This is a case-based guide detailing our methodology to verify a Russian drone strike allegedly targeted at the Aidar battalion, geolocated to Starohnativka, Donetsk Oblast, Ukraine. It serves as a guide to replicating the methodology as well as a tutorial for using open source methods, tools and crowdsourced material on Twitter to verify Russia’s claims in the war in Ukraine.
by Tom Jarvis and Robin Taylor
Introduction
On March 4th, 2022, the Russian Ministry of Defense (MOD) published an edited YouTube video of a drone strike hitting a building supposedly somewhere in Donetsk Oblast, in Eastern Ukraine. Russian authorities claimed to have hit a command and observation post of the Aidar (Айдар) battalion, a volunteer-based military unit accused by Amnesty International of war crimes in 2014.
This is believed to be the first drone strike video video published by the Russian military since the beginning of the invasion and possibly the first combat footage of the Orion UAV, also called ‘Inokhodets’ (Иноходец). Since the strike had only been reported by Russian media outlets and was (to our knowledge) not successfully verified, we decided to give it a go.
Geolocating drone strikes poses several challenges.
- Firstly, the footage is often grainy/unclear and monochromatic, making identifying helpful map features (such as mountains, vegetation, etc.) difficult – unless you are used to working with drones.
- Secondly, there is usually little additional information accompanying the footage, such as the precise time and strike location. Moreover, whatever information is published about the strike may be misleading.
Usually, drone footage is published by the military, and thus with a purpose. In this case, a drone strike against a known far-right militia outpost in Donetsk Oblast is an easy PR win for the Russian Ministry of Defense (MOD). Additionally, it has been well reported that Russia realised it was already losing the information war. It is therefore important to be cautious with analysing official information, seeing that they could lead the geolocation/verification effort astray. For all we know, it could be imagery from a training exercise or completely fake. We have seen several examples of old drone footage doing the rounds on social media in the last month alone.
Thus, determining if this is new footage is one of the primary goals of the verification process.
This guide discusses the steps, methodology and tools we used in order to geolocate and chronolocate this video, including all the challenges we encountered with its verification. Furthermore, it provides additional tips that could be used to support future drone verification attempts.
Breakdown of the video
The 38-second video consists of either four or five clips of footage. An initial wing-camera view of the alleged drone in flight is followed by a thermal image view of a road and compound showing the heat signatures of people. This is followed by a three-second clip – believed to have been sped up – of a car entering the target location and then the fourth clip showing the strike itself from a different angle. The fifth clip may be part of the fourth clip, where a cut to a different zoom level was recorded and shows the camera tracking off-target and looking at a nearby building.
What is notable about the strike itself is the angle of the projectile as it strikes the target. Toward the end of this article, we make a case that it appears that the munition was not fired by the drone filming this footage, despite the Russian MODs claim, and could quite possibly not even be a drone strike. This would mean the drone was acting in a reconnaissance or guidance role instead.
Screen capture from the video posted by the Russian Ministry of Defense on YouTube on March 4th, 2022: https://www.youtube.com/watch?v=iK4DBQOxfZo
Methodology
This verification effort followed a very simple methodology. It should be noted that there could be a plethora of ways in which this footage could have been verified and there is no one-size-fits-all method. Feel free to share any alternative methods you think could have aided our search or anything we missed. Each step should help narrow down your eventual area of search.
Context
Context is the information that accompanies the footage you are trying to geolocate. Context can be the title or description of the video, comments online below the post itself, or it can be stored within the video in the form of EXIF/metadata. Metadata, however, is rather rare since most social media platforms strip any stored data before publishing the video on their site. In addition, metadata can be misleading since anyone can alter the metadata on purpose, or accidentally, by editing the video before publishing. From the context, you can establish the basic facts: is this a new video? What is it about? Who might be the source? Where do they claim the event took place?
Furthermore, given our scepticism of the validity of the Russian MOD’s statement, we found it particularly useful to conduct further basic research regarding each fact. That meant we actively sought out and collected information and footage about the drone itself and the recent history of the Aidar battalion. This part spills over into our next phase.
The search
The next step is to see what others are saying about the video. ‘Others’, in this case, can be news outlets or social media comments about the strike, but also any discussion related to key terms established from the given context. In this case: ‘drones’, ‘Inokhodets’ (Orion), or ‘aidar’. The aim of this search is to gather as much additional information about the video as possible that could aid your investigation. In any geolocation case, there are bound to be others with more situated knowledge than yourself. Therefore, searching through comments or online discussions you can find about the video can provide hints or in some cases the exact location. In our case, we are also looking to find any information about the validity of the video. While platforms such as Google and Twitter are common places to start, we will demonstrate how Telegram, especially in the context of Ukraine, can be a useful place to get a decent understanding of who is talking about the video in question.
Visual knowns
If nothing from the previous two steps has yielded sufficient findings, we need to prepare for a hands-on geolocation effort. As mentioned, geolocating and verifying drone strikes often requires a different type of methodology than normal geolocation. Establishing ‘visual knowns’ is all about analysing your video and creating a simple list of what you can see in the video. Importantly, these should be clues that you can easily identify on a map, such as landmarks or general remarks about the landscape: Is it densely populated? Are there any bodies of water? And so on.
Geolocation
Geolocation is the practice of finding the real-life location where your image or video was taken. It is perhaps one of the most well-known open source investigative practices and has been used extensively throughout the Ukraine invasion to establish where strikes occurred.
There are plenty of geolocation guides going into various tools and methods we will not cover here. As mentioned, geolocating grainy black and white drone footage offers different challenges that other geolocation efforts do not. The method that we use in this guide is something called ‘brute force’.
Brute force, in geolocation lingo, is a method where one scours an entire area, city, state, country, or more, based on your imagery analysis and whatever clues you were able to find through your search. While brute force is a method that takes a lot of patience and a keen eye, we will present some tips and tricks to make your search more efficient.
Chronolocation
Finally, we have chronolocation. Chronolocation is the practice of establishing when the event that you are witnessing in your imagery occurred.
While with geolocation you are generally looking for a very precise answer, with chronolocation it is about establishing a timeframe and attempting to narrow it down as much as possible – which, in some cases, can be down to minutes, in other cases could be days, weeks, or even months. So, when trying to narrow down your timeframe for when your imagery was captured there are a few methods that have been cultivated in recent years.
Here is a comprehensive summary by chronolocation master @Sector035. However, attempting to chronolocate drone imagery differs from usual footage since we cannot rely on commonly used indicators such as shadows, weather, or seasonal indicators (e.g. leaves on trees or flowers). To chronolocate an image, we repeat many of the same steps above.
Geolocating the drone strike
Context
Our first act was to investigate whether this video had existed elsewhere on the internet previously. In order to do this, we need to reverse-image-search our video. Amnesty International created a tool that allows the user to paste the link of any YouTube video and it will display the video metadata. YouTube, as mentioned, strips any metadata stored in the video and as such any information that would aid your investigation. However, it does grab keyframes, such as the thumbnail, and allows you to search the web using said thumbnails.
Screengrab of results from Amnesty’s International’s YouTube Metadata Viewer. https://citizenevidence.amnestyusa.org/
This is a simple trick to discover if the video is old or new. Following a number of Google reverse image search attempts, we could demonstrate that every website hosting the video had been published after the Russian MOD had published it on 4th March 2022. We could therefore assume that the video was very likely new and probably did not exist elsewhere previously.
The most important context accompanying the drone strike footage is the title and description of the video added by the Russian MOD on their YouTube channel:
“The destruction of the command and observation post of Aidar battalion by crew of unmanned aerial vehicle Inokhodets of the Russian Aerospace Forces in the territory of the Donetsk People's Republic. The target was hit by guided aerial munition.”
Already, this statement significantly narrows down the search area. However, we were prepared to revisit all assumptions further down the line considering the possibility that the statement and/or the source could be misleading for the aforementioned reasons. Nevertheless, according to the context provided by what we (for now) assume was the Russian MOD, we now had key terms we could use as a start for the investigation: a general location (Donetsk), a target (potentially Aidar), and the type of weaponry used (Inokhodets drone). Since we had little prior knowledge of the latter two, we spent some time gathering whatever publicly available information we could find about them.
Public information on ‘Inokhodets’ UAV
Image source: Russian MOD https://www.youtube.com/watch?v=BBi-mgPa9YU
One of the easiest parts of the video to identify is the type of drone in the initial shot. This only required a very basic Google search of Russian drones in operation and visual analysis skills. Such a search can easily be done with simple search terms such as “Russian drone” on Google Images or searching for a list of drones in operation. There are very few top-secret vehicles in the world (secrecy typically surrounds the technology inside the aircraft rather than the platform itself) and manufacturers normally post more than enough information to help identify weapons and aircraft in their press releases. This can be used to your advantage.
What we were able to discover about the drone:
-
The drone in question was a military version of the Orion drone nicknamed Pacer (иноходец/Inokhodets), a Russian medium-altitude long-range UAV developed by Kronstadt.
-
The drone provides for the installation of up to four air-to-ground missiles, the cruising speed of the device can reach 200 km/h, the maximum flight altitude is 7.5 km, and the device can stay in the air for up to a day. The maximum mass of the UAV combat load is up to 250 kg.
-
It came into service in 2020.
We also discovered a demonstration video of its combat capabilities from late 2021. This helped as we were able to compare and match the drone interface between the two videos. This at the very least indicated that the footage in the first shot is authentic and from an Inokhodets. In addition, It would later allow us to compare the combat footage side by side with the demonstration video.
- NOTE: It should be noted that at the time of writing this guide additional footage of the Inokhodets has been published by various news outlets.
Public information on the Aidar Battalion
This battalion is a volunteer-based military unit that has been accused by Amnesty of committing several war crimes and human rights abuses. The Aidar battalion has been chased by controversy, including allegations of far-right beliefs, and was disbanded in 2015. It has been reorganised and reincorporated into other groups since.
The history of this group makes it a prime example of “Ukrainian extremism” in Russian propaganda channels. The coverage of the strike in these channels caught our attention due to the potential for a falsified claim to showcase military success in the field and also to demonstrate justification for Russia’s so-called “war on Nazi extremism.”
The Aidar battalion is named after the Aidar river, in Luhansk, where it was originally deployed. This disrupted our original search plan as we began debating whether this meant the strike could have taken place in Luhansk.
The search for location
In addition to reverse image searching, we needed to gather all information about the strike that we could find online. We proceeded by establishing keywords in Ukrainian, Russian, and English, such as ‘Drone’, ‘Aidar’, ‘Orion’. Afterwards we tried various combinations of these keywords (in both English and Russian) in the most topically relevant search tools: Google, Yandex, Twitter, and Telegram. The results exposed that on the day (4 March 2022), only Russian media outlets and forums had commented on the strike and they often used the exact same wording as the Russian MOD. Thus, we were not able to find additional information about the airstrike. While searching Google or Twitter is simple enough, Telegram takes a little more effort.
Initial searches on Twitter confirmed the drone identification and provided additional options of footage – this can be a useful way to find higher resolution footage in some cases. In this instance, all the information appeared to be recycled from the official announcements.
Establishing a pool of searchable Telegram channels
One of the first things to generate when investigating the Russia/Ukraine conflict is a searchable information pool in Telegram. By adding channels to your Telegram feed, you are able to search within them.
Telegram search by itself is useful, but returns limited results and generally only searches the channel names. This is why it is useful to search when you are already subscribed to channels.
To find channels, one can refer to previous open source investigations referring to Telegram channels and begin joining the pages listed if relevant. Due to the information chaos that was present at the start of the conflict, very little methodology or screening was needed for building this resource. Specifically, the methodology in this case was “search and collect everything you can find.”
Once you find channels of interest, search through them for forwarded messages and follow those channels, too. It is much easier to unfollow channels that turn out to be useless than it is to find channels. Remember, the more channels you follow, the bigger the pool of information you have that can be searched.
Another method of building a pool of Telegram channels is to determine relevant terms which can be searched for and the resulting groups that can be subscribed to.
Telegram search gives you results in two “feeds”. First, it gives global results, normally limited to channels and profiles featuring the search term in their name. Second is a list of messages from channels and groups you follow that feature the term. In this instance, a search for “Айдар” did not yield good results in the global search, so it was imperative to follow a wide range of Russian and Ukrainian channels, these were already being followed as known distributors of information and disinformation about the conflict.
For this investigation, following channels from both sides was beneficial because it may have opened disputed avenues of information from each side, which could have been investigated further. As it stood, the only references to this attack tended to come from pro-Russian sources.
Building a profile of the visual 'knowns'
In addition to the useful bits of information we found about the strike, building a profile of the visual ‘knowns’ will be important to determine the most obvious clues that will aid the search. By actively noting the key features of interest, a checklist is created to easily match the possible locations with the essential criteria required for a match. It also creates a “visual profile” which enables fast scanning of satellite imagery and rapid dismissal of the majority of locations. Our profile of ‘knowns’ after analysing the footage was this:
- Small river next to distinct houses
- River is <1 building width at location
- River goes right up to a straight road
- Specific road pattern and looks like a dirt road
- Not a densely populated area
Screenshot from the Russian MOD video of the drone strike
When attempting to geolocate an image with poor resolution or satellite imagery, a great tool in the open source intelligence (OSINT) arsenal is a pen and paper or a digital drawing tool. By creating a sketch of the area that includes only relevant details, you actively align your focus with the key features and rough proportions of the image. The sketch should include relevant layouts and buildings as well as land features and road layouts.
In addition to the aerial view, the drone footage provided a reasonable amount of additional information. This included graphic overlays believed to be the direction of travel and the compass orientation. Considering the scarcity of ‘Inokhodets’ footage online, this would be a tough task to solve on our own. As such, we discussed our theories publicly on Twitter with the aim to get experience from drone operators and people who may have worked on this type of footage before.
Screenshot of Twitter exchanges by the authors on the topic. Source: Tom Jarvis
Establishing north
In order to save time geolocating, we realised we had to establish where north was in our footage so that we could orient ourselves in relation to a map (a practice called map orientation). This would allow us to dismiss a number of possible locations off the bat.
The recording of the drone view provided useful information. On the graphic interface, there was an arrow that was believed to be a compass pointing North. By aligning the different frames it appeared that the arrow always pointed the same way with respect to the landscape. Another key takeaway was that once the geolocation was confirmed, it would lend proof to the theory of the drone display having a compass orientation.
Frame of the drone footage adjusted to compass based on the assumption of the arrow’s function.
Geolocation: crowdsourcing and brute force
Having collected all the clues through various searches and built our checklist of visual knowns, it is time to open our map of choice, in our case, Google Earth Pro, and attempt to identify the location of the strike. However, given the fact that we had very little information to go by, some conflicting information, and that what little information we had found could be fake or misleading, and with all of Eastern Ukraine as a starting point, we realised we would have to ‘brute force’ it. While an unstructured approach could potentially have taken weeks, we would like to share two tips that save time and construct your effort, namely: crowdsourcing and Overpass Turbo.
Crowdsourcing
Having analysed the imagery and conducted our searches, we decided to share our checklist and relevant information on Twitter with the aim to get as many people and eyes (that were willing) involved as possible. Hashtags, such as #geolocation and #verification, have been widely used by the OSINT community to gain help by others on geolocation puzzles.
Along with images, we posted our checklist of visual knowns and skepticisms about the authenticity of the video.
Through our Twitter initiative, we were able to get opinions on the drone footage from experienced drone operators. They were able to confirm our theory as to whether the arrow could be pointing North. More importantly, several people became involved in our attempt in solving the puzzle.
Systematic brute-forcing
One of the most effective ways to brute force a geolocation is by adding a grid system as an overlay in Google Earth over the total area you will be searching. This way you can simply divide up regions amongst yourselves or use as a checklist so you know what areas you have already looked in.
- If you are wondering how to make a grid system in Google Earth, here is a very simple tutorial (unfortunately it only works for Windows and it is rather complicated for Mac users).
In Google Earth, you can use the ‘path’ function to draw a marker indicating each grid you have looked through. This method helps keep you and your team organised with areas to focus on and allows a systematic approach to ruling out grid squares.
Here we have a well-defined grid structure using the above tool so that crowd-sourced analysis can be allocated to discreet locations and labour divided.
- NOTE: One of the best open source tools available is Overpass Turbo. This tool acts as an assistant to you for reading and extracting data from OpenStreetMap. You ask it to collect information and it returns with that information neatly packaged into a usable format, such as a KML file which you can then import into Google Earth.
Given that we have aerial footage, we can start by mapping what we know is there. It is a lot easier to geolocate an unknown location when you have ruled a lot of land out. In this case, we know it must be close to a river.
KML files were generated of all rivers in the area of interest by using the search terms River in “Donetsk Oblast” and River in “Luhansk Oblast” in Overpass Turbo. A grid was generated using GE-Path, a tool which you can read more about here.
Once you have a map of all rivers in the area of interest, you have a finite set of lines that can be followed to try and find the location of the strike.
We also know other features are present such as the orientation of the road alongside the river and its proximity. This further narrows things down and means that the search from here can be quite rapid.
Results of the geolocation efforts
Knowing that many areas were not close to rivers, vast swathes of Ukraine were ruled out and the brute-forcing became significantly smaller in scope. We were able to geolocate the strike to the town of Starohnativka, Donetsk Oblast. Coordinates: 47.543764, 37.779394.
We were able to discover the location with relative ease, particularly with the help of the open-source community weighing in with extra sets of eyes.
Furthermore, we were able to indeed confirm our theory that the arrow was pointing in the direction north.
Chronolocating the drone strike
The first step to ‘chronolocate’ something is by establishing a starting point and a timeframe. In our case, the first timeframe starts in 2014 at the beginning of the Donbas war and ends on March 4th, 2022 when the video was posted by the Russian MOD. The second and final step is to continually narrow down this timeframe until we are satisfied.
Google Earth
We can begin narrowing our timeframe by looking at freely available historical imagery on Google Earth Pro. Google Earth has imagery of Starohnativka from August 2007 until October 2020. As we can see below, no visible change to the compound – such as blast damage – occurred between 2014 and 2020. The location of the strike is marked by a yellow circle. This narrows our timeframe to 2020 to March 4th, 2022. This also fits nicely with the Wikipedia description of the ‘Inokhodet’ drone, which was first introduced into the Russian military in 2020 following a trial period in Syria in 2019.
While nothing of note occurred at the compound between 2014 and 2020, we can use the changing landscape to further solidify our current timeline. In the satellite images below, we can see that the roof was extended on the left-hand side between 08/2020 and 10/2020. This is the same house that we noted for having a very specific structure. In the drone strike video, we can identify that structure and therefore be certain that the drone footage was filmed after 08/2020.
Screenshot from Google Earth
Screenshot from Google Earth
Screen capture from the video posted by the Russian Ministry of Defense on YouTube on March 4th, 2022: https://www.youtube.com/watch?v=iK4DBQOxfZo
The search for timeframe
Now that we have narrowed it down significantly, it might be useful to begin looking for news and social media posts about this town between 2020 and 2022. In a similar fashion to the types of searches we applied for the geolocation, we can do for chronolocation. The aim is to note down all, if any, reports of bombings in Starohnativka and get a better understanding of the town.
The initial search quickly taught us that Starohnativka was a strategic location for the Ukrainian military located very close to the frontline, and had been so for a number of years. A number of news reports and social media posts were made concerning shelling in the vicinity, but few reports indicated any houses or locations inside the village perimeter had been struck before February 2022. Furthermore, we learned that from around mid-late February, right around the start of the 2022 invasion, several people reported about bombing and destruction of houses in Starohnativka.
By using Twitter’s advanced search function we can tweak what days are of interest to us and add several keywords to run. We ran the search looking for tweets about ‘Starohnativka’ but also any including the Russian (Старогнатовка) or Ukrainian (Старогнатівку) spelling. The search indicated that around the 21st of February 2022 we started seeing news about shelling and fighting inside the village itself.
The precise search query was: (Старогнатовка OR Старогнатівку OR Starohnativka) until:2022-02-25 since:2022-02-19. The same formats were used for the following queries.
Similarly, we can use Twitter’s advanced search function to see what people had been saying about Starohnativka before 22nd February 2022. Most media reports and tweets discuss shelling in the near vicinity, but not inside the village itself.
Due to the visible smoke and flames coming out of the back of the projectile in the footage, we can rule out mortar fire and artillery shells. (Image: screenshot from Twitter)
While not definite, we can say with a certain degree of confidence that the strike most likely occurred after the 21st February. One news organisation stated that on the 24th February one house in Starohnativka was destroyed and ten others damaged, which could very well be the footage we have geolocated, albeit not by drone strike.
Though we should be ready to revisit this assumption should we find any contradicting information. However, it would add another layer of ‘weirdness’ if this turned out to be a two-year-old drone strike. Moreover, we learn the village was taken over by the pro-Russian Donetsk People’s Republic (DPR) forces on the third day of the 2022 invasion, the 26th February 2022. This was reported by Russian news sources and by DPR soldiers posting on Telegram. This is important because we can assume that the strike would have occurred before pro-Russia DPR soldiers advanced into the village, narrowing our end date to the 26th February. Based on our social media search, we can assume a new timeframe being roughly 21-26th February with the mindset of being prepared to revisit this assumption.
Image: screenshot from Twitter
Further research led to the discovery of smaller accounts on Twitter reporting heightened conflict and action in the area on the 25th February. One account posted that the village was being “wiped off the face of the earth” (translation), at 11:12 on the 25th February, followed by another account posting at 17:23 that the village had been taken.
This matches claims made by the Russian MOD that the area had been taken on the 25th.
Other map sources
When having trouble chronolocating a recent event, one needs to exhaust all satellite imagery sources. So, here are a few we utilised.
-
Sentinel Hub is frequently updated with low-quality satellite imagery from around the world nearly every other day provided by the European Space Agency.
-
EOS Landviewer is another free platform to view satellite imagery with a cleaner user interface (UI) than Sentinel.
-
Satellites.pro is a website where you can view Google Maps imagery and also Apple and Yandex maps (though the latter two do not add dates to their imagery so they are of little use).
-
More recently, an increasing number of commercial actors are providing Synthetic aperture radar (SAR) imagery. SAR imagery, being radar, is unaffected by weather and has been effective at monitoring Russian military equipment, see here and here.
However, despite our best efforts we were not able to visibly confirm that damage occurred to the buildings from both Sentinel and Landsat imagery, mostly due to the quality of the imagery than anything.
Results of the chronolocation efforts
Despite having narrowed down our timeframe to a little less than a week, any effort to reduce it further would be a fairly difficult challenge without additional on-the-ground footage or access to additional high-resolution satellite imagery (though historical weather data suggests it was quite cloudy). It should be noted that without further investigation we can never be 100% certain about the timeframe, though there is good reason to believe it occurred around the 24th-25th of February, it should be classified as a low-level chronolocation confidence.
Generally, a multi-source verification of the time would be ideal - in this case, we could have benefitted from local witness statements. Unfortunately, we encountered one of the main limitations when using open source information: availability of verifiable witness sources. It is however essential to measure the window of time because by ruling days out, you may help to verify / debunk additional footage in the future.
Additional tips on information sources
FIRMS
There is one resource, if you are lucky enough, that can almost instantly narrow down your timeframe when chronolocating an airstrike and it is called Fire Information for Resource Management System (FIRMS). FIRMS is a NASA (US National Aeronautics and Space Administration) tool that delivers near real-time information about fires around the world. Myanmar Witness frequently uses FIRMS to discover when and where villages and houses have been burned down. It has also been used to monitor fires in Ukraine. However, in this case it could very well be that the fire was too small, burned out, or extinguished, before FIRMS was able to pick it up. We were able to confirm that a number of the reports of shelling by Twitter users in/near Starohnativka occurred outside the town due to FIRMS data.
Geotagged Tweets
Perhaps the least useful tip on the list is geotagged tweets. Sometimes people geotag their tweets (roughly 2% of all tweets are geotagged). There are two tools that can help you quickly identify if there are any relevant tweets in a specific area for your investigation. Firstly, onemilliontweetmap posts the most recent one million tweets anywhere in the world and can be useful for current events. Secondly, Birdhunt allows you to navigate to the location in question, chose a radius, and will run advanced twitter search for all previously tagged tweets within the given radius.
Metadata & Streetview
The final tip is perhaps the most well-known OSINT method and that is retrieving exif or metadata from an image or video. While conducting our social media search, we came across a number of Ukrainian and Russian blog posts and news outlets displaying images of destroyed or damaged houses in and around Starohnativka. In some cases, we were able to assume that an image was irrelevant due to the fact that geographical information was stored in the image. If you are not familiar with Exif/Metadata, Bendobrown has a fantastic and simple YouTube tutorial on the topic.
Finally, in cases where the geographical information had been wiped, there was not much we could do. Usually, we would be able to quickly geolocate these images using streetview. However, Google Streetview is limited in Ukraine and other providers such as Mapillary, which is a user-generated streetview tool, with plenty of Ukrainian street view data had removed their Ukrainian data since the 2022 invasion began after consulting with partners in Ukraine. This in itself shows the value of open source information during conflict, and how it can be deployed offensively to help invading forces navigate.
Was this actually a ... drone strike?
Before wrapping this guide up, there are a final few questions that are interesting in of themselves: do we know if this actually was a drone strike?
With OSINT, particularly when faced with an environment riddled with influence operations, it is essential to separate what is absolute and what is inferred. In this case, we have drone footage viewing a strike at a location. The inference made is that the drone fired and guided the rocket to the target, but without visual evidence of this it is simply an inference. Let us start with the first question.
Was this a drone-fired strike?
While the Russian MOD claims that the target was hit by a ‘guided aerial munition’. Due to the nature of the footage, it is difficult to determine the exact munition used, however, there is reason to at least doubt that it came from the drone.
Firstly, you need to know that this is in fact the first supposed combat footage by a Inokhodet drone had been published by the Russians. Meaning until now, no one had actually witnessed its active combat capabilities nor has it been reported upon previously (unlike other drone types such as the Turkish Bayraktar TB2). However, we stumbled across previously released demonstration videos of the drone targeting both aerial and ground targets. By comparing the strikes in the demo video and the video of which this guide is based upon, we can notice discrepancies, specifically in the trajectory of the munition.
The two first sets of images below are from the demo video and the final from the geolocated video.
Demonstration video: https://www.youtube.com/watch?v=0FMCk5xJnxk
Demonstration video: https://www.youtube.com/watch?v=0FMCk5xJnxk
Strike video: https://www.youtube.com/watch?v=iK4DBQOxfZo
Based on what we see in the first two sets of images - the projectile is either shot from directly underneath the drone and as such is in the centre of the screen almost the entire way, or it is shot from the wing, in which case it curves drastically before centering itself. If we follow the projectile from the Aidar strike, it starts in the upper-right corner and proceeds in a straight line, as seen below:
Strike video: https://www.youtube.com/watch?v=iK4DBQOxfZo
The angle suggests that the drone and the projectile are quite distant from one another, unlike in the demo video. Moreover, the drone appears to be locked onto its targets in the demo video: we can see a white box around the target and potentially the distance between the two noted to the right of the box. Both, in turn, would suggest that this is in fact not even a drone strike; instead, it could very well be that the drone had a more observational role rather than a combat one. Given the success of the Ukrainian military’s use of drones, perhaps Russia felt the need to have a drone PR win of their own. Nevertheless, it is interesting to note the clear discrepancies between the two public videos we have of the drone.
Concluding remark
This case study demonstrates just how far one can go in order to rule out a claim. In this instance, we have locked down a precise location and rough time frame. In the event this video is repurposed for future claims, it will be much easier to identify it as a disinformation attempt.
It is also a perfect example of an investigation that could not reveal clarity on every question – something that can sadly be all-to-common. It is hard to understate the value of “negative verification” – the 99% of conclusions we can rule out – thus making that final 1% of information stronger.
As a methodology, open source approaches offer a low-barrier entry to conflict research and accountability investigations. They have their value in transparency and replicability – something which is resilient to scrutiny and can be improved or expanded upon with additional research.
If you have any comments or suggestions, feel free to get in touch on Twitter:
- Robin Taylor: @robintayloor
- Tom Jarvis: @tomtomjarvis
About the authors
Tom Jarvis is an OSINT analyst with an interest in geospatial data, conflict analysis, and human rights accountability. Tom leads the Tibet Research Project, an open source analysis project geolocating Tibetan prison and detention facilities.
Robin Taylor is an open-source investigator with experience in conflict and environmental analysis, and a side-interest in tracking ships. Robin leads the Tibet Research Project in collaboration with Tom, and is the founder of the Investigation Lab, a website about the practice of investigating in the public interest.
Credits and Licensing
This guide is authored by Tom Jarvis and Robin Taylor, edited and published by Tactical Tech's 'Exposing the Invisible' project team, and licensed under Creative Commons Attribution-ShareAlike 4.0 International license / CC BY-SA 4.0.
This content has been developed as part of the Collaborative and Investigative Journalism Initiative (CIJI) project co-funded by the European Commission under the Pilot Project: "Supporting investigative journalism and media freedom in the EU" (DG CONNECT).
This text reflects the authors' view and the Commission is not responsible for any use that may be made of the information it contains.