OSINT

Open source intelligence (OSINT) is intelligence produced from publicly available material, such as eyewitness photos and video, social media posts and commercial satellite imagery, in a form that others can check. Telegram channels, news outlets and fact-checkers all practise it. Its findings can confirm, date or contradict an official account, sometimes before one side's officials have said anything, which gives it weight in conflicts where the parties dispute what happened.

Commercial satellite imagery and NASA thermal fire data give an early independent check on strikes on Russian sites, follow damage across repeated strikes, record new Russian drone-launch bases and date pictures shared online. On social platforms, Russia's military intelligence agency recruits saboteurs in Europe through Telegram job ads, while investigators map state-linked influence networks and identify people and parts tied to Russia's Alabuga drone plant.

Verification work centres on recycled and AI-generated footage that attaches itself to real attacks, which fact-checkers expose by combining reverse image searches, comparison with primary footage and AI detectors that catch only part of it. Geolocation ties eyewitness footage of strikes and sabotage to specific sites when officials decline to name them, though it fixes where footage was filmed rather than who is responsible. As of October 2026, imagery showed every large floating-roof tank at a Transneft crude-blending hub near Samara damaged or destroyed, and Google's public watermark detector read marks from only four AI companies.

Satellite Imagery

Open-source analysts use commercial satellite photographs, and fire detections from thermal satellites, to confirm, date or contradict accounts of what happened on the ground. Telegram channels such as Exilenova+ and projects such as Absolutely Reliable Source publish and analyse the imagery. NASA's Fire Information for Resource Management System (FIRMS) gives an early independent check on strikes on Russian sites: when drones hit the Sasta machine tool plant in Sasovo overnight into 8 October 2026, FIRMS placed a blaze at the plant and the Yandex data centre on its site before any Russian official comment.

Successive passes follow damage across repeated strikes, though roof damage seen from orbit does not show whether a factory stopped working. Comparing passes over weeks or years records construction and movement, from new Russian drone-launch bases to depleted S-400 launcher stocks, and imagery also dates pictures shared online, as with Google Maps images of Gaza that had been available since June 2026. As of October 2026, imagery showed every large floating-roof tank at a Transneft crude-blending hub near Samara damaged or destroyed after four strikes in nine days, and a drone-launch site near Millerovo, an empty field on 1 September, with its first section close to completion.

Social Media Intelligence

Social media intelligence works from what platforms expose, and those platforms also carry sabotage recruitment, state propaganda and evidence of military supply chains. Russia's military intelligence agency, the GRU, hires saboteurs in Europe through Telegram: a Vot Tak investigation documented more than 20 million Telegram job ads in the first half of 2026 that recruited saboteurs, who were then given arson, reconnaissance or parts-buying tasks paid in cryptocurrency. Of 172 perpetrators identified in 151 Russian-linked sabotage incidents in Europe between 2022 and 2026, 95% were ordinary citizens, and by October 2026 Estonia, Poland and Denmark had publicly tied such attacks to Russia.

Repost graphs, transparency data and telltale cloned news sites have exposed influence networks aimed at Latvia, Israel's 27 October 2026 election and the Baltic states. The Insider's repost graph of 72 Latvian Telegram channels traced 43.7% of 93,000 reposts to Russian state media, government accounts, military bloggers and pro-war channels. Photos and video have tied people and parts to Russia's Alabuga drone plant, among them a 32-element anti-jamming antenna that The Insider found closely resembles a design by sanctioned Chinese supplier Harxon. Takedowns shape what remains to collect: Telegram blocked more than 43.5 million channels and groups in 2025, though blocked communities typically re-form elsewhere, Check Point Research found.

Content Verification

Content verification tests whether a photo, video or news clip shows what its caption claims, often in the hours after a real attack, when fake footage can spread faster than the genuine record. Old footage attaches itself to fresh events, and generative AI adds deepfake news reports, synthetic images and "enhancement" that invents detail. The Flydubai hijacking attempt of 30 September 2026 drew at least six fake or miscaptioned clips by October 2026, among them a deepfake BBC report blaming an Indian passenger, and a fabricated video of a missile hitting a Saudia airliner in Riyadh drew 3.6 million views on one repost.

Fact-checkers combine reverse image search, geolocation, comparison with primary footage and AI detectors, which catch only part of the problem; detectors returned no conclusive signal on the Riyadh video. Google opened its SynthID Detector to the public in October 2026, reading watermarks from Google, OpenAI, Nvidia and Kakao but missing Meta's standard and open-weight models. On 31 July 2026, about a day after adding it, Google withdrew a Google Earth tool that generated synthetic satellite imagery, after Bellingcat and Alan Turing Institute researchers warned it could corrupt the reference imagery analysts use to debunk fakes.

Geolocation

Geolocation establishes where a photo or video was made by matching it against satellite imagery, maps and webcam archives, and it can identify a site that officials confirm was hit but decline to name. After drones struck Rostov-on-Don on 10 October 2026, the outlet ASTRA geolocated residents' photos and videos to the NZNP oil-loading terminal, which supplies fuel to Russian troops. By 14 October the fire was in its fourth day and had spread to 8 of the terminal's 12 storage tanks, by ASTRA's count.

Outlets used a surveillance still, satellite imagery and a webcam archive to place a reported arson attack on Starlink antennas at the Plana Earth Station south of Sofia; prosecutors had charged no one as of October 2026. The method fixes place, not responsibility: The Insider said there was no evidence for an opposition MP's suggestion of Russian involvement in that fire, and Misbar's placement of a video in Ethiopia's Tigray region does not settle troop movements Eritrea denies. Tools such as GeoSpy aim to automate the matching, and IARPA, the US intelligence research agency, seeks AI that geolocates unlabelled video with 90% of predictions within 250 metres.