Europol has announced a new unit whose job it will be to find and analyze publicly available information indicating Russian war crimes committed in Ukraine.
The Operational Taskforce (OTF) will scour the internet to “identify suspects and their involvement in war crimes, crimes against humanity or genocide crimes” through open source intelligence (OSINT), the policing group said.
OSINT is an increasingly important part of intelligence gathering in military and cybersecurity spheres.
Although OSINT has been around as a concept for years, the proliferation of content circulated online today has made it a far easier to gather compelling intelligence. Ahead of the Russian invasion of Ukraine on February 24 2022, for example, non-military observers used commercial satellite imagery to warn of a build-up of troops on the border.
“Russia stated that its forces were redeploying away from the borders,” explained general Hockenhull, who leads the British army’s Strategic Command. “Quickly this was exposed by the open source community which was able to show that not only were troops still in place, but in fact what was happening was a redeployment of force in order to be able to better execute the invasion plan.”
Read more on OSINT: Ukraine: Russian Cyber-Attacks Should Be Considered War Crimes
In cybersecurity, OSINT is used by both network defenders and their adversaries. A classic threat actor technique is to use publicly available social media profile details to target and craft spear-phishing emails.
The Europol OTF will be led by the international crimes units of the Dutch Police and German Federal Criminal Police Office, supported by Europol’s Analysis Project Core International Crimes (AP CIC).
Fourteen countries have agreed to assign a dedicated OSINT capacity to the taskforce, including the UK.
The new OTF will not go unnoticed in Moscow. Russian threat actors are suspected of breaching the International Criminal Court (ICC) in November after the tribunal issued a global arrest warrant for Vladimir Putin back in March.
A Russian spy masquerading as a Brazilian intern was also blocked from working for the ICC after Dutch intelligence intervened last year.