Open-source intelligence is piercing the fog of war in Ukraine

On May 29th 1982 Robert Fox had just witnessed 36 hours of intense warfare over Goose Green, a remote spot on the Falkland Islands, an archipelago in the South Atlantic then being fought over by Britain and Argentina. It was the decisive battle of the war and it had gone Britain’s way. Mr Fox, then a BBC radio correspondent, was keen to tell listeners. It took him ten hours to get to a satellite phone aboard a warship, he recalls. It took another eight hours to decrypt his text in London. The story was not broadcast for 24 hours. Television journalists had it worse, says Mr Fox. Their shots took ten days to reach home.

When the southern Ukrainian city of Kherson was liberated in November, it took just hours, if not minutes, for the news to flood out. Images circulating on Telegram, a messaging service popular in Russia and Ukraine, showed Ukrainian soldiers strolling into the centre of the city and Ukrainian flags lofted over buildings (see clips above). A network of amateur analysts on Twitter tracked the Ukrainian advance, almost in real time, by “geo-locating” the images—comparing trees, buildings and other features to satellite imagery on Google Maps and similar services.

The rise of open-source intelligence, OSINT to insiders, has transformed the way that people receive news. In the run-up to war, commercial satellite imagery and video footage of Russian convoys on TikTok, a social-media site, allowed journalists and researchers to corroborate Western claims that Russia was preparing an invasion. OSINT even predicted its onset. Jeffrey Lewis of the Middlebury Institute in California used Google Maps’ road-traffic reports to identify a tell-tale jam on the Russian side of the border at 3:15am on February 24th. “Someone’s on the move”, he tweeted. Less than three hours later Vladimir Putin launched his war.

Satellite imagery still plays a role in tracking the war. During the Kherson offensive, synthetic-aperture radar (SAR) satellites, which can see at night and through clouds, showed Russia building pontoon bridges over the Dnieper river before its retreat from Kherson, boats appearing and disappearing as troops escaped east and, later, Russia’s army building new defensive positions along the M14 highway on the river’s left bank. And when Ukrainian drones struck two air bases deep inside Russia on December 5th, high-resolution satellite images showed the extent of the damage.

But whereas satellites were well-suited to cataloguing Russian battalions laid out neatly in open fields in January, it is harder to capture compelling images of small companies of men dispersed over a wide area and often ensconced in trenches or bunkers. The single most important repository of data during the war has been Telegram.

OSINT analysts scour Telegram channels such as Rybar, an account with over 1m followers, to harvest images of battle, testimony from the front line and the mood among troops. Rybar is not neutral—its founder once worked for the press service of Russia’s defence ministry, and reportedly once had links to Yevgeny Prigozhin, the head of the mercenary Wagner group—but it offers relatively accurate and timely accounts of battlefield movements, including Ukraine’s blitz through Kharkiv in September, and is often critical of Russian policy.

Telegram has become a platform for Russian ultra-nationalists, supportive of the war but dissatisfied with its conduct, to air their grievances against Russia’s military leadership. Popular accounts have circulated images of troops without basic equipment. During the Kherson offensive in early October, one panicked Russian account even used Telegram to make a desperate plea for air support. The first ten years of the Syrian civil war produced video footage running to 40 years, notes Matthew Ford of the Swedish Defence University. In the first 80 days of the Ukraine war, there was ten years of footage—an order of magnitude more.

For armies seeking to maintain operational security, this profusion of data is a nightmare. In 2019, after a series of blunders, Russia passed a law banning soldiers from uploading sensitive photos or videos. It began shutting down railway-tracking websites shortly before the war began, removing a valuable source of data. It has also attempted to obscure patches on soldiers’ uniforms and vehicle markings, to avoid giving away the position of whole units. In October the Kremlin began cracking down on prominent critics on Telegram, such as Igor Girkin, a hardline ex-spook who led Russia’s proxy war in Donbas in 2014. But they remain as garrulous as ever. After at least 89 Russian servicemen—possibly hundreds—were killed by a Ukrainian attack on New Year’s Day in Makiivka, a Russian-occupied town in the Donbas region, Mr Girkin lambasted the incompetence of Russian generals, describing them as “untrainable”.

Nor has Russia staunched the flow of information. “There’s a lot of lessons being learnt very slowly,” says Tom Bullock, an OSINT analyst at Atreides, an intelligence company, “but I think that’s on Telegram, where they know people are looking”. On VKontakte (VK), the Russian equivalent of Facebook, says Mr Bullock, “it’s basically just as bad as it always has been. There’s so many geo-tagged pictures of their bases just floating around at all times.”

This sloppiness can have lethal consequences. In December a Russian volunteer posted photos on VK of forces encamped in a country club in Sahy, an occupied part of Kherson province. His post included a geo-tag of the exact location. Ukrainian missiles later struck it, after which the volunteer posted yet again. This time he uploaded a video showing the extent of the destruction, in effect giving Ukraine a damage assessment from on the ground, noted Rob Lee of King’s College London.