Eyes on Russia: Documenting Russia's war on Ukraine

Using best practices established through the Centre for Information Resilience’s (CIR) projects and the wider open source community, CIR launched the Eyes on Russia project in January 2022, to collect, document and verify information coming out of Ukraine, as well as to provide a publicly available Eyes on Russia Map to share, inform and support research on what is happening in Ukraine.

Our ambition was to make verified and reliable information public, in order to support media, humanitarian, research, justice and accountability organisations. We did exactly that.

The Eyes on Russia Map and database is a CIR-led effort assisted by the wider open source community, and serves as an archive of verified information that can be used by justice, accountability and advocacy groups and a public map to serve and support research.

This report explains the methodology and practical steps conducted by the Eyes on Russia team to document the information seen in the Eyes on Russia map and database.

The processes outlined in this report that are undertaken by our team are guided by best practices established in the Berkeley Protocol on Digital Open Source Investigations developed by the Human Rights Centre UC Berkeley School of Law, Documenting international crimes and human rights violations for accountability purposes: Guidelines for civil society organisations from European Union Agency for Criminal Justice Cooperation (Eurojust) and methods and techniques pioneered through our other projects in this field, such as Myanmar Witness. CIR has had its methodologies reviewed by leading practitioners in the field.

Collaboration – who do we work with?

CIR is not the only organisation documenting Russia’s full-scale invasion of Ukraine; however, our collaborative database has seen more than 20,000 videos and photos collected and preserved, more than half of those have been analysed and verified.

That’s a lot of information, and this has been successful due to crowdsourced footage, submissions, and the effort of a large number of volunteers and organisations.

At Eyes on Russia, we have a core team of more than 10 investigators, and a wider network of volunteers and partner organisations that work around the clock to monitor, collect, and verify the content coming out of Ukraine.

We have partnered with international investigation groups such as Bellingcat and Geoconfirmed who also contribute to the database. We also work with organisations and individuals in Ukraine to enrich the database. Bellingcat also provides archiving assistance which allows our analysts to automate the archiving of data, allowing them to focus on the human-based verification which is our true value-add.

Output – who uses this information?

Information from our database is used by three main stakeholders:

1. Media and civil society
2. Policy and humanitarian groups
3. Justice and accountability efforts.

First and foremost, our data, analysis and investigations resulting from our findings support media organisations and civil society in their investigations and coverage of what is happening in Ukraine.

Second, the information is used by policy and humanitarian groups to assist in the strategic decisions, aid support, and situational awareness to inform decisions made on the ground to increase the safety of civilians, as well as to prevent and mitigate atrocities.

Finally, the data and valuable analysis is also used by organisations working towards justice and accountability and supports domestic and international justice and accountability mechanisms in war crimes and human rights investigations.

Methodology – steps to building a database of verified information

Our main effort at Eyes on Russia oversees the development of one of the biggest archived databases of verified information on Russia’s invasion of Ukraine.

The team first started this database as a small project to document, verify and make sense of Russia’s military buildup along Ukraine’s borders by mapping the verified information. Much of this content, in the form of TikTok videos of Russian military vehicles, was logged in a spreadsheet by CIR.

As the war evolved, so did the need to document the overwhelming amount of information, preserve it for future use and make sense of the information.

To triage the data emerging from Ukraine, our methodology follows six steps.

Researchers collect data commonly referred to as user-generated content (UGC) from open-source social media. This is the main focus of the collectors/investigators.

Main sources of UGC are Twitter, Telegram, Facebook, TikTok and YouTube. Data is identified through a combination of keyword, date-based and hashtag searches, and monitoring of data sources that generate high levels of relevant content.

Data is archived upon entry into the Eyes on Russia database. The database relies on the use of an autoarchiver, which supports the auto-archiving of relevant links which are stored on a secure server.

When the data is archived, the media (photos and videos), source code, and a screenshot of the source of the information, is all collected and stored in the database.

The collected data is then given a hash value using a SHA3-512 secure hash algorithm. This autogenerated hash value gives the data a unique value string, which would change, should the data be altered in any given way. For example, should a photo in the archive be edited, the hash value would differ to the original value. This hash value is then publicly timestamped on Twitter.

All collected data undergoes verification using independently replicable techniques such as geolocation, chronolocation and identification of visual features in the media to verify questions such as where it happened, when it happened, and what is being shown in the media. This is a process that our teams have excelled at from other projects such as Myanmar Witness and Afghan Witness.

To expand upon those techniques, the process of geolocation involves finding where the photo or video was filmed. This involves looking at visual clues in the footage, and matching it with satellite imagery, Google Street view, or other related media, to determine the precise coordinates of the location seen in the video or photo.

Chronolocation results in identification of the date of media. This may, at times, be less definitive than geolocation. However, through image reverse search, shadows, meta data, other footage from the same time and weather markings, investigators are able to ascertain the approximate time when a video or photo is captured and when an event occurred.

Content entered into the database is categorised based on a number of indicators, including, but not limited to: Russian military presence, bombing or explosion, ground battle, detention or arrest, civilian casualty, mass grave or burial, civilian infrastructure damage, military infrastructure damage, Russian military losses, munitions, Russian firing positions, Russian allies or movements.

Subcategories are also used on entries such as where there is civilian infrastructure identified in the footage, and is sub categorised as: residential, industrial, government, healthcare, education, military, commercial, religious, cultural, humanitarian, infrastructure, agricultural and communications.

Once data has been collected, archived, hashed, verified and categorised, it undergoes a review process by a team of senior investigators to ensure information is as accurate and reliable as possible. Data is also reviewed for privacy and safety to mitigate the risk of sharing footage that reveals where people who filmed acts by Russian forces live, or where footage reveals private information such as names of civilians.

The strength of open source investigations is shown when threading disconnected pieces of data together to give a full picture of what happened and who is responsible. Our team has conducted numerous independent investigations as well as in collaboration with media and accountability efforts to use our data as a launchpad for investigations.

Graphic content level – creating a safer viewing environment

While the verification of the footage is important, one of the core values of CIR is to ensure that our teams work in a safe environment. Many of our teams are regularly exposed to traumatic footage and information on human rights abuses, all of which can take a toll on mental health.

When documenting conflicts, there are a number of mitigating factors we undertake to regulate some of these risks.

One of those steps is the use of a graphic content level category, where the videos and photos are ranked on a scale from one to five. This allows reviewers, investigators and those viewing the footage to prepare themselves for graphic imagery. This is also seen on the map, where both violence levels are used, and graphic imagery is either blurred, or not displayed.

The Eyes on Russia map uses the codified values seen in the second column as: mild, moderate, severe, very severe.

Threading data – open source investigations on Ukraine

CIR investigators have used Eyes on Russia data both from the database, and the map, as a launchpad for numerous new investigations to uncover new findings, and reveal the extent of what is happening in Ukraine.

The breadth of investigations cover numerous topics, such as the use of mapped data to reveal trends, analysis of satellite imagery to reveal the impact of the war on civilians or the use of propaganda and disinformation to distort the truth of on-ground events.

Examples of our investigations are:

• Mapping the systematic targeting of infrastructure in Mariupol
• Debunking Russian disinformation during its withdrawal from Snake Island
• Mapping the systematic targeting of educational infrastructure in Kharkiv
• Finding where rockets were fired from that killed many civilians in a train station in Kramatorsk, Donetsk region
• Tracking how Ukrainian civilians are illegally deported to Russia
• Showing how the Russian Government weaponises children for pro-war propaganda
• Mapping mass graves in Ukraine after Russia’s full-scale invasion
• Investigating soldiers killing Ukrainian civilians fleeing the war on highways near Kyiv.

Our investigative team also supports media in their analysis of events, powered by data. Examples include:

• Showing the strategic targeting of Ukrainian energy infrastructure sites by Russia in the buildup to winter
• Tracking the growth of mass graves in Russian-occupied Mariupol
• Showing how schools are being targeted in Ukraine
• Tracking the war around Ukraine’s nuclear power plants
• Showing how Russian soldiers ran a ‘cleansing’ operation in Ukraine’s Bucha

Visualising data – Eyes on Russia Map

Mapping verified data is crucial to gaining a better understanding of events on the ground in Ukraine. CIR has been publicly providing a map of verified information since the start of Russia’s full-scale invasion in Ukraine since the beginning of 2022, and continues to build upon and improve the data and the ability to analyse and search through the data displayed on it with the support of C4ADS.

The Eyes on Russia Map draws on the database of videos, photos, satellite imagery or other media stored in the database managed by CIR. The information on the map has been verified for authenticity and location.

Data can be selected and shown on the map in a number of ways: by category, by sector, by start and end date of specific events and by keywords such as place names using the free text box

These search functions can be applied together or on their own. The map will present data complying with your search parameters. Each pin on the map represents a piece of verified data.

The map also allows for an assortment of categories and subcategories of the data. For example, civilian infrastructure can be represented, and sub categorised to only show healthcare infrastructure.

Given the nature of the data in both its location and date verification standard, specific geographic areas can be selected, as well as windows of time on the timeline of verified data. In the example below, Mariupol is seen with the data from February to May only shown.

The history of the Eyes on Russia map and a guide on its simple features can be found on YouTube.