How OSINT shaped reporting on the war in Ukraine

When Russia launched a full-scale invasion of Ukraine in February 2022, open source investigative techniques – or OSINT – entered the mainstream, with journalists and analysts around the world turning to these tools to track troop movements and investigate potential war crimes. Three years on, we ask CIR staff how OSINT has altered perceptions of the war and shaped reporting.

“I believe almost every person in Ukraine is aware of OSINT after MH-17”, says Yuliia Chykolba, head of CIR’s Ukraine office. In 2014, a commercial Malaysia Airlines jet carrying 298 passengers and crew was downed over Donetsk Oblast by a surface-to-air missile launched by Russia’s 53rd Anti-Aircraft Missile Brigade, according to a now famous report by Bellingcat. The release of this report, which drew on open source information, helped cement public perceptions of OSINT as a legitimate form of digital investigation. It was also an early indication of OSINT’s latent potential for impactful analysis of the war in Ukraine. 

“When it comes to media consumption, the full-scale invasion was unique”, says Eyes on Russia investigator Rollo Collins. Collins says the full-scale invasion is “the first case in which the mass use and large-scale concentration of conventional forces can be seen from satellite imagery”. 

This enabled investigators to not only identify instances of infrastructure damage, but also to track and identify the movement of forces through satellite imagery. As Eyes on Russia Project Director Belén Carrasco Rodríguez points out, OSINT has proven that “in the context of Russia’s full-scale invasion of Ukraine, digital investigation techniques are crucial to expose potential war crimes from afar and support efforts to hold perpetrators accountable for the crimes and abuses committed”. 

The Eyes on Russia project has worked with hundreds of volunteers and dozens of local and international partner organisations to track troop movements, document damage and civilian harm, and monitor potential war crimes, including the forcible deportation of Ukrainian children, torture and illegal detentions, and the systematic killing of civilians, documenting over 23,000 incidents in an interactive online map. Investigators use techniques such as geolocation and chronolocation to verify user-generated content, which is corroborated with media reports or satellite imagery analysis.

Olena Oliinyk, who was self-taught in OSINT for two years before eventually joining CIR as an investigator, says it allowed her to look back and “analyse in detail” how Russian propaganda operated in February 2022. The various disinformation campaigns waged by the Kremlin were reported by Politico as early as March 2022. Another article, published by the Alan Turing Institute, documented how a dramatic surge in the Telegram activity of pro-Kremlin influencers occurred in tandem with ceasefire violations in Ukraine’s eastern territories at the outset of the full-scale invasion. These cases are indicative of what Oliinyk describes as the “immense resources Russia dedicates to hybrid warfare” – the use of diverse methods in service of military objectives. 

Following the full-scale invasion, the Kremlin’s ban of western-owned social media platforms, namely Instagram and Facebook, prompted users to migrate to other sites like Telegram. The platform’s daily audience in Russia increased by almost 50% (from 27.5 to 40.6 million) between February and March 2022, according to Forbes. 

Telegram has since become home to an extensive community of pro-war Russian military bloggers, turning the platform into a valuable resource for both Moscow and OSINT analysts documenting the conflict. According to a study by DFRLab, ties between this community of “millbloggers” and the Kremlin exist but vary in extent, and findings from a study by the Alan Turing Institute suggest that pro-Russian online activity does not necessarily need to be entirely coordinated by Moscow to align with its military objectives. The diversity within this complex network of commentators – ranging from Kremlin-adjacent to private military company channels – makes for a uniquely useful resource for investigators, but is often difficult to unpick. 

According to Fernando Tabarez Rienzi, an investigator at Eyes on Russia, this information landscape, combined with the Kremlin’s “hostility” towards independent reporting, has rendered OSINT the “primary form of information collection and verification” within the Russian information sphere. This places OSINT in a unique position. Tabarez Rienzi believes that, far from supplanting traditional investigative journalism and war correspondence, OSINT is a “major complement to the investigator’s toolkit”, taking us “beyond the localised information sphere”.

Crucially, OSINT functions as a powerful extra lens that enables investigators to remotely verify evidence and witness claims emerging from on-the-ground sources. Tabarez Rienzi points to the example of a recent Eyes on Russia documentary which investigated multiple videos showing the executions of 80 Ukrainian servicemen. In these cases, OSINT techniques allowed investigators to determine the military allegiance of the combatants and the dates and locations of the incidents, suggesting they were not “attributable to a single military formation” but part of a wider pattern. This ability to “establish wider contexts” is one of the chief advantages of OSINT, Tabarez Rienzi explains.

Tabarez Rienzi’s conviction that OSINT is adept at uncovering “wide ranging disinformation campaigns” is shared by Oliinyk, who says OSINT opened her eyes to the “sheer scale of Russian information campaigns”. These campaigns have been studied extensively by CIR’s Alona Shestapolova,  who has focused in particular on the state-controlled communication directed against Ukraine following Russia’s occupation of Crimea in 2014. Utilising open source data, Shestapolova’s research shows how these communications “provided a variety of false justifications”, establishing a framework for “how millions of Russians and pro-Russian individuals interpret the ongoing war”. A potent reminder that the roots of the current conflict stretch back further than 2022, this research demonstrates how OSINT techniques can be applied on a macro level to help us understand the longer, often more elusive processes that shape conflicts.

Awareness of OSINT is also growing among the Ukrainian population living through the daily realities of the conflict. According to Chykolba, this awareness extends to OSINT’s many strengths, from debunking mis- and disinformation,  to tracking conflict dynamics and supporting accountability efforts and evidence gathering. OSINT is one of the “very few available tools” for prosecutors and investigators, Chykolba adds, especially in occupied areas of Ukraine where on-the-ground investigations are either difficult or impossible to conduct. Chykolba also draws attention to the numerous OSINT Massive Open Online Courses (MOOCs) available in Ukrainian as a telling indication of how OSINT has both grown in popularity and altered the information landscape in the country.

There are also challenges ahead, however. In a recent CIR article, Eyes on Russia’s head of open source, Benjamin den Braber, indicated how increasing awareness of OSINT among perpetrators could lead to self-censoring, which would effectively shrink the pool of evidence available to investigators. An article published by the Royal United Services Institute also highlights the problems posed by the sheer volume of open source information – for instance, the Ukrainian Archive, which preserves digital evidence of human rights violations in Ukraine, has over six million records. Squaring the ever-growing reams of available information with the time, care, and resources needed for robust, impactful analysis remains a major challenge. 

Despite challenges, OSINT has helped secure a number of key victories in recent years. For example, several CIR investigators participated in a successful international effort, reported by the BBC, that used facial recognition techniques to track down Ukrainian children believed to have been abducted during Russia’s full-scale invasion. Tabarez Rienzi also points to the European Commission’s recently established special tribunal on aggression against Ukraine as further progress towards justice and accountability. 

“It is a big win for those of us who work tirelessly to hold Russia to account,” he says. “We will continue monitoring, analysing, and verifying Russian war crimes until justice is served”.