The use of Open Source Intelligence (OSINT) tools for military intelligence in wartime is a hot topic with a wide range of controversial issues. The results of this study confirm that OSINT can provide valuable information about potential adversaries, maintain situational awareness, and assist in the planning and execution of military operations. This type of intelligence can come from a variety of sources, including social media, news articles, and scientific research. However, it is important to recognize that OSINT is susceptible to disinformation, which can limit its accuracy and reliability. Therefore, it is crucial to use OSINT in conjunction with other intelligence-gathering methods to ensure that the information obtained is accurate and reliable. The study highlights the importance of resource management, as OSINT provides a significant advantage in this regard. The tools and methods used for OSINT analysis, in particular in social media, are based on social media analysis and geospatial analysis. The article proposes the author's software “Cyber Eye” for tracking war crimes and documenting them based on the use of OSINT, and analyses the functionality, advantages, and disadvantages of the developed software. The results of the study show that OSINT can serve as a valuable tool for military intelligence.
Open Source Intelligence (OSINT) refers to the collection, analysis, and dissemination of information obtained from publicly available sources, including social media, news articles, and other online platforms [1]. In conflict zones, OSINT plays a crucial role in documenting human rights violations and war crimes. By providing valuable information and evidence, OSINT can help to establish the identity of a person (location at a certain point in time) and bring perpetrators to justice. It is an important tool for investigators, prosecutors, lawyers, and judges who may lack experience in dealing with specific categories of serious violations, such as war crimes [2–3].
In Ukraine, OSINT plays a crucial role in
documenting war crimes committed during
the war. Europol has set up a special team to
support investigations of major international
crimes committed in Ukraine, which will assist
with open-source intelligence [
The importance of OSINT goes beyond the
direct documentation of war crimes in Ukraine.
It is also needed by organizations seeking to
facilitate the investigation of war crimes
committed on the territory of Ukraine in
foreign jurisdictions, by the principle of
universal jurisdiction [
The purpose of the article is to reveal the possibilities of using OSINT as a tool for documenting war crimes.
The purpose of the study is specified in the following tasks: to reveal the capabilities, tools, and functionality of OSINT for tracking useful information; to develop software and reveal examples of the use of OSINT to document war crimes, and to analyze the shortcomings and limitations of its use.
The research resulted in the development of tracking software to document war crimes.
The following methods were used during the research: analysis of scientific literature on clarifying Open Source Intelligence; analysis of programming environments and online services for creating software; modeling the life cycle of software development product; testing of the developed author’s software to form the stability of the software code; visualization (presentations, drawings, conversion of the obtained data into appropriate formats) to present the research results.
The research was carried out within the framework of the complex scientific theme of the Department of Mathematics and Physics “Mathematical methods and digital technologies in education, science, technology,” DR No. 0121U111924, and the scientific theme of the Department of Information and Cyber Security named after Professor Volodymyr Buryachok of Borys Grinchenko Kyiv Metropolitan University “Methods and models of ensuring cyber security of information processing systems and functional security of software and technical complexes of critical infrastructure management,” DR No. 0122U200483.
A structured OSINT investigation is important for several reasons.
It helps to increase efficiency by allowing you to find the information you need faster and minimize distractions.
Ensures completeness by covering all important aspects.
Provides repeatability for reviewing or sharing results.
Facilitates documentation, making the process and results transparent and traceable.
Encourages creativity by providing a solid foundation for innovative approaches.
Improves organization by allowing better structuring and analysis of information.
Provides control to better manage the process and track progress.
Minimises errors by promoting systematic and methodical approaches.
Ideally, you should start the investigation process with the option that requires the least amount of effort and at the same time offers the highest probability of a productive outcome. OSINT functionality allows you to search the following sources: • Internet—search engines, forums, blogs, websites, etc. • Databases—government, medical, educational databases, etc. • Social media—Facebook, Twitter,
LinkedIn, Instagram, Reddit, etc. • Technical analysis—metadata, IP addresses, domain registrations, WHOIS information, network data, etc. • Images and video—identify people, objects, places, or events. • Geosocial intelligence—geotagging, logging, and location information to identify the location, activities, and connections of people/organizations.
This structure may vary depending on the purpose of the investigation and is not exhaustive.
OSINT tools essentially perform three
functions:
Identify public assets: The most common
function of OSINT tools is to help IT teams
identify public assets and the information they
contain. This includes data that could
potentially contribute to the development of
attack vectors. However, this does not mean
identifying security vulnerabilities or
penetration testing—it is only about
information that can be accessed without using
hacking methods [
Finding relevant information outside the organization: Another function of open source intelligence tools is to track information that resides outside your organization—for example, on social media platforms or in domains. This feature should be of particular interest to large companies integrating new IT assets as part of an acquisition. Given the rapid growth of social media, it makes sense for every organization to check for sensitive information outside the company.
Some OSINT tools can summarise the information and data collected in a usable form. In the case of a large organization, an OSINT scan can produce hundreds of thousands of results—especially if it covers both internal and external sources. Structuring the data and addressing the most pressing issues first is not only useful in such cases. 3.1.
Recon-ng is a multi-level OSINT tool for software developers working with Python. The interface is similar to Metasploit, which significantly reduces the learning curve for experienced users of the popular framework. Thanks to the interactive help function (which is missing from many Python modules), developers can get started right away. In the case of Recon-ng, this includes automated processing of time-consuming and repetitive OSINT tasks (e.g. copy and paste marathons). This creates more time for things that need to be done manually. The OSINT tool has a modular structure with numerous integrated functions, so even Python beginners can master Recon-ng. These include common tasks such as standardizing output, interacting with databases, running web queries, and managing API keys. Instead of programming Recon-ng at great expense, developers simply select the functions they need and create an automated module in just a few minutes.
Recon-ng is free and open-source software.
Shodan is a specialized search engine that provides information about devices—for example, the millions of IoT devices already in use. The OSINT tool can also be used to find open ports or vulnerabilities in specific systems. Some other open-source intelligence tools use Shodan as a data source but a paid account is required for in-depth interaction.
The potential applications of Shodan are impressive: it is one of the few tools that also includes Operational Technology (OT) in its analysis, such as those used in industrial control systems in power plants or factories. Therefore, any OSINT initiative in an industry where IT and OT go hand in hand would have significant gaps if it were not based on Shodan. The OSINT tool can also be used to analyze databases: Under certain circumstances, information can be accessed publicly through workarounds.
A freelancer license ($59 per month) for Shodan allows you to scan up to 1,520 IP addresses per month, with up to a million results. The enterprise license promises unlimited results and allows you to scan 300,000 IP addresses per month for $899 per month but with a vulnerability filter and premium support.
The DarkSearch.io platform is a good starting point for those new to the dark web. You don’t even need a Tor browser to use DarkSearch.io—the search engine works with all common browsers. However, interested companies or individuals should contact the operators by email to gain access.
One of the most effective ways to document
war crimes in Ukraine is through the use of
OSINT [1]. OSINT involves collecting and
analyzing publicly available information such
as social media, news, and satellite images [
To collect personal data, geodata, and metadata in social networks, and filter people by parameters (fields: gender, age, date of birth, place of birth, etc.), we have created the Cyber Eye software with the following functionality: Tab “REST API”
Receiving information from various API services has been implemented: • About the operator/region by IMSI identifier. • About the Russian/international subscriber number. • About the IP address. • About the location by coordinates, getting the coordinates of the object. • Information about nearby GSM, UMTS, and LTE base stations around the specified point (saves a report with a list of stations to display on a map). • The engine makes it possible to view a user’s nickname in the database of 1027 sites. • Search by IMEI. • Geocoding to get the coordinates of places by name, latitude, and longitude. • Search for base stations by specified coordinates and export to HTML from Google Maps.
Scan images for viruses. • VK • It is possible to create infographics. • Lists. • Search for people. • Search for communities. • Keeping statistics.
• Identifier definition. • User data by nickname. • Number of likes, comments, views. • Addresses on photos (GeoSint).
• Get basic information about the user.
• Allows you to receive user data, as well as find the administrator of a group or channel, bot.
• Allows you to get results from a global search on the Internet using deep dark search.
Databases • Allows you to get results by criteria in the specified databases The search is performed by the following parameters: − by surname − outside the city/village − by phone number − by region.
• Used for mass mailing of messages The mailing is carried out according to the parameters: − single number − room group.
The program, at the moment, is available in Ukrainian, in the future it is planned to localize at the first stage in the languages English, Polish, German, and French, by the formation of a multi-language file and dependency system Localization.xml.
There are situations when the results have links to graphic objects or the user found is of interest and you need to find more information manually—there are modules for viewing pictures on the right side of the application. There is also a field for notes—“Draft”. The ability to change the color scheme and enable sound notifications has been implemented.
Python programming language was used to write the software, based on open databases and common APIs.
It is possible to use copyrighted software: Search for a person on various social networks and informers, including OSINT VK, TikTok, Telegram, GetContact, and Instagram.
In addition to people, you can search for various geo data, base stations, and geo decoding.
Region identification by operator and domain and IP information.
Search by username is possible (returns a matching recursion).
Also check the image (if everything is fine, it will show the photo, if not, the file is suspicious).
The interface of the b-version of the software contains 7 tabs for searching for information and 1 for SMS in Fig. 1: Based on the analysis of open data, the author’s software “Cyber Eye” can perform several tasks related to the selection, accumulation, and systematization of data to form a documentary evidence base for further judicial proceedings, and search for both war crimes and criminals.
For example, here is a screenshot of the code that allows you to search for a person through the VK platform to identify general information and family ties, general information for collecting a person’s data in Fig. 2.
Social media platforms have become a
valuable source of evidence for documenting
war crimes, as they allow for the collection of
real-time information and eyewitness
accounts [
Satellite imagery can provide important evidence of the destruction and damage caused by military operations, as well as the location of military objectives and troop movements. By analyzing satellite imagery, researchers can identify patterns of destruction and track changes in conflict over time. This information can be used to support prosecutions against those responsible for war crimes and to provide a more complete understanding of the conflict.
Cooperation with local civil society
organizations and journalists is also an
important aspect of documenting war crimes
in Ukraine [16]. These groups can provide
valuable field reports and first-hand accounts
of the conflict, as well as access to local
communities and sources of information [
Moreover, one of the necessary elements is the geodetic decoding of the mobile network area, including the detection of base station points and repeaters in Fig. 4. Having identified the coverage area, you can track the location of a particular person through the network channels.
While OSINT can be a valuable tool for documenting war crimes in Ukraine, there are several challenges and limitations to consider. One of the main challenges is the need to verify information obtained through OSINT [19]. As with any source of information, there is a risk of false or misleading data, so it is important to confirm the accuracy and reliability of any data before using it as evidence. This process can be time-consuming and resource-intensive, requiring significant effort to cross-check information from multiple sources and ensure its reliability.
Another limitation of using OSINT to
document war crimes is the need for access to
reliable sources [
Thus, there are legal and ethical considerations that need to be taken into account when using OSINT to document war crimes [2]. For example, there may be concerns about privacy and data protection, especially when collecting information from social media or other publicly available sources. In addition, there may be questions about the admissibility of OSINT data as evidence in court proceedings, especially if it has not been independently verified or subjected to appropriate retention procedures. Thus, it is important to ensure that OSINT is used to document war crimes in a manner that is consistent with legal and ethical principles to avoid any potential challenges to its credibility and reliability.
In summary, OSINT plays a crucial role in documenting war crimes in conflict zones, including Ukraine. The use of social media, satellite imagery, and cooperation with local organizations and journalists have proven to be effective in gathering evidence. However, there are limitations to the use of OSINT, including the need to verify information, access to reliable sources, and legal and ethical considerations. Despite these challenges, the importance of OSINT in documenting war crimes cannot be overstated, as it provides valuable evidence to bring perpetrators to justice and seek justice for victims. As technology continues to evolve, OSINT will undoubtedly play an increasingly important role in documenting war crimes and human rights violations.
Potential limitations of using OSINT tools in wartime for military intelligence:
Although OSINT has become increasingly
popular in recent years due to its ability to
provide valuable information about potential
adversaries, it is not without its limitations.
First, like any intelligence-gathering tool,
OSINT has limitations in terms of its ability to
support conventional warfare and cyber
operations. While OSINT can provide useful
information, it is not always reliable or
accurate, which can be a significant drawback
in a wartime environment. In addition, OSINT
can be vulnerable to disinformation and
propaganda, making it difficult to distinguish
legitimate sources from those that are
intentionally misleading [
The article theoretically reveals the methods of using Open Source Intelligence to track personal activities and presents the author’s software “Cyber Eye” for documenting war crimes through the analysis of social networks, cooperation with local organizations, and the use of satellite images. The functionality, advantages, and disadvantages of the developed software are analyzed.
In the process of modeling the application, three main OSINT functions were defined: identifying publicly available assets to find useful information, searching for relevant information outside the organization, and collecting and structuring the information received. In particular, OSINT: Recon-ng and Shodan simplify asset discovery and provide information on IoT devices and system vulnerabilities; DarkSearch.io helps to search for information on dark networks without the Tor browser.
The use of OSINT in Ukraine is appropriate for intelligence purposes and for documenting war crimes through social media analysis, cooperation with local organizations, and the use of satellite imagery. Prospects for using this type of tracking/intelligence can be useful for providing documentary support for court proceedings, identifying criminals, and tracking troop movements.
At the same time, despite the possibility of obtaining valuable data for military intelligence during conflicts, OSINT is vulnerable to disinformation, which can complicate the accuracy and reliability of information.
Prospects for further research are the implementation of best practices for integrating OSINT with traditional intelligence-gathering methods.