Start your day with intelligence. Get The OODA Daily Pulse.
SIGINT (Signals Intelligence) and OSINT (Open Source Intelligence) are entering a new position within the public sphere in 2019. Watershed events in 2018 have finalized a long, slow transition from the monopoly of shadowy intelligence agencies and the occasional investigative journalist into a space fully accessible and contestable by anybody with an internet connection. An analysis of a case from 2018 highlights some of the emerging characteristics and actors.
Soldiers in uniform lead two women and two young children along a dusty footpath. They are blindfolded, instructed to kneel, and then riddled with bullets as onlookers gape and the soldiers jeer. A cell phone video containing this scene went viral on social media pages across West Africa and beyond this summer. Different versions accused soldiers from several Sahel countries, all succeeding in causing outrage against the accused.
The video lent itself to multiple interpretations. As soon as it became the cause of public outrage in Cameroon, the government dismissed it as fake news or as having originated elsewhere in the Sahel. The nondescript landscape, the lack of unique markers on the faded uniforms of the soldiers, and the poor audio quality of the video strengthened both the deniability and the power of framing statements.
The video footage, viewed by unknown thousands from West Africa to Washington DC and beyond, is clear enough. Removing the most graphic footage, the team published their OSINT journey in tracking down the actors behind the killings.
This is the video that went viral. We’ve cut out the ending, but – WARNING – it’s distressing. pic.twitter.com/6JJrdJqurW
— BBC News Africa (@BBCAfrica) September 24, 2018
In July, the Cameroonian govt dismissed the allegations as “Fake News.”
They claimed the guns were not those carried by the Cameroonian military.
They said the camouflage pattern was not used in the Far North.
They asked why the soldiers were not wearing full combat gear. pic.twitter.com/4peZmjISCY
— BBC News Africa (@BBCAfrica) September 24, 2018
After a tip off from a Cameroonian source, we found an exact match for that ridge line on Google Earth pic.twitter.com/niJoH9w3nX
— BBC News Africa (@BBCAfrica) September 24, 2018
Once we had the general location, we looked at other details in the film – tracks, buildings, trees – and matched them precisely to features visible on satellite imagery. pic.twitter.com/IzKuyKzao8
— BBC News Africa (@BBCAfrica) September 24, 2018
When did this happen?
Again, the video contains clues.
This building is visible in the video. But satellite imagery reveals that, back in November 2014, the walls around it had not yet been built.
The killing happened after November 2014. pic.twitter.com/XODYqL5LRY
— BBC News Africa (@BBCAfrica) September 24, 2018
We know that the murders took place in the hot, dry season, because this footpath – just visible in the video – only appears on the satellite imagery between January and April.
That makes it probable that we’re looking at early 2015 pic.twitter.com/Uotw9w25mY
— BBC News Africa (@BBCAfrica) September 24, 2018
We know where. We know when.
But who are the men who killed these women and children?
We’ll start by establishing that these are members of the Cameroonian military. pic.twitter.com/SqyL9yOPQf
— BBC News Africa (@BBCAfrica) September 24, 2018
The govt also claimed that Cameroonian soldiers in the Far North wear pale, desert-style fatigues, not the darker, forest-style camouflage seen in the video.
But we found these images on Facebook – tagged to Zelevet – of soldiers wearing the type of camouflage seen in the video pic.twitter.com/ROVP1q6tcZ
— BBC News Africa (@BBCAfrica) September 24, 2018
We know this is a combat outpost because we found a @Channel4News report that was filmed here in 2015 – and we matched the features visible in that report to the details we see on satellite imagery. pic.twitter.com/nmtD8cm0Ag
— BBC News Africa (@BBCAfrica) September 24, 2018
We have identified three men who actually pulled the trigger.
One of them is this man, introduced in the video as “Tchotcho” pic.twitter.com/lBtnhmlpNt
— BBC News Africa (@BBCAfrica) September 24, 2018
The BBC also spoke with a former Cameroonian soldier, who asked not to be named.
He confirmed that this is ‘Tchotcho’ Cyrique Bityala pic.twitter.com/vBqkD3ZsiD
— BBC News Africa (@BBCAfrica) September 24, 2018
We identified two other guns used in the killing.
One of the was in the hands of this man. We see him here blindfolding the women with the baby just before the shooting starts.
Our military source identified him as Barnabas ‘Gonorso’. pic.twitter.com/ofOdRpOwI7
— BBC News Africa (@BBCAfrica) September 24, 2018
The other gun used in the killing is the Zastava M21 we saw earlier.
It’s in the hands of a man identified in the video as “Cobra.”
Who is Cobra? pic.twitter.com/mvWRoPvBbQ
— BBC News Africa (@BBCAfrica) September 24, 2018
The name Tsanga also appears on the government’s list of soldiers now under investigation, suggesting that “Cobra” is a nickname for Lance Corporal Tsanga. pic.twitter.com/vVMz2YoJH5
— BBC News Africa (@BBCAfrica) September 24, 2018
The government statement makes clear that all these men enjoy the presumption of innocence, and that they will be given a fair trial. pic.twitter.com/sFWnE4hmio
— BBC News Africa (@BBCAfrica) September 24, 2018
The two women killed outside Zelevet received no trial at all.
No presumption of innocence was extended to the children who died with them. pic.twitter.com/WG7SFjQ9ml
— BBC News Africa (@BBCAfrica) September 24, 2018
The heroics of the investigation aside, the process of the entire event cycle, from the atrocity to the eventual conclusion of the legal proceedings and sentencing, suggests a number of takeaways for 2019. These takeaways are both opportunities and problems. In the words of OODA Founder Matt Devost, however, these problems may just be “opportunities with a different risk profile.”
The BBC Africa investigation highlights the incredible power and depth available to the open source researcher. From satellite imagery to massive searchable databases of obscure information, individual OSINT researchers can access what was previously only accessible to governments. Armies of these researchers, often simply hobbyists with no substantial technical or coding knowledge, are sharing tools through online forums and advancing the field at a startlingly fast pace. Within its various forums, one sees the daily expansion of OSINT tools into new data troves, methods, and tactics.
While the atrocity investigation was conducted under the aegis of BBC Africa, it was supported by several freelance researchers. Some of these researchers are connected to Bellingcat, the so-called “the home of online investigations.” This organization serves as one of the major hubs for these kinds of OSINT researchers, many or most of whom are hobbyists and freelancers.
Hosting quizzes and “how-to” articles with titles like “Using Time-Lapse Satellite Imagery to Detect Infrastructure Changes,” “How to Collect Sources from Syria If You Don’t Speak Arabic,” and “Automatically Finding Weapons in Social Media Images,” Bellingcat brings together researchers and advances techniques to pierce through disinformation. Researchers associated with the group have independently corroborated Human Rights Watch and Amnesty reports and disproved Russian claims on the use of cluster bombs in Syria. They have also identified one of the Paris bombers 3 days after his suicide attack. Their most impressive and public-facing achievement to-date, however, is likely their establishment of the true identity of the Skripal poisoning suspects, linking them directly to Russian military intelligence.
Other individuals and organizations have rounded out the OSINT field, providing podcasts, free tools, trainings, and even merchandise. This author’s favorites resources include the /awesome-osint repository on GitHub and the several podcasts including The Privacy, Security, and OSINT Show and The OSINT Podcast.
As one scratches beneath the surface of all of these pages and organizations, however, one quickly realizes that they are nearly all comprised of individual researchers from a variety of backgrounds with a largely self-taught arsenal of skills and tools. Herein lies the essence of one of the leading benefits of OSINT in 2019: it is a democratic tool that allows anybody with the interest and ability to self-learn to pull back the shrouds covering important information and stories.
Aside from “Vicarious Trauma” that an unknown number of researchers have acquired from viewing unedited, brutal footage (yes, there is also a Bellingcat how-to article on “How to Prevent, Identify, and Address Vicarious Trauma“), there is the ever-present risk of losing potentially life-threatening data. This can happen both intentionally and unintentionally.
In one unintentional instance, a modern take on the WWII warning “loose lips were sinking ships” saw US-service members around the world contributed to “heat maps” on workout ap Strava. These heat maps provided clear information on personnel movements and patrols at secretive military installations (yes, there is also a Bellingcat article on “How to Use and Interpret Data from Strava’s Activity Map“).
On the intentional side, malicious actors have access to the same tools. Individuals, organizations, and nation-states make use of these same tools for their own purposes. Disregarding the constant OSINT operations conducted by governments, criminals can use these techniques to improve their own activities. Individuals and groups, whether “hackers” or not, now rely on OSINT tools to customize and refine everything from sophisticated spearphishing attacks (computer as target) to more traditional criminal activity (person as target).
Aside from data-leakage, the broadest and likely the most critical threat of OSINT in 2019 is the same problem driving fake news. It takes incredible amounts of time and effort to sift through the “noise” of information and misinformation. While the BBC investigation brings hope that malevolent actors can be brought to justice, there is nobody investigating most instances of the kind. Whether in the Sahel, Soho, or New Jersey, there are masses of data and information out there in which malicious actors can hide. While this part is the bad news, the good news is that the tools to find them are out there. And with the leaps and bounds in AI and other technologies, these tools will only become more powerful.