The Evolving Role of OSINT
New tools, data analysis methods and inter-agency collaboration are boosting use of open sources in war crimes justice processes.
Also see
Russian Soldier Appeals Life Sentence for Murder
Serviceman confessed to the crime but now hopes to secure a lighter punishment.
In March 2022, during the occupation of the village of Dovzhyk in the Chernihiv region, Russian soldiers took three brothers - Yevhen, Dmytro and Mykola Kulichenkos – to a nearby wood where a grave had been dug for them.
They shot one after the other and left them for dead. Despite a gunshot wound to the face, one brother – Mykola– survived.
“I was on my knees,” he recounted. “When they fired at me, I jerked my head aside. The bullet entered my cheek and exited behind my ear. I collapsed and they kicked me into the pit with their boot.”
Mykola had overheard the execution order issued by a Russian soldier with the call sign Zakon (Law). Later, when the region was liberated, he shared this information with Ukrainian investigators.
The Ukrainian human rights organisation Truth Hounds conducted a parallel probe into the case, drawing on a video recorded by a local resident in which a Russian soldier with the call sign Zakon addressed civilians while wearing a balaclava. Using open source investigation techniques (OSINT), researchers identified him as Colonel Konstantin Smirnov, chief of military police for the Central Military District of the Russian Armed Forces.
From other videos of Smirnov sourced online, they performed an audio analysis that confirmed matching phonetic patterns.
They also identified the subordinate who directly carried out the execution order: Russian serviceman Denis Podgorny.
As a result of the collaboration between Truth Hounds and prosecutors, on February 3, 2025, Smirnov and Podgorny were found guilty in absentia of violation of the laws and customs of war combined with premeditated murder and sentenced to life imprisonment.
The role of OSINT in war crimes investigations has evolved dramatically since the onset of Russia’s full-scale invasion, according to Bohdan Kosokhatko, head of investigations at Truth Hounds.
“The requests we received from law enforcement in 2022 are very different from those coming in 2025–2026,” he explained. In the early stages, inquiries often focused on basic identification – for instance, establishing the name, date of birth or any other lead from the photo of a suspect. Over time, however, these requests had grown far more sophisticated.
“Today, we frequently receive preliminary dossiers with some information already compiled, where the task isn’t starting from zero but rather deepening and verifying the details,” Kosokhatko said.
He attributed this progress to the rapid development of OSINT tools, with new social networks, data analysis methods, facial recognition technologies and AI-powered products, services and apps emerging constantly.
“In the past, we had VKontakte and Odnoklassniki for searches,” he continued. “Now TikTok, Facebook and Reddit are widespread. The Russians have launched their own messenger, Max, and Telegram has expanded dramatically. As a result, the number of tools, resources and possible combinations for tracking down individuals has grown accordingly. All of this is expanding in geometric progression every day.”
Since the onset of Russia’s full-scale invasion, investigators from Ukraine’s Security Service (SBU) have been conducting pre-trial investigations into alleged war crimes including Russian shelling of civilian infrastructure, mistreatment of Ukrainian prisoners of war, torture of civilians and deportations
“In the course of these investigations, digital (electronic) evidence is utilised, including photographic, audio and video materials, as well as computer data. Investigators also apply OSINT analysis,” SBU spokesperson Artem Dekhtarenko told IWPR. “When collecting, documenting, seizing, storing and using such digital evidence, SBU investigators adhere to the requirements of Ukraine’s Criminal Procedure Code.”
All information must meet evidentiary standards, a spokesperson from Ukraine’s Prosecutor General’s Office emphasised.
“The use of OSINT in war crimes investigations significantly enhances the ability to identify suspects and reconstruct events,” the spokesperson told IWPR. “Yet it is precisely during court proceedings that open sources encounter the stringent demands of criminal procedure. Ukrainian law does not specifically address the admissibility of evidence derived from open sources, meaning that information gathered via OSINT methods must be assessed under the general provisions of Ukraine’s Criminal Procedure Code.”
Kyrylo Puhachov, head of the department for Prosecuting Crimes Committed during Armed Conflict at the Chernihiv Regional Prosecutor’s Office, agreed that the identification of a suspect was only part of the challenge.
“Identifying the accused in the courtroom - even if their identity was established during the pre-trial investigation - requires convincing proof that this specific serviceman was in a particular place at a particular time and carried out the actions that constitute a war crime,” he told IWPR.
At the trial stage, Puhachov noted, the key issues were “assessing the admissibility and reliability of evidence, proving the accused’s personal involvement in the crime and establishing their intent”.
Consequently, the court must verify the authenticity of materials, the legality of how they were obtained and the credibility of witness testimonies - a task that is often technically and procedurally complex, especially amid an armed conflict.
Prosecutors ensure their admissibility through formalised documentation, such as examinations of web pages, social media posts and video files. These actions result in protocols that detail the date, time, URL addresses, technical parameters and content of the material. Only then can data from open sources gain the status of evidence in criminal proceedings.
“The difference between evidence gathered through traditional methods and that obtained via OSINT lies in the source of the information,” Puhachov continued. “Traditional evidence is collected directly within the criminal case - such as scene examinations or witness and victim interrogations. OSINT evidence draws from open and publicly accessible sources, including social networks, messaging apps, video platforms, satellite imagery, online media and official websites. OSINT materials are not evidence in themselves. They acquire evidentiary status only after procedural fixation, such as through examination protocols, expert analysis and incorporation into the case file.”
Law enforcement agencies investigating war crimes often receive crucial support from Ukrainian and international OSINT researchers as well as NGOs including Truth Hounds, Bellingcat, Global Rights Compliance and others.
There is no single international legal framework governing the admissibility of evidence uncovered by non-state investigators. For that reason, Kosokhatko stressed, reproducibility is crucial in OSINT cases.
“Investigators must be able to replicate the steps we took – visiting the same websites, reviewing the same videos, documenting it all procedurally and arriving at the same conclusions or perhaps different ones,” he said. “Only then will it become their own official finding.”
This approach aligns with the recommendations of the Berkeley Protocol followed by international investigative communities. Among the key requirements are the mandatory archiving of materials, documentation of the entire search process and preservation of file integrity.
“The pathway to discovering a specific photo or video must be recorded just as meticulously as the content itself. Only then can open-source information hold genuine evidentiary value,” Kosokhatko said.
At the same time, creative thinking has also been a decisive factor.
“Law enforcement agencies have their own tools and capabilities, along with a single perspective on any given case,” Kosokhatko continued. “We have our own tools and methodologies, which can yield slightly different results. But by combining our findings with theirs, we can build a more comprehensive picture. That’s the essence of collaboration.”
