Bellingcat’s Grozev on Investigating Russia’s Invasion of Ukraine

Editor’s note: Christo Grozev is an investigative journalist and the executive director of GIJN member Bellingcat, an independent collective of researchers based in over 20 countries. Christo has received multiple awards for his journalism, including the European Press Prize Investigative Reporting Award for an investigation into the poisoning of former Russian double agent Sergei Skripal. In this seminar on Russia’s attack on Ukraine with the Reuters Institute for the Study of Journalism — republished with permission – Grozev emphasized that investigative reporters need to show Russian audiences the consequences of their country’s invasion. He also discussed how journalistic evidence of possible war crimes, and of the true Russian casualties – already listed at about 3,000 by Bellingcat, despite Russian denials – could apply an additional layer of pressure on Putin beyond that of financial sanctions from the West.

1. Strong Focus on Data

“Information is often valuable, but you need to net it out of the agenda, of the noise, and find the valuable information,” Grozev said. He explained that this is why Bellingcat’s work is data-focused rather than based on sources, as sources often have agendas. Before the war, Grozev’s team received tip-offs about what was going to happen. As these were unverified claims from sources, they didn’t publish them, but they gave them some hints about the situation in the Kremlin.

“Almost a year ago I received some credible-sounding information that things would change in Russia in 2022. That it would be like nothing we’ve seen before, that Russia would become a dictatorship. That Russia would be North Korea 2.0 and journalists would be jailed and the free media (well, the remaining islands of free media) would be shut down. And that the country would become an army or it would run like an army,” he said.

More tips came in late last year, this time concerning a war with Ukraine. “Again, this was a source we couldn’t use but it scared us, and it forced us to look for the data that would support or disprove this,” Grozev said. As Russia massed troops at the border, Bellingcat got to work.

Christo Grozev. Image: Screenshot from the webinar

2. Bellingcat’s Top Priority: Documenting War Crimes

“At this point, the most important thing we can do with a relatively small team is archiving any evidence of war crimes for the near future,” Grozev said. Possible instances of war crimes need to be carefully fact-checked. This work isn’t yielding immediate results, but is building a valuable record for the future. Bellingcat did this during the war in Syria. But Grozev said that the role of propaganda and misinformation in this conflict is different.

“It’s like nothing we’ve seen before,” he said. “But we switched our resources to trying to archive and validate, prove and disprove war crimes and human rights violations. A lot of this work is invisible. A lot of this work will end up in courts in the future.”

3. How Bellingcat Investigates the War

“Databases have allowed us to pinpoint the search of data to a particular subgroup. For example, military people or FSB [former KGB] people involved in preparations for war,” Grozev said. Bellingcat is using this to track these people’s communications and movements, in particular data surges that can suggest something is being planned. It then combines this information with open source public data to find an explanation.

To identify and verify possible war crimes, the process is long and involves several steps. Grozev explains:

• “We have automated data collection bots that look for any TikTok, Twitter, or other social media evidence of explosions, where there seems to be residential or other buildings hit and therefore there’s likely to be civilian casualties. We then duplicate all of this humongous archive of data we’re getting and we’ve put out an appeal on Twitter to anybody who sees something that looks like a war crime. So the first step is deduplication.”
• “The second step is geolocation and verification and chrono-location, which is also important because a lot of the data out there on social media is actual war crimes but it’s not from now. It’s from other conflicts. It’s from 2014 or 2015 so we have to chrono-locate the event to be sure that it’s from the current war.”
• “Then the next step is trying to find conclusive evidence that it’s the Russian side or the Ukrainian side that is the originator of the crime. And to do that, we have to look for the smallest piece of evidence such as the angle in which the crater is slanted, in one direction or another. And then try to geolocate the exact crater, put it on a compass, and then to see what the angle of approach of the missile would have been, essentially creating a reverse analysis to see from where it would have come.”

This is similar to what Bellingcat has already done for previous conflicts, such as the 2015 artillery strike on Mariupol in southeastern Ukraine, which they determined came from Russian separatist-controlled territory. Grozev said that similar investigations for the current war will be published in the future.

Bellingcat’s Russia-Ukraine Monitor Map, a crowdsourced effort “to map, document, and verify significant incidents during the conflict in Ukraine.” Image: Screenshot

4. Why the Role of Journalists is Changing

Grozev explained what digitalization means to wartime reporting: “One of the things that makes this war different from anything else is the digitalization of the war. And the fact that because much of it is digital and the information part of it is completely digital, it has equalized the sovereign states who previously owned the propaganda machine to non-sovereign states like Bellingcat, or to real biased parties on each side who actually have the capabilities, the sophistication, and the data to either put out the truth or to put out a disguised truth.”

Grozev explains why this is a challenge: “This makes the role of journalists a thousand times more important than in previous wars, when you only had a binary choice and when you only had to find out whether this was a piece of propaganda issued by this government or by this other government. Now we’re talking about multi-vector propaganda messaging coming from bad actors on one side and from good actors also putting out fakery. So we journalists have to be the gatekeepers and to simplify this for the audience.”

5. Russian Media is a Minefield of Fake News

“It’s impossible to get on Twitter or Facebook in Russia. So Russians are defaulting to VK, the Russian version of Facebook, which is penetrated by the FSB and where every second post is a planted post,” Grozev said.

However, misinformation is also coming from official sources. “In the first days we saw a lot of false equivalence in European coverage, and it was dangerous. Many outlets reported on claims of both sides as if they were equivalent in value. We saw it in Bulgaria, Hungary, and Italy,” Grozev said. Now, however, this is no longer happening and he thinks European media is doing well in their coverage of the war.

Despite warning about the dangers of giving Russian claims uncritical airtime, Grozev does not support banning Kremlin propaganda outlets such as RT and Sputnik. “Blocking them is not really achieving any outcome other than getting Russia the false equivalence to block the BBC or Deutsche Welle,” he said, noting that the German public service broadcaster has already been banned in Russia.

6. Possible Next Steps in the Conflict

“Sources say that people around Putin are freaking out and they’re thinking how to minimize the damage to themselves. And that does include thinking about how to get rid of him. And it’s natural. It is not something that we haven’t seen before in history,” Grozev said. However, this comes from human sources and not from the data Bellingcat usually analyzes. “It doesn’t have to be a conspiracy theory,” he said. “It’s the natural inclination of the oligarchs who brought Putin into power and are now suddenly threatened, their livelihood, their existence is threatened by his anti-pragmatic behavior.”

7. On the Ethics of Reporting on the Kremlin

Grozev explained how Bellingcat’s transparent methods are inadvertently offering inspiration to bad actors, who read the journalists’ investigation and then use it to make their own dealings harder to spot. “In our own case, we’ve seen this as a multi-layer computer game where we go one level and then we teach the bad actor how to upgrade themselves,” he said.

Grozev gave a disturbing example: “Yesterday I was exposed to a bad actor who is under arrest now. They found in his computer a report, an article that I had written about an assassination attempt in Europe, and this bad actor had analyzed my report. And had come up with a list of suggestions for improvement of the assassination next time around. So essentially, what we do, while it exposes a lot of the bad actors’ activities, can be used as a training manual.”

This creates a moral dilemma for outlets like Bellingcat, which have to evaluate this possibility and weigh it against the public interest of their work when they choose whether or not to publish.

However, there are also clear benefits to the transparent way in which Bellingcat chooses to work. “[We are in touch with] many new allies, hackers we didn’t use before, the hackers that previously were hacking for money, hackers that actually had hacked us before because they received money from the FSB. [All these people] are now leaking to us because they see that this is an evil war. So I think the downside of being too transparent is being offset by the increasing number of allies who are willing to help us get data,” Grozev said.

Watch the full Reuters Institute seminar with Grozev below:

Additional Resources

15 Tips for Investigating War Crimes

Essential Steps for Journalists in Emergency Situations

How to Use Data Journalism to Cover War and Conflict

Marina Adami works as a digital journalist at the Reuters Institute for the Study of Journalism, based at the University of Oxford in the UK. Originally from Italy, she has reported on breaking news for Politico Europe in Brussels and on local news in London. You can follow her on Twitter here: @Marina__Adami.