How to Conduct Open-Source Research on the Russian Internet

About This Guidebook

This research project by Aric Toler, a contributor at RuNet Echo and Bellingcat, offers a series of guides,
tutorials, and walkthroughs on understanding and conducting open-source research on the Russian-
language Internet (RuNet). The primary focus of the project is providing instruction on the nuances of
Russian-language research relating to the conflict in eastern Ukraine by using contemporary case studies.
To show how these methods are useful in other conflicts, this project will also explore some similar open-
source work being done on the Syrian conflict. The finished product will help readers learn how to
understand and conduct such research.

There are more Internet users in Russia than any other European country, yet there are no detailed guides
or tutorials available to guide non-Russian speakers on navigating the wealth of open-source information on
the RuNet. Many, if not most, of the guides will be accessible to those with little-to-no Russian skills, giving
non-Russian speakers the tools and confidence to access information on the RuNet.

The project helps researchers, journalists, and anyone interested in understanding more about the Russian
Internet to verify sources and understand information found on Russian social media. It also provides some
techniques for media forensics involving images and videos, including the different levels of verification
needed for different uses: journalistic, evidentiary, as well as other avenues.

The motivation for carrying out this project is to satisfy a demand among English-speakers for learning
materials about carrying out and verifying open-source research on the RuNet. There is a wealth of
information on the RuNet that is of interest to specialists, journalists, and the general public in the English-
speaking world. There are currently no guides, however, that provide instruction for navigating and verifying
these sources that differ from English-language counterparts. Important sources for research data include
exclusively Russian-language social networks like Vkontakte and Odnoklassniki, along with others that
function in Russian-language pockets on Twitter, YouTube, Facebook, and elsewhere.

Open-source research can complement traditional journalism by generating leads and supplementing on-
the-ground reporting. For example, the author of this project, Aric Toler, provided open-source research on a
particular Russian soldier who fought in Ukraine to VICE News journalist Simon Ostrovsky to assist him in
following his “journey” from his hometown to the battlefields of Ukraine (see “Selfie Soldiers: Russia Checks
Into Ukraine”). In another example, open-source research from Bellingcat into the downing of Malaysia
Airlines Flight 17 provided material for a 60 Minutes Australia investigation at the site of the tragedy.

Each installment of RuNet Echo’s guidebook includes a detailed tutorial, accompanied by case studies,
teaching readers how to conduct a particular kind of open-source research.

How to Conduct Open-Source Research on the Russian Internet

• So You Want to Conduct Open-Source Research

These general instructions address specific ways to assess the reliability of photographs, videos, and human sources, with a
special focus on the Russian Internet.
page 1
• What You Need to Know About Russian Social Networks to Conduct Open-Source Research
Outside of the familiar English-language social networks of Twitter, Facebook, Instagram, and others, there is a handful of
social media platforms used either exclusively or primarily in the post-Soviet world.
page 13
• Want to Research the Russian Internet But Don't Speak Russian? We Can Help.
Conducting open-source research is especially challenging when you don't speak the language of your research topic.
Thanks to the Internet, however, even these obstacles don't make it impossible.
page 23
• Unearthing Local Stories on the Russian-Language Internet
While a lot of open-source research on the RuNet is possible thanks to broad Internet searches, sometimes it’s best to drill
down to the narrowest sources available.
page 30
• Herein Lie the Secrets of Geolocation
This guide will provide instruction on using satellite images, with a focus on historical imagery, and available street-level
imagery accessible for Russian and Ukrainian cities.
page 38
• Triangulating Sources to Thin the Fog of War
Even with the flood of information created and made accessible by the Internet, the fog of war is still thick. But it's not
impenetrable.
page 47
 • How to Comb Russia's TV News
This guide explains how to evaluate Russian TV news sources and navigate television networks’ online video archives, in
order to compare coverage of specific events.
page 53
• How to Learn More About the Big Wigs and Public Officials in Russia and Ukraine
There are numerous free and open information portals and databases available for researching individuals in Ukraine and
Russia, whether you are investigating a public figure or a private individual.
page 60
• You've Read Our Open-Source Research Guidebook. Now Let's Use It.
This ninth and final entry takes the tools and instructions we've been studying and applies them to a single case study: last
year's wildfires in the Siberian city of Chita.
page 65

What we do: Global Voices reporters cover how citizens use the Internet and social media to make their voices heard, often
translating from and to different languages.

So You Want to Conduct Open- from a variety of traditional media outlets, such as
Source Research the BBC, and emerging projects, like Storyful.

These general instructions address specific

ways to assess the reliability of photographs,
videos, and human sources. While most of the
advice applies to any area, we focus specifically
on Russian-language evidence and sources.

Contents

• Photos
• Videos
“Dreaming” by a4gpa. October 3, 2009. CC 2.0. • Vetting Sources
Edited by Kevin Rothrock.
Photos
Before diving into the specifics of
There are countless ways to verify an image,
investigating open-source data on the RuNet
depending on the various elements of the source.
(Russian-language Internet), it's useful to
One of the most common ways to verify a
understand the general verification processes that
photograph is by geolocating the image, which
are applicable to all sources of open-source
involves confirming or rejecting a photograph's
intelligence (OSINT). For a comprehensive
location by matching visible elements to outside
treatment of the verification of digital open-source
sources, such as road signs, topographical
intelligence, you may want to see the Global
features, and landmarks. Another way to verify
Voices social media verification guide or
claims about an image is to verify the time that it
the Verification Handbook, written by journalists
was taken, either through seasonal differences (for

1
example, is snow visible in a photograph logos are plastered onto it, including the Web
supposedly taken on the day after reports of heavy address of RusVesna.su, implying that the site’s
snow?) or specific times, by measuring observable photographers recorded the image themselves or
shadows. These two verification methods— hold the rights to the photograph.
geolocation and “temporal” location—will be
covered in extensive detail in a future installment
of this series.

As detailed in the two broad verification

guidebooks cited in our introduction, the quickest
way to verify a photograph’s uniqueness is by
conducting a reverse Google Image Search or a
TinEye search. Let's take a couple of Russia and
Ukraine-specific examples to verify media content
through these reverse image searches.

As described by StopFake and other outlets,

several pro-Russian and separatist media outlets
have used decades-old photographs to depict what
they claim are recent events in the the war in
eastern Ukraine. For example, in the below article This photograph, as many have pointed out, is
on the pro-separatist website RusVesna.su actually from Tiananmen Square in 1989. A
(meaning “Russian Spring”), a photograph of reverse Google Image search of this image will
military equipment on fire is juxtaposed with a story reveal this fact, when the search dates are
about fighting in eastern Ukraine on June 25. The restricted to resulted published before the
photograph is presented without context, and two Ukrainian conflict.

2
How do you conduct such a search?

Go to images.google.com, and click the camera

icon, in order to search by image:

After modifying the search's date parameters, it

You may need to take a screenshot of the becomes clear that this image likely comes from
photograph you want to search. Either upload the China and appeared online before the conflict in
photograph (a screenshot or the actual saved file eastern Ukraine.
will both work) or enter a URL that directly leads
back to the image file (such as .jpg, .gif, .png—just
not the entire webpage that hosts
the image). When conducting a reverse image
search, be sure to find the highest resolution copy
available, as it will bring the most results.

3
 There are various free tools that will analyze a
photograph’s metadata and compression
information, allowing further verification of an
image’s veracity. The results are not always clear,
however, and depend on the copy of the file
uploaded. For example, a JPEG that has been
resized, recompressed, and changed from the
original file will have much less reliable data than
the original full-resolution image recorded by a
TinEye works roughly the same as a reverse camera. Still, if you would like to try to analyze an
Google Image Search, but will usually return fewer image through ELA (error-level analysis) or its
results. The mechanisms are the same as Google metadata, visit findexif.com, fotoforensics.com,
Image Search, where you can either upload an and Izitru.
image file or provide a URL.
Instead of digital forensic tools, you can also rely
on the naked eye. The easiest way to detect a
Photoshopped image is by examining an image's
shadows and reflections.The Moscow

4
Times, StopFake, and many others have noted Just as with many hoaxes in the English-language
that Russia’s Investigative Committee used a corners of the Internet, a simple reverse Google
Photoshopped image of Donetsk in flames on the Image Search or critical eye can stop many
cover of a book entitled The Tragedy of Southeast falsehoods in their tracks.
Ukraine. When examining this image—which was
also used in a news article on the site Videos
Politnavigator.net—it is clear that the reflections in
Unlike images, there are no services available for
the water are incorrect.
reverse video lookup. This means that when you
find a video, there is no fast solution for verifying
its original source. However, there are still ways to
carry out a reverse-verification of a video to see if
supposedly new evidence is actually rehashed
material.

The closest thing to a reverse video search is by

capturing a screenshot of the video at a particular
moment, and then conducting a reverse Google
Image search of that screenshot. Additionally, you
can take a screenshot of the video’s thumbnail and
The incorrect reflections in the water are evident
reverse search it, hoping to find a copy of the video
across from the rising flames, especially the
elsewhere on YouTube or another video hosting
leftmost column of fire and smoke. Note how a
service. A more detailed description of how
building is reflected in the water beneath the left-
YouTube generates its thumbnails can be
most flame, while the fire is not. As discovered
found here.
by StopFake, the flames were artificially added to a
normal picture of the Donetsk cityscape.

5
This video on Vkontakte, Russia's most popular
social network, is titled “SHOCK!! July 19, 2014 at
3pm, a BRUTAL shelling from a GRAD of the city
of Gukovo.” The video, posted on July 19, 2014, is
apparently from Russian state television
channel Rossiya 2, and shows soldiers loading
missiles into a Grad multiple launch rocket system
and firing them. Without any specific identifying
features, it is hard to verify the time, location, and
original source of this video based on context clues
alone. However, by taking a screenshot of
particular moments in the video, we can find the
original video source.

The best places to take screenshots are the very

beginning and very important or unique moments.
The first video frame does not return any helpful
results, but a screenshot of the moment of the
missile launch yields multiple search results:

6
 Once you verify that a video is unique, the location
and time of the photograph should be verified to
greatest extent possible. In April 2015, wildfires
ravaged much of Siberia, including the region
known as the Zabaykalsky Krai. A video emerged
onYouTube and Russian social networks,
including Odnoklassnki, showing a hellish scene of
cars driving through thick smoke. Reverse image
searches did not reveal any duplicates of this video
after it was posted on April 14, meaning this video
could not be verified debunked using this method
alone. The time stamp on the video itself
checks out, showing April 13, 2015; however, this
information could be modified or digitally added,
and is thus not a reliable means of verification. An
inspection of the license plates in the video
showed that the code was 75 (top right, after НК):

Following the first link gives us a video uploaded in

October 2013 of Russian soldiers conducting
training exercises in 2009 with the Grad multiple-
launch rocket system. Clearly, this video does not
show Ukrainian soldiers shelling Russia on July
19, 2014, as the original user claimed.

7
 Verifying the reliability of sources on social media
is not too different on the RuNet than it is with the
rest of the Internet, but there are some special
considerations one should make. While there are a
number of “bots” that send out identical tweets in
every language, there is an especially large
concentration of them on Twitter writing
in Russian. This trend is particularly true with
politicized events, as both pro-Ukrainian and pro-
Russian headlines are spammed across hashtags
and keywords, making open-source investigation
more difficult.
Cross-referencing the license plates codes in
Russia shows that this code is indeed local to the In the screenshot below, we see that an identical
Zabaykalsky Krai, lending additional credibility to tweet has been sent by dozens of Twitter bots at
the video. Additionally, the user who uploaded the the same time. The tweet reads “A source says
video to YouTube has one other upload from a bomb threat has been called in at two hotels in
months before the wildfire video—a local news Moscow,” with a number of people with generic
broadcast segment for Khakassia, located not Russian names spreading the information.
far from the Zabaykalsky Krai. With all of these
factors combined, there is no open-source
information available that leads us to think
this video was fabricated or falsely represented.

Vetting Sources

8
 This bomb threat did actually take place, but these
bots are not reliable sources of information. So,
how do you find out if a source is a real person, or
just a bot? Other than the context clues of the
account’s tweets, such as sending out thousands
of tweets with only a handful of followers, you can
reverse image search the user's avatar.

Most bots and other unreliable sources—both in

Russia and elsewhere—will use stolen
photographs of other people as their avatars. For
the Twitter bot @PatnietecnAmwa (or “Mashka
Ya,” indicating that the woman’s name is Mariya),
a quick investigation of the account's avatar
reveals that the Twitter account is likely not
operated by a human.

9
After copying the URL of the avatar (or just clicking Here, we see that the avatar of “Mashka” is
“Search Google for this image” in the Chrome Web actually a woman named Dasha Makarova, and
browser), paste the link into a reverse Google that the Twitter user’s avatar was almost certainly
image search to find similar pictures elsewhere stolen from the woman’s VKontakte page.
online.
To find the original source of this tweet, search the
headline on Twitter and find the first person who
tweeted those exact words on the day of the flood
of bot tweets. The original source of this tweet
comes from @_ainequinn, a more reliable user
than the other bots, as he has over a thousand
followers.

10
 photograph is commonly reused in reports
about emergency responses in Moscow, appearing
in various news stories as far back as 2011.

However, we still must verify the information in this

tweet, even if the source seems to be reliable. The
photograph shared by this user shows a scene that
seems to fit the situation: emergency responders,
a bomb-sniffing dog, and a truck with the
word “MOSCOW” (Москва) on its side. A reverse
image search reveals, however, that this

11
While the more human-seeming Twitter account
appears to be a more reliable source of information
than a horde of bot accounts, the photograph that
accompanied the tweet is generically used and not
truly from the scene of the bomb threat. Thus, as
we see from these examples, it is always
necessary to verify specific pieces of information
using all available means.

The next installment in this guidebook will be

an introduction to Russian social networks and the
unique Russian and Ukrainian usage of Facebook
and Twitter.

12
What You Need to Know About Contents
Russian Social Networks to • VKontakte
Conduct Open-Source Research • Odnoklassniki
• Moi Mir
• VKontakte (or VK, which means “In Contact”)
is by far the most popular social network in
Russia. The layout is basically the same as
Facebook of years past, but with added
quirks and a heavy dose of pirated content.
• Odnoklassniki (“Classmates”) is the second
most popular platform in Russia. The
demographics for this service tend to skew
Image created by Kevin Rothrock. older than other services, but it's still
immensely popular.
Outside of the familiar English-language social • Many Russians and Ukrainians also maintain
networks of Twitter, Facebook, Instagram, and too profiles on Moi Mir (“My World”), a service
many more to name, there is a handful of social operated by Mail.ru. Accessing information
media platforms used either exclusively or on a stranger’s Moi Mir account is more
primarily in the post-Soviet world. While the restricted than it is with the other services
instructions and tips laid out here are meant listed here.
specifically for Russia's homegrown
social networks, the general approach is the same VKontakte
for research conducted on any such website—
VK is by far the most important and popular social
especially regional networks.
network in Russia and Ukraine. The same is true

13
in Belarus, Kazakhstan, and other Russian-
speaking former Soviet states. In 2014, there were
more than 60 million VK users in Russia,
compared with only 10 million Facebook users.
Learning the ins and outs of this social network is
essential in conducting open-source research on
the RuNet.

Because you need to have an account on VK to

access much of the information available on the
website, you should register an account, if you do
not already have one. If you are using VK purely
for monitoring and research, there is no need to
enter your real name or personal details—all you
need is a valid phone number to receive a
confirmation SMS.

You must have a way to receive an SMS

message to confirm your account.

14
 • The military service information is also
unique to VK, when compared to Facebook.
Many soldiers and veterans will have
numerous battalions and groups listed here.
Russia has military conscription for young
men, and many (but not all) men will have
some military experience, whether it is listed
on VK or not. Contract soldiers will often list
multiple military units in which they served,
possibly with both conscripted and
contracted units. Additionally, soldiers will
often join public groups for their military unit.
• Click “See All” next to photos to see all of a
user's albums and profile pictures in one
place.
The account-setup process is very similar to
Facebook's, with user-inputted personal
information, pictures, a place for “posts” (similar to
a Facebook timeline), and a list of friends. Note
some of the highlighted sections in the image
below, which are of use when tracking Russian,
Ukrainian, and separatist soldiers, for instance:

• In the top right, there is a “last login” feature,

which is not on Facebook. There is no way
to see the location of the last login, however.

15
 The search functions on VK are much more robust
than on Facebook, and very easy to use. If you
were to look for soldiers from Pskov, Russia
serving in 2014, the search parameters below
yield numerous results:

16
You can also use more advanced options in
specific cases, to narrow your results to show just
users with certain kinds of employment, military
service, or education, past or present. For
example, if you wanted to conduct research on
corruption in Kyiv, you could search for specific job
titles, such as civil clerks, police officers, judges,
and so on, then scavenge the available open-
source information to find signs of conspicuous
wealth or lavish trips.

In the example below, the search parameters are

set for residents of Kyiv who list “police” (милиция)
in their employment field.

17
Of course, not every one of these results will be Registering for Odnoklassniki is a bit easier than
police officers. For example, one search result is VK, since you do not need to provide SMS
someone who is part of the “Group for the Support confirmation. However, unlocking extra account
of the Police,” and is likely not an actual police features requires SMS confirmation.
officer. Additionally, there are hundreds of other
police officers who are simply not on VK, or did not
list their job titles in searchable fields. If you're
looking for someone who isn't discoverable using
this kind of search, it's important to track networks
of contacts (partners, relatives, colleagues, and so
on) who might provide more information for your
research topic.

Odnoklassniki

Odnoklassniki is the second-most popular social

network in Russia. Like VKontakte, Odnoklassniki
is very popular in post-Soviet, Russian-speaking
countries, including Ukraine, Kyrgyzstan,
Uzbekistan, and Georgia. In 2014, Odnoklassniki
had around 40 million registered users in Russia
and 65 million in total. The service's users
are typically older and more likely to be
women than any other Russian social network.

18
After registering, you will be greeted by the home
page, which looks quite a bit different than VK
(and, by extension, Facebook).

Browsing Odnoklassniki anonymously, however, is

not free—it costs “OKs,” a sort of digital currency
on the site.
Odnoklassniki is unique among modern social
networks in that it provides users with the identities
of people who visit their accounts pages.
Therefore, if you are trying to conduct a discreet
open-source investigation, it is important either to
search anonymously, or to “Enable Invisible
Mode.”

19
100 OKs, which allows 50 days of anonymous use,
costs 100 rubles (not even $2). You can buy these
credits with a variety of payment methods,
including credit cards. Moi Mir

Like VK, Odnoklassniki has a robust set of search The third-most popular Russian social network
parameters: is Moi Mir, an offshoot of the Mail.ru web service,
not unlike the relationship of Google+ to Gmail. As
of 2014, Moi Mir had about 25 million Russian

20
users—roughly the same number of active
Russian Facebook users in the same year.

Moi Mir users set up their accounts through

a Mail.ru e-mail address. As with Odnoklassniki, no
SMS verification is required to complete
registration on Moi Mir:

As with Odnoklassniki, optional account verification

via SMS will unlock a Moi Mir account's
full features, but this isn't necessary to use the
site's basic features.

The search functionality of Moi Mir has many of the

same features as VK and Odnoklassniki, but it is
clearly aimed at being more of a dating site. Many
of the search parameters are based on physical
After selecting “Join now” on the signup screen, appearance, or (in what is likely unique for any
registration for a Moi Mir account is complete. social network) the user’s “Chronotype,” signifying

21
when someone typically wakes up and goes to based on location, as the site is not accessible in
sleep. English.

***

These three social networks are the largest such

websites specific to Russian and post-Soviet
users, but Russians also use Instagram,
Facebook, Twitter, and other sites. There has been
continued Russian-language growth on these
networks from all angles, whether we're talking
about the strong community of anti-Kremlin
opposition users on Facebook, Chechen leader
Ramzan Kadyrov's infamous antics on Instagram,
or popular pro-Kremlin Twitter accounts. If you
want to conduct research using the networks
with the largest numbers of ordinary Russian
speakers, however, you need to gain some
fluency in using VK, Odnoklassniki, and (to a
lesser extent) Moi Mir.

As you can see from the screenshots above, you

need to be able either to read Russian or to copy
and paste in Russian city names to search users

22
Want to Research the Russian identifies and explains free resources that allow
Internet But Don't Speak Russian? you to conduct Russian-language open-source
research without knowing the language. Here you'll
We Can Help. also learn how to navigate search algorithms on
Google and Twitter to retrieve usable information.

Contents

• Google Translate
• Abbreviations and Acronyms
• Searching in Russian
Google Translate

If you have little or no Russian language skills,

“Help.” Photograph by Ali Moradi, April 20, 2010. then translation software is an absolute necessity
Halifax, Nova Scotia. CC 2.0. Edited by Kevin for conducting research on Russian open-source
Rothrock. information. Google Translate is the most versatile
tool for translation, offering many features you
Conducting open-source research can be difficult,
likely know about already, along with some others
and it’s even more challenging when you cannot
that might be less familiar.
read or write in the language of your research
topic. Thanks to the Internet, however, even these The normal translation function of Google
obstacles don't make it impossible for people who Translate is certainly already obvious to you—copy
don't speak Russian to conduct such research in and paste in Russian (or type in English) text, and
Russian. To do so, you need to have equal parts receive a translation. You can also enter a
patience and technical knowhow in navigating
search algorithms and translation tools. This guide

23
website’s URL into the translation box and see the can greatly differ from printed Russian text. Below,
entire page translated into any given language. the phrase до свидания (“do svidaniya,” or
“goodbye”) is successfully rendered into type by
If you have trouble reading the Russian alphabet, Google’s handwriting tool:
Google Translate's “drawing” function, which
allows you to outline letters using your mouse or
trackpad, converts the sketches into editable,
translatable text. See below for an example with a
Магнит (“Magnit,” meaning “magnet”) supermarket
storefront:

Abbreviations and Acronyms

As with English, there are a seemingly endless

number of bureaucratic acronyms in Russian, and
the website Sokr.ru helps navigate many of these
puzzles. For decoding location-specific language,
especially useful is this Russian Wikipedia entry,
As you draw your text, Google automatically which lists the common abbreviations for various
suggests editable text to match your sketch. localities in Russia (cities, towns, villages, and so
Sometimes the first suggestion isn't always correct, on).
so be sure to review the options.
For example, the following text is found in the title
In an especially useful feature, Google's tool can of a video on VK, put out by a pro-separatist video
also recognize cursive handwriting, which channel. Using the two tools outlined above, it's

24
possible to decipher the information, even without this acronym is short for “реактивная
speaking Russian. система залпового огня / ракетная
система залпового огня” (reactive system
г.Донецк Ленинский р-н обстрел РСЗО of volley fire / rocket system of volley fire).
“Ураган” The English equivalent to this is “multiple
rocket launcher system” (MLRS), which in
There are three abbreviations here, all of which are
this case refers to the Uragan (“Hurricane”)
very common among videos related to the
MLRS.
Ukrainian conflict:
Therefore, the title of the video is “City of Donetsk
Leninskiy district shelling MLRS ‘Uragan’”

Searching in Russian

A search on Sokr.ru for the abbreviation “г.” In English, words rarely change based on their role
1. г. Донецк: The first listing for “г.” On Sokr.ru in a sentence, but they occasionally will add a
brings up “город” (city), which is also the letter to indicate count or possession (soldier,
second entry on the Wikipedia page listing soldiers, soldier’s, soldiers’), or in the case of some
abbreviations. This describes the city of pronouns to indicate subject or object (who or
Donetsk (Донецк). whom, he or him, she or her, and so on).
2. Ленинский р-н: Both the Sokr.ru website
and Wikipedia say this means “район” Things are not so simple in Russian, as there are
(region/district) for this abbreviation. This about a dozen forms for each word (indicating
describes the Lenin (Ленинский) district. singularity or plurality and case), and
3. РСЗО: This has nothing to do with towns, so several different conjugations of verbs. Depending
we must rely on Sokr, which tells us that on its role in the sentence (subject, direct object,

25
indirect object, plural, plural direct object, and so
on), the word “cat” can have the following nine
declined (changed) forms: кошка, кошки, кошке,
кошку, кошкой, кошек, кошкам, кошками,
кошках. Making things more complicated, each of
these spellings returns different results in a Twitter
search—for example, the simple “cat” or “cats”
forms of the noun will bring back far more results
than advanced searched for “with a cat” or “with
cats.”

Wiktionary provides the declined forms for most

words in its Declension section, along with verb
conjugations. For example, the Wiktionary entry for
кошка (cat)shows the singular and plural forms for
each of the six Russian cases. When carrying out
searches, be sure to remove the accent mark (the
small mark on the о́, as seen inко́шка) from the
letters by pressing backspace in front of the When searching on Google, this is not much of a
accented letter. problem, as the search algorithms are able to
include many of the forms of a word in its
searches. (When you enter the Russian word for
cat (кошка) in a search, relevant results that
include the declined forms—cats, to a cat, of a cat,
on a cat, etc.—will also come up.) Therefore,
unless you put the word in quotation marks to

26
specify the results, there is no need to worry about
noun and verb forms when searching on Google in
Russian.

On Twitter, however, it’s a different story. Twitter

can only return results for the exact letters given,
and is not able to detect changes in verbs (such as
“run,” “ran,” “runs”) or nouns.

If you were trying to find out information about the

evacuation of a building in the city of Kazan, you
can get drastically different search results,
depending on the word forms you enter in your
search. For example, try two searches with forms of
the verb “эвакуировать” (to evacuate) with the
search strings of Казань (normal form of “Kazan”)
and в Казани (“in Kazan”).
On Twitter, you receive far fewer results, as this
1. Эвакуировать Казань – Evacuate Kazan
form of the “evacuate” verb is rarely used in tweets
(no changes to verb/noun forms):
and news articles. As you see in the results below,
Searching Google News, the results include there is a 4-month gap between three tweets,
various forms of both Kazan and Evacuate, but it indicating that there is either hardly any information
will also bring back the noun “evacuation” about this topic, or the search phrase needs to be
(эвакуация) and adjectival form of Kazan in revised.
various declensions:

27
 2. Эвакуировали в Казани (“evacuated in
Kazan”)

Using the past tense plural form of “evacuate”

(common in passive constructions) yields far more
useful results than the first search terms. (If you
look back to the results from Google News, the
second result uses these forms of the words
evacuate and Kazan.) The tweets below are quite
varied, but are all relevant for the search results,
such as the evacuation of a church after a fire, a
bus evacuation, and a school evacuation:

28
If you are not familiar with Russian, it is difficult to opaque acronyms, Twitter searches, and Google
know what phrases and search parameters to use to assist your research efforts.
to maximize results. So, it’s a good idea to enter
general Russian terms and phrases into Google—
such as “evacuation” and “Kazan”—and then copy
the terms used most often. After we did this with
the news results from Google, we found many
more relevant results in our Twitter search,
which—it's important to recall—is not very
accommodating to the malleable nature of Russian
nouns and verbs.

***

As you can see from these guides, researching in

Russian—without knowing Russian—can be
frustrating and time-consuming, but it is ultimately
possible. You do not have to know how to read
Russian, or even know the Cyrillic alphabet, to
conduct Russian-language open-source research,
but it certainly helps to have a basic familiarity with
the language. After a while, you will start to
recognize the letters and figure out how to read the
alphabet, especially as certain names and cities
begin to reappear in your searches. In the
meantime, this guide will help you leverage

29
Unearthing Local Stories on the virally on the Internet originate in small, relatively
Russian-Language Internet unknown communities.

Contents

• Finding local communities on Vkontakte

• Navigating local online communities on VKontakte
• Finding other local groups

How do small groups make big waves on the

Internet and in the media? Consider an example
from September 2015, when a local online
community for the Russian city of
Digging for Buk missile systems. Original photo by Novocherkassk garnered international attention after
Mark Robinson. May 1, 2014. CC 2.0. Edited by someone shared a photograph of a child being
Kevin Rothrock. walked like a dog.

While a lot of open-source research on the RuNet

is possible thanks to broad searches on Google,
Vkontakte, Twitter, and other websites, sometimes
it’s best to drill down to the narrowest sources
available. This guide will instruct you on how to
find local online communities on the Russian-
language Internet. Oftentimes, eyewitness
accounts, photographs, and videos that spread

30
 tracking down the original source, or by
investigating other claims through these pages.

Finding local communities on Vkontakte

For nearly every Russian and Ukrainian city and

region, there is a local group on Vkontakte for
residents to swap stories and chat. The two most
popular groups are called “Подслушано в …”
(“Overheard in…”) and “Типичный …” (“A Typical
Day in…”). In the latter case, the word “typical”
(типичный) may change endings to “типичная” or
“типичное“, depending on the gender of the
locality's name. A Google search, however, yields
results for all spellings, regardless of the
As we read the story, we see that the post was grammatical ending to the word in the community's
made in the “Overheard in Novocherkassk” group name. Additionally, if these two methods do not
on the Russian social network Vkontakte: produce useful results, you may try searching for
the word “public” using the phrase: “паблик” + [city
name].

Internet users primarily use these groups to chat

with other locals or to find services available in
Content that resonates online widely town. Common queries you'll find in these
sometimes originates on such websites, and we as communities are “Who can give me a ride to a
researchers can verify photographs and videos by

31
neighboring town?” and “Does anyone know a You can find these local groups by searching the
good place to get my cell phone fixed?” Internet for the words “Подслушано в” or
“Типичный,” plus a city or region name. Providing
When news breaks in certain localities, however, the correct grammatical case of the word is not
these groups can transform into platforms for important, as websites like Google can bring
heated discussions. When war came to eastern relevant results for both “в Донецк” (to Donetsk)
Ukraine, some Vkontakte communities became and “в Донецке” (in Donetsk), even if one is used
digital spaces to talk about the conflict from local incorrectly. The search results for “Подслушано в
points of view. The topics in these groups include Донецке” reveal numerous groups, including
talk of troop movements, checking in on the safety mirrors for these communities hosted on
of residents in certain apartment buildings, and LiveJournal and Ask.fm (where user-submitted
sharing photographs and videos of the scenes questions are posted), as well as the addresses of
from the conflict. the Vkontakte groups.

As you would imagine, these local groups can offer

unique access to open-source information in the
form of eyewitnesses and local reports. However,
there are challenges, as these groups’
administrators often have strong political
allegiances, particularly in conflict scenarios. In
eastern Ukraine, for instance, many of the
Vkontakte groups’ administrators sympathize with
the pro-Russian separatists, leading to either
outright censorship or self-censorship from locals
who post in these groups.

32
 are archived. First, click the link that lists how
many posts there are in the group (see the red box
below).

Scroll through a few pages of the group (see the

new red box below), and notice the number next to
Navigating local online communities on VKontakte “offset=” in the URL (highlighted in blue below).
This number indicates the posts being displayed,
When you visit some groups, often there
with “1” being the most recent. There are 3,670
are thousands of posts, making it very difficult to
posts in the group displayed below, as indicated in
find content published several months earlier.
the screenshot above, so we can determine the
Thankfully, there is a quick way to find posts that
the chronology of posts based on that number. If

33
you replace the number (120 below) with a larger group on July 17, shortly before MH17 was shot
number, you will be able to quickly navigate down.
through old posts. It could take a while, but after
entering a few numbers, you can find the correct
period of time. For example, if you replace the
number 120 above with 1680, then posts from July
17 and 18, 2014, will appear.

When Bellingcat [note to readers: the author of this

guidebook is a contributor to Bellingcat] conducted
research into the anti-aircraft system that shot
The screenshot above captures
down Malaysia Airlines Flight 17, the
correspondence between two Vkontakte accounts
“Подслушано в Торезе” (Overheard in Torez)
that apprently belong to residents of Snizhne and
group provided essential information. Eyewitness
Torez. They discuss how three tanks without flags
reports of a military convoy moving through the
passed through Snizhne at 1:14 p.m. (local time)—
cities of Torez and Snizhne were posted in this
almost exactly three hours before MH17 was shot

34
down near Snizhne. According to Ukrainian
security services, a convoy of three tanks and two
BTRs escorted the Buk system through Snizhne
on July 17. Thus, we can use local communities to
find eye witnesses who can verify—or refute—the
official accounts of government officials.

Finding other local groups

Vkontakte is not the only online forum for local

communities; there are several popular social
networks and message boards for neighbors to
meet and talk.

Many Russian Internet users turn to Odnoklassniki In some communities, public message boards and
to organize discussion groups almost as often as forums are still popular, though they are not nearly
thye use Vkontakte. With a simple Google search, as widely used as groups on Vkontakte and
you can find nearly every one of these groups Odnoklassniki. To find these less common
without much trouble. Here is a search string that communities, search the city name along with
will identify numerous local groups on keywords that include the word “форум” (forum).
Odnoklassniki dedicated to the Russian city of In the search below, two unique message boards
Novosibirsk: and two Vkontakte groups reveal the so-called
“Kharkov Forum” (Харьков форум). The first
result, Kharkov Forum, has hosted millions of
messages over the past several years,
addressing topics including politics, sports, and

35
help for soldiers and wounded civilians in the war, Zabaikalye” public Vkontakte group organized
and included local chatter about road conditions. response efforts and distributed useful information
to locals about avoiding the approaching forest
fires. Additionally, locals wrote in this group to
disseminate information and to organize volunteer
and humanitarian efforts.

Additionally, in local communities, outside of the

large public groups, there are often improvised
communities set up during emergencies, designed
to coordinate relief efforts. For example, during the ***
devastating wildfires that swept across Siberia in
April 2015, the “Volunteer Wildfire Firefighters of

36
Researching the RuNet by broadly searching
Google, Twitter, and Vkontakte searches can only
get you so far. To get through to a more specific,
localized stratum of information, you must be able
to locate and navigate the groups described
above. While much of the open-source research
concerning Russia and Ukraine over the past 18
months has focused on the Ukrainian conflict,
there are still seemingly endless pools of
information on local networks for nearly any other
topic of research, from wildfires to local oddities.

37
Herein Lie the Secrets of imagery accessible for Russian and Ukrainian
Geolocation cities.

Contents

• Google
• Yandex
• Wikimapia
Google

Likely the most useful single piece of software

when conducting open-source geolocation
Image edited by Kevin Rothrock. research is Google Earth Pro, which can be
downloaded for free here. Google purchases its
With most photographs and videos, the most
satellite imagery from Digital Globe, a private
reliable way to conduct verification is through
company with numerous satellites in orbit.
satellite images, allowing you to geolocate content
by matching it to a known location. Sometimes, Google Earth—which is a downloadable
this requires observing changes in an area over program—is not the same as Google Maps—which
time. Satellites have photographed almost every is what you access through your mobile apps or on
inch of the Earth, but there are special a Web browser at http://maps.google.com. While
considerations when working in Russia and Google Earth contains many of the same features
Ukraine concerning the availability of satellites and as the more familiar Google Maps, Google Earth
street-level imagery. This guide will provide also provides easily accessible historical imagery,
instruction on using satellite images, with a focus 3D terrain mapping, customizable locations, and
on historical imagery, and available street-level markers that can be quickly imported and

38
exported, as well as many other features. In short,
Google Earth is geared towards the power user,
while Google Maps is for more casual use.

Countless open-source reports use historical

imagery comparisons in their analysis, but one
recent example of this process can be found in
a March 2015 Bellingcat report (note: this
text's author, Aric Toler, also wrote the
Bellingcat report) that analyzed a large Russian
training camp near the Ukrainian border. Viewing
the location of this training camp, just south of the
village of Chkalova in the Rostov oblast, reveals an
extremely large, well-travelled training camp. Screenshot of a Google Earth image from October
9, 2014.

A question immediately comes to mind: is this

training camp new, or has it been around for years,
without any correlation to the Ukrainian crisis?
Scrolling through the historical imagery on Google
Earth will quickly reveal this answer.

39
 corner of your satellite imagery. After rolling back
the imagery to a previous date, we see that this
training ground was pristine farmland in October
2013—revealing that the camp sprung up anew
after the Ukrainian crisis began.

Screenshot from Google Earth for October 19,

2013.
Yandex

The Russian search engine Yandex operates

After choosing the “Historical Imagery” option a mapping service similar to Google Maps, including
under View, a slider will appear in the top-left

40
road maps, satellite imagery, and selective The top version is the English site, and the bottom
coverage of street-level imagery. is Russian. For the remainder of this tutorial, the
Russian version (bottom) will be used, but the
There are two ways to access Yandex maps— English version is roughly equivalent and the
through maps.yandex.ru and through instructions should mostly translate over.
maps.yandex.com. As you'd expect, the latter is in
English, and the former in Russian. They are Instead of “street view,” Yandex uses what it calls
largely the same, but the layouts are slightly the “Panorama” view for street-level imagery of
different. certain cities in Russia, Ukraine, Belarus,
Kazakhstan (Astana, Almaty, and Karaganda), and
Turkey. As evident in the map below, only fairly
large cities and roadways have Panorama imagery
available, indicated by the shaded blue areas. You
can turn on Panorama imagery by clicking the
Panorama (Панорамы) button in the top-right of
the page.

Top: English Yandex, Bottom: Russian Yandex.

41
 Like Google Maps, Yandex can place geolocated
photos from users onto their maps, giving you
additional views of a location from the ground.

A very nifty feature that is not available on Google

is livestream videos from locations (most often
traffic cameras). After selecting the video-camera
option in the top-right corner (Видеокамеры), you
can select the purple camera icons on the map
(most often in densely populated urban areas) for
a livestream of the location. See below with a
traffic camera in central Moscow:

In the above screenshot, the title of the photograph

(which is “Untitled,” без названия) is available,
along with the user responsible for uploading the

42
image (bottom-left red box), and the date of the
photograph’s upload (bottom-right red box). Turn
on the photographs overlaid on the map by
selecting Photographs (фотографии) in the top-
right corner.

The Yandex satellite imagery, which is unique from

the Google Maps (DigitalGlobe) satellite imagery,
can also be accessed through Wikimapia.

Wikimapia

Wikimapia combines an array of satellite services

with user-inputted descriptions of locations,
providing an impressive array of professional
(satellite) and local (descriptions) information.

The available satellite imagery can be viewed in

the top-right corner, including Google
(DigitalGlobe) imagery, Google Terrain, Bing,
Yandex, Here, OSM (Open Street Map), and
Yahoo.

43
This tweet was posted a few hours before the MH17 1. в Снежном: in Snezhnoe
disaster, showing a Buk anti-aircraft system 2. дом 50 лет октября: house/building 50
supposedly in the town of Snezhnoe. By using Years of October
Wikimapia, we can locate some of the landmarks 3. в нем пирка: in it is pirka
mentioned in the tweet and verify the location of 4. уголек: ugolek (small piece of coal)
the image. 5. фуршет: furshet (buffet, smorgasbord)

We can assume that the person posting this is not

saying that the Buk is near a buffet of food or a
little piece of coal, so we need to do some more
digging to find the context of the words. The
search function within Wikimapia is not very useful,
so it is often better to search the site using Google,
but restricting our results to those on Wikimapia by
using the “site: search” function.

By following the first result, we find that “50 Years

The five locations mentioned in the tweet above of October” is a street in the center of Snezhnoe.
are reproduced below with English translations: From Wikimapia, we can search the nearby

44
location and look for the other landmarks
mentioned in the tweet: Ugolek, Firshet,
and Pirka.

We do not know where Pirka is (though if you

looked long and hard enough, you would see it is a
shop in one of the apartment buildings in the area),
but identifying four of the five landmarks—the city,
street, and two locations—is enough to focus our
search on this area for traces of the Buk in the
photograph. From here, it's a matter of geolocation
and matching angles, trees, and the road in the
photograph.

For those wondering: the Buk was indeed in

Two of these are immediately clear on both sides Snezhnoe, photographed approximately 3-4 hours
of 50 Years of October (the street that runs vertical before MH17 was shot down. The photograph was
between the two landmarks). After clicking their traced back a building on 50 Years of October,
entries on Wikimapia, we find that Furshet is a facing towards the apartment building on
supermarket and Ugolek is a restaurant. Karapetyana 13a.

***

45
Whatever a photograph's location, there are
always geolocation options—whether it's a
livestream from the street, or a blurry satellite
photo from 2012. Using the resources described in
this guide, you should be able to find the most
accurate and helpful image available for locations
in Russia and Ukraine, whether it's from Google,
Yandex, Wikimapia, or sites less useful for Russia
and Ukraine, such as TerraServer or Bing Maps.

46
Triangulating Sources to Thin the possible on individual events, in order to discern
Fog of War fact from fiction. This guide will show you how to
find pro-separatist, pro-Ukrainian, and
independent-observer (OSCE) reports for specific
days, using as a case study the January 13, 2015,
shelling attack on a civilian bus near the town of
Volnovakha, which resulted in the deaths of 12
passengers.

Contents

• Separatist dispatches
Ghost village, by Christos Tsoumplekas. January • Ukrainian National Security and Defense Council

6, 2012. Ano Simi, Crete, Greece. CC 2.0. Edited • The Organization for Security and Co-operation in

by Kevin Rothrock. Europe (OSCE)

• Thinning the ‘fog of war’
The war in eastern Ukraine was the first European Separatist dispatches
war to take place in the ubiquitous presence of the
Internet, documenting nearly every aspect of the Much like the Ukrainian government, various
war as it played out. The conflict's ideological separatist groups issue dispatches that summarize
battleground unfolded online, making tragic events recent battles and military activity. Also like
into fodder for propaganda (for Internet users in dispatches from Kyiv, these should not be trusted
both camps of the war). without extensive verification through outside
sources. Below is a list of some of the most
As historians and investigators look back at the popular separatist dispatches, most of which have
fighting, it will be vital to collect as many views as information going back to the first half of 2014.

47
Many of these dispatches duplicate the same • Донбасс Центр (Donbass Center),
information, but they may also contain additional with dispatches from a variety of sources,
photos, videos, and context: including journalists, specific officials, and
individual militants.
• Сводки от ополчения Новорссии (Dispatches
from the militia of Novorossiya) Searching for one of these outlets (Новости
Vkontakte group. This post was previously Новороссии) with the date parameters of the day
called Сводки от Стрелкова Игоря of and after the attack, we find dispatches on pro-
Ивановича (Dispatches from Igor Ivanovich separatist RusVesna.su for the two days:
Strelkov), containing dispatches supposedly
from the infamous separatist commander
himself, though the texts were actually
authored by others. Some of the posts were
taken from messages that Strelkov (Igor
Girkin) supposedly posted through other
channels.
• Новости Новороссии (News of Novorossiya)
• Русская Весна (Russian Spring)
• Новости Донецкой Республики (News of the
Donetsk Republic)
• Новороссия Информационное
For the January 13 report, the separatist dispatch
Агентство (Novorossiya Information Agency) says, “The armed forces of Ukraine shot up a
• Военные сводки с Юго-Восточного
passenger bus with peaceful citizens at a
фронта (War dispatches from the checkpoint near Volnovakha. 10 people are dead,
Southeastern front) 13 are wounded.” More information can be found
searching for another of these dispatches—the

48
News of the Donetsk Republic—with the data separatist attack with a Grad artillery system, as
parameters and the keyword “Volnovakha” in Rozhin's argument goes, there would be dozens of
Russian: shells fired at the location.

Ukrainian National Security and Defense Council

The Ukrainian National Security and Defense

Council (СНБО, or NSDC) releases regular
dispatches regarding casualty figures, the
locations of battles, and sightings of Russian and
separatist military equipment in eastern Ukraine.
You can access these from various Ukrainian
news sites, including the video dispatches that
In the first result, the news site provides quotations usually include Anti-Terrorist Operation (ATO)
from separatist commander Igor Girkin (Strelkov) spokesperson Andrey Lysenko. Like the separatist
and pro-Russian/pro-separatist blogger Boris dispatches, the information contained in these
Rozhin (“colonelcassad”). Girkin accused Ukraine NSDC and ATO dispatches should not be taken at
of “attempting to hide the truth” and said that there face value and should always be verified with
were “clear signs of bullet wounds from small additional sources.
caliber weapons,” contradicting Ukrainian claims
To find a situation map or dispatch for a particular
that separatists shelled the checkpoint with
day, Google the phrase “АТО СНБО,” plus the
artillery. Rozhin sees a more complicated plot,
date, or change the Google search parameters to
saying that there should be “several craters” at the
include only a certain day. The Ukrainian news
site and not just one near the bus, and that
site 112.ua hosts videos and reports on nearly all of
Ukraine fired a single shell at the passenger bus to
these dispatches. You can also find information
blame separatists for the attack. In a real

49
from ATO dispatches and National Security and
Defense Council reports on social media, such as
NSDC's English-language Twitter account.

The first three results are Ukrainian news reports

on the updated maps and situation reports from On the map, the red square denotes Volnovakha,
the Ukrainian NSDC for January 13 and 14, where the bus attack occurred. As we can see, the
2015—the day of and after the Volnovakha bus area is well under Ukrainian control.
attack.
Further investigation with searches of Волноваха
автобус (Volnovakha bus), using the date
parameters of January 13-14, 2015, gives us a
tremendous amount of information, as this incident
made news headlines for several days in Ukraine
and Russia. Shortly after the attack, various

50
Ukrainian news outlets published a video of the separatist allegations of a landmine triggering the
attack from security footage, showing attack or a Ukrainian “false flag” attack against its
approximately 88 shells fall around the checkpoint, own checkpoint.
with fire seemingly coming from the northeast in
the direction of separatist-held Dokuchaievsk. The OSCE's Special Monitoring Mission
(SMM) arrived at the location of the incident at
The Organization for Security and Co-operation in 5:45 p.m. and witnessed the removal of two dead
Europe (OSCE) passengers from the bus. The bus had shrapnel
damage consistent with a nearby rocket impact,
The OSCE is the only international organization estimated by the SMM to be 12-15 meters from the
allowed to conduct monitoring in eastern Ukraine, side of the bus. The SMM visited the Volnovakha
thus making it a valuable resource for hospital where the staff confirmed that 10 persons
independent information about the conflict. The on the bus were killed instantly, while two died
OSCE produces daily updates, along with spot later in the hospital. Another 17 passengers were
reports on special events, regarding any fighting injured.
observed, groups of vehicles spotted,
investigations into particular attacks, and other The OSCE later confirmed that a Grad rocket, fired
events. The daily OSCE updates can be from the northeast of Volnovakha, was the source
accessed here, along with the spot reports. of the attack on the bus. This information
corroborates Ukrainian accusations that
One of the most widely discussed OSCE updates separatists fired an artillery attack from territory to
was its spot report on the Volnovakha bus attack, the northeast of Volnovakha, as seen in the
following a separatist artillery attack near a checkpoint. security footage from the checkpoint.
With allegations flying from both Ukraine and
separatist forces, the OSCE report was a
stabilizing force in the controversy, dismissing

51
Thinning the ‘fog of war’

There is more information about the Volnovakha

bus attack than most incidents in the Ukrainian
war, as this particular attack drew international
outrage and commentary from world leaders.
Nevertheless, the same research principles can be
applied to study events as minor as an empty town
being hit by mortar fire, or as major as the MH17
tragedy. Though the Volnovakha attack was fairly
unambiguous in culpability, not all incidents are so
clear, as Ukrainian sources often compete with
separatist spokespersons to produce unreliable
reports. Even with the flood of wartime information
created and made accessible by the Internet
(dispatches, videos, photographs, and eyewitness
accounts), the fog of war is still thick. But it's not
impenetrable.

52
How to Comb Russia's TV News video archives, in order to compare coverage of
specific events.

Contents

• Channel One (Первый канал)

• Russia 1 (Россия 1)
• Russia 24 (Россия 24)
• NTV (НТВ)
• Zvezda (Телеканал звезда)
Combing Russia's television news networks. • LifeNews (ЛайфНьюс)
Image: Kevin Rothrock. • TV Rain (Дождь)
Channel One (Первый канал)
According to survey research by the Levada Center,
the vast majority of Russians (85 percent) say they This is the most-watched channel in Russia, airing
watch television to learn about the country's news. a variety of news, entertainment, and sports
While less than half (41 percent) say they also programs. The channel is state-owned and has a
trust the news they learn from TV, it still inspires generally pro-government bias. For open-source
twice at least as much confidence than any of its research, the most relevant programming is the
competitors. When conducting online open-source popular “Vremya” (Время) nightly news program,
research in Russian, finding and evaluating which has a weekly segment by the infamous
television reports is often just as important as pundit Dmitry Kiselyov. A livestream of the channel
combing social media and online news sources. can be viewed here.
This guide explains how to evaluate TV news
sources and navigate television networks’ online The fastest way to locate particular pieces of
Channel One's news coverage is by searching

53
through its easy-to-use video archive, sorted by date Saturday” (Вести в субботу), “Vesti at 8:00 p.m.”
(if you cannot read the months, check a reference (Вести в 20:00), and so on. A livestream of the
guide here from MasterRussian.com). The archive channel can be viewed here.
goes back to 1999, providing a wealth of easily
accessible information. The website makes it very easy to search for news
segments, categorizing them by date and by specific
program. After clicking on a Vesti segment, you can
search by a calendar (календарь) to find a news
broadcast on a specific date, going back to 2012.

Additionally, you can search through Channel

One’s YouTube channel here.

Russia 1 (Россия 1)

This is the second-most-watched channel in

Russia, airing news, entertainment, sports,
documentaries, and other programming. Like Additionally, Russia 1 has numerous regional
Channel One, the channel is state-owned and the channels. For their video broadcasts, search for
news coverage is rarely, if ever, critical of the Россия 1 with the region or city name—for
Kremlin. Each news segment's title contains the example, enter “Россия 1 Ярославль” to find the
word “Vesti” (Вести), including “Vesti,” “Vesti on station's Yaroslavl branch. Googling this phrase

54
will bring theofficial television station’s website and
the YouTube channel for the station, giving us an
archive of nearly all of their local news broadcasts.

Russia 24 (Россия 24)

This is a 24-hour news channel and the sister

channel to Russia 1. The channel was named
“Vesti” (Вести) until 2010, and still retains the
same URL of Vesti.ru. A livestream of the channel
can be viewed here.

As with Russia 1, there are vast video archives for Additionally, Russia 24’s vast news broadcast
the news broadcasts for this channel, accessible archives are accessible (going back a few years)
by category and show here. You can filter the on its YouTube channel. The programs are filtered
results by date after searching a term (click the on the YouTube channel by theme (such as the
magnifying glass in top-right corner), then selecting more-than-1,000 videos on the “Situation in
a date range. Ukraine” channel) or by program.

55
NTV (НТВ) the control of Media-Most and, after 2001,
Gazprom Media. NTV is nominally independent,
but the state has a majority stake in Gazprom,
effectively putting the Kremlin in control of the
network's major editorial policies.

NTV airs a number of news programs, along with

shows, movies, and emotional investigations that
often focus on crime. Its news is slanted towards
the government line, and it's often more
sensationalist than Russia 1 or Channel One. A
livestream of the channel can be viewed here.

The easiest way to navigate NTV’s broadcast

archive is by filtering its news page. From the
“news” (новости) page, scroll down to find a small
segment on the right-hand part of the page
showing the date.

After selecting the desired date, any news

segments that aired on that day will appear. When
searching by key word, there is no way to search
within a date range, but the results are ordered
chronologically by default. You can also search
through the daily news programs of NTV
Since its takeover in March 2000 (following Putin's
first presidential election win), NTV has been under

56
(“Сегодня” and “Итоги дня”) using NTV's YouTube to search (the first one, after “от”) and the day after
channel. the desired date (after “до”). For example, if you
wish to search for a news segment on December
Zvezda (Телеканал звезда) 1, 2014, the graphic below show the needed
search parameters (along with a key word in
This is the Russian Defense Ministry's television
Russian after “По контексту”):
network. As you might imagine, Zvezda airs
programs that focus on the Russian military,
including documentaries, news programs, and war
movies. The news itself is very pro-Kremlin, and
sometimes it publishes and airs unverified content
from fringe websites, such as a story claiming that
“thousands” of ISIS fighters arrived in Odessa in
November 2015. A livestream of the channel can
be viewed here.

Zvezda’s YouTube channel with programming is

available here (and the news-only channel is here).
Unfortunately, the search function on the Zvezda
website to find specific news segments is
cumbersome, but you can still navigate it with Alternatively, you may find success searching
some effort. Go to their search page and type within Zvezda’s YouTube channel, avoiding the
anything into the field in the top-right of the page awkward search interface of its native website.
(which will say “поиск”). This will bring up the
search parameters. When searching for a
particular date, you must choose the date you wish

57
LifeNews (ЛайфНьюс)

This is a privately-held television channel that has

gained quite a reputation throughout the Ukrainian
crisis as sensationalist and loose with facts.
LifeNews—owned by Aram Gabrelyanov and said TV Rain (Дождь)
to be close with Russia's security services—prides
itself at being the first to report news (often to the Lastly, there is the independent, generally anti-
detriment of the truth andtaste). Since the cooling of Kremlin television network TV Rain, which moved
the Ukrainian crisis, LifeNews has gone back to to a subscription model after most cable carriers
focusing on sensationalist stories and a higher dropped it from coverage. The station often hosts
dose of celebrity news than Russia 1 or Channel pro-Western, anti-Kremlin guests, and occasionally
One. You can watch LifeNews’ livestream here. grants airtime to pro-Kremlin figures and even
some state officials. The network is said to have
Of all of the television channels outlined in this ties to Prime Minister Dmitry Medvedev's circle of
guide, the broadcast archives of LifeNews are influence. While the great majority of the channel’s
probably the most difficult to navigate. On the programming is news, there are also
network's website, the search function only allows some entertainment programs. A livestream can
keyword search, without date parameters. You be viewed here (with a paid subscription).
may have better luck searching through
their YouTube channel, or trying focused searches The channel’s archives are very easy to navigate
through Google Video. For example, the search using its archive here. For example, the search
parameters below would search for all videos on below for November (“Ноябрь”) 10, 2014,
LifeNews’ website that appeared on July 8, 2015, yields 52 results, including 17 broadcast segments.
that also contain a keyword of choice:

58
 topic—these archived broadcasts often provide
incredible amounts of information, along with a
window into the source that the vast majority of
Russians rely on for their news.

While access to some results may require

a subscription, the great majority of the archived
broadcast segments is accessible to everyone.
You can also access the channel’s broadcasts on
its YouTube channel.

***

There are, of course, additional channels in Russia

producing news coverage—such as REN TV (РЕН
ТВ), Channel 5 (Пятый канал), and RBC (РБК)—
but for most purposes, the channels outlined
above will be more than sufficient for research, in
conjunction with local television channels. Unlike
American and some European media outlets,
Russian television channels are often meticulous
in publicly cataloging their broadcasts, sometimes
going back over a decade. When conducting open-
source research on nearly any event in Russia—a
protest, natural disaster, crime, or any other

59
How to Learn More About the Big the portals and databases you can use to learn
Wigs and Public Officials in Russia more about public figures and big-wig individuals,
even if you have little or no knowledge of Russian
and Ukraine or Ukrainian.

Contents

• Information on Organizations
• Nomer.org
• Declarations.com.ua
• Missing Persons
Information on Organizations

A handful of websites provide information

Image edited by Kevin Rothrock. about organizations registered in Russia, including
non-profits, LLCs, and other companies. The
There are numerous free and open information
website SBIS.ru is one of the best available online
portals and databases available for researching
resources, providing information about the
individuals in Ukraine and Russia, whether you are
individuals who hold leadership positions in these
investigating a public figure or a private individual.
bodies and the owners of the organizations. SBIS
Information about ordinary Russians and
relies on public data for each category of
Ukrainians can be hard to find on these databases,
information. For example, the “Court records”
and sometimes the best way to locate data
section (Суды) derives its information from the
about such people is to look on social networks, as
Federal Arbitration Court of the Russian
detailed in a previous installmentto this guide. This
Federation.
eighth and final entry in RuNet Echo’s guide to
doing open-source research on the RuNet looks at

60
To find out what the organizational affiliations of a Nomer.org
specific individual are, search for that
person's name (with patronymic, if possible) The website Nomer.org holds a vast amount of
using Google with the search parameter of information, but its results are often outdated, full
“site:sbis.ru,” restricting the results to this site. For of gaps, and somewhat unreliable. Regardless, if
example, when searching for the Russian you are looking for information about an individual
basketball player Andrei Kirilenko, some of the in Russia or Ukraine, you may find some success
results are clearly tied to him, including details with this site.
about Kirilenko serving as the president of the
Nomer.org hosts a database with the addresses
Russian Basketball Federation. If you speak
and dates of births of millions of Ukrainians,
Russian, most of this information will be fairly
though much of this information is outdated and
clear, though a bit thick in bureaucratic language. If
now incorrect. From the site http://nomer-
you do not speak Russian, the categories of
org.net/allukraina/, you can input information into the
information are detailed below.
green fields to refine your search:

Testing this out, we can input the name of the

Ukrainian president, Petro Alekseyevich
Poroshenko. In this case, Nomer.org returns
accurate information:

61
 these income declarations must be published
electronically (although a new law passed in March
From left to right, the information given is the 2016 will require officials to publish electronic
person’s name, listed telephone number declarations—Global Voices). That's where the
(Poroshenko does not have a listed number), date Declarations.com.ua project, ran by journalist and
of birth, city of residence, street, street number, anti-corruption activist Denis Bigus and his
building number, and apartment number. colleagues, comes in. Relying on crowdsourced
efforts, the site provides electronic copies of
Nomer.org also hosts a limited directory of Russian officials’ paper income declarations.
citizens, accessible by clicking the correct city or
region on the website's main page. Also available is Unlike the sites previously described in this guide,
a limited directory of the license plates Declarations.com.ua is written in Ukrainian, not
in Yekaterinburg, Novosibirsk, Rostov-on-Don, Russian. It is nevertheless quite easy to navigate
and Moscow. To find information in these vehicle and has an intuitive interface. To search for an
directories, either search within the Nomer.org individual, enter their name (in Ukrainian, but the
search engine, or use Google, by searching the name may be recognized in Russian, as well) into
person’s name, address, license plate number, or the search bar, and choose their name if they
telephone number, adding the search parameters come up in the auto-complete. Below, we'll
“site:nomer.org” or “site:nomer-org.net.” try searching for Ukrainian President Petro
Poroshenko:
Declarations.com.ua

A post-Maidan anti-corruption law requires all

Ukrainian public officials—including legislators,
judges, prosecutors, and others—to declare their
incomes. However, the law does not specify that

62
This search produces three results: Poroshenko
income declarations for 2011 (when he was a
presidential candidate), in 2013 (when he served in
the parliament), and in 2014 (by which time he
assumed the presidency). By clicking any of these
records, we see his digitized income declaration,
While this project is ambitious and quite useful,
along with a scan of the original document
there are obvious limitations: Ukrainians without
(accessible via the red PDF button in the upper
official governmental roles will not be represented
right).
in this database, and the database is still
incomplete, as there is still an ongoing effort to
digitize a massive number of paper records.

Missing Persons

There are two noteworthy websites that allow you

to search for missing persons in Russia and
Ukraine. The first is a Russian national service
called Жди меня (Wait for Me), which can be
found at at http://poisk.vid.ru/. This service is a

63
partner to a television show with the same name,
which features stories about searches for lost
loved ones in Russia, Ukraine, Latvia, and other
post-Soviet countries.

To search for a person in the database, go to the

Найти человека (Find a Person) option, and then
enter the necessary information into the search
fields: ***

If searching for open-source information about a

particular Russian or Ukrainian individual, it's quite
possible that you won't be able to find any useful
information, aside from the information available on
social networks. For most people, the social-network
route is by far the most fruitful way to find
information about their education, employment,
and family history. However, depending on the
person’s status or importance, it is quite likely that
one of these special resources will provide more
information, especially if the focus of the
Ukraine's national missing-person database is also investigation concerns financial connections or
quite easy to use. From the search page, input the corruption.
known information about the person you are
searching for:

64
You've Read Our Open-Source Contents
Research Guidebook. Now Let's • Finding Photographs and Videos
Use It. • Finding Information From the Ground
• The View From the Sky
• Verifying Materials
Finding Photographs and Videos

One of the first logical places to look for footage of

last year's wildfires in Siberia is Russian national
television. You can search Russia's national and
local TV broadcasts by date (in this instance, April
You can do it. Image by Kevin Rothrock. 12–16, 2015) on the various networks’ websites
(as detailed in this guide).
This article is part of a larger guidebook by RuNet
Echo to help people learn how to conduct open-
source research on the Russian Internet. Explore
the complete guidebook at the special project page.

RuNet Echo has now published eight installments

in a guidebook on conducting open-source research
on the Russian Internet. This ninth and final entry
takes the tools and instructions we've been
studying and applies them to a single case study:
the wildfires that caused significant damage to the
Siberian city of Chita in 2015.

65
Figure 1: Screen capture from a national news
broadcast. Figure 2: Screen capture from a local news
broadcast.

But this is just a starting point; you shouldn't settle

for the footage aired by the media. In these
circumstances, it's possible to find more
information uploaded to the Internet by ordinary
people on the ground. You can do this by
searching Instagram and YouTube, among many

66
other websites and online services. (For
conducting such searches on Russian social
networks, see this RuNet Echo instruction guide.) By
searching some of the hashtags used for this
wildfire, such as #пожары2015(“wildfires 2015”)
and #чита (“Chita,” a large city where there were
wildfires), you can find a wealth of materials
documenting the disaster.

Figure 4: Screen capture from a video posted by

Instagram user “katya_greeg” of a wildfire, filmed
from an apartment building in Chita, Russia.

Video from the Chita wildfire, showing a car driving

through the heavy smoke.

Finding Information From the Ground

Photographs and videos are great, but sometimes

Figure 3: Photograph from Instagram user you need more detailed information from the
“koctac” of a wildfire near Chita, Russia. witnesses and participants of an event from the
ground. That’s where searching local
communities and social networks comes in
(see RuNet Echo's detailed guides on

67
these respective topics). If you do not speak
Russian and are struggling to find the
right communities, check out our guide for non-
Russian speakers on conducting such research.

Searching for local communities on the Russian

social network VKontakte (VK) reveals numerous
open groups, including “Overheard in Chita,”
“Typical Chita,” “Chita.ru,” and “I’m Looking for
You, Chita.” Of these, the first two are especially
useful for searching public information.

Figure 5: Google search for VK (ВК) communities

in Chita (Чита).

In Chita, one of the Vkontakte groups with

excellent local information about Chita is the
Zabaykalsky Kray volunteer firefighters’ community
page, where you'll find photographs, videos,
eyewitness accounts of the wildfires, and other bits
of useful information regarding the rescue workers’
organizing efforts. If you are researching or
reporting on this topic, you could find dozens of

68
valuable contacts here, as many of the volunteer The View From the Sky
firefighters active in this group publicly share their
phone numbers and email addresses. While we've reviewed several ways to find
information produced on the ground, you
might also want to examine the situation from
above. As detailed in this guide, you can view
territory chronologically using services like Google
Earth. Looking at the Siberian areas affected by
the wildfires, you can see the full extent of the
damage. A comparison of a region outside of Chita
from May 2014 and then April 2015, shortly after
the end of the wildfires, shows some of the areas
most affected by the blazes.

Figure 6: Screenshot from the open Vk group

Figure 7: Screen capture from Google Earth of an
“Volunteer Firefighters of the Zabaikalye.”
area near Chita, May 2014.

69
 in this guide. Lastly, when you find photographs and
videos to use in a report, it's essential that you
verify the location of the materials—otherwise, you
might end up using phony data. This guide will walk
you through the process of “geolocation”
ªverificating a photograph or video’s location).

For example, this is how we would verify

the photograph below, shared by “koctac,” posted
during the 2015 Siberian wildfires:

Figure 8: Screen capture from Google Earth of an

area near Chita, April 2015.
Verifying Materials

Discovering information is terrific, but it's worthless

without proper verification. Often times, open-
source research requires more time in verification
than discovery. It's important to find all information
sources available for each event you're examining
(as described in our guide on research conducted
during the conflict in Ukraine).

When vetting sources and potential witnesses, you

can sometimes check information about their place
Figure 9: “This is all that remains of Mira Street in
of residence and business interests, as detailed
the village of Shira in the Republic of Khakassia.

70
Using the location mentioned in the caption above
(Mira Street, Shira, Khakassia, Russia), we can
see on Google Earth between July 2013 and April
15, 2015 that the buildings were indeed destroyed
after the April 2015 wildfires.

Figure 11: Screen capture from Google Earth of

Mira Street in Shira, Khakassia, from April 15,
2015.

Upon closer inspection, other features in the

photographs are also visible on Google Earth,
Figure 10: Screen capture from Google Earth of including a white dormitory in the background, and
Mira Street in Shira, Khakassia, from July 15, the elevation of the hills. From all of this, we can
2013. confidently confirm the authenticity of the
photograph.

***

71
Conducting open-source research on the Russian Internet is not all that different from
carrying out such work online in other languages, but there are certainly aspects to the
RuNet that it's vital to consider. We at RuNet Echo hope our guidebook can help you bridge
some of these differences, and perhaps inspire you to do some digging on your own.