The digital frontline: Conducting open source investigations in Gaza, Lebanon and Israel

Four investigators share their thoughts and experiences from the past year – providing insights into the role open source research has played in the conflict and the personal challenges they have faced.

Please note: this article contains details that some readers may find distressing. CIR has changed the names of the investigators and other team members interviewed to protect their identities and ensure their online safety. 

With most international media prevented from reporting on the ground in Gaza, the war has mainly been filmed from smartphones rather than TV cameras. Local media and citizen journalists have played a critical role in documenting the situation – live-streaming their stories in real-time to millions of followers online – even as scores of journalists and media workers have been killed.

With access for foreign correspondents granted only through rare, escorted trips into the territory by Israeli troops, media outlets have become reliant on images and footage filmed by people on the ground. From BBC Verify to CNN’s investigative team, newsrooms have turned to open source (OSINT) techniques to make sense of a constant stream of footage emerging online since the Hamas-led 7 October attacks, which killed about 1,200 people and saw over 250 hostages taken. 

Israel responded with a military offensive on Gaza that has killed over 44,000 Palestinians and led to a humanitarian crisis, with the UN reporting that 1.8 million are experiencing “extremely critical” levels of hunger. In late September, the ongoing conflict escalated in Lebanon too, killing at least 1,400 people and driving millions from their homes.  Tens of thousands of Israelis are still unable to return to their homes and, until the recent ceasefire, faced near-daily strikes.  

In Gaza, where the international media has limited visibility, locals who are capturing footage are “the most valuable sources by far” says Carlos, a CIR investigator focused on the Occupied Palestinian Territories, Lebanon and Israel. His colleague Michael agrees: “It’s something that I think is engraved in Palestinians themselves – to record what is happening.”

As open source investigators, part of their jobs is to gather, archive and analyse the authenticity of videos and claims posted online to build a reliable picture of what is happening on the ground. This will often require combing through hours of graphic footage to identify features such as the remnants of a weapon system, indications of a location –  such as building names – or to count visible casualties after a strike. 

So far, the team has archived over 8,000 pieces of content and verified over 2,500. CIR will soon make all verified data publicly accessible through an online map intended to provide an additional resource alongside existing open source maps, such as the one recently published by Forensic Architecture. CIR’s map will also provide assessments and analysis of over 1,200 incidents, with a focus on those involving casualties or significant damage. Covering the Occupied Palestinian Territories, Lebanon and Israel, it will aim to provide a comprehensive picture of the conflict through open source and will be regularly updated to enable ongoing monitoring.

Pieces of a puzzle

CIR classes an “incident” as a combination of multiple pieces of content, often captured from different angles and at various stages of an event, allowing investigators to verify details such as the location, time and date, visible casualties, and impact on infrastructure such as housing, hospitals, and utilities. The content may be in the form of user-generated content (UGC) but also includes satellite imagery, CCTV, drone or bodycam footage, as well as written claims and media reports. 

Open source investigator Michael recalls a car strike on a crowded street in Rafah, southern Gaza, where a video showed several casualties, including children. Footage of that strike was also released by the Israeli Defense Forces (IDF) on X, in which a soldier can be heard asking permission to target the car. Michael identified one of the casualties, a young girl, in footage later filmed at the Kuwaiti Hospital, Rafah, based on the red clothing she wore. 

It is this very act of piecing together fragments of information that makes open source investigations so strong, says Myla, the team’s technical lead.

“We don’t have a reliance on one piece of evidence – we can never assume or make deductions from what we see. We have to take it a step further and try to get a wider picture – look at the aftermath, but also the ongoing situation, and investigate what was happening on the ground or in the area preceding that specific incident,” Myla explains.

She likens the process to piecing together a puzzle. When these pieces slot together, the results can be a powerful reconstruction of an incident, providing critical insight into how events unfolded. 

Within hours of the 7 October attacks, CIR analysts started to collate and verify the videos showing Hamas terrorists attacking Israeli civilians and taking hostages. They worked with journalists from the Washington Post to help construct a timeline of events, bringing grim clarity to what was then a confused, chaotic picture. 

CIR’s co-founder Ross Burley was keen to mobilise a team as soon as possible. “I was in Madrid at the time, but like everyone else could see immediately how serious the attacks were,” he remembers. 

“CIR often works in difficult contexts – in particular conflict zones. We have analysts who can quickly start to collate and verify digital content, and we had a database up and running within an hour or two. I also remember how shocking the level of violence was – the digital material from October 7th was  some of the worst material I or our investigators had ever seen.” 

Their work continued in the months that followed: in December 2023, CIR supported a Reuters investigation into an Israeli tank that killed one of the news outlet’s journalists and injured six other reporters in Southern Lebanon on 13 October 2023.  The investigation threaded together hundreds of photos and hours of video footage, as well as satellite imagery and shrapnel gathered from the scene. It was able to reconstruct the timeline of events leading up to the firing of two shells as the journalists filmed cross-border shelling. All evidence pointed towards Israel, with CIR’s independent analysis of the shell fragments strengthening the investigation’s conclusions. 

Geolocating ruins

Like all digital investigations, the work requires a painstaking level of detail,  but this conflict in particular poses an array of challenges for those conducting open source analysis. 

Geolocation is the process of using information in a video or photograph to pinpoint the location where it was taken. With limited Google StreetView in Gaza or the West Bank, investigators must work mainly with satellite imagery to geolocate footage and analyse visible damage, but this is not always up-to-date or high resolution. 

The team must therefore be creative and opt for what Myla describes as an “all source” approach – turning to a range of different satellite or map providers, or even more unlikely sources such as weather data, which can sometimes be used to narrow down a time frame.

Investigators are reliant on buildings and landmarks to geolocate images and footage, but the level of destruction in Gaza makes this verification process difficult. A UN assessment of satellite images in September 2024  found that around 66% of structures, including more than 227,000 housing units, had sustained damage.

“If you see a video that was taken in Gaza last week, any imagery of Gaza from two years ago is kind of completely useless, because the buildings that you might have used [as a point of reference when geolocating] are so highly damaged that they look completely different,” explains Rolf, another CIR investigator. This is a result of not only air strikes, he adds, but what appear to be demolitions by Israeli troops that the team have mapped as part of their work. 

Rolf points out that evacuation orders, and the continual flow of people fleeing from one city to the next, can also impact what is captured on camera and what is not. The UN’s humanitarian agency says that about 90% of the population of the Gaza Strip has been displaced at least once since the war between Israel and Hamas began. Incidents in some areas are far more visible than others – with internet blackouts also playing a part in limiting information from surfacing – another reason why investigators treat UGC as a representation of what is happening and never the complete picture.

A digital battlefield

The team monitors social media channels daily, taking into account written claims and media reports as well as footage and images. 

“There’s rarely a day without any incidents at all,” Carlos observes. “The sheer volume of information can indeed feel overwhelming, especially given its intense nature and the volume of footage involved.”

But misinformation is widespread. One BBC journalist previously described the online environment surrounding the Israel–Gaza war as a “battlefield of information”. Experts say that in times of crisis, there is an information vacuum that gets filled with misinformation as people attempt to share content that validates their views. 

Rolf agrees. “If you have your natural biases, you’re going to naturally be inclined to think about things in a certain way,” he says, “even if it doesn’t necessarily match the facts.”

The CIR team often see captions and comments that tell a different narrative to the visual content – for instance, footage of conflict zones such as Ukraine and Syria shared out-of-context, or old videos framed as breaking news. On the more extreme end of the spectrum, investigators in other organisations have identified clips from video games being passed off as real-life and narratives of “Pallywood” – a campaign that claims crisis actors are used to stage casualties in Gaza. 

While the war has highlighted the benefits of open source, some have raised concerns about anonymous accounts that post findings with the “aesthetics of OSINT, but without the rigour”. Open source specialists have spoken out about how X’s verification system – where anyone can pay for a blue tick – has made it more difficult to know who to trust. There has been a pattern of OSINT accounts emerging on the platform packaging divisive and partisan posts as verified information. Some churn out thousands of posts on X for monetary gain, 404 Media reports, prioritising speed – and likes – over accuracy. 

Digital investigations often take weeks or even months to conclude, but in a 24-hour news cycle, even reputable newsrooms have stumbled when rushing to break the news first. In the aftermath of the Al-Ahli hospital blast, the New York Times backtracked on its original reporting, admitting it had “relied too heavily on claims by Hamas” and that it “did not make clear that those claims could not immediately be verified”. 

A later probe by the New York Times does not answer what or who was responsible but casts doubt on a video used by Israeli officials to demonstrate that a failed Palestinian rocket launch was to blame. Investigations by Forensic Architecture and the Washington Post came to similar conclusions, while a Human Rights Watch report set out how a misfired rocket from within Gaza was the most likely explanation. 

Graphic footage ‘changes you’

While the work CIR does may appear to be distant, removed and clinical – with investigators required to view digital evidence through an impartial lens – there is no denying that it takes its toll. Anyone who has monitored events since 7 October 2023 will have been exposed to some of this content, shared both in the mainstream media and through social media accounts. Investigators are required to go over what is often graphic footage again and again, analysing it with a forensic level of detail. 

Carlos admits that it is the hardest part of the job, especially when children or vulnerable people are involved. He adds that the “emotional toll” of seeing this content day in and day out is “quite intense”. 

Mental health specialists describe vicarious trauma as “empathetic engagement” with trauma survivors, and it is common among journalists and investigators who are exposed to trauma victims either in real life or online. Symptoms can include feelings of sadness, rage or detachment, and concerns have been raised over the volume of graphic footage social media users have been exposed to over the last year – with many feeling a need to bear witness.

“People will say they see certain videos and then they can’t get them out of their heads for days,” Rolf says. “They go to sleep at night seeing the same horrible video.” He adds that he has not experienced this himself but “even that kind of makes you question yourself a little bit”.

Michael says it is not the images of the deceased that linger in his mind, but the footage of family members in despair as they look for loved ones buried in the rubble – he struggles knowing they are forced to live on. The “amount of dehumanisation is abnormal”, he says, adding that exposure to such footage “does change you”.

Burley says vicarious trauma and the wellbeing of staff remains a concern: “It’s one of the hardest things at CIR – teams of dedicated, amazing people, who choose to watch some of the most horrific things humans can do to each other. 

“This was the overriding reason we chose to keep our work on Gaza quiet – to try and protect the team as much as possible, while they had to verify unimaginable violence. Staying silent has given our investigators the time and space to do their work. By sharing our analyses in public now, those investigators can take comfort from knowing that their work will have a wider impact.”  

The team leans on each other for support, covering for each other when things get too much. Regular breaks and self-care measures are ingrained into their daily routines in an attempt to build a barrier between themselves and the violence they witness on their computer screens. Michael says he tries to make his colleagues laugh, providing a respite from their work.

Anna, who manages the project and team, describes how such work has been rewarding but extremely traumatic. “Working on graphic content for months with a small team has been quite intense and still is intense. This work is incredibly meaningful for us as a team and for CIR, but it has also been traumatic. We’ve created a safe space and built strong relationships within our team to support one another.”

Justice and accountability

At a time when the conflict shows no sign of slowing down, and many people feel a strong sense of helplessness, Myla points out that open source research gives the team a sense of purpose, whether through verifying incidents or archiving data.

“It’s kind of our way to help out,” she says. “[The project] has brought us together because it’s like a mission that we’re working on.”

CIR adheres to the Berkeley Protocol on Digital Open Source Investigations and Eurojust’s guidelines for civil society organisations documenting international crimes and human rights violations for accountability purposes. These resources provide international standards for conducting digital investigations and guidance for gathering, analysing and preserving information in a “professional, legal and ethical manner”. 

Content collected by investigators is archived to ensure any deleted images or videos are preserved, and data is shared with justice and accountability bodies. The goal is that this digital trove will one day be used to hold perpetrators accountable. 

Despite the challenges, it is a key motivation to keep doing this work, Burley says: “Investigators do it because without them, the truth around these events will be distorted or lost – they do it so that one day, there can be accountability for those committing these acts of violence.”

CIR will soon release a map documenting the data collected and verified by this project, from 7 October 2023 onwards – providing an accessible, open source resource for researchers, journalists and anyone else monitoring the ongoing war in the Occupied Palestinian Territories, Lebanon and Israel.

CIR’s policy on vicarious trauma is available here and includes tips on handling traumatic and graphic content.