In the first hours of the Russian invasion of Ukraine, internet watchdogs pored over images shared on Russian media that claimed Ukraine struck first and Russia merely responded.

The Biden administration has been warning for weeks that, in the days and hours leading up to the invasion of Ukraine that arrived before dawn on Thursday, Russian sources would release “false flag” photos and videos to make it appear that the Ukrainian military attacked Russian forces unprovoked.

To understand how these investigators do their work, you should first understand a few basics.

Understanding metadata

Everything created on a digital device — whether it is a smartphone, a laptop or tablet — includes a digital fingerprint that rides with the file. That digital fingerprint, called metadata, sticks with the document — whether it is a video, photo, spreadsheet or other document — until somebody or some program removes it.

Let me give you an example before we explore images from the Russia/Ukraine border.

I took a photo of my office at Poynter. When I pull that photo into a metadata viewer like the one shown below, you can see the data behind the file. The data shows that I used my iPhone 11 Pro Max to take the photo on Feb. 22, 2022, at 11:56 a.m.

(Al Tompkins/Poynter)

You will also see that my phone embedded my latitude and longitude in the metadata. It says the phone was pointed toward the west. Drop the latitude and longitude into Google Maps and you will see precisely where I was standing when I took the image. The tag is correct within about 50 yards.

(Screenshot/Google Maps)

Metadata isn’t foolproof

It is possible to change metadata. I could pull my photo into Photoshop, for example, and edit the metadata to make it appear that I was anywhere else I could dream of. Think of metadata as a clue and not an ironclad answer. That is why it is important to triangulate metadata with other elements to debunk or confirm an image.

If I shared that photo on Twitter or Facebook, those social media sites would not pass along the metadata. But there is a social media platform called Telegram that is very popular outside of the United States because of its speed and its functionalities, which include encrypted video calling.

Telegram has another unique quality: It does not remove metadata on videos and photos that are shared on it. So, it is possible to easily find out where images or videos from Telegram were captured.

Metadata in action

Let’s apply this technique to a video that the Russian news agency Tass ran on-air and online.

Tass said that five Ukrainian soldiers had crossed the border into Russia riding two armored personnel carriers. It just so happened, Tass reported, that the intruders were wearing helmet cameras and rolling video when they attacked Russian soldiers and the Russians killed them. The video had been posted on Telegram, and the metadata indicated it was not actually from inside Russia but instead from the occupied area of Eastern Ukraine.

That detail is critically important because, if the metadata is accurate, it indicates that the video was not an attack inside of Russia that would justify a counterattack.

The metadata indicates the armored vehicles were blown apart very near another alleged attack by Ukrainian forces against what was reported in Russian media to be a Russian military outpost. The metadata of those two images map to a location five farm fields away from each other.

All of this evidence would seem to indicate that both images are at least questionable. The metadata does not match the claims, and skeptics believe they were both staged — or “false flag” — attacks meant to make Ukraine appear to be the aggressor.

Bellingcat journalists lead the way in using forensic analysis like metadata to verify or debunk images and videos. Bellingcat posted a spreadsheet showing the date and content of the footage and provided an analysis of what debunkers have found.

(Bellingcat)

Bellingcat reported:

In another illustrative case from February 20, a pro-Russian militia from Luhansk posted a video to its Telegram channel claiming to show a man in the village of Pryshyb whose leg had to be amputated after shelling by Ukrainian forces.

This video includes an initial clip of a man on the ground allegedly at the scene of his injury. A man is then shown in hospital where he is said to be recovering after an amputation.

Although it cannot be established that these two men are the same, the video appears easily disprovable as the man’s prosthesis seems clearly visible in the initial clip (hence his leg had already been amputated).

In addition to examining metadata, researchers look at the smallest details to see if they add up. For example, on Monday, Russian media said Russian President Vladimir Putin scheduled an emergency Security Council meeting after leaders of two contested regions in Eastern Ukraine requested Russia recognize their independence. Russian TV showed Putin signing an action doing just that.

It seems like Putin is showing a pre-recorded conference… the time on this guy’s watch ~ 5 hours agohttps://t.co/8MY1Ln1Vze

— MaKin (@KiarKini) February 21, 2022

But debunkers noticed that people in the video were wearing watches. The Security Council meeting reportedly took place at 5 p.m. local time, but the watches all read noon. And watches at the signing ceremony read 10:15 a.m., so either everyone had the wrong time, or the signing took place before the Security Council meeting. In other words, it was all cinema.

Be careful

While doing this kind of debunking work, journalists and other researchers should be careful not to overstate the certainty of what they undercover.  For example, while I have cited inconsistencies in state media claims and the misaligned metadata behind videos and photos, we cannot say with certainty who captured the video and who posted it. But the fact that Russian government media is running it and claiming definitively that it is proof of Ukrainian aggression makes it important enough to question.