1.

Figure 11 (Video 2)

The large road and the lampposts point to the two videos being filmed in the same location. The semi-circular frame and the distinctive police post confirm that the location shown in Video 1 is the separatist fighting position shown in Video 2. This would also explain why the vehicles in Video 1 are both using the same side of the motorway: the fighting position is blocking the other lanes. All these details confirm, barring a gross act of friendly fire, that the incoming fire in Video 1 is in fact Ukrainian.

Final confirmation that this is a separatist fighting position is provided by Russian news reports from this position reportedly on 08/03/2016 by various agencies. These reports were found simply using Google and searching “Yasynuvata, attack” for pages posted after the 24/02/16. They show a substantial separatist fighting position at this location, clearly identifiable as the location in Video 1 and 2 by the distinctive semi-circular frame structure, traffic post and firing positions.

Figure 12 (Video 3: Russia 24)

Figure 13 (Video 4: News Front)

Conclusion

OSINT is a form of intelligence that is not going to disappear, indeed it will continue to grow. The spread of social media, and technologies such as camera phones, have given us the unprecedented ability to create and send huge amounts of data all over the world almost instantaneously. It has also meant that the trusted sources of news are no longer just governments or the mainstream media, but include a much wider range of actors, including private citizens posting on sites such as LiveLeak. In some ways this has furthered the cause of transparency, as individual citizens have a greater capability to examine and expose government actions, yet it also allows private citizens to produce false and misleading information, as we have seen with Video 1. OSINT has placed a great deal of power into the hands of individuals, using the information contained in the videos I have examined, and other freely available information, I have produced a map of what is probably a platoon sized fighting position shown in Video 2. This includes the locations of: the probable command bunker; AGS 17; probable 12.7mm machine gun; radio antenna; bunkers; firing points & arcs and layout of physical defences. I can even see the doorways into the police post and if they open inwards or outwards. This level of detail would be vital to a commander on the ground and would raise ethical issues if it were to be published, potentially putting the lives of the separatist soldiers at risk.

Video 1 does raise the possibility of a more ethical use of OSINT: the use of private citizens to monitor, record, disseminate and verify actions that would otherwise remain hidden or uncertain. This is not a new concept and has been suggested as a method to monitor and control nuclear proliferation. Currently the ceasefire in Ukraine is being monitored by the OSCE and their observers on the ground, producing rather general spot reports, for example: “the SMM heard 26 undetermined explosions and two bursts of heavy-machine-gun fire 5-10km north and north-west of its position”. An organised group of OSINT analysts examining media produced by the public could aid this mission, adding specificity to the general reports of battles and, with an engaged population producing multiple angles and viewpoints of the same incident, potentially a better chance to verify events, countering the kind of misinformation that appeared with Video 1.