How to Investigate TikTok Like a Pro - Part II: Using TikTok for Ukraine Research

TikTok has emerged as a key platform on which footage of the invasion of Ukraine is shared.

This includes footage of missile strikes and their aftermath, damaged or destroyed military equipment, as well as visual evidence of suspected war crimes and other atrocities.

Misinformation and disinformation about the invasion can also be found on the platform. This includes posts by Russian state-backed media, posts of old or unrelated videos falsely claiming to show contemporary events and misleading or false claims about the details of a video -such as the location it was recorded. 

In short, there is much for digital investigators to explore on TikTok.

But compared to other social media companies, TikTok does not currently allow researchers to access and inspect data at scale. Investigating content on TikTok is mostly a manual process that can be very time consuming. Yet there are methods, tools and shortcuts that can help. 

An example of footage posted on TikTok showing the invasion of Ukraine.

Bellingcat released a guide in 2020 detailing some of the basic steps to investigate TikTok. This detailed how to:

• Extract user profile information, download and archive profile photos and videos
• Understand the differences between using TikTok on a web browser and mobile app
• Tips on privacy for users and investigators
• Use the app for content and information discovery for videos, users and hashtags
• Use external platforms such as search engines and other social media platforms to find TikTok content

Readers can view this guide here. 

What follows is a guide that builds on that introduction, adds new tips and techniques and shows how they can be applied to the War in Ukraine.

Among the topics covered are:

• An update on the differences between the mobile app and web browser
• Tips on content searches and how to find metadata on the app
• Using third party tools and browser plugins to extract audio, text from images, and conduct real-time translation  
• Recording your work as you go and how to get the best out of the app and web browser versions

While this article can work as a standalone guide, it is also worth reading our original intro to TikTok as a refresher. More recently, we also published this guide on the Bellingcat-built tool that lets you analyse TikTok Hashtags.

Before we begin, however, a quick word on privacy and security. If you are using TikTok for research purposes, it’s recommended you operate anonymously and disclose as few personal details as possible. In November, TikTok released an important privacy policy update for users in the UK and EU, confirming that their data can in some cases be accessed by employees outside the continent including in China. New research found that code in TikTok’s in-app web browser allows the company to track users’ keystrokes. Researchers should never share any sensitive personal information on TikTok’s in-app web browser or via the mobile app.

Before beginning your research, take some time to update your privacy settings on the app. Switch off ‘suggest your account to phone contacts,’ switch off ‘people who open or send links to you,’ switch off ‘Facebook friends sync’ and switch off ‘profile view history’.

What has Changed Since 2020?

TikTok originally only supported 15-to-60-second video options, but users can now also post three-minute videos. Ten-minute videos are currently available to some users and full release is likely to follow soon. TikTok has also added a livestream option for users who are over 16-years-old and have more than 1,000 followers.

User profiles still contain profile photos, biography, follower metrics, display and username, but users can now also link to other social media accounts (only Instagram and YouTube for now) in their profile. Currently, it is only possible to see if a user has linked to other social media accounts when using the TikTok mobile app. 

Similarly, users can add a URL to their biography. Many use this to link to a landing page platform such as Linktree, so be sure to click through to this if investigating a user as you might find links to their other social media accounts.

Users can now also create playlists, although these are also only viewable on the app, not a web browser like Chrome or Firefox. 

Update on Mobile App vs Web Browser Experience

TikTok is designed to be a mobile application. That means the web browser version has limited functionality compared to the mobile app but you’ll probably end up using both and moving videos from your mobile to a web browser like Chrome or Firefox on your laptop/desktop during the course of an investigation. I tend to think of the process like this: use the mobile app for content/account discovery and use the browser version on a laptop for archiving or performing analysis (geolocation, etc).

RT’s Russian-language TikTok account on the mobile app and the web browser. Images A and B show the mobile version, with a link to RT’s YouTube and follower lists. Image C shows the same account on the web browser where those features are not available.

A user’s followers and following lists are viewable on the app but not on the web browser, so if you find a noteworthy account and want to find more like it, use the app to click through and inspect these lists, effectively using a snowball sampling methodology, to discover similar accounts.

You can use the app and web browser version to perform searches using relevant keyword(s), for example Severodonetsk/Сєвєродонeцьк. On a web browser, you can toggle between tabs for accounts and videos that feature your keyword though you can’t filter your results and the feed of videos returned is generally sorted by relevance, meaning a combination of videos posted recently or that received large views or interactions.

On the app you can filter your video results by activity (whether you’ve watched or liked these videos before); the date the videos were posted (yesterday, this week, this month), or sort the results by relevance or most-liked. It’s recommended you perform your main searches on the app because of the increased search functionalities.

An example of the various fields you can use to filter your video search results via the TikTok mobile app.

Conducting Smart Content Searches on TikTok and Beyond

TikTok does not offer an official API, nor does it allow boolean searches to include specific dates in your searches. Therefore conducting searches using the date filters on the app is one of the most effective ways to discover timely videos. Naturally, if you’re conducting ongoing monitoring of Ukraine, or any other topic, undertaking daily or weekly searches and filtering your video results by ‘yesterday’ or ‘this week’ will give you the best chance of gathering relevant content more regularly. 

As a general rule for any open source investigation and online search, the more unique a keyword or search term is, the less noise or irrelevant information you will get in your results. This applies for TikTok searches too. Keywords related to locations remain the most effective search terms, especially specific terms and those related to smaller, less populated locations. For this reason, you can understand why Kyiv/Київ returns so many videos in a search, even if filtering for videos posted only ‘yesterday,’ compared to a district or a smaller town or village. If searching for Kyiv content, try street names or districts instead.

In the case of conducting searches about Ukraine, you should definitely include alternate English spellings of locations but, more importantly, you should also search using the Ukrainian language and Cyrillic script. It’s always smarter to search using local terms and the local alphabet. In other words, when deciding on your search terms it always helps to think like a local.

Two posts on the World Health Organization’s TikTok account; one post is using the video’s original sound (left) and the other post (right) is using a popular song available on the app as a TikTok Sound.

Unlike Twitter, Facebook and other platforms, TikTok does not offer users many ways to see how a video has been shared by others, unless the original video creator used their own audio for their video. You can then click through to see other videos that use that sound or audio by clicking on the track (which appears at the bottom of any post and is always named “Original Sound” followed by the creator’s username). However, if users created videos using TikTok Sounds or audio tracks (which includes many popular songs) clicking through to a feed of thousands of videos that use the same sound or song but are not related to the video you’re analysing, is practically useless.

Users also often react to and share videos from others by using the Duet or Stitch functions. Duet allows creators to record alongside existing TikTok videos, while Stitch offers creators the option to crop existing videos and add their own contribution to create a new recording that is then published on their account. You can also use these terms as keywords to include in your search. For example, if you want to see how others have shared videos from the account of RT’s Editor-in-Chief, Margarita Simonyan, try searching the username, “@simonyan.m”, with “#stitch” or “#duet” and then use date filters to refine your search. Or instead of “#duet” use the Russian/Ukrainian equivalent “#дуэт.” It’s not a perfect tool but it can often help you find supplementary content.

You can also use this approach to discover content around developments in the conflict that TikTok users are sharing and posting on the platform. By combining keywords like #duet or #stitch along with terms relevant to the conflict, such as locations, alongside date filters in your video searches, this can assist you in finding the latest related content that users are sharing on the platform, as highlighted in the #Duet Kherson example included in the image below.

Left: Search results for RT’s Editor-in-Chief, Margarita Simonyan “@simonyan.m” and “#duet”: results include video duets commenting on earlier videos posted on/by Margarita Simonyan. Right: Search results for “Kherson” and “#duet”: results include video duets commenting on other users’ videos about Kherson.

Unlike other platforms, TikTok allows users to easily download and share native TikTok content on other social platforms. Searching for something like “TikTok” and a relevant keyword, such as Donbass/Донбас, on other platforms can be an extremely effective way of finding relevant videos.

In addition, searching generic and noisy terms in the Hashtags tab, such as “Putin”, can also reveal additional specific hashtags that might be worth investigating. 

Or, you can use the new hashtag tool Bellingcat released that allows you to collect a dataset of TikToks associated with specific hashtags over lengthier periods of time.

Metadata and View Source Shortcuts: Find Views, Upload Time, Account Creation Time

Once you find a video of note, there are some handy shortcuts to find out more information about the video or when the account was created. When viewing a user’s feed on both the app and browser, you can see the number of views for each video they have posted. When you click through to a video, you can see the upload date (in the US date format). If you want the specific number of views or the specific upload time, there are some useful shortcuts you can use.

For views, open your video on your browser (Firefox, Chrome, Internet Explorer or Opera) and press Control + U (for Safari, it’s Control + Alt + U) and then open View Source (or right click anywhere on the page and select View Source if your browser still allows it). When a new tab opens you should press Control + F (on Mac, this Command + F) and search for “playcount”, the term used by TikTok to label video views. The number after the colon is the number of views it has received to date.

For the specific upload time, you should use the Bellingcat TikTok timestamp tool. Just input the URL of the video and the tool will display the specific upload time for you.

Left: A post from the Ukrainian Government’s TikTok account @Ukraine.ua. Top Right: Source code “playcount” search, revealing the exact number of views for the video is 18,100. Middle Right: Source code “createtime” search, revealing the exact post creation time in UNIX format. Bottom Right: Creation time converted to a readable format: May 10, 2022, 16:04:44 GMT.

The Not-So-Real Zelenskyy

Let’s put all of these skills to use and look at one of several TikTok accounts that claimed to be the Ukrainian President, Volodymyr Zelenskyy. The fact that the president’s website does not include any links to TikTok among the other listed social media accounts, as well as the absence of any verified TikTok accounts bearing his name, should be enough of a giveaway that there is no official Zelenskyy account on TikTok. Yet, there are opportunists, pranksters and bad actors who will try to convince users otherwise.

One such account, @official.zelenskiy, described itself as the “official” account of the President of Ukraine. The account (since removed, but archived here) had a photo of Zelenskyy on its profile, featured a playlist (viewable on mobile only) of Ukraine videos and its feed was replete with videos of Zelenskyy with the account’s username watermarked on the videos. The videos were shot front-facing, speaking to a smart phone, the selfie style for which Zelenskyy has become famous since the beginning of the invasion. However, Zelenskyy and his team prefer to use other platforms like Telegram and Twitter to post these videos, not TikTok. This supposedly-official account was popular and before it was removed had over 356,400 followers; its uploaded videos had received a total 2.2 million likes.

A TikTok account that claimed to be the official account of Ukrainian President Volodymyr Zelenskyy.

Using the methodology described above, we can find the upload times of this TikTok account’s videos and compare them to the same videos posted on Zelenskyy’s official accounts, such as Telegram. At no point did this TikTok account post a video before they were first posted on Zelenskyy’s Telegram, suggesting whoever was running this TikTok account was simply scraping content from Zelenskyy’s official account and reposting it.

There is another giveaway though. Every video posted after March 28 included the account’s username, @official.zelenskiy, as a watermark on the corners of the video. But if you examine any video posted before this date, right back to the earliest video on the account, posted on March 1, the watermark viewable on each video was @_dinim313.

This was the username of the account before it changed to the more official-looking alternative. Watermarked usernames are a great way of tracking account changes and spotting potential fakes or misleading videos. 

Left: A video posted on the fake Zelenskyy account on March 26 featuring the @_dinim313 username. Right: A video posted on the account on March 28 featuring the new @official.zelenskiy username.

My guess is that, seeing the large views the March 1 video received, this user decided to post only content featuring Zelenskyy and deleted any videos posted between January 25, when the account was created, and March 1, before then committing fully and changing their username around March 28 too.

At the start of the invasion, it was reported that many users pretended to be based in Ukraine and broadcast fake livestreams complete with added air raid siren sound effects to garner attention and interest from others users. Crucially, users can also seek donations and gifts from livestreams, demonstrating how misinformation about Ukraine could be monetised on TikTok. In fact, in the course of writing this article, I observed this fake Zelenskyy account broadcasting a livestream featuring a slideshow of selfie photos of the president to which users were encouraged to donate and send gifts to the account.  The account has since been removed from TikTok. Following the invasion of Ukraine, TikTok said it had dedicated significant resources to “developing and enforcing new protective measures” on the platform, including improving methods to detect and take action on livestreams broadcasting recycled or misleading content.

The Fake Zelenskyy TikTok account livestreaming and soliciting gifts from followers.

Web Browser Third Party Tools and Useful Plug-ins: Audio Analysis, Extracting Text From Images and Archiving Shortcuts

Note: In this section, unless otherwise stated, the browser and plug-ins noted here are on Chrome.

Now that we have explored how to navigate the platform itself, let’s look at some external tools that can help with TikTok research. These include optical character recognition (image-to-text) tools and how to analyse audio on TikTok.

First up: audio. If you are analysing a video on TikTok and it includes a song but it is not labelled or referenced clearly in the post and you want to know its name then you should use Shazam, a popular application that can identify songs-even from short audio clips. Two ways you can do this are: Install the Shazam plugin on your web browser, start playing the video and then click the plug-in to start Shazam or; play the video on one device, such as your browser, and start Shazam on your phone. The tool is generally very quick at identifying most songs and is also quite good at identifying remixes. It has also occasionally identified cover versions for me too.

An example of a Russian TikTok trend of posting videos holding a “Russian Lives Matter” placard. Many videos featured a remix of a song used by TikToker @Evgen_military.

Here’s an example (it appears TikTok geoblocked the video in some regions, an archive of the clip is viewable here). In early March many prominent Russian content creators on TikTok participated in a trend that saw them hold up “Russian Lives Matter” placards. Each video featured a remix of a song that was originally used by @Evgen_military but wasn’t listed as an official sound on TikTok, just an ‘original sound’ attributed to this user. The original video is now gone, but over 11,000 other videos have used this sound. By using Shazam, you could quickly figure out the song was a remix of the Soviet military folk song, Katyusha.

Beyond music, what do you do if you encounter a TikTok video in which you don’t understand the language that someone in the video is speaking and there are no text references or clues in the post caption? This is a challenge commonly faced by researchers conducting analysis in many conflict zones. Luckily there are numerous audio transcription and translation tools available online.

A quick caveat, though. Audio transcription tools are under constant development and while the technology underpinning these tools is becoming more sophisticated and capable at audio detection, we should still temper our expectations of what’s currently possible. A video of a speech, shot in a quiet room with little background noise offers more opportunities for a helpful transcription than a video taken on a busy street, and so on. Still, these tools can be quite effective at recognising references to locations or place names and sometimes, that’s all you need to geolocate a video.

A tool like Google Translate offers voice-to-text transcription functionality (via the mic icon) that can be really helpful. You can’t ask Google Translate to define the language before beginning, so you’ll need to have at least a small assumption of what the language might be. Or you’ll need to try out a few languages. If you’re working on a Ukraine investigation though, you can make an educated guess and set the language-to-be-transcribed as Ukrainian or Russian and translate it into English or whatever your working language is.

Using Google Translate, press the mic icon (circled in red) to begin voice-to-text transcriptions and translate the text into your working language.

Here’s how to do it. Start the transcription on one tab and play the video on another tab of your browser or on your mobile. Or switch it around and use Google Translate on your phone and play the video on your browser. Break the video down into 15 second segments and use the tool on each segment a few times and assess what is transcribed.

You can also use the Voice Typing function on Google Docs to transcribe audio in real time too, though one of the advantages of using Google Translate first is that it not only transcribes text but will immediately translate it for you too.

Extracting Text From TikTok Videos

As well as audio, you will likely encounter videos that contain text embedded on-screen that you might want to capture and translate. This can provide useful investigative clues. Unlike the text in the post caption that you can just copy and paste into a translation tool or run through a plug-in like Google Translate, embedded on-screen text can’t be copied. Instead, you will need to use optical character recognition software which is available on Yandex, Google Lens or other image-to-text tools that can extract the text for you. Plug-ins like InVID’s WeVerify are very helpful for conducting image reverse searches or extracting text from images, but these tools aren’t so flexible when you’re working with video. For that, we need a different approach.

You’ll probably have to play and pause a video many times, stopping each time you want to extract text from a new frame. You could obviously pause a video, screenshot the frame and upload that frame to Yandex or similar sites, but doing so would take a long time. Instead, a quicker way to do this is to install a plug-in like Copyfish. With this, every time you pause a video, you can then use the extension to quickly take a screenshot and paste the text onto a clipboard that will then open on-screen. Reminder: Press the gear icon to change the language you want to use Copyfish to capture. It doesn’t currently support Ukrainian but does support Russian (and I am told Ukrainian is on the way, also). Once your text has been copied, you can hit the Google Translate shortcut on the clipboard and this will open a new tab and translate the text for you.

Left: Using image-to-text tool such as Copyfish to select and extract text. Top Right: Make sure extracted text matches the text in the image and copy to clipboard or use Google Translate integration. Bottom Right: View results in Google Translate.

A quick example. On March 3 Russian state-controlled news organisation NTV published a video on TikTok showing Russian soldiers on the move in trucks and various armoured vehicles. The post’s caption states this was recorded somewhere in the Kyiv region. The video includes on-screen text which, using Copyfish, you can extract and translate to tell you the same. You can also use Copyfish to extract text from road signs too which, along with storefront names, can be invaluable sources of information. But where exactly in the region was this recorded?

At the very start of the video there is a large yellow and blue overhead sign that reads “Ukraine,” so, since we believe this video was shot in the Kyiv region, we can then surmise this is likely Ukraine’s border in the Kyiv region with Belarus. Can we get the exact location? At 0:08, the video shows a blue road sign which, again using Copyfish, you can extract the text from to tell you this is the “Полі́ський райо́н” or Polis’kyi district in the Kyiv region. (The Polis’kyi district was abolished in 2020 and incorporated into the Vyshhorod district though it’s possible the signs at border crossings haven’t been updated.)

Moving off TikTok, performing a web search for border crossings in the area will yield further information such as these photographs captured by Getty Images’ Chris McGrath who said they were taken in Vilcha, Ukraine, which is located within the Vyshhorod district. Further, in one of McGrath’s photos, you can distinctly see the road sign with “Полі́ський райо́н” in the background, meaning we can then confirm the exact location where the TikTok video was recorded.

To take it one step further, Getty Images’ states McGrath’s photos were taken on February 13. By comparing the state of buildings and the general scene in these images with the footage posted online on March 3, you can then begin to assess what may have been damaged or destroyed in the intervening period too. 

Archiving Shortcuts and Saving Your Work 

Once you’ve used the TikTok mobile app, you’ll immediately realise how quickly you can be pulled down numerous rabbit holes conducting different searches; inspecting a user’s followers, scrolling through videos on a hashtag page and so on. It’s easy to lose track of your progress or forget about a useful or interesting video you want to investigate further.

As noted above, I tend to think of the TikTok discovery process like this; use the mobile app for content/account discovery and use the browser version on a laptop for archiving and performing analysis. Naturally there are many ways you can create your own workflow like this but for those of you starting out on TikTok, here’s a sample breakdown of one easy way to do it. To move videos between the mobile and laptop web browser versions, you can use a live Google/Teams spreadsheet to log video URLs as you find them via mobile. Add a short one line summary when you add them to your spreadsheet to describe the content and the relevance of the clip.

Screenshot of excel spreadsheet that is useful to log TikToks, record content summaries and status for archiving.

On the TikTok mobile app you can of course like relevant videos and then see them instantly in your ‘liked’ video collection on the web browser, but incorporating a live spreadsheet means you save them somewhere external to the platform, which is good practice in case you lose access to your account. On mobile, you can also bookmark videos and add them to your favourites and create specific collections, which is definitely useful, but bookmarks/collections are only accessible on mobile, not web browsers.

By using a spreadsheet, you will also have a short description of the video available when needed and you can use different tabs/spreadsheets for numerous investigations instead of creating a singular clogged feed of videos on your ‘liked’ collection. For security reasons too, it may be wise to avoid liking or interacting with the content or user you’re investigating.

Once you open your videos on a web browser on your laptop, you should archive them. Tools like the Wayback Machine and Archive.Today are getting better at archiving TikTok content but they’re still not perfect. For high value videos, I prefer to save local versions of the video and download them directly. There are numerous plug-ins that do this. As well as video archives, you should also take screenshots of accounts, video pages and comments when needed too. A plug-in like Save to Google Drive is a one-click process that screenshots an entire page on a browser on your laptop. The added bonus of this tool is that you can select/create a folder on your Google Drive as the save location. Again, with many investigations in progress, having numerous, specific folders will save you time in the long run. As always, file management is the key to any good open source investigation.

Left: An example of Google Chrome extensions that can be used to download TikTok videos directly from the web browser. Right: Extension and folder destination options for saving to Google Drive.

Geolocation

Much of your investigation will likely involve trying to confirm the location shown in a piece of footage. Bellingcat regularly publishes guides and tutorials with tips on geolocation, including our recent article about the first steps you should consider before getting started. But since this invasion has also exposed lots of new people to online open source investigations, particularly through TikTok content, it’s also worth including a section here about what geolocation is like on TikTok. Spoiler: it’s not all that different to other platforms since you’re still working with visual footage, but there are some points to keep in mind.

First of all, read the caption and hashtags of the particular post and listen to (or translate) the audio of a video in case there are any geographical references to what is shown in the video. Read (or translate) the comments too. As previously stated, it’s best not to engage with accounts you are investigating, but in some rare cases it may be beneficial to ask others in the comment section where the location is; if you need to do this, remember to be careful about protecting your own identity whilst conducting your investigations.  Inspect the TikTok user’s account in full, examine their profile for references to their general location in their biography, other videos on their account or in their linked social media accounts.

Regarding the footage itself, it will be easier for you to view and analyse the video on laptop/desktop versus mobile. When examining the footage, look out for distinctive landmarks like buildings, monuments or street signs, or features on buildings. A shop name can be googled and their address could confirm the location. If you want to take it a step further, you might even want to use their phone number or social media accounts to contact them and ask them about the event that was captured in the footage.

Distinctive features are your friend when it comes to geolocation. The placement of lampposts, the width of a street, the location of train tracks and much, much more can all help you to corroborate and confirm a location. You can also incorporate the placement of the sun and shadows into your analysis to work on determining the time of day that a video was recorded too. This can be incredibly important work when establishing a timeline and you should read our guide for this specific task as well.

When you have an assumption, you will want to corroborate and confirm your hunch. Here, you should use satellite map imagery, including Google Maps or Yandex Maps (try out a few as each service can differ in quality depending on the location) to find and visit the location. Video or images from news organisations, government entities or local civilian or armed groups can also be extremely useful as they will often include geographical references when sharing footage online. And, of course, use Google to search images or search for locations (and use the timeline feature) on photo libraries for agencies like the Associated Press or Getty Images.

And lastly, use the crowd. There are active open source communities online, particularly on Twitter, but also on Discord, Reddit and other platforms, where you can ask questions about footage, share your findings and learn new skills. This is also where  journalists and people closest to an event tend to share information.

Things to Remember

We’ve covered a wide range of tools, tricks and tips to help you investigate the invasion of Ukraine (or any other event) like a pro! Before you start your own Ukraine investigation, here’s a quick list of things to remember:   

• Conduct searches in the local language first, Ukrainian or Russian terms.
• Use image-to-text or audio transcription tools to capture and translate to your working language.
• Use specific search terms and keywords, especially locations and place names, in combination with the date fields on TikTok video search to get the most up-to-date results.
• Follow valuable accounts, inspect their followers/following, view their accounts on mobile to access linked social accounts and search their usernames on other social platforms. Note usernames or videos in a separate spreadsheet to track your work.
• Archive, catalogue and save content as you go as conflict videos often get quickly taken down. Screenshot pages using one-click tools as you work.

Remember that you are going to get things wrong, especially if you are starting out with online open source investigations or using TikTok for the first time. It’s important that you are careful and considered in your research but most of all, it’s essential that you are creative and curious and seek new and additional methods to uncover more evidence and confirm (or dismiss) your findings. Lastly, archive everything.