Bellingcat, Open Source Investigations, and the Truth About MH17

DATE: 2pm, 2 July 2018

VENUE: Boothroyd Room, Portcullis House, 1 Parliament St, Westminster, SW1A 2JR, United Kingdom

SPEAKER: Eliot Higgins, Founder of Bellingcat

EVENT CHAIR: Dr Andrew Foxall, Director of the Russia and Eurasia Studies Centre at HJS 

[Dr Andrew Foxall] Hello everyone, welcome to our little event, I’m very glad that you can be here for what I think is going to be a fascinating talk. I’m just going to introduce in about ninety seconds something about Bellingcat, something about Eliot, and why I think it’s very important. A few years ago now, how long ago did you start doing ‘Ground Moses’?

[Eliot Higgins] 2012.

[Dr Andrew Foxall] 2012, and it was in a job housing asylum seekers and he started collating information on Libya almost as a hobby and that spread to collating information on Syria, which became Ground Moses, which became for those of you who are interested in Syria, one of the go-to sites for information on what was happening in the Syrian war.

One thing to led to another and now Eliot is at King’s. And so out of all this work in Ground Moses looking at Libya, looking at Syria, the Bellingcat online investigation site was launched, and I know that Eliot is going to explain it much better than me, but basically, it’s a form of crowd sourced information and intelligence. Crowdsource is a specific term that Eliot may take issue with, but what is remarkable in this day and age, that personal computing power, combined with Google Maps, being able to geolocate mobile phones if someone’s got their ‘Find Me’ button on, means that amateurs and activists can now do the work that ten, fifteen years ago, and all the decades before that, was only really done by people like spies and people with extraordinary expertise, and the level of open source material, as any spoof or anyone will tell you, is that such, you can find a huge amount out on the Tinternet if you know where to look, and very often the quality of that open sourced information is as good as or better than governments can provide. I think the work that Bellingcat has done on identifying Russian positions in Ukraine, the work on the MH17 and finding the senior GIU and other military members responsible is an extraordinary piece of work. And having seen Five Eyes’ intelligence myself, frankly the quality and quantity of work now being done by Bellingcat, to be honest I’d probably take the Bellingcat open source research over Five Eyes because the quality of it is in many ways as good, because the quantity- the amount of people doing the work, and the ability- the desire to do the work, and being able to hunt around the internet, in the Russian version of Facebook and others, it gives you that power and that edge.

Eliot is going to talk for twenty-five minutes on how Bellingcat works, some of the work that they’ve done, and the background to how they do this extraordinary work, and then we’re going to have some questions. I will be typing away making notes, because one of the things that I want to do, is Eliot is making a digital database of war crimes in Syria, again this is extraordinary and ground-breaking work, to record as much as he can of all the horrible things that have happened, so there is a digital database, so that in the years to come we will have potentially some kind of responsibility for some of the things that happened in that country, and the appalling and awful civil war. And for me, governments and parliamentarians, and frankly the media don’t understand this, because when I was talking to World at One programme, and I was saying that have you seen Bellingcat’s work, their attitude was that they were a rival broadcaster, and that’s when I said -no, you don’t get it. This is digital forensics, this is online detective work, this is online Sherlock Holmes stuff that you’re missing out on and you should be using this stuff, instead of assuming they are some kind of rival broadcaster. So anyway, on that note- Eliot, if you could talk to us for a little bit about the amazing work that you do that would be wonderful.


We can break down the process that Bellingcat uses into three stages, and that is identify, verify and amplify. Now identify can be anything from a tweet on social media to digging through open source information online; verify is what I’m going to talk about in detail today; and amplify is the various end products you can produce from this kind of work. I started looking at stuff that was being published about the conflicts in Libya, and there were a lot of questions about how do we know that these various videos are filmed where they claim to be. So, to start off I’m going to give you a very simple example of geolocation. And this was a video that was published online by a Libyan opposition group, they claimed they captured a town in the place called Tiji, and I want to figure out where this was filmed. And how do we find out where this was filmed? Well, we start looking at the objects that we can use to narrow down the location, so the biggest objects we can see. Geolocation is taking an image and using other sources to confirm exactly where that image was taken. It’s an essential part of our process of verification. So, we start with the biggest thing we know, which is that it’s supposedly in Tiji, we’ve got to double check that, so we see this mosque- it’s got a dome, it’s next to a road that’s got two lanes of traffic, we can see there’s a divide, there’s a tank that’s going down it. So, the first thing we can do is go to satellite imagery of the town, look for the widest road, and we can see there’s one running through the centre of town, then there’s two lanes of traffic, and you can actually see how wide it is based on the width of the cars, then we start moving down the road until we eventually come to the mosque in question- a very distinctive dome and minaret. But we don’t settle there, because we have to start looking at smaller and smaller details until we’re certain it’s the correct location. Very often with this it’s a matter of having levels of confidence in how sure you are the location is correct. So, we start looking at the small details, we can see the curve of the road and the discoloration, and we can see the wall that’s visible there as well, and all these other details we can piece together to confirm this is the location in question. And this is a very basic example of geolocation. Anyone can do this from the comfort of their own home.

A more advanced version is the one from the barrel bomb attacks in Syria. This is actually a fairly historic video, this is the first-ever video of a barrel bomb from 2012 in Syria, and that looks like to most people someone’s pushed over a bit. So, you have articles like this on Russia Today “Barrel Bomb Belone” saying there was no such thing as a barrel bomb, this was just propaganda, this was made up. But thanks to the conflict in Syria producing so much conflict, we can see a video like this, where you can actually see a barrel bomb being pushed out of the rear of the helicopter. And eventually we came across another video. This is filmed inside a helicopter as a barrel bomb is lit with a cigarette and then pushed out the rear of the helicopter. That is published and then people say well how do you know where that’s filmed? That could be anywhere in the world. How do we know this is Syria? Basically, we play an adult version of ‘spot the difference’ with this image and Google Earth. I can actually zoom to the location in question after searching a very long time for it, and we can actually do a side-by-side comparison and show that the layout of the roads and the buildings matches, so helps confirm exactly where this was filmed.

This part is about executions, so there are some images that are rather strong. So this is about the Werfalli Executions, which were a series of executions that took place in Libya, and the ICC issued an arrest warrant based on the Facebook videos that Werfalli himself uploaded onto his Facebook page. He’s a commander in General Haftar’s army, and he’s publishing these videos basically to intimidate the local population that he believed were supporting ISIS. So, there’s a series of six videos, starting with an individual execution, and then there’s video number six, which we geolocated. Video number six shows rows of prisoners ready to be executed, it’s filmed from a scattered position, so what we do is we take the individual frames that are visible in the video, and we can separate those frames out, and merge them into one large image, and this just makes it easier to work with this image. Now, once we have that we start looking at the various details that are visible in this image. We can see there are buildings in the background and there’s a wall in the distance, and also there’s a fork in the road. And that’s really not too much to go to for. So, we go to the social media profile and we can see that he had recently been fighting in an area called the ‘Chinese building area’ of Benghazi. So, this is likely the location where this was taken, but we need to be able to prove this. We start looking for this Chinese building area, which is a fairly large area of partly-constructed buildings in the south of Benghazi and we start looking for these features of a wall and the fork in the road. And as you can see there are many buildings in this area so it took a very long time, but we make this shopping list of what we’re looking for, but eventually we come across some sites that have it, and this is one of the sites in question. So, you can just make out, barely visible, the buildings, the wall and the fork in the road. Next what we want to do is determine the position of the camera in relation to the position of the camera in google earth and the video. So just watch the bushes here as we merge the satellite imagery and the video footage. You can see the bushes in exactly the same position. This next bit is graphic, but after the execution, these marks appear on the ground. And they are in fact the blood stains from the executions that match precisely to the video footage, so you’re able to confirm the exact location of the camera and all these executions. We can also use the shadows cast by the individuals as a sun dial to find the precise time of day these executions took place. There are a number of tools you can use for this, some of them are free, this is a slightly more expensive one, but it’s simply just using the shadows as a sun dial. So the time, location, and, because we have satellite imagery from before and after the executions, we can see when those blood stains appeared, so we can establish the date range of when they happened, all based off that video and open sourced information.

[Unidentified speaker] Can I just say- that is incredible. I am blown away by that.

[Eliot Higgins] The ICC is really interested in the use of this and we’ve been talking a lot to them about this work. Something else we can do is look for ISIS members in Europe. This is a social media campaign that ISIS started on Telegram. These images were then shared on Twitter by various researchers and this is a social media campaign that basically- they asked ISIS members to take photographs of themselves holding up a piece of paper with the city they’re in. Now, the first two you cannot geolocate, or if you can you can come to me and work with me. The third one, though, is actually much easier to do. This is in Germany, and we know Germans are very organized, and we can see an advertising poll. So, they actually have a website with all the advertising locations listed in Germany. We can select the type of advertising, it gives us a match of all these advertising polls in Munster, then it’s systematically checking all these locations and looking for various features. We have this lovely aerial imagery in Munster, so we have a nice, clear view, and we can go and start going through and matching off the features. This is a game and once we figure this location, it’s a basic geolocation. This is the camera position, we can see all the polls very obvious here, we can see the railings behind it are visible, we can see the road markings, the thick road markings on the left side and the dotted markings on the right-hand side of the photograph, and the traffic lights in the distance. Now, what this meant, is because this was an online discussion, I was sharing- there’s lots of people on Twitter who are really into open source investigation- I asked them to help me find this on my online discussion. There were four photographs that were geolocated in London, Paris, Amsterdam and Munster, showing the location of these people, some of which were taken from the window of their own homes. So, we had to do this, and this image was geolocated in ten minutes because we asked people on twitter to help. Now, this meant that the narrative around this was not -oh, ISIS is everywhere, isn’t it terrifying, it was ISIS supporters in Europe are idiots because they give their information away online. Another crowd source campaign we’ve been involved with is the Europol tracing objects to stop child abuse campaign. This is a campaign that has been running for a year. They ask the public if they can help people identify objects they’ve taken from child abuse injury. [inaudible] And they’ve asked the public to help identify these objects. This is straight forward crown sourcing. They posted, can you figure out what these objects are? It kind of went viral, and people started being able to identify all of these objects. Out of around a hundred objects that have been published online by Europol, about eighty of them have been identified, and about a quarter led them to the country these photographs were taken. And in a lot of cases, this is the last chance for these investigations. One of the most significant ones was this photograph taken in a hotel room somewhere in the world. This could literally be any hotel room in the world, and within a few hours someone said they had stayed in the same hotel in Mauritius, and we were able to get the photograph from the website- the bedsheets were different, but it was the same room- and that again was another major lead in this child abuse investigation.

You can also use it to find missing people. A BBC journalist shared this video, he said it was taken during Hurricane Irma. A family had just moved to the British Virgin Islands, they hadn’t given their address, and a few days ago they posted this video. So, this video is the only thing we had, and knowing they were in the British Virgin Islands, to find out where they were. And as you can tell there isn’t a lot there, but there is enough there to find out where these people are. We can see in the distance there are these islands, and we know it’s the British Virgin Islands, so again we can spend some time searching around, and we can actually use Google Earth to find a single location. You have this three-dimensional terrain, it’s fairly accurate, but if you zoom into the ground and look away from this coastline, you can see a similar range of islands. But this isn’t good enough evidence, we need something stronger. There’s a site called Ecosec, which allows you to search for geotagged photographs on social media. This is something people have to have turned on, but it’s a good source for imagery. And we got this image. This is a very nice photograph that someone took, and you can compare it to what’s visible in the video and just make out that same silhouette. So, this tells us the location, but doesn’t tell us where this house is, so we start looking at other features in the photograph and the video. We can see the top of the roof has this wooden structure and we can see the hand rail. And, this looked like a residential property, but there are really only three locations where you could see that coastline. So, there’s this area, but from satellite imagery it looks like it’s an industrial estate. Then there’s another, but you can see boats in the foreground. But in between that, we have a residential area. And you can see in the residential area there’s lots of swimming pools, cars, and driveways. So, how then do I find photographs of those houses? Well, I start looking at Airbnb and estate agents. And all these houses are unique, and this one is interesting, because you have a railing that is just the same style as the one in the video. You also have a roof that is a similar design. But I looked at all these photographs and they didn’t seem quite right, they didn’t seem to match what I had. So, I looked at the estate agent’s website, and they marked this property. And I realized that the red roof building is the one we are looking at, and the one next door was virtually identical apart from the swimming pool. And that was very unusual in that area, as all the other houses were very different from one another. So, I got the number of the estate agent, and I passed it on, and they were able to pass it on to the family of the missing family, and it turned out the estate agent had just sold the house to that family and was able to get them rescued from that house. And that was all based on having that one video and knowing they were in the British Virgin Islands.

So, we can also hunt Nazis with the internet. At the white nationalist march is Charlottesville there was a very well-known photograph showing a young man being attacked by several men. We wanted to identify who he was- we didn’t know who he was. We collected all the photographs and videos and searched through until we found someone who appeared to be the same. He was wearing this nifty, customized helmet, he’s got this shirt he’s wearing, so it’s highly likely it’s the same person. So, we search for more images, and we could find the same person. And how do we know it’s the same person? Well, we can actually use these distinct features on his neck, so we can be one hundred percent certain that’s the same person. One thing I see a lot of about the white helmets, for example, is people saying here’s two blurry people pictures of a jihadist and a white helmet, they’re cleared the same person. What we need is this level of accuracy- you need to be able to see scars and moles and these details to be one hundred percent certain in these cases. So, we have this but it doesn’t tell us who he is. so, what we do then look at are the people around him. We kind of assume he’s there with his friends. And fortunately, the good thing about the internet is sometimes people do your job for you and this guy already identified these two people. We found their social media profiles, and we were able to find photographs proving they were the person they claimed they were, and so we had Jacob and Ryan. Now, Ryan has a friends list that is private so we can’t see who i=his friends are, fortunately for him, Jacob does not have a private friends list, so we can see he’s friends with Ryan. We can also see that Jacob is friends with this guy- Dan Bockborden, and he’s friends with Jacob and with Ryan. And we can actually see from his photographs that he’s actually got these same moles on his neck. So it was possible to identify him from all this information, and this is what he looked like before, and this is what he looks like now he’s been found guilty of attacking that young man.

Something else we can do, we can do a lot with social networks. And one thing we did a lot of was work on the MH17 case. So, we spent about four years on this case, tracking the missile launch, identifying where it came from, and the first clue of where it came from went like this. Posters in June 2014 showing buck convoys in Russia. So, these were very interesting to us…

[Unidentified speaker] Do people need to know that buck is the name of the defence kit? That is the missile system.

[Eliot Higgins] This is the most interesting buck we found because these markings are very unusual, because there was a photograph taken inside Ukraine on July 17th showing a buck with very similar markings. And we did this comparison to see if it was the same. Now, when Russia was sending equipment to Ukraine, they painted over the numbers, but didn’t always do a good job. So, what we have here we’re kind of merging them together and highlighting a few things. Although the numbers are painted over, the bits that are left in the same position. There’s a loading marker as well, that’s in exactly the same position. And we can see a burn mark that’s in the same position, and the rubber side skirt as well. Now this is a heavy rubber side skirt, basically it’s amateur. And it creates a unique finger print, and the finger print of the side skirt in Russia and the one in Ukraine is very, very similar apart from one discrepancy. So, that could be for a number of reasons, we’ve flattened a two-dimensional image, and if the three-dimensional feature wasn’t accounted for, that could be a problem. So, we had to look at another image from Russia and we could actually see that damage on the rubber side skirt, further confirming it was the same missile launcher. And we didn’t just stop at one missile launcher, we looked at every single buck missile launcher we could find in Russia and Ukraine, doing the same thing looking at the markings on the rubber side skirt. The investigation team we’re sharing our work with published this video that was very exciting for us, that showed the other side of the missile launcher. And we had the video of that in Russia as well. So again we did another comparison and see more features, and a few weeks again the Joint Investigation team gave a press conference where they effectively confirmed all our findings on the MH17, apart from naming the suspects. And this is the video they put together, and you can see they’re using pretty much exactly the same technique but with a bigger budget. So, this confirms that the missile launcher that shot down MH17 came from Russia.

[Unidentified speaker] What’s your relationship with the Joint Investigation? The Joint Investigation team is the Dutch, Malay, US…

[Eliot Higgins] It’s not the US, it’s Australia and Belgians in there as well.

[Unidentified speaker] Ok, but it’s a multinational and multilateral investigation team looking at who shot down the MH17, and providing that evidence. Were you supporting that or just doing parallel work?

[Eliot Higgins] Well, because it’s a criminal investigation, they can’t tell us anything, but we give them stuff. Generally, they are very happy to take stuff off of us, and then they’ve had a couple of press conferences where they explain their findings, and everything is basically exactly the same as we’ve said. The only thing they haven’t talked about is the actual suspects, and that’s something they can’t name until they’ve actually gone to court. So what we did is we tracked this missile launch, and this is near the border with Ukraine, and all these photos and videos we’ve geo located with this missile launcher. And we discovered that all the trucks had the number plates ending with fifty, that meant they belonged to the Moscow military district, and the Moscow military district only has one air defence brigade with these missile launchers, the 53rd air defence brigade. And they have a social media page, which the 53rd air defence soldiers follow, which means we can get photos like this posted on their social media profile. I’ll stress this is not some new vault of MH17, but it’s the person who in 2013 was driving the same truck that was filmed in 2014 in the 53rd brigade. So we started digging through these social media profiles, and there’s an awful lot of them, some that led to accounts on Instagram, but there were posts like this on Instagram, an attendance day for the 53rd air defence brigade. So we take all the names, and we plug it back onto social media and Google, and we find stuff like this. A bunch of soldiers in the 53rd brigade laughing about, tagging each other in each other’s posts. So that gives us another lead. We find photographs of them in the actual convoy, transporting the missile launcher. We find them in this photograph, this is a video of the bus they were on. That guy is that guy fast asleep on the window, it was caught at the same time. When they got to their camp in Minarova in Russia, they started taking photographs outside of the sign in the town side, and we can geo locate that just to be sure. After they did their exercise, they posted certificates saying “I’ve done an exercise on these dates” –which matched the dates of the convoy. And we had the wives, girlfriends and mothers of these people posting on the internet for them, discussing their movements and what they were doing.

[Unidentified speaker] Who were the Russian speakers here? Were you doing this with a Russian group or Ukrainian group?

[Eliot Higgins] We have Russian team members and Russian speakers. So, we had photographs of the soldiers where you can get details about them like badges that tells us they’re part of the 53rd air defence brigade, they have lapel pins, we also have videos of all the vehicles, so we start reconstructing all the vehicles as well and what was in the convoy. We have their base; we have them geo located at their base. Now we have this table breaking down every single vehicle in the convoy, we have the entire structure of the 53rd air defence brigade, purely from open source information, mainly their own social media posts. And we end up with every single member of the 53rd air defence brigade mapped out, all the way from the commanders, all the way down to the members of the actual buck unit. And this is all based from open source information, something they posted themselves on the internet. We’ve identified these individuals, but we’ve also been able to identify other people on phone calls that were published by the Joint Investigation team. Two in particular are Ryan and Delphin, who were of particular interest. So, we identified them. Delphin is Colonel General Nicolai… I’m not going to say that, but he’s the chief inspector of the central military district of the Russian Federation. He’s a serving member of the Russian military, and he was involved in the downing of the MH17. We also recently identified a ‘Ryan’ who is a member of the Russian GRU.

[Unidentified speaker] Whose code name is that? That’s the codename or the Joint Investigation’s codename?

[Eliot Higgins] That’s the codename that he was using. So, we were able to identify him because he made an online purchase that he had sent to his office at the GRU, and then the online database broke and allowed everyone to read it. He’s also got a really high voice so we called him up a couple of times pretending to be, trying to ask him for information and we also got voice samples. And we did the same for Delphin. We got voice samples and had forensic analysis done of his voice comparing it to the voice on the intercepted phone call.

We’ve also looked at Russia’s bombing in Syria, so in the start of September 2015 the bombing began and they said they were targeting ISIS, but people said you’re not targeting ISIS, so Lavros said do not trust the Pentagon, ask the Russian Ministry of Defence. And in a way that’s what we did, because the Russian Ministry of Defence posted lots of videos online showing their air strikes, and we examined these, and there’s actually a group on Twitter whose hobby it is to figure out where these were filmed. So just like that the barrel bomb example was like looking at Google and finding the location. And we managed to find the location of the first thirty videos. And out of those thirty videos claiming to target ISIS, only one of them was actually targeting ISIS. But how do we know that? Who are we to say where ISIS are controlling and what? Well, again we asked Russia. They produced this map showing who controlled what in Syria, and we went into Google Earth and we can overlay that map into Google Earth and sketch around the areas of control, and then remove it. So anytime we geo locate something, we can immediately see whether it is in ISIS territory. So this is what Russia called an ISIS facility being bombed, and we were able to geo locate this as usual and go to the location. So obviously ISIS is the black area on the right hand side and the green area is non-ISIS area, according to the Russian MoD. And it turned out this was the location bombed in non-ISIS territory, and it wasn’t an ISIS facility, it was in fact a bakery run by the charity the IHH. We can also look at the denials that Russia was using cluster bombs. Russia was accused of using cluster bombs by Human Rights Watch and Amnesty International, and they said we do not use them, there’s not even cluster bombs in Russia’s airbase in Syria. So, we dug through all of the Russian media’s photographs of their base, found video footage and photographs, and what do we have here? Well in this corner, there are cluster bombs. And also after the siege of Aleppo was ended, the Russian MoD published these photographs of Russian soldiers disposing of unexploded ordinance, and they put them in this trench, and what do we have here? The same kind of cluster bombs we saw at Russia’s airbase in Syria.

So, they were accused of bombing the hospital, and they said this is untrue, we have this satellite imagery showing the building is completely unharmed, and this is what they presented saying this place has not been bombed. And they made two very distinct statements, that there are no changes that can be observed, and that it proves basically that it’s a lie. I was looking at this when I actually discovered that this place was bombed three times in a week. And, this is from the second bombing on October 1st, this is the hospital building, you can see there’s some damage there because the crater is only a few meters away from the actual hospital building itself, and this was all geo located and examined, and there’s lots and lots of footage of this. But this tells us what it looked like on October the 1st, this street on the east side of the building on October the 1st. Now what’s interesting is on the back wall of this area there’s a camera, a CCTV camera system that shows us what this looked like on October the 3rd moments before the bombing that occurred.

[Unidentified speaker] Where did you get the CCTV footage?

[Eliot Higgins] We reached out to the local people running the hospital and they had it. So this is the moment of the bombing, this is caught on camera. This is the bombing that Russia said didn’t happen. And this is what it looked like before and after, so clear damage but when we go outside to where there’s that smaller crater, we see this- a huge crater next to the hospital building. A few meters to the west would have completely destroyed the building. So the question is then, why can’t we see any changes in Russia’s imagery? Well, you can actually get better resolution imagery from commercial sources, you can actually see it on Google Earth if you want to have a look, start looking for differences. So, you can actually see that this roof from this building here has actually collapsed in both the right hand image and the Russian image. You can also see that this roof has also collapsed. We can even see the damage to the road. So what Russia has done here is simply lie about what you can see in their satellite imagery. You can see changes, and there is evidence from the ground showing that this place was bombed. So that’s bell and cat. So, that’s Bellingcat, any questions?


[Bob Seely MP] I’m on the foreign affairs committee, I’m wondering if you could give a presentation to us because I don’t think people realise the level of extraordinary detective work that’s out there. Anyway, let’s kick off with questions, who’s got a question?

[Question no. 1, Ian Moore, Centre for European Reform] My question is, do you see the Russians and others responding to what you’ve been able to do by tidying up their operations and security? I mean one obvious thing is, are you making sure that your sources do not have cell phones when they go to Russia and Ukraine? So do you see over time that your sources are drying up as the Russians are improving their counter intelligence?

[Eliot Higgins] Even if they are, we have so many different sources to get information from we’ve never really had a problem where we haven’t found the information, you don’t know what you don’t… that doesn’t exist. But we’ve never had any issues yet with losing sources like that. It is a bit hard to judge like that at the moment, because they aren’t as exact in Ukraine at the moment as they once were, but we also have civilians filming stuff. That convoy that was published online was nearly entirely filmed by local civilians. So you always have that information, plus you have other sources –satellite imagery and other data that you can use, so, even if that kind of information does dry up, it still isn’t the end of the world, and we’ve also seen when Russia’s been reacting to the kind of work we’re doing when we’re talking about the airstrikes, for example, and we published our work on that, they became a lot more general in the terms they used, they went from saying ‘ISIS in twenty kilometres outside of this town’ to ‘militants in this province, Syria.’ And even then they got stuff wrong. And they still just lie about stuff and they lie about it badly. This is the one thing, we often talk about how clever Russia are, how they get away with all these lies, but if you actually take the time to examine what they’re saying, its actually quite easy and straightforward to do to prove this sort of stuff, it’s just everyone gets so caught up with them being so supremely devious.

[Unidentified speaker] I think it’s also the detail, the time you’ve proved it they’ve sort of moved on to the next issue, and I think there’s an attention span issue as well and I think we’re all used to the Russians lying so much. And you know we aren’t perfect ourselves, and Iraq wasn’t a great example of Western behaviour and it’s difficult.

[Question no. 2, Colleen Graffy, LLM, Pepperdine University] I teach International Criminal Law and so this is fascination. And I’m wondering what is the reaction from Russia when you confront them with this other information? And also, to your point that they lie, but the public don’t see that, but the public don’t see that, so an important aspect of what you’re doing, I would hope, is to change minds. Just the other day a young girl was talking about how RT was just great, great and just so interesting with different perspectives, and I was aghast at hearing this. So are you able to do a quick turnaround and the New York Times picking up your information and putting something out, you know, moments later?

[Eliot Higgins] So, the Russian reaction, I mean the Russian reader in Russia today are healthy critics of Bellingcat. We’ve been attacked by the Russian Foreign Ministry, they’ve repeatedly said were liars and that were using fake information. In 2016, they did that. Actually I emailed them to ask for the evidence that we’re liars and please share it if you have it. And the response, I got an eight-page word document that was mainly plagiarized blog posts they’d found, and I got to write back saying please don’t plagiarize blog posts in the future, and they told me never to write to them again.

One thing we do; I think sometimes it’s very useful to in a way inoculate people against some of this stuff. A really good example is, the Russian MoD published what it claimed was drone imagery showing that the Americans were helping ISIS escape. Immediately lots of people responded saying no, that’s footage from a computer game, and it was. They had used a screenshot from a computer game as evidence. The reason people could respond so quickly was two weeks ago someone had used the same footage to claim it was a drone attack on the ISIS convoy, and I had basically just said this is from a computer game, and it got like, the original claim was like ten thousand retweets, but they’re the kind of people who read what I’m reading and the kind of people who follow the Russian MoD, so when they made that claim there was an instant reaction to that, and that’s the only time I recall the Russian MoD withdrawing its claim and apologizing for it being wrong. And another example is there’s a claim… there’s a photograph of what we might call White Helmets on a film set, with a makeup lady and stuff like that, and it was reported by [inaudible] sites in Russia that this was clear evidence that the White Helmets were faking videos. I very quickly did a quick investigation and discovered it was actually set photographs from the film made in Syria about Western journalists faking footage in Syria, so there’s like layers, you know. But because I wrote that, anyone who was reading seeing anyone who was sharing that kind of claim responded with that article, and in a way it stopped it becoming a meme, it never really took hold. Think of it like this: if Russia wants to fight an information war, we’ve got to arm the troops on the ground, be it on social media or whatever, with weapons, and give them the truth, but if no one does it, then…

[Unidentified speaker] Can I just follow up with that question? And can you just tell us a little bit about this database, this digital database because this is potentially very important for investigation into war crimes in Syria, and may become a bit of a template for the future.

[Eliot Higgins] Yes, so one big issue that’s coming up with Syria is there’s a massive data management task, because what you’ve got is lots of people who have been collecting archives and videos, lots of videos, some have been downloading videos online- the Syrian archive website for example, they’ve got now over a million videos they’ve downloaded from YouTube from Syria. And that’s just one organization of many, so there could be anything up to five million videos produced from Syria that are just the online videos, and this doesn’t include videos that are offline, so hard drives like the White Helmets have. So we’ve been working on an archive with the Syrian Archive and other organizations that will allow people to have an online archive of material, it will be on their own service, so they don’t have to give all that precious material away to different organizations, and with a centralized indexing system, and the idea is an organization like the IIIM can go to the macro Syria, highlight an area, set a date, and it’ll throw them every single video in the archives across the world, and they’re all going to be geo tagged and dated. We’ve just started a project with… actually, I can’t say that. We have started a project with an organization to archive a large number of videos and make them available to organizations like the triple I-M, but the lessons we’re learning here we’re going to use in other conflicts, because I’m already talking to groups about doing stuff with Yemen, because the ICC is working with Libya there’s a massive amount of interest in anyone who can do open source investigation in Libya.

[Unidentified speaker] ICC is International Criminal Courts.

[Eliot Higgins] Yeah. So the irony is I did all this work on Libya, did all this work on Syria, huge amounts of work, and it’s actually Libya where we can actually do stuff with it. So, but Yemen, Syria and Libya are really the three key areas of interest in the justice and accountability area in the Middle East at the moment.

[Question no. 3, journalist] I have a question about language arts, in particular, how did you get overcome [inaudible], how did that add to the issue, did it make it worse? [inaudible]

[Eliot Higgins] So, initially when I started doing this back in 2012, I don’t speak any Arabic, so I was just looking at stuff I could understand, like what weapons do these people have? Where was this video filmed? Over time, just through people being interested in my work with language skills, they would volunteer their time to translate. Now I’ve actually got staff at Bellingcat, we have Russian speakers, Arabic speakers, so that’s kind of less of an issue than it was originally.

[Question no. 4, Andrew, Public and currently Private Sector] Thank you for the great briefing. Question- considering your interest in Syria and open source exploitation, did you try looking for John Cantlie, and if not, the follow question is why?

[Eliot Higgins] Well the problem is because he’s moved around so much and the time lag between when these videos are filmed, I’ve actually geo located the likely execution site of James Foley, and there was actually an ISIS social media reaction to that- they said we need to be more careful about how we’re filming stuff, and in the following execution video they actually filmed it in a less distinct background, so I think ISIS in particular is actually really aware of this, maybe even more aware than some in Europe are, but inside Syria they seem very aware of this. So there has been stuff geo located, I mean a lot of these videos have been geo located, and a lot of the execution videos for example the Jordanian pilot execution video, but they film it, they move on and it’s impossible to track them like that unfortunately.

[Question no. 5, John Sweeny, BBC] I work for the BBC and you’re a hero. One of these days you need to get him an MBE, you should work for MI6. You’re summary on MH17 was incredible, around there at the time, after it happened obviously, and we used your pictures, the pictures you put up, to try and ourselves go to the places, which we did, we tracked where the MH17, where the boot went, and we found two witnesses who had spoken to the officer in charge of the convoy, and he spoke Russian with a Moscow accent. And none of that would have happened without you and your people. My question is, too often I come across people who say ‘the BBC, etc., etc., etc. is just the same at RT.’ And so aggressively, and so what’s the answer to this acceptance by too many people, that our Western medias are the same as something that comes out backed by the Kremlin?

[Eliot Higgins] That is a hard one. I kind of always feel there’s an education to this and we kind of assume that everyone kind of magically knows about the internet, how it works when they first get handed a smart phone when they’re maybe ten, eleven, twelve, whatever. I think we need to be a lot more proactive in schools about teaching them, teaching students about how information is shared, how it works, although I don’t want to start advising on policy or anything like that because it’s way beyond, and can be evolved, but I think if we can teach stuff like this. I’ve worked with people at schools in America where they teach students how to do this kind of investigative work, looking at their own school districts. Nothing huge, I mean they’re not looking at missile launchers or anything like that, they’re just learning more about what’s happening around them and actually being able to have an influence and discover stuff. And we’ve seen several good cases where, I think there was a student body at a school newspaper, and did an open source investigation into their principle and discovered they had a very dodgy past and got them fired. That might not be ideal in every circumstance, but they were really passionate, they were very engaged, they cared about their community. A lot of what we do with Bellingcat is a really big scale thing, we’re looking at the big global thing and it’s far away, but you can do a lot in your own community with this work, and I think if we were to encourage students at some point to do this we might make them think a lot more about the kind of media they’re consuming and how it’s constructed just as part of the process of doing this.

[Unidentified speaker] My worry is that government agencies are not as advanced. They’re not as good, they’re not as driven, they’re not as creative, and they lack the sort of outside genius that we have from Bellingcat. But also they lack the digital forensics lab that is supported by the Foreign Office. So I think that’s the first problem. The second problem is I think there’s just a level of ignorance about the wealth of information that’s out there. Thirdly, you don’t want people like Eliot too close to government because you know, if we get into another war he might be using this information against our own forces in a way that some of us might feel uncomfortable with, but it might be for the best because we have to observe the rules of law and all that thing especially in warfare, so it’s a difficult one. Thank you for your question.

[Question no. 6] A couple of very practical questions, but first of all for the most magnificent and inspiring presentation. A couple practical questions, how big of a team are you? And how many staff do you employ? And how do you keep going, where does your financial rapport come from? And also how do you choose which projects to chase?

[Eliot Higgins] So my team, we just got some more funding so we’re expanding to twelve people full time, and we’ve got a team of about fifteen volunteers who I’m trying to employ because they’re basically the best open source investigators I know. Before this month we had about six full time staff and they worked in very diverse subjects, so we had someone for example looking full time at Scottish [inaudible] partnerships, which some of you might be familiar with, but many people are not.

[Unidentified speaker] That has to do with money laundering and criminality not to do with independence or anything, right?

[Eliot Higgins] No, no it’s all to do with corruption and stuff like that. And mainly we’re funded by the Open Societies Foundation, the National Endowment for Democracy and basically the workshops that we run on a monthly basis. But it’s very difficult because there are so many topics we could be looking into, and some of them are really worthwhile, there are some really worthwhile topics, I would love to set up a team just looking at Libya, just looking at crimes in Libya, but money is an issue but also having people who can actually do this. There’s a very small number of people who can actually do this, and even smaller who actually have the language skills to do this. There’s very, very few really good quality Arabic speakers who are open source investigators who don’t already have a job. And it’s also a very competitive market because a lot of people look at us and think oh well it’s like journalism. But the kind of people who do this work- if we pay them journalist wages, unfortunately I think they’d go and find work working for private companies doing business intelligence, because that’s kind of more the kinds of organizations that are interested in the kind of people who work for Bellingcat. So I’m trying to race against time trying to hire these people before they get hired, we’ve already lost someone to the New York Times. It’s a real problem for me.

[Unidentified speaker] Right, let’s have a couple more questions if we could.

[Question no. 7, Miranda Guey, Institute for State crime] you must be getting tired of all the thank yous, but I’m Dutch myself, and just thank you for researching the MH17 case. How strong is evidence like this in court?

[Eliot Higgins] So, that’s actually a really big question we have now. It’s like with the MH17 case- we have all this open source evidence, we have a massive amount of open source evidence, and it’s pointing very clear in the direction of who’s guilty, we’ve been able to identify suspects, but you know the Joint Investigation team, they have more than just this information. This is kind of a weird situation where you have this Russian counter narrative being pushed, they’re doing a criminal investigation, but they’ve also got this information that is public, that Bellingcat has already written about. So, this is why they have these press conferences, because otherwise you would have had four years of Russian propaganda about what happened before they even actually got to court. Now, there’s actually an advantage to that, because in a way you kind of crowdsource Russia’s defence, you have all these people who support Russia, who think that MH17 is a conspiracy theory so they come up with every possible scenario to explain away all the evidence surrounding MH17. So in a way they’ve already crowdsourced all of Russia’s defence even before Russia’s gone to court, which gives the chance to the Joint Investigation team and Bellingcat to massively debunk this stuff because it’s rubbish. But the question now is what can the ICC, you know the Wafalli example, for example, that is what they used to issue their arrest warrant but they will go out and interview, and find people and other information. So really, open source information in terms of a court case is really just part of the picture. But I get frustrated when people say ‘oh well this isn’t doesn’t really count as evidence because it won’t stand up in court.’ We aren’t presenting this at the moment to go to court. If we did, and I have done this stuff, the whole process is incredibly tedious but important, that can be done. But we are publishing stuff for raising awareness on issues, sometimes it’s advocacy, sometimes it acts as journalism, sometimes it’s just because something’s just interesting and we want to write about it. Sometimes it’s because something is so obscure that nobody’s even bothered looking into it so it squashes into partnerships, where some people have done that but we did it in a slightly different way that no one had tried before that used data. So, yes I think’s just a matter of, and also depends court to court how they use this information, and there hasn’t really been any real test of this yet, but I think the MH17 case, both in Dutch courts, and the European Court of Human Rights case, which is also using a lot of open source information, is also going to be quite important.

[Unidentified speaker] Right, I’m just worried about the time, I’m just going to take two more questions together, and then you can answer both at the same time.

[Question no. 8] I saw the headline for this was the MH17, could you just summarize what happened, why was that aircraft shot down? Was it just some loony sitting around who thought it would be good fun to shoot down an aircraft or was it a more conspiratorial plot by central Russia [inaudible]?

[Question no. 9, William Sander] Well, I think I may be able to answer that. William Sander but formerly a pilot for British Airways, but now cast in the Pacific. And my understanding is they were probably trying to shoot down a military plane that happened to be in the wrong area. And the question that I have is, really whether you genuinely [inaudible] I understand the book system needs about four vehicles to be operated in its most sophisticated way, one of which would be target identification, and all they had was a simple missile launcher with a fairly simple radar that attracted that, and that really is my question, if you can confirm that?

[Eliot Higgins] So, broadly on the MH17 basically the receptive forces in that part of Ukraine were getting a lot of pressure from aircrafts, so they had been giving things like shoulder launch air pads, they had a [inaudible] of tens, which are forms of missile launchers, but the missile launchers were meant to be dealing with higher altitude aircraft. There’s incepted phone calls where one receptionist is talking about how ‘the bird is flying in your direction,’ he is basically talking about him, but he’s talking about another date. We’ve looked into this, we’re going to publish a piece on this soon and it’s garbage- he’s definitely talking about that specific date, so it looks like he knew this aircraft was heading in the direction. It’s believed they actually believed it was a transport aircraft. And the reason it was misidentified is, as you said, they didn’t have the full system. So you have like a support, command centre, a radar system, but all they had is the built-in radar system, which is very directional, produced less information, and supposedly they also had a thermal camera, but we don’t know if that was operational or not. So it’s likely they misidentified the target as a transport aircraft, to be shot down a few days earlier, and they thought it was a military transport aircraft, but I genuinely don’t think they shot it down as any kind of conspiracy or purposeful attack on a commercial airliner. But they still do bear responsibility, they were sending military equipment, including missile launchers, over from Russia to Ukraine.

[Question no. 10] Obviously you do an amazing variety of different things, I’m a journalist. If you could say in a sentence your mission, what is Bellingcat’s mission?

[Eliot Higgins] It’s really about spreading open source investigations to a range of different fields and areas.

[Question no. 10] To achieve?

[Eliot Higgins] Basically to achieve more people doing open source investigation. We think it’s really valuable and useful for a whole range of organizations.

[Unidentified speaker] It is incredibly valuable and brilliant, and actually I did ten years very accidentally in the armed forces, a very accidental soldier basically, and I did the Libya campaign, and then I did Iraq, ISIS and Iraq II, and then Afghanistan. And the power of open source investigation is really beginning to shape and have significant impact on the military, because the military had all of these closed systems, and all of a sudden you have a wealth of information that comes in open source. And actually gives you a much fuller picture of the world you are inhabiting, and the world in which you are trying to conduct operations, than this very limited picture and actually having a closed system as the military does, now because of the extraordinary wealth of open source data, and how certain people- activists and previously amateurs but now experts are using it, our military in my opinion is struggling to catch up. Anyway, on that note, Elliot, thank you that was amazing.


Lost your password?

Not a member? Please click here