Thread by @brechtcastel

According to Russia 🇷🇺 "The unexpected reveal of "innocent patients" with assault rifles showcased how the Ukrainian military uses ambulances." 🚨

Their proof? A video of 21 sec.

What do we see? Investigate! 👇 1/...

#OSINT 🔎
#Verification 🎥
#GeoLocation 🌍
#HowToOSINT 🧐

The investigation on this tweet from the Ministry of Foreign Affairs of Russia is a team effort together with @Techjournalisto, @ArchitMeta and @akhmxt.

(Follow them if you like these kind of #OSINT-investigations.)

The short video is viewed more than 110K times. 2/...

Armed men emerge from a van bearing the logo of the Red Cross.

The International Red Cross (ICRC) has a neutral status, also in the war in #Ukraine.

Do we see a recent war crime by the Ukrainian army in this clip? 3/...

In the video, we see not only the white van with a red cross from which armed men are coming, but also something that looks like an ambulance 🟦. 4/...

Finding out that this really is a Ukrainian ambulance is easy with Google #Lens.

"Ambulance" in Ukrainian seems to be written on this vehicle. 5/...

This ambulance in the background gives us more clues about where this might be.

We take a screenshot of it and load it into the Russian search engine Yandex, which is how we find similar vehicles 🟨. 6/...

Visual elements are similar. 🟩 for example

We also see the same logo 🟥 in the video (1) as on the photo we found (2).

When we search with this logo in Yandex (3), it appears to be the coat of arms of Kyiv with the archangel Michael. 7/...

By taking the background of the footage, the residential building, it was possible to pin the location to a place right between Irpin and Kyiv city. 📍

Geolocation. ✅

The timefunction on Google Streetview shows it's should be post 2019. 8/...

When was the video recorded?

We find different versions of the video on Twitter, YouTube and Facebook.

The oldest version we find online dates from 30 March 🟥. 9/...

We translate the Arabic caption with Google Lens: "end of the first day of Russian-Ukrainian negotiations in Istanbul".

This was on Tuesday 29 March 2022.

Since the video has the form of a live stand-up, it was probably recorded on that day. ⏲️✅10/...

We found the original footage from Al Jazeera: mediaview.aljazeera.com/video/YWO7qTe8…

The reporter is said to be Mahmoud Zaibak.

Analysis with #Azure shows that his profile picture on Twitter (right) is with 79% certainty the same person as the reporter in the video (left). 11/...

He is an eyewitness of what happened! 👀💯

We contacted him via e-mail, LinkedIn and Twitter, but he didn't want to respond to our questions. ☹️12/...

➡️ So, we continue our search with the info online.

Who are these five people getting out of the van?

Everything indicates that they are indeed Ukrainian soldiers.

They are dressed in camouflage, wear 🟦 armbands and 🇺🇦 is visible on a uniform 🟨. 13/...

It is highly unlikely that these were Russian infiltrators.

The video was shot behind the front line on the Ukrainian side + several journalists were present.

If Russian soldiers, disguised as Ukrainians, had suddenly appeared in Kyiv, this would have been reported. 14/...

Four of these five Ukrainian soldiers are visibly armed 🟨. 15/...

The video posted on Twitter by the Russian Foreign Ministry lasts only 21 seconds and does not show the whole situation.

The original report from Al Jazeera lasts 2 minutes and 32 seconds. Important elements are not shown in the Russian version. 👇👇👇 16/...

We see a Ukrainian fireman moving someone in a wheelchair (00:41). We also see other wheelchairs in the background. 17/...

🔊 Al Jazeera reporter Mahmoud Zaibak talks about 'civilians being evacuated from #Irpin'.

He describes that he sees 'ambulances arriving' and that we see 'Ukrainian forces helping with the evacuation'.

This is not mentioned in the Russian source. ❌ 18/...

Irpin is a town close to Kyiv where heavy fighting between Russian and Ukrainian troops was going on for weeks.

Irpin is 8 kilometres from the place where the video was shot. It is therefore plausible that evacuees arrived here. 19/...

On 27 March @washingtonpost published an article about the same evacuation from Irpin. 👇

Above that article is a video. 🤔20/...

washingtonpost.com/world/2022/03/…

@washingtonpost This video was shot at the same location as the Al Jazeera video. 📍

This becomes clear when we compare visual elements: a window 🟥, the tent opening 🟩 and the wall in the background 🟦 match. ✅ 21/...

@washingtonpost In the AJ video we only see the soldiers getting out of the van.

Where they came from, whether they helped with the evacuation and what their exact task was at that moment, is not immediately apparent.

In the WP video we do see that the soldiers actively helping refugees. 22/.

@washingtonpost Notice the man on the left❗️

If we compare him to one of the soldiers in the AJ video, it turns out to be the same soldier.

In the cropping you see him in the WP video and on the right in the AJ video.

His hat, beard, weapon and visual features of his uniform match. ✅ 23/.

@washingtonpost All these elements ☝️ indicate that these soldiers were somehow involved in the evacuation of civilians from #Irpin. 24/...

@washingtonpost Is using a van with a red cross for this a war cirme?

Expert: "The red cross is for the identification of sanitary units. However, it is permitted for sanitary units to be armed or to have an armed escort..."

@washingtonpost "... Beyond that, its use is forbidden and a violation of the Geneva Conventions, but only a war crime if this emblem is misused for the purpose of killing or wounding the enemy'." 26/...

@washingtonpost In this case, it seems to be an evacuation of civilians with the soldiers as an armed escort.

We found no evidence that these soldiers would have wounded or killed any enemies while using the van with the red cross.

So there is no evidence of a war crime here. 27/...

@washingtonpost We contacted the International Committee of the Red Cross in Ukraine:

"The van from which the soldiers come is not an ICRC-van. The ICRC was not involved in the evacuation from Irpin either. This vehicle may belong to the Ukrainian Red Cross or to volunteers." 28/...

@washingtonpost CONCLUSION: The images of Ukrainian soldiers getting out of a van with a red cross are real.

However, they are part of a longer video which contains several indications that it is a humanitarian evacuation from Irpin accompanied by Ukrainian soldiers. (1/2) 29/...

@washingtonpost That context was absent from the Twitter message under investigation.

Without that context, the message is misleading. ❌(2/2) 30/...

@washingtonpost What have we learned? 👩‍🏫

1) #Propaganda hides the truth, #OSINT reveals it. 🧐
2) Google Lens is a powerful tool to understand text on an image. ㊙️
3) More sources = more info = a better understanding of what really happened. 🦾 34/..

@washingtonpost You can read my full article with all sources used here (@Knack) for FREE. 👇

Big thanks 🙏 to @Techjournalisto, @akhmxt and @ArchitMeta for digging together. 👷 32/...

knack.be/nieuws/factche…

@washingtonpost @Knack @Techjournalisto @akhmxt @ArchitMeta Did you learn something from this #OSINT for #FactChecking?

Follow me (@brechtcastel) and check out my channel on #YouTube: youtube.com/channel/UCMBPt… 🙏

Older 🧵🧵underneath this tweet:

https://twitter.com/brechtcastel/status/1390688405416198145

33/END

Thanks everyone for reading and sharing this 🧵: this is very motivating for our small #OSINT-team. 😌

Not only #propaganda, but also #debunking it can spread fast. 🔥

Special 🙏 at @bellingcat for retweeting 34/35

https://twitter.com/bellingcat/status/1515379048276504586

@bellingcat This was the second collaboration with @ArchitMeta, @akhmxt and @Techjournalisto. You can read our first investigation here. 👇

(We will continue using #OSINT to uncover the truth. If you have ideas for us: send one of us a DM, pls.)

https://twitter.com/brechtcastel/status/1510163030205771776