OSINT: "Brown Moses" & Bellingcat (merged thread)

[davidbfpo]

Moderator's Note

This thread today had two other related threads merged together. 'Brown Moses' work is the focus and is separate from a general open source intelligence thread (ends).


A true "armchair" expert, who from his home, has become a reputable source of information and intelligence, much of it visual - shown on YouTube. Profiled today in the New Yorker (behind a paywall), but the Huffington Post has a full article too:http://www.huffingtonpost.com/2013/1...?utm_hp_ref=tw

A little background:

From his living room, Higgins was racing to solve the same whodunit confronting world leaders amid claims that Assad had unleashed chemical weapons against rebel sympathizers in the suburbs of Damascus. Was Zamalka a victim of such an attack? If so, who was responsible for the deed?

On paper, Higgins -- a 34-year-old with a 2-year-old daughter -- brought no credentials for the job. He had no formal intelligence training or security clearance that gave him access to classified documents. He could not speak or read Arabic. He had never set foot in the Middle East...

Yes he has his critics and supporters - like this un-named CW expert:

I think Eliot has done a lot more for Syria than the U.N.

Twitter shows 13k followers and 56k Tweets.

OSINT in a different way:

When viewed in isolation, the micro-dispatches posted to Twitter, Facebook and YouTube tended to confuse and overwhelm anyone trying to make sense of events. But if you viewed such posts together, Higgins realized, the photos and videos could yield detailed accounts of events across the globe. The posts could be used to fact check claims, providing clues far beyond what cameramen had intended to show. Arguments could be won, myths disproved, rival commenters put in their place.

One wonders how OSINT and people like "Brown Moses" will fare when journalists and NGOs will have drones.

[AdamG]

That's extraordinarily well-written for HuffPo.

[davidbfpo]

A lengthy article from the Daily Telegraph, if you read the HuffPost piece possibly nothing new, but still of interest. A website is coming soon:

It is called bellingcat.com, and a stable of about 15 contributors will write on subjects including Africa and the Middle East; they are partnering with Uncoverage, a crowd-funding site for investigative journalists.

The extent of potential open source footage, first some context:

In 2007 Assad banned Facebook and YouTube, but after the current uprising began, in early 2011, and his grasp on the country started to weaken, he lifted the ban. The internet has since become a potent weapon for opponents of his regime.....After the Houla massacre Higgins realised that he could subscribe to every YouTube channel uploading footage from Syria, then aggregate the videos by region and organisation on his blog. He began by monitoring several dozen channels. Now he tracks 700.

Link:http://www.telegraph.co.uk/news/worl...-his-sofa.html

[Firn]

His results have certainly been very impressive. Some months ago I did watch some videos of that tragic and brutal civil war and was surprised by it's youtubezation. The flood of digital data over the net seems to have pushed the importance of that OSINT thing into new dimensions...

[davidbfpo]

A very short film clip as he speaks to a Google audience:http://www.marketingmagazine.co.uk/a...ter-ban-turkey

[Firn]

The flood of open-source data and information, reporting and propaganda streaming out of Eastern Ukraine did enable outsiders to get surprisingly quickly a good understanding or what might have happened. It does obviously not replace traditional or other means of gathering information to understand events but it does in many cases greatly aid them.



The geo-location of digital media like tweets, pictures, videos is greatly speeding up research and makes it far more accurate. Fascinating stuff. In this specific case the close links between Russian news outlets and Russian organizations in Eastern Ukraine and the Russian propaganda overdrive made many events quite visible. Girkins bragging about a downed aircraft, rebel boasting of Buk launchers, videos of said launchers, quick propaganda spread by Russia media and so forth all left leads pointing towards a highly likely chain of events.



Brown Moses is of course also involved.

In the great scheme of things OSINT will become increasingly important for all the interested actors.

[davidbfpo]

Earlier this week there was a conference on open sources, Investigathon, even Google participated, as did Brown Moses.

The Google PPT is huge and took a long time to download, IIRC 130 plus slides and it defeated my understanding:http://dmrussell.net/presentations/I...thon-final.pdf

This article follows MH17:http://gigaom.com/2014/07/18/want-to...you-can-do-it/

Brown Moses has started a new website, but you need to donate to get access:https://bellingcat.com/

[Firn]

Quite a presentation, I don't think I will work through that.

The amount of digital material flowing out of war zones through various by many entities is indeed vast and varied. Without getting into the technical aspects it is in my opinion key to look at the big picture. Lets take first into account the following global trends:

1) An ever increasing amount of objects able to capture various data*
2) An increasingly wide and deep capability of long-range communication
3) An ever increasing importance of social media and data sharing

Even if it a simplistic take those overall trends will provide a increasing detailed, rich and robust base for OSINT. There is no doubt that parties will try to opress and counteract when it isn't in their interest but this can only achieved partly. Interestingly propaganda videos and dispatches have in many occasions revealed informations which backfired or harmed the producer's cause.

It is clear that not only media but various services, likely led by the US, have long started to make use of the recent waves of OSINT. The US has of course the advantage that the data of the most important software companies is on home soil and that it is present in different forms almost worldwide. The Ukrainians have been clearly saving lots of stuff coming over the social media so that the deleting stuff wasn't quite successful. Some cases in the Donbas like the famous seperatist Buk with three missile moving east have also shown that it is difficult to understand from the outside where to draw the line between OSINT and 'normal' covert observation. Was it filmed by a civilian, agent or infiltrated soldier? If it was the former was it first posted on YT or sent to a Ukrainian civil group or directly to the government?

Lots of question but there is little doubt that we will see the importance of OSINT growing.


*Smartphones, CCTV, dash-board cameras, and normal ones have been used to cite a few.

[davidbfpo]

An interesting account of the open sources used to identify a photo of a mobile SAM-11 aka Buk:

In the wake of the tragic events of July 17th a number of photographs and videos were posted online claiming to show the Buk missile launcher that has been alleged to have been involved in the downing of flight MH17 in locations that were claimed to be near the crash site. Over the last 48 hours, using a variety of open source investigation techniques, it has been possible to identify the precise location some of these images were taken, confirming key claims about the location of the Buk missile launcher.

Link:https://www.kickstarter.com/projects...t/posts/919158

[Firn]

Open source and the MH17 shootdown links fine articles (some already posted) and has an interesting podcast with sometimes surprising background on some of the work. Overall good stuff.

Had also to laugh at how the trolls, in this 'Kremlin' ones, operated because it felt so familiar. Lie, busted, new lie, busted, new lie and so forth.

[davidbfpo]

Another example of OSINT, notably satellite photos and videos, can help to explain events. 'Brown Moses' helped too:

Today marks the first anniversary of one of the biggest air strikes that has been conducted inside Syria, and particularly in the country's third largest city's of Homs, on a strategic Syrian army arms depots. .....Many believed that the attack in Homs on Aug. 1st, 2013, was carried out by Syrian armed opposition groups, launching Grad rockets towards the strategic arms depots of the Syrian army, resulting in a massive explosion that rocked the entire city of Homs.

Today and after almost a year after that strike, a number of never released before satellite photos revealed for the first time that the target was not the arms depots, rather a secret underground chemical weapons storage facility south of Homs.

Link:http://www.businessinsider.com/israe...#ixzz398mH7FT0

Note this was a year ago today and citing in part the conclusion:

This incident also suggests that Israel targeted the Syrian chemical weapons program at least once before the August 21st Sarin attacks in Damascus.

[Firn]

Bellingcat, his website got now £48,388 pledged of the £47,000 goal. I was one of them. It is of course not an investment for any monetary return but a support for high quality open research.

[davidbfpo]

Bellingcat now offers open, public access - having raised funds - and in a case study (one of four) offers guidance on verifying film footage in:https://bellingcat.com/category/resources/case-studies/

[OUTLAW 09]

The Independent @Independent

A crowdfunded site may have just exposed Isis using Google Maps http://bit.ly/1qCJctb

Moderator adds: This website is partly founded by "Brown Moses", an open source SME and documented on a thread 'OSINT: "Brown Moses" better than the UN on Syria':http://council.smallwarsjournal.com/...ad.php?t=19471

[OUTLAW 09]

The UK blogger bellingcat who identified the IS training camp in Mosul via open source materials as well as working the open source location ID for the US journalist killing has been hit by a massive DDoS attack all day---this is interesting for two reasons 1) the IS did not believe open source could be so effective and 2) his work was also used in the MH17 open source materials.

So he has two groups angry at him that has the IT abilities of a DDoS---the IS and the FSB.


bellingcat @bellingcat

Bellingcat is still being DDoS'd by *someone*, if you don't know what a DDoS attack you can learn more here http://en.wikipedia.org/wiki/Denial-of-service_attack …

[AdamG]

A group of crowd-funded citizen journalists seem to have located a training camp for the militant group ISIL using only online mapping services and some old-fashioned detective work. Bellingcat, which raised almost £51,000 ($85,000) to do its own unique form of journalism, was founded by Eliot Higgins, who became famous (and was profiled by the New Yorker) for proving Syria was using chemical weapons from his bedroom in Leicester, England using only images and videos available online. His team includes a mix of bloggers, research analysts, and traditional reporters.

http://www.defenseone.com/technology...g-camps/92267/

[davidbfpo]

A twenty-five minute video, mainly PPT, which explains how Brown Moses works:https://bellingcat.com/resources/art...onflict-zones/

[davidbfpo]

'Brown Moses' aka Eliot Higgins has been working on the MH17 shoot down again, supplying help to the police investigation and the Australian version of 'Sixty Minutes'. The later's report is available via:http://www.9news.com.au/world/2015/0...uction-of-mh17

YouTube links found by Outlaw09 have been disabled due to copyright claims.

A short 4.5 minute interview with Eliot once more reveals how much can be found and verified from open source video:http://www.9jumpin.com.au/show/60min...4240894610001/

Note within the Ukraine: non-military thread are a number of posts on how the MH17 investigation has gone. Yes they are not easy to find, so this post has been added for reference.

[OUTLAW 09]

'Brown Moses' aka Eliot Higgins has been working on the MH17 shoot down again, supplying help to the police investigation and the Australian version of 'Sixty Minutes'. The later's report is available via:http://www.9news.com.au/world/2015/0...uction-of-mh17

YouTube links found by Outlaw09 have been disabled due to copyright claims.

A short 4.5 minute interview with Eliot once more reveals how much can be found and verified from open source video:http://www.9jumpin.com.au/show/60min...4240894610001/

Note within the Ukraine: non-military thread are a number of posts on how the MH17 investigation has gone. Yes they are not easy to find, so this post has been added for reference.

Next Phase in Bellingcat’s Ukraine Vehicle (Russian) Tracking Project via @bellingcat https://www.bellingcat.com/news/2015...cking-project/ …

[OUTLAW 09]

Social media open source analyst using a Russian mapping satellite actually confirms it was a Russian invasion not an incursion—maybe someone should let DoS and the White House know about this satellite imagery if the US IC does not have it.

Russian owned Yandex has been quite helpful to further expose the Russian invasion into Ukraine last summer... :P.

But Yandex also revelas this battery of D-30 heavy artillery a little bit more south.
https://maps.yandex.com/?ll=38.29919...19&l=sat%2Cskl … pic.twitter.com/lAw3IvxuHy

Like these MSTA-S reported by @JulianRoepcke
https://twitter.com/JulianRoepcke/st...43483592847361 … pic.twitter.com/kONJFCDXql

Yandex also shows a lot of Russian artillery positions at height of Komsomolske-Telmanove. pic.twitter.com/19trsHCgRz

Yandex still shows some military vehicles on that invasion route into Ukraine.
https://maps.yandex.com/?ll=38.82076...18&l=sat%2Cskl …
@JmmJhnsn pic.twitter.com/GgyyxDKvsE

Yandex shows where Russians massively crossed border to cut off Ukraine army at Saur Mogila
https://maps.yandex.com/?ll=38.81279...17&l=sat%2Cskl … pic.twitter.com/HUMVmnwdVu

It looks like Russian Hollywood produced another idiot video of OSCE dragging a dead Azov soldier behind their car. https://twitter.com/hellmuthcstuven/...16967540002817 …

Yandex reveals where Russians crossed the border to arm and supply their militia in Dmytrivka
https://maps.yandex.com/?ll=38.92793...19&l=sat%2Cskl … pic.twitter.com/wIcjIqzmNj

Yandex reveals yet another not seen before MLRS & artillery location from Russia into Ukraine
https://maps.yandex.com/?ll=38.91726...18&l=sat%2Cskl … pic.twitter.com/83vuX6Ygju

Some more (other kind of) vehicles can be seen nearby too:
https://maps.yandex.com/?ll=38.95734...19&l=sat%2Cskl … pic.twitter.com/20BZuYMY6I

UPDATE Now Yandex shows Russian BUK battery near Marynivka in its full glory #MH17http://ukraineatwar.blogspot.co.uk/2...images_20.html …
@finriswolf pic.twitter.com/d9J3S5w6LH