As horrifying images began to appear from the wreckage in the recently liberated Ukrainian town of Bucha, global outrage grew. Five weeks after Russia’s invasion of Ukraine, screens were flooded with videos, photos, and stories of the atrocities inflicted on Ukrainian civilians in this Kyiv suburb: shocking footage of people in civilian clothes, some with their hands tied behind their backs; naked and burned bodies of women; and mass graves. Estonian Prime Minister Kaja Kallas tweeted: “This is not a battlefield, it’s a crime scene.”
The painstaking and exacting work of gathering evidence of war crimes by the human rights community, aided by ubiquitous digital devices, is now being done in collaboration with journalists, military officials, the open-source intelligence community, cyber sleuths, and civilians on social media alike. The amount of documentation being assembled is beyond precedent. And although public proclamations alleging violations of international law draw attention, these charges must be supported by a precise process, complete with vetted and permissible evidence, to convict.
The battle for hearts and minds today takes place electronically. So, predictably, just as soon as the images from Bucha were published, the Russia propaganda farm rolled out a highly coordinated and targeted disinformation blitz, calling the footage a “provocation” and a “staged production.” Russian Foreign Minister Sergey Lavrov called the massacre a “fake attack.” Russia’s defense ministry posted to Telegram, saying some of the photos were “fake.” Pro-Kremlin social media accounts accused “Ukrainian Nazis” of the Bucha killings—a deceit that has already made it to China.
The Kremlin reverted to a well-worn slogan, “Do not believe your eyes,” in an attempt to sow confusion domestically—deceiving a Russian population already primed to disbelieve these atrocities. Russian President Vladimir Putin’s version of events is amplified by an army of pro-Kremlin activists who seed the field with falsehoods, doing everything from calling the victims in Bucha crisis actors (just as they did in Mariupol, Ukraine) to claiming to uncover falsified footage (that was then debunked by open-source investigators).
This tragic moment in time can be a turning point, however. Human Rights Watch has already documented many “laws-of-war violations” and is gathering evidence and eye witness accounts, which include harrowing testimony about summary executions and rape as a weapon of war. Graphic videos of the bodies of dead civilians have been shared—and verified. Satellite imagery appears to confirm a mass gravesite in Bucha. And these will not be the last atrocities uncovered. The integrity of the war crimes documentation process is essential, and collecting data is only the beginning.
Oleksandra Matviichuk is angry but undeterred. When the shelling started in Kyiv, she was forced out of her home, and her plan B to evacuate to the suburbs was also scuttled when enemy paratroopers landed in Ukraine. It’s difficult for her to sleep or eat, and there is no time to worry or grieve—she is gathering evidence.
Matviichuk is a human rights lawyer and head of the Center for Civil Liberties in Ukraine. She is interviewing witnesses of the attacks targeting civilian populations and medical personnel. Grateful to still have access to the internet and for her modern digital tools, Matviichuk is also doing live press interviews and tweeting about what she is seeing—including the “Butcher of Mariupol,” Col. Gen. Mikhail Mizintsev of Russia’s National Defense Management Center.
Matviichuk has hope that one day, the data she is assembling will help lead to a war crimes tribunal and justice for Ukraine. One month into Russia’s invasion, U.S. Secretary of State Antony Blinken announced what many in the international human rights community had already been tracking for some time: that there was credible evidence that Putin’s regime was violating the laws of war.
There is no single global treaty that covers all war crimes; rather, there are a variety of statutes and conventions that encompass the laws of war, from the Hague Conventions to the Geneva Conventions to the Rome Statute, along with other norms, known as customary laws. There is no statute of limitations.
The International Criminal Court (ICC) prosecutor has opened an investigation into Russian war crimes in Ukraine. Others are following suit. The United States is fact-finding, as is London’s Metropolitan Police war crimes team. The U.N. Human Rights Council—from which Russia was suspended this week—has established a commission, and various other states are assisting the Ukrainian government in gathering evidence.
There is no guarantee that Russia will ever face justice. Neither Russia nor Ukraine is a party to the Rome Statute, though Ukraine has acknowledged the jurisdiction of the ICC. Russia, assuming it is not expelled, would undoubtedly veto any action by the U.N. Security Council or the ICC, which cannot try Russia for crimes of aggression since it is not a signatory. Other possibilities to hold Russia accountable could include a tribunal or special court. But history has shown that justice can be elusive.
War crimes, along with genocide and crimes against humanity, are about the destruction of a people; they are also about the destruction of truth. Russians are now committing mass atrocities in Ukraine, including offenses that may fall under the definition of genocide: “acts committed with intent to destroy, in whole or in part, a national, ethnical, racial or religious group.”
The words and definitions used matter because they come with standards and legal implications—and however these unconscionable acts are ultimately characterized, they are grave violations of international law that must be condemned, investigated, and prosecuted. Imperiled by the deluge of damning data, Putin is revving up his disinformation machine—rewriting historical narratives based on ancient myths, aggressively disseminated via online campaigns and techniques laboratory tested in the United States in 2016 and elsewhere.
Russia’s cyberwarfare capabilities may exceed their conventional proficiency. Fortunately, the same digital tools weaponized by authoritarian dictators to spread hate and lies are also available to fight back. Disinformation is a scourge in online spaces, and Russia wields this weapon potently. It is therefore vital to leverage all the tools at Ukraine and its allies’ disposal—fighting cyber fire with cyber fire, utilizing technology and crowdsourcing resources to reveal the truth.
However, as Eliot Higgins, founder of the Netherlands-based investigative journalism organization Bellingcat, suggests, “The obsession around disinformation can unfortunately act as a distraction … seeing war crimes in terms of the lies that are told rather than the truths that can be found.” Ultimately, the best way to combat Putin’s propaganda machine is to safeguard the proof that can hold war criminals accountable.
While international lawyers around the world compile the necessary legal resources, the open-source intelligence community (OSINT)—aided by a large army of digital activists and other non-professionals, armed with smartphones, computers, and terabytes of storage—are combing through data, from satellite images to social media to radio intercepts.
In international humanitarian law, incidental violence or “collateral damage” is not considered a war crime—evidence needs to show the events rose to the level of unlawful acts of war—and it is notoriously difficult to track such violence during wartime. The sheer volume of content already accumulating is without precedent. In Ukraine, professional and amateur investigators (both in-country and remotely) are sifting through posts of attacks to confirm their authenticity. Others have organized ways to enable civilians to assist with evidence collection; there is even an appeal for proof on the Ukrainian government’s website.
From the outset of the invasion, the OSINT has been diligently working to compile vital data. Violent conflicts are complex, and to succeed at an eventual trial, the proof must be permissible and corroborated. Even the ghastly images from Bucha will require testimony and confirmation.
This information has to be collected now, and videos and photos alone will not be sufficient. Evidence must include proof of intent, such as the computers and cellphones of Russian soldiers; notes and instructions from their superiors; interviews; invasion maps; and insignia—all meticulously and securely collected and backed up. It is a formidable challenge to link these crimes up the chain of command and provide enough context to show the requisite intent.
There is a complicated interplay between countering disinformation and hate online and collecting proof of war crimes, abetted by Big Tech’s haphazard content moderation policies. When digital content is erased, it can be lost forever. And algorithms are increasingly automating these processes, so sophisticated artificial intelligence (AI) can delete proof (that we might not even know exists) from the evidence locker—permanently.
For example, if Facebook’s algorithm flags a post in breach of its guidelines and it is taken down by AI or a human content moderator and subsequently deleted from the company’s servers, it will be lost to investigators (assuming they were even made aware to look for it in the first place). Currently, there is no archive protocol nor is there a requirement for platforms to preserve possible evidence of war crimes.
Some organizations, including Human Rights Watch, are calling for an independent repository to protect important evidentiary data. The complexities of war crimes work require confronting the digital realities of the moment.
Some of the dedicated groups and seasoned activists documenting war crimes in Ukraine in addition to Bellingcat include Mnemonic, eyeWitness to Atrocities, Truth Hounds, the Centre for Information Resilience, Project Owl, and Reporters Without Borders. The Pilecki Institute has recently set up a center to preserve evidence and collect testimony, naming it after Raphael Lemkin, the Polish lawyer who studied and lectured in what is now the Ukrainian city of Lviv, and is best known for coining the term “genocide.”
Many of these investigators have been doing this work for years, from Myanmar to Yemen to Iraq to Syria. Evidence collection in Ukraine is benefiting materially from lessons and relationships that came out of the experience of recording atrocities in Syria. The war in Syria brought about the 2020 Berkeley Protocol—a guide for the ethical and effective use of digital open-source information in investigating violations of international human rights.
Alongside the professional groups and those like Matviichuk on the ground in Ukraine, there is a growing cadre of volunteers connecting online who are becoming an integral part of the war crimes investigative community. They are also helping with vetting content, using geolocation and other methods.
EyeWitness has a cache of resources to help those who are documenting atrocities, as does Witness. Amnesty International’s Citizen Evidence Lab also chronicles violations of human rights, and anyone can track the attacks by Russia the group has verified to date. For all of these organizations, data obtained from trained investigators and “citizen evidence” alike are accepted, and a variety of authentication techniques are deployed, from looking at metadata to cross-checking images with weather patterns, flight tracking, and NASA fire databases. Radar, light detection and ranging, and satellite imagery may be used to look for evidence of attacks (such as craters, weaponry, and troop movements). Weapons trade data can help track the origin of armaments. In all cases, ideally there is also corroborating eyewitness testimony.
Bellingcat records dubious evidentiary claims in a Google spreadsheet and has an interactive TimeMap that serves as a living document of civilian harm. They use only publicly available information and focus mainly on violence against civilian targets. Discord (a platform originally designed for gamers) is used to help organize their OSINT, which has grown by the thousands since the war began.
A lot of Bellingcat’s evidence comes through Telegram, a go-to source of information for Ukrainians and an app originally designed by two (now exiled) Russian entrepreneurs. Hundreds of thousands of people have joined Ukraine’s “IT army” on the app, where evidence lives alongside falsehoods and fakes, including targeted disinformation initiated by Russia. Telegram, like all social platforms, is largely unregulated and is accordingly rife with both information and disinformation. From Facebook to TikTok, users face constant exposure to lies. We are living in an age of context collapse, where myriad audiences and content are all in the same feeds; and these apps are double-edged swords.
Operating side by side and aligned in spirit if not necessarily coordinated with the war crimes investigative teams and organizations, there are growing cyber armies consisting of motley crews of hacktivists and tech wizards fighting back against Russian virtual warfare. Programmers are initiating cyberattacks to take down Russian sites and mounting defenses of Ukrainian digital assets. Anonymous is one of the groups involved, and Ukrainians and allies around the world are engaging in cyber combat, targeting everything from Russian communications to transport.
Currently, a large part of this strategy consists of “distributed denial-of-service” attacks that can bring down Russian propaganda sites with torrents of traffic that render the site unreachable. There are more than 1 million information technology professionals in Russia, Ukraine, and Belarus (290,000 in Ukraine alone)—many now out of a job and looking to join the cause. Volunteers have been doing everything from online translation to updating websites.
ArchiveTeam Warrior, founded to preserve at-risk websites, is now backing up the entire Ukrainian internet to help protect cultural heritage. Alongside digital preservation and cyberattack strategies, there is another tactic being used to counter disinformation: pumping in truth to counter lies.
One such effort is the crowdsourced, email-based campaign mail2ru.org, where volunteers write directly to Russians from their own email accounts. A Harvard communications expert has even enlisted her help to redesign the email campaign to be more effective. The group operating mail2ru.org has sent 60 million emails and counting. They do not track responses—in order to evade Russian monitors—and these self-styled “tech nerds” are adapting their messages on the fly and looking into using AI to automate the process.
Although most digital warriors are focused on combat in cyberspace and the cloud, the internet is also composed of tangible things—such as servers, wires, fiber cables, and transmission infrastructure—that need safeguarding and maintenance. Since the war began, Ukraine has unplugged from the Russian power grid and linked itself with the European Union’s by synchronizing their electrical networks, completing what would typically be a yearlong (and symbolic) job in just two weeks.
When Russian forces began hitting TV towers throughout Ukraine (also a war crime), the Ukrainian government switched to sending signals via satellite and mobile networks, which have become critical infrastructure in this war. They are now also running new cables in basements in Kyiv (you can request an internet connection in a bomb shelter) to keep the city connected and informed.
One primary reason that Ukraine’s network is intact is that the country presciently bolstered digital infrastructure in the years prior to the war. It’s also possible that Russia is not comprehensively targeting Ukrainian systems because they need the technology too—both for their own military communications as well as to listen in on Ukraine. Be it strategy, policy, or chance, many Ukrainian networks remain operational, and the same digital tools that Russians deploy as cyber weapons are the technologies that can be used to hold them accountable.
In times of war, the task of humanity is to not look away, bear witness to atrocities, and ensure that war criminals are brought to justice. But to catch the devil, it’s in the details—and any successful war crimes prosecution will demand both legal and technological skill in the dogged pursuit of truth.