Online sleuths use publicly available data to find out what's really happening on the ground

A man lying on the ground, clutching what appears to be a severed leg, screams in agony. The pro-Russia account that posted the video days before the Russian invasion of Ukraine claimed the man was a victim of a Ukrainian attack. But skeptics were quick to point out the leg was a prosthetic.

While an unsophisticated fake, it's one of the thousands of images flooding social media around the invasion of Ukraine, keeping fact-checkers, like Giancarlo Fiorella, with Bellingcat, very busy.

Bellingcat, which takes its name from an old fable about mice conspiring to neutralize the threat of a cat by putting a bell on it, is a collective of researchers, analysts and journalists who sleuth online using publicly available data — or open-source intelligence — to hunt down the origin of images, videos and information.  

"We're all hands on deck on this at the moment," said Fiorella, speaking from Amsterdam.

Open-source intelligence investigators use a wide variety of tools to verify the images they are seeing, including the metadata embedded in pictures and videos, as well as geolocation tools, which help pinpoint the time and place an image was captured.

"The real challenge when it comes to Russian disinformation — at least what we've seen for the invasion of Ukraine now — is the volume of it. Just the sheer quantity of events that they're flooding social media with," Fiorella said. "There's so much of it."

Several Western governments, including Canada, the U.S., the U.K. and the European Commission, are also vowing to fight Russian disinformation amid the ongoing invasion.

In a joint statement issued Saturday announcing fresh sanctions on Russia, including blocking some Russian banks from the SWIFT global banking system, the allies committed to "step up or co-ordination against disinformation and other forms of hybrid warfare."

Investigators focused on Ukraine images

Bellingcat, which has documented numerous incidents of Russian aggression over the years, tends to focus on humanitarian concerns. Right now, though, they are using that focus to triage the steady stream of information bombarding social media and verifying images of destruction and potential war crimes.

In one recent example from Ukraine, Bellingcat investigators were able to use geolocation data to verify some images and match them to reports of damage to some apartment buildings from a Russian attack near the city of Chuhuiv. This created a trusted visual record of damage on the ground.

"We're trying to focus on incidents that show damage to civilian infrastructures, like buildings, or civilian casualties," Fiorella said. "It's been heartbreaking to see the videos and the images of residential areas in Ukraine being targeted indiscriminately by Russian shelling."

Most of the images the group has encountered have come through Telegram, a messaging app created by two Russian tech entrepreneurs that is widely used in eastern Europe.

Fiorella says Bellingcat's work in the short term is to provide people with an accurate account of what is happening in real time. But in the longer term, it's about establishing a record, which it posts on its website and social media.

The evidence they gather, he said, will "hopefully make its way to a courtroom at some point in the future."