by Eliot Higgins

“The blank zones are shrinking.” No military surveillance system can even approach the coverage of citizens on the internet. We Are Bellingcat provides an overview of the tools and techniques a group of regular people used to uncover the truth behind serious incidents ranging from chemical bombings in Syria to the poisoning of the Skripals in Salsbury, England. Bellingcat’s most famous works have been exposing the lies and misdeeds of governments, most notably Russia and Syria. Consequently, their independence from any government is critical to their credibility. However, U.S. intelligence personnel could learn from Bellingcat’s crowdsourcing techniques, research methods, and dedication to source validation, to supplement the more exquisite (and expensive) classified collection capabilities.    

Despite having no background in journalism or investigations (his career was in finance) Eliot Higgins had a passion for finding and exposing the ground truth in conflict, exemplified in his blog “Brown Moses” where he shared huge amounts of information gleamed from open source on the Syrian conflict and the Arab Spring. His willingness to learn from others led him to gather teams with special skills and backgrounds from around the world to expand his efforts into what he named “Bellingcat.”

Bellingcat has focused considerable investigatory effort on Russia, as they pose a particular threat which General Hayden, former director of the NSA, identified several years ago. According to Hayden, in the 1990s, U.S. intelligence focused on dominating cyberspace while Russia focused on dominating the information space (diplomacy, public affairs, disinformation). We are now behind the power curve, though we can learn much from entities like Bellingcat, as well as the Baltic states who have been dealing with Russian disinformation for decades.

Higgins outlines how online open-source investigation provides opportunities for dealing with Russia’s disinformation ecosystem, including online trolls, amplifiers at RT, and think tanks like Global Research. Higgins calls these entities the “Counterfactual Community,” whose goal is to amplify outright lies, twist factual information, and create doubt. The Kremlin’s 4D approach to this — dismiss, distort, distract, dismay – allows them to muddy the waters and obscure the truth. Open-source information can help expose dishonest sources, fight false narratives, and shut down the counterfactual community before their message can be amplified.

Higgins describes several of the tools, sources, and techniques the Bellingcat community has used in its online investigations (see graphic below). They include applications for measuring shadows in pictures to determine the time of day and using Google Earth to identify the location of a picture from simple identifiers within it or to create a strip map from video taken from a moving vehicle. The team has uncovered and exposed a network of Russian covert officers though linking one operator to a single address using vehicle registration records. They uncovered the identities of individual military officers and units’ organizational structures from social media contacts. One particularly interesting technique Bellingcat members used to establish a high level Russian officer’s contact network was to trace the calls he made on Defender of the Fatherland Day, a day when Russian military members exchange celebratory greetings with each other.

The parallels to our current military intelligence structure are striking and demonstrate the enormous benefit open source information provides to every intelligence discipline. SIGINT can conduct call chaining using publically available phone records. HUMINT can create psychological profiles and gain an understanding of a potential source or a targeted foreign person from their social media presence. Counterintelligence can protect soldiers and family members from foreign disinformation and actors. GEOINT can use their access to mapping tools and unclassified imagery to identify locations of objects and personnel from images and videos posted online.

Most of the sources and tools Bellingcat uses are publically available and often free. This has the added benefit of enabling researchers to extensively document their work and provide detailed references and sourcing which enhances the credibility of their findings. However, occasionally they have had to rely on discrete human sources or information from the dark web. Similarly, military intelligence entities gain credibility with their consumers when we can show our work without classification restrictions; using open-source also facilitates sharing and working with foreign partners and non-governmental agencies. When an intelligence gap remains that cannot be resolved with open-source, analysts can then turn to classified sources and methods.

Bellingcat also exemplifies the power of cognitive diversity. Bellingcat crowdsources their investigations, which enables people with special skills like language, historical expertise, scientific knowledge, travel experience, and cultural understanding to uncover details that never would have been exposed by traditional “experts.” Concerned about the lack of women in the field, Bellingcat has made a particular effort to hire more women and to amplify their successes to attract more into the field. Impressively, Eliot also details the importance of safety – physical and psychological – for Bellingcat researchers. Viewing graphic imagery online for hours can result in PTSD and it is important to prepare investigators for this and provide resources when needed.

This book should be required reading for all involved in developing the Army’s OSINT strategy. The detailed examples of Bellingcat’s work illustrate what is possible. Although Bellingcat maintains a strict policy of not training intelligence professionals from any country, there is still much we can learn from their work which continues today and is documented at https://www.bellingcat.com/. “The response to information chaos is transparency.” In an environment where we are already overwhelmed with data, intelligence professionals should seriously consider the lessons we can learn from successful organizations like Bellingcat.

Follow Up:

1. What causes/issues could Bellingcat and the military partner on?
2. Would Bellingcat be willing to consult on a training path for OSINT?
3. Study The Interpreter, an online publication that studies the Kremlin https://www.interpretermag.com/
4. How can the military use “elves” like the Baltic states to combat disinformation on our own websites?