Digital Sherlocks: Open-source investigation and news verification during wartime

Bana
Bana Alabed, known as 'Aleppo's tweeting girl', and her mother, Fatemah, pose during an interview with Reuters in Ankara, Turkey, December 22, 2016. Open-source investigation methods were used to verify her existence and accounts of life in Syria after the regime suggested her Tweets were mere 'propaganda'. [REUTERS/Umit Bektas]

Digital Sherlocks: Open-source investigation and news verification during wartime

THE LONG READ: From proving the existence of a seven-year-old girl in Syria to fact-checking locations of aerial bombings, how do you verify ‘open-source’ information in a war zone?

 

Truth, it has been said, is the first casualty of war. In the digital age, where anyone with a smartphone and internet access can produce and share stories at a fast pace, this thought is perhaps more relevant than ever. 

On March 16, 2017, almost 300 people gathered for the Ishaa night prayers in the Omar ibn al-Khattab mosque south of al-Jinah, in northern Syria. At 6:55 PM local time, an airstrike targeted the religious complex, killing at least 38 individuals – according to claims made by locals. 

How can a journalist seeking to establish what happened that night find out more while not being able to visit the targeted site? Online open source investigation offers an opportunity to discover, verify and validate multimedia information coming out of war zones. These can provide you with more elements to answer the who, what, when, why, where and how, and enable you to tell a story to your audience. 

The information ecosystem in a conflict setting includes a great amount of propaganda as part of war strategy. At the same time, activists and citizens start playing relevant roles in reporting what is happening, especially now that they have the tools to do so and are easily able to connect globally. 

Case in point: There are more hours of online video footage of the Syrian conflict than the actual time elapsed since the war began

The increasing reliance on user-generated content (UCG) is in some cases the only information coming out of denied-access terrains for journalists. But this information may be biased or factually incorrect. Journalists, thus, need to have the skills and tools to go through the overwhelming amount of information produced during wartime, filter inaccurate information – whether published deliberately or not – and get the facts right. 

This article aims to show how to verify UGC, with a specific focus on war and conflict contexts. The use of digital tools that facilitate reverse image search, checking the weather on a given location at a certain date and time, or geolocating a specific site, along with core journalistic skills, such as cross checking sources and interviewing relevant stakeholders, will be examined here as key elements of fact-checking. 

First, a brief discussion about the importance of verifying photo and video, as a continuation of this introductory conversation is crucial to raise awareness on how easy it is to alter and/or decontextualise images, and how this in our visually driven world continues to be one of the main strategies used to misinform people. 

Second, the best way to illustrate how valuable these verification resources and skills are, and show the diversity of situations they can be applied to in order to fact-check stories, is primarily done by examining four case studies where we have put them into practice. Finally, we describe the results they have rendered. Here are the four cases: 

1. The United States (US) bombing of a mosque complex in northern Syria 

2. Authenticating WhatsApp messages of Turkish coup plotters 

3. Fact-checking locations of official videos: Russian airstrikes in Syria 

4. Proving the existence of a 7-year-old girl in Aleppo 

Photos and videos: Simple tools for verification 

There are numerous examples of politicians and officials that use photos that were not related to the topic they were talking about. US Senator James Inhofe, for example, presented photographs to the Senate in February 2015 of what he said were Russian Army tanks in Ukraine the previous year. Two of the three images he showed were in fact taken during the 2008 Russo-Georgian War.That is not to say that there were no Russian Army tanks in Eastern Ukraine: Open source monitoring indeed shows there were.

OSINT1
Senator Inhofe presented photographs to the Senate in February 2015 of what he said were Russian Army tanks in Ukraine last year. Two of the three images were in fact taken during the 2008 during the Russo-Georgian War. [Photo: C-SPAN]
OSINT2
Two photos of Russian tanks during the Russo-Georgian War in 2008. The photos were used by a US Senator to say they depicted Russian tanks entering Ukraine. [Photo: (left and right) AP Photo / Mikhail Metzel]

More recently, Syria’s ambassador to the United Nations (UN), Bashar Jaafari, used an old photo taken in Iraq in an attempt to show the Security Council that Syrian government forces were not mistreating civilians in Aleppo. 

The picture he used to corroborate this version of events appears to show a woman being helped down from a vehicle by a soldier, an image originally published in Arabic news websites in June 2016, describing it as a woman being helped by Iraqi soldiers in Fallujah.48 Ironically, Jaafari condemned the use of “fake news” around the December 2016 battle for Aleppo. 

OSINT3
Syria’s ambassador to the UN holding up a photo, which he says shows his government’s forces are not mistreating civilians in Aleppo (left). However, the photo was already posted in June 2016 on Arabic-language news websites, saying they show Iraqi soldiers helping a lady in Fallujah, Iraq (right). [Photo: (left) UN Web TV49 , (right) IBN News] 

For images posted on the web, there is a simple tool to figure out whether it was posted before. This is called reverse image search, and browser extensions or add-ons have been developed by, for example, Google and TinEye, and can be downloaded for free. With two mouse clicks, you can see if an image was posted somewhere before the alleged event took place. 

Here is an example of how useful reverse image search is used in verifying digital content. In the context of the increasing media coverage given to the recent flow of refugees seeking entry to the European Union, a photo of a boat loaded with people was being shared on social media, claiming to show refugees arriving in Europe in 2016. Some people reacted stating that they were not refugees in 2016, but European refugees arriving in northern Africa in the 1940s. Neither of the claims was true. A reverse image search shows the photo displays Albanian refugees arriving in Italy in 1991. 

OSINT4

OSINT5
A photo of a boat loaded with people was shared on social media, claiming to show refugees arriving in Europe in 2016. Some people reacted stating that they were not refugees in 2016, but European refugees arriving in northern Africa in the 1940s. Neither of the claims was true. [Photo: ROPI / Alamy Stock Photo] 
OSINT6
A reverse-image search shows the photo actually displays Albanian refugees arriving in Italy in 1991. 

Even though an event may have happened, sharing photos that are not related to it may cause harm by people simply calling the whole event “fake” or saying it has not happened. This is especially relevant in a war context, where all involved parties and stakeholders will try to influence public opinion. Never forget that information is a crucial and powerful weapon. 

Another good example of this is when, in May 2016, the White Helmets posted some photos that allegedly showed the aftermath of Russian airstrikes in a hospital in Idlib, Syria. One of the pictures they showed had appeared in a news piece by Al Jazeera in November 2015, which showed alleged airstrikes in Aleppo that, according to Syria’s Civil Defence, targeted residential areas and trucks loaded with humanitarian aid. 

The Russian Embassy in the United Kingdom exposed the White Helmets through its Twitter handle, demonstrating they were using an image that did not correspond with the event they were referring to, and that it had been published months before.

OSINT7

Screen grab of the Twitter handle of the Russian Embassy in the UK, at the moment it exposed the White Helmets. On the left, the decontextualised picture can be seen on the bottom right of the tweet screenshot. On the right, a screenshot of Al Jazeera’s news piece, published in November 2015, that shows the same photo.

 

However, a reverse image search only does so much of the job. Searching for videos, for example, is significantly harder. Nevertheless, Amnesty International has developed a tool, the YouTube DataViewer, which allows you to find the exact uploading date and do a reverse image search of stills from the video. The latter may not always be accurate, but it is a good start for verifying videos. You may wonder why it is useful to know the exact uploading time, and why YouTube does not initially provide you with this information. It does tell you the date, but not the local time in which the video was published. An incident in which a suspected US airstrike killed civilians in Syria exemplifies why determining the uploading time of a video – local time – is crucial to having an accurate publishing date, and how both pieces of information are relevant to verifying news. 

On a video uploaded to YouTube, a young girl can be seen amidst dust and twisted metal beneath the rubble of a destroyed building in Kafr Deryan, 40 kilometres west of Aleppo city in Syria. These images were among the strongest pieces of evidence pointing towards civilian injuries and casualties as a result of US-led Coalition airstrike in the early hours of September 23, 2014 – the first night of Coalition airstrikes in Syria. A thorough review of the content by Amnesty International, combined with satellite imagery analysis and reports by Syrian human rights groups, suggests multiple civilian deaths, raising the question as to whether this attack was proportionate and whether precautions to minimise harm to civilians may not have been taken. Yet, the US Central Command’s conclusion was unequivocal: “[…] Open source images presented as casualties from the strikes actually came from previous [Government of Syria] strikes.”

Now, the YouTube video may indeed cause confusion: It says it was uploaded on 22 September, but the uploading date reflects the time difference between Syria and US Pacific Time, where YouTube’s headquarters are based and used as the official publishing date. Ignoring this can easily lead to wrong research findings, as happened in the past, and may confuse reporters and journalists seeking to verify critical information. 

Using Amnesty’s YouTube Data Viewer, it is possible to extract the exact time and determine local publishing time: Around 6:00 AM local time on September 23, which fits perfectly with the timeline of the attack. It is worth noting that organisations such as Amnesty International have gathered compelling evidence related to specific attacks by Coalition forces from 2014 to 2016, often using open-source material. 

So far, we have shown relevant examples of how reverse image search and other tools allow journalists to check visuals within a few seconds. But how do we go about more difficult cases?

News verification can change the news 

As a journalist, if you take the information that stakeholders are feeding you without verifying it – or any kind of information for that matter, especially in a war context – you are failing to do your job. Verifying news is pushing for accuracy, a core journalistic value, or at least aiming to do so. When we succeed, when we get the facts right, news verification can actually change the news: Establishing facts as a means to answer the W’s of journalism (who, what, when, why, where) and how events take place, might result in changing the story. Sometimes, despite all of our efforts, we cannot verify a piece of information – in which case it should be relayed to the audience as a means of ensuring utmost transparency. 

The following case studies offer good examples of the possibilities and challenges of news verification. 

The US bombing of a mosque complex in Northern Syria 

To begin with, it is a matter of noticing something has happened. But if you are on the other side of the world, how can you notice a relevant incident, and how can you try to verify it? There are a number of ways for discovering events, and social media is today a relevant public space to access this information. Make social media monitoring a habit. There are a number of digital tools for this. One of them is TweetDeck, where you could start by putting together a list of activists, citizen journalists and any other gateway medium that may potentially be of interest. When looking for a specific geographical area, you could also try to find geotagged photos via services like EchoSec and WarWire. 

On March 16, 2017, an airstrike hit a mosque complex in Al-Jinah, Syria. Locals tweeted only two minutes after witnesses stated they heard airstrikes. The first tweet mentioning a strike in al-Jinah, for example, was sent into the worldwide web at 6:57 PM local time – only two minutes later. The tweets published minutes after the incident from local citizens claimed that the village had been targeted by warplanes without specifying what or by whom. At 7:07 PM local time, a tweet mentioned that the airstrike was conducted by the Russian Air Force. Local media agencies echoed that claim. On YouTube, on the other hand, a steady stream of videos coming from the alleged targeted site would become available approximately 1.5 hours later. These videos were later assessed for their noteworthiness. The information came from different platforms like Twitter, Facebook, YouTube, in addition to media and other relevant websites. However, it may well be that these sources actually all refer to the same tweet, with or without mentioning it. 

OSINT8
A typical homepage from a YouTube account subscribed to many accounts posting videos from the conflict in Syria.

When you find your incident of interest, the next step is to collect every video, photograph, and any other relevant piece of information, and post them in one place to begin making sense of the incident. Wherever possible, identifying the original source of that information is key, as it allows journalists to: 

1. Verify whether the content is new 

2. Discover new information posted by the same source 

3. Identify any links those sources may have that can take you to other potential sources 

For example, in the mosque attack, we could identify the relevant YouTube channels quickly, and on the main page of those channels were other links to different social media channels. All this content is essential, as it may contain key information for the verification process. So, how can you track down the original source? If it is a photo, for example, you might want to try a reverse image search. If it is a claim, try searching Twitter on a keyword and list the results chronologically. The aim is to answer who tweeted it first. The next step is to geolocate as many of the images as possible, so you can begin to get a sense of the location, and start eliminating any videos or photographs that might not be relevant, or flag those that need further investigation. Geolocation is the exact determination of a location where a video was taken. 

One challenge is that it is occasionally very tricky linking interior shots of a structure to its potential exterior, so we can prove the interior belongs to the structure we are examining. In the al-Jinah-case, a video filmed by a local inside the mosque complex and uploaded to YouTube not only allowed us to link the interior with the exterior, but also to confirm details about the building, such as the prayer room being below ground level, and connected to the outside by a staircase to the north side of the building. We compared the interior shown in the video with images showing the exterior, as well as satellite imagery obtained via Google Earth, Microsoft Bing Maps, and TerraServer. While the filmmaker’s interpretation of the evidence in the area cannot be verified, the details provided about the physical space are essential in understanding the incident. 

Once you have obtained as much information as possible regarding available imagery through tools such as geolocation and reverse image search, you will start having a better understanding of the area, so when you come to review statements from locals gathered through social media you can compare them to what is visible within the geolocated images. Through that, you might also be able to make sense of some of the more unusual things you have noticed. 

Back to the al-Jinah case, the first clue that the attack was by US or Coalition forces was the remains of munition reportedly recovered from the scene of the attack. 

OSINT9
Remains of munition reportedly found at the scene of the mosque complex attack. [Photo by Sakir Khader]

Journalist Sakir Khader obtained the photograph from one of his sources on the ground. Moments after the attack, he asked them to find bomb remnants on the scene and to take photographs and gather information that could lead to determine who had dropped them.

The label was near-identical to the labels used on Hellfire missiles, only used by the US and Coalition forces, so despite claims in some of the initial videos and tweets from the attack site that Syria or Russia were responsible, the evidence found in the photo pointed in a different direction. 

That same night, the US Central Command claimed responsibility for the attack, wrongly stating its target was a location in Idlib, Syria. The geolocated images clearly showed it was in the Aleppo governorate, though close to the governorate borders. The Pentagon would later state, according to Bellingcat, that this may have been due to differences in internal reporting. 

It was clear from the geolocated image that there was a massive crater on the north side of the large building in the complex, far beyond what a Hellfire missile could achieve. Based on witness accounts in videos posted on YouTube and Facebook, and text posts on Twitter, some claims seemed to explain this. Witnesses said that a larger bomb had been dropped, followed by several missiles. While there were small differences in how the witnesses described the events, the larger bomb or bombs and several missiles recurred in each of their accounts. Often, you will find witnesses giving differing versions of the same event, but usually not dramatically different. Nevertheless, those accounts always need to be compared to other evidence to build a clearer picture. 

So, after we verified the location, and put together a clearer timeline of the events by cross-checking and comparing eye-witness testimony, there were still crucial questions that needed to be answered: 

1. Can we confirm who is responsible?

Interestingly, the US usually publishes reports about the approximate location they are striking. And they happened to have published a report about striking what they said were Al-Qaeda militants in the Idlib province. The building we had geolocated was located in the Aleppo province, but only a few kilometres from the provincial border with Idlib. In combination with the photos of weapon remnants that we obtained through photos and videos uploaded by locals and local media, we decided to email the Pentagon for clarification. Did the Idlib strike refer to the al-Jinah strike? Yes, it did, they would reply. 

2. What was the targeted building? 

This is especially important in the mosque example as we have the US claiming the target were militants linked to Al-Qaeda, while people on the ground claimed they were civilians and members of a local religious group. With this we had to go back to previously discovered sources, see what information was being posted there, and compare it to images from the attack. Ideally, we would have images from before the attack, or even social media pages used by the victims. Groups like the Violations Documentation Centre and White Helmets will often provide details of the victims, and we can reach out to groups and individuals on the 106 Journalism in Times of War ground via social media. No evidence of the presence of an armed group could be obtained via open source information. However, this does not necessarily mean there were no Al-Qaeda operatives. A question that would reveal more interesting information will be discussed now. 

3. Was the targeted building a mosque? 

Revisiting the incident as new information became available, and using that to review, verify, and discredit claims and findings, was crucial to reporting on this particular issue. Often new satellite imagery will become available that shows more details of the area before and after the attack, or, as in the case of the mosque complex attack, the US provided imagery from just after the attack. 

OSINT10
An aerial photo provided by the Pentagon of the targeted area (left) and a still photo taken from a SMART News Agency video (see minute 2:20). Photo: (left) DoD photo and (right) SMART News Agency. [Photo: Composition image by Timmi Allen/Bellingcat]

The image provided by the Pentagon showed the building after the strike, claiming it was a “partially constructed meeting hall” and that they “deliberately did not target the mosque at the left edge of the photo in order to minimise civilian casualties”. 

However, open-source imagery, videos, satellite photographs, as well as survivor testimonies collected by Forensic Architecture and Human Rights Watch, strongly indicated the targeted building was also a mosque. An adhan speaker, used for the call to prayer, was discovered on pre-strike footage, besides the mosque sign already in place near the mihrab inside the building.

As showed here, news verification enables you to answer basic journalistic questions: What happened? Who is responsible? Where did it happen? When did it happen? How did it happen? In this particular case, as it sometimes occurs, the question as to why it happened remains ambiguous. Were there really individuals linked to Al-Qaeda present? Or do the locals speak the truth? That is something we have not been able to answer satisfactorily, but it is evident that the building hit was a functioning mosque. 

The al-Jinah case exemplifies how verifying news and UGC can provide your audience with accurate information about a newsworthy event, a responsibility that might find a more complicated path amidst the information chaos generated by war and conflict. By using geolocation, comparison and cross-check of information coming from different sources (from witnesses to the countries involved, such as the US), we were able to build a solid picture of what happened on March 16, 2017. 

Authenticating WhatsApp messages of Turkish coup plotters 

OSINT11

Screen grab of a video that showed part of the Whatsapp conversation between Turkish coup plotters. The original uploader is unknown.

 

In the morning of the failed coup attempt in July 2016 in Turkey, a WhatsApp chat allegedly displaying a conversation between part of the coup plotters surfaced on social media. While it was being shared thousands of times, the question was: “Is the group conversation authentic?” Based on the transcript, partly provided by Al Jazeera Türk, each and every message was analysed to confirm the authenticity of the conversation.

“66th on its way” or “212 has been passed” – some of the messages included in the chat – may seem cryptic, but with some research ‘212’ appeared to refer to a big shopping mall in Istanbul, and by comparing number plates of military coup vehicles and a database of Turkish vehicle registration plates, it was possible to determine that ‘66th’ referred to the 66th Mechanised Infantry Brigade. 

Subsequently, advanced searches on social media can be done, for example, to determine if military vehicles with the same number plate were spotted at the locations mentioned in the group app. In that way, each and every message was carefully analysed and triangulated with other open source material, resulting in an extensive reconstruction of the coup attempt in Turkey in July 2016. 

OSINT12

Military vehicles used during the coup attempt revealed more information about the units taking part in the event, as the vehicle registration plates reveal their military unit. These units could be matched with mentions of units in the WhatsApp conversation: ‘196’ refers to the 2nd Armoured Brigade and ‘117’ to the 66th Mechanised Infantry Brigade, both part of the Turkish Land Forces’ First Army, 3rd Corps. [Photo: (left) Baz Ratner / Reuters; (right) Getty Images]

 

 

Again, to be sure that the photo indeed showed the location it was said to show, we used geolocation. Always remember to cross-reference visual clues in a given footage or photo with satellite imagery. 

Fact-checking locations of official videos: Russian airstrikes in Syria 

Since the start of their respective air campaigns in Syria, as well as in Iraq, both the US-led Coalition and Russia have published videos purporting to show their bombs targeting military objects. Information-wise, this is one of the peculiarities of war: Content that perhaps in a non-war situation would not be produced and published. Content projected and presented by military forces can be used to deter and threaten adversaries, as well as to gain legitimacy among and support from public opinion. Fact-checking the following official airstrike videos resulted in some interesting findings. 

When the Russian military started bombing targets in Syria in September 2015, President Putin claimed that the purpose of the mission was to fight Islamic State in Iraq and Levant (ISIL). Initial reports of the Russian Defence Ministry (MoD) claimed that ISIL was the only target of Russian military activity. Yet crowd source analysis of the videos purporting to show those airstrikes, ironically published by the Russian authorities themselves, quickly revealed that specific claims they made were not correct, as illustrated by two examples below. 

Triggered by the discovery of two videos of the Russian MoD claimed to be filmed in or near ISIL-controlled Raqqa were geolocated in sites over 100 km west of the city. Bellingcat decided to test these claims by launching a collaborative effort to use the Check59 platform to geolocate and collect additional information on these official videos. The results were remarkable. 

Some videos were verified as being in locations matching the title and description of the videos, but many others gave inaccurate claims as to whose territory was targeted, or even totally wrong location. 

A video posted on the Russian MoD’s YouTube channel, claims to be showing an airstrike on an ISIL “ammunition depot” in the Raqqa governorate.60 The Russian MoD implies that the strike occurred near Tabqa, west of Raqqa. However, as has been the case in dozens of other videos, the video was actually geolocated 115 km away near Al-Bab, in the Aleppo governorate. It is unclear why the Russian MoD claimed the wrong location: Both territories were held by ISIL at the time. 

Other videos, however, claimed to show airstrikes against ISIL targets but were geolocated to areas where there is no known presence of the group – implying Russia targeted other rebel groups instead. An example is an airstrike said to have taken place in Raqqa according to the MoD, but was geolocated to Al-Lataminah in the Idlib province. While the location was classified by media outlets and activists as “rebel-held”, the claim that there was no ISIL presence could even be substantiated with the Russian MoD’s own information: Their map of territorial control presented at a press conference. By using this as an overlay in Google Earth with the geolocated airstrike videos mapped, it showed that not only this strike but many others were actually in non-ISIL held territories. Note that this is in 2015; at later stages Russia published more videos showing strikes on actual ISIL-held territory. 

OSINT13
Screen grab of Google Earth, with two added overlays. First, the colors green, black, and non-colored are the areas of territorial control according to a map published by the Russian MoD.

Second, the circles are geolocated airstrikes, green for a correct location by the Russian MoD and red for not a correct location. 

Perhaps the most striking geolocated airstrike video was published in December 2015. The Russian MoD released a video of what it claimed to be an “airstrike against an oil refinery near Khafsa Kabir.” However, this “oil refinery” was actually a water treatment facility, “producing an average of 18 million litres of water daily,” according to the United Nations Children’s Fund (UNICEF) representative in Syria, Hanaa Singer. The structure shown in the airstrike video appears identical to Google Earth satellite imagery.

OSINT14
Satellite imagery from Google Earth (right) reveals that the supposed oil refinery near Khafsa Kabir, Syria (left), is actually the Al-Khafsa water treatment facility, located at 36.178345, 38.041224. [Photo: (left) Russian Ministry of Defense, (right) Google Maps]

Further analysis of ground-level photographs of the facility confirmed this was indeed a water treatment facility, and not an oil-refinery as claimed by the Russian MoD. Additionally, using a file type search on Google, we obtained an official document of the German company that renovated the water treatment plant – providing further evidence that this was in fact a water treatment plant, and not an oil-refinery as claimed by the Russian MoD. These are all examples of how aerial views can be analysed against satellite imagery to establish facts. Now, geolocation is also useful to match a ground perspective to satellite imagery. This method has been used to proof the existence of a seven-year old girl in Syria, as our next and last case study will show. 

Proving the existence of a seven-year-old in East Aleppo 

As the Syrian government forces encircled the city of Aleppo in late 2016, a seven-year old girl named Bana Al-Abed gave a voice to many civilians trapped in the city’s opposition-held east. Helped by her social media savvy, English-speaking mother, Fatemah, Bana’s Twitter account published pictures of their daily life, amassing over 300,000 followers, including author of the Harry Potter series JK Rowling. 

Bana’s rapid rise to world prominence soon made her a target in the online battle over alleged misinformation about Syria. 

In an interview, Syrian President Bashar Al-Assad conflated Bana Al-Abed with “terrorists or their supporters” and suggested her Twitter account was a “game” and “propaganda”. Online critics questioned the remarkably well-written English of a seven-year old or why her house still had electricity and internet in besieged east Aleppo. As the speculation about her account became so prevalent, two Bellingcat volunteers decided to examine Bana’s Twitter account, effectively fact-checking the life of the seven-year old Syrian girl. 

The open-source investigation used methods and tools such as social news gathering, context analysis, cross-reference of sources, geolocation, and satellite imagery, among others, to examine Bana’s existence and authenticity. For example, they were able to establish that Bana was indeed tweeting from East Aleppo, and not from Turkey, as some of her critics suggested. 

The Bellingcat team used her videos and photos posted on Periscope and Twitter, including footage in which Bana herself appears, and geolocated them to the area around the same apartment block in East Aleppo where Bana claimed to live, using freely available satellite imagery from Google and Bing Maps. More recent satellite imagery also supported the claim that Bana’s family apartment was bombed on November 27, 2016. 

Also, the team was able to determine several facts with regard to other claims: 

1. By analysing Bana’s Periscope videos and reviewing news reports on her (from the BBC and Sept à Huit) they concluded that Bana and her family had access to electricity through solar panels installed on their roof. The panels allowed them to charge some form of car battery, which was then used to charge the phones.

2. As for the internet access, they examined tweets, news pieces, and reports from IT solutions company Dyn, to establish that there were multiple ways in which Bana and Fatemah could have gained access to the Internet. 

3. As stated in Bana’s Twitter account, it was Fatemah, her English-speaking mother, who wrote a majority of tweets. Fatemah, in fact, had been clear and open about her running the account. 

OSINT15

Photos and videos posted by Bana Al-Abed’s Periscope and Twitter accounts can be geolocated to a neighbourhood in East Aleppo using openly available satellite images. Online critics had earlier questioned whether the seven-year old girl was really in Syria, but actually tweeting from Turkey or somewhere else instead.

 

The district where Bana’s family home is located fell to the Syrian government and allied forces on December 3. Bana and her family were subsequently evacuated to an opposition-held area in the countryside of western Aleppo governorate in late December 2016, along with thousands of others displaced from east Aleppo. 

You can do this! 

In today’s world, where so much information is being shared, it is easy for inaccurate news to spread, especially on social media. Therefore, fact-checking, verification and validation of information coming out of war zones is more important and essential for the future of journalism than ever. 

We have discussed how using open-source investigation, supported by digital tools and core journalistic skills, can help you search for stories and tell them accurately to your audience. A simple reverse image search will do when you are just trying to validate if a picture actually corresponds to the story that is being told, but other times, when trying to establish the who, what, where, why, when and how, you will have to approach the story in a more holistic way and this requires using several tools and skills to establish the facts. 

The discovery process will see you through to the next step, the next claim or UGC that needs to be verified. In sum, these will point out which combination of tools and methods can be used for determining the authenticity of each specific ‘fact’. Always keep your mind open, question everything and be creative in the ways you approach the content to verify it. Your aim is to build a picture as clear as possible. And if you do not figure it out, always be honest to you audience: Say you simply do not know. Before you know it, you will be a true digital Sherlock. 

 

Hadi Al-Khatib also contributed to this article, which first appeared in the AJMI publication, Journalism in Times of War

 

المزيد من المقالات

صحفيو شمال غزة يكسرون عاما من العزلة

رغم الحصار والقتل والاستهداف المباشر للصحفيين الفلسطينيين في شمال غزة، يواصل "الشهود" توثيق جرائم الاحتلال في بيئة تكاد فيها ممارسة الصحافة مستحيلة.

محمد أبو قمر  نشرت في: 17 نوفمبر, 2024
جيريمي سكاهيل: الحرب على غزّة وضرورة العودة إلى "صحافة المواجهة"

يدعو الصحفي الاستقصائي الشهير جيريمي سكاهيل إلى إحياء ما أسماه "صحافة المواجهة" للتصدي لحالة التفريط بالقيم المهنية والإنسانية الأساسية في وسائل إعلام غربية مهيمنة، وخاصة في سياق تغطية الإبادة في قطاع غزة.

Mohammad Zeidan
محمد زيدان نشرت في: 6 نوفمبر, 2024
في السنغال.. "صحافة بلا صحافة"

شاشات سوداء، وإذاعات تكتم صوتها وصحف تحتجب عن الصدور في السنغال احتجاجا على إجراءات ضريبية أقرتها الحكومة. في البلد الذي يوصف بـ "واحة" الديمقراطية في غرب أفريقيا تواجه المؤسسات الإعلامية - خاصة الصغيرة - ضغوطا مالية متزايدة في مقابل تغول الرأسمال المتحكم في الأجندة التحريرية.

عبد الأحد الرشيد نشرت في: 5 نوفمبر, 2024
تهمة أن تكون صحفيا في السودان

بين متاريس الأطراف المتصارعة، نازحة تارة، ومتخفية من الرصاص تارة أخرى، عاشت الصحفية إيمان كمال الدين تجربة الصراع المسلح في السودان ونقلت لمجلة الصحافة هواجس وتحديات التغطية الميدانية في زمن التضليل واستهداف الصحفيين.

إيمان كمال الدين نشرت في: 28 أكتوبر, 2024
الأثر النفسي لحرب الإبادة على الصحفيين

ما هي الآثار النفسية لتغطية حرب الإبادة على الصحفيين؟ وهل يؤثر انغماسهم في القضية على توازنهم ومهنيتهم؟ وماذا يقول الطب النفسي؟

أحمد الصباهي نشرت في: 18 أكتوبر, 2024
"أن تعيش لتروي قصتي"

في قصيدته الأخيرة، كتب الدكتور الشهيد رفعت العرعير قائلا "إذا كان لا بد أن أموت فلا بد أن تعيش لتروي قصتي".

لينا شنّك نشرت في: 15 أكتوبر, 2024
عامٌ على حرب الإبادة في فلسطين.. الإعلام الغربي وهو يساوي بين الجاني والضحيّة

ما تزال وسائل إعلام غربية كبرى تثبت أنّها طرفٌ في حـرب الرواية، ولصالح الاحتلال الاسرائيلي.. في هذا المقال، يوضّح الزميل محمد زيدان كيف أن وسائل إعلام غربية كبرى ما تزال تطوّر من تقنيات تحيّزها لصالح الاحتلال، رغم انقضاء عام كامل على حرب الإبـادة في فلسطين.

Mohammad Zeidan
محمد زيدان نشرت في: 8 أكتوبر, 2024
حسابات وهمية بأقنعة عربية.. "جيش إلكتروني منظم"

أُغرقت منصات التواصل الاجتماعي بآلاف الحسابات الوهمية التي تزعم أنها تنتمي إلى بلدان العربية: تثير النعرات، وتلعب على وتر الصراعات، وتؤسس لحوارات وهمية حول قضايا جدلية. الزميلة لندا، تتبعت عشرات الحسابات، لتكشف عن نمط متكرر غايته خلق رأي عام وهمي بشأن دعم فئات من العرب لإسرائيل.

لندا شلش نشرت في: 6 أكتوبر, 2024
رصد وتفنيد التغطيات الصحفية المخالفة للمعايير المهنية في الحرب الحالية على غزة

في هذه الصفحة، سيعمد فريق تحرير مجلة الصحافة على جمع الأخبار التي تنشرها المؤسسات الصحفية حول الحرب الحالية على غزة التي تنطوي على تضليل أو تحيز أو مخالفة للمعايير التحريرية ومواثيق الشرف المهنية.

مجلة الصحافة نشرت في: 23 سبتمبر, 2024
"مأساة" الصحفي النازح في غزة

بينما تقترب حرب الإبادة الجماعية في فلسطين من سنتها الأولى، ما يزال الصحفيون في غزة يبحثون عن ملاذ آمن يحميهم ويحمي عائلاتهم. يوثق الصحفي أحمد الأغا في هذا التقرير رحلة النزوح/ الموت التي يواجهها الصحفيون منذ بداية الحرب.

أحمد الأغا نشرت في: 22 سبتمبر, 2024
من الصحافة إلى الفلاحة أو "البطالة القسرية" للصحفيين السودانيين

كيف دفعت الحرب الدائرة في السودان العشرات من الصحفيين إلى تغيير مهنهم بحثا عن حياة كريمة؟ الزميل محمد شعراوي يسرد في هذا المقال رحلة صحفيين اضطرتهم ظروف الحرب إلى العمل في الفلاحة وبيع الخضروات ومهن أخرى.

شعراوي محمد نشرت في: 15 سبتمبر, 2024
المصادر المجهّلة في نيويورك تايمز.. تغطية الحرب بعين واحدة

ينظر إلى توظيف المصادر المجهلة ضمن المعايير المهنية والأخلاقية بأنها "الخيار الأخير" للصحفيين، لكن تحليل بيانات لصحيفة نيويورك تايمز يظهر نمطا ثابتا يوظف "التجهيل" لخدمة سرديات معينة خاصة الإسرائيلية.

Mohammad Zeidan
محمد زيدان نشرت في: 5 سبتمبر, 2024
عمر الحاج.. "التحول" الصعب من العطلة إلى بؤرة الزلزال

قبل أن يضرب زلزال عنيف مناطق واسعة من المغرب، كان عمر الحاج مستمتعا بعطلته، ليجد نفسه فجأة متأرجحا بين واجبين: واجب العائلة وواجب المهنة، فاختار المهنة. في تغطيته لتداعيات الكارثة الطبيعية، التي خلفت آلاف القتلى والجرحى، خرج بدروس كثيرة يختصرها في هذه اليوميات.

عمر الحاج نشرت في: 17 أغسطس, 2024
رفاق المهنة يروون اللحظات الأخيرة لاغتيال إسماعيل الغول

كانت الساعة تشير إلى الرابعة عصرا أمس (31 يوليو/ تموز)، مراسل الجزيرة في مدينة غزة إسماعيل الغول، والمصور رامي الريفي، وصحفيون آخرو

Mohammad Abu Don
محمد أبو دون نشرت في: 1 أغسطس, 2024
في الحرب على غزة.. كيف تحكي قصة إنسانية؟

بعد تسعة أشهر من حرب الإبادة الجماعية على فلسطين، كيف يمكن أن يحكي الصحفيون القصص الإنسانية؟ وما القصص التي ينبغي التركيز عليها؟ وهل تؤدي التغطية اليومية والمستمرة لتطورات الحرب إلى "التطبيع مع الموت"؟

يوسف فارس نشرت في: 17 يوليو, 2024
الأمهات الصحفيات في غزة.. أن تعيش المحنة مرتين

أن تكون صحفيا، وصحفية على وجه التحديد تغطي حرب الإبادة الجماعية في فلسطين ومجردة من كل أشكال الحماية، يجعل ممارسة الصحافة أقرب إلى الاستحالة، وحين تكون الصحفية أُمًّا مسكونة بالخوف من فقدان الأبناء، يصير العمل من الميدان تضحية كبرى.

Amani Shninu
أماني شنينو نشرت في: 14 يوليو, 2024
بعد عام من الحرب.. عن محنة الصحفيات السودانيات

دخلت الحرب الداخلية في السودان عامها الثاني، بينما يواجه الصحفيون، والصحفيات خاصّةً، تحديات غير مسبوقة، تتمثل في التضييق والتهديد المستمر، وفرض طوق على تغطية الانتهاكات ضد النساء.

أميرة صالح نشرت في: 6 يونيو, 2024
الصحفي الغزي وصراع "القلب والعقل"

يعيش في جوف الصحفي الفلسطيني الذي يعيش في غزة شخصان: الأول إنسان يريد أن يحافظ على حياته وحياة أسرته، والثاني صحفي يريد أن يحافظ على حياة السكان متمسكا بالحقيقة والميدان. بين هذين الحدين، أو ما تصفه الصحفية مرام حميد، بصراع القلب والعقل، يواصل الصحفي الفلسطيني تصدير رواية أراد لها الاحتلال أن تبقى بعيدة "عن الكاميرا".

Maram
مرام حميد نشرت في: 2 يونيو, 2024
فلسطين وأثر الجزيرة

قرر الاحتلال الإسرائيلي إغلاق مكتب الجزيرة في القدس لإسكات "الرواية الأخرى"، لكن اسم القناة أصبح مرادفا للبحث عن الحقيقة في زمن الانحياز الكامل لإسرائيل. تشرح الباحثة حياة الحريري في هذا المقال، "أثر" الجزيرة والتوازن الذي أحدثته أثناء الحرب المستمرة على فلسطين.

حياة الحريري نشرت في: 29 مايو, 2024
"إننا نطرق جدار الخزان"

تجربة سمية أبو عيطة في تغطية حرب الإبادة الجماعية في غزة فريدة ومختلفة. يوم السابع من أكتوبر ستطلب من إدارة مؤسستها بإسطنبول الالتحاق بغزة. حدس الصحفية وزاد التجارب السابقة، قاداها إلى معبر رفح ثم إلى غزة لتجد نفسها مع مئات الصحفيين الفلسطينيين "يدقون جدار الخزان".

سمية أبو عيطة نشرت في: 26 مايو, 2024
في تغطية الحرب على غزة.. صحفية وأُمًّا ونازحة

كيف يمكن أن تكوني أما وصحفية ونازحة وزوجة لصحفي في نفس الوقت؟ ما الذي يهم أكثر: توفير الغذاء للولد الجائع أم توفير تغطية مهنية عن حرب الإبادة الجماعية؟ الصحفية مرح الوادية تروي قصتها مع الطفل، النزوح، الهواجس النفسية، والصراع المستمر لإيجاد مكان آمن في قطاع غير آمن.

مرح الوادية نشرت في: 20 مايو, 2024
كيف أصبحت "خبرا" في سجون الاحتلال؟

عادة ما يحذر الصحفيون الذين يغطون الحروب والصراعات من أن يصبحوا هم "الخبر"، لكن في فلسطين انهارت كل إجراءات السلامة، ليجد الصحفي ضياء كحلوت نفسه معتقلا في سجون الاحتلال يواجه التعذيب بتهمة واضحة: ممارسة الصحافة.

ضياء الكحلوت نشرت في: 15 مايو, 2024
"ما زلنا على قيد التغطية"

أصبحت فكرة استهداف الصحفيين من طرف الاحتلال متجاوزة، لينتقل إلى مرحلة قتل عائلاتهم وتخويفها. هشام زقوت، مراسل الجزيرة بغزة، يحكي عن تجربته في تغطية حرب الإبادة الجماعية والبحث عن التوازن الصعب بين حق العائلة وواجب المهنة.

هشام زقوت نشرت في: 12 مايو, 2024
آليات الإعلام البريطاني السائد في تأطير الحرب الإسرائيلية على غزّة

كيف استخدم الإعلام البريطاني السائد إستراتيجيات التأطير لتكوين الرأي العام بشأن مجريات الحرب على غزّة وما الذي يكشفه تقرير مركز الرقابة على الإعلام عن تبعات ذلك وتأثيره على شكل الرواية؟

مجلة الصحافة نشرت في: 19 مارس, 2024