Welcome to edition thirteen of OSINT Field Notes.

Two weeks ago, we looked at this Russian military facility near St Petersburg that had been hidden on Yandex Maps under copy-and-paste squares of fake trees laid over the satellite imagery tiles.

It was a pretty poor effort. The repeated patches made the edit conspicuous, and comparing other imagery providers revealed the buildings and paved areas beneath the fake forest.

But that’s not the first time we’ve seen fake or manipulated imagery. Manipulated imagery has been around for years. Comparing it with independent sources can expose those alterations, as other imagery providers helped demonstrate in this case.

The full walkthrough is in the YouTube video below, but in this edition of OSINT Field Notes, we’ll explore other examples of manipulated imagery, from concealed sites in South Korea and the Netherlands to false claims about strikes in India, Pakistan, Bahrain and Qatar, and a fabricated image used by Russian state TV to misrepresent the downing of MH17.

Staying on the theme of authenticity and sourcing, we’ll also use platform transparency features to look behind the pro-Russian Global Fact-Checking Network, a “USA” garage sales page and pages run from Sri Lanka that pose as British and Australian “patriots”.

And then we’ll go through the dispatches, which is a round up of some of the impressive, insightful and inspiring digital investigative content I saw this month.

Technical Teardown: check the image, then the source

Finnish broadcaster Yle reported the example on 17 August 2026. It’s a clear case of how satellite imagery can be manipulated to obscure, hide or mislead.

The repeated patterns make this edit relatively easy to spot, but a less repetitive edit, including one made with generative AI, could have been harder to identify from the image alone.

Comparing visual material with independent sources is one of the most useful ways to test what it actually shows.

Google Earth does that for us, along with another comparison which I used in the video from Esri’s World Imagery Wayback.

I also revisited a Naver Maps image of Yongsan, Seoul, that I shared in 2022. It showed copied forest covering a military area. In the comparison assembled for this edition, Google Earth obscures the area with blur, while Esri’s World Imagery Wayback shows buildings and roads.

Other examples of altered satellite and aerial imagery

There’s been quite a few different cases where imagery editing or faking has been caught out.

In the case of MH17, Russian state tv claimed images showed a fighter jet firing at the plane before it was downed. The imagery was quickly identified to be a fabrication by analysts and written up by Bellingcat in November 2014.

In 2013, Hans Kristensen at the Federation of American Scientists reported that an aerial image he purchased of Volkel Air Base had been altered. A weapons storage area had been replaced with trees, fields and invented roads.

Cases of doctored imagery surfaced during an increase of hostilities between India and Pakistan in May 2025. It was used to beef up claims of damage caused by one party to another. Those were also quickly analysed and fact-checked by imagery analysts.

In March 2026, the Tehran Times shared a supposed before-and-after image of an American radar in Qatar. DW traced the location to a US naval base in Bahrain. The “before” image was genuine, but DW identified the “after” as AI-generated. Separate satellite imagery showed real damage at the base following an Iranian attack. That did not make the fabricated image authentic.

The checklist

The useful question is whether the image supports the claim attached to it and while inspecting the pixels is one part of that, running checks on the source, location, date and independent evidence is another.

So some good questions to ask yourself are:

• What’s the claim? Pin down exactly what the image is supposed to show.

• Where did it come from? Trace it back to the original source using an image reverse search.

• Where is it? Confirm the location independently (cross-referencing with other satellite providers like we did above).

• When was it taken? Distinguish the image’s capture date from the map update and the date someone shared it.

• What do independent sources show? Compare other imagery, footage and reporting from the ground. Remember that two map services may use the same underlying imagery so double check the independence of your sources.

Transparency labels give revealing context

It’s such a simple thing, to take the mask off someone, but when when you’re online, that’s a bit harder.

For example, take this account on X called Global Fact-Checking Network (GFCN). To anyone scrolling on their feed quickly, the name and some of the tweets could check out to anyone passing by. They look like any normal fact-checking outlet. That is, until you look a bit deeper.

GFCN’s own website names its founders: Russian state news agency TASS, Dialog Regions and the New Media School. It has hosted sessions featuring Russian foreign ministry spokesperson Maria Zakharova. Reporters Without Borders has documented how its output promotes Kremlin narratives.

Its X transparency panel adds another detail: “Account based in United States” alongside “Connected via Russian Federation App Store”.

X also warns that the country label may be inaccurate and those labels are worth checking, but the connection through the App Store is reliable. And that’s to be taken in conjunction with the content on its website.

Similar transparency features are available on Facebook and Instagram and can help you check whether a page presenting itself as local is actually managed from elsewhere.

For example, let’s look at this Facebook page Crazy Dumps USA with almost one million followers. At first glance, it looks like an ordinary page sharing yard-sale finds.

But the page presents AI-generated content as real yard sales in the US. Its videos attract substantial audiences, and records show that the page was monetised until June 2026.

Facebook’s transparency panel lists Bangladesh and the UK as the countries where the page’s managers are located.

Back in August we used the same techniques to identify Sri Lanka-based admin locations of a large network of accounts pretending to be British and Australian and posting anti-immigration AI-generated content to garner views and raise revenue.

The Crazy Dumps’ linked Instagram has some AI-generated videos, like the one in the screenshot below of the cosmetics in a dumpster, that have been viewed more than a million times. Impressive for a page ran out of Pakistan, as shown on the transparency feature below.

I’m not saying these platforms are perfect. But for a quick check on who or what is behind a page, these transparency features are a gift, and checking them is a habit worth building for anyone who comes across something online that raises doubts.

Places like YouTube don’t have these country disclosure features.

For example, if we pivot to the linked “crazy dumps” YouTube channel which is posting the same AI-generated content, we can see the channel lists its location as the United States. That channel-country field is selected by its owner. It doesn’t independently establish where the channel is run from.

Dispatches: interesting things I saw over the past month

As we have seen, mapping services can easily dictate what you see and what you can’t. The past few weeks have been a spectacle of that.

BBC Verify found that detention facilities linked to alleged human rights abuses were blurred on Apple Maps in China.

Aerial imagery of northern Gaza appeared on Israel’s public mapping portal, GovMap, before parts were obscured again. Nathan Ruser preserved a northern Gaza layer on Soar Atlas.

Bellingcat’s comparison is also a useful reminder that newly circulating imagery is not necessarily newly captured imagery.

Four years, one photograph and a community of strangers

Rainbolt is known for rapid geolocations, but his latest video follows a much longer search: almost four years spent identifying where a photograph of Julia and her late mother was taken.

The search became a collective effort. Local researchers visited parks, volunteers compared trees and benches, and people shared historical records and footage. A breakthrough came from a 2006 YouTube home video of a grandmother visiting Owl’s Head Park in Brooklyn. It preserved the layout before renovations changed the scene.

The journey is brilliant, the investigative work, the analysis - amazing. But the community effort is what makes this worth your time. Different people brought local knowledge, patient searching and access to photographs that weren’t readily available online. Together, those contributions helped reconstruct the place and the occasion.

Do watch it. It’s inspiring to say the least.

Geolocating the 2012 video of Austin Tice in captivity

Thomas Bordeaux and Gabòr Friesen geolocated scenes from the 2012 video showing American journalist Austin Tice in captivity, including a convoy near Syrian military ammunition bunkers. Their findings form part of the wider BBC/NPR investigation into the Assad regime’s role. There’s some great visual analysis in this one.

Rohingya stories backed by footage and satellite imagery.

The Guardian’s Rohingya investigation combines satellite imagery, verified footage and testimony. Read it for how the team connects visible changes with people’s accounts and evidence about responsibility.

AI checker SynthID

Google has opened SynthID Detector to the public, expanding access to checks for invisible AI watermarks. Its partners include NVIDIA, OpenAI and Kakao.

As we have seen before, a detected watermark can help identify AI-generated material, but finding no watermark does not establish that something is real. And this is why these types of indicators are useful, but should be taken as part of a workflow which also including original analysis techniques and verification steps such as geolocation and contextualising.

Beefed up mapping

I love a good map, especially when it’s using helpful data in one location that would otherwise sit disconnected across the web. Bilawal Sidhu is building God’s Eye View along with a community of devs, researchers and others to crowdsource this incredible project. It’s a great community product and it looks like there’s a lot of experimental dev work being done on this project that will inspire many other projects. Oh, and it’s open source - here’s the GitHub link ;]

Finally, an update and the end.

Thanks for joining these newsletters, sharing them and boosting them.

Following on from the last newsletter: I’ll soon be launching a self-paced course with a certificate. It’ll focus heavily on analysis and technique with practical real-world exercises, the stuff that stays relevant whatever the latest cool tool or platform is.

See you in the next one. Ben :]

Welcome to edition 12 of OSINT Field Notes. It’s an honour to bring you these newsletters and practical skills each month and receive the really helpful and supportive feedback from those of you that read it and find it useful.

I’m making this month’s edition of OSINT Field Notes a thematic piece, looking at how open source investigative techniques, data analysis and clever sleuthing can help response efforts to disasters, in light of the horrific events in Nepal.

With disasters like this, things move fast online and offline and what’s critical is getting the truth from the ground. This is especially the case in environments where restrictions and disinformation impede access to the reality on the ground.

Emergency response efforts coordinate information on locations, supply routes and access to data to support that. At the same time, online efforts to locate lost family members, reconstruct events for news, and battle the scourge of disaster-related fake news, all use these same skills in one way or another.

And that’s what this edition is about: disaster data. We’ll look at how to find rapidly available imagery released during disaster efforts, how to verify what a viral video actually shows, constructing a visual timeline of events and even the geolocation of the last known whereabouts of missing family.

To make sure these newsletters are efficient, I’m changing the order of content to prioritise the practical parts such as the technical teardown where we walk through how to do things, and the case file where we walk through a case and the methods and techniques. The dispatches and toolkit will be at the bottom of this edition.

So let’s get into it. Ben.

1. Technical Teardown: how to find free satellite imagery from commercial providers during disasters

Some commercial satellite imagery providers make their high-resolution imagery free to support response efforts to disaster events.

If you are trying to understand what happened on the ground, or geolocating footage of the aftermath, this type of rapidly updated imagery can be incredibly helpful.

In the aftermath of the Nepal floods, Vantor published an open collection of imagery, as part of its Open Data Program.

The imagery can be accessed from a number of places including on Vantor itself, but two multi-source locations I used for the Nepal floods were MoreGeo or Development Seed.

Each of those, as seen in the images above, give a map-style interaction to load the available satellite imagery.

Start with a question

When you’re looking for updated imagery of disasters, don’t just scan through the library of available images looking for the most dramatic one.

One thing I do is pick one set of images that have a before and after (or you can opt to use a before from other freely available imagery resources), and have a series of questions to think of.

For example, questions you might have when looking at imagery might be:

• Did the visible river change near any settlements?

• Are critical roads still connected?

• Are there any changes to buildings within settlements?

Read the imagery metadata before looking at the visuals

Things to keep in mind when scrolling through these libraries of satellite imagery are to check the footprint, acquisition time, cloud cover and viewing angle. Knowing those things only takes a quick minute and can help decide whether the image is going to be worth loading and scrolling through.

For example, a recent Vantor item I checked, B120001101226410, reported 94% cloud cover and an off-nadir angle of about 44 degrees. It was recent and it covered the area, but much of the scene was hidden.

In many cases, recent imagery doesn’t always mean useful. However, that image was easy to check, because it also meant there was a very small area visible in the image, so it didn’t take me too much time to check that out.

Open the actual image

In moreGeo, for each item you see on the map, you can download it or copy the source URL by clicking on the specific satellite tile, or scrolling down the viewable list, and finding those download options under Asset > Visual COG.

For a quick assessment, show it on the map first. Development Seed offers the same basic route through the item properties and asset links.

Record the title number or item ID and acquisition time (often referred to as datetime) as soon as you choose a scene and start looking at it, so that you know when the change was observed and on what item.

Do note that publication time and capture time are different things, and the capture time is the one that belongs on your comparison.

Build a comparison, not a collage

Find an overlapping image from before the flood. Match the location and scale, then check whether the older image is recent enough for the question. This collection includes historical imagery, so a difference may reflect years of construction, seasonal river change or an earlier disaster rather than the flood you are investigating.

I find when doing imagery analysis like this, that it’s helpful to keep a small analysis log, kind of like a little journal as to what you’ve seen, where you saw it, the details of the image, dates etc. I usually set these up in a spreadsheet covering:

• A link to where you got the imagery from

• coordinates of the change you witnessed

• pre-event item ID and acquisition time

• post-event item ID and acquisition time

• cloud or angle limitations

• what visibly changed

I put ‘visibly’ in bold, because that’s important for this work. If your conclusion is “the road connection is no longer visible in the post-event image”, write that. Do not jump to the conclusion that “the flood destroyed the road” unless an image can visually confirm that.

Diversify the imagery

The Vantor assets I inspected were one type of imagery, but there’s many out there and a number of commercial providers also support open data programs during disasters.

A helpful tool that has been developed to explore different imagery is this Nepal Floods Imagery Viewer which has compiled a number of different providers into a single resource. The benefit of this is there are different spectral features for those different images, for example the Pelican imagery from Planet seen on the viewer can be selected to view false colour or NDWI.

I also mention diversify imagery, because in some disaster efforts there are also releases of drone imagery (see the clarity in the imagery below), which can be incredibly useful for geolocation and further analysis.

2. Case File: one video, two sources, one false story

A widely shared video was seen on X more than 1.8 million times, claiming to show an F-16 bombing a dam and causing the floods in Nepal.

The video was actually two videos. One was an AI-generated video showing an explosion in a dam wall. The second video was real and shows CCTV footage from the Gyirong border area during the flood. In this case, the claim was incorrect.

The claim and the footage was fact-checked by Lead Stories, who found that the AI-generated video had in fact been circulating online since at least 10 May, 2026.

This work is critical, and in many cases, just like this Nepal floods-related fake news, much of the leg work was done through a quick image-reverse search.

We can follow those steps, by selecting key frames from the video and making screenshots.

When we do an image reverse search using Google Lens, we can see just how many times this AI video has been repurposed for the Nepal context, or others. It’s also not the only video to go viral of a jet bombing a dam. Another fake video, showed in the recommendations, was viewed more than 5 million times.

By looking at the source and uncropped footage on Facebook, it is clear that this was AI-generated imagery due to the label (see the little white ‘Ai’ in the top left). However we would also be able to identify that this was AI-generated footage by analysing the jet, how it flew, the area and verification of the dam.

In general, when it comes to these cases, I find the most useful question is not “is this video real?” It is:

• Which parts of the video are real?

• When was the video, or parts of it, originally posted?

• Does the claim being made in the comments or text uploaded with the video actually match the footage?

• What can we prove with our findings through referencing links and analysis, as opposed to just saying “this is fake”?

3. Dispatches from the disaster response

Reuters

This coverage from the Reuters Graphics team shows a reconstruction of the rapid landslide and flood and how it came from the glacier source down through the valley using satellite imagery, terrain data and verified footage.

There’s a good building of trust right at the top in this report, because it clearly states what is known vs what isn’t known. That’s good analysis, because not every explainer needs to know every detail, and in a sea of mis/disinformation, sometimes it’s critical to get facts out early, even if it means the entire picture isn’t completely known.

The sources used to visualise this report are the method, and can be applied to many other contexts. They’ve effectively stacked sources to be able to tell the story, using tools often featured in this newsletter, such as: Sentinel-2 imagery, Google Earth, geolocated footage and open data (as covered above) from Vantor, Planet, Open Street Map.

OpenStreetMap / HOT

In response to the disaster, Humanitarian OpenStreetMap Team (HOT) and NAXA launched a mapping initiative, in collaboration with the local mapping community, to support ongoing humanitarian efforts in the region. The OSM team launched a public map to show the extents of Tasking Manager projects (red) and the boundary of the focus area (blue).

This response shows what happens after imagery becomes available: roads, buildings and affected areas are turned into helpful geographic data to support ongoing efforts.

Similar to the technical teardown, you can access the tasked imagery through the OSM Nepal Floods panel.

Reddit: locating a missing person’s last image

A user posted to r/whereisthis after a friend's father went missing around the Nepal–Tibet border. The photograph they shared was the last image he had posted to social media. There was no location attached, so they asked whether anyone could work out where it had been taken.

Within the thread, Redditors matched the building to the Integrated Customs Building at Rasuwagadhi. One of the replies specifically points to the windows as part of the match, while another contributor says they recognised the location from Google Maps. The person who posted the appeal then confirmed that he regularly worked there.

It is a very simple technique of visual geolocation, but the application is important. Open source work did not determine what happened to the missing man. It did, however, turn an unidentified photograph into a specific place and therefore help establish where his last known visible location might have been.

A lot of geolocation exercises online are treated almost like puzzles, but this case is a reminder of how those exact same techniques can be used in the real world to find the last known location of someone who is missing after a disaster.

4. Toolkit

Copernicus Emergency Mapping: the ESA, Copernicus Emergency Mapping service provides a resource in times of disasters for monitoring and response efforts. This specific one, in response to the flash floods and landslide in Nepal, provides a rapid flood extent and damage assessment mapping, which is publicly available.

Google Fact Check Tool: I’ve mentioned this tool in the past, but the recent floods and wave of mis/disinformation is a timely reminder of the Google Fact Check tool, which indexes fact-checks done by local and international outlets and categorises them in different ways, depending on country, theme or event. I wanted to include this tool because I think it’s an incredible place to kick off more detailed investigations into patterns of networks, coordinated activity and digging into who is behind specific networks.

A small personal update

I have been in the process of working on an affordable, self-paced course on open-source investigations and analysis. I’m truly excited to share this, as it’s been a work in progress over some time, especially after the success of the YouTube series I ran called “OSINT At Home” and the trainings I’ve delivered around the world, many of which focussed on entry level techniques and using them in real-world investigations.

The course I am designing is going to focus on practical work and lessons I’ve learned leading investigations in the field. It’s going to be full of very real-world exercises and technique-driven, covering many of the topics I’d wish I had available when I was first starting out as an investigator. Stay tuned, as it will be ready in the coming months.

Closing Note

If writing this edition of OSINT Field Notes has reminded me of anything, it is just how vast the applications are for open source investigative techniques.

In this edition we looked at how the geospatial data community pulled together to coordinate mapping of buildings, serve up imagery, stack geospatial data with other forms of open source data to support humanitarian efforts.

We’ve seen fact-checkers debunk viral claims attempting to attribute blame of a natural disaster and disinform people who are desperate to get news about what’s happened in Nepal.

And we saw how online communities helped locate the last known photo of a missing person.

Same techniques, different subjects. All with the aim to add valuable, trustworthy, information to an environment susceptible to incorrect information.

If anything, I hope this edition on disaster data inspires you to think about different applications of the skills you’ve learned from this newsletter, even if it’s just an image reverse search, because many a great investigation stem from just that.

Ben.

Welcome to edition eleven of OSINT Field Notes.

I’ve taken a bit of time off recently and finished some hobby projects. I set up an ADS-B receiver that captures raw flight data overhead. It’s helpful to understand how flight data we work with is actually collected. Setting it up was pretty straightforward and takes a bit of Raspberry Pi configuration whi…

Read more

Welcome to edition ten of OSINT Field Notes.

I can’t believe we’re at edition number 10 already and what a community this newsletter has grown with. We’re now at just over 5,300 fellow pixel-gazing subscribers and I cannot thank you all enough for the amazing messages, shares and appreciation for these monthly words.

In a personal update, earlier this mon…

Read more

Welcome to edition nine of OSINT Field Notes.

This month has been about discovery, both through genuinely useful vibe-coded tools and through the old-fashioned curiosity of researchers willing to scroll Street View for hours or pull apart a video’s metadata.

I was fortunate enough to share some of these techniques I write about in person this month, speak…

Read more

Welcome to edition eight of OSINT Field Notes.

It’s been a busy month for movement data.

Conflict Insights Group used phone-location data, Wi-Fi network names, satellite imagery, flight tracking, and open-source reporting to follow Colombian mercenaries from Bogota through Bosaso, Abu Dhabi, and Kufra into El Fasher during the RSF takeover in October. Av…

Read more

Welcome to edition seven of OSINT Field Notes.

The past month has been active. A French sailor’s morning jog around an aircraft carrier deck handed researchers the exact position of the Charles de Gaulle in the eastern Mediterranean. Within weeks, the i Paper had found 519 British service personnel, including nuclear submarine crews, publicly logging run…

Read more

Welcome to edition six of OSINT Field Notes.

The Iran conflict has produced a volume of verifiable material that would have been unthinkable a decade ago: satellite imagery, geolocated videos, munitions analysis, strike timelines. With it came a serious test of whether open-source verification can substitute for the extremely limited on-ground access. On…

Read more

Welcome to the fifth edition of OSINT Field Notes, a special edition for those seeking images from above.

Satellites have dominated this month. Shadow fleets caught from space despite killing their transponders, war and conflict captured from orbit, users’ traffic data resurfacing as geospatial products, and whale migration highways mapped through satell…

Read more

Welcome to the fourth edition of OSINT Field Notes and the first one for 2026.

Over the holidays, between trying to switch off and still doomscrolling the news, I’ve been thinking about how quickly “evidence” turns into “story”. A PDF gets shared and people assume the black boxes mean the sensitive bits are gone. A map appears and suddenly it’s framed a…

Read more

Welcome to the third edition of OSINT Field Notes.

Lately I’ve been buried in gaussian splatting, a technique that turns photos into 3D scenes. Skyfall-GS is the latest example, rebuilding terrain from angled satellite shots. It’s still rough, but you can already see the impact for understanding what has happened in an area, hard-to-reach incidents and e…

Read more

Welcome to the second edition of OSINT Field Notes.

Over the past month, I’ve been down a rabbit hole looking at the world after dark, using night-lights data to trace the scars of war, disasters, and power outages. Satellites see more than we realise, and those nightly patterns are quietly documenting how the world shifts.

Read more

Welcome to the very first edition of OSINT Field Notes.

Over the past month, I’ve often been reminded that the most crucial evidence often hides in plain sight. Whether it’s the unseen geometry of a shadow to solve a geolocation puzzle or the precise weave of a shawl identifying a militia group, the clues are always there if you use the right lens.

This …

Read more