How I Became a One Man Intelligence Agency

Share this post

Eliot Higgins didn't start out thinking he'd become a one man intelligence agency, but once he started using his blog to track international activity through public social networks, that's exactly what happened. Now he's running a Kickstarter for Bellingcat, a platform for open source citizen journalism. We asked him to explain how he got into this field.

Al Qaeda has a Facebook Page: How I Became a One Man Intelligence Agency from the Comfort of my Own Home

In March 2012 I started a blog on Blogger, just as a place to record stuff I thought was interesting. I called it the Brown Moses Blog, after an online pseudonym taken from a Frank Zappa song that I had used for a number of years. I figured the only people who would be interested would be people who knew me from Twitter and the various forums I posted on. 

The Brown Moses Blog
The Brown Moses Blog

 I had worked in an administrative role for a company housing asylum seekers in the UK, and had spent the last ten years doing various administrative and financial roles. Within a year on the Brown Moses Blog I had exposed arms smuggling by Saudi Arabia to the Syrian rebels with the New York Times, identified and tracked the use of cluster munitions and the now notorious “barrel bombs” by the Syrian air force, and was increasingly being seen as being at the forefront of a new way to do journalism. 

 How did I do this? In a way it was something very simple. I took the vast amount of information being produced from Syria through social media channels such as YouTube, Facebook, and Twitter, and worked to establish what was reliable within this maelstrom of information. 

I developed an understanding of how social media was being used by Syrians. The “Houla Massacre” in May 2012 led to me realize YouTube channels were being set up by groups in different areas where they regularly posted videos from their local area. So, I began collecting these channels, some belonging to local civilians groups, others to armed groups, and started checking them on a daily basis for new videos, tracking the progress of the conflict in each area through those videos. 

What started as a list of 25 channels has now grown to over 1,000, with 100,000s videos posted by groups across Syria. While this information was growing in accessibility, the important question was (and still is): Can we trust it? 

I started looking for answers. Using a variety of open source tools and techniques it was possible to examine and verify the content of many videos. For example, with satellite map imagery available on sites like Google Maps I was able to confirm the locations videos were filmed by comparing the landmarks in the videos with what was visible on satellite maps. Facebook pages used by groups in Syria could be used to crosscheck claims made by other groups. As time went on I refined and expanded the processes I used. The most incredible thing is that the tools and resources I was using to do these investigations were all available online to anybody, and I realized in theory anyone could do these sorts of investigations.

Speaking to Channel 4 News
Speaking to Channel 4 News

I began to establish myself as a unique source of reliable information about the conflict in Syria. In October 2012 I began to track the use of cluster munitions by the Syrian government for Human Rights Watch, when the Syrian government denied they were using them. At the start of 2013 I began to see four weapons appearing in videos from the south of Syria I had never seen before in the conflict. Using a variety of resources I was able to establish they were all linked to one country, Croatia, and going to moderate opposition groups, mainly in the south of Syria. I took this and the dozens of videos I had collected to the New York Times, and a team of journalists used this information in an investigation that showed that the Saudis were providing weapons they had purchased from Croatia to the Syrian opposition. 

 These two pieces of work, plus others, began to make it increasingly clear that these investigative tools and techniques could be used by established organizations in a variety of fields to great effect. It wasn’t until August 21st 2013 that organizations really began to take notice. 

In the early hours of August 21st, 2013 reports of a chemical attack in suburbs of Damascus began to appear on social media channels. Dozens of videos from the reported attack sites began to be posted and shared. Using the tools and techniques I had developed over the past year and a half I began organizing and examining the information. I had my list of hundreds of YouTube channels from across Syria, so I found the channels posting videos from the locations attacked, and collated them into a playlist I shared with hundreds of journalists from across the world, as well as chemical weapons specialists I had contacted in relation to previous attacks. 

One of the rockets used on August 21st
One of the rockets used on August 21st

When images of the munitions used started appearing no one was able to recognize them, but I immediately realized they were the same type I had seen used in a previous alleged chemical attack in nearby Adra, Damascus, on August 5th. I was also able to find the exact impact locations of some of the rockets recorded by the opposition in the areas involved in the attack. Locals began to send me measurements of these mysterious rockets, which were used in a later Human Rights Watch report on the attacks. In the following days and weeks, using nearly exclusively sources like YouTube, Facebook, and Twitter, I was able to gather detailed information on the attacks, from areas inaccessible to foreign journalists. 

Much of the information I gathered would later be confirmed in the September UN/OPCW report. Then NPR journalist Andy Carvin described me as the “Nate Silver of Syrian munitions.” When the US government’s report into August 21st was published many journalists noted that they could find much more detailed information on my blog than what was being provided by the US government, something that seemed to highlight a disconnect between what people were increasingly coming to expect to see in situation like this, and what governments were providing. 

What was becoming clear was that more and more groups were interested in using this open source content for gaining a greater understanding of what was happening in conflicts across the world. The issue was not many people actually knew how to do it, and not everyone who was doing was getting the recognition and support I felt they deserved. 

This is where the new website I’m Kickstarting, Bellingcat, comes in. One big hurdle I’ve come across is getting people to engage with the tools and techniques that have been developed. It’s one thing to make a video, do a presentation, or write an article about the tools and techniques, but another to get them to actually use them. 

Using Meedan's Checkdesk to examine the remains of flight MH17
Using Meedan's Checkdesk to examine the remains of flight MH17

With Bellingcat I’m bringing together writers who produce great work from open source information and emerging writers who want to learn about the tools and techniques themselves. Already we’re using Meedan’s Checkdesk to involve people with the investigation into the remains of flight MH17, downed in Ukraine. Collaborative investigations have also been used to verify images posted on social media of the Buk Missile Launcher linked to the downing of flight MH17, allowing us to track it’s movements on July 17th through rebel held territory

Future projects involve working with the OCCRP and Hacks/Hackers London on tracking cross-border crime and corruption, using databases available online after the success of the OCCRP’s Investigathon, something we hope to expand to other cities across the world in the future. 

What these projects demonstrate is another key aspect of investigative work and collaboration. With large sets of data, or sources that need a human being to look at them instead of a computer algorithm, being able to work collaboratively to examine the information can be hugely productive. At Bellingcat we hope to create a community from our audience and contributors of people who know how to work with this information. 

It’s really not hard to do, and the biggest hurdle is getting ordinary people aware that they can do this work. I had no experience in this kind of investigative work when I started what I was doing, but was able to teach myself as I went along. People who visit Bellingcat will be able to learn from my mistakes and successes, creating a community of investigators who can use evidence and expose crime and corruption, from battlefields to boardrooms. On Bellingcat, “audience engagement” isn’t about adding comments and buttons for Facebook and Twitter, it’s about giving the power to challenge the criminal and corrupt.

    1. Missing avatar

      Lidiya on

      Ни хрена непонятно: Вы узнали, кто сбил самолёт? Самолёт сбили по команде из НАТО.

    2. Missing avatar

      Namaku Keren on

      This comment has been removed by Kickstarter.

    3. Missing avatar

      teguhbejo on

      This comment has been removed by Kickstarter.

    4. Missing avatar

      Doa Ibu Tersayang on

      This comment has been removed by Kickstarter.