Digital footprints and OSINT: how investigators follow leads

A digital footprint is the trail we leave online, and OSINT — open-source intelligence — is largely the craft of reading it. Over the past decade, journalists and independent researchers have followed those leads to reconstruct the downing of an airliner, identify the perpetrators of a filmed execution and unmask intelligence officers. The same techniques, misused, have accused innocent people and fuelled harassment campaigns.

This long read looks at how digital leads have been followed in real cases and at the principles that guide serious investigators today. It is historical and descriptive: it does not explain how to locate or identify specific individuals, which in Europe also runs up against data protection law and can cause serious harm.

What is a digital footprint?

Two kinds of footprint are usually distinguished, and the difference helps explain nearly every case below:

• Active footprint: what we choose to publish — photos, videos, comments, profiles, reviews.
• Passive footprint: what gets recorded without a deliberate decision — file metadata, connection logs, app location data, or turning up in someone else's photos.

For an open-source investigator, the most valuable trace is rarely a single data point. What matters is the combination: a photo, a shadow, a shop sign, a number plate and a date that, cross-checked, can confirm or disprove what someone claims.

Why digital footprints matter in war

Until recently, establishing what happened in a conflict required access on the ground or information from intelligence services. Camera phones, social media and commercial satellite imagery have changed that: some of the truth about a war can now be verified from a desk thousands of kilometres away. Eliot Higgins, who founded Bellingcat in 2014, has described the shift as the rise of 'an intelligence agency for the people'.

Six cases that show how leads are followed

1. MH17: tracking a missile launcher through social media

On 17 July 2014 Malaysia Airlines flight MH17 was shot down over eastern Ukraine, killing all 298 people on board. Over the following days, local residents and Russian and Ukrainian media posted photos and videos of a Buk missile launcher moving along roads in the region. Bellingcat researchers geolocated those images — pinning down the exact spots by matching buildings, trees and road signs against satellite imagery — and pieced together the vehicle's route.

The Dutch-led Joint Investigation Team (JIT) independently reached matching conclusions: in 2016 it said the Buk had come from Russia and returned there afterwards, and in 2018 that it belonged to Russia's 53rd Anti-Aircraft Missile Brigade. In November 2022 a court in The Hague convicted three men in absentia for the downing and acquitted a fourth. Russia has always denied responsibility.

2. Libya: a video as evidence at the International Criminal Court

In August 2017 the International Criminal Court issued an arrest warrant for Mahmoud al-Werfalli, a Libyan unit commander, over his alleged role in executions. What was new was the evidence: much of it consisted of videos posted on social media. It was one of the first times an international court had based an arrest warrant largely on open-source material. Al-Werfalli was killed in 2021 without ever being handed over.

3. Cameroon: anatomy of a killing

In 2018 a video circulated showing two women and two children being executed by armed men. Cameroon's government initially called it fake news. BBC Africa Eye, working with open-source contributors, published the investigation Anatomy of a Killing: by matching the mountain ridgeline in the footage with satellite imagery it placed the scene in the country's far north, narrowed down the period from vegetation and buildings, and estimated the time of day from the length of shadows. The authorities later announced the arrest of several soldiers.

4. Salisbury: the tourists who weren't

In March 2018 the former Russian spy Sergei Skripal and his daughter were poisoned with the nerve agent Novichok in Salisbury. Britain identified two suspects travelling on Russian passports as 'Petrov' and 'Boshirov', who appeared on Russian TV claiming to be tourists keen on the cathedral. Bellingcat and the independent Russian outlet The Insider later reported that they were in fact GRU colonel Anatoliy Chepiga and military doctor Alexander Mishkin.

Here the trail was not purely open-source: the investigators acknowledged using leaked Russian databases or records bought on grey markets. That raised a question still being argued over: where does open-source investigation end and the use of illicitly obtained data begin?

5. Navalny: the team that followed him

In August 2020 the Russian opposition leader Alexei Navalny was poisoned with Novichok. That December, Bellingcat, The Insider, CNN and Der Spiegel published an investigation identifying an FSB team that had shadowed him for years, based on flight records and phone metadata again obtained from Russia's black market in data. Navalny then phoned one of the alleged officers, who appeared to confirm details of the operation during the call. The Kremlin denied any involvement.

6. Boston: when the crowd gets it wrong

After the Boston Marathon bombing in April 2013, users of Reddit and other platforms combed through thousands of photos looking for the bombers and circulated the names of supposed suspects. One was a student who had gone missing weeks earlier, had nothing to do with the attack and whose family was subjected to intense harassment; his body was found days later. Reddit's general manager publicly apologised. The case remains the most cited warning about crowdsourced investigation without method.

How serious investigators work

After years of experiences like these, the UN Human Rights Office and the Human Rights Center at the University of California, Berkeley, launched the Berkeley Protocol on Digital Open Source Investigations in 2020. Its aim is to make such investigations robust enough to stand up in court. It sets out a cycle in phases:

1. Online inquiry: searching for information relevant to a specific question.
2. Preliminary assessment: deciding whether material looks relevant and reliable at first sight.
3. Collection: capturing material in a way that does not alter it.
4. Preservation: archiving it securely, because online content disappears easily.
5. Verification: checking source, place and date through several independent routes.
6. Analysis: interpreting what has been verified and stating how confident the conclusion is.

A few concepts recur in almost every published investigation, outlined here only in general terms:

• Geolocation: working out where an image was taken by matching visible features against maps or satellite imagery.
• Chronolocation: estimating when it was taken from shadows, weather, vegetation or visible events.
• Source verification: establishing who first posted a piece of content and whether they are who they claim to be.
• Corroboration: at least two independent routes pointing to the same conclusion.

The European Journalism Centre's Verification Handbook (2014), one of the most widely used guides among journalists, captures the spirit of the whole process: open-source material deserves the same scepticism as any other source.

Limits, mistakes and ethics

Misidentification

Boston was not a one-off. A similar face, a common name or a photo out of context is enough to single out the wrong person, with consequences no correction can undo. That is why professional guidelines insist on a very high bar of verification before any identification is published.

Leaked data and the law

The Skripal and Navalny cases showed the value of cross-checking sources, but also that part of the evidence came from leaked or purchased databases. Many journalists consider their use justified to expose state crimes; others warn that it normalises an illegal market in personal data that criminals also exploit.

Privacy: public does not mean fair game

In the European Union, the fact that personal data is accessible online does not mean it can be processed without limits: the General Data Protection Regulation still applies. Gathering and spreading information to single someone out — doxxing — can break the law and expose the target to harassment or violence.

Manipulation and fake content

Open sources are also a disinformation battlefield. Old images passed off as new, video-game footage shared as real combat and AI-generated content all demand more careful verification than ever. Some actors even mimic the style of OSINT researchers to lend credibility to their falsehoods.

The human cost for investigators

The Berkeley Protocol includes a section on investigators' wellbeing: reviewing footage of extreme violence day after day can cause vicarious trauma. It is a less visible dimension of the work, but one increasingly recognised across the field.

What it means for everyone

The lesson of these cases reaches beyond investigators. Soldiers who posted selfies, fitness apps that mapped military bases and agents betrayed by their travel records all show the same thing: almost everything leaves a trace, and traces can be combined. Being aware of your own digital footprint — what you post, what permissions your apps have, what shows up in other people's photos — is now a basic part of personal security.