From censorship to disinformation, to the mental health repercussions that come with exposure to graphic content – several CIR open source investigators shed light on the challenges of investigating human rights abuses and war crimes.
Photo by Mstyslav Chernov/ UnFrame. Journalist documenting events at the Independence Square during clashes in Kyiv, Ukraine, February 2014. This file is licensed under the Creative Commons Attribution-Share Alike 3.0 Unported license
Open source, or “OSINT”, is the process of gathering and analysing information from publicly available sources. In recent years, it’s proven critical for conflict and human rights monitoring, particularly in countries where press freedom is severely restricted.
An open source investigator can carry out research from the comfort of their study or bedroom, but whilst they remain shielded from the physical dangers of conflict, they face a myriad of other obstacles in conducting their work safely and effectively.
We sat down with four of our open source investigators to discuss the challenges they face working across Gaza, Ukraine, Sudan, Myanmar and Afghanistan.
Press restrictions and internet blackouts
By definition, open source investigators are limited to information from public sources – often images, videos and other user-generated content (UGC) shared on social media. However, a reliance on information that is publicly accessible means that research is hindered if civilians and journalists are prevented from sharing information in the first place.
In some conflicts, actors may deliberately block internet access, as has been the case with extensive blackouts in Gaza and Sudan. Investigators from CIR’s Eyes on Russia project note the use of electronic warfare trucks in the occupied territories, jamming mobile phone signals and preventing people from communicating with each other and posting footage to social media.
Reporting from journalists on the ground provides crucial insight for open source investigators, allowing them to cross-check social media claims and understand the broader context of an incident or conflict. However, many of the countries CIR investigators work on face limited press freedom, which means those trying to monitor from afar face limited visibility of events on the ground.
“Limited media freedom can really limit the amount of content we can find on certain incidents, which makes it harder to confirm details,” notes Benjamin Den Braber, an investigator on CIR’s Afghan Witness project.
Self-censorship, threats to personal safety and selection bias
Given that open source is heavily reliant on visual content that investigators can analyse and verify, internet connectivity and access can also significantly influence the flow of information from a region.
For instance, Afghan Witness investigators note a steady stream of information from the capital, Kabul, but a far more limited visibility of Afghanistan’s rural provinces, where internet connectivity is scarce.
Even in regions where access to the internet is more common, self-censorship can limit information from surfacing. Civilians may be hesitant to share information online out of fear of being persecuted. Afghan Witness investigators point to the repressive regime of the Taliban, under which citizens are cautious to post online about acts of violence, let alone photograph or film them.
In Sudan, this pervasive sense of fear means investigators are heavily reliant upon footage shared by the Sudanese Armed Forces (SAF) and its rival, the Rapid Support Forces (RSF), in addition to affiliated militias.
It’s a challenge that’s compounded by restrictions on the press – with limited access for independent or international journalists, much of the information that does surface from Sudan stems from state-controlled outlets that push the SAF’s narrative.
It’s also worth noting that the information that’s vital for analysts and investigators to do their work can put the person behind the camera at significant risk. In a war zone, sharing images and videos on social media can mean risking arrest by either side of the conflict, notes Tom Jarvis, a CIR Eyes on Russia investigator. “If you [a citizen of Ukraine] post a video online, it is very likely that your own security forces, or the Russians, can accuse you of being a spy,” he explains.
“Generally speaking, people are very scared, and rightfully so, to post footage of, let's say, a convoy moving, because every single soldier does not want that to be posted, except the other side.”
This also leads to a significant selection bias in the information available to open source investigators, Tom adds, pointing out that only a fraction of information surfaces online.
“Not everything is reported on equally, because people have to pick and choose what they share. It's not like there's just a live feed of everything going on.”
A “murky” information environment
Open source investigations are arduous – requiring hours of painstakingly combing through what can at times feel like white noise, and attempting to filter out the relevant from the irrelevant, and the accurate from the inaccurate.
Open source has proven essential in documenting and verifying incidents amid the worsening humanitarian crisis in Gaza. However, CIR Investigators monitoring the situation note that the many conflicting narratives have produced a “murky” information environment, making it difficult to understand events from open source alone.
“The data is out there, but having the capacity and resources to filter it, identify it and collect it properly – that’s a challenge,” says Tom. “In a lot of cases, the relevant information is hard to find, more so than it’s unavailable.”
Investigators must work in an environment where a single source can prove both reliable and unreliable at different moments – something Mohamed (referred to here by a pseudonym), an investigator at Sudan Witness, has observed. He points to the social media pages of the SAF and RSF, both of which have developed a reputation for occasionally accurately describing incidents, but also purposefully disseminating misleading information.
Since the onset of Russia’s full-scale invasion of Ukraine in February 2022, Russian influence operations have intensified, spreading mis- and disinformation with the ultimate aim of undermining support for Ukraine.
“The best disinformation is generally not a blatant lie,” explains Tom. “It’s normally something believable that can be backed up by a misrepresentation of something that's happened. We saw this with the collapse of the Kakhovka dam. Some were saying it was Ukraine, some were saying Russia, some said it was an accident.”
The process of information laundering – combining clean and dirty information until the two become indistinguishable – has made it increasingly difficult to detect or debunk manipulated information.
“It doesn't matter that there is one convincing story – you just need to muddle up all the information so much that every reputable source is likely to be misquoting at least one fake source,” adds Tom.
“Then no one can get to the bottom of it, because there is too much information that's contaminated with partial truths.”
Whether intentional or unintentional, individuals and media outlets can share information that is old or presented out of context, further muddying the waters for investigators.
Benjamin considers this a regular occurrence in Afghanistan: “Let’s say there has been an explosion in Kabul and the media goes on to reshare an image of an explosion in Kabul but from two years ago. This can obscure our process – is this image new, or is it actually from the incident we're trying to investigate? Verifying these things can be very time-consuming.”
Interestingly, the growing popularity of open source has in some cases contributed to the spread of false information. In April, Bellingcat covered some of the common mistakes they observe within the OSINT community – such as not providing the original source or archiving social media posts before they’re removed. Bellingcat also points out that the nature of social media and 24-hour breaking news – where everyone rushes to report the news first – means that for some amateur investigators, the desire for speed can override methodology and accuracy.
Benjamin has observed an increasing number of OSINT accounts on social media sharing their analysis of events, some of which have proven inaccurate. He says he commonly notes errors – whether accidental or intentional – in satellite imagery analysis and geolocation.
“Something I’ve seen recently, for example, was satellite imagery of strikes in Iran by Israel,” Benjamin adds. “The OSINT account posting claimed that there was damage to a specific facility, pointing to craters, but these were actually just the shadows of clouds.”
The paradox of OSINT
Social media can prove a double-edged sword for OSINT investigators: whilst such platforms are fundamental to open source research, they also pose unique obstacles to the process.
Benjamin, who also conducts OSINT investigations into the situation in Gaza, notes the popularity of Instagram in capturing events, particularly the ‘stories’ function, where users can temporarily share images and videos with their followers. However, because the posts expire after 24 hours, investigators have to identify and archive the relevant content before it disappears.
Regular operational and algorithmic updates can also affect the methods investigators use to retrieve information. According to Tom, data collection has become particularly difficult due to recent platform changes.
“If you’re looking to collate massive datasets, it's pretty much impossible unless you are paying for very expensive tools or you get creative and construct your own bespoke ones.”
The push for increased content moderation has served as an additional challenge. Last year, the BBC reported on the use of artificial intelligence to remove graphic content, and found it may have erased evidence of war crimes and human rights abuses in the process.
While recognising that content moderation is much needed to protect social media users, Tom also points to the challenges for those who are trying to quickly archive potential evidence in the hope that it can support accountability mechanisms and, potentially, prosecutions.
“Nowadays, a lot of the stuff that would be very useful to OSINT investigators, all of a sudden, is being deleted within seconds because it's automatically detected as inappropriate,” Tom says. “It makes it a lot harder for researchers to be able to pick it up because the moderated content isn't then open sourced.”
A human perspective
Being an OSINT investigator requires sometimes hours spent forensically examining the same graphic clip to piece together vital fragments of information, which inevitably takes its toll mentally.
The term “vicarious trauma” refers to the emotional residue of exposure to the fear, pain and terror that others have experienced, and it’s common among investigators and others who work in roles where they are frequently exposed to traumatic content. “The mental challenge is the biggest challenge, not just for me, but for all investigators,” says Benjamin.
“We investigate human rights violations and war crimes, so what we see is the most violent footage – some days, that’s all you see. It can be very difficult.”
This can be especially arduous when the investigator bears a personal connection to the conflict they are investigating. One investigator, from CIR’s Myanmar Witness project, speaks of the emotional challenges of viewing imagery of the State Administration Council (SAC) inflicting harm upon civilians in Myanmar. He explains this is particularly difficult as a Burmese citizen who has witnessed the violence of the conflict firsthand.
Such work can also put investigators themselves in harm’s way, with risks particularly high for those who are citizens of the country they are investigating. For this reason, some CIR investigators operate under pseudonyms and are particularly careful about what they share online.
For those who are public about their work, harassment – both online and in person – poses a risk, or perhaps even arrest, if they were to enter countries in which they would be considered a political enemy.
And while the remote nature of OSINT has allowed thousands of investigators from countries all over the world to connect on social media through their shared passion, it is, by the same token, an isolating line of work.
“A lot of OSINT is remote, so quite often you don't have a lot of direct contact with your colleagues,” says Benjamin. “It is nice to have a break and a quick chat – but since we're all behind our computers all day, there can be limited communication.”
Despite the plethora of challenges they are confronted with on a daily basis, investigators remain confident in the power of open source to shine a light into the darkness: exposing human rights abuses and potential war crimes, debunking disinformation, and ensuring the public has access to accurate and up-to-date information.
Mohamed says, “OSINT is about finding the truth, and truth is the enemy of false narratives. We are, in a way, combatting what malicious actors propagate daily by increasing access to the truth – this is our way of fighting back.”
CIR’s guidelines on handling traumatic content can be found here.