00:05 CNN clip: The silence in these fields is that of a tomb, like sorrow and loss have isolated it from the war around it.

00:13 Paul Brandus: CNN correspondent Nick Patton Walsh in July 2014 at the crash site of Malaysia Airlines Flight 17. The Boeing 777 was en route from Amsterdam to Kuala Lumpur when it was shot down over eastern Ukraine, killing all 298 passengers and crew. What happened?

00:35 *clip audio: Here's what we know so far. Evidence indicates that the plane was shot down by a surface-to-air missile that was launched from an area that is controlled by Russian-backed separatists inside of Ukraine. We also know that this is not the first time a plane has been shot down in eastern Ukraine.

00:56 Paul Brandus: President Barack Obama at a White House briefing. But who did it? There was plenty of intelligence, much of it was in the open and available for sleuths to piece together. Ultimately, the discovery of the truth was expedited by open source intelligence, OSINT for short. Open source intelligence is a critical way of helping not just governments, but the private sector form judgments about critical issues. In that regard, it can help differentiate truth from untruth, fact from fiction, and information from disinformation. I'm Paul Brandus, and that's the name of this podcast series, Disinformation, a co-production of Evergreen Podcasting and Emergent Risk International, a global risk advisory firm. Later in this episode, I'll be joined by one of ERI's intelligence analysts, Iman El-Banna. We have just shot down a plane, this Russian voice says, reportedly a member of a pro-Kremlin rebel group, the second voice said to be a colonel in the GRU, the Russian Military Intelligence Directorate, a man named Vasyl Mikhailovich Geranin. The tape was released by Ukraine's main security agency, the SBU, which said it intercepted phone calls between separatist forces and the Russian military intelligence officer. The conversation, which took place within 30 minutes of the shootdown, was also deemed authentic by the U.S. National Security Agency. But private sector investigators were also looking into the tragedy. One was a Dutch-based group named Bellingcat. Bellingcat is an investigative group that specializes in fact-checking and open-source intelligence. It was founded in 2014, a decade ago, by British citizen journalist Elliot Higgins and is based in Amsterdam. Higgins' interest in OSINT, again open-source intelligence, began in 2011 when he realized that it was possible to verify videos with satellite imagery. He quickly put this understanding to work by examining video footage from the civil war in Syria and concluding that the Syrian government, then as now headed by Bashar al-Assad, was using cluster munitions and chemical weapons against its own people. His skills soon proved helpful in unraveling the mystery of Flight 17 as well. Here's Higgins explaining at a conference put on by the Atlantic Council's Digital Forensic Research Lab.

03:59 Elliot Higgins: Moments after MA-17 was shot down, we immediately had this surge on social media of people finding information, sharing it. A lot of it was rubbish, but we needed to figure out what was good information and what wasn't. So one of the first things we started seeing are photographs and videos of a Buk missile launcher being transported on a truck. and over the weeks and months that followed, more images appeared. And from that, we could actually build up a route of where this missile launcher had been. So, what we have here is the first photograph that was taken of the missile launcher on the day. But how do we know that's the case? Well, there's various interesting things in this image. For example, the phone number that's visible here. Now, As all good open source investigators should do, as soon as you see a number on something that's interesting, type it into the internet and see what happens. And in this case, we came across this website. And this is for a vehicle yard, a rental firm that's in the city of Donetsk, which was separatist controlled at the time. And we know that because we have this, which gives us the full address, and we're actually able to find that place on Google Earth. And we can zoom into the exact location. we can see the vehicle yard and what we can even do is go to the street view imagery and see the phone number on the building outside and we can see that it matches to the vehicle and confirm it's the phone number from that vehicle yard. So we can already see there's a very strong chance that this is somehow related to each other.

05:31 Paul Brandus: So from one scrap of information, a phone number, Bell and Katz digital detectives were able to determine the possible location of a possible missile launcher. That wasn't proof of anything, not yet, but it was a good starting point. Higgins then showed another video of a truck transporting what looked to be a large piece of military equipment.

05:56 Elliot Higgins: So, this one was a lot easier to geolocate, because the person who posted it online also gave us the full coordinates of where it was posted. The problem was, we don't just trust stuff because it's on the internet. But again, it's a string of numbers, so we chuck that into the internet, see what comes up, and it gives us this location, in a town called Zores, which is east of Donetsk. Now, we want to verify this, so what we're able to do, start comparing the various things. Now, we can do the old coloured boxes on items that we do with geolocation. So, we have this structure on top of one of the buildings we can see. We can also see this structure on the ground. We can see the shadow being cast by this post, for example. The paths are the same. There's all these details that allow us to match it quite easily and quickly. So, we've established two locations. So, now what we're going to do is move back to the vehicle yard we were in at Dinesk. And this time what someone did is they decided they would automatically calculate the route between this location and the next location and then switch to street view. And then what he did is he pointed the camera down the road and started virtually driving down it to see if he could find a match for the photograph.

07:15 Paul Brandus: Note that Higgins mentioned things like satellite imagery, street views, roadmaps. These are all resources available to anyone with a computer.

07:24 Elliot Higgins: incredible resources right at your fingertips he continued and eventually that person did and i'm extremely glad to say that wasn't me um but it was an area just east of the vehicle yard and what was interesting here is this these signs because we could start taking these signs and comparing the details and the structures that were visible so straight away we could start seeing things that matched in the image, and we started matching them off. So again, we whip out the colour boxes, we can see that's a match, that's a match, and this is a match. But there was one thing that made it very clear it was the same location. And it was the branches and the leaves in the background, which were almost identical. And if you look really carefully, and you look at every individual branch as I did, and every little twig, you can actually see they're all in the same position. So we can be certain this is the same location.

08:23 Paul Brandus: At this point Higgins brought in a colleague Eric Toller who again zeroed in on that imagery and what it revealed.

08:32 Eric Toller: You saw this picture earlier with the table game with the first geolocation table game so this will be a little bit familiar to you. So, right here you see the Buk missile launcher again. We made this journey from Donetsk that morning, then it went through Zagreb, and now it's in Taraz, in the city in eastern Ukraine. Here it is, the Buk missile launcher that shot down MH-17, landed the truck with the phone number on the side. And you remember the jeep, that's important later on, so keep that file out of the way for about 15 minutes from now. Followed by a US 469 jeep. And so where is this located? When this first came out, it was reported that it was in Snezhnoe or Snezhnyan in Ukraine, which is a town actually about five kilometers east of Torez.

09:17 Paul Brandus: Toler noted, and this is important for investigators using OSINT tools, that it can take time to put clues together. But like anything, experience and familiarity with the tools and so forth can accelerate the process. Obviously important for any analyst. Of course, street views and whatnot may be more robust in some parts of the world than others. In eastern Ukraine, Toller noted that it can be a tad problematic, including the village of Terez, central to the Flight 17 probe.

09:51 Eric Toller: There's no Google Street View or Yandex Street View for Terez. But, we have the next best thing. If you go on to YouTube, there's a whole bunch of Russians and Ukrainians, almost always Russians and Ukrainians, who have the registrator, the dashcam video, right? So these dashcam videos you see bears across the street, comets in the air, meteorites, right? And also, you have kind of your own personal Google Street View for each town and village in Russia and Ukraine. So a lot of these places don't have coverage in Google Maps or Yandex. Street View. But you do have a bunch of people, even with a timestamp, right? This is in 2012. You can see over time how these places change. So you have the next best thing, you have live videos that are on YouTube. Just type in the city, maybe the address you're looking for, and you can find all these people have uploaded these videos. They've been driving around town, they even list in super detail the route they take, sometimes they drive between towns, it's three, four hours long videos. It's just as good as Google's review.

10:46 Paul Brandus: So YouTube, an amazing resource, again, open intelligence available to anyone. Of course, all of this visual data can then be used in combination with social media, for example, Twitter or X as it's now officially called. to bring an analyst even closer to the truth, especially when the analyst uses another tool, this one called SunCalc.

11:11 Eric Toller: With this you can put in the day that the photo was taken and it could figure out the azimuth of the angle of the sun with all the historical data and astronomical data. And if you put the approximate direction that a key shadow was cast at the time, you can find out, not to the minute, but within 15-30 minutes when the photo was taken. So if we had seen this video right here, if it would actually have been taken at 5 p.m. or at 8 a.m., it does not fit our timeline because the Buk was in Donetsk around 9, 10 a.m. and it fired the missile around 4, at 4, 20 p.m. So if this was at 5 p.m. or 8 a.m., it throws everything out the window because it means this photo is old or some information we know is wrong. But if it's the timeline perfectly, this is exactly the same time. This is around 12, 12, 12, 15, which is when a lot of reports coming in from Twitter of locals in Torres were talking about this book going down that exact street that we saw. So it's not just one piece of information. We triangulate from different pieces of information.

12:07 Paul Brandus: So phone numbers, YouTube videos, roadmaps, social media, the wonders of modern technology combined with Mother Nature, the casting of sun and shadow, helped Bellingcat determine when and from where the anti-aircraft missile that knocked Flight 17 out of the sky was fired. But let's return to Elliot Higgins now, who says there's still more to be told, and thanks to videos, more to see.

12:35 Elliot Higgins: There were other things we were discovering as well. Once we found these videos and photographs of this path, we started digging through social media for people who'd seen it and posted about it. Because there's a big difference between, say, Ukraine and Syria. In Syrian opposition-held areas, you have very restricted internet. In Ukraine, people are just posting all sorts of rubbish. So you have to sort through that rubbish. and you find posts like this. So this is a translation of a post. This, as far as we figured out, I believe is the first sighting of that missile launcher. And it's describing that missile launcher coming down a highway into Donetsk before it leaves. And it's in a convoy. It has a convoy with a RAV4 camouflage UAZ, which is kind of a military vehicle, which you saw in the photograph earlier, and a blue van. They get the make wrong. And we know that because we actually had another video appear I think around two years later of the missile launcher in a convoy. And this is very interesting because straight away you can see the vehicles described in the convoy, you can see the missile launcher again, you can see the UAZ behind it, and the van. Now, we wanted to verify where this was taken and what time it was taken, and a minor miracle occurred. First of all, one thing we discovered as we were searching through all the videos of convoys is that the same exact vehicles were in a separate convoy two days earlier. So we knew they were in the area, we knew these number plates were the same and all the other details, but how do you know if this video was actually taken on July 17th? Well there's a petrol station in the video and what you can do is go to the petrol station's website and there's these websites that archive web pages.

14:15 Paul Brandus: And by looking at those gas station archives you can find out what gas prices were on such and such a date thus making it easier to date the video showing the missile launcher on the truck. Again, this process obviously is far from easy. Like any puzzle, there are lots of pieces and it's the analyst's job to methodically put them together. Let's take a short break here. When we come back, I'll talk with a longtime intelligence analyst at Emergent Risk International who is well-versed in the craft of open source intelligence.

14:54 clip audio: This series on disinformation is a co-production of Evergreen Podcasts and Emergent Risk International, a global risk advisory firm. Emergent Risk International. We build intelligent solutions that find opportunities in a world of risk.

15:15 Paul Brandus: Welcome back. This is the first in a two part series on open source intelligence or OSINT. We just heard the amazing story of how Bellingcat, the Dutch-based investigative group that specializes in fact-checking and open-source intelligence, helped learn the truth about the downing of a civilian airliner a decade ago. But the underlying tools of OSINT, that's the point. Let's continue the conversation now with Iman Albana. She's Director of Customer Success at Emergent Risk International, but also a nine-year intelligence analyst and frequent user of OSINT tools. OSINT has emerged as a really powerful tool as you know, for gathering data from publicly available sources. In your opinion, though, are companies and decision makers taking full advantage of this?

16:11 Iman Albana: I do think companies and decision makers are taking more and more advantage of OSINT, especially just because of the sheer volume of publicly available information. You almost can't function without some level of OSINT. We all actually use OSINT, and we probably don't realize it, but OSINT is really just any of the publicly available information, but it's about using it in an effective way to kind of sift through that information and gain valuable insight. So I do think companies, especially those with well-staffed and invested intelligence teams, whether it's for security purposes, but also importantly for business and market sentiment purposes, you have to have fully capable intelligence functions to do business. And I think a lot of corporations are very aware of that and are investing in those, although I'm sure there are some gaps, of course, when it comes to utilizing OSINT.

17:15 Paul Brandus: Is there any kind of correlation between companies that use OSINT that are aware of the benefits it has and say things like a shareholder returns or a market cap or that kind of thing, company profitability or just avoidance of errors and pitfalls. Is there any correlation between the use of that and those things?

17:42 Iman Albana: I think there is, you know, those that do OSINT effectively. So trying to kind of, you know, focus on the information that's going to gain valuable insights, being able to, you know, work with social media and understand your brand and the changing sentiment around it and how that affects profitability, that's all crucial. And I think companies pay attention to it a lot on the business side, especially companies that perform well. From the intelligence community perspective, OSINT is often thought or in terms of security. So thinking about intelligence to identify threats. That's often where you see talk of OSINT, which is extremely important. Of course, companies want to be able to get ahead of any potential threats to them, protect their people and assets, their executives and all of that. And OSINT is absolutely crucial to doing that. But there's a lot from corporate intelligence teams in the use of OSINT that can go beyond just addressing the risks, but even turning that intelligence into opportunities as well and focusing not just on the risk, but the opportunity, which I think is crucial for companies. They do it. It's just a matter of understanding that, you know, this is what OSINT is and how they can do so effectively in sharing tools, whether it's using OSINT for security and risk assessments versus using it for, you know, more market and business driven, profit driven decisions, which is what your company shareholders are going to care more about.

19:22 Paul Brandus: Just because you have open source intelligence. How do you know whether it's true or not? It's open source doesn't necessarily mean it's true. How do you verify data and information that you acquire through these open sources?

19:41 Iman Albana: Right. So that's kind of the craft of the intelligence part is trying to use open sources to verify information. So really, it's just a form of research using these publicly available sources that can help individuals kind of understand a piece of information or data better. There's just so much information available and you can use public sources, whether it's social media or official websites, mass media, to try and triangulate, verify certain claims. It can be a challenge sometimes navigating the different webs of information, but that's the craft of OSINT, taking advantage of that information at your fingertips to valuable insights and turn it into intelligence. Definitely difficult in this day and age with all the disinformation that's out there, but there are ways that people that are really good at OSINT can go and find the original source of a claim, decide whether it's verified or not, and work with that information from there.

20:44 Paul Brandus: There are various types of OSINT out there. Could you take just a couple of these, offer listeners who might not be up to speed on some of these things, just a very brief explanation, if you can. The first one is, and I think you alluded to this, is social media intelligence, SOCMINT, I guess, S-O-C-M-I-N-T. But what is social media intelligence?

21:07 Iman Albana: So social media intelligence is basically just the collection and analysis of information from social media platforms. Of course, your traditional social media platforms that you might think of like Facebook or X or formerly Twitter, Instagram, but even also there's so many new types of social media platforms. run the range, but basically just using those platforms to find information and gain intelligence that can help decision makers. I would say with the sort of explosion of social media in the past decade, it's become a crucial component of OSINT more broadly. That's probably the most popular form of OSINT that you can think of. And through conducting social media intelligence, you can, you know, target specific individuals, groups, events, or, you know, just the information that's out there to gain insights. You know, a lot of companies, like I said, in the Intel world, you might think of it as, you know, looking for, you know, people that are threatening your company or your executive and going after it. But, you know, market people use social media intelligence all the time to, you know, measure trends, sentiment for a company, its products, very specific things. But yeah, social media intelligence is crucial for companies. It, like I said, can help them identify threats or changes in sentiment, identify both risks and opportunities just because so many people are using social media, posting information out there. There are some challenges when it comes to privacy, for example, and most social media platforms have those options where some are private, some are not. There can be some ethical challenges, for example, in taking advantage if you've got access to accounts. We've seen some people get into trouble for posing as certain people on social media when that violates a social media platform's rules, for example. But yeah, there's lots of interesting things when it comes to social media intelligence.

23:24 Paul Brandus: And you mentioned a minute ago the challenge of triangulation, trying to just confirm things. Social media, I think, as most people are aware, can be a source of all kinds of things that simply aren't true. And obviously, it would be rather foolhardy, I think, to simply take at face value something that you see on a social media platform. If you saw something on a social media platform, you mentioned X or Facebook, the usual, the big ones that most people know. The triangulation, of course, would be vital. If you saw something on X or Facebook, where would you go beyond that to verify? What would you do if you saw something that was interesting, but you weren't quite sure and you wanted to be sure?

24:16 Iman Albana: Right, if you're trying to kind of confirm something you see on social media and you absolutely should, it is wholly dependent firstly on who's posting it. The interesting thing is there are so many more official channels. So whether it comes to certain ministries or ministers and government officials, a lot of them are using social media constantly. And sometimes that's the only place they're posting information. Even, for example, local police departments, emergency management, in times of crisis, a lot of the times they're only solely posting from social media accounts. So the first thing is to understand who's posting the information, because sometimes it might actually be from an official source. Obviously, Twitter has gotten into some, or X now, has gotten into some issues with the way they verify accounts. It was originally actually pretty trustworthy, reliable the way that they do the process. It's a pretty stringent or somewhat stringent betting process. Nowadays, people can purchase those little blue checks. So that makes the challenge a lot it makes it a lot more challenging to kind of understand who's who on social media accounts. Other than that, there's often the turn to traditional media and understanding if some of these major media organizations or press groups, local sources as well, if they are also reporting on the same thing or if they're able to verify social media claims. But a lot of the time, you know, things are said on social media, there's no verification. And a lot of the times it's disinformation, misinformation, or just, you know, flat out false. So it's a difficult, um, area to navigate but there are both pros and cons to it and i think it's something the intelligence part is crucial so yes there's lots of information on social media but being able to intelligently sift through it and decide what is an actionable sort of thing to flag to your decision maker is really important.

26:27 Paul Brandus: Another one that is important that folks might not know as much about is geospatial intelligence. Now, in the old days, by old, I mean 15, 20 years ago, geospatial intelligence would be something that was essentially the domain of the federal government, something at the national government level. But these days, anybody can access satellite imagery and that kind of thing. So within the parameter of OSINT, tell me about the geospatial intelligence.

27:04 Iman Albana: Yeah, so geospatial intelligence, like you alluded to, it's based off of sort of images, maps, location-related data. So there's lots that can be revealed through that, especially, you know, satellite imagery. Obviously, like you mentioned, it's been a long time crucial thing for militaries, traditional intelligence agencies who have historically had the best access, I would say, to that type of imagery. But now with the expansion of commercial satellite imagery, I think it's made that more accessible to just about anyone, although there are still some limits. And I'm sure governments have better access to quality and updated satellite imagery. I think thinking about geospatial intelligence, one example that comes to mind is, of course, Russia-Ukraine. I think there was circulation of satellite imagery of Russian troops heading towards the border prior to the invasion, I think, some analysts pointing according to changes in Russia's behavior and using satellite imagery to do that. It's also been crucial. You can see people looking at the aftermath of certain drone strikes or whatnot. It's not coming from official sources, but even just analysts on the internet or Bellingcat is a really good example of a site that they do a lot of really interesting OSINT work and they use geospatial intelligence to do it where they'll kind of help confirm attack claims or assess the aftermath of a certain attack. There's a lot happening in the OSINT space when it comes to geospatial intelligence specifically. Another example I saw actually circulating recently is there's this, it's not something I've been able to verify, but there's this satellite image of a site in Mongolia actually that resembles Taiwan's presidential office. And some analysts are linking it to maybe it's signs of China's preparations for a possible invasion of Taiwan someday. you know, they're taking that one image, you know, comparing it to satellite imagery of Taiwan's presidential office and trying to kind of gain some insights over what China might be planning, which is interesting.

29:33 Paul Brandus: Interesting. Another OSINT source these days is blockchain intelligence. I think folks have a basic understanding of what the blockchain is, but with regard to OSINT, tell me how that might work.

29:50 Iman Albana: Blockchain intelligence is a little more complex. And for those that are more familiar with blockchain, it's more accessible. I think it's linked to financial intelligence as well. So trying to understand kind of, you know, financial intelligence is traditionally looking at basically financial transactions and sifting through for insights often used by, you know, banks and governments. law enforcement to track financial crimes such as money laundering or tax evasion, for example. But when it comes to blockchain intelligence, that's becoming more important as we see criminals, for example, turning to cryptocurrency and these digital currencies to get away from the traditional financial transactions that are more easily tracked. So using blockchain intelligence, that's the way you can kind of see the log of cryptocurrency transactions. And so it's a complex process, but those that are able to do it can actually trace back certain financial transactions. One example, I think Israel and the US have done this with Hamas, the Gaza-based militant group, looking at some cryptocurrency transactions made to them. Showing that they've taken advantage, they're a heavily sanctioned group because they're designated as a terrorist organization by the US, UK and others. So to get away from those traditional sanctions, they're taking advantage of cryptocurrency and they're not the only ones. But intelligence analysts trying to find this activity have to look through blockchain ledgers to try and figure out where these digital currencies are moving and who they're getting into the hands of.

31:43 Paul Brandus: What other OSINT tools would you like to see? We've touched upon a couple. There are others. web intelligence, financial intelligence, which you just alluded to with the discussion of blockchain. But are there any other tools out there, even other areas that you would like to see that would be useful to an OSINT analyst?

32:06 Iman Albana: Yeah, I think one space to watch, of course, is artificial intelligence, AI. We keep hearing a lot about it and how much it can improve the effectiveness of certain processes, automate things for us. And that's going to be, I think, crucial to OSINT. There are actually a lot of existing AI-linked, AI-powered OSINT tools that are popping up. One that we've actually used and kind of partnered with is this company called Pyra Technologies. They're doing a lot of really useful things around the US elections, but specifically they have an AI tool that identifies and tracks threats across social media. And they have this specific tool to track trends on election narratives, and they're using unmoderated social media platforms. So it helps because for people conducting OSINT that want to get into some of these platforms that, you know, some of them are, there are risks, of course, interacting with people, especially that might be, you know, pose a threat to your organization and or might require you to identify yourself. So to have tools like that, that take that burden away, that helps. But this one, they can specifically use AI to identify narratives. So one that was circulating, of course, is with the TikTok ban or proposed TikTok ban from Congress. Some are trying to say that it's an attempt to influence the US elections. And there's arguments on both sides that it's going to benefit Republicans, that it's going to benefit Democrats, or this idea that TikTok is an anti-government space and the government's coming in to ban a platform that lets people criticize the US government. Some of these narratives are circulating widely. And, you know, from Pyre's tool, that can help organizations point to a specific threat or, you know, understand like, you know, if people are getting that upset about technology platforms ahead of the elections, you know, if that means that they might target some in other ways down the line. But I think that example of using AI to sift through that and taking kind of the burden off of human moderators, because there's just too much out there for people to sift through, but having a tool that can do that for you. And there's other tools out there that can do that.

34:31 Paul Brandus: Another good tool, by the way, is data miners. So faster verification obviously has tremendous market value attached to it. I think one thing that I also wanted to ask, some of the potential pitfalls or risks of the private sectors over reliance or perhaps simply reliance on OSINT, tell me about some of the potential risks or pitfalls that could be associated with that.

35:02 Iman Albana: I think the biggest thing about dealing with OSINT is just that risk of being susceptible to disinformation and misinformation. It's really hard sometimes to verify things. And with OSINT, it's done very quickly. There's so much information out there. Often you're sifting through social media posts and things and trying to decide whether something is a real threat or of real importance to your organization can be difficult. But when you're using those types of platforms all the time, you know, you can easily, you know, try to go down the road of using something that was actually misinformation or disinformation. So I think being exposed to that is important, especially as we see the other the dark side of A.I. when we're seeing AI powered disinformation campaigns being circulated widely. So maybe your traditional verification processes, you see something on social media, you go to a new site to try and verify. These tools have already posted it on every possible channel. And so you might see that information and think it's real because you've seen it in multiple sources. But in the end, this is just a very sophisticated disinformation campaign. And we've seen actually even nation states like Iran, for example, organize those and do it really well and have a lot of reach, not just in their area, but in the U.S. even. So something to watch.

36:38 Paul Brandus: Open source intelligence is such a big topic. In our next episode, we'll get some additional insight from Bellingcat's chief operating officer, and we'll hear from emergent risk intelligence analysts. Noemi Maciero. My thanks to Iman Albano, sound from CNN and the Atlantic Council's Digital Forensic Research Lab. Our sound designer and editor, Noah Foutz. Audio engineer, Nathan Corson. Executive producers, Michael Deoloia and Gerardo Orlando. And on behalf of Meredith Wilson, the CEO of Emergent Risk International, I'm Paul Brandus. Thanks so much for listening.