Lena, a corporate executive living in Germany, left her native Ukraine in the 1990s but stays in regular contact with her extended family there. When Russia struck the family’s town soon after the invasion started, they sent Lena photos of bomb damage. Around the same time, she was searching for news about the war on social media when she came across an appeal by Ben Strick, an open-source investigator, for images to geolocate. She sent him one picture, and then more. “After three or four images, he offered me to join the team on a voluntary basis,” she says. “So I did.”
Today, Lena spends three hours a day of her spare time working with Strick’s team at the Center for Information Resilience, a U.K.-based nonprofit dedicated to countering misinformation, part of a worldwide community of open-source intelligence (OSINT) researchers studying the war in Ukraine. Like the rest of the world, the team has been shaken by the images from Bucha, where Russian forces are accused of executing civilians and torturing Ukrainian soldiers. For the past week, Lena and her colleagues have contributed to a collective effort to identify and locate the perpetrators — a task that’s especially relevant to Lena because her family members are currently living under Russian occupation as Bucha’s residents were. “Right now, it’s pretty peaceful where they live, but I don’t think it will stay that way. The fights will come,” she says. (Out of concern for their safety, she asked me to change her name.)
The team started working on Bucha by using software to locate media that had been created within a certain radius of the city. “Sometimes you don’t know what you are looking for in the beginning. You just look at the information and absorb,” Lena explains. “And then maybe after two hours or maybe another day, you get an idea that could lead to the solution.”
In addition to her native Russian and Ukrainian, Lena also speaks English and German, so she’s the team’s go-to for transcribing and translating videos. One item that caught her attention was an audio clip that an anonymous user had edited onto a video and posted on YouTube with the tag “Bucha.” It seemed to be a recording of an intercepted phone call between a Russian soldier and a relative back home. The soldier describes looting a village and mentions that the regimental commander, Colonel Zakharov, was killed the day before. Searching online, the team came across a notice by Ukrainian military intelligence reporting that Zakharov, the commander of Russia’s 6th Tank Regiment, had been killed in battle. The location wasn’t Bucha, though, but a town called Brovary some 25 miles to the east. They’d hit a dead end.
Meanwhile, a Ukrainian OSINT organization called InformNapalm was also on the case. A lively and freewheeling community mostly active on Telegram, the group has the manpower to sift through vast quantities of material online. In the past, its members had dug up social-media postings that helped Bellingcat, the granddaddy of OSINT collectives, identify Russian officers involved in the 2014 shoot-down of Malaysia Airlines Flight 17. Four of those men are currently on trial in absentia in the Netherlands.
These days, there’s not much of that kind of information available anymore. “Before MH-17, there were soldiers everywhere posting on VK, taking selfies and videos on TikTok and everything,” says Strick of the Center for Information Resilience, referring to the Russian social-media site. “But after Bellingcat outed them for MH-17, the Russians introduced a policy of no social-media use in the military, and it’s actually pretty effective because we’re barely seeing any footage coming out filmed by soldiers.”
That’s not to say that Russia’s operational security is exactly tight. As society becomes ever more digital, all sorts of new resources keep emerging. For instance, John Deere tractors these days come equipped with geolocation and wireless networking. That’s great for helping farmers log which fields they’ve worked. It also lets Ukrainian farmers track machines that have been stolen by the military and transported across Russia.
Another new source of data: obituaries. Since the war started, memorial notices appearing on social media have sometimes revealed surprising amounts of military information. On VK.com, InformNapalm volunteers found an obituary for a certain Corporal Pavel Grigoryevich Lukyanov that revealed he served in the 5th Guards Tank Division and died on March 13. The site of his death: Bucha.
Another unit identified as being active in Bucha was the 64th Separate Motorized Rifle Brigade, a unit normally garrisoned in the far eastern city of Khabarovsk. “Soon all these murderers, rapists and looters will be known by name,” InformNapalm wrote on April 3 alongside photographs of unit members apparently taken before the start of the war.
One member of the unit, however, has been publicly identified so far, thanks to InformNapalm: Lieutenant Colonel Azatbek Asanbekovich Omurbekov. In November, he was blessed by the Russian Orthodox bishop of Khabarovsk before he deployed. After the ceremony, Omurbekov declared, “History shows that in most of our battles we fight with the soul. Weapons are not the most important thing.” At this point, it’s hard to say if the identification is accurate, since InformNapalm hasn’t yet revealed its methodology. (The group hasn’t responded to inquiries.) The name doesn’t appear on a list of the unit’s personnel released by Ukrainian military intelligence on April 4, but there might be a good reason for that — that roster appears to date from 2018, before Omurbekov joined the unit.
InformNapalm is fast and creative but occasionally colors outside the lines. Other OSINT practitioners have different aims and take different approaches. Human Rights Watch, for instance, is all about establishing the veracity of what has happened on the ground. “We’re in a situation where there’s so much information and so much content, it’s crucial in terms of potential future justice and accountability mechanisms that we are documenting everything rigorously,” says Sam Dubberley, the head of HRW’s Digital Investigations Lab. “We’re super cautious about what we publish. We can’t afford to be wrong.” To that end, his team is documenting everything to a set of standards called the Berkeley Protocol, which was developed to verify social media so that it could meet the evidentiary standards of courts of law.
Now that the Russians have been driven from Ukraine’s north, including Bucha, OSINT techniques can be supplemented by more traditional gumshoe detective work. Ukrainian authorities are treating it as a crime scene, removing corpses and sifting for evidence, and HRW has a team there as well. “We work really closely with our team on the ground,” says Dubberley. “We’re constantly relaying information.”
Fred Abrahams, who supervises HRW’s crisis and conflict team, says the process is complicated by the fact that what happened in Bucha wasn’t a single incident but a monthlong occupation during which a series of separate events unfolded. Not every corpse lying on the street is necessarily a murder victim. “Some people were killed in fighting, some people died of natural causes. We found that in one case a woman who was on a respirator for health reasons, the electricity went out and she died. Other people were captured and executed with their hands bound,” says Abrahams. HRW’s goal is not to develop a case for prosecution but to bring public attention to the atrocities — “The name and shame playbook,” as he puts it — and to provide accountability by documenting what Russian soldiers have done.
Still, if Bucha crimes do wind up being tried in a court of international justice, HRW’s information could well prove useful. In the late 1990s, Abrahams was HRW’s lead researcher for the war in Kosovo and testified at the international war crimes trial of former Yugoslavian president Slobodan Milošević. That case only came about because Milošević had fallen from power and his successor extradited him to the Hague. As it was, the case dragged on for five years and would certainly have gone on longer had Milošević not dropped dead of a heart attack in his cell.
The implication is that few Russians are likely to face justice for what happened in Bucha unless, at a minimum, Vladimir Putin is ousted. Even if he is, there’s no guarantee that his successor will be interested in turning over Russian soldiers to face justice abroad.
For her part, Lena says that she is under no illusions, either about the cruelty that Russian soldiers are committing in Ukraine or the amount of reckoning that they someday may face. “Coming from this culture, it’s not a surprise to me, honestly speaking. We will see much more horrific scenes in the coming days, I am sure of it,” she says.
For now, given her skills and the opportunity to use them, she doesn’t see any other option than to apply them as best she can and hope for the best. “It’s not that I’m doing something that will lead directly to justice, but maybe in eight or ten years, there will be justice,” she says.
This article originally ran in New York magazine on April 8, 2022.