Sofia's OSINT Exercise 006

💡 Check out Sofia's amazing blog and this exercise here

Challenge

On January 19, 2023, a journalist with almost 140k followers on Twitter shared an image of a destroyed vehicle amidst a large cloud of smoke and fire. The tweet said: “BREAKING: TTP carried out a suicide attack on a police post in Khyber city of Pakistan that killed three Pakistani police officers.“

The photo is not of the event described by the journalist.
a) Verify the statement above.

First Look

It’s getting more tangible. Mis- and disinformation are a ubiquitous real-world problem with far reaching consequences. Looks like Sofia has started to incorporate lessons on how to use OSINT for good in her exercises. Way to go! 🫡

Getting Working Material

We start by searching for the Tweet text ("BREAKING: TTP carried out a suicide attack on a police post in Khyber city of Pakistan that killed three Pakistani police officers") in quotes, which takes us to the original Tweet. Through it, we can access the original image for better reverse image search results.

To Trust or to Verify

Reverse searching via Google Lens quickly brings us to a Wikipedia page of the photo where we learn that this image was supposedly taken after a Vehicle Born Improvised Explosive Devise (VBIED) exploded outside of a newspaper office in Baghdad, Iraq. According to the article the photo was taken on August 27, 2006. While Wikipedia is generally a good source, it’s also often heavily disputed and edits are fought over. Especially when it comes to politically influential material, it’s always better to find the primary source if we can.

Original Source

Unfortunately, the exact source listed by Wikipedia isn’t around anymore. It looks like the Navy’s website where this image was allegedly taken from has changed. They still host a photo gallery, but even when we search for the image there based on the date or the keywords “vbied” and the photographer’s name “Medellin”, we can’t find it.

Archived Pages

Also no luck using common web archives, such as the WayBackMachine, archive.md, or cached pages from Bing and Yandex.

While proof-reading this post I checked the archives again and it turns out I made a small mistake here. The primary source is totally available on the WayBackMachine! My mistake was using the wrong URL. The original link http://www.navy.mil/view_image.asp?id=38460 gets rewritten to https://www.navy.mil/view_image?id=38460 by the Navy website after the 404 error and I didn’t pay close enough attention (mind the missing .asp? in the second URL). The actual page was captured on May 4, 2016 by the WayBackMachine and confirms that Wikipedia correctly cites the source and context of this image.

So there we have it. We debunked the claim by the journalist and showed that this photo was actually taken on August 27, 2006 in Baghdad, Iraq. I’ll leave the rest of this blog post up, because it shows an alternative way of verifying this (or getting as close as possible to certainty), in case no archives of the primary source were available.

No Archive, No Problem

Suppose we hadn’t found an archived version of the primary source. We’d need to find an alternative way to verify this, so we ditch our efforts to find the original source listed on Wikipedia. By googling keywords from the description (VBIED iraq "al sabah"), we find a second Wikipedia image that supposedly shows the same event, but from a different angle.

The metadata shown on the Wikipedia pages suggest that the second photo was taken at 13:34h, eight minutes after the first photo. The author, description, and camera details also match. We can confirm that this data is in fact correct by extracting the images’ metadata ourselves. I like to use the command line utility exiftool for this, but there are many online alternatives such as https://exif.tools/.

The metadata Wikipedia shows us is correct. The data could of course be forged, but by adding more and more pieces of evidence to the puzzle, we’re slowly chipping away at the likelihood of this possibility.

Connecting The Pieces

The final piece of evidence that ties this investigation together is a second Google result for the query VBIED iraq "al sabah". The second photo we found on Wikipedia, also appears on the official website of the U.S. Department of Defense. The description confirms what we have already learned from Wikipedia and convinces me that we found the correct information, even without access to the primary source.

Answers

The image shared in the journalist’s Tweet does not depict events in Khyber, Pakistan. Instead, it was taken on August 27, 2006, by Eli J. Medellin following an explosion of a VBIED in Baghdad, Iraq.

Final Remarks

It might be alluring to simply trust content from Wikipedia. Taking into account active efforts of disinformation campaigns, and how fast mis- and disinformation generally spread, it is crucial to verify information, especially when it is politically charged or influential in another way. Finding primary sources of information is not only good practice, it also helps avoid the wildfire-effect of news outlets quoting each other without verifying the actual claims, prioritizing delivery speed over information correctness.

We showed two ways of verifying information when the primary source is no longer around:

1. Web archives are a good way to retrieve information from websites that have gone dark, or to view how content appeared in the past. Limited by data availability, these archives aren’t perfect.
2. In this case, enriching the research question with as much contextual information as possible can help solve the case, or at least make an informed assessment based on detailed evidence.

Tools used

• WayBackMachine
• archive.md
• exiftool