On July 17, 2014, hours after MH17 was shot down over Ukraine, open-source investigators reconstructed the full route of the BUK launcher using Instagram posts and Google Earth satellite imagery. The target had no idea the record existed.
Satellite imagery, infrastructure data in OpenStreetMap, and EXIF metadata from photographs each pinpoint locations independently. Combined, they form a permanent geospatial record that persists even after targets move or scrub their tracks, queryable with no active contact with the target and without alerting them.
Geospatial Records Are Archaeology — They Predate the Investigation
The Copernicus Sentinel-2 archive covers the entire globe at 10-meter resolution and has been freely available since 2015. The Landsat archive goes back to 1972. Every building, vehicle in transit, and ground alteration captured in these archives exists in the record before any investigation begins.
OpenStreetMap maintains an append-only history of every edit made to the platform. A node created 12 years ago is still retrievable through the OSM history API with a precise timestamp. When an investigator queries that layer, they are not accessing the current state of the map. They are accessing an immutable log of geolocated contributions, each with a date and author.
EXIF metadata follows the same logic. The device records GPS coordinates, timestamp, camera model, and orientation at the moment the shutter fires, not at the moment of upload. A photo taken at a sensitive location in 2019 and shared today as a direct file still carries the 2019 coordinates, regardless of how many years have passed.
The practical consequence: the geospatial record of any target with a physical presence predates the investigation. No cleanup effort executed after discovery can alter what the satellite already captured, what OSM volunteers already mapped, or what EXIF already recorded at the moment of the shutter press.
MH17: 3 Independent Evidence Chains Converging on the Same Point
Bellingcat published the BUK launcher's geolocation before any official investigation. The methodology used 3 data layers that cross-validated independently, with none depending on the others to establish validity.
The first layer came from Instagram photos posted along the convoy's route through eastern Ukraine. Investigators matched visual elements against Google Earth: a specific road fork, 3 trees north of a bend, a house with a red roof, and 2 junctions in sequence. Matching those landmarks against Google Earth Street View and Wikimapia fixed the launcher's position south of Snizhne. Volunteers confirmed the same location independently via Twitter, with no coordination with the main team.
The second layer was temporal. DigitalGlobe imagery from July 16, 2014 showed a field southeast of Snizhne with no visible disturbance. Imagery from July 17, 2014 showed a scorched field at the same geographic point. That difference between 2 consecutive captures corroborated the launch site with no human source involved. The temporal analysis detected the event without any investigator knowing in advance where to look.
The third layer was the road network. Investigators overlaid the convoy's path in the photos against the Google Earth road layout and identified the same junctions in sequence. 3 evidence chains that had no contact with each other converged on the same geographic point south of Snizhne. Each chain was sufficient to place the launcher in the area; all 3 together established the site with precision before any intelligence agency published an official conclusion.
This case is the canonical template for geospatial OSINT because it documents every methodological step with replicable precision. Any investigator can repeat the process. The evidence is auditable because every file used is public and permanent.
EXIF: The Metadata That Records Coordinates Without Warning
In 2016, Harvard researchers archived 223,471 images from dark web drug markets. Of 223,471 images collected — 229 sellers had not removed GPS coordinates from the EXIF of their own product photos, sellers had not removed GPS coordinates from the EXIF. The sellers operated via Tor on AlphaBay and Hansa, used cryptocurrency, and exposed no identities. They forgot that the image file contained metadata recorded before any anonymization began.
The Higinio Ochoa case, who operated as CabinCr3w, is more direct. Ochoa posted a taunting photo on a privacy forum. The JPG's EXIF contained GPS coordinates pointing to an address in Wantirna South, Australia. The FBI cross-referenced the coordinates with Facebook account data and arrested Ochoa in Galveston, Texas.
The technical mechanism explains why this mistake is systematic. EXIF is recorded by the device at shutter press, not by the upload application. Instagram and Twitter strip EXIF automatically on reupload; Telegram in file mode, Dropbox, and direct image server URLs often do not. The difference between a compressed message and an original file can be the difference between anonymity and arrest.
ExifTool extracts coordinates with a single command: exiftool -GPSLatitude -GPSLongitude image.jpg. intel.mago.team automates this extraction during investigations, revealing GPS coordinates in any file submitted for analysis.
Overpass Turbo: Querying Infrastructure in OpenStreetMap
OpenStreetMap is not a map. It is a geospatial database with a tag taxonomy for physical infrastructure contributed by volunteers: power=substation, man_made=data_center, telecom=exchange, building=data_center. Every node with those tags is queryable through the Overpass API without authentication, without an account, without cost.
An Overpass QL query to enumerate data centers in São Paulo:
[out:json];
area["name"="São Paulo"]->.a;
nwr["building"="data_center"](area.a);
out geom;
The result returns in under 2 seconds as GeoJSON, importable directly into the Copernicus Browser for overlay with satellite imagery. The investigator compares what the OSM tag describes against the current image and temporal history to verify when the facility was built.
The same approach works for electrical substations (power=substation), telecommunications towers (man_made=mast), and ISP exchanges (telecom=exchange). Each tag includes volunteer-contributed attributes: operator, voltage, capacity, and connectivity. Predicta Lab documented the use of Overpass to locate surveillance cameras and emergency service infrastructure across entire regions. Many organizations have no idea their physical facilities were mapped by volunteers before any investigation began.
The Convergence of 3 Layers Closes the Loop
The convergence workflow runs in sequence. An Overpass query identifies facilities of a given infrastructure type within a bounding box around the target's known address. The Copernicus Browser compares captures from different dates to verify when the structure appeared in the satellite record. Public photos associated with the facility provide files whose EXIF cross-references the location against independent GPS coordinates.
Each layer is self-sufficient. If OSM is out of date for that region, the satellite confirms the facility independently. If the satellite has cloud cover on the relevant date, the EXIF from a public photo of the site resolves without depending on the other 2 layers. The method's robustness comes precisely from no layer depending on the others.
All 3 layers are timestamped and independently auditable. The Copernicus Browser provides acquisition timestamps for each image. EXIF embeds date, time, and timezone in the file. The OSM history API records when each tag was added and by which user. An investigator can build a timeline of geospatial evidence where every point has its own chain of custody, queryable years after the event.
The satellite archive predated the investigation. The OSM data was contributed before anyone knew that information needed protecting. The EXIF coordinates were recorded at the shutter press. Geospatial OSINT is archaeology: the record exists, regardless of who knows they are being investigated.
Top comments (0)