Eliot Higgins – Beyond the Story: Justice and Accountability
Founder of Bellingcat, Eliot Higgins, describes the art of online open-source investigation, and how public data is changing the entire landscape of war reporting.
Can you outline the work of Bellingcat?
We’re most well-known for what we call online ‘open-source investigations’ (OSI). These have been around as long as there’s been public information. In world war two you had news reports from Germany and people in the UK trying to find out what were lies and what was truth. Over the last 10 years we’ve had this massive explosion of information online; thanks primarily to smartphone technology people are constantly sharing information, and we use platforms like Google Earth, Google Sreetview, YouTube. People often ask what’s the most useful tool we have to search for things, and it’s Google. Stuff people use every single day. You did an open-source investigation to find my office. At the moment we focus on conflicts in warzones. That’s something that’s developed through an amateur community online, which is fairly unusual – but now after 7-8 years of this, we’re finding things that are useful for court cases, and are working with the ICC and Interpol.
Just a group of people collaborating online...
You described your motivation for starting Brown Moses, your first blog and a kind of precursor to Bellingcat, as ‘intellectual stimulation’. Why do you do what you do?
That’s a great way of putting it. Initially it was just about putting arguments up on the internet. There was a period back in 2011 when everyone left my office and there was a lot less work to do – I was bored, basically. And at the time there was an escalation of what was happening in Libya, and I spent my days on The Guardian’s live blog just commenting on stuff. Quite quickly you could see pro-Gaddafi supporters, or pro-intervention people who were finding videos and sharing videos, but nobody was fact-checking their claims. So I came up with the idea that you could use satellite imagery to actually verify this stuff, and that’s when I started doing what we now call geo-location. There was literally a year before we even had a word to describe that kind of process.
At the same time I saw there was so much information coming from Libya from multiple sources, but no one was putting them together. The example I use is that one of the rebel groups in Misrata, one of the three areas with rebel strongholds, pushed out after months of fighting and went south along a road towards Sirte, where Gaddafi was hiding. Along that road just south of Misrata there was a town called Tawergha, just off to the side. And all the journalists who were with the rebels were driving off looking for Gaddafi, and would then drive back, and they’d tweet in passing, “the rebels are here”, “the rebels are firing artillery into this town”; and because on the ground Tawergha wasn’t the journalists’ priority, they weren’t writing stories about it. So unless you were following all the journalists as a group you wouldn’t pick up on this pattern of behaviour; but because we had this macro view – we could see something was happening in this area.
I started my blog in 2012 because I wanted a place where I could put everything and just write. I approached it as journalism with an idealistic view of what journalism was - I could see other blogs online with people posting a video showing someone in Libya who was non-Libyan, and they’d say “oh, this is evidence the CIA are in Libya”; it’s evidence that there’s a white person in that video – that’s all it shows. So I was very systematic and tried to be very careful, and then in 2013 I had this very big story that ended up making the New York Times’ front cover about weapons smuggled to rebels. And I stared getting invited to events. One of these was run by a group called Tactical Tech in Italy, and they had 100 - 150 activists and lawyers all focussed on human rights issues – and then there was me with my blog writing about weapons in Syria, and I did a demonstration of what I did with no idea how these people would react. I was not a good public speaker back then, but they reacted really well, and started coming up with all these ideas about how we could track weapons down in riots, acting quite inspired, and that’s when I realized I had to take what I was doing more seriously because lots of these people were a bit blown away.
It was probably in 2014 when the joint investigations team reached out to me over our work on MH17, and contacted me through the Metropolitan Police to be interviewed as a witness to the investigation – which I was surprised by. They asked me to go through everything we’d written step-by-step and we had people who contributed to the website who I knew, and I just said that if the joint investigation team are interested in our work – maybe we should come together, and this just drove us to do more and be more accountable. With the international human rights community asking us more and more, we got involved with the Berkley School of Law, the ICC, all these bodies who are helping to develop the field of open-source investigation, and that’s led to what we’re now doing with Yemen.
You’ve just opened an office in the Hague to collect evidence for your Yemen project. How do you work with international bodies, like the ICJ or the UN, now that you’re supplying them with data for war trials?
Early on when I started getting invited to talk at journalist conferences it was like getting up on stage and showing everyone a box of magic tricks, even though it was quite simple stuff it was new to everybody there. Now the ICC is good at picking up on this being very useful, they have this technological advisory board with a big focus on OSI. The work we’re doing on Yemen is focused on the court cases in the UK on arms-export control. Taking information to court for MH17 meant re-writing a lot of our work and finding lots of alternative versions to links that were dead so that it was all submissible. Now, archive is everything. And we’re finding a way to write so that we can meet a general standard for every court and just hand it over. Things might need to be tweaked, but it’s a matter of five minutes rather than spending days and days on old material.
I’ve spoken to lots of different parts of the UN, and they all have very different knowledge and understanding of OSI – some none whatsoever, some know about it but can’t do it themselves, really the pool of people who are good at it is very, very small. Some are very wary of it. But there are dozens of teams, and you can talk to one in Beirut doing work on Syria, and one in Istanbul doing work in the same place – and they have a very different knowledge of the subject. So we give as many cases to demonstrate the value of it to different organisations. We want to amplify the information we have to get it to as many people as possible who need it and make it as easy as possible to consume. Part of the challenge is convincing them to use the tools we’ve got.
You aren’t local media or national media, but exist very much in an online world. What’s that like?
(Laughs) It’s useful actually. It gives us a lot of flexibility for our investigations and we’re not focussed too much on one area. How open-source investigations developed as a field, even from really early on, was really just a group of people collaborating online. One person from amnesty, one from human-rights watch – me doing my blog, we were a tight-knit group who were all just big nerds about it. Over time that’s formed a very close community of people who are really supportive of each other, whereas in a more traditional media landscape there’s significantly more competition. We’ll happily work with all kinds of organisations if we’re doing an investigation and we want to work with a partner – a national newspaper perhaps, or a national broadcaster. With the flight MH17 investigation, we’d find Ukrainian papers, any Russian sources who didn’t hate us – and they might ask us for additional material that has more impact in those countries, which then has a knock-on effect.
Brown Moses, your first blog, began by being crowdfunded. How does Bellingcat operate now?
Initially we were crowdfunded. But I don’t have any idea how to raise large amounts of money – and funders don’t want to give an organisation money if they’re the only funder so initially it was kind of chicken and egg. Fortunately we got kickstarter money, which meant funders started giving us other bits of money. Then a couple of years ago we started doing workshops, first a few a year, now we do about 25-26 that are all paid for. It’s about £2000 per person for five days, and that generates about 50% of our income at the moment. Although we’ve just got half a million euros from the postcode lottery so that’s shifted the ratios a bit.
How do you choose the targets for your investigations?
Previously it was led by the investigators on a volunteer basis, but when we started blogging Syria was escalating and there was a lot of material nobody was really looking at, so it sort of became our focus. Then only a few days after we launched Bellingcat, flight MH17 was shot down. It was because there was just so much open-source information available about it that it drew a whole new community to the story, so Ukraine became the next big topic. Then all these side-stories about Russia’s involvement, before the two communities of Syria and Ukraine sort of came together. Really over the last eighteen months we began to get funding, and so we can actually start choosing the projects we can do. My opinion has always been to look for where’s the most value to open source investigation as a field, and that’s why we’re focussing on the justice and accountability in Yemen, and local projects through the workshops we run. Sometimes the local issues are just really interesting. After one workshop we did in Ukraine somebody started looking into illegal amber mining where they use pressure hoses to wash away riverbanks for these chunks of amber. It’s a hugely destructive process, but the people who do it post their finds on social media – and in a two day investigation they found one of the people doing it was actually in charge of investigating illegal amber mines in the police!
This is what we do with our workshops – we teach them the tools.
What’s your opinion of war-correspondents from traditional media sources?
I think their work is incredibly valuable, and although when we first started it seemed like it was ‘new journalists vs old journalists’, it’s not – it’s a collaborative process. With Syria, which was the first big focus of open-source investigation, it became very dangerous very quickly for journalists to be on the ground. Some people saw that as we were replacing traditional journalists, but then MH17 was something very different. You could move around Ukraine as long as you weren’t big-dickish and pissing people off at checkpoints. You also had a lot of online activity, which was very different from Syria because there had been very limited internet access there and there might have been only a thousand or so sources – which had been very useful to catalogue, but in Ukraine people were posting pretty much what they wanted, though some in separatist areas had to be a bit careful. People could film stuff, put it on Instagram – and it was kind of like looking for lots and lots of needles but in a really big haystack.
So you could find really little scraps of information, but then what we found could be very quickly followed up by journalists. When we geo-located the Buk missile launcher which brought down the plane, journalists went out and spoke to people on the ground who had seen it at the same time in the same circumstances. For the journalists it gave them something they could investigate, and we got another source to confirm our data.
You’ve described in a lecture how the research that uncovered the providence of the Buk missile that shot down Flight MH17 cost you exactly £0. So is your sort of work going to become a staple in newsrooms?
It’s difficult with newsrooms because it’s very difficult to become a good open-source investigator if it’s only 5% of your job. And most journalists have other things to do. Even the basics can be really useful for them, but if you want a good OSI team – they have to do it full time. The video investigation team at the NYT was actually set up by someone who was one of the very early members of this community that I was part of, now they’ve got a former Bellingcat member there – it’s a really strong team. And they’re doing really good, interesting investigations – and realizing it’s a very visual thing quite often. You can do really cool animations to make it engaging for the audience.
A couple of years ago we trained the BBC Arabic team, and that then led to the creation of BBC Africa Eye, and they came to me and said we’d really like an open-source component to it and for Bellingcat to help out. So one of my volunteers ended up joining them and that was hugely successful; this Anatomy of a Killing video was a collaborative effort with various experts with open-source backgrounds – plus people from Twitter who were just really keen to do that particular investigation. It’s a video of two women being walked off a road and killed, and when it was presented to the Cameroonian Government, they said it was fake news. A year afterwards, the BBC managed in this collaborative effort to figure out who did it – and in Cameroon they’re now putting these soldiers on trial after saying it was fake news when it was first presented to them. And that really taught the BBC the value of OSI, and it’s not just the story – but something that goes beyond the story to this court case – justice and accountability through journalism.
Constantly little innovations are happening, like using historical imagery on Google Earth – a very simple idea, but it’s really useful. Historical imagery on Google Streetview – most people don’t even know that that exists. There was a photograph posted by George Papadopoulos, who was Trump’s policy advisor just before he was arrested by the FBI, he posted a video in London saying #business, and we used Google Streetview to prove it was taken in 2014 rather than 2017 as he claimed, because stickers on a pole next to him had changed. It’s so simple. This is what we do with our workshops – we teach them the tools.
Your workshops also reveal how much of a premium you place on your methods being transparent; every time you go through steps saying ‘this is how we knew this, this is how we know that’. While you’re automatically protecting your work from claims of it being ‘fake news’, might deep-fakes or other new tech impact your investigations?
It wouldn’t really affect our investigations – but there’s two sides to this. On social media you’ve basically got a minute to stop fake news just going viral. And the open-source stuff we’re doing looks at original video sources, who posted it, when, where etc. I think the more dangerous thing is that if fake copies of video appear too often, then people will stop trusting videos. People are so cynical now, but that’s why we use so many different elements to cross-reference our evidence. We had to prove our evidence with MH17 in great detail, but some people still believe Russian claims because they want to believe the Russian claims.
On the other hand, like with this stuff in the Strait of Oman with Iran supposedly attacking oil tankers – the Americans are presenting their evidence as a slam dunk, it wasn’t. It was blurry footage, you couldn’t work out what they were doing. It didn’t contradict what they were saying but it wasn’t as supportive as people would like. And by presenting this evidence it makes it look like they might have something to hide. In this black and white video where they supposedly take this mine off the Iranian vessel, I would have started the video early, before the men were removing it – because if you start it while they’re covering the object, it looks suspicious. You want thirty seconds or the entire video beforehand. They say it’s an Iranian boat - why should I know it’s an Iranian boat? Show me a photograph, open-source ideally, of it being used by Iran. When you do that, this dissonance and mistrust between the authorities and an audience disappears.
Human Rights Watch, Bellingcat, and Forensic Architecture submitted a report to the US for comment when you each worked together on demonstrating that it was a US Hellfire missile that bombed a civilian mosque during the Syria conflict. Have you encountered more official resistance from reporting stories that implicate western governments than foreign regimes?
Not in the way we have with Russia, who’ve been very aggressive. America were saying that we couldn’t have taken into consideration classified information that disproved our investigation – but it was a fucking mosque, and we proved it, and two weeks later they said it was. In Russia they just lie because they can, but the US were playing a kind of game. It’s still bullshit, and that’s why you have to keep challenging them.
In an article for Delayed Gratification, you suggested you were working on a searchable database of evidence collected by open source investigators to be compiled for future investigations. You’ll be pre-empting any bad-actor’s ability to get away with things before people start looking - in effect, starting the video early.
If you wanted to put all the videos from Syria together, you’re talking about millions of videos and it’s a big data management task – and there are groups who make videos and who don’t want to give it away for free to everyone because it’s their stuff. Also sometimes you might have a video of someone giving a witness statement, and you don’t want the whole world to know you have this specific person talking about a war crime, but you want it accessible to big investigative bodies. The idea of this archive is creating a system of tools and processes that then we might be able to deploy. A company called Benetech has been developing an indexing system that will mean if you have a collection of videos and the relevant date and time metadata, you can have it go to this database and be discoverable by people like the ICC. The index will search its archive to match duplicates from organisations who might have described the same footage in thirty different ways, and you can get to a stage where you can draw a circle on a map and just have all the video data from this place pop up at once.
We exist in a weird space between all these fields, and have to do the best we can
Do you see any part of this process as big-brotherish? Where do you stop?
In a way it hasn’t affected Bellingcat because we don’t have the technology to develop the kind of system Cambridge Analytica had – we’re just investigating, not scraping all the information we can from the data. And we’re not trying to sell this information or use it for anything but investigations. You might want to scrape lots of data for an investigation – for example, putting together the 53rd Brigade (where Bellingcat identified every single member of the anti-aircraft unit Russia was accused of using to shoot down flight MH17), took a year. A lot of it was very simple stuff where you clicked links on pictures and posts for ten thousand social media accounts – which was very time consuming. But you could automate a lot of that process and we’ve been talking to university technology departments about this, something that takes a year could take a couple of weeks. But what we did there was map out an entire military unit. And if you teach machine learning to do 90% of that job and point it at every single social media site to let it do its thing, you’d probably find every single soldier of all the world’s militaries. That would be an amazingly powerful intelligence gathering tool, and the question is whether we want to be putting that out into the world. Every intelligence agency would be climbing over themselves to gain access to that.
A limitation for machine learning search technology is that we don’t actually know how it’s searching an archive. You can point it at something you want to find, and it’ll find it, but we won’t know how it’s actually done that. It might also miss something you’d like to see, but that you haven’t told it to find. What are the implications of this for responsible users, or for courtrooms?
It could prove difficult in a court because during the discovery process you want to look at all the evidence. On the other hand what you have is a triage process – looking through the videos of highest priority. The Syrian Archive who we’ve worked with have already developed something that’ll search for cluster munitions in videos and identify them. They can take the videos they need, and that might not be every single video – but it’s a pretty decent chunk, and they can tag it and make it useful. This is a process of adding metadata. One thing that’s been very useful in the development of the Benetech system is they’ve not only been de-duplicating videos – but this information has helped them develop a system for detecting similar-looking buildings. So if you geo-locate one video, and then there’s four-hundred other videos that have similar looking features, you’ve reduced the task of locating all these sources from taking days to what might take minutes. And adding metadata to it, you can start exploring the connections. There might be 50,000 videos from a certain area, and you can do certain analytics over a period of five years where you can see which buildings have been destroyed – or when the attacks were happening. Along the way you’re learning how to deal with massive amounts of information. And the work we’re doing now in Syria or Yemen could be used to apply to future conflicts; what happens if you’ve got an algorithm that as videos are coming out – automatically sorts them into where they were physically filmed? But could also haverepercussions, because we’ve seen activists uploading from the same spot every single day. If you were crafty and you’ve got artillery, you could wait for the time you thought they were going to be there – and obliterate the activist.
Is there a danger that even in a perfect world where this technology isn’t misused, Bellingcat’s role is becoming too closely aligned with judicial instruments? Journalists have to be a watchdog for our legal infrastructure as well as their targets.
It is finding a balance. The joint investigations team shared its information before publishing. The one issue with open-source information is that if you publish, everyone knows what it is – after you publish, online accounts with evidence can be deleted, evidence can be destroyed. The way we work we’re very transparent about our sources, some journalists might hide their sources to be discreet, but we wouldn’t. Sharing information with the police before it’s published can therefore be very important because it stops evidence being destroyed. But we don’t want to become a proxy investigations agency for the police. The police have restrictions on what they can do with publicly available information – they can’t go onto every single person’s Facebook account looking for evidence without a really good reason to do so. Because we’re private citizens we can do whatever the hell we want with public information within reason – certainly things the police couldn’t. So we don’t want the police to come to us and say, “hey, can you look into this for us” – because we aren’t trying to get round the laws that protect the public from the police. It’s finding that right balance between the journalistic ethics and having to consider all the justice and accountability implications to what we’re doing. We exist in a weird space between all these fields, and have to do the best we can, often in a case by case basis. Some journalists say that’s not real journalism, and it can create tension with some of our partners – but we understand that that’s the nature of where we are as an organisation.
What happens when there’s a really important issue for the world to deal with somewhere extremely rural, where there’s a more incomplete picture being uploaded online?
Nowadays we have so many satellites that you can hear about villages being burnt in Myanmar and we actually have imagery of the aftermath. But open source investigations aren’t a cure-all for everything, there are going to be places where it doesn’t work. We were very surprised by Yemen how successful our investigations were – I was under the impression there wasn’t going to be that much material. But we found all sorts of local community groups doing all kinds of work on the ground, and by collaborating with them directly we see how what we’re doing is kind of the snowflake on top of the iceberg of what is possible. We’re really reliant on funding, and one thing I want to do is have a rapid reaction team where there’s a real need for quality investigative work.
How do you define what you’re doing? It’s the most Gettysburg Address kind-of-journalism I’ve ever heard of – for the people by the people.
In a way, yeah. We’re actually starting a training programme to help local people to do local investigations, so we’ll run a workshop for five days with students from a university, academics, local journalists who understand what we’re doing. Everywhere local journalism is struggling, so we’re looking at the relationship between local news and public investigators – and saying: ok, perhaps the public should collaborate with news organisations to investigate things that they care about. It can be simple stuff like why are my bins not being emptied when they should be, but my hope is that it addresses the issue where local news organisations are actually trying to find their way in the world by getting the public engaged. I’ve found that often with local government, it’s not that they don’t want to do something – it’s just that they need enough information to justify doing something. So going back to the bin example, a university could develop an app with a local news organisation that just says, if you walk past a bin – take a photo of it, and tick a box for how full it is. That gives a location, time, and date, and with hundreds of people taking pictures of bins the university could see this area doesn’t get its bins emptied when it should. Give that to a local council who adjusts their behaviour.
Academics just don’t get this; they try to apply logic to this, which doesn’t account for weird internet behaviour
Is there a need for a whole new sector to get set up to do what you’re doing?
More organisations like Bellingcat would be a good thing, and I think it’d be a collaborative effort. But it’s very difficult to do because Bellingcat is such a focus of where the expertise is going – right now we need to develop the field, it’s not something I expected to do, but the focus now really is on Bellingcat. It’s difficult to say whether we’re a tech development company as well, and we are doing a bit of that but we’d rather do it in partnership. Maybe if some billionaire wants to give me a billion dollars then we could do it all. It’s been a nightmare for our business plan because I don’t know what’s happening in a week let alone in five years; but we’re never going to have shareholders which is unusual in journalism, and any money we make gets put back into Bellingcat.
Do you think global bad-actors are going to be attending your workshops, learning your secrets and reforming their methods to make it harder to do your work?
(Laughs), it depends on the agency, I’m sure the GRU would like to do that. But generally the people making it harder to do this work are the social media companies themselves. Facebook removed graph-search which was a very powerful tool that was being abused by the likes of Cambridge Analytica and various state actors using it for influence campaigns. That was something that had to be cracked down on, but it’s had a direct impact on our work in Yemen because now it’s harder to find specific information about airstrikes people posted a couple of years ago. YouTube started cracking down on extremist content – which means hundreds of thousands of videos were removed. These are legitimate reasons but it makes our work harder. We want to make them understand how it affects human rights investigations.
Can you tell me a little about when counter-terrorism police came knocking on your door?
The first time was after the Skripal investigation where they came to my house just to make sure, they gave me this ‘now you’re a terrorist’s VIP’ talk: this is what the crazy people do. Then they came here and wanted to inspect my office, and were a bit surprised it was so empty; and asked about these photographs posted on a jihadi crowd-funding website on the dark web. Someone had geo-tagged my office to the photographs – they thought we’d set up a honey-trap for jihadis, which we hadn’t. Someone just did it for a joke or a threat, but we should print those up and frame them in here. I love the weird propaganda we get about Bellingcat, stuff like Russian news organisations making a graphic with us in the centre and all these incorrect sources of money we were apparently getting – one was from UNESCO world heritage. Bizarre.
Are we better informed than ever before?
We can be better informed. I think the lunatic fringe has taken over a bit, but it’s a hard one to judge. In a way, everyone is being taught fake news but we could be better informed – it’s just making people aware, and making the media better informed and more reliable, more transparent.
I’ve got a theory about fake news. The internet is very good at getting people into the right bubble. If you click on something for a laugh, it teaches an algorithm to share viral shit. The people seeking that out, can always find it with like-minded people. In these communities you can post stuff that’s too extreme, and you get booted out – from 4chan to 8chan if you will. Over time, people get filtered into more and more extreme communities as you find your level – and people base their values on the communities they’re part of. Venn diagrams of these communities begin drawing together because the same people find conspiracy minded content funny, and they get a good reaction. Now you have the MAGA crowd, people who are 8chan, alt-right, alt-left – all these bubbles are actually getting closer and they use the same sources. And one thing is that think-tanks and academics just don’t get this; they try to apply logic to this, which doesn’t account for weird internet behaviour. To reach out to these groups, you have to get in education at an early age – I think media studies should be core curriculum now, people are getting online at a very young age and seeing a lot of bullshit.