How Open Source Intelligence Became the World’s Window Into the Ukraine Invasion

In a grainy cell-phone video shared widely on Twitter early on Thursday morning, plumes of black smoke billow out of a burning vehicle on the tarmac of what appears to be a military airstrip. The heavy breathing of the man holding the camera is audible over the sounds of broken glass and rubble crunching underfoot.

The video, which was originally shared on a Ukrainian Telegram channel, was verified and uploaded to Twitter by Thomas van Linge, a 25 year-old based in Amsterdam. The video, van Linge wrote online, depicted “utter destruction” after an explosion at the military airfield in Lutsk, western Ukraine, just 90 kilometers away from the border with Poland. It appeared to be some of the day’s first evidence that the Russian assault on Ukraine was confined not just to the country’s south and east, but military targets across the country, even those just miles away from a border with a NATO member-state.

Another video shared by van Linge on Thursday morning purportedly showed Russian military vehicles advancing north into Ukraine from Crimea. This time, the source of the footage was a public-facing CCTV camera trained on a road leading off the peninsula.

Read more: Here’s What We Know So Far About Russia’s Military Operation in Ukraine

As the Russian invasion of Ukraine unfolded in the early hours of Thursday morning, van Linge and hundreds of other OSINT researchers pored over the thousands of videos emerging from the country. The acronym is short for “open source intelligence,” a field of social media analysis that over the last decade has emerged from obscurity into a central feature of modern war reporting, as social media and smartphone access have allowed videos, photos, and other data from war-zones around the world to proliferate. Together, via a loosely-organized community mostly based on Twitter, these researchers work together to verify the location of videos, piecing together the first public details of a rapidly-changing situation on the front line of Europe’s most volatile military conflict in nearly eight decades. Online, in real time, they share these pieces of evidence with the world, rivaling established newsrooms and defense analysts in a parallel effort to reveal what is happening on the ground.

“On Twitter, there’s a lot of cooperation. People share footage, geolocate it, try to identify the types of tanks, armed vehicles, that kind of stuff,” van Linge said in an interview on Thursday morning. “Everyone is doing their own part to get as much information out there as we can.” Van Linge says he was able to verify that the videos from Lutsk were likely genuine, because the airstrip and buildings were recognizable and could be compared against older footage.

Read More: How Putin’s Denial of Ukraine’s Statehood Rewrites History

The picture researchers are seeing, with the benefit of the birds-eye-view from OSINT, is of a fast-changing military situation in Ukraine. “From around 5am local time until [11am], the videos were mostly missile strikes, smoke clouds, the sounds of shelling and stuff,” van Linge says. “Since [midday local time], it has actually developed to footage of Russian forces on the move across parts of Ukraine—they’ve broken out of Crimea, they’ve broken through front-lines near Kharkiv, there’s also reports of fighting south of Belarus, [and] around Donetsk.”

OSINT analysts are acutely aware of the risks that their work may be playing into the Kremlin’s hands, and experts have raised concerns that Russian actors may try to seed false reports of military activities in order to encourage Ukrainian surrender. The internet in Ukraine is currently still broadly accessible, indicating that the Kremlin does not necessarily want to suppress footage depicting their Blitzkrieg attack. “I guess the Russians might consider it beneficial as an intimidation tactic,” van Linge says. “They want to show their striking capabilities.”

But the news isn’t all good for Russia. Some footage indicates that the most fierce fighting so far has been around Kharkiv, in the north-east of Ukraine, according to Kyle Glen, the co-founder of Conflict News, a popular OSINT-focused online news platform. Early on Thursday, Glen shared a graphic video—apparently filmed near Kharkiv—depicting what he said were burning Russian tanks and a dead Russian soldier.

“There’s a definite possibility that Russia wants this information to come out,” Glen says. “On the other hand, in the Kharkiv region they are definitely not doing as well as they had hoped—and there are a lot of videos of dead Russian soldiers and destroyed Russian equipment. They’re not going to be happy about stuff like that coming out. If we start seeing more and more evidence of the Russian offensive not going so well, maybe we’ll start to see them crack down on the internet a little bit more.”

OSINT techniques have also allowed sleuths to pick holes in Kremlin rhetoric. On Monday, researchers deduced that a video of Putin meeting with his security council to discuss Ukraine was not broadcast live, as Moscow had claimed, but several hours earlier—a fact given away by closeup analyses of the wristwatches of several participants.

In the Twitter group chats where OSINT analysts share videos and help each other verify material, an informal code of conduct has emerged, according to Glen and van Linge. Some researchers have said they will not share graphic videos of dead bodies. Others have decided to keep a lid on any videos that reveal Ukrainian troop movements. In cases where researchers accidentally share false or misleading information, researchers tend to delete their tweets and issue corrections. Much of the time, the collegiate atmosphere helps prevent mistakes before they happen. Overnight, Glen observed two debunks on a Twitter group chat in real-time, before anybody posted the videos to public-facing social media accounts. One video, depicting an explosion in the dead of night, turned out to be from Yemen, not Ukraine. Another video that purported to show a Russian helicopter attack against a Ukrainian base turned out to actually be from Afghanistan.

These informal ethical guidelines and verification techniques have been honed over the last decade. Van Linge and Glen both started their work in 2014, during the Ukrainian revolution and the Syrian civil war. In Syria, OSINT information helped to link deadly gas attacks on the regime of Bashar al-Assad, and undermine the U.S. military’s claims that its airstrikes were hardly killing any civilians. But there is a sense in the OSINT community that something about this invasion is different. “OSINT was a lot more niche in the Syrian civil war,” Glen says. “There was a lot of really gritty technical stuff, like analyzing shell craters. Whereas it seems the community in the buildup to this [invasion of Ukraine] has been a lot more accessible. It’s not difficult to understand if someone posts a video of a Russian convoy of vehicles and can demonstrate how they know where that convoy is.”

“OSINT first and foremost is a collaborative effort,” Glen says. “A great thing about OSINT is that when you’re posting the evidence, you’re posting how you came to it. It allows people to have a lot more trust in what you’re doing—and maybe things get taken a little more seriously.”