Bellingcat: An Intelligence Agency for the People with Eliot Higgins

Erin Dietrick: Welcome to "SpyCast," the official podcast of the International Spy Museum. I'm Erin Dietrick and your host is Dr. Andrew Hammond. Every week we explore some aspect of the past, present, or future of intelligence and espionage. If you enjoy this week's show, please consider leaving us a five star review. The original podcast on intelligence since 2006, we are "SpyCast." Now sit back, relax, and enjoy the show. [ Music ]

Andrew Hammond: Well, thanks for joining me this morning, Eliot. I'm really looking forward to discussing Bellingcat with you.

Eliot Higgins: Thanks for having me on.

Andrew Hammond: You bet. I think the first thing that I just wanted to ask was, you know, you were -- you and Bellingcat were pioneering this type of work a decade, a decade and a half, ago. What does it feel like now that Ukraine has been called -- is being called the first OSINT or open source intelligence war. You have people in the intelligence community here in the U.S saying that they're going to flip the script from 80% secret and 20% open to the reverse. And then you've got the International Spy Museum wanted to do an exhibition on open source intelligence in Ukraine and inviting you on their podcast. So it's quite the journey you've been on. Can you tell me a little bit more about what that's been like for you and for Bellingcat?

Eliot Higgins: I always felt when I started looking at this stuff, you know, 12 years ago already just talking with people on the inside about it that there was useful information here. But I was finding stuff in these videos and photographs that I wasn't seeing elsewhere and I always thought this just seems like loads of really useful free stuff. So why aren't more people taking advantage of it? And, you know, after 12 years it kind of got through to a lot of people that, yeah, this is really, really important information that needs to be treated like that.

Andrew Hammond: And a lot of the work that you do is it fair to call it investigative journalism? Is that the main thrust of Bellingcat would you say?

Eliot Higgins: I would say primarily we've had this kind of discussion internally because we do a lot of different types of activities and defining exactly what we are as an organization took some time. Like the whole staff were involved when figuring this out. Primarily I would say we're an investigative organization, but that outcome of what that investigation is can be something that is more of a traditional media product, but we've also done a lot of work on legal accounts [inaudible 00:02:42] for example. We also do lots of education work through workshops, through working with schools and universities. So we have a whole range of activities, but it really comes down to my original goals for when I set up Bellingcat. I had been blogging for two years and I saw more people interested in open source investigation. So I wanted a site where people could not only kind of write articles and have them published, but also learn how to do open source investigation. So that kind of, you know, publishing and education side of it is still, you know, kind of core of what we are. It's just turned into something much bigger than I had originally imagined.

Andrew Hammond: And help us understand the ways in which Bellingcat has changed the ecosystem or just the ways that the ecosystem has changed. I'm just thinking of BBC verified the "New York Times" visual investigation kind of unit. How has this type of approach been mainstreamed? How has it been on boarded at some of these major organizations that I've just mentioned like the "New York Times" and the BBC?

Eliot Higgins: A lot of it has already come about because we've had to prove that this is legitimate. When I first started doing this work and I kind of was blogging for a bit and I got invited to come to -- go to events in 2013. You know, [inaudible 00:04:00] and conferences and stuff. And I would present, you know, geo location and stuff on stage and it was like they were acting like I was doing magic tricks. But my point wasn't that this is magic. This is something that you can do and recreate and understand. And that's kind of really been a big part of my personal mission is spreading those ideas. And we've done that through, you know, not just publishing guides and case studies on the website. We've trained thousands and thousands of activists and journalists and researchers and really built the circumstances by leading by example, but also through training so organizations feel comfortable enough to actually start using this stuff in their own work and they understand how it works. And that's already been a big part of it because this whole field didn't emerge from a professional network. It emerged from an online amateur network which for professional journalists is a very scary thing. So there was a lot of convincing to be done and we still continue to do that kind of work even though we've kind of convinced the NGO and the journalism space. We're now working on the education and legal accountability space in the same way building that trust and understanding of what open source investigation can mean.

Andrew Hammond: It'd be interesting to discuss the approach and just break that down a little bit more, but before we get there the name Bellingcat. Some of our listeners may be thinking that's interesting or that's cool. Can you tell us a little bit more about how you got to that name?

Eliot Higgins: Yeah. So back in 2014 in Germany I was thinking I should do a new website. I don't know what the name's going to be. I was thinking of names and they were all really rubbish. It was like the open source dot com and stuff like that. Awful names. And I had a friend, Peter Jukes, who he's a playwright so I thought he must have some clever word ideas. So I called him up and the first thing he suggested was, "Well, what about the fable of belling the cat?" I said, "I'm not familiar with it." And he says, "Well, it's about a group of mice who are terrified of a large cat so they have a meeting and they agree that they should put a bell on the cat's neck. But then they realize they don't know how to do it and no one's brave enough to do it." So what I would be doing is teaching people how to bell the cat. So I went to belling the cat dot com and that was the main part for about $4,000 and Bellingcat dot com was available for about $20 so I went with Bellingcat dot com.

Andrew Hammond: Okay. Interesting. So, you know, with our podcast the audience varies from people that are working on these specific issues -- it could be someone in the open source enterprise working at the CIA, for example. But it could also just be the average person on the street who likes a good story or who just has a general interest in how the world is put together. So for people that are not read into this type of stuff can you just tell them a little bit more about what this approach is like? What's the ethos? What's the, you know, drive behind Bellingcat? How does one -- how does one nail down what the kind of overall approach is?

Eliot Higgins: So in the most basic way it can be described as using publicly available information to investigate a whole range of topics from I've investigated I think from, you know, dognappings to chemical weapon use in Syria. So it can be a really wide range of topics. And this has been really enabled by the changes of the last 15 years or so that were driven in particular by the introduction of the iPhone because when the iPhone was introduced it was using an operating system people could make apps for more easily which led to a rise in the use of social media and other sharing apps. So lots of people had devices in their pockets they were using to collect information. And when you realize that information is part of a network that reflects reality you can start extrapolating information from that. And in parallel to that we've also had the widespread dissemination of imagery like satellite imagery that we never had access to before, but now is easily available [inaudible 00:07:56] through a place like Google Earth. You had street imagery and other imagery that could be used for -- as reference imagery to verify photographs and videos taken, you know, 5,000 miles away. So by these kind of two developments from 2008 onwards has allowed this field of online open source investigation to emerge. And it emerged from online communities. It didn't come from professional [inaudible 00:08:21]. I assume intelligence agencies were using some of this in maybe the way I was. I don't know. But it's basically a ton of free really useful information. It's just learning how you navigate that. A big part of our [inaudible 00:08:35] is being part of the online communities as well because it's not just about the process. It's about okay you've got all these people are looking at stuff at different ways. They have different knowledge. They can actually work together in different ways. And it's not always the same way. It can be an organized community. It can be an ad hoc community that emerges around the same subject. It can be a community that might have a very small amount of knowledge about something that's just relevant today. One example of that, for example, is a few years back there was a photograph screenshot of an Instagram post by Alexandria Ocasio-Cortez that supposedly showed her feet in a bath. And you can't see her face, but the implication was she had taken a kind of saucy picture and posted it on Instagram and then deleted it. But it was actually the wiki feet community, the community of foot fetish enthusiasts, who were able to say very quickly, "No. This isn't her feet because it actually belongs to this other woman." And because they have that very hyper specialized knowledge they were able to quickly debunk that. It's kind of like pre-internet or in the old days of the internet you had the kind of CIA black site rendition flights that were identified by plane spotters. Those people still exist. Now they're all on the internet. So all of their kind of logs are actually online and can be used in a similar way. So it's really like, okay, you have all this different types of knowledge. Some of it is really hyper specific. Some of it is a bit weird. But actually if you bring this all together and you can turn it into a process you can actually make really, really big findings with it.

Andrew Hammond: So it's like the idea of plane spotters or train spotters, but whereas before they would write things in books and have monthly meetings in a [inaudible 00:10:12] or something, now they're putting all of this information online which can be used as a data point for investigations.

Eliot Higgins: Yeah. Absolutely. And it's really what we try to do at Bellingcat is not only, you know, train people how to do this throughout -- leading by example in workshops, but also create spaces for them to do this as well. And really the open source community as we see it today emerged from Twitter communities who were kind of talking about the, you know, conflicts in Syria from 2012 onwards and that then became MH17 was kind of the big story in 2014 that led to more people looking at Russia's involvement in Ukraine. And then Russia started bombing Syria so those two kind of the Venn diagram kind of drew together those two communities. So it's kind of emerged organically online, but I think Bellingcat has played a really big role in professionalizing the field as well as, you know, being a major participant in it.

Andrew Hammond: And I think it would be interesting to just use an example and maybe we can just follow the way that an investigation unfolded so that we can get a better understanding of the types of data that you're gathering and the places that you're gathering it from. So I don't know what example you think best displays view location, you know looking at YouTube videos, other things that you guys -- is there an example that would help illustrate this to our listeners?

Eliot Higgins: I think MH17 is useful because that's a case where you could -- we got a ridiculous amount of information basically from online sources. So MH17 was shot down July 17. It was flying over eastern Ukraine. And immediately there were allegations from the pro separatist Russian side and the Ukrainian side. On the Ukrainian side they were claiming it was a Buk missile launcher. So an air defense system that shot down MH17. And it was controlled by the separatists. On the Russian side they kind of made lots of allegations basically. They throw a lot of mud at the wall and then they see what sticks, but the main one to start with was it was the Ukrainian fighter aircraft that had shot it down. So what you had on the day is lots of people online just finding, sharing, anything that looked like it could be vaguely relevant to what happened with MH17. So one of the first things that I did is when MH17 was shot down the cockpit section crashed separately from the rest of the aircraft. It crashed inside this sunflower field. And people were going to the site and taking photographs of this wreckage. And it was a mess. I mean, as you can imagine, it didn't look really like any particular part of the aircraft. But I could see in some of the photographs there was -- there were holes in the remains of the outer skin of the aircraft, the [inaudible 00:12:57], which suggested an outward force had kind of passed through them. And there were lots of these holes. So it could be shrapnel from an air to air warhead, for example. So this is a potential clue, but I couldn't figure out where this stuff was until I took all of those photographs and actually put them in sequential order in terms of their position in relation to the wreckage and created a kind of homemade street view of the wreckage so I could kind of walk around the edge of the aircraft and start figuring out where everything was. And that allowed us to, you know, on the first day establish that the aircraft was hit by a large amount of shrapnel coming from a very specific direction into the aircraft which, you know, was just the first step of then establishing how this was shot down. We then had photographs and videos of the missile launcher or a missile launcher being transported through separatist territory. And with that we could geo locate those videos. So, for one example, there's a photograph that showed a low loader carrying a Buk missile launcher and one of my colleagues, Aric Toler, who at that time was just another internet user, but eventually joined our organization as an employee, he noticed there was a sign on a shop in the background that could only be so many words in Russian. It was blurry and obscured, but he figured out what it was. He Googled that and then he found the shop in a town and he searched for the shop name and the town name and from that he found an online wiki that lists all the streets in eastern Ukraine with the shops on them. So then he had the town, street name, and the shop name. He searched for that which gave him a court document about a fight that had taken place in the shop with the full address. So then with that he's then able to find the exact location on satellite imagery using Yandex maps which is like Russian Google. And we -- he also discovered there was a guy who would drive around the streets of eastern Ukraine filming it on his dashboard camera then uploading it on to YouTube with a list of all the streets he'd been down. And that actually then was picked up in the Google search for the streets which gave us an on the ground view of the same location. And that entire -- these entire long videos could be geo located so that allowed us to verify where this was taken. And we did that using different techniques on several images. We also have the question of when these photographs were taken. So in some images there were shadows so once you have the exact position of a camera you can use your shadow to tell the time of day it was taken. But some didn't have shadows so in those cases what we did have were people who were on social media who'd seen the missile launcher posting in the moment. So we kind of discovered those social media posts and that started giving us a timeline of the movement of this missile launcher confirming it had gone through separatist territory. It headed to the launch site that had been identified because there were photographs of the launch smoke and satellite imagery of the burned field after the launch as well. So once we had that we had like the launch site, the route of the missile launcher on the day, and eventually we were able to find videos and photographs of a Russian military convoy taken by Russians shared on social media a few days before MH17 was shot down. And the damage and markings on one of those missile launchers in that Russian convoy in Russia was identical to the one in Ukraine. So we were able to show that missile launcher actually came from Russia. It wasn't one stolen from Ukraine. And we were actually able to track that back to the military base it came from which was the 53rd Air Defense Brigade who has a social media page followed by lots of the soldiers in the 53rd Air Defense Brigade which we could then use to -- their kind of social media network to establish all the unit's members, their ranks, their names, their photographs. And establish who was in this convoy transporting the missile launcher that shot down MH17 and who could have potentially been operating it. And this is all on publicly available information. It's because everything's a huge network of information and when there's a real world event that network is impacted by that real world event. People post about it on their social media pages. They say, "I've seen this." And then people discover that information and share it. So it's kind of, you know, working your way back to those original sources and extrapolating as much information as you can from what they're sharing.

Andrew Hammond: It's funny. When I think about say Bellingcat just say as an investigative, you know, journalism organization I know that that doesn't capture the totality of what you do, but let's just put that jacket on for a second and think about it. It's almost like it's like journalism with footnotes. You know, historians use footnotes and the idea is that, you know, if you don't believe me, you can go to this book and this page and see that this is what this person wrote or you can go to this primary document and see that this is the discussion that was actually had at the National Security Council and so forth. So it's almost like it's a different kind of model. Right? It's not based on an anonymous source, someone that I took to lunch in our capital city overseas. It's just anybody can do this. Anybody can go and check your work here as this is what we do. I just wondered if you'd thought about that.

Eliot Higgins: Yeah. It really was something that emerged from my first kind of blog where I knew that I wasn't an expert on anything that I was writing about. I was teaching myself about things like weapon identification by using publicly available sources, you know, about Soviet era munitions and stuff being dropped in Syria. So I was thinking that, okay, if I'm going to say something I'm going to say only what I can demonstrate through the sources that I'm going to provide. But it also meant that I could present part of the picture, but all the resources were there for someone who wanted to look at that and actually build on top of that as well because it's not only just about putting the information out there and expecting people to read it. It's about giving them the opportunity to see, to take it further if they want. And that is the kind of idea around transparency and collaboration that we've really brought into our work now, that we try and produce for example with Ukraine we produce a -- we have a map of a geo located video showing civilian harm. That's publicly available and that's used by a wide range of different types of actors, you know journalists, people working in human rights NGOs, people working with refugee and, you know, other charities as well. Because we're able to produce useful data. And it's this idea that what we're doing isn't meant to be the end of this. It's just part of an ongoing process that can go off in different directions, but within that process you want to make sure you're producing good quality information that's transparent and well sourced.

Andrew Hammond: And for this type of work how -- like say someone's listening and they're like, "I'm really intrigued by this." Like how would they go about getting into this type of stuff? Like what hardware, software, do they need? How can they train themselves? Obviously there's Bellingcat training courses and so forth, but just say they can't get to them. A lot of it started without formal training, as you mentioned online. So how would someone dive into this if they want to get involved?

Eliot Higgins: On the Bellingcat website we have a resources section which is guides and case studies. So you can read through those. Even reading through our investigations can act as a form of inspiration because we're so transparent about the process. You can pick up ideas from that for what you're doing. I'd also say don't feel you have to investigate huge complex things. Even learning how to geo locate videos and doing that repeatedly is a really good skill to build up. We also have a discord server. We've got 28,000 members there and we encourage anyone to go there and start looking for the channels and see if there's any conversations they want to get involved with. We've published work that's come from that discord server as well on topics that probably wouldn't have been looked at by anyone had it not been for our community digging into them. So we've created that space as a way that people can kind of do that stuff. It used to be Twitter was the place for that, but now Twitter is not the place really to do that anymore because of changes by Elon Musk. So yeah. We're trying to create those spaces. And there's quite a lot of videos out there as well. So there's a guy called Ben Strick who used to work with Bellingcat and is now part of the Center for Information Resilience and he publishes YouTube videos explaining how to do different types of investigations. And we do on our own YouTube channel. So yeah. There's a lot of stuff out there. My main piece of advice beyond looking at that stuff is don't feel you have to do huge investigations. It's just enough to, you know, find one thing about one video or photograph that no one else has figured out.

Andrew Hammond: To do this type of stuff should -- it is okay for people just to use their home computers or should they really have a separate laptop that's configured in a specific way with Linux and, you know, all the kind of fancy stuff?

Eliot Higgins: Yeah. You don't need to do anything fancy with this. The one warning I would give, though, to anyone who's thinking about doing this stuff one thing that's really a big part of this is trauma management because you can have an impact from trauma by watching this video content and we do -- we have actually articles on our website talking about this, how to minimize the risk of that. But I think because people are so used to kind of doom scrolling about conflict on social media now they don't realize that's actually quite psychologically damaging for some people and that desire to kind of be a witness to it is actually often driven by a sense of powerlessness and that sense of powerlessness can actually cause harm if you're constantly being exposed to this imagery and you don't feel there's like a way to actually do something about what you're seeing. So I really warn anyone doing this work to like really judge what you're looking at and I actually think it's, you know, worth my mental health if it's really horrible stuff.

Andrew Hammond: And it seems to me that Bellingcat in a way is almost like a market disruptor a little bit for journalism and for state intelligence agencies. So I just wondered like what has Bellingcat's relationship been like with both of those communities? Obviously it can depend on which ones. The GRU or the SVR or the FSB might have a particular take on Bellingcat that could be different from MI6 or CIA or MI5. And, you know, we -- you hear people like from the intelligence community or formerly from the intelligence community in the U.S who praise Bellingcat, but then there's also people who are critical of Bellingcat. So just help me understand how Bellingcat relates to both of those worlds.

Eliot Higgins: Yeah. So in terms of intelligence we've generally done everything we can to avoid any direct contact with them or in direct contact with that because we get accused of being proxies for the CIA and, you know, MI5 and MI6 all the time. So we're quite careful about making sure we're transparent about how we work and who we're talking to and that we avoid those relationships. Generally speaking I think we had -- in the west we get a good response. I mean I've read the articles where they say, you know, what Bellingcat are doing is great. In Russia we get the opposite response, but that's often because we're exposing the activities of Russian intelligence services and we've also done a lot on Russia's crimes in various countries. So that [inaudible 00:24:18] in a big way. So we do have a lot of security [inaudible 00:24:22] concerns at Bellingcat around those kind of things. It's just but it's kind of just part of, you know, the price of doing business in one way. With regards to journalism, for example, I mean we've generally had a really strong and positive response and you've really seen in the last few years more news organizations using open source investigation and setting up teams to do that. I think the "New York Times" really led the way in doing that in the kind of mainstream press. Malachy Brown did a fantastic job with the "New York Times" Visual Investigation Team. You've now got more organizations doing it for the "Financial Times," CNN. You've got the BBC setting up BBC Verify and the new head of BBC News is a very big fan of Bellingcat and open source investigation. So this is something that's becoming kind of a bigger and bigger thing. But what's actually really lacking is training in this because this still was something that emerged from amateur communities so you don't really have this being taught at university. You aren't -- if you go to journalism school you might learn about this, but it's still not something that's like really deeply integrated into the like university level education. So it actually makes it a bit difficult for employers [inaudible 00:25:26] there's this kind of big increase in interest in open source investigation finding people who've actually been trained to do it rather than just learned how to do it themselves. So this -- I think there's quite a gap in terms of, you know, the amount of practitioners there are and the demand there is for people who are actually doing it.

Andrew Hammond: And tell me a little bit more about professionalization. So a couple of weeks ago an episode of our podcast was featuring the U.S army's senior open source intelligence advisor and you know they -- the U.S army obviously have a particular view of how they're going to do this stuff and it relates to their mission and what they do and so forth. But there is this view that, you know -- well, let me back up for one second. So I think there's a couple things going on there. One is open source intelligence or OSINT versus open source techniques. And then there's the -- you know the idea that intelligence is still there. So Bellingcat, an intelligence agency for the people. So I just wondered if you could tell us a little bit more about the idea of Bellingcat as an intelligence agency for the people and then also the relationship between open source intelligence that governments do and then what private citizens or Bellingcat and other organizations like you guys do. Just help me understand that a little bit more.

Eliot Higgins: I think a lot of the confusion comes from really in the early days of this, you know, back in 2011 there was a very small group of us who were doing this kind of work together online. And we didn't really have words to describe what we were doing. So someone started using the words open source intelligence to describe what we were doing because we didn't have really a word to describe it ourselves in our own terms. So that kind of stuck when ultimately we aren't doing open source intelligence because that's part of an intelligence process with certain products at the end of it. Ultimately we're doing open source investigation or online open source investigation. But I mean OOSI doesn't sound as good as OSINT so that's why people still use that. It's also become a trendy thing to use on Twitter accounts that repost videos from Telegram. They say, you know, Ukraine OSINT and it's like Telegram [inaudible 00:27:39]. So and one good way to spot someone who isn't really doing a -- who I would say might be a bit dodgy and isn't a good open source investigator is they go straight to calling themselves an OSINT account on social media. It's usually a bad sign. But I think yeah really in terms of how this has become professionalized it already did start with amateur communities figuring out stuff as they were going along. And certain things are quite easy to check like a geo location someone else can look at and check. It's basically spotting the difference with video footage and satellite imagery. So it's not that difficult. But really what we're trying to do at Bellingcat is democratize that process and get as many people involved as possible. And there's a few reasons to -- for motivating us to do that. One is I think it's just good for healthy democracy that people are engaged with the information and trying to verify facts and collaborating together to do that. But we've encountered a lot of topics where there was a lot of open source information, but they aren't the main focus of the open source investigation community which has been quite small up until a certain point. So they don't get looked at. And there's one that really stuck in my mind that several years ago we were doing a workshop in London. And our workshops would be five days and three days of those would be training and two of those would be practical examples taken from current, you know, stories that were happening. And that week this video from somewhere in Africa was circulating showing soldiers executing two women and two children at a roadside somewhere in Africa. And we were digging in to, okay, where could this have been filmed? Who was responsible? But that only happened because it was -- happened that week and it was trending on social media in terms of that kind of video. So that eventually led because we started at the workshop to the soldiers being arrested, imprisoned for those executions. So that led to accountability. But it was mostly random. Had that workshop been a week earlier or a week later it would have never have happened. But that randomness is not something to be -- like we have to stop things being random. The randomness is then there by the chaotic nature of the internet. What we need to do is create more opportunities for those random things to actually be picked up and processed into something. And that's why we create spaces like the Bellingcat discord server where it's not just up to our small group to decide what needs to be looked at and to look at it. We can get as many people involved as possible, but then, you know, be able to draw from that into kind of the core of Bellingcat, verify it, and publish it so there can be the impacts that can lead to real accountability. So I think that's when we talk of ourselves, you know, well -- converse as an intelligence agency of the people. That's really that idea that this is not about us telling the people stuff. It's about people actually learning the skills to find the stuff themselves and look at the stuff they care about and what they think is important.

Andrew Hammond: And in a world of state intelligence anyway you have the different ints, I-N-T-S. So imagery intelligence, geographic intelligence, signals intelligence, human intelligence, and so forth. So just again for our listeners that are maybe just trying to get their heads around this they've got a laptop, they open it up, turn it on, they go to Google. Like what kind of ints are they using? Like imagery, signals -- yeah, help them understand like what sort of information are they going to be using to try to build up a picture that you would do during an investigation. And what kind of web sites would they be going to?

Eliot Higgins: Well, it depends, but you know broadly speaking first there's social media. It's, you know -- you find stuff on social media initially. That's often your first idea that, you know, something's happened somewhere in the world. And you can then use -- explore all the information that's available on social media about an event. So often what you get with social media is the kind of initial -- very short initial aftermath of an event. You'll get a ton of posts from people who are witnessing and seeing it. And that's the real key stuff you've identified because the second way are people talking about and sharing about material rather than being the original source and that tends to kind of eventually increase the amount of stuff that's out there. And that adds a lot of noise because then you're dealing with people's interpretations of images and biases. So you try and identify from social media those original posts. So it's like with MH17 there were people on lots of different social media platforms who saw the missile launcher and it's discovering all of that kind of stuff. You then have other way -- other kinds of data sources. You have, you know -- you might be trying to geo locate a video. You've got satellite imagery that's available. You know 20 years ago if you said to someone like an organization like Bellingcat can task a satellite to a specific location to look at it, and it doesn't cost them that much money, that would be unbelievable. But that's what we can do now. If there's an incident we can send the satellite over there and get good quality satellite imagery. But even for those who can't there's still massive amounts of satellite imagery available online and satellite imagery companies are now inclined to share imagery of key events for free. So especially with Ukraine you had lots of satellite imagery companies who were putting out imagery for the public to look at as soon as it was available which can be less than 24 hours in some cases. So that's an incredible resource. You also have Google street view imagery and street view imagery on sites like Yandex maps as well that is also really useful reference imagery if you want to have a look at a location, geo locate something, or just have a bit of a sneak around virtually of, you know, a location that's interesting. You also now have ship tracking and plane tracking websites that allow you to track vessels. We've used that recently to track a vessel that was responsible for an oil spill off the coast of Trinidad and Tobago. But, you know, in terms of plane tracking I mean people move -- Elon Musk getting very upset about his plane being tracked, but there's this huge amount of information available there. There's also all kinds of online systems and databases that might be financial records in different states and countries. It could be really obscure data sets of like purchase orders for, you know, weapons sold to U.S allies and stuff like that. Just loads and loads of these data sets that are out there. And then you have the aforementioned specialist communities who may be really interested in, you know, trains, feet, whatever their specialization is, but they often have a massive amount of knowledge about very specific topics and that's also a really good resource on that. And then you have official statements, media reports, and you combine all of that together and that with a very long process of verification and analysis will hopefully give you the answers that you're seeking. But within all of that you don't have to be the entire process. You can be geo locating one video that's relevant to a much more complex investigation. And that's where this kind of networked effect that we have around Bellingcat with our community acts as a real force multiplier. And I think that's where a lot of organizations be they the media or you know the military they really lack that capability because the media's too scared of having strange people involved in their editorial process and, you know, military intelligence is military intelligence so they don't want people of the internet being involved in that either. [ Typing sounds ]

Andrew Hammond: So I guess the idea of the intelligence agency for the people, that's more possible in say the U.S or the U.K or western Europe, but for a country like China I'm guessing it's going to be very difficult for people to do this type of stuff or to be involved in these types of investigations because of the great firewall of China and the fact that, you know, the -- part of the idea behind the Chinese communist party's restricting the information that the citizenry get about the world and about the true nature of their regime and their state and so forth. So yeah. Would you agree with that? Is that true?

Eliot Higgins: Yeah. That's not to say you can't investigate things that are happening in China or be part of networks that, you know, Chinese people might to be part of who want to investigate that, but actually being inside the country and being part of that is going to be very, very difficult indeed. But one of the advantages of living in a networked society that's connected to people all across the world is you don't have to be in the country to investigate something that can help a lot of people in that country. Again it's like the Trinidad and Tobago case. No one involved in that case is from Trinidad and Tobago or has anything to do with it. But they were still able to really help the local understanding of it and have action taken because of that work. So it creates this kind of sense of international solidarity to a certain extent that you can, you know -- if you care about a topic no matter where it's happening in the world you can be involved in contributing in a positive way. But it also means we have to be kind of very careful with how we create spaces. So we have our discord space, but we had a lot of debate about should we have a Tik Tok account. And we decided no in the end because we didn't want to create a kind of honey pot for every open source investigative person in the world to be identified by the Chinese government.

Andrew Hammond: Yeah. That's interesting. And just talking about the Chinese government, just thinking about your lead Russian investigator. He's a wanted man in Russia and with the [inaudible 00:37:11] case, the other types of stuff that you've been involved in, and the war in Ukraine and Syria and so forth, like how much either you personally or for Bellingcat do you brush up against the darkness that is out there? You know the people that are -- have malevolent intentions toward you or toward Bellingcat. How do you stay safe? How do you secure your information? You know, yeah, just help me understand like because Bellingcat has went from, you know -- it must be a real trip for you. It's went from being this part of this small online investigation community and now you're on -- you're known by Elon Musk. You're known by Russian intelligence. You're known by the CIA. So yeah. Just help us understand how you deal with that.

Eliot Higgins: Yeah. It's kind of like in terms of the kind of threats that can be broadly put into two categories. One is state level actors and the other is crazy people of the internet. So there's a certain [inaudible 00:38:14] how you kind of have to treat that. There's physical security issues. So it's making sure that you're safe in a number of ways. If you're traveling, you know, you have a sense of security around, you know, where you're staying. We have a security officer who we report our movements to and stuff like that. We have a cybersecurity so we have to be really on top of that. I'll not give the specifics for obvious reasons. But yeah. So there's cyber in terms of, you know, hacking attempts against us and, you know, that's certainly happened in the past. I mean we know a lot about phishing campaigns because we've been targeted by so many of them. And we constantly educate our staff about those and have reminders of what that looks like through various certain efforts. We also have in terms of cybersecurity kind of disinformation and, you know, how we're targeted by disinformation by state level actors, but also communities who may or may not really believe that we are the CIA or, you know, working for western governments. So we have a very heightened awareness of all of this and that we have -- it's something that we educate all our staff in that everyone from, you know, the people working on admin to the investigators need to understand that because they're all potential vectors for attack. And then yeah. A lot of it is just being careful, being sensible. But yeah. There's certainly been activity that's targeted us in all those different realms. And, you know, that's had consequences but I think so far we've been being careful enough. It only takes them, you know, getting it right once for it to be a problem.

Andrew Hammond: And I think that just because it's so relevant to what -- the types of things that we look at here at the International Spy Museum, can you just tell us a little bit more about the Skripal case which I think is one of the most fascinating ones and with your book it's the one that opens up your book? So just tell us a little bit more about that and some of the -- you know many of them may well know about Skripal and what happened, etcetera, but help them understand the role that Bellingcat specifically played in identifying the killers and so forth.

Eliot Higgins: Yeah. This was always something that kind of really sucked us in with regards to an investigation because it started a few months after the Skripals were poisoned actually when the U.K released the identities of two suspects involved. And there was a Russian website that got the flight manifest they had used to fly to the U.K which included their passport numbers. So those passport numbers were only a few digits apart even though they appeared to be unrelated which was odd. Now one of my former colleagues, Christo Grozev, he was someone who as a kind of hobbyist was really interested in Russian spies and he was also aware of the Russian -- what's known as the [inaudible 00:41:03] market which is basically the black market for data in Russia. In Russia it's really, really easy to get government data because the government collects loads of data on its citizens and lots of its citizens who have this data are really corrupt. So you can go online and in Russian internet forums find someone who knows someone who can get you say someone's phone records or their passport registration form which is what we got from the two passports that were used by the two suspects in the Skripal case. And it was always done at the time -- surely Russia isn't going to like stamp secret service and the phone number of the Russian MOD on these forms. But it turned out they actually did do that on these forms and it was kind of like at that point it was like okay. Well, that gives us a huge amount of leads to start digging into. That's what we did. We just dug into all this data, all these leads that were produced. So we were first able to identify the two suspects by their real identities because we were able to establish that they used the same first name, place of birth, and date of birth in their fake identity documents frequently. So that allowed us to ID one suspect. The other suspect we basically profiled him. We understood that he must be in a certain part of the military intelligence, that he was probably only going to go to so many military schools at a certain time, and basically just used all the open source information about the other attendees to narrow down a potential list of suspects of who this could be and then figured out who that was. So we were able very rapidly to expose the fact that these two guys who were [inaudible 00:42:33] saying they were sports nutrition salesmen were actually GIU officers. From there we started -- it just sent us down like one big line investigation that next led us to the same group being involved with the poisoning of Emilian Gebrev in Bulgaria who was an arms dealer. And around the same time arms depots he had in the Czech Republic were blown up by the two Skripal suspects and this actually in the last couple of weeks has now become something they've been charged for by the Czech authorities. Throughout this we're getting lots of phone data. So we're identifying more and more interesting people and one of the interesting people identified in these phone records with the poisoning suspects was a scientist who worked at a sports nutrition facility where all the other scientists who worked there, including himself, were former members of Russia's chemical weapons program. And we were able to identify that this was very likely where there was a hidden secret chemical weapons program being used to produce chemical weapons for the purpose of assassination. So when Navalny was poisoned we were able to get the phone records of the people suspected to be involved with that poisoning. And they had been calling these same scientists that -- you know, around the time they poisoned Navalny. And by analyzing their travel records which again were also publicly available thanks to Russia and all this other data we were able to track their movements and connect them to multiple poisons and assassinations that included the poisoning of Vladimir Kara-Murza twice who he's now imprisoned to Russia, but he was a close ally of Boris Nemtsov who had been followed by the same assassination team that poisoned Navalny, but they stopped following him and changed target to Vladimir Kara-Murza a week before he was shot to death outside of the Kremlin in Moscow. So and additionally we found multiple other people who'd been targeted by the same team. One was a Russian poet who'd been writing satirical poems about Putin. A couple of local activists working on kind of regional issues. So it became very clear that this poisoning program wasn't just one or two things here or there. It was a systematic program to murder people who were problematic for Russia both at home and abroad. But this ultimately was really just one thread we just kept on picking and there's just so much to it that, yeah, we can go a long way with it.

Andrew Hammond: And if people that are listening to the show want to dig into this Skripal case a bit more, how can they do so? Is there some kind of like report on the Bellingcat website, a PDF or it details each stage of the investigation and what was found? Or is it more there's a variety of articles and they go through them and they can follow the links? Or yeah. Help them. I think the Skripal case is a good way for people to try to get their heads around open source investigations. Like what products are there to help them do so?

Eliot Higgins: I think the best [inaudible 00:45:18] and this is a bit of self promotion, but I do write about this in my book in some detail. It's all on the Bellingcat website, but it's multiple articles over several years that it's a big task to read that when they're all split up all over the place, but yeah. It's detailed in my book and if you really want to dive into the specific evidence then we have lots of it on the Bellingcat website.

Andrew Hammond: And just thinking as well about the Skripal case with MI6, for example, MI5, MI6, British intelligence, with a case like that this would normally be the preserve of a nation state's intelligence agencies. They would be the people with the capabilities and the know how and the connections to try to uncover who these killers were. But then they could either sit on the information or they could publicly disclose it which is not something that they traditionally did. But now you're coming in and sort of skipping them and putting the information out there. So how -- how does that like -- yeah, just help me understand the sort of market disruptor effect of Bellingcat with regards to say British intelligence in this particular case.

Eliot Higgins: I mean we also in this case we really saw the impact of that. I did get the impression we were finding stuff that maybe the intelligence of the services of the world didn't actually have. And as this has gone on it's become more and more apparent that it's like the Czech warehouse explosions where they didn't seem to know who was involved until we identified the two Skripal suspects. That we provided a lot of useful information for these people across the world to build their own investigations on. So I think the biggest impact we've had really has been if you look at 2022 and the run up to the invasion of Ukraine the way U.S intelligence was declassifying information, a lot of which actually came from open sources, but would have been combined with other intelligence products and classified, but they were declassifying those so the state departments -- President Biden could talk about what they were observing through this. And because that material often came from open sources the open source community could find that same material and say, "Oh, they've spoken about this in the press conference. Now here's the actual video they're talking about. Here's the analysis of it." So it's kind of like this. It increases, I think, transparency. And I think more countries need to think about that in terms of, you know, winning the arguments when it comes to the intelligence they have on these kind of developments because certainly the U.S intelligence community post, you know, 2003 with the invasion of Iraq has not got a good reputation among the public. So having any form of transparency where they can at least point in the direction of the evidence, if not give the evidence outright, can be very, very helpful.

Andrew Hammond: Two final questions. One is there was a British journalist back in the day called Chapman Pincher and he would quite often for the "Daily Mail" he would publish stories based on tips that he got from intelligence agencies. He was accused of being a urinal for British intelligence. And I know that Bellingcat doesn't, you know -- it's not like you guys are meeting up with MI6 and saying, you know, "Give us a clue. What should we investigate now?" But in the information space when you're playing with intelligence agencies there's always these agendas that are going on in the background. You know, about shaping the information space. So I guess the question just to boil all of that down the question is how does Bellingcat stay cognizant of how you can be used as a tool or a pawn in how other entities shape the information space?

Eliot Higgins: I mean we don't really take any information from that kind of -- those actors. It's all, you know, stuff that's been chaotically shared online. So if it's false information then the way in which we verify stuff is very easy to spot false information. If it's coming from a source that even is slightly smells like it could be from an intelligence source like someone emails us and say, "I've got all these emails you should read from this person. Can't tell you how I got them," then we're going to be like that's immediately suspicious. We're not interested. So yeah. We do a lot to kind of really keep away from that -- those kind of people and getting involved with anything like that. But yeah. I mean the thing is they're always going to be able to use the information we produce because it's verified, it's publicly available, and there's nothing we can really do about that side of things, but we avoid using anything that they would be providing in any way whatsoever.

Andrew Hammond: And final question. What does your day to day look like now and do you still get a chance to do your original love which is the actual investigations?

Eliot Higgins: Very rarely unfortunately. I -- the thing is that for me it's about being able to facilitate the work of our staff because you've got loads of really great investigators in our staff working a whole variety of different topics. And because of kind of my position in the open source community and my own personal reputation I use that to help them do their work. You know, be it through fundraising or connecting them to the right people or being able to have meetings with people they wouldn't otherwise be able to talk to. And then, you know, move stuff along in that way. So yeah. I try and make myself very useful. I'm also running the Bellingcat production company and we've got three documentaries that have been in the works. And yeah. That's keeping me quite busy as well. And at some point I'm supposed to be writing a second book, but I'm still not certain exactly what that's going to be about.

Andrew Hammond: Okay. Well, thanks ever so much for your time. It's been a pleasure to speak to you.

Eliot Higgins: That's great. Thanks very much. [ Music ]

Erin Dietrick: Thanks for listening to this week's episode of "SpyCast." Please follow us on Apple, Spotify, or wherever you get your podcasts. If you enjoyed the show, please tell your friends and loved ones. Please also consider leaving us a five star review. Coming up next week on "SpyCast."

Unidentified person: So it was my good fortune to be able to debrief Ana Montes for NSA and they don't exactly train you on how to talk to someone like Ana Montes. So my role was simply to try to listen to information from her to learn as much as possible.

Erin Dietrick: If you have feedback you can reach us by email at spycast@spymuseum.org or on X at intlspycast. If you go to our page thecyberwire.com/ podcasts/spycast you can find links to further resources, detailed show notes, and full transcripts. I'm Erin Dietrick and your host is Dr. Andrew Hammond. The rest of the team involved in the show is Mike Mincey, Memphis Vaughn the Third, Emily Coletta, Emily Rens, Afua Anokwa, Ariel Samuel, Elliott Peltzman, Tre Hester, and Jen Eiben. This show is brought to you from the home of the world's preeminent collection of intelligence and espionage related artifacts, the International Spy Museum. [ Music ]