How online investigators proved that the video of Ukrainian soldiers abusing a woman was staged

Deepen your understanding of digital investigation with our in-depth article that highlights how online investigators proved that a video of Ukrainian military abuse of a woman was staged. The article covers all aspects of the investigation, including analysis of video footage, use of geolocation data and analysis of social media to identify inconsistencies that point to staged play.

Fake video investigation

Dashcam footage shows a green car pulling up in front of the driver, who had just stopped on a country road. Two soldiers in a uniform similar to Ukrainian military uniforms drive up. One of them approaches the driver and scolds her for overtaking the military equipment: “Mraz, do you know the rules of the road? Didn’t you see the convoy?”. After hearing that she speaks Russian and checking her documents, he demands that she switch to Ukrainian and calls her a “pig”.

After she asks the soldier not to hurt her, there is a loud crash and the woman shouts, “What are you doing? I have a child!” The soldier then walks in front of the woman’s car and fires his weapon into the air before joining another soldier in a green car and driving past the frightened woman.

These are scenes from a video widely shared by prominent pro-Russian figures and their supporters on social media on March 27. The time stamp on the video recorder indicates the date of the shot was March 24, just after noon.

However, the facade presented by this footage began to crack as online communities tried to verify its authenticity. While the video shows soldiers speaking Ukrainian and allegedly wearing Ukrainian uniforms, geolocation shows that the video was actually shot in areas deep behind the front lines in Russian-controlled territory — territory that the Ukrainian military does not control.

This is not the first time that Russian and pro-Russian actors have created and promoted fake videos. Just two days before Russia’s full-scale invasion of Ukraine on February 24, 2022, Bellingcat debunked two such videos. One allegedly showed saboteurs attacking chlorine tanks, while another showed the aftermath of a staged IED explosion that allegedly killed civilians.

As the intrusion continues, online communities have moved aggressively and quickly to fact-check such claims.

“Think of yourself”

One of the earliest and most prominent posts about the video came from the Russian Embassy in the UK’s Twitter account, which highlighted the additional claim that the soldier identified the woman as Muslim and that gunshots could be heard in the video. Ukrainian soldiers out of frame.

Shortly after, the same video was released on Twitter of the Russian Foreign Ministry with the hashtags #Think4Yourself and #See4Yourself, with the caption “Once a Nazi, always a Nazi.”

While other media outlets cited a tweet by a pro-Russian Twitter user named Yuri Alekseich as the first source of the video (13:38 CET), Bellingcat discovered an earlier appearance (12:31 CET) on Two Majors, a pro-Russian Telegram channel that regularly publishes footage from the frontline in Ukraine.

It was accompanied by several paragraphs describing the video and noting that the woman was using a Muslim name and surname. The last paragraph draws further conclusions from this fact, stating that:

“The ideology introduced by Nazi battalions into all Ukrainian military formations is extremely simple: one nation, one faith, one language. Like the Third Reich, nothing new. This is very appropriate for the worthless enemy soldiers who have no idea that March 24 was the first day of the Muslim holy month of Ramadan. The video was then widely shared on pro-Russian social media and detractors of Ukraine on social media, garnering millions of views across multiple platforms.

The video was reported by several well-known Russian mass media, including “Izvestia”, “RenTV” and “Tsargrad”. Early reactions suggested that the footage, or the way it was presented by pro-Russian actors, was suspect. Users of Ukrainian social networks were quick to notice that video recorders have been banned in the country for almost a year to stop the spread of information about the Armed Forces of Ukraine.

Open source communities across the web have taken notes and attempted to geotag videos. The key piece of information for authenticating videos and photos is the exact location where they were stored. In the context of open source forensics, geolocation refers to the process of determining the location of an object, event, or person using publicly available information. This technique allows researchers to collect important spatial data, increasing the overall accuracy of the study.

To the east of Donetsk

On the evening of March 27, the Twitter account of GeoConfirmed, a volunteer community engaged in geolocation of video of the full-scale Russian invasion of Ukraine, published a branch with detailed geolocation of the video at 47.977044, 37.953754. Tatarigami, a Twitter user who says they are Ukrainian military reservists, also posted a thread that evening with the same conclusion.

This is an intersection southeast of Donetsk, the capital of Ukraine’s Donetsk region, occupied by Russia as the “Donetsk People’s Republic”.

This border area has been continuously occupied by the Russian army since 2014, so the “military convoy” the soldier mentions had to cross one of the most disputed and dangerous front lines in Ukraine and advance 30 kilometers deep into the Russian occupation. area before calling about this woman to catch up with him.

Later, Ukrainian blogger Anatoliy Shariy published a video on Telegram in which the video recorder shows a car driving from Donetsk to the specified area. The start of the video can be geolocated at 47.9712, 37.9288, on Komunistichnaya Street on the southeastern outskirts of the city.

It is not known how Shariy obtained this video or when it was filmed. However, these shots can be compared with the 2010 street shots available on Yandex Maps.

After that, you can follow the car’s path on satellite images until it reaches the exact point previously geolocated by the DVR on March 24. Matching elements like these tree branches make it clear that this is the same location seen in this stage video.

The Valkback

After the video was widely debunked, even pro-Russian commentators were quick to disavow it. On the evening of March 27, a well-known Russian military blogger, Rybar, added to the initial Telegram post a message that “the video turned out to be fake.” About two hours later, the pro-Russian Telegram channel Zapisky Veterana (translated as “Veteran Notes”) wrote that “the video is a fake. Our boys are not training well. In carrying out such information operations, they still need to study and learn.”

Two hours after the last post, pro-Russian Ukrainian politician Oleg Tsarev wrote on his Telegram channel: “Regarding the video that everyone posted. It seemed suspicious to me from the very beginning. But to write about something that is suspicious is to do a hostile business. And to share a video, which I doubt, is to mislead your followers. So I decided not to publish it.”

At the time of publication, a tweet from the Russian Embassy in the UK with the fake video is still online. However, underneath it, Twitter added a community note for authorized users that reads, “Intelligence reports from open sources have confirmed that this video was filmed in Donetsk territory, which is currently occupied by Russian forces, making it definitely a hoax, as there are no Ukrainian forces in the area,” referring to the mentioned GeoConfirmed thread.

If anything, this video illustrates the value of geolocation when it comes to verifying the authenticity of videos and the role of online communities in debunking misinformation. Sometimes, as happened here, some of those spreading false information may retract their misleading claims, though not all will.

The article was made on the example of the Bellingcat investigation