OSINT in an Age of Disinformation Warfare

In the build-up to the invasion of Ukraine, it was publicly available satellite imagery shared online and used in news reports that gave credence to official warnings from the West about Russia’s intended aggression. Since then, self-taught enthusiasts, long-established news organisations, think tanks, NGOs and specialist teams have collaborated and shared to counter an increasingly aggressive and violent Russian information war machine. Designed to confuse and disable effective reactions, it has included a massive disinformation campaign, attacks on foreign news crews, strikes against TV broadcasting masts in Ukraine, and the censorship and sweeping controls placed on Russian media outlets.

In stark contrast, transparent, volunteer-led, crowd-sourced information gathering and analysis is providing an important bulwark in the heavily contested information space around the war in Ukraine. Open-source intelligence (OSINT) has undergone a revolution since its origins in the 20th century. Then, OSINT revolved around monitoring a limited amount of open-source material, mostly mass media, and served up its analysis to governments alone. Now, there are global networks of practitioners who collaborate and share. Many started with the Syrian war, when an explosion of online data could be scoured. OSINT is now set to thrive in a world in which data-rich smartphones and social media are ubiquitous.

OSINT has become as much about public interest journalism and digital activism as intelligence. Its functions complement those of professional news media. When OSINT practitioners scrutinise online data, they can provide perspectives and facts about a conflict that are often invisible to reporters. It helps to penetrate the fog of war by establishing the truth about individual incidents occurring on the ground. Scrutinising each and every event is important for building overarching narratives about the success and legitimacy of the war, especially as Russia seeks to fabricate news – including about US chemical weapons labs in Ukraine – in order to escalate its offensive. Leading OSINT organisations based in the UK, the Netherlands and Ukraine are collaborating to maintain a live picture based on more than 1,000 incidents – from military losses, to civilian casualties and bombings – using social media imagery and geolocation.

OSINT is also defence in a war of information where falsehoods and a series of myths are created to justify and perpetuate aggression. This campaign is not only directed at Russian speakers. A multilingual website purporting to debunk facts is in fact a source of disinformation and deception. Employing the same tactic, a series of social media posts claim to debunk non-existent examples of Ukrainian disinformation.

As the war goes on, verified open-source evidence of human rights atrocities and war crimes will need to be secured – an objective which the international community and media are increasingly turning their attention to. OSINT databases of abuses in Myanmar, Syria and Afghanistan serve as evidence for the International Criminal Court. In 2017, social media analysis was critical to the issuing of an arrest warrant for Mahmoud al-Werfelli for war crimes in Libya. In addition, OSINT can open up new dimensions in the Ukraine conflict, including exposing the assets held by Russians associated with Putin.

But it is particularly in the realm of forensic, painstaking investigations that OSINT makes its mark. Intricate crowdsourced analysis of online video footage led to the arrest of Cameroonian soldiers who executed women and children, and is central to the international investigation and new court case around the downing of Malaysia Airlines Flight 17 over eastern Ukraine in 2014. In the Ukrainian war, one investigation has created a picture of how the Russian-controlled narrative developed in the run-up to the invasion.

Volunteers collaborate in their analysis, holding each other to account. The self-same networks share findings online, making them more resilient – though far from immune – to interference and capture, in contrast to the targeting of TV masts in Ukraine. The process is as important as the product. Participating in important acts of analysis and information sharing becomes a cause, providing those who contribute with a sense of agency, community and empowerment. One UK-based organisation, the Centre for Information Resilience, reports receiving offers of support from dozens of volunteer netizens every day.

Volunteer amateurs are becoming integrated with mainstream professionals, further expanding impact. One defence editor credits OSINT with providing invaluable context in the build-up to the invasion. Some open-source centres report daily contact with journalists from media organisations eager to expand their sources and verify information for news. Many news organisations are developing their own in-house OSINT capabilities. Others utilise existing OSINT organisations – many of which are independent non-profits – such that OSINT analysis has become a normal part of US and European news reporting on Ukraine.

As social media companies suspend their services or have them shut down in Russia, the New York Times reports a digital barricade being erected. Unchecked, this will entrench different realities on the borders of Europe in a way not seen since the end of the Cold War. In the 20th century, open-source agencies like BBC Monitoring helped peer behind the Iron Curtain. In this emerging context, OSINT will become harder but more significant.

The field has attracted controversy when it acts as investigator, judge, jury and executioner in the court of public opinion. Some open-source organisations receive government funding, and can appear more as activists than journalists. In OSINT, everything hinges on the credibility of the process and its results, so practitioners and governments will need to be wary of becoming too intertwined. Undoubtedly, though, OSINT is here to stay. It is a fast and flexible response to conflict that shortcuts existing bureaucratic processes of intelligence gathering and assessment, while simultaneously impacting the battlefield and the media narrative.

The views expressed in this Commentary are the author’s, and do not represent those of RUSI or any other institution.

Have an idea for a Commentary you’d like to write for us? Send a short pitch to commentaries@rusi.org and we’ll get back to you if it fits into our research interests. Full guidelines for contributors can be found here.