By Amra Dorjbayar, Archit Mehta, Ben Heubl, Brecht Castel, Kalim Ahmed, Alberto Olivieri, and the volunteers of GeoConfirmed.
On the morning of 16 April, an armoured factory plant in the East of Kyiv was attacked with precision missiles by the Russian military. At least three Ukrainian civilians were killed in the attack.
The strike came after a Ukrainian news channel, 1+1, broadcast a report on 7 April. They reported on how the factory was converting captured Russian military equipment for use by Ukrainian forces. The 1+1 news coverage was seized on by an open source intelligence group called Rybar, supportive of the Russian invasion.
This investigation by the Centre for Information Resilience’s Eyes on Russia team reveals how Rybar accurately geolocated the factory, published the coordinates and, in doing so, supported a lethal, precision strike by the Russian military.
The investigation shows how verification of footage filmed in Ukraine has been potentially used to identify Ukrainian military facilities, which were then bombed. This is despite a decree issued on March 3 by the Ukrainian Government prohibiting the broadcasting of military facilities. The decree was intended to prevent footage filmed by Ukrainian journalists from revealing potential targets.
Finally, our investigation also determined that one of the destroyed Russian BMD-4s contained a sophisticated thermal imaging camera distributed by Thales, a French arms company. It is possible that an expensive, increasingly rare, Russian precision missile was deployed to prevent the system from falling into Ukrainian hands.
This information comes after Disclose, a media outlet, revealed in March that France exported 152 million euros worth of arms to Russia between 2015 and 2020, despite a European Union embargo imposed after the annexation of Crimea in 2014.
It further adds to the body of evidence suggesting that Russia has been taking military action that seeks to present its position as winning the war, despite the facts on the ground indicating that it has struggled to achieve its goals since the beginning of the invasion.
Overview of our investigation
On the morning of 16 April, far from the front line, people in East Kyiv woke up to the sound of a Russian missile attack. It was a targeted, precision attack on one building, a workshop. At least three Ukrainian civilians were killed in the missile strike. Why was this factory building hit? How was its location determined? And who was responsible for the deaths?
Our investigation used open source investigative methods to determine the answers to these questions. These methods are commonly referred to as open source intelligence techniques, or OSINT, and will herein be referred to as such.
According to satellite imagery, the workshop was almost completely destroyed by the rocket impact. The surrounding buildings were not damaged, thus indicating a precision airstrike.
Figure 1: Footage of the aftermath of the rocket strike in East Kyiv.
Figure 2: Satellite imagery showing the location of the workshop.
Russian army spokesman Igor Konashenkov said on 16 April that ‘a high-precision long-range aerial weapon destroyed the production building of a tank factory in Kyiv […]’.
Vitali Klichko, the Mayor of Kyiv, announced on Telegram the same day that ‘as a result of a rocket attack this morning, in the Darnytskyi district there was one death, and several wounded were hospitalised'[sic].
However, pictures from the Ukrainian news site gazeta.ua show at least three bodies at the site of the impact. Although firefighters were extinguishing the fire and ambulances were present, three bodies lay in front of the destroyed building.
Due to the sensitive nature of these images, we have blurred the visuals.
Figure 3: Footage of the deceased civilians in front of the factory in Kyiv.
Yet, nine days earlier, on 7 April, the Ukrainian TV channel 1+1 broadcasted a report on the now destroyed military repair facility.
The Ukrainian TV audience watched how confiscated Russian tanks were repaired and transformed for combat among Ukrainian troops.
The journalist said:
‘Electricians are installing Ukrainian radio communication instead of Russian. They are hurrying, because this vehicle has to return to the front as soon as possible. But this time with the barrel pointed at its former owners.’
Figure 4: A screenshot from a report about the military repair factory.
Since the report only shows footage of the workshop indoors, it is not immediately possible to determine its location.
However, the video started to circulate on social media such as Reddit (left) and VKontakte (right).
Figure 5: A screenshot from a report about the military repair factory.
Through this widely circulated report, the footage was obtained by OSINT investigators supporting Russia in the war against Ukraine.
After the report of 1+1 went viral, Rybar, an anonymous pro-Russian telegram account, located the exact location of the factory. Rybar has over half a million followers; “rybar” translates as ‘fisherman’ in Russian. The account claims to use OSINT to ‘fish for interesting info in the wild sea of information’ and reports on the war from the Russian perspective.
Figure 6: A screenshot of Rybar’s Telegram Page.
Rybar takes credit for the attack
Rybar posted the following on 14 April, two days before the missile strike:
‘After a detailed analysis of the video (from 1+1, ed), our team managed to find out that the video was filmed in the Kyiv armoured vehicle factory. […] it was even possible to find the specific workshop where the armoured vehicles in the video were located. The exact coordinates are 50.418871, 30.701717. This location is definitely worth sending several missiles to.’
Their message contains screenshots of the report in question from the Ukrainian channel 1+1 (red boxes in figure 7), shows the location of the workshop on map and satellite images (blue box in figure 7) and even contains the exact GPS coordinates of the building (green box in figure 7).
Figure 7: A screenshot of the report by Rybar.
How did Rybar find the exact coordinates?
It’s difficult to ascertain exactly how they did it. Yet, we can replicate possible steps using OSINT and verify that it was indeed possible for Rybar to determine the location.
For example, the 1+1 journalist mentions “factories” where T-72 “tanks” are repaired. A simple search for “tank” and “factory”, in Ukrainian, yields few results since Ukraine has only a handful of major factories for armoured vehicles.
As there are only a few factories to choose from, Rybar could have scanned old Google images of all those tank factories. In this way, it is relatively easy to compare the report’s video footage with images of those factories.
One can exclude other factories by recognising the colours on the walls, the size of the windows and the height of the factory ceiling. As a result, it can be concluded that the 1+1 journalist visited the Kyiv Armoured Plant. This is the same location where T72 vehicles were repaired before the invasion.
To determine the exact location of that particular factory workshop, satellite images from Google Earth can be used. The long building with white beams, the width, and other features of the building would have helped to confirm the specific building structure anyone can access on Google Earth.
So, with several simple searches and combining public sources, it was possible to determine the exact location of the workshop based on the 1+1 report.
Rybar also claimed responsibility with their OSINT, for contributing to the deadly missile strike:
‘On 14 April, our team located a repair shop for military vehicles in the area of the Kyiv armoured vehicle factory […] During the night of 15 to 16 April, that installation was destroyed.
This is probably the best confirmation of both the practical usefulness of our work (publishing coordinates of possible targets, ed.) […].’
A Propaganda Attack
From the previous analysis, the attack had a significant human toll, but did it also have a major military impact?
A video on Telegram shows that at least three armoured vehicles were present in the building when it was destroyed. The destroyed building can only hold approximately ten vehicles, so more material damage is not possible.
Figure 8: Footage showing the aftermath of the missile attack.
One of these vehicles was also present when 1+1 travelled there to shoot a report. If we compare visual elements in the video after the destruction of the building (incision) with a vehicle from the 1+1 report, they match (coloured frames).
Figure 9: A screenshot of the footage from the aftermath of the missile attack.
Since the start of the war, Ukraine has already seized at least 376 Russian armoured vehicles, including tanks. So, this missile strike would have less significance than what was originally intended.
We showed the images of the rocket attack to Mart de Kruif, former Lieutenant General of the Dutch Armed Forces: ‘The military value of such an installation is scarce. In my view, therefore, this is a low-value military target.’
‘It is possible that the Russians have used a precision weapon here,’ de Kruif continues, ‘but that is not efficient. The Russians have a big problem with the number of long-range precision weapons. Using these scarce resources against a target of limited value, therefore, seems to have more of a psychological effect than a military one. It is, therefore, an attack with a strong propagandist character.’
Ex-US military analyst Henry Schlottmann points out that the Kyiv Armoured Plant would have delivered a total of 50 BTR-3DA vehicles to the Ukraine Army and National Guard in December 2017.
It produced more than 100 vehicles for the army and the National Guard in 2017, and it was equipped with advanced assembly equipment, production tools, and welding devices.
Schlottman admits that the workshop destroyed only contained a few vehicles, limiting the attacks` strategic value.
The use of publicly available footage to coordinate targeting
According to The Economist, the war in Ukraine is the most transparent war in history. This case is a perfect illustration: a workshop in a TV report became a Russian target after an OSINT analysis.
The Ukrainian reporting rules for journalists covering the war are very strict. On 3 March, the Commander-in-Chief of the Ukrainian Armed Forces, Valerii Zaluzhnyi, issued a decree that prohibits journalists to publish ‘descriptions, pictures and symbols that identify or could identify military facilities’. This rule exists to stop the very incident this investigation has revealed from happening.
It also shows that at any time footage is about to be shared online, it should be assessed through ethical and editorial frameworks as to what risk that footage might pose – for example, does the footage reveal any information that should remain protected or private?
Civilians who share information useful to the Russian military on social media can be subject to punishment. For example, a user who posted on TikTok that a Ukrainian battalion was hiding in the parking lot under a shopping centre, which was later bombed by Russian forces, was arrested by the Ukrainian security service SBU.
It could be argued that mistakes were made by 1+1 to allow military footage to be broadcast without an assessment of the consequences. Yet without Rybar’s OSINT investigation, the TV report might have escaped the Russian army’s intelligence service.
Rybar claims to have more than 150 volunteer OSINT researchers in their ranks. They have already published more than 150 coordinates, including potential targets for the Russian military.
These include bridges, railway stations and buildings where aid was gathered. Additionally, they receive donations via crypto-currency into an account number from Moscow. This indicates a possible violation of Telegram’s terms of service, which prohibit ‘promoting violence on publicly visible Telegram channels’.
The aftermath of the attack
On 5 May, Ukrainian President Volodymyr Zelensky posthumously awarded five employees of ‘the Kyiv armoured factory’ the order for bravery. This seems to indicate that there were two more deaths than initially reported. Their names are known, but so far, we have only been able to say with certainty that one of them worked at Ukroboronprom through analysis of individual social media profiles.
With obvious low strategic value for Russia to attack the repair facility, according to experts, the question remains: Why? Did the importance of technological know-how found by workers in the Russian vehicles make the facility a strategic target?
In a 1+1 recording, the narrator mentions how Ukrainian forces examine captured Russian equipment and technology: ‘…factories not only repair but also study Russian equipment, for example, the latest BMD-4, a landing combat vehicle’.
One of these BMD-4s in the bombed-out hangar has a striking inscription ‘V5’ and reveals troubling information about French arms deliveries to Russia.
Figure 10: A screenshot showing the BMD-4.
We were able to ascertain where this ‘V5’ appeared earlier in Ukraine by comparing the images of 1+1 (left in figure 11) with other images of armoured vehicles in Ukraine, such as a video on TikTok (right in figure 11).
Based on the bullet impacts, we have verified that it is the same vehicle.
Figure 11: A comparison between the two images of the BMD-4s.
The TikTok video shows a John Deere tractor pulling the V5 on a public road. Such videos have frequently gone viral during Russia’s invasion of Ukraine.
Figure 12: A screenshot from the TikTok video showing the BMD-4 being pulled by a tractor.
Through Google Street view, our team of investigators found that the tractor is located west of Kyiv. It is driving away from the besieged cities of Irpin and Bucha towards the South.
Visual elements in the video (left in figure 13) correspond to Google Streetview on that spot (right in figure 13): a road sign (red frames in figure 13), a chimney (yellow frames in figure 13) and a detail of a building (green frames in figure 13) match.
Figure 13: A screenshot showing footage of the BMD-4 compared with Google Streetview.
Earlier, on 13 March, photos surfaced of the Georgian legion of the Ukrainian army posing in front of the Russian V5 (left in figure 14). On 3 April, Ukrainian soldiers also posted photos of the armoured vehicle on Facebook (right in figure 14).
Figure 14: Footage of Ukrainian soldiers posing in front of the BMD-4.
The exact location of these photos could not be determined. However, Russian vehicles with a V appeared mainly in columns that entered Ukraine from Belarus West of Kyiv and fought around Irpin and Bucha.
According to the Russia-Ukraine Monitor map of verified war images from the Centre for Information Resilience (CIR), it is possible that the V5 entered Ukraine with Russian troops via Belarus. This suggests that the V5 tank was involved in one of the most gruesome phases of the war.
Work on the vehicle allowed for links to be revealed suggesting that it belongs to a French equipment manufacturer in Russian military assets. The evidence was revealed on 21 April when the Ukrainian vlogger Pavlo Kachtchouk published a video on YouTube showing the same V5.
Importantly in this video, the background was blurred. Possibly to make it impossible for Russian OSINT investigators to determine the location of the vehicle this time. The team of investigators were not able to determine whether this footage predates the missile strike or whether the V5 was able to escape because the vehicle was moved.
Figure 15: A screenshot from footage by Ukrainian vlogger showing the V-5.
Kachtchouk shows in his video that this tank contains a thermal camera with the “un-Russian” name Catherine FC. These thermal cameras are manufactured by Thales, a company in which the French state is the largest shareholder.
On the Catherine FC in the V5 is a logo of Thales. That thermal camera, which is integrated into the visor system of a tank, can detect a target within a radius of about ten kilometres, during the day and at night.
‘It is a very high-tech tool that provides an extremely important tactical advantage,’ a former employee of Thales’ defence branch explained to Disclose.
Thales states that ‘no export contract for defence equipment has been signed with Russia since 2014 and there have been no deliveries to Russia since the beginning of the conflict in Ukraine’.
Indeed, this camera was not manufactured in France, but in 2016, in the Russian city of Vologda. Thales entered into an agreement with Russia’s Vomz in 2009. Vomz is a member of the Russian-state owned Rostec defence conglomerate.
Despite the EU sanctions, Russia, with the support of Thales, was able to produce the thermal cameras that were to equip the tanks deployed in Ukraine. The Thales brand can be seen in the image below.
Figure 16: A screenshot showing the thermal imaging camera.
Disclose revealed in March that France exported 152 million euros worth of arms to Russia between 2015 and 2020, despite the European embargo imposed after the annexation of Crimea in 2014.
Was the factory targeted in a precision strike to prevent the Catherine FC camera being deployed against Russian troops? We cannot say for certain. Yet the rationale for this missile strike, which claimed the lives of at least three Ukrainians, remains elusive.