Author: kjf

By @Doxsor

NOIR has taken part in an Al Jazeera investigation for the documentary The Search for Assad Executioners  (البحث عن جلادي الأسد), directed by Mahmoud Alken, which was aired on the 10 of May 2020. (The documentary is in Arabic, but has a lot of visualisation of methods. Also, see a 2 min sample of the documentary in English here). Al Jazeera is working on an English version of the documentary.

The documentary shows how Syrian state doctors and state-sponsored militias soldiers (Shabihas) have been torturing and killing Syrian civilians. And its show the investigation methods to track down some of these state-sponsored soldiers and doctors now posing as refugees in Europe.

In the investigation, NOIR and the other open-source investigators have worked together with a team of visual investigators to find the Syrian Shabihas (Syrian government militia soldiers), doctors and workers from the ‘601 hospital’ in Damascus, that fled to Europe posing as refugees. Furthermore, we have worked with a juridical team, which help to verify our findings together with the team from Al Jazeera. The research was led by Al Jazeera journalist @mmalken. The involved freelance open-source researchers were @PatrickHilsman, @MonicaCCamacho, @JettGoldsmith and @curieBosphorus.

Starting point: Two sets of lists

The investigation began looking at two sets of lists, namely a list of workers from the ‘601 hospital’ from Zaman Al Wasl Leaks and a list that came from a blog called unfetteredfreedom.wordpress.org, which suggested some of the Shabihas that had fled to Europe.

1. The Zaman Al Wasl Leaks shared a list of names of the workers from the hospital named ‘Hospital 601’ in Damascus on March 21 2019. This hospital was known to be a site of torture and killings, which have been documented by the photographer, known by the name Caesar, who smuggled out a large archive of documentation of the atrocities that had taken place at 601. Read more about the photographies in a report from Human Rights Watch.

2. Furthermore, unfetteredfreedom.wordpress.com published a list of state-supported militias (Shabiha) that were posing as refugees in Europe. This list has now been removed from the internet but was archived by our team. The list showed images of the individuals who were accused of entering Europe as refugees. These images showed on one side their war crimes, such as stepping on corpses and at the same time images taken from their new residents in Europe. Syrian Observatory for Human Rights has stated that some of the Shabihas are mercenaries. 

Example of geolocating an image

The following section will provide one of the techniques that were used during this investigation:

1. We focused on the image of the Shabiha soldier presented above, which claims that he had travelled to Europe. We managed to geolocate the image on the right by first finding the less cropped version of the image, then looking at the details in the image (restaurant, red, location of tree, tiles on the ground), then finding the restaurant name and finally that led us to the location in Turkey.
2. Afterwards, we were able to investigate an estimate of the time of the image by looking at the restaurant’s social media pages and comparing interior changes such as refurbishment and the instalment of an awning, that is visible in the image (Installed in between the April 23 and May 15 2015).
3. Thus, this resulted in finding  the exact position of the soldier and the time he had been in Turkey (between April/May 2015 until end January 2016.) The final date was set due to other images of him in Syria.

The investigations happened primarily by SoMe investigations and google searching. We used multiple different online social media, such as Facebook, Instagram and Twitter, to track down the Syrian state-sponsored personal in Europe. We used online maps to geolocate images to specific locations in Europe or Syria.

The Spiegel has also published an article about the documentary. The New York Times has also published an article of what happened after the documentary, where one of the doctors got arrested in Germany.

By @doxsor, NOIR

NOIR and Danwatch arranged a Bootcamp with Lighthouse Reports from Utrecht, Netherlands, between February 17 and February 21 (2020).

The Bootcamp occurred over a week in which seven media and broadcasting organisations met to investigate Scandinavian arms trades. The focus was to find any trades that have ended up in oppressive regimes or embargoed states. The media and broadcasting organisations taking part were TV2 (DK), SR (SE), VG (NO), Berlingske Tidende (DK), Danwatch (DK), NOIR (DK) and Lighthouse Reports (NL). Furthermore, Leone Hadavi and Youri van der Welde joined the research, who are both Open Source investigators. Here is a short biography about them:

• Leone Hadavi is an Open-Source investigator and analyst. He has an MA in War and Security Studies and an LLM in International Humanitarian Law, International Criminal Law of Armed Conflict. He worked as an intern analyst at the International Criminal Tribunal for the former Yugoslavia (ICTY), at the Extraordinary Chambers in the Courts of Cambodia (ECCC) and at the International Criminal Court (ICC). At the ICC he first started applying OSINT techniques to investigate the use of technicals by the Seleka armed group (From Bellingcat’s website).

• Youri van der Weide is an Open-Source investigator and trainer. He was part of the team that investigated a killing committed by the Cameroonian army (Anatomy of a killing, BBC), #SpanishArms by Lighthouse Reports (Arte, El Diario) and he often contributes to @Quiztime. Training included the investigative desk of Al Jazeera, Radio Liberty Georgia, workshops with Bellingcat in Africa. 

How the Bootcamp went
6 weeks before the Bootcamp representatives of the media organizations, Lighthouse Reports and NOIR established a preliminary research team of investigators, who met every week to discuss angles and leads for the Bootcamp. In this process, there was a representative from each country, who looked into databases, reports and articles about sales to oppressive or embargoed states.

Afterwards, all the investigators and journalists met up for 5 intensive Bootcamp days in late February. The first days, we were taught about skills, tools and methods to investigate the arms industry by Youri van der Weide. We got to know about how to track flights and marines through online open-source platforms (and paid platforms). All these insights became very useful in our investigations. We then spent the remaining time in mixed teams to further investigate the leads that the preliminary team had found.

During the workshop, we agreed on a day to publish all our findings, which has been postponed several times due to COVID-19, but Sunday, May 17, 2020, the results of the investigation were published. 

Another blogpost will follow about all the findings we did during the Bootcamp!

NOIR has recently worked together with TV2 on a case about forced labour in China linked to the danish brand Jack and Jones.

Text by @KatrineFriis

NOIR gave a tip to TV2 about a report from the think tank Australian Strategic Policy Institute (ASPI) that accuses the Chinese government of taking 80.000 ethnic minorities under conditions that strongly suggest forced labour.

The Danish brand “Jack and Jones” is in the report mention in the context with the two Chinese firms Esquel and Youngor, who are two of the firms, which is accused of forced labour. On the two firms’ websites, it says they are the subcontractor to the Danish brand and other global brands such as Calvin Klein and Nike.

The team behind the report used satellite photos, authority documents and material from the media to reveal that many of the ethnic minorities have been sent from “re-education camps” that is controlled by the Chinese government and highly guarded to work on the fabrics in the region of Xinjiang. It is part of their re-education of

NOIR helped TV2 to strengthen the link between the two Chinese firms and Jack and Jones. In the end, an article with the perspective on Jack and Jones was published at the beginning of March 2020.

OSINT guide: Learn how to use open-source intelligence methods to track a cargo ship and link firms together.

By @doxsor, NOIR

NOIR met with the TV2 journalist Emil Ellesøe Ditzel and discussed whether we could track a cargo ship, named Clipper Amsterdam, contained with biomass for the HOFOR BIO4 power plant, that was berthed at port some days before. The cargo ship had departed from Brazil, but we were not sure from which port and who had delivered the biomass. 

Brazil has gotten a lot of media attention after their president Jain Bolsonaro made it easier for the paper and biomass industries to get access to the nation’s rainforest, which has led to a significant increase in deforestation in the country. 

Methods to find the port

So, first we wanted to find what port the cargo ship laid in. First, we used google dorking around the internet to find the exact location, which is a way of writing search words in regards of being very specific of what you are actually asking the search engines.

1. Vessel Clipper Amsterdam AROUND(5) brazil
2. “Clipper Amsterdam” + “brazilian port” + Copenhagen

When we are google dorking we always use several different search engines (Google, Bing, Yahoo, Yandex), because they all give different results due to their difference in algorithms.

This led us to find the port – Santana port in Amapá

Now, we wanted to verify the link between the Santana port in Amapá and the cargo ship, so that we could be sure that this was the place the cargo ship departed from. We began looking at the port’s facebook page to see if any of the employees had taken any photos while the ship was in the port. Unfortunately, there was nothing to be found and we did not manage to find an Instagram account for the port to continue this search.

After going back to the search engines and continuing the google dorking, now in portuguese, because we wanted to find the brazilian port and find information about the brazilian company we found the website of the port.

1. “santana doca” filtype:br

We found the website of the port by translating to portuguese search and focussing on santana doca (port) and websites from brazil (.br).

On this website we confirmed that the ship had departed on the 27^th of October and had arrived in “Copenhagem” on the first of November. The spelling mistake in Copenhagen (with the ending M) had made it more difficult for us to find our way to the website. See below.  

Methods to find the cargo and company 

On the website where we found the information about the departures, we also found information about the company Amcel, which is a Brazilian biomass company based in Amapá. Furthermore, the overview showed that it was eucalyptus that had been shipped and that it was 32.734 ton of it. the cargo and the quantity of cargo. 

After this opening in our research we began looking into the company and quickly found the company’s name in an amazon watch report about land grabbing and other foresty violations, which led us to a series of papers about the trials on Amcel’s violations and land grabbings.

We spent our time analysing all these reports and quickly found both the lawyers prosecuting and Amcel’s lawyer in all of the cases. 

A month later we saw that there should be another delivery to Denmark by a cargo ship called, so Emil Ditzel and a TV2 film crew flew to Brazil to document the cargo ship being loaded and departing, conducting interviews with local farmers, which have experience land grabbing from Amcel and finally to confront Amcel about the accusations. You can read about all our findings and Emil’s interviews and documentation in articles on TV2.

Eksporteret våben fra EU-lande er ikke organiseret systematisk til en slutdestination, og der følges heller ikke op på, hvad våbene bliver brugt til, når først de er sendt afsted.

Derfor satte et team fra Lighthouse Reports og Bellingcat sig for at opbygge #EU-arms-projektet, der netop har til opgave at spore den endelige destination på eksporterede våben fra EU-lande.

Teamet bag projektet har allerede sporet pansrede køretøjer fra Frankrig brugt i Cameroons militær til at bryde med menneskerettigheder. De har også sporet tyske våben blive solgt til Saudi Arabien og Forenede Arabiske Emirater, der er blevet brugt i krigen i Yemen.

Sidstnævnte afsporing har #EU-arms open-source efterforsker og analytiker Leone Hadavi blandt andet været en del af. Og det er også ham, du kan møde på Berlingske d. 17. februar, når han vil gennemgå metoderne bag #EU-Arms-projektet.

Leone Hadavi har en kandidatgrad i krigs- og sikkerhedsstudier og en LLM (akademisk forskningsgrad inden for jura) i international humanitær lov, international kriminel lov for væbnet konflikt. Før han kom på #EU-arms projektet arbejdede han som intern analyst i Den Internationale Straffedomstol (ICC).

Sted: Berlingske Media, Pilestræde 34, København K

Tid: Dørene åbner 14:45 og oplæg starter kl. 15

Pris: Gratis, men HUSK tilmelding på dette link senest 12. februar

Sprog: Engelsk

Se begivenhed på Facebook her.

På Den digitale Graverskole 2019 har vi prøvet at tilrettelægge et program, der kommer rundt omkring de digitale, journalistiske processer, studerende kan møde. Graverskolen har derfor udviklet deltagernes digitale og visuelle egenskaber, som der er kommet disse udgivelser ud af.

View this post on Instagram

Holdet for Den digitale Graverskole 2019 består af 12 dygtige deltagere!

A post shared by CUJ RUC (@cuj_ruc) on Aug 14, 2019 at 7:05am PDT

Ekstra Bladet: Afsløring: Her er frimurernes optagelsesritual

En af vores seje deltagere på den digitale graverskole 2019 Andreas Wentoft har fået publiceret en vild graverhistorie om de danske frimurer, som er en loge, der har eksisteret siden 1743, og hvor flere danske konger har været leder af logen. Afsløringen er blevet lavet i samarbejde med os. Andreas fortæller selv:

“Graverskolen har virkelig inspireret mig i forhold til forskellige måder at fortælle en historie. Det har jeg helt klart brugt til at formidle frimurernes optagelsesritual.”

Zetland: Er det bedst bare at glemme de 110 tons gift, der ligger begravet på stranden?

Den Digitale Graverskole 19 har også arbejdet med lange, digitale fortællinger. Det har en af vores deltager Ida Maria Kristensen taget til sig, da hun lavede en fantastisk historie om et giftdepot, som påvirker et helt lokalområde, men som ingen vil tage ansvar for at fjerne. Ida fortæller selv:

“Det var især det fortællende element, graverskolen har været med til at inspirere mig med. Jeg har både trukket på besøget af den internationale underviser Mark Kramer, og det at sætte en digital fortælling op, som vi har fået hjælp af Rasmus Fahrendorff, til at få den her fortælling hjem.”

Berlingske: To år efter Kundby-pigen blev dømt, er hun tilbage i rampelyset: »Vi viser en person, som virkelig er i lort op til halsen«

Deltagerne på Den digitale Graverskole har også fået undersøgende værktøjer med hjem. Peter Thomsen tog meget hurtigt dette til sig, da han sideløbende med en af skolens kursusdage om research på sociale medier, arbejdede med en artikel om de etiske dilemmaer ved at lave teater om den terrordømte Kundby-pige til Berlingske. Peter Thomsen fortæller:

“Forud for undervisningen havde jeg allerede brugt et par timer på at finde en helt central person i forløbet, som havde ændret navn på sociale medier efter terrorsagen, men uden held. Efter den éne kursusdag, fandt jeg en central personen på fem minutter . Det understreger i virkeligheden, hvor hurtigt man kan omsætte graverskolens undervisning til noget brugbart.”

Information: Selvmord i LGBT-samfundet

Graverskolen fik i en weekend også besøg af den internationale underviser og grundlægger i ‘narrative journalism’ Mark Kramer. Her underviste han i den gode fortælling med udgangspunkt i deltagernes egne historier. Dette gjorde deltageren Jeppe Kanstrup Jørgensen i særdeleshed brug af, da han skulle fortælle historien om den høje selvmordsrate i LGBT-samfundet. Jeppe beskriver selv:

“Jeg brugte i særdeleshed de fortællermæssige greb, vi har lært især fra Mark Kramer, til at fortælle en vigtig historie. Derudover var min mentor en medvirkende faktor til, at jeg blev udgivet.”

Ekstra Bladet: Svindel i Forsvarsministeriets Ejendomsstyrelse

Den digitale Graverskole 2019 startede med en bootcamp på Møn i fire dage. Her stod den blandt andet på aftenoplæg fra diverse undersøgende journalister i Danmark. Vores deltager Mikkel Ryrsø bed ikke mindst mærke i Mathias Friis fra DR’s undersøgende redaktions oplæg om hans metoder bag ‘Sagen om Dan-Bunkering’. Det har han brugt som inspiration til hans historier om Forsvarsministeriets Ejendomsstyrelse. Han fortæller selv:

“Jeg har ladet mig inspirere lidt af Mathias’ systematik i Excel. Den systematiske tilgang har jeg brugt mere generelt i komplekset omkring FES som helhed og den måde, jeg har startet dækningen op på og fortsat kører den. Så det har tjent som en generel inspiration, mere end det har været helt specifikt.”

MedWatch/Finans: Enochian sletter ros: Central forsker er ikke længere et geni

På den digitale graverskole blev deltagerne også undervist af DR journalist Louise Dalsgaard i to dage om, hvordan man knækker koden til at bruge sociale medier som undersøgende værktøj. Med i baggagen fik de tips og tricks, som Peter Thomsen også har anvendt i historien om, at topchef hos Biotekselskabet Enochian Biosciences trækker udtalelse tilbage om, at medstifter af selskabet er geni. 

Denne side bliver løbende opdateret.

By Daniel Oxholm

This is the first blogpost from NOIR and is made as a response to the first @Quiztime quiz I made some weeks ago. The quiz was about a danish CV90 on a lorry going west toward ‘Antvorskov Kaserne’ close to Slagelse. 

@Nixintel solved this quiz brilliantly and wrote a blog post that I recommend reading:

In this blog, I will give tips regarding methods to find military logos and camouflage, military vehicles, military airplanes, weapon and short about finding the military locations.

Military logos

Firstly, Google is very helpful to find the right troops logo that you are searching for. It might take time if you are looking for small military troops, but still, this should be possible.

Try searching for some different troops like English troops, which might lead you to a page like this one, which will show you many different options for your logo. 

If you already have an image of the logo that you are searching for, then you should go for a “reverse image search” on both Yandex, Google and Bing. Rule: Always check all the different search tools, which are available to you, it will increase your chance of getting more results.

If you are trying to find a specific type of camouflage and figure out which troop it belongs to, the page camopedia, is a good place to start.

Military vehicles recognition

Type of vehicle: You can do a reverse image search if you have an image of the vehicle. 

Make sure that you are looking at the right model and not an old model of the same vehicle. See, for example, this site, on licenses plate of the world: 

If you are trying to find a specific vehicle, then make sure that you get all of its unique characteristics; damages that have been done to the vehicle, unique logos, licence plate, numbers and camouflage layout. A good case to understand this is M17 by Bellingcat. See the article about this case here.

Military Airplanes

Airplane spotters: 

Try looking or asking for aviation spotters in the country or state, that you are doing your research in. Here are some examples. 

• FighterControl 
• Scramble – Dutch Aviation Society 
• Facebook page – Military Aviation Spotter 
• Facebook page – Danske Flyspotter (old page, but good example) 

Airplane tracking:

The main source for tracking airplanes is the online websites with overviews of airplanes movement. Global Investigative Journalism Network (GIJN) has made a very useful guide of how to use these websites – read this guide carefully!

Examples of websites to use are:

• Flightaware.com
• Flightradar24.com

Military weapons

I have not worked with this, but I think that Elliots (founder of Bellingcat) approach when he began his Brown Moses blog is still valid. Find and ask around until you get to know what you are looking at.

Another good source would be to follow @CalibreObscura and other arms researchers on Twitter. And remember to ask about weapons that you either don’t know or don’t understand!

Finding military locations

The method to find a specific location is mostly a mix of satellite images and maps. The two main sources are google maps, google earth, if you are without a budget – another good interactive map is Mapillary. When it has to do with military it is always good to consider what the strategy for a group or person in the image is, because this might tell you where they are, where they might have come from and the direction that they are heading. In the quiz about a danish CV90, the direction of the vehicle and the shadows of the vehicle, helped Nixintel find the E20 highway that is the only one running East-West in Denmark.

By Jannie Møller Hartley

Miranda Patrucic is the regional editor of OCCRP Sarajevo. In the afternoon of the second day, she gives her best advice on how to think about story-telling in stories based on large amount of data.

Miranda’s six ways of turning data-stories into real stories, that people want to read even if they are heavy with data.

1. Organisation: “Preparing to write from the moment, I start reporting.”
2. Structure: “Journalists are bad at structuring, but I use it to give my writing a backbone.”
3. Clarity and simplicity: “You want to make the complex simple.”
4. Voice and authority: “When you don’t have what you need, you write around it. But instead, use the writing to find the missing pieces.”
5. Use fictional techniques in non-fiction
6. Multimedia, digital and alternative forms of story-telling: “You don’t need all the details in your story or the whole research, pick out the bits you need to tell the story, some research might be better in a graph, that you present on a separate website”.

As an editor, Miranda has learned the hard way, that it’s important to force the journalists to think about the pitch of their story before starting. Too many stories are relevant but seem irrelevant or too complicated for users. Too few journalists ask the “so what question,” she argues.

“Think about why is my story important, who should people care about this?”

For Miranda a timeline is one of the most useful tools in her storytelling process:

“Once you have started, you should do a timeline, who are the central people, dates, important events and it gives and overview of the connections.”

A timeline is useful because it allows you to see the bigger picture in all the data, and it guides you towards the interviews and observations. But even then, when interviews are done, journalists need to ask themselves, what is the story here and then do more research.

“Think about the questions that arise out of the interviews and talk to the editors, or other trusted people.”

But even then, don’t start writing. Instead, Miranda says, start reading through everything. Find the quotes.

“What are the three major points, you want to make in your story.”

Finally, she notes four questions, you should always ask yourself as a storytelling journalist:

• What is the purpose of this story?
• What is the relevance to the reader?
• How big IS the problem?
• What are the competing interests involved?

By Katrine Juel Friis

The day began with BBC research specialist, Paul Myers, tools for a structured researched on Social Media and shortcuts for information.

Therefore, CUJ wants to share some of them.

1. Firstly, Facebook’s search box is not very efficient, so Paul Myers gave some different ways to search for persons on Facebook. The website findmyfbid.com helps you find a Facebook pages’ unique ID-number, which you then enter like this: Facebook.com/search/[ID-number]. See guide here, and also learn different customised sample searches.
2. Another website is peoplefindThor.com, but be careful with this, because it searches everything in the searched word.
3. Paul Myers also showed how powerful the Facebook Graph search generator stalkscan.com is. Try it out!
4. The website archive.is is good for finding past social media pages both on Facebook and Twitter, when looking for deleted social media accounts.
5. For analysing a particular Twitter account followerwonk.com and tweepsept.com are efficient tools.
6. Paul Myers also gave some advice on the research method ‘Reversed Images’. This is a method to search on specific locations of an image on google search. For example, you can have a photo of the person you want to research, with a hotel logo in the background, BUT not the hotel’s name. You can find the hotels name by Google search. But first you have to crop the photo to only the logo, and then you search on google pictures.
7. Another tool for this is Yandex – which you can also get as a plugin. It can do some of the same as Google search, but however, it also has facial recognition.
8. And then to the scary part. Because you can upload a photo on http://exif.regex.info/exif.cgi, and then it can display the photo’s metadata and geolocation. Then you can click on this, and go to google maps where you can use street view, to see if the picture has the same backgrounds as street view. 
9. To find someone’s location, you can also create a fake link on IPlogger.com.
10. If you want to find the domain for a website, go to either who.is, domainbigdata.com – where you can search on a specific name -and domaintools.com.
11. If you, for example, have someones email-address you can look it up at pipl.com, which is an amazing database of peoples data. 
12. And a scarily good way to track a location via a persons mobile phone is the website hlr-lookups.com.

There are more tools and methods on this page.

By Jannie Møller Hartley

In the afternoon we heard Ine Renson from the Belgium newspaper De Standaard presenting her experiences of how to include readers into your investigations. The project was to measure NO2 – a parameter of air quality (mainly traffic pollution, especially from diesel cars). They were able to show that pollution was linked to how the road was designed and street canyon effect, or if you have wind blowing in from the side. This made the air pollution dramatically different in places that were geographically close to each other. Here is what they went through – step by step:

1) The goal was to cover and collect data on pollution from the whole region – and the university (Antwerp) did the analysis of the data. People contributed by collecting data from outside their homes.

2) The journalist used this data and made an interactive tool, where you could zoom in and look at the results where they live, they named it “The biggest reality check ever”. Launching it as a huge campaign it had to become famous among a lot of people.

3) “It started with a special report on air quality – but we asked: how bad is it really? The measurement stations were placed in places, where people don’t live. Then we thought: There is no data, so we have to just find and collect the data”

4) They had no script, and they had to invent it as they went along. They found partners and collaborated with public officials and the University

5) “It was super expensive and complicated, we needed 20.000 entry points spread out over the country.”

6) “We had to make signs, manuals, deliver test tubes during a certain temperature, and you have NO guarantee of success. 96 percent of the data entries were valid.”

7) They have all the data on the website, and they published the stories over 16 pages in the newspaper.