Chapter 8 — Open Source, Lawfully

On 17 July 2014, Malaysia Airlines Flight 17 was shot down over eastern Ukraine. A group of researchers with no security clearance, no subpoena power and no access to intelligence established the route of the missile launcher that did it — by watching soldiers post photographs of their own convoy.

The method was geolocation: matching landmarks visible in user-posted video and photographs to satellite and street-level imagery. A "Magnit" supermarket sign in one frame. A particular intersection in another. The convoy traced from Russia into rebel-held Ukraine, frame by frame, cross-checked against the soldiers' own social media showing the same vehicles along the same route. [ESTABLISHED] (Bellingcat, geolocating the MH17 Buk convoy)

In 2018, after the Skripal poisoning in Salisbury, the same outfit examined the passport records of the two men Russia presented as tourists. The passports carried numbers differing by three consecutive digits — implausible for unrelated ordinary citizens — and an issuing-unit code, 770001, reserved for state VIPs and intelligence officers. The two were identified as GRU Colonel Anatoliy Chepiga and Dr Alexander Mishkin. [ESTABLISHED] (Bellingcat)

In 2020, the FSB team that had followed Alexei Navalny was reconstructed from purchased call-detail records, flight manifests and vehicle registrations cross-referenced against one another: operatives who flew a day early or late along Navalny's exact route, cell-tower pings placing one of them near his hotel at the time of the poisoning. [ESTABLISHED] (Bellingcat methodology)

These are, by some distance, the most impressive investigations conducted by private individuals in the modern era. And the third one is not a method you may use.

The line, drawn where it actually is

Bellingcat's own methodology write-up is admirably direct about this. The passport, phone and vehicle records came from Russia's black and grey data markets — Telegram bots selling personal records for around ten euros, delivered in minutes, for a total spend they describe as a few hundred euros of cryptocurrency. They state plainly that this trade is illegal under Russian law, that data brokers are caught and prosecuted, and that what they exploited was Russian state negligence and internal corruption — not a technique available to investigators generally. [ESTABLISHED] (Bellingcat; BBC Russian on the data black market)

This was investigative journalism knowingly using unlawfully obtained data because the state whose crime was being exposed could not credibly prosecute the leak. It was a defensible choice in that specific configuration. It is not a template.

The same act, performed against a private citizen in a jurisdiction with functioning data protection law — the European Union, or Thailand — is itself a crime. If you take one thing from this chapter, take the separation: the geolocation work is replicable and lawful; the database work is neither. Almost everyone who cites Bellingcat as inspiration has failed to notice that these are two different kinds of activity.

The standard that exists

There is a formal standard for doing this properly, and most people who do open-source investigation have never opened it.

The Berkeley Protocol on Digital Open Source Investigations was published jointly by the UN Human Rights Office and the Human Rights Center at UC Berkeley School of Law on 3 January 2022. Its full subtitle names its purpose: the effective use of digital open source information in investigating violations of international criminal, human rights and humanitarian law.

What it covers: methodologies for gathering, analysing and preserving digital open-source information in a professional, legal and ethical manner; guidance built for admissibility before international tribunals rather than for publication; templates and a glossary. And a chapter that no comparable document has: measures investigators should take to protect their own digital, physical and psychosocial safety and that of witnesses, victims and first responders, given routine exposure to traumatic material. It is available in all six UN languages. [ESTABLISHED] (OHCHR; full PDF)

I did not extract verbatim clauses on hashing or retention from the document body and will not paraphrase them as though I had. If you need quotable text, open the PDF. [ABSENT] on the specifics.

The wellbeing chapter deserves a sentence of its own. Anyone who works through hundreds of fraud complaints is reading, in sequence, the worst financial day of several hundred people's lives, many of them elderly, many describing shame. The protocol treats the analyst's exposure as a methodological issue rather than a personal weakness, and that framing is correct.

The techniques that carry weight

Geolocation is the workhorse. Match what is visible — signage, architecture, road markings, vegetation, terrain profile, the relationship between fixed objects — against satellite and street-level imagery. It is slow and it is verifiable by anyone who repeats it, which is the property that makes it evidence rather than assertion.

Chronolocation and shadow analysis. Sun angle and shadow length can establish when an image was taken, or narrow candidate locations given a known date and time. Failure mode, stated in the same breath: it requires the object's true height to be known or estimable, diffuse light defeats it, and it yields a band of possible times or locations rather than a point. [ESTABLISHED] (Bellingcat)

Reverse image search, with its instruments honestly graded. Google Lens has the largest index and the best object recognition, and deliberately does not perform facial matching — a design choice, not a limitation. TinEye finds only exact or near-exact copies, which makes it good for dating a first appearance and weak for everything else. Yandex has the strongest face matching, with reported accuracy in the 65–75% range against Google's 30–40%, and is strongest on Russian, Eastern European and Asian source material. And the qualification that matters: none is reliable enough for definitive identification. [CONTESTED] — the accuracy figures come from comparative reporting rather than controlled evaluation. (comparison, 2026)

Satellite imagery, free and adequate for more than people expect. Copernicus and Sentinel Hub give free access to Sentinel-1 and Sentinel-2 optical and radar imagery with historical archive; USGS Landsat is the standard for change over years and decades; NASA Earthdata is broad and free. Google Earth Pro remains central to practitioners specifically because of its historical-imagery time slider, which lets you find when a visible change occurred. Resolution caveat: Sentinel-2's roughly 10-metre pixels will show you vehicle concentrations, new construction and runway activity, and will never show you a person. That requires commercial sub-metre imagery, which is not free. [ESTABLISHED] (GIJN)

The technique that does not work

Metadata.

The instinct of every newcomer is to check a photograph's EXIF data for GPS coordinates. For anything downloaded from a mainstream platform, this is close to useless. Instagram strips GPS, camera make and model, and timestamps from feed posts, stories and reels. Facebook strips location and camera data from what other viewers see — while retaining the full original internally for its own purposes. X strips most metadata aggressively.

The exception, and it is the kind of exception worth knowing: stripping is not consistent across sharing modes. GPS has been found surviving in Instagram direct messages when original-quality sharing is used, and direct-message and file-sharing features across several major platforms have been found to leak location in some configurations. [ESTABLISHED] (platform metadata comparison, 2026)

This is precisely why Bellingcat's toolkit is built on visual geolocation rather than metadata extraction. The metadata is gone. The supermarket sign is still in the frame.

The law, and the question nobody has answered for you

In the European Union, and this surprises people: using genuinely public information is lawful in principle, but GDPR governs the processing of personal data even when the source data is public. Processing requires a lawful basis, commonly legitimate interest, and a documented assessment of it.

The threshold at which obligations begin is described as low, and the trigger is specific: it is not a single transient lookup, but the point at which you begin building a pattern of life on an individual, monitoring them generally, or extracting and retaining information as a record. [ESTABLISHED] (ScienceDirect, comparative analysis of OSINT legal aspects; Proelium Law)

Read that trigger again, because it is exactly what an investigator does. The moment you open a file on a person and start filling it, you are processing personal data as a record. Practitioner sources name the adjacent criminal exposures plainly: unauthorised access to information systems, identity fraud or impersonation, stalking and harassment, and knowingly handling unlawfully obtained data.

In Thailand, the Personal Data Protection Act took effect 1 June 2022 and applies extraterritorially to anyone processing the personal data of people in Thailand. It is enforced by the Personal Data Protection Committee. Penalties include up to one year's imprisonment, and liability can attach personally to a responsible individual rather than only to a company. [ESTABLISHED] (Securiti guide; IAPP)

And now the gap, which I am flagging rather than filling because filling it would require inventing law: I found no source addressing how the PDPA applies to an individual, non-commercial investigator as distinct from a corporate data controller. [ABSENT]

That is not a small hole. It is the exact question anyone in Thailand doing independent investigative work needs answered, and the honest position is that it requires an opinion from a Thai-qualified lawyer, not a paragraph in a book. If you intend to do this work seriously, that opinion is a prerequisite, not an afterthought — and obtaining one before you need it is itself evidence of good faith if you are ever asked.

The posture that follows

There is a version of open-source investigation that is lawful, verifiable and genuinely powerful, and it has three properties.

It works on what is visible in the material rather than what can be bought about the person. It preserves and documents as it goes, so a stranger can repeat the work. And it can state, for every fact in the file, the lawful basis on which it was obtained.

The MH17 investigation has all three. The Navalny investigation has the first two and not the third, and its authors said so themselves. Take the first. Do not take the third and hope nobody asks.

The Move — Write the lawful basis in the file, at the moment of collection. Every time you record a piece of information about a person, write one line beside it: where it came from, whether it was publicly accessible without circumventing any control, and why you are entitled to retain it. Do it at collection, not later, because reconstructing it afterwards is both harder and less credible. This single habit is the difference between an investigation and a dossier, and it is the difference a regulator, a court, or a defence lawyer will look for first.

What would change my mind: a published Thai regulatory decision or legal opinion establishing how the PDPA treats individual investigative processing would replace the largest open question in this chapter with an answer. Until that exists, everything here about Thai law is a statement of the statute's shape, not of how it will be applied to you.