GEOINT : case study of a strike in Ukraine

Introduction

Verifying the authenticity of images during a war is essential to control the reliability of information. However, in the case of the war in Ukraine, this work can seem daunting for a novice when faced with the quantity of photographs and videos released by both sides. For example, Oryx has so far documented nearly 3700 photographs of Russian vehicles lost since the beginning of the conflict.

In order to be able to support the speed of the information flow, it is therefore necessary to have an efficient and generalist methodology that allows to geolocate and date an image in a few minutes. This is why this article aims to explain through a case study a methodology among others that is generally adapted to most situations in Ukraine.

The case study is as follows: On May 13, 2022 @Rob_Lee publishes a video taken by a drone showing the destruction of vehicles allegedly by Ukrainian artillery in the Donbass.

Translated with www.DeepL.com/Translator (free version)

https://twitter.com/RALee85/status/1525186196963569664

Note that until the end nothing confirmed will be taken for granted.

I. Préparer son espace de travail

On the computer: Your computer is the center of your work. Everything will be archived and sorted there so that it can be used again if needed.

Here is how my work on Ukraine is organized:

On the computer we will use krita to write and overlay the images directly. Any full-featured image editor is suitable. The analysis will be saved in the “Analysis” folder as an image and .krita file.

Online we will use :

• Google map (or any other similar tool such as Bing map)
• Google Earth* (Pro on the computer if possible)
• Suncalc : suncalc.org (simulate the position of the Sun and the shadows)
• Ventusky : ventusky.com (weather archives)
• E-O Browser* : apps.sentinel-hub.com/eo-browser (free satellite imagery)

*Optional, these tools simplify the work and allow to have photographs or a recent image of the field. Ukraine is a country that evolves rapidly. Thus many images of google map do not correspond any more to reality.

To the list can be added Yandex and any translation tool but they will not be used in our case.

IN MOST AREAS, TOOLS ARE SECONDARY. THE RESULTS OF A SURVEY ARE LINKED TO THE METHODOLOGY AND THE UNDERSTANDING OF THE SUBJECT.

II. Analyze the image

1) Contextualize

In order to know what we observe, we first look for the context of the image : « Video from Ukrainian SSO showing the aftermath of artillery strikes on a Russian artillery ammunition stockpile. »

A telegram link : https://t.me/ukr_sof/94

This Telegram link serves us directly as a pivot point, Rob Lee as a self-respecting and socially useful person gives us the origin of the video, saving us long minutes of research (and we want to get it over with).

Unfortunately the description gives us a context but no geographical indication.

2) The Sun

The Sun is a constant, if it is there we know the time and the direction. If it is not there we know that there are clouds.

Here, the shadows tell us that the weather looks good. They are elongated and should be about twice the length of their object.

Looking for this result in May we find that it is about 5pm or 7:30am. The Sun is also due east or due west.

As the source is Ukrainian vehicles are more likely to come from Russia, so from the east. Moreover with the general luminosity we can hypothesize that it could be 17h to a few hours.

At this point we know that the victims are probably Russian and we can complete our analysis :

3) The environment

This is the simplest part, we simply list what we see:

• A wide road that corresponds to a highway. It is oriented towards the northwest,
• 2 small woods,
• A small road going west,
• Dwellings with probably a gas station,
• Fields,
• In case you haven’t seen it already, something is burning.

This information allows us to add that this event took place after the thaw and that there was no rain. Moreover the vegetation had time to green up, we are well in April or in May.

4) The wind

Last step in the analysis of the image, we observe that the smoke is pushed by a north-east wind. Let’s update our analysis and keep this information in mind for the future.

III. Define the search area and a sketch

1. The search area

I regularly archive the map of the front. On the other hand, a quick look at @War_mapper or any other person making maps of the front allows me to know where the fighting was concentrated between April and May. Since the weather was bad in April, let’s consider that the video is from May. Our video is probably on the front line or a bit behind the Russian lines.

We are looking for a highway that goes from the northwest to the southeast, on or in the Russian lines. The M03 Kharkiv-Slovyansk highway seems to be a good search area. The video can be found here :

Congratulations, the search area has been reduced from more than 603 548 km² (considering that we are in Ukraine) to some 350 km².

2. The robot portrait

Let’s not rush, we might pass over the right place without recognizing it. So we will draw what we should see by satellite on google map.

Facing north is even better.

Now we just have to hope that we are not mistaken.

So let’s observe the M03 highway from Чугуїв to Суха Кам’янка…

IV) Compare and conclude

Here are my various suspects I met along the way:

If you had not checked that the image has not been reversed (which can be arduous) or you are not sure of the orientation you had found do not hesitate to expand your tolerance.

Here the choice is quickly made, the photo 3 corresponds, it is to Веселе (Vesele)

We have not finished yet! Ukraine is a country that evolves quickly, so we will check that in May the landscape corresponded well.

Everything is there, problem: the forest has already burned on May 6. The video is therefore from before.

But as the world is well made we can already see that the fields have the right shape and the right color. We are not far from the right day!

On May 3 the area is intact, so the video takes place between May 3 and 6. Let’s crosscheck with the weather by looking for the wind direction between 3 and 6 pm on May 3, 4 and 5 (the satellite having passed in the morning)

On May 5 the wind is from the wrong direction:

On May 4th the wind is good at 2pm but the weather is bad and the wind is from the south at 5pm.

On May 3rd the wind is good and the weather is clear. The site was not very precise we can consider that it corresponds to our video.

To conclude, we just need to communicate our results to the OSINT communities in order to have a critique of the analysis if needed and so that others don’t need to do the same work again. To do this, summarize your work in an image and an explanatory text with precise keywords so that you can find it again if necessary.

Ukrainian strike on russian convoy in Веселе (Vesele, Kharkiv Oblast) on the M03.

Location : 49.39732444069642,37.205029686706546

Date : probably 3 mai, approx 17h UTC +3

Source : https://twitter.com/RALee85/status/1525186196963569664

Conclusion

In conclusion, geolocating an image can be very fast with an adapted methodology. In the case studied, having a prior knowledge of the context the geolocation took 8 minutes by taking the time to look for a map of the highways which could be useful later.

It is possible to go faster by taking more risks or by having a better methodology. In any case, it is important not to rush and to follow directly a methodical and thorough analysis in order not to waste time always redoing the analysis.

It is also extremely important to communicate your results in a clear and concise way on Twitter by mentioning Geoconfirmed or through discord servers, so you will have feedback to improve yourself, you will avoid others to waste time and you will facilitate the general understanding of the war by limiting the possibilities of misinformation.

However, if you feel a piece of information is too sensitive to be shared, feel free to keep it to yourself.

Tips:

• In the absence of obvious shadows, tools such as Forensically allow you to observe variations in light.
• The south of Ukraine is flatter and less wooded than the northeast which tends to be hilly, similarly Crimea is drier and the southeast of Ukraine has different shaped fields than the rest of the country.
• Very black soil is often the mark of the Donbass.
• Some asymmetrical objects (like the launcher of a MILAN missile) exist only in one direction, checking the shape allows to verify that the image has not been reversed.
• In OSINT any general knowledge will help you sometime.
• You can extract the text from an image to translate a sign, the fastest way in the long run is to learn Russian.
• Beware of Ukrainian information that may be propaganda, but never believe Russian information until it is proven.
• The closer you get to the source of the information, the less context you lose.