Case Study 20.2: Geolocating a War Photo — A Step-by-Step Verification Walkthrough

Overview

On a Tuesday morning in early 2022, shortly after Russian military forces crossed into Ukrainian territory, a photograph began circulating on social media. It showed devastation: a residential building with its facade destroyed, a collapsed roof, debris scattered across what appeared to be a residential street. The image was shared thousands of times within hours, with captions attributing the destruction to Russian airstrikes in a specific Ukrainian city.

This case study walks through the verification process that professional fact-checkers and open-source intelligence analysts would apply to such an image. While this is a generalized walkthrough constructed from documented practices used during the 2022 Russia-Ukraine conflict (drawing on published verification guides from Bellingcat, First Draft, and similar organizations), the techniques are directly applicable to any conflict or newsworthy photograph that makes geographic and temporal claims.

The walkthrough illustrates each element of the SIFT method as applied to visual content, culminating in a geolocation verification that either confirms or contradicts the image's claimed location.

Why Conflict Imagery Requires Verification

Conflict zones generate enormous volumes of imagery, and this imagery moves through social media and news organizations at a speed that outpaces traditional editorial fact-checking. Photographs and videos claiming to depict recent events have enormous emotional and political impact — they shape public understanding of what is happening, whom to blame, and what response is warranted.

This impact makes conflict imagery a target for deliberate manipulation. During the 2022 conflict in Ukraine, documented cases included:

• Photographs from previous conflicts (Syria, Gaza, Donbas, 2014) recirculated with new captions
• Images taken in Ukraine but misattributed to different cities or regions
• Images from unrelated contexts (explosions, industrial accidents, demolitions) attributed to combat
• Genuine images from the conflict misdated to support specific narratives

Professional fact-checkers and open-source intelligence (OSINT) organizations including Bellingcat, BBC Verify, AFP Fact Check, and others developed systematic verification protocols to address these categories. The protocol described in this case study draws on these documented practices.

Step 1: Stop — Recognize the Emotional Trigger

When this image arrived in a fact-checker's workflow, the first step was to pause and identify the emotional triggers. The image is striking: visible destruction of a residential building implies civilian harm. The caption attributes the destruction to a specific actor (Russian forces) and a specific location, which makes it politically relevant to ongoing debate about international response.

This emotional weight is precisely why verification is urgent: images with high emotional impact drive rapid sharing behavior and potentially rapid political response. The faster an image spreads, the more difficult correction becomes if the image turns out to be decontextualized or fabricated.

The stop move is not skepticism about the reality of conflict or sympathy with any particular side. It is recognition that the combination of emotional impact and political relevance makes this image particularly likely to spread without verification — and particularly important to verify before acting on or sharing it.

Step 2: Investigate the Source

Who shared this image first?

The first question in source investigation is: where did this image originate? For social media images, this means tracing backward through the sharing chain.

Using Twitter/X search with date filters (from: and since: operators), the fact-checker searched for the image description to find the earliest sharing instances. Multiple accounts appeared to have shared the image within a short time window — typically suggesting either a coordinated release or very rapid organic spread from a single original post.

Who is the original poster?

The original apparent poster was an account with a Ukrainian language profile that had been created very recently. This combination — recent account creation, posting conflict imagery in the first days of the conflict — is a yellow flag but not definitive. New accounts are created legitimately during conflicts as people begin using social media to document what they witness. The account could be a genuine witness, a journalist, a propaganda operation, or a recycled image poster.

Lateral reading on the source:

A search for the account name and any associated website or handle produced minimal results — the account was too new to have significant external references. This is inconclusive: most legitimate conflict witnesses would not have established social media presences that would surface in lateral reading.

Lateral reading on the image itself (before performing reverse image search — see Step 4) involved searching for the claimed city name and "explosion" or "building" in news coverage from major international news organizations. AFP, Reuters, BBC, and AP all had conflict correspondents in Ukraine; their coverage would surface genuine events. This search yielded some results, but the specific location claimed in the image caption was not prominently featured in early professional news coverage — another yellow flag requiring follow-up.

Step 3: Find Better Coverage

Who else is covering this specific event or location?

The image's caption claimed a specific residential neighborhood in a specific city. Fact-checkers searched for news coverage of that neighborhood in that city in the days around the image's claimed date.

Professional news organizations with correspondents in the country (Reuters, AP, AFP, BBC, NYT, The Guardian) were covering the conflict heavily. However, the specific neighborhood and visual details in the image were not immediately verifiable through news coverage.

This absence is ambiguous: professional correspondents cannot cover every incident during the early chaotic days of a conflict. An absence from professional coverage does not prove an image is false. But the combination of recent-account origin + no professional news coverage of the specific incident created sufficient uncertainty to warrant full visual verification.

Fact-check database search:

A search for the image in Bellingcat's published verification database, CORRECTIV's database, and other real-time conflict verification resources found that the specific image had not yet been assessed. This meant the verification team needed to proceed to full visual analysis.

Step 4: Trace Claims — Reverse Image Search

Tool 1: TinEye

The image was uploaded to TinEye with the "Oldest" sort selected. Results showed the image had not been indexed before the date of its current circulation — this suggests the image was either new or had not previously appeared in web-accessible contexts. This finding is consistent with a genuine photograph but does not confirm it.

Important: A lack of prior TinEye results does not prove an image is genuine. TinEye's index is large but not comprehensive; an image could have circulated in WhatsApp or Telegram (which are not indexed) without appearing in TinEye results.

Tool 2: Google Images

The Google Images reverse search returned no significant prior results for the exact image. However, it did return visually similar images of building damage from other contexts. Comparing these visually similar images to the image under investigation:

• The architectural style of the damaged building appeared consistent with Soviet-era residential construction common throughout Eastern Europe — not conclusive but consistent with the claimed location.
• The type and scale of damage appeared consistent with munitions damage rather than structural failure — though this assessment requires expertise the verification team explicitly noted they were not qualified to make definitively.

Tool 3: Yandex Images

Yandex's reverse image search, which has stronger indexing of Russian-language and Eastern European content, also returned no prior instances of the exact image. It did return additional visually similar images that, again, showed consistent architectural features but no clear prior occurrence of this specific image.

Preliminary conclusion from reverse image search: No evidence that the image had previously circulated in a different context. This is consistent with the image being genuine and recent — but reverse image search absence is not definitive proof.

Step 5: Visual Analysis of the Image

Before proceeding to geolocation, the verification team performed careful visual analysis of the image content for contextual clues:

Architectural features:

The building showed features consistent with a specific era of Soviet housing construction: the facade material (a characteristic precast concrete panel type), window size and spacing, and floor height. Architectural historians working with conflict verification organizations have produced guides to identifying specific Soviet construction programs by visual features, which can narrow down regional origins.

Visible text:

The image contained partially visible text on what appeared to be a signboard or business name partially obscured by debris. A partial reading of Cyrillic characters was possible but incomplete. This partial text became a key element in the geolocation attempt.

Vehicle:

A partially visible vehicle in the street corner of the image showed license plate-like features (though the plate itself was not readable). The general vehicle type was consistent with civilian vehicles common in Eastern Europe.

Environmental features:

Snow coverage on the ground was consistent with winter conditions in the claimed region. Tree species visible at the image edge appeared consistent with Eastern European deciduous species.

Signage:

A small street sign was partially visible in the background. Its format — blue background, white text, a specific format of house numbering — was consistent with Ukrainian street signage formats.

Step 6: Geolocation Using Geographic Resources

With the contextual clues identified, the geolocation team began systematic geographic identification:

Step 6a: Narrow to the claimed city.

The image's caption claimed a specific city. The geolocation team began by examining that city's residential neighborhoods using Google Earth satellite imagery and Google Street View (where available for Ukrainian cities — coverage is uneven).

Step 6b: Search for matching architectural blocks.

Using the architectural analysis, the team searched for residential blocks in the claimed city that matched the construction type visible in the image. Google Earth's satellite view of the city showed several candidate neighborhoods.

Step 6c: Match specific building features.

Within candidate neighborhoods, the team used Google Street View (taken before the conflict) to look for buildings with the specific facade features visible in the image: window arrangement, building height, distance to adjacent buildings, a distinctive corner feature visible at the image edge.

Step 6d: Identify the signboard text.

Cross-referencing the partial Cyrillic text visible in the image against Google Street View and Google Maps of candidate areas, the team identified a business whose signage matched the partial text visible in the image. This significantly narrowed the location.

Step 6e: Verify using sun position.

Using SunCalc (suncalc.org), the team calculated the sun's position at the claimed location at the approximate time of the image's circulation. The shadow angle visible in the image — from debris and standing walls — was consistent with the sun's position for morning light in that location in late winter. This was corroborating but not definitive (the sun's position varies relatively little across nearby Eastern European locations).

Step 6f: Match with satellite imagery.

Following the business sign identification, the team was able to identify a specific address. Comparing the image to pre-conflict satellite imagery of that address showed the building layout — its relation to adjacent structures, the street layout, the presence of distinctive features — was consistent with the image's perspective.

Geolocation confirmed: The team concluded with high confidence that the image did depict the claimed city, and with moderate-to-high confidence that the specific street was correctly identified.

Step 7: Dating the Image

Confirming that the image shows the claimed location does not confirm that it was taken on the claimed date. The geolocation team also attempted to establish the date range of the image:

Vegetation state: The leaf state on deciduous trees (or their absence) was consistent with winter/early spring, consistent with the claimed date.

Snow condition: Snow coverage and condition appeared consistent with recent snowfall rather than accumulated winter pack, consistent with the specific weather conditions that meteorological archives showed for the claimed location in the claimed timeframe.

Satellite comparison: Comparing the image to commercial satellite imagery of the location (Sentinel Hub and Maxar satellite imagery were publicly available for many Ukrainian locations during the conflict), the team verified that the building damage visible in the image was not present in satellite imagery from before the conflict's start date.

Conclusion on dating: The image could not have been taken before the conflict began (the pre-conflict satellite imagery shows the building intact). The weather conditions were consistent with the claimed date. These findings are consistent with the claimed date but do not definitively exclude a few-day window around it.

Final Assessment

After completing this verification workflow, the fact-checking team reached the following conclusion:

• Location: Confirmed with high confidence that the image depicts the claimed city. Moderate-to-high confidence in the specific street.
• Date: Consistent with the claimed timeframe; cannot have been taken before conflict began.
• Attribution: The image appears to depict genuine damage from the conflict. The team noted explicitly that visual verification cannot definitively attribute the cause of building damage (what specific weapon or incident caused the damage), only that the damage depicted is genuine and at the claimed location.
• Original context: No evidence that the image had previously circulated in a different context.

Overall rating: The image appears to be genuine and correctly located. The core claim — that the image shows building damage from the ongoing conflict in the claimed city — is supported by available verification evidence. Attribution of the damage to a specific actor or weapon type is beyond what visual verification can establish.

Lessons from the Walkthrough

Verification Is Rarely Definitive

This walkthrough demonstrates that professional visual verification typically does not produce certainty — it produces a probability assessment based on the available evidence. Each element of evidence (reverse image search results, geolocation, sun angle, satellite comparison) contributes to a cumulative assessment. Professional fact-checkers are trained to characterize this probability accurately rather than claiming definitive verification or dismissing images as unverifiable.

The Process Takes Time

The walkthrough described here represents several hours of work by a team with specialized tools and expertise. Newsrooms and fact-checking organizations that perform this work at scale face genuine time pressure: performing rigorous verification before publishing takes time, while the story — and the image — spreads. This time pressure is a fundamental tension in conflict verification.

Multiple Tools Are Necessary

No single tool — TinEye alone, Google Images alone, geolocation alone — produces reliable verification. Effective conflict image verification combines multiple tools and approaches, using each element of evidence to corroborate or challenge the others.

What Cannot Be Established

Just as important as what verification can establish is what it cannot. Visual verification of this image can confirm location and establish a date range. It cannot determine the cause of the damage, the weapons used, who was responsible, or whether casualties occurred. Claims that go beyond what visual evidence supports — regardless of how strong the verification of the visual is — require additional evidence.

The Ethical Dimension

Geolocation verification of conflict imagery raises ethical questions that professional organizations grapple with explicitly. Publishing a precise geolocation of an active military or civilian location in an ongoing conflict can provide information to adversaries that could endanger people. The tradeoff between transparency — making verification findings public so that audiences can assess the evidence — and safety — not publishing information that could be exploited — is real and has no universal resolution. Different organizations handle this differently; the most thoughtful approaches involve withholding specific address-level information while confirming city-level geolocation.

Discussion Questions

1. The walkthrough shows that visual verification cannot definitively determine what caused the building damage, even after confirming the image's location and date. What claims can visual evidence support, and where does it reach its limit?

2. SunCalc's sun angle analysis provided corroborating evidence for the date claim. How strong is this evidence? What would make it stronger or weaker?

3. The geolocation was achieved partly by identifying a business signage text. What privacy considerations arise from this level of locational specificity, particularly in conflict zones?

4. The verification process described here took several hours. Given that false images can spread to millions of people within minutes, what institutional structures would be needed to make this kind of verification routinely achievable in breaking news contexts?

5. Bellingcat has published extensive open guides to geolocation verification. What are the benefits and risks of publishing this methodology publicly? Could hostile actors use these guides to better craft unverifiable fake images?