Quick answer: The war in Ukraine, since February 2022, has become the most extensively documented conflict in history through open-source intelligence. Independent research groups such as Bellingcat and Oryx have used smartphone footage, satellite imagery, and geolocation techniques to verify equipment losses, map civilian harm, and build evidence archives that courts and journalists now rely on, largely because most of the country has the smartphone and internet access that makes this kind of citizen documentation possible in the first place.
This post looks at how that documentation actually works, what it has produced, and the real limitations of relying on open, public data to understand an active war.
Why this war became an OSINT case study
Open-source intelligence, OSINT, means building an intelligence picture entirely from information anyone could access: public social media posts, satellite imagery, flight-tracking data, and commercial surveillance footage. Earlier conflicts produced fragments of this kind of material. Ukraine produced it continuously, in part because of how saturated the country already was with smartphones, mobile internet, and GPS-enabled cameras, and in part because both soldiers and civilians kept filming and posting from the first hours of the invasion onward. That combination gave independent researchers, sitting anywhere in the world, a volume and immediacy of raw footage no prior conflict had offered at this scale.
Oryx: counting equipment losses with photographic proof
One of the most cited OSINT projects to come out of this war is Oryx, a volunteer-run database that has visually confirmed equipment losses on both sides since the invasion began. Oryx’s core rule is strict: a loss only gets added to the list if there’s a photograph or video actually showing it, cross-referenced against location and prior entries to avoid counting the same vehicle twice. By late 2025, Oryx’s tally had passed roughly 23,000 visually confirmed Russian equipment losses, with Russian tank losses alone surpassing 4,000 by mid-2025, and Ukrainian losses recorded in the thousands as well. Oryx is explicit that these are minimum confirmed figures, not full battlefield totals, since plenty of destroyed equipment is never filmed or photographed at all. Despite that built-in undercount, Oryx’s numbers are widely cited by journalists and military analysts specifically because every entry is independently checkable, unlike official claims from either side of the conflict.
Bellingcat: mapping civilian harm and archiving evidence before it disappears
Bellingcat, the investigative group founded by Eliot Higgins after his earlier work geolocating weapons used in Syria, built a continuously updated database tracking incidents of potential civilian harm in Ukraine, including strikes on schools, cultural sites, and healthcare facilities. The database has documented over a thousand individually mapped incidents, placing each one precisely in time and location using geolocation, a technique that confirms where and when footage was actually filmed by matching visible landmarks, shadows, and terrain against maps and satellite imagery. Bellingcat has applied the same method to some of the war’s most scrutinized events, including the mass graves uncovered in Bucha and Izium and the strike on the Mariupol theater, helping establish verified timelines that have since been cited in international reporting and war crimes investigations.
A detail that shapes how this work gets done: Bellingcat treats archiving as urgent, not optional. Researchers learned from a decade of prior investigations that footage posted online can be deleted, taken down, or lost within days, so collection and preservation now happen as fast as verification itself, specifically so evidence doesn’t vanish before it can be checked.
How the verification actually works
The methodology behind both projects, and the wider OSINT community working alongside them, follows a consistent process:
- Collection. Monitoring social media, Telegram channels, and video platforms for footage as it’s posted, often within minutes of an event.
- Geolocation. Matching visible details in the footage, buildings, signage, terrain, vegetation, against satellite imagery and street-level references to confirm exactly where it was filmed.
- Chronolocation. Using shadow angles and known lighting conditions to confirm or challenge when a piece of footage was actually taken, which matters enormously when old footage gets recirculated as if it were new.
- Cross-referencing. Checking a single claim against multiple independent sources before treating it as confirmed, rather than relying on one video or one account.
- Archiving. Preserving the original footage, metadata, and source links immediately, since the content itself is often the only evidence that will ever exist of a given event.
This is the same disciplined, source-by-source approach covered in our earlier posts on GEOINT for beginners and link analysis, applied here under much higher stakes and a far faster pace than a typical investigation.
What this kind of documentation has actually achieved
Beyond the public record, this work has had concrete downstream impact. Verified OSINT findings have been submitted to international courts and war crimes investigations as supporting evidence, precisely because the methodology produces a traceable chain: a named researcher, a documented process, and original source material anyone can independently check. That traceability is also what separates this kind of work from propaganda or unverified claims circulating on the same platforms, and it’s a large part of why the volume of this evidence has mattered as much as any single finding.
The honest limitations
OSINT documentation of this war is extensive, but it is not complete, and the researchers doing this work are generally the first to say so:
- Systematic undercounting. Projects like Oryx only record what’s actually filmed and shared. Losses that happen with no camera present, which is most of them in some phases of the war, simply never enter the public record, so every published figure is a floor, not a ceiling.
- Speed versus rigor is a real tension. Bellingcat’s own investigators have noted that a single, fully verified report can take a year of work, while events in Ukraine often need same-day assessment. Faster output generally means accepting a lower initial confidence level, clearly labeled as such, rather than waiting for certainty that may never fully arrive.
- Platform dependence creates fragility. Early in the war, several OSINT-focused social media accounts sharing verified footage were suspended by platforms applying blanket content moderation rules, interrupting access to source material regardless of its evidentiary value.
- It documents what’s visible, not intent or context. Confirmed footage of a destroyed building or a damaged vehicle establishes that something happened; it doesn’t, by itself, establish why, or settle broader disputes about responsibility, which require the kind of fuller investigation a geolocation alone can’t provide.
Why this matters beyond this one conflict
The methodology developed and stress-tested during this war, rapid geolocation, cross-platform verification, continuous public archiving, has become a template now applied to other conflicts and disputed events worldwide. It’s also a preview of a broader shift we’ve covered elsewhere in this series: OSINT moving from occasional, query-driven research toward continuous, near-real-time monitoring, and increasingly needing a human analyst’s judgment to separate a verified finding from a plausible-looking fake, especially as synthetic media gets harder to detect by eye.
Frequently asked questions
What is OSINT, in the context of a war? Open-source intelligence in a conflict means building a verified picture of events using only publicly available material: social media footage, satellite imagery, and public records, rather than classified sources.
Who are the main OSINT groups tracking the Ukraine war? Bellingcat and Oryx are the most widely cited, alongside groups such as the Conflict Intelligence Team, GeoConfirmed, and independent geolocation researchers who collectively cross-check each other’s findings.
How accurate are OSINT equipment loss counts? They are minimum confirmed figures, not full totals. Projects like Oryx only count losses with photographic or video proof, so actual losses are generally higher than the published, verified number.
Can OSINT evidence be used in court? Yes. Verified OSINT findings, including Bellingcat’s geolocated incident database, have been submitted as supporting evidence in international war crimes investigations, in large part because the verification process produces a traceable, independently checkable chain of evidence.
What is geolocation in OSINT? Geolocation is the technique of confirming exactly where a piece of footage was filmed by matching visible details, buildings, terrain, signage, against maps and satellite imagery, often combined with shadow analysis to confirm the time as well.