Puzzling Pieces

Kyiv’s signature of the statute on 21 August came several weeks after Russia’s 8 July attack on a paediatric hospital, which killed over 35 people (including four children) and injured another 190, in Russia’s latest egregious crime committed during its war of aggression in Ukraine. In the face of such a tragedy, OSINT analysts in Ukraine and further afield were quick to identify the make and composition of the Kh-101 missile that hit the hospital, denying Russia the opportunity to mask the attack and affirming the increasing relevance of OSINT in holding the Kremlin accountable.

OSINT’s relevance to Russia’s invasion of Ukraine is no coincidence, but rather the result of OSINT’s gradual development and acceptance in recent years, in parts thanks to advancements in data tools including geolocation and chronolocation software. Realising its full potential requires a coordinated and prepared approach from government, the private sector and civil society – no small undertaking.

Squaring the Evidentiary Triangle

Today, from Luhansk to Lviv and around the world, the online community is filming, posting and resharing evidence of Russian war crimes on social media, online fora and journalistic sites in the hope that someday, victims might hold the guilty to account.

The adoption of OSINT techniques in documenting modern crises has demonstrated a need to expand the production of criminal evidence beyond the traditional triangle of law enforcement, forensic experts and witnesses.

Since the aftermath of the Second World War, OSINT has gradually played a more pivotal role in holding perpetrators of international transgressions to account. For example, starting in 1945, photography and film offered critical evidence during the Nuremberg Trials. From 1993–94, documentation from news channels, online fora and satellite imagery led to the establishment of the International Criminal Tribunals for the former Yugoslavia and Rwanda. Beginning in the 2000s, cell phone photos and videos, geo-referencing tools, drones and social media captured information crucial for the hybrid internationalised tribunals for the conflicts in Sierra Leone and Cambodia in 2001 and Lebanon in 2009. Finally, in March 2011, images of clashes in Darʿā, a rural province of southern Syria, changed everything, giving birth to the first “war feeds”, or “digital war in plain sight”. During the Syrian conflict, OSINT was regularly pivotal in correcting war narratives, especially surrounding the Assad regime’s use of chemical weapons.

In We Are Bellingcat, Elliot Higgins highlights how, even as hopes for international support in Syria dwindled, OSINT analysts continued documenting and disseminating evidence of human rights violations on social media. Collaborations like the Google/Bellingcat-supported Syrian Archive validated the dangers faced by Syrians in gathering evidence and solidified OSINT’s role in facilitating evidence collection.

Spinning the “Web of Accountability”

What was once a fledgling ecosystem of citizen journalists has grown into an organised cohort of OSINT practitioners documenting, analysing and presenting open source evidence in court, ultimately pursuing greater degrees of accountability for criminals and malign actors than ever before.

Ukraine and its partners have jointly pursued a “web of accountability” – a term coined in March 2023 at the United for Justice conference in Lviv – for war crime investigations in Ukraine. However, the pseudo-network of strands comprising this web are messy and convoluted, spanning an amalgamation of actors in nearly as many jurisdictions.

What was once a fledgling ecosystem of citizen journalists has grown into an organised cohort of OSINT practitioners documenting, analysing and presenting open source evidence in court

Currently, the OSINT network dedicated to uncovering war crimes in Ukraine comprises – at a minimum – six legal firms, nine academic hubs, 19 OSINT investigative teams (including names like Berkeley’s Human Rights Investigations Lab, Osint For Ukraine, Global Rights Compliance and the Ukrainian Molfar), 17 special IT projects (which range from apps like e-Enemy to blockchain solutions like project Dokas), a sub-network of 23 judicial bodies in Ukraine and further afield, and 39 civil society organisations (including the 5AM Coalition) that collect and document potential war crimes and crimes against humanity. These actors are intricately linked with judicial authorities across the West and around the world.

The Joint Investigation Team and the CICED Database at Eurojust epitomise this collaborative spirit, pooling resources and evidence with enhanced support. Additionally, the Atrocity Crimes Advisory Group – a collaborative venture between the EU, UK and US – provides tailored guidance to war crime prosecutors. Another effort, the Dialogue Group on Accountability for Ukraine – an initiative led by Ukraine, the ICC and the EU – aggregates workstreams from Ukraine’s General Prosecution Office, international accountability actors, domestic and foreign accountability providers, and civil society organisations. USAID’s Human Rights in Action Programme is funding study visits and advanced training (inclusive of OSINT modules) in international criminal law and justice for Ukrainian lawyers. Europol has also established an OSINT taskforce to facilitate international investigations of Russian war crimes in Ukraine. The Council of Europe has launched the CyberUA project, which aims to enhance Ukraine’s capabilities in handling electronic evidence related to war crimes and gross human rights violations. In short, there are several notable cases of successful international cooperation in leveraging open source information for documenting war crimes in Ukraine.

Between these achievements, however, interorganisational coordination is arduous. Actors may not know of each other’s existence and do not necessarily have the means, forums or trust to collaborate. “The current landscape lacks a unified model for archiving war crimes evidence, with various platforms operating in isolation and without full integration”, stressed Roksolana Burianenko, former programme manager for Mnemonic’s Ukrainian Archive. “The key issue is the absence of a coordinated approach and a governance system to harmonise efforts across different archives and actors. Such coordination is essential not only for accountability, but also for creating a digital memorial that captures the Ukrainian people’s suffering. In our digital age, establishing these archives and memorials should, and could, happen much faster than in the past”.

The result is paradoxical: actors across nearly every sector of society are tackling overlapping aspects of war crimes investigations, but those same actors are so siloed that communication is inconsistent and cooperation is sporadic, even in the digital age.

Leveraging OSINT

Despite the strengths that OSINT lends to war crime investigations, the sheer amount of information (and disinformation) in the open sources, the costs of upskilling to use this information, and judicial wariness of open source information pose several challenges.

Information Overload

The immense and ever-growing volume of digital evidence – from sources including social media, blogs, online forums, CCTV footage, livestreams and satellite – deepens the web of accountability’s inefficiency. The Ukrainian Archive contains a staggering 6,930,635 videos from 9,567 sources, and even this represents only a fraction of the pieces of open source evidence amassed by the 5AM Coalition. Meanwhile, the Ukrainian Prosecutor General’s office keeps a diligent count of registered crimes of aggression and war crimes since February 2022. At the time of writing, this number exceeds 143,899 – a testament to the enormity of the task at hand. For comparison, the office records only 19,274 crimes against national security in the same period.

“Overall, we have 5 million digital records in our system”, says a chief investigator for Mnemonic. “We are preserving the potential human rights violations and possible war crimes from all parties, but only a small percentage is being really analysed. While preservation of data was our initial priority, the community now aims to undertake analysis, mapping and tagging on a larger scale to harness the full potential of the preserved data. With all the data we have collected it would take decades, probably, if not longer, to investigate every single one of these files!”

Additionally, the volatile nature of conflict zones and the complexity of war crimes make it difficult to verify the authenticity of digital evidence. Russia has enthusiastically compounded these issues by flooding online spaces with disinformation and propaganda, propagating conflicting narratives and leveraging deepfake technology in ways that highlight the need for continuous adaptation and innovation in the use of OSINT.

Prohibitive Capacity-Building Costs

If the overwhelming availability of OSINT evidence is one problem, the costs of storing and processing this evidence represent another.

“There’s a pressing need for a technological platform”, argues Lindsay Freeman, co-author of the Berkeley Protocol on Digital Open Source Investigations, “that enables civil society groups and documentarians on the ground to securely store digital evidence. This idea, like a ‘digital evidence locker’, has been widely discussed, but even the biggest NGOs face significant challenges in scaling and securing such operations”.

Once this evidence is stored, investigators and legal professionals often require training to ensure they can efficiently handle and process OSINT-generated evidence. Thus, another obstruction facing the coordinated use of OSINT by actors investigating war crimes is a difficult trade-off: should they invest time, resources and funding into trainings and platform subscriptions, or leave investigators aimlessly sifting through datasets that grow with each social media post and website refresh, further burying key evidence?

As a result, actors with more resources can advance their application of OSINT in their investigations, while others are left further behind in capacity and capabilities. This disparity exacerbates the web of accountability’s patchwork use of OSINT. “Technical trainings on software techniques and OSINT methods should not be confined to exclusive clubs; there is a need of some form of modernisation and update of these investigative and legal communities to achieve a more effective usage of the concept of Universal Jurisdiction”, says Burianenko.

Courtroom Challenges

From a judicial perspective, accountability structures need time to adapt to the introduction of OSINT as an evidence collection tool as well.

For example, courts often have varying admissibility criteria for open source evidence, which needs to be handled accordingly. “I’m certainly not against open-source investigations”, Freeman clarifies, “but I insist on their execution within the bounds of legal standards. It’s heartening to see many in the OSINT field have significantly honed their methodologies … [but some] tend to leap to conclusions prematurely. In criminal proceedings, where establishing guilt beyond a reasonable doubt is the cornerstone, selecting a single hypothesis from a spectrum without adequately exploring alternative scenarios can be a major oversight”.

It is imperative for Ukraine and its partners to wade through the challenges of a coordinated and consistent use of OSINT in holding perpetrators of war crimes accountable

Freeman also indicates that the aforementioned information deluge compounds the legal difficulties of using OSINT. “Much of what’s captured during a conflict is [more relevant] for historians and won’t directly feed into crime documentation … Flooding [judges] with an excessive amount of information is not just tactically unsound; it risks prolonging the trial unnecessarily and could potentially infringe upon procedural efficiency”. For actors to use OSINT to evidence war crimes in a way that could be effective in judicial proceedings, they therefore need to be incisively selective.

“The essence is ‘data minimisation’, to gather only what’s pertinent to the case at hand”, continues Freeman. “This requires setting precise research questions and establishing a clear investigative direction – to discern what must be proven and what evidence is genuinely relevant, whether it incriminates or exonerates”.

A Labour of Love

It is imperative for Ukraine and its partners to wade through the challenges of a coordinated and consistent use of OSINT in holding perpetrators of war crimes accountable. Thankfully, several mechanisms are already in place that could facilitate both a more efficient, well-connected web of accountability and the closer integration of OSINT into that web.

The EU, which supports Ukrainian rule of law institutions and agencies with EUAM Ukraine, is investing over €10 million to support the ICC, as well as over €6 million on IT and equipment for the Ukrainian General Prosecutor’s Training Centre, civil society organisations and new, dedicated accountability structures. EUAM has also helped coordinate workshops designed to assist Ukrainian legal offices and courts with admitting OSINT war crime evidence.

Other allies of Ukraine are pursuing similar support and coordination structures. For example, the International Centre for the Prosecution of the Crime of Aggression against Ukraine (ICPA) aims to be “the first step in this process to preserve evidence and prepare cases for future trials” with the help of a joint investigation team led by Ukraine, Lithuania, Latvia, Estonia, Poland and Romania, and with additional participation from the ICC and financial support from the US. The EU also supports the Register of Damage, which records “claims and evidence on damage, loss or injury caused by the Russian Federation’s internationally illegal acts in or against Ukraine”.

As initiatives like the ICPA seek greater coordination for evidence collection and processing, other partners are specifically facilitating opportunities to boost OSINT capabilities. In December 2023, the UK committed £3.7 million to the “documentation, investigation, and prosecution of war crimes committed in Ukraine”, which will fund training for Ukrainian authorities to develop “skills in verifying and utilising open-source intelligence, including materials uploaded by mobile phones to social media, and train prosecutors in preparing strong and well-evidenced legal cases”.

These efforts, among others, to develop a comprehensive, technology-centric and OSINT-enabled approach are encouraging, but there is always more work to be done. As stated by the ICPA, “we are dealing with an international crime that has rarely been prosecuted and for which there is no standard practice”. Holding war crimes perpetrators accountable will require an equally unprecedented commitment to innovative collaboration in evidencing and prosecuting atrocious crimes in Ukraine, but the benefits of doing so – chief among them, a secure and sovereign Ukraine – are worth the effort.

Andrea Ricci is a Minister Counsellor at the EU Delegation to the UK. His portfolio spans foreign influence, cyber security and crisis management. With a PhD from ULB Brussels, Andrea has experience in risk analysis, conflict prevention, and information systems.

Jack Crawford is Research Fellow with RUSI’s Proliferation and Nuclear Policy research group. His work leverages open source intelligence and analysis to derive insights on critical security and defence questions, having supported projects on Russian sanctions, transatlantic nuclear issues, Euro-Atlantic security, and great power competition in the 21st century.