# Geolocation and Chronolocation Methodology ## BLUF **Geolocation** is the process of determining where an image, video, or claim originated using features visible in the content itself, independent of metadata. **Chronolocation** is the complementary process of determining *when* the content was captured. Together they constitute the forensic backbone of contemporary OSINT verification — the methodology that makes it possible to verify or refute claims about conflict, human rights violations, and state operations without access to classified intelligence. Bellingcat's MH17 attribution (2014–2016), the Ukraine War's distributed battlefield intelligence network (2022–present), and every credible Gaza strike verification rest on this methodology. The technique is teachable, the tools are open-source, and the rigor is legally defensible. --- ## The Verification Problem Raw open-source content — a photo, video, or claim on social media — has zero evidentiary value until it is verified. Adversaries actively plant falsified content to mislead analysis ([[02 Concepts & Tactics/Active Measures|active measures]]); well-intentioned amateurs misattribute genuine content to wrong locations or dates; platforms and re-posters strip metadata; AI-generated content is increasingly sophisticated. The geolocation/chronolocation discipline addresses this: features *in* the content — buildings, terrain, shadows, vegetation, road markings — cannot be faked by metadata manipulation and can be cross-referenced against independent sources. --- ## Geolocation Method ### Step 1: Inventory Visible Features Catalog every visible feature that could serve as a geographic signature: **Built environment:** - Building architecture (roof styles, window patterns, construction materials) - Signage, text, and language (road signs, shop names, license plates) - Street furniture (lampposts, traffic signals, benches — national design varies) - Infrastructure (power lines, pylons, road markings, cycle lanes) **Natural environment:** - Terrain features (mountains, hills, coastlines, river bends) - Vegetation (species specific to climate zones) - Water features (rivers, lakes, coastlines) **Distinguishing markers:** - Any unique feature: sculptures, radio masts, large commercial buildings, stadiums, bridges ### Step 2: Cross-Reference Against Mapping Services Primary tools: - **Google Earth Pro** (free desktop application) — historical imagery layers; 3D building rendering; measurement tools - **Google Maps Street View** — ground-level verification; time slider for dated imagery - **Bing Maps / Yandex Maps** — often superior coverage for Russia, Eastern Europe, Middle East - **OpenStreetMap** — community-maintained; strong coverage in conflict zones - **Mapillary** — crowdsourced street-level imagery - **Sentinel Hub / Planet Labs** (commercial) — recent satellite imagery **Method:** Start with the most distinctive feature visible in the source content. Use it as a search anchor. Once tentative location identified, verify by matching *additional* features — never conclude from a single match. ### Step 3: Verify Through Feature Matching A robust geolocation requires multiple corroborating matches: - **Primary anchor:** A distinctive feature (unique building, signage, terrain form) - **Secondary corroboration:** At least 2–3 additional features (street layout, adjacent buildings, vegetation patterns) - **Perspective verification:** The camera angle and viewing position must be consistent with the geography (is the hill visible in the source image actually visible from this location on the map?) ### Step 4: Document the Chain For each geolocated piece of content, preserve: - Screenshots with annotations showing each matched feature - URL links to the mapping service resources used (Google Earth KMZ files, Street View permalinks) - Date/time of the verification work - Coordinates (latitude/longitude) to appropriate precision --- ## Chronolocation Method ### Shadow Analysis The position and length of shadows reveal the sun's position, which — combined with the known latitude of the location — reveals the time of day and (with sufficient precision) the date range. **Tools:** - **SunCalc.net** — calculates sun position for any location/date - **Shadow Calculator** — reverse-engineers time from shadow length and direction **Method:** Measure the angle and direction of shadows in the source image. Cross-reference against sun position calculations for the known location. The time of day is typically determinable within ±30 minutes; seasonal constraints narrow the date range. ### Weather and Atmospheric Conditions Cloud patterns, precipitation, and atmospheric haze can be cross-referenced against meteorological records: - **Weather history archives** (weatherunderground.com, NOAA) — daily historical weather for specific locations - **Satellite weather imagery** — EUMETSAT, NOAA GOES archives A photo showing rain, snow, or specific cloud patterns must match the weather record for the claimed date at the claimed location. ### Vegetation and Seasonal Markers Leaf cover, snow cover, and seasonal vegetation states constrain the date range: - Deciduous trees in full leaf vs. bare branches - Seasonal crops (wheat, corn, rice) at specific growth stages - Snow cover patterns (extent, consolidation) ### Visible Technology and Culture - License plate formats (countries periodically update designs) - Mobile phone models visible in images - Advertising campaigns, election posters, event signage - Flag variations (some countries have updated flag designs) ### Digital Forensic Analysis - **Metadata (EXIF):** When available (not stripped by platform), reveals capture time, device, and often GPS coordinates. Easily faked, so cross-check against other chronolocation methods. - **Timestamps in content:** Clocks visible in the scene; shadows as analog clock - **Social media context:** When was the content first posted? When was the first posting made to an account with a track record (not an anonymous new account)? --- ## Key Tools Inventory | Tool | Purpose | Access | |---|---|---| | Google Earth Pro | Satellite imagery, historical layers | Free | | Google Maps Street View | Ground-level verification | Free | | Yandex Maps | Superior Russia/CIS coverage | Free | | Mapillary | Crowdsourced street-level imagery | Free | | SunCalc | Shadow-based time calculation | Free | | TinEye | Reverse image search | Free | | Yandex Images | Reverse image search (superior for conflict zones) | Free | | InVID / WeVerify | Video verification plugin suite | Free | | ExifTool | Metadata extraction | Free | | Planet Labs / Maxar | Recent commercial satellite | Paid | | Sentinel Hub | ESA satellite archive | Free (limited) | --- ## Case Study: Bellingcat MH17 Attribution The 2014 Malaysia Airlines MH17 shoot-down investigation is the canonical demonstration of the methodology: **Starting evidence:** Social media photos and videos of a Russian military vehicle convoy — including what appeared to be a Buk surface-to-air missile launcher — in eastern Ukraine on 17 July 2014. **Geolocation work:** - Individual images geolocated to specific road segments in Donetsk Oblast - Road signs, utility poles, buildings, and adjacent features matched against mapping services - Convoy route reconstructed by sequencing geolocated images **Chronolocation work:** - Shadow analysis placed images within a narrow time window on 17 July - Weather conditions matched meteorological records - Social media posting times cross-referenced with image timestamps **Attribution work:** - Vehicle markings identified as belonging to Russia's 53rd Anti-Aircraft Missile Brigade (Kursk) - Specific missile launcher identified by its distinctive paint damage pattern — matched to vehicles filmed leaving the brigade's home base days earlier - Unit personnel identified through VK (Russian Facebook) profiles **Outcome:** The Dutch Joint Investigation Team eventually confirmed Bellingcat's attribution officially. The investigation demonstrated that volunteer OSINT analysts could produce forensic attribution at state intelligence community standards. --- ## Common Pitfalls **Feature-matching in isolation:** A single matched feature can be coincidence. Require 3+ independent matches minimum. **Confirmation bias:** Analyst wants the content to be from a specific location; unconsciously weights ambiguous features toward that conclusion. Counter with [[08 Guides & Manuals/Analytical Frameworks/Analysis of Competing Hypotheses|ACH discipline]] — systematically evaluate against alternative location hypotheses. **Stale imagery:** Street View, satellite imagery, and OpenStreetMap features may be years out of date. Conflict zones change rapidly; verify with most recent available imagery. **Adversarial deception:** Sophisticated actors stage environments or select filming locations that are difficult to distinguish from genuine operational settings. Maintain skepticism especially for content that aligns suspiciously well with an adversary's messaging goals. --- ## Key Connections - [[02 Concepts & Tactics/OSINT]] — the discipline this methodology operationalizes - [[08 Guides & Manuals/OSINT Methodologies/Source Verification Framework]] — the broader verification discipline - [[08 Guides & Manuals/Analytical Frameworks/Analysis of Competing Hypotheses]] — analytical method applied to geolocation uncertainty - [[08 Guides & Manuals/Operational Manuals/Open-Source Intelligence Manual]] — the parent operational document - [[04 Current Crises/Active Conflicts/Ukraine War]] — the current large-scale case for distributed geolocation intelligence - [[04 Current Crises/Active Conflicts/Gaza War]] — strike verification through geolocation - [[06 Authors & Thinkers/Contemporary Analysts/Thomas Rid]] — academic context for forensic attribution methodology