Ukraine May Mark A Turning Point in Documenting War Crimes

This piece appeared first at Just Security.

Last week, the United States government announced its formal determination that Russian troops have committed war crimes in Ukraine. Secretary of State Anthony Blinken said the assessment was made on the basis of a “careful review” of public and intelligence sources. “We are committed to pursuing accountability using every tool available, including criminal prosecutions,” his statement read.

Accountability, though, requires evidence. The collection and preservation of digital media and other evidentiary material in Ukraine is a massive undertaking. It is being met by brave Ukrainian officials and local civil society groups operating in besieged cities and towns, as well as by an international coalition of human rights, open source intelligence and digital forensics researchers. This loose coalition is drawing strength from relationships formed with one another and lessons learned while investigating past conflicts, including in Syria, Yemen, Myanmar and elsewhere.

The ongoing effort in Ukraine, then, can be seen as part of an evolution – or a maturation – of an expanding community of volunteers and professionals gathering user-generated evidence and open source intelligence. It may also represent a crucial test of whether the evidence produced by these methods can play a substantial role in securing convictions.

What follows is a snapshot of the effort in progress, based on interviews with more than a dozen individuals representing a sample of organizations. It reveals some of the key challenges facing this growing field: the reliance on volunteers working in the midst of a conflict; security threats and coordination problems flowing from the over-collection of material; and the centrality of social media platforms that were never designed with atrocity documentation in mind. Still, the reality that prosecutions cannot succeed without evidence drives those doing the work.

A resilient community inside Ukraine

U.S. recognition of war crimes comes more than eight years after Russian President Vladimir Putin’s first invasion of Ukraine, when his troops took the Crimean peninsula and cleaved off Donetsk and Luhansk. For a committed coalition of Ukrainian and international organizations dedicated to collecting and preserving evidence of human rights violations, the documentation of Russian war crimes began in that first wave of invasion and occupation in 2014. For these groups, Blinken’s announcement may be a reminder that authorities such as the U.S. government have been slow to acknowledge and fully grapple with Russian atrocities on Ukrainian soil since 2014.

“The rhetoric that we see in certain international law and policy analysis speaks about the Russian invasion or the Russian aggression which started on the 24th of February,” says Kateryna Busol, a Ukrainian international lawyer and senior lecturer at the National University of Kyiv-Mohyla Academy. “But of course we know that this is all part of the larger encroachment on Ukraine sovereignty since 2014.”

Ukrainian human rights groups and the UN Human Rights Monitoring Mission have been documenting serious human rights abuses since Russia’s original invasion. “[E]ight years of these violations were there and we needed this bloody invasion and the new, totally awful threshold of violence by Russia to catalyze action,” said Busol.

Oleksandra Matviychuk, a Kyiv-based human rights lawyer and head of the Center for Civil Liberties, was among the first to organize the documentation of war crimes in Crimea and the east of Ukraine. She says her group coordinated thousands of volunteers following the Euromaidan protests at the end of 2013 and early weeks of 2014. Those were the pro-democracy events that served as a trigger for the initial Russian invasion. Now, her organization is coping with the new reality of the current invasion.

“A lot of my colleagues from other human rights organizations joined the army or territorial defense, and couldn't continue their human rights work,” said Matviychuk. “That's why for the current moment we are overloaded with work, how to quickly document war crimes.”

Another documentation group, Truth Hounds, which has conducted forensic investigations of international crime scenes across Eastern Europe since 2014, is facing the same problem.

Both organizations have recruited new volunteers to help, but training them in documentation methodology is no small task. “We had to literally work days and nights to be able to do this,” said Maryna Slobodnyuk, an investigator with Truth Hounds.

Dmytro Koval, a human rights legal expert and Associate Professor at the National University of Kyiv-Mohyla Academy who works with Truth Hounds, says new limitations on investigations in the active war zone mean investigators are focusing more on collecting open source information to provide leads to pursue interviews with witnesses. “Since we don’t have access to the battleground, the places where the alleged violations were committed, we have to at least interview victims and witnesses,” says Koval.

A maturing global network

While the hardiness of the Ukrainian government and civil society effort to document war crimes is apparent, a growing global community of organizations has also directed its considerable resources at Ukraine. Some of the organizations in this loose coalition cut their teeth in the 2014 Russian invasion, or have experience working together in Syria, another war that has produced a volume of Russian war crimes, and elsewhere.

Hadi Al Khatib, Executive Director of Mnemonic, an organization that houses archives of human rights abuses in Syria, Sudan and Yemen, says the maturity of this coalition means it was immediately ready to address the latest crisis in Ukraine. “These years of experience resulted in us being able to act in a very concrete way when it comes to the invasion in Ukraine right now,” explained Al Khatib.

Mnemonic was able to almost immediately provide technical infrastructure for international and local human rights groups documenting and archiving material. He also points to improved protocols and verification procedures as key to helping ensure the information collected is valuable to accountability efforts in the future.

One key development that Al Khatib points to is the creation in 2020 of the Berkeley Protocol on Digital Open Source Investigations, a set of standards and a practical guide to the collection and use of open source information in the investigation of human rights violations. The protocol covers everything from ethical principles and legal frameworks through to each stage of the open source investigation cycle.

Lindsay Freeman, Director of Law and Policy for the Tech and Human Rights Program at the UC Berkeley Human Rights Center and one of the authors of the Berkeley Protocol, is helping groups in Ukraine standardize their efforts and adapt and apply the protocol in this specific situation. “I've seen huge improvement in how people are able to jump in and start doing this work and how groups are already set up to do the intake and to have a methodology for the tagging,” Freeman said.

It also helps that some of the behaviors of the principal actor fit patterns that have been observed before. The Atlantic Council's Digital Forensic Research Lab (DFRLab) put together comprehensive records of the siege of Aleppo, for instance, including how the Russian army targeted civilians and aid workers, bombed hospitals, and used similar seige tactics as those underway in Ukrainian cities like Mariupol. “What we're seeing unfold right now in real time is a very real war with its real human cost, human tragedy; and the same Russian playbook that we've seen in any number of other domains and in any number of other events for the last six years plus,” said Graham Brookie, senior director of DFRLab.

Such pattern recognition means seeing linkages sooner, which could lead to understanding issues like chain of command, direction of firing, identification of specific military units, munitions markings, detailing any chain of custody in handling the evidence and other details and elements that could hasten prosecutor’s jobs. Steve Kostas, a lawyer with the Open Society Justice Initiative, which is part of the Open Society Foundations, says this is evidence of the progress the community has made since the Syrian conflict.

“Already at this very early stage, groups are thinking about linkage evidence much, much earlier than they have in the past,” said Kostas. “So thinking about these chain of command questions, the unit location, direction of firing… I mean this is sort of information that in the Syrian context, nobody looked at for years after the events.”

Another factor that may help propel investigators and efforts at accountability is the number of Russian soldiers – presumably including Russian officers – already in Ukrainian custody. “We might see here a different timeline than what happened in Syria in terms of cases taking forward, especially with Russians that are involved in the invasion of Ukraine right now that are captured, for example,” said Al Khatib. “So they could be on trial very soon. This is something that is very different from the Syrian context.”

There are other advantages to a more mature community of professional organizations. Hadi Al Khatib points to efficiencies that come with more clarity on the roles and capacities of different groups, while Graham Brookie points out that collectively groups have been able to share what they have learned about how to deal with issues ranging from the vicarious trauma experienced by analysts to security and technology issues.

The Bellingcat Investigation Team, which consists of volunteers and full time investigators, is documenting and logging incidents of civilian harm in Ukraine. Click here to view this map in its original, full screen format. (Courtesy Bellingcat)

Some Friction

The scale of the conflict in Ukraine has invited new organizations and individuals who seek to participate in the documentation effort. A number of the experts interviewed for this report underscored that there is more than enough work to be done, so newcomers are welcome.

“Hundreds of people in different countries are now working on gathering and verifying massive proof of war crimes,” said Dmytro Zolotukhin, an expert on open source investigations, a lecturer at Kyiv-Mohyla Academy, and a former Deputy Minister of Information Policy for Ukraine. "But there are risks to relying on less experienced groups.”

“For a lot of the new entrants, whether it's formalized efforts, or group projects, or just individual voices, we're all learning a lot about the reliability, backgrounds, potential slants of some of those groups,” said John Scott-Railton, senior researcher at the Citizen Lab at the University of Toronto's Monk School.

Eliot Higgins, founder of the open-source investigations organization Bellingcat, says a key factor is to figure out how to bring new people into the system in a way that makes their output useful to investigators, whether they are doing journalism or accountability work. “It's more kind of an organizational issue,” he said. “There's such a vast amount of data out there.”

When it comes to meeting the evidentiary standards for venues like the International Criminal Court, Steve Kostas says this will be a test for the community. While there has been a great deal of learning and effort put into capacity building around the gathering of open source evidence, there is less experience with using it in legal proceedings.

“The Berkeley protocol and the methods that people have been employing haven't really been put to the test at many proceedings yet,” said Kostas. “So I think it's on civil society and government donors to make sure that the methods that we're setting up right now are pre-screened and look like they will stand up in court.”

To date, user-generated video and photographic evidence has been used by war crimes prosecutors on a limited but increasing basis. Those include obtaining an arrest warrant for a militia leader in Libya (in the ICC’s case of Mahmoud Mustafa Busayf Al-Werfalli), securing the ICC’s first guilty plea (in the case of Ahmad al-Faqi al-Mahdi of Mali), and trials for outrages on personal dignity and other inhumane treatment in Germany, Finland, and Sweden. The Netherlands prosecuted a case involving war crimes in Syria that included evidence from YouTube, Facebook, Instagram, and Twitter.

In gathering evidence including witness testimony in Ukraine, groups that are new to the work or that are working with volunteers who have had minimal training may introduce risks. “My first concern is whether there are strong enough security protocols in place to protect those being interviewed,” says Rebecca Hamilton, an Associate Professor at American University who previously worked in the Prosecution division at the International Criminal Court. “My second concern is that testimony gathered in the midst of a crisis may not be usable by prosecutors, who have their own set of guidelines they need to follow.”

Knowing the difference between the evidentiary standards required by a criminal court, as compared to a group wanting to raise public awareness or do human rights advocacy, is crucial, agrees Berkeley’s Freeman.

“I've found that there are a lot of groups who say they're collecting for legal accountability, but they don't have lawyers,” says Freeman. “They're not necessarily following the very strict procedures that are required by many criminal courts in order to protect the rights of the defense, which is an important thing that collection for other purposes really doesn't take into consideration.”

In addition to the challenge of ensuring the quality of the documentation, the sheer quantity of information being collected presents another challenge. Last month the International Criminal Court opened a portal through which civil society groups could submit potential evidence. And Kateryna Busol identifies a number of similar initiatives in Ukraine: “There are separate portals created by the Office of the Prosecutor General, and then the one announced by the Office of the President, and there's also another specialized portal announced by the Ministry of Culture inviting to submit evidence of the violations concerning the cultural heritage of Ukraine.”

This proliferation means that those doing documentation may try to upload their evidence to multiple locations, which could raise chain of custody concerns for criminal courts. Different portals may also have different evidentiary requirements, further adding to the workload of documentation groups. “I'm expecting that in a week or a month we will see the merger of these initiatives, or at least that there will be certain clarification as to how they function,” said Busol.

Other experts are less confident. “We are witnessing a massive over-collection of material without the systems in place to coordinate how that material is actually going to be used,” says Hamilton. “Documentation is not an end in itself,” she added.

The Citizen Lab’s John Scott-Railton raises further concerns about volume, particularly with regard to video. “How do we even gather information about the kinds of videos that are being seen? How do we do it at scale? How do we process that content?” he asks.

Role of tech firms

Ukraine is not only a test for the community of human rights and open source investigators. It is also a test for social media platforms, which play host to vast volumes of material posted by users on the ground, including citizens and soldiers. While some of the experts interviewed for this report suggested tech platforms have generally made nontrivial progress, there is a sense the firms still have not fully grasped the nature of the responsibility they have in these conflict scenarios.

Lindsey Freeman says that while the tech platforms appear to have more political will to engage on these issues, they are still setting their own rules and policies, and changing them as they see fit. She believes the tech platforms need to do more to create working relationships with civil society, particularly beyond working with only major international NGOs. One option is for them to provide direct channels of communications with vetted local organizations and networks.

“There are a lot more channels for civil society to connect there, but I still don't think it's everyone, and not necessarily equal,” said Freeman. “The big international NGOs like Human Rights Watch and Amnesty International have much better connections there than local NGOs. And especially, when a new conflict starts, it's not necessarily going to be the Ukrainian or Afghan or Ethiopian local NGOs who will have any idea how to connect to those tech companies.” That’s because of the difficulties of communicating with the companies and the firms’ lack of engagement with the local actors.

Of course, the main challenge for investigators is the loss of content, which is often taken down by content moderation algorithms or human moderators. For years, activists have asked for “evidence lockers” and other means to preserve content from conflict zones. Amre Metwally, a former member of YouTube’s content policy and enforcement team, has written about the “highly dependent dance with the tech titans: a policy change, an enforcement modification, a poorly trained moderator, an imprecise detection algorithm, an inadequate appeals mechanism can all lead to the erasure of material.” He advocates for platforms to establish a common “trust” to which users in conflict zones could flag content.

The Oversight Board, the quasi-independent entity set up by Meta to hear appeals of content moderation decisions on Facebook and Instagram, has invited public comment on a case related to an incident in Sudan that queries “[w]hether Meta’s policies on violent and graphic content provide sufficient protection of users documenting or raising awareness of human rights violations.” In its decision, the Oversight Board may make non-binding policy recommendations to the company on issues such as how “Meta’s content moderation, including the use of automation, impacts freedom of expression and documentation of human rights violations during a conflict, and how negative impacts may be prevented or mitigated.”

For Bellingcat’s Higgins, the answer is simply not to rely on social media platforms at all. He advises setting up systems to ingest as much content from the platforms as soon as possible.

“I mean, there's always an issue with moderation that if you've got material from a conflict zone, it's showing bodies and terrible things, that some of that content is going to get removed,” said Higgins. “People remove content themselves, and we can't expect the social media companies to give us special access to stuff users have removed themselves. So this is again why archiving from day one is so important that we grab this stuff before it goes.”

Mnemonic’s Al Khatib believes certain platforms could do more to provide access to select human rights watchdogs to acquire relevant data, such as providing access similar to that provided to academic researchers.

“There is a lot of content published about Ukraine on Twitter,” said Khatib. He’d like more capacity to archive user tweets than is available through the platform’s public interface. “We absolutely need more capacity to be able to archive more content from certain users that are very active documenting the conflict. We reached out to Twitter about this, and this was not possible for human rights organizations yet. It's possible for academic institutions, but not for the human rights community, which is really disappointing, especially after 10 years of doing this work in Syria and in other countries.”

[wpdatatable id=9]

Looking forward

Before such ambitions can be realized, the war may have to be won. But in the longer term, one way or another the current conflict in Ukraine will eventually represent only one point on the timeline of the evolution of digital investigations of conflict and war.

Last week, the U.S. Ambassador-at-Large for Global Criminal Justice, Beth Van Shaack said, “It’s also extremely important to continue to document what’s happening on the ground to preserve that information as potential evidence for future accountability purposes. We don’t want to lose that evidence.”

The experts interviewed for this report argue more funding is needed to train individuals and organizations and to build more human and technical infrastructure to reliably do this work in future. That might require nations investing in a shared capacity, perhaps, in the United Nations or through another mechanism.

“That means the states investing way more in the ICC,” said Lindsay Freeman. “For a case like Ukraine, it means investing way more funding into NGOs like Mnemonic that already have a proven, tested model where they can build these archives. And I think ultimately, having a permanent independent investigative mechanism, similar to the models that they've used in Myanmar, Syria and Iraq– having something permanent that's already set up is the long term answer to this.”

Bellingcat’s Eliot Higgins imagines “a network of investigating bodies who are kind of working independently of each other, but able to share information with each other,” potentially through some “centralized indexing system.” The goal, for Higgins, is to see more “real world cases where open source evidence has played a role, especially at places like the International Criminal Court, where there's always already an interest in it.”

It’s not only the investigators of war crimes that are looking into the future, of course. The perpetrators are evolving their behaviors and capabilities as well. One key area of concern is the use of disinformation campaigns and tactics to deflect blame for crimes.

“There is a real need to build up verification capacity within civil society and journalists covering the conflict, just because in the Syrian context many of the narratives that were subject to the greatest amount of disinformation are about Russian linked crimes,” said Steve Kostas. “And I would expect that to be even more the case in this conflict– covering the tracks or muddying the waters about what is actually happening.”

There will also be a perpetual need to improve cybersecurity for the individuals and organizations engaged in investigative work, including the portals and databases used to collect and store evidence. “The security of the new portals is something that has to be monitored and enhanced all the time,” said Kateryna Busol.

In the current conflict, the Ukrainian government is doing its best to protect web resources related to the collection and publication of information on war crimes. Viktor Zhora, Deputy Head of the State Service for Special Communication and Information Protection of Ukraine says his office has observed these resources being mentioned as hacking targets in Russian Telegram channels.

“This activity is structured, is organized, and we see attempts to hack the web resources that publish information on war crimes,” said Zhora. “Of course we put our efforts on protecting these websites.”

For those working in the field, there is at once hope that there will be accountability, and yet frustration at how hard it is to achieve. Those on the frontlines in Ukraine right now feel this acutely. Oleksandra Matviychuk describes the pain of learning of such a high volume of terrible crimes and not being able to stop them.

“You speak with people who tell you how they were beaten, raped, whose fingers were cut, whose eyes were pulled out with spoons, and tortured with electricity,” she said. “And you know for sure, this will repeat tomorrow, the day after tomorrow. In this same second, somebody is being tortured in the same way. So international justice, unfortunately, is delayed in time. And it's important to document war crimes and to build very strong evidence and a very strong legal case. But now we also need to solve a much more difficult task: how to stop these war crimes in the current moment.”

Reflecting on his decade doing this work, Hadi Al Khatib thinks first of the people who have put their lives at risk – the people who have died – to gather the evidence in the archives he has helped to create, from Syria a decade ago to Ukraine today.

“Whatever international organizations or institutions are going to bring when it comes to justice, it won't happen without the involvement of the people capturing this evidence,” he said.

April 8, 2022: This article has been updated to include a reference to the Dutch judicial system's reliance on OSINT in the prosecution of war crimes arising out of Syria.