Can a tweet be evidence? How social media is being used to hunt down war crimes in Ukraine – Grid News


Can a tweet be evidence? How social media is being used to hunt down war crimes in Ukraine

Grisly images of massacred Ukrainians have appeared on social media and in news accounts recently, prompting many to accuse the Russians of war crimes, crimes against humanity and even genocide.

Even before the images emerged, the International Criminal Court, the independent body that investigates and prosecutes genocides, war crimes and crimes against humanity, announced that it had opened an investigation on March 2, after referrals from 41 state parties.

U.S. officials have pledged to help the effort. “We have to continue to provide Ukraine with the weapons they need to continue the fight and we have to get all the details so this can be an actual — have a war crime trial,” President Joe Biden told reporters last week. On Wednesday, the House of Representatives overwhelmingly passed a bill directing the government to “collect, analyze and preserve evidence” related to war crimes in Ukraine.

But even with international support, the process of investigating and prosecuting war crimes is notoriously slow. Cases can drag on for years. That can be frustratingly dissonant at a moment when millions around the world are virtual witnesses to atrocities in real time.


Russia has disputed the accusations and has made counter-accusations that Ukraine staged the bodies for the cameras. A growing body of evidence appears to disprove suggestions of Ukrainian involvement in these atrocities, although there are indications of possible incidents of war crimes by Ukrainian forces.

Could war crimes investigations go more quickly in an era of ubiquitous social media? To find out, Grid spoke with Alexa Koenig of the University of California Berkeley School of Law, an expert on investigating war crimes. Koenig is trying to speed up the process of probing and prosecuting war crimes using technology. Her program, the Human Rights Center at the University of California at Berkeley, trains students and professionals alike on investigating atrocities online.

Together with the United Nations, Koenig and her colleagues developed the “Berkeley Protocol,” a roadmap for formalizing the collection and standardization of online evidence to be used in war crimes investigations and other international justice and human rights efforts. She spoke with Grid from The Hague, where she and her colleagues are launching a training for war crimes investigators.

Grid: Why do war crimes prosecutions typically take so long?

Alexa Koenig: The evidentiary standards for international criminal cases are more rigorous than what, say, the media may require in order to publish a story.


Ideally, to meet the standard of proof, a war crimes investigator will try to secure physical, testimonial and documentary evidence, including digital evidence, for each element of every alleged crime — and the charges may include dozens of crimes, creating a scale to the investigation that can be daunting and time-consuming.

For example, for murder as a crime against humanity, a prosecutor will have to establish that there was a murder. Then, to establish that the murder was a crime against humanity, they must show that the killing was perpetrated as part of a widespread or systematic attack against a civilian population and that the perpetrator knew or intended that the killing be part of that widespread or systematic attack.

To establish a willful killing as a war crime, a prosecutor must establish that same killing of one or more people, and also establish that the person or people killed were protected by the Geneva Conventions, that the perpetrator knew about the victims’ protected status, that the killing happened in the context of and was tied to an international armed conflict, and that the perpetrator was aware of that conflict.

That’s a lot of evidence to collect. The political and security obstacles, and the logistical obstacles to getting on the ground and collecting physical evidence or meeting with potential witnesses can be significant. And by the time you get on the ground, critical information may have been taken or destroyed.

G: How are people trying to speed that process up?

AK: War crimes investigators are often ridiculously under-resourced, which means person power may be limited, and they are hampered by bureaucratic processes that can be critical for security and other reasons, but significantly slow the potential for adopting new technologies.

Using new technologies, digital investigators can accelerate the pace of their work. Artificial intelligence-based technologies like object recognition are helping investigators identify photos and videos that may contain critical information, including potential evidence, from among the thousands or even millions of images they have collected. Automatically identifying particular types of weapons or vehicles that may have been in a particular region, over a specific time period, can bring the need for manual review down to a more human scale.

G: We are seeing hundreds of hours of videos and millions of pictures of this conflict emerge on social media, from Twitter to TikTok. How can investigators use this as evidence to build cases on alleged war crimes in Ukraine?

AK: Social media evidence can be helpful in a few ways. First, it can be useful for planning before a formal investigation commences, helping investigators see where there may be relevant evidence if they are able to get boots on the ground. Online videos, photographs, documents and other digital material can contain valuable clues that point to physical evidence and potential witnesses and helps them know where to go looking to document alleged crimes.

Second, social media may help investigators know what crimes may have been prevalent in the conflict and when and where those crimes may have taken place, so that you can begin to build a timeline and map of the conflict, situating incidents in time and space. Investigators may, for example, map certain types of practices — like bombings of hospitals — by pinning those locations to satellite images to help generate working hypotheses about what happened.


That information can be especially helpful for establishing patterns among the morass of data and may help generate the critical insights needed to suggest that the destruction of a number of hospitals, for example, constituted a crime against humanity because the destruction was systematic or widespread, or that it was a potential war crime, by suggesting the number of civilians killed was disproportionate to any military necessity.

Videos and photographs that show people with their hands bound would be classic evidence to suggest that they were killed in violation of the laws of war which protect POWs and others.

Finally, social media content can be used to corroborate or disprove other kinds of information that is collected, as well as relationships between people and their networks.

G: Are there downside or blind spots for investigators using social media for war crimes investigations?

AK: Social media-based investigations can lead to a very biased understanding of what is or has taken place, but we need to expand how you might think of a “bias.” There are three categories of bias that investigators need to be wary of and check: access bias, technical biases and cognitive biases.


Who has access to smartphones, the internet and social media sites? That is who is sharing their experiences or observations online. Differences in access, whether based on gender or geography, age or class, the urban-rural divide, or otherwise, can radically distort what gets posted and what investigators are able to find online.

Internet blackouts can also generate holes in the available data, and blackouts can be common during wartime.

Internet platforms can introduce bias with algorithms that prioritize posts that keep people glued to sites, which is not always the highest quality or most helpful information. A user’s previous search history, search location and other details are variables that affect what results the user gets when they conduct an online search, which is why investigators try to start from as neutral an operating environment as possible. (For example, investigators may use a VPN to change their alleged location to counter some of those biases and use different online systems and profiles for their professional and private lives, so that their private searches don’t influence the results of their professional work.)

Of course, we all bring human or cognitive biases to our work. A common example is confirmation bias where the investigator tends to look for, find and prioritize information that confirms their favored theory of their case. It can come up in less obvious ways, too. For instance, some crimes are just more “visible” and easy to detect, such as the destruction of buildings versus sexual and gender-based violence. It’s often easier to find the former, which can lead investigators to overlook the sometimes more hidden or coded signs of the latter.

G: How do investigators sort through the many claims made around photo and video evidence online? For instance, the Russian Ministry of Defense has pointed to photos of corpses in the streets of Bucha and claimed those bodies were dumped there by Ukraine. How would an investigator building a case determine responsibility?


AK: A first step may be to assess the reliability and authenticity of the video or photograph. We developed a protocol [the Berkeley Protocol on Digital Open Source Investigations] in partnership with the United Nations Human Rights Office that outlines how to appropriately verify digital content.

The first step is to conduct a technical analysis, for example, by inspecting any metadata still attached to an image file. Every time a digital device captures a photo or video, it embeds information with the image that can be helpful to an investigation, such as the day and time it was shot, the possible geo-coordinates of where it was taken and details about the capturing device. That information is not always reliable, so it’s not determinative on its own, but it can act as a starting place.

Many social media companies strip metadata from images and video uploaded to their platforms, but a few platforms keep the data intact.

The second step is conducting what’s called “source analysis.” Who is the source of the image and how reliable are they for what they’ve told you? Many of us were taught as kids to trust information from major media and government affiliates, but unfortunately they may deliberately or inadvertently communicate wrong information, so reputation alone isn’t all that reliable. Is there evidence that the source was actually at the scene of a crime? Do they have biases or potential motives for sharing that may call their credibility into question? Is it possible they’re not even human at all but a bot used to share propaganda or other misleading or inaccurate information?

A third step is content analysis. If you are told a photo depicts a possible crime that occurred in Bucha in Ukraine — what within the “four corners” of the image suggests it was, in fact, taken of Bucha? Is the clothing worn by people in the images consistent with clothing typically worn in that place at that time of year? Is the weather you see consistent with what you can find on sites that catalog weather or with what would be typical in that part of the world during that season? Is the built or natural environment (terrain or vegetation or architectural style) consistent with what can be found in that region? Can you find other images of that town, maybe even that exact location, to help corroborate or disprove what you’ve been told?


One of the most essential steps for verifying visual imagery is to run what’s called a reverse image search. Investigators will search to see if a particular image has appeared online before or whether it has been recycled from another place or time. That recycling is incredibly common, especially in conflict — sometimes to mislead, but other times just to illustrate the “gist” of what someone is trying to communicate.

As for responsibility, this is where triangulation of witness testimony, physical evidence and documentary evidence becomes especially helpful. Who controlled the area at the time the bodies appeared? How were the people killed? What kind of weapon was used? Is the type or means of killing consistent with the signature or practices of a particular military unit or civilian team?

An investigator will want to generate multiple working hypotheses and test those hypotheses against all the available relevant evidence. For example, what evidence exists to suggest that the perpetrators were Russian? What evidence exists of possible staging? What do we know about whether the image was of a real event but miscontextualized, which we call a “shallow fake,” or generated whole cloth through a machine learning process, which is a deepfake? All of that will get tested.

G: We are now seeing Ukrainian President Volodymyr Zelenskyy and others allege genocide on top of allegations of war crimes. What does this mean for investigators at the International Criminal Court?

AK: There are four international crimes within the jurisdiction of the International Criminal Court: genocide, crimes against humanity, war crimes and the crime of aggression. In the context of Russia-Ukraine, the ICC only has jurisdiction to investigate the first three, although several people are calling for a special court to be established that could be used to investigate and prosecute the crime of aggression.


The baseline difference is that with genocide, you have to show that the perpetrator had the intent to destroy, in whole or part, a particular group because of their nationality, ethnicity, religion or race.

Proving that intent is key, and often really hard to do. Killings that happen without that intent to destroy that group would not qualify as genocide, even if the killings are extensive. In that sense, legal and lay use of the term “genocide” really differ.

War crimes are violations of the laws of war. Intentional, mass killings of civilians would be a war crime. When talking about mass killings of civilians, it’s often easier to prove that what happened was a war crime or a crime against humanity than genocide, given the difficulty of proving that specific intent.

G: Both the U.S. and Russia are “signatories that have withdrawn” from the Rome Statute that governs the ICC jurisdiction. How does the withdrawal by both countries impact the ICC’s efforts to bring to justice those who committed atrocities in Ukraine?

AK: A country becomes a “state party,” essentially a member of the ICC, only after they have both signed and ratified the Rome Statute. Some countries, like the U.S., have signed but then never ratified the Rome Statute, meaning they were never legally bound. So this is less about withdrawal then about never completing the process of becoming a party to the court. The U.S. then “unsigned” the Rome Statute under [President] George W. Bush, which was largely a symbolic attempt to undermine the court in the aftermath of 9/11.

G: Ukraine is a signatory but has not ratified the statute. What does this mean for potential war crimes committed by Ukrainian troops? Are they at greater legal risk than Russians?

AK: Ukraine is not a party to the court but has twice accepted the court’s jurisdiction, the first time for investigation of potential international crimes that occurred from Nov. 21, 2013, through Feb. 22, 2014, and the second time from Feb. 20, 2014, on, as permitted under article 12(3), of the Rome Statute — which says that a country that is not a party to the court may voluntarily accept the court’s jurisdiction. And then in March 2022, 41 state parties referred the situation in Ukraine to the ICC. Today, the court is looking into alleged crimes committed in Ukraine since the Nov. 21, 2013.

As for who is vulnerable to prosecution: The Office of the Prosecutor is mandated to investigate all sides of a conflict without favor or bias toward any set of actors, thus both Russian and Ukrainian troops could be vulnerable to prosecution for international crimes that took place in Ukraine during the period under investigation. These include any acts that might constitute genocide, crimes against humanity or war crimes.

You can follow Alexa Koenig on Twitter @KAlexaKoenig, and the Human Rights Center’s work here. Thanks to Alicia Benjamin for copy editing this article.

  • Jason Paladino
    Jason Paladino

    Investigative Reporter

    Jason Paladino is an investigative reporter for Grid where he focuses on national security policy, U.S. foreign involvement and corruption.