OSINT for Human Rights — Methods, Evidence, and Accountability

Thematic Intelligence Study | intelligencenotes.com

Study date: 2026-05-15 Domain: OSINT methodology × international accountability law Analyst: L. H. S. Brandão Overall confidence: High on field-evolution narrative and institutional precedents (MH17, Al-Werfalli, Raslan); Medium-High on Berkeley Protocol as de facto standard; Medium on the trial-stage admissibility ceiling.


1. Executive Summary (BLUF)

OSINT has transformed human rights documentation from a field reliant on survivor testimony and journalist access to one capable of independently verifying atrocities from satellite imagery, geolocated video, intercepted communications, and digital forensics. The MH17 Joint Investigation Team (2014–2019), the Syria accountability work of Bellingcat and the Syrian Archive, the Xinjiang facility documentation by BuzzFeed News and the Australian Strategic Policy Institute, and the International Criminal Court’s first explicit use of OSINT evidence in Prosecutor v. Al-Werfalli (2017) mark successive milestones in the field’s institutional maturation. The Berkeley Protocol on Digital Open Source Investigations (2020) consolidated the methodological field by establishing the first authoritative chain-of-custody and verification standard recognised across UN, ICC, ICJ, and universal-jurisdiction proceedings.

Assessment (High): OSINT is now a load-bearing evidentiary layer in international accountability proceedings, not a supplementary corroboration tool. The Anwar Raslan conviction in Germany (2022) — the first criminal conviction for Syrian state torture — used OSINT evidence centrally rather than peripherally. The ICJ’s reception of OSINT-sourced satellite imagery in South Africa v. Israel (2024 Gaza provisional measures) extends the same evidentiary architecture to the highest international tribunal.

Gap (Medium): Legal admissibility at the trial (as distinct from preliminary examination or arrest-warrant) stage of international proceedings remains largely untested for standalone OSINT evidence. The field’s accountability function continues to depend on political will to prosecute, not solely on evidence quality. The methodological mature-state has outpaced the institutional uptake state.


2. The Human Rights Documentation Challenge

The traditional human rights documentation model — survivor testimony plus on-the-ground investigation by NGOs and journalists — encounters five structural limits in contemporary conflict and authoritarian environments:

  • Access denial. Conflict zones, authoritarian states, and denied areas preclude on-the-ground investigation. Examples: Xinjiang since 2017, North Korea since the partition, Tigray during the 2020–2022 federal blackout, Gaza since October 2023.
  • Witness protection. Survivor testimony carries severe risk to sources in active conflicts and post-conflict authoritarian environments. The “name a witness and they may die” constraint operates structurally for Syria, Myanmar, and Xinjiang case-building.
  • Evidence preservation. Digital evidence degrades, gets deleted by platforms (often as part of the platforms’ own counter-terrorism content moderation), or is actively suppressed by state actors. The Syrian Archive (now Mnemonic) was founded specifically to address the YouTube mass-deletion problem of 2017, when platform anti-extremism rules erased millions of Syria conflict videos overnight.
  • Evidentiary standard. International courts require a higher standard of proof than journalistic publication — a “beyond reasonable doubt” threshold at trial, against which uncorroborated witness testimony alone has historically struggled.
  • Attribution complexity. Identifying individual perpetrators within state structures from open-source evidence requires linking specific actions to specific individuals within specific chains of command — a multi-step inference that survivor testimony alone rarely supports.

The gap OSINT fills. Geographic and temporal verification independent of access; documentation when witnesses cannot testify; pattern-of-life evidence demonstrating systematic rather than opportunistic conduct; corroborative material that allows surviving witnesses to testify under reduced risk because their account is already partially established.


3.1 International Criminal Court (ICC)

Rome Statute Article 69(4) establishes the admissibility criteria: relevance, probative value, and prejudicial effect. The Statute is technologically neutral — it does not enumerate evidence types — which has allowed digital open-source material to enter ICC proceedings without statutory amendment.

Prosecutor v. Al-Werfalli (2017). The Pre-Trial Chamber issued an arrest warrant against Mahmoud Mustafa Busayf Al-Werfalli, a Libyan National Army commander, based substantially on open-source video evidence. Thirty-three videos of extrajudicial executions in Benghazi were identified, geolocated, and verified by OSINT methods. This is the canonical first instance of an ICC arrest warrant resting predominantly on open-source material.

The verification standard. The ICC Pre-Trial Chamber applies a “reasonable grounds to believe” threshold for arrest warrants; trial chambers apply the higher “beyond reasonable doubt” standard. Al-Werfalli established OSINT’s adequacy at the lower threshold; the question whether OSINT alone can sustain the trial threshold remains open in the absence of an Al-Werfalli trial (he was reportedly killed in 2021).

Gap (Medium-High). No ICC precedent yet establishes satellite imagery as standalone proof of specific criminal acts. Satellite imagery has functioned corroboratively — establishing destruction, displacement, mass-grave patterns — rather than as primary proof of a named perpetrator’s actus reus on a specific date. The pattern-vs-individual evidence gap remains structurally open.

3.2 International Court of Justice (ICJ)

The ICJ adjudicates state-vs-state disputes and has reception practices distinct from the ICC. Recent practice has integrated OSINT-sourced satellite imagery as exhibits submitted by parties:

  • South Africa v. Israel (2024 Gaza provisional measures). Satellite imagery of infrastructure destruction was submitted by parties and reviewed by the Court. The 26 January 2024 order finding “plausible” risk of genocide drew on aggregated open-source casualty and destruction data, including UNOSAT damage assessments.
  • The Gambia v. Myanmar (Rohingya genocide case, ongoing). Satellite imagery and OSINT-derived village-burning documentation entered the record at the provisional-measures stage (2020).

3.3 Universal Jurisdiction Investigations

Universal-jurisdiction proceedings in European national courts have advanced OSINT-admissibility practice further than the international courts themselves, because national courts operate under domestic procedural law and have admitted OSINT evidence with fewer interpretive hurdles.

  • Germany — Anwar Raslan case (Koblenz Higher Regional Court, 2022). First criminal conviction for Syrian state torture. The prosecution case relied substantially on social media posts, survivor video identification of perpetrators, leaked Syrian military documents (the “Caesar files”), and Bellingcat-style OSINT corroboration. Conviction on charges of crimes against humanity.
  • France, Netherlands, Sweden. Active universal-jurisdiction caseloads on Syrian, Rwandan, and Liberian charges with growing OSINT integration. The Netherlands’ Eurojust-coordinated International Crimes Section is a methodological leader.

3.4 The Berkeley Protocol

The Berkeley Protocol on Digital Open Source Investigations (2020), issued jointly by the Office of the UN High Commissioner for Human Rights (OHCHR) and the Human Rights Center at UC Berkeley School of Law, is the field’s authoritative evidentiary standard document. It is now the de facto reference for OSINT-as-evidence in international proceedings; investigations not following its framework face admissibility challenges.


4. The Berkeley Protocol — Core Requirements

The Protocol’s substantive requirements consolidate prior practice into six pillars:

  1. Chain of custody. All digital evidence must have documented provenance from discovery through storage. Each handler, transfer, and access event must be logged with timestamp and identity.
  2. Verification. Content must be verified using corroboration (multiple independent sources), EXIF/metadata analysis (where present and trustworthy), geolocation (architectural, topographic, environmental features), chronolocation (shadow analysis, weather correlation), and reverse image search (to detect prior circulation that would falsify “first-instance” claims).
  3. Preservation. Evidence must be preserved using cryptographic hash verification (SHA-256 minimum) and stored in read-only formats. Original files must be retained alongside any derived or processed versions; processing steps must be reversible and documented.
  4. Contextualisation. Content must be placed in geographic, temporal, and narrative context. A geolocated video of a strike is not yet evidence; the same video, placed in a documented sequence of events at a known location on a known date attributable to a known unit, becomes evidence.
  5. Source protection. Collection practices must account for risk to sources and subjects. This includes not republishing material that would identify witnesses, not exposing the methods used to obtain non-public material, and not creating reverse-engineering opportunities for adversaries.
  6. Proportionality and privacy. Only collect what is necessary; minimise data retention; respect the privacy of subjects who are not the focus of the investigation. The Protocol explicitly rejects mass-collection approaches that scoop bystander data alongside relevant evidence.

Assessment (High). The Berkeley Protocol has become the de facto standard for OSINT-as-evidence because it harmonises NGO practice with prosecutorial requirements. Its verification pillar operationalises the general Source Verification Framework standard for the specific demands of legal proceedings. Bellingcat, the Syrian Archive, the Amnesty Digital Verification Corps, HRW’s Digital Investigations Lab, and UNOSAT have all aligned operational practice with the Protocol since 2020. Investigations following its framework enjoy presumptive admissibility; those that do not face challenges that often cannot be cured retrospectively.


5. Key Methodological Techniques

5.1 Satellite Imagery Analysis

Satellite imagery is the foundational layer of contemporary atrocity documentation because it provides geographic and temporal verification independent of any on-the-ground presence. Four canonical use cases:

  • Mass-grave site detection. The Srebrenica precedent (US imagery, 1995) established satellite imagery as actionable in genocide investigation. Yazidi mass-grave sites in northern Iraq (2014–2017) were documented using a combination of commercial high-resolution imagery and survivor-led location identification.
  • Infrastructure-destruction mapping. The UN Satellite Centre (UNOSAT) issues recurring damage assessments for Gaza, Syria, Ukraine, Sudan, and Yemen. UNOSAT’s methodology — change-detection between pre-event and post-event imagery, building-footprint comparison, damage classification — is now the institutional reference.
  • Detention-facility construction tracking. ASPI’s Xinjiang Data Project (2017–2020) used Sentinel-2 and commercial imagery to document the construction of 380+ detention facilities across Xinjiang. The case demonstrated that satellite imagery can establish systematic state conduct — a category of evidence that survivor testimony alone struggles to produce.
  • Forest clearance / village burning. Human Rights Watch documented Rohingya village burning in Rakhine State (2017) using before/after satellite imagery across dozens of sites. Sentinel-3 thermal anomaly detection corroborated the burning timeline at hour-resolution.

5.2 Video Geolocation and Chronolocation

Geolocation identifies the exact location at which a video or image was recorded; chronolocation identifies the date and time. The two together convert an uncontextualised video into court-admissible evidence.

  • Architectural and topographic features. Buildings, road layouts, signage, vegetation patterns, and skyline features are cross-referenced against satellite imagery, Google Street View, and OpenStreetMap.
  • Shadow analysis. Tools such as SunCalc.org compute solar azimuth and elevation for any location and date; matching observed shadow direction and length to computed values either corroborates or refutes a claimed time of recording. The technique is decisive when the discrepancy is large.
  • Weather correlation. Historical weather data (precipitation, cloud cover, wind direction visible in smoke plumes) provides an independent temporal cross-reference.
  • Multi-angle spatial reconstruction. When multiple videos of the same event exist from different angles, spatial-reconstruction techniques (used by Forensic Architecture and the New York Times Visual Investigations team) produce a 3D reconstruction that resolves contradictions and establishes physical impossibility of alternative accounts.

5.3 Weapons Identification

Munitions identification from video and imagery has matured into a discrete sub-discipline:

  • Serial numbers and markings. Munition fragments often carry manufacturer codes, lot numbers, and country-of-origin markings that establish the supply chain from manufacturer → exporting state → end-user.
  • Design-feature identification. Specialists identify weapon systems from partial imagery using design signatures (fin configuration, tail-fuze design, casing geometry). The discipline tracks the supply chain back to the manufacturer.
  • Prohibited-weapons detection. Cluster munitions (banned under the 2008 Convention on Cluster Munitions) and white phosphorus (restricted under Protocol III of the CCW) have distinctive visual and thermal signatures. Documentation of their use carries direct legal consequence.
  • Specialist organisations. Armament Research Services (ARES) and Conflict Armament Research (CAR) are the field references; their reports are routinely cited in UN sanctions-monitoring panels and ICC proceedings.

5.4 Social Media Evidence Collection

Social media is the primary first-source for atrocity evidence in most contemporary conflicts. Standard practice:

  • Archive first. Screenshot + URL + timestamp + Wayback Machine capture before any analytical step. Platforms delete content on hours-to-days timescales; analytical hesitation costs evidence.
  • Cryptographic hashing. SHA-256 hash of collected content for chain-of-custody (sha256sum filename). The hash anchors the evidence to its state at the moment of collection and forecloses later tampering allegations.
  • Tooling. Hunchly is the field standard for automatic evidence capture (records every URL visited, with timestamp and hash, in a court-ready format). Archive.org and HTTrack provide complementary mass-capture capability.
  • Platform-preservation requests. Meta, Google/YouTube, and X have law-enforcement portals that accept preservation requests from authorised entities. NGOs and academic investigators may qualify via Interpol referrals, Eurojust coordination, or domestic court orders. The Berkeley Protocol recommends initiating preservation requests as the first step after capture, not the last.

5.5 Pattern Recognition — “Systematic” vs. “Opportunistic”

International humanitarian and criminal law distinguish widespread or systematic violations (constituting crimes against humanity) from isolated incidents (which may constitute war crimes individually but do not aggregate to the higher category). OSINT is uniquely positioned to establish pattern at scale:

  • Frequency. Count of incidents per unit time across a defined geography.
  • Geographic distribution. Spatial pattern of incidents — clustered, dispersed, or concentrated along military axes.
  • Actor consistency. Identification of the same unit, platform, or command across multiple incidents.
  • Command-period correlation. Correlating command appointments with incident timelines establishes the temporal frame within which command responsibility doctrine (Yamashita; Rome Statute Article 28) applies.

The shift from “isolated incident” to “systematic pattern” is the most legally consequential transition in atrocity-evidence development, and it is the one OSINT performs most efficiently. The analytical framework mirrors Pattern of Life Analysis, adapted to atrocity-documentation thresholds rather than targeting workflows.


6. Key Organizations and Their Methods

OrganizationMethodFocus
BellingcatOSINT investigations, geolocation, weapons trackingWar crimes, state violence, disinformation
Syrian Archive (now Mnemonic)Systematic social media archivingSyria, Yemen, Sudan atrocities
Amnesty International Digital Verification CorpsVolunteer OSINT verification networkGlobal
Human Rights Watch Digital & Investigative LabSatellite imagery, OSINTGlobal
WITNESSDocumentation training, video evidence standardsGlobal; community-led documentation
UNOSAT (UN Satellite Centre)Satellite imagery analysis for humanitarian/accountabilityGlobal
Berkeley Human Rights CenterBerkeley Protocol development, trainingGlobal
Forensic ArchitectureArchitectural and spatial reconstruction of eventsWar crimes, state violence
Australian Strategic Policy Institute (ASPI)Xinjiang Data Project, satellite change-detectionXinjiang, Indo-Pacific
Conflict Armament Research (CAR) / ARESWeapons-tracing and supply-chain forensicsGlobal arms transfers

7. Case Studies

7.1 MH17 (2014–2019) — OSINT establishes aircraft origin and route

The downing of Malaysia Airlines Flight 17 over eastern Ukraine on 17 July 2014 became the canonical case for OSINT-driven state attribution. Bellingcat and the Dutch-led Joint Investigation Team (JIT) used geolocated social media posts to track a Buk surface-to-air missile system from a Russian military base in Kursk through eastern Ukraine on 17–18 July 2014. Multiple videos of the Buk convoy were cross-referenced, geolocated against satellite imagery, and verified for chain-of-custody. The investigation established with forensic specificity that the Buk system belonged to the Russian Federation’s 53rd Anti-Aircraft Missile Brigade.

Outcome. The JIT indicted four individuals — three Russian and one Ukrainian — including two officers of Russia’s Federal Security Service (FSB). In November 2022, a Dutch court convicted three of the four in absentia of murder. MH17 established the proof-of-concept that OSINT can sustain criminal convictions at trial.

7.2 Xinjiang Detention Facilities (2017–2020) — satellite change detection

ASPI’s Xinjiang Data Project documented the construction of more than 380 detention facilities across Xinjiang using Sentinel-2 (free, lower-resolution) and commercial high-resolution imagery (Maxar, Planet Labs). Construction signatures included perimeter walls, watchtowers, internal partition patterns, and characteristic site-preparation footprints. The construction timeline (2017 acceleration) corroborated independent reporting on the mass-internment campaign.

The investigation cross-referenced satellite-derived findings with:

  • Local government procurement documents (Chinese-language)
  • Official statements from regional Party authorities
  • Survivor accounts collected by the Uyghur Human Rights Project
  • BuzzFeed News reporting (Megha Rajagopalan, Alison Killing, Christo Buschek — 2021 Pulitzer Prize for International Reporting)

Outcome. The combined evidence base entered the record of multiple national parliamentary inquiries (UK, Canada, Netherlands) and informed the 2022 OHCHR assessment finding “serious human rights violations” in Xinjiang. The case demonstrated OSINT’s capacity to document systematic state conduct at continental scale under conditions of total ground-access denial.

7.3 Rakhine State / Rohingya (2017) — evidence for ICJ and ICC

Following the August 2017 Myanmar military operations in Rakhine State, Human Rights Watch satellite imagery documented village burning across dozens of sites. Survivor accounts from Cox’s Bazar refugee camps were corroborated with:

  • Sentinel-3 thermal anomaly data establishing the burning timeline
  • Identification of weapons used (RPG-7, military helicopter markings)
  • Geolocation of execution sites described by survivors

Outcome. The combined evidence base entered the record at the ICJ (The Gambia v. Myanmar, 2020 provisional measures) and the ICC (jurisdiction confirmed 2018 for the cross-border crime against humanity of deportation). The case demonstrated multi-forum admissibility of a single OSINT evidence base.

7.4 Syria — Anwar Raslan Case (Germany, 2022)

The Koblenz Higher Regional Court conviction of Anwar Raslan — a former colonel in Syrian General Intelligence Directorate Branch 251 — was the first criminal conviction worldwide for Syrian state torture. The prosecution case combined:

  • Social media posts identifying perpetrators
  • Survivor video identification of Raslan from photographic line-ups
  • The “Caesar files” — 53,000+ photographs of Syrian detainees killed in custody, smuggled out of Syria by a defected military photographer
  • OSINT corroboration of detention-facility locations, command structures, and incident timelines

Outcome. Life imprisonment for crimes against humanity. The Raslan case established OSINT’s capacity to sustain a trial-stage conviction in a Western European court for international crimes, under universal jurisdiction.


8. Preservation, Storage, and Evidentiary Integrity

The integrity layer is what distinguishes evidence from journalism. Operational standards:

  • Hash immediately. Compute SHA-256 of every collected file at the moment of capture: sha256sum filename > filename.sha256. The hash binds the file’s content to its state at capture and forecloses later tampering allegations.
  • Immutable storage. Store evidence in immutable format — WORM (write-once-read-many) storage devices, append-only filesystems, or blockchain-anchored timestamps via services such as OriginStamp. The Berkeley Protocol does not mandate a specific technology but requires that alteration be detectable.
  • Access logs. Maintain access logs for chain of custody — who accessed what file, when, and for what purpose. The investigator-team workflow should produce these logs automatically.
  • Reversible processing. Do not alter or enhance imagery beyond documented, reversible processing steps. Sharpening, colour-balance adjustment, and contrast enhancement are permissible if documented; cropping that removes context is not.
  • Tool baseline. Hunchly is the de facto standard for automated capture (records all web pages visited during investigation with timestamps and hashes); Archive.org and Archive.today provide redundant external preservation; HTTrack supports bulk site mirroring.

9. Ethical Constraints and Analyst Responsibility

OSINT-for-human-rights work is exposure-heavy. Five ethical constraints structure responsible practice:

  • Secondary trauma. Extensive review of atrocity imagery has documented psychological harm on investigators. Rotation policies, professional counselling access, and workload limits are operational necessities, not optional welfare measures. The Dart Center for Journalism and Trauma maintains the field’s working guidance.
  • Subject dignity. Public display of atrocity imagery without analytical purpose is unethical. Evidence serves accountability; it does not exist as content. Editorial standards must distinguish documentation from spectacle.
  • Re-identification risk. Publishing geolocation of individuals in conflict zones may expose survivors to retaliation. The Berkeley Protocol requires that publication choices consider downstream identification risks, not merely upstream evidentiary value.
  • Source safety. Publishing methods that expose how investigators obtained information may enable adversary countermeasures. The trade-off between methodological transparency (which builds field credibility) and operational security (which preserves future-collection capacity) must be negotiated case by case.
  • Volunteer governance. Crowd-sourced verification (Amnesty’s Digital Verification Corps; Bellingcat’s discord channels) raises distinct ethical issues — volunteer welfare, vetting, and the appropriate scope of crowd-sourced participation in cases that will go to trial.

10. Strategic Implications

  1. OSINT has closed the impunity gap created by access denial. Authoritarian states can no longer simply restrict media access to conceal systematic violations. The Xinjiang precedent demonstrates that continental-scale state conduct is documentable from orbit. This is a permanent structural shift in the asymmetry between perpetrators and accountability mechanisms.

  2. The trial-stage admissibility ceiling remains the field’s open frontier. The Al-Werfalli precedent established OSINT’s sufficiency for arrest-warrant issuance; no ICC trial-stage decision has yet rested standalone on OSINT evidence. The next test case will define the upper limit of the field’s accountability function.

  3. Deterrence value is now material. The knowledge that satellite imagery and archived social media will be reviewed after the fact shapes commander behaviour at the margin. The deterrence is imperfect — and is empirically failing in Gaza, Sudan, and Ukraine simultaneously — but it is not zero. The MH17 indictment, the Al-Werfalli warrant, and the Raslan conviction collectively shift the cost-benefit calculation for atrocity decisions made under uncertainty.

  4. The methodological mature-state has outpaced institutional uptake. Bellingcat-grade OSINT capability is widely distributed; ICC investigative capacity, OHCHR investigation panels, and universal-jurisdiction prosecution capacity remain bottlenecked. The constraint on accountability is no longer evidence; it is the political and institutional will to act on existing evidence.

  5. The next-decade frontier is AI-content detection. As generative AI produces increasingly plausible synthetic atrocity imagery and audio, the verification burden on OSINT investigators rises proportionally. Deepfake detection, provenance authentication (C2PA standards), and trained verifier networks become load-bearing. The field’s continued evidentiary status depends on resolving the synthetic-content problem before adversaries weaponise it at scale to discredit authentic evidence.

  6. Multi-lingual OSINT is becoming non-optional. State-aligned narrative campaigns operate in their domestic languages first and in English second. OSINT-for-human-rights investigators who do not collect in the relevant primary language miss the official framing that conditions all downstream verification. The Berkeley Protocol’s contextualisation requirement implies, but does not yet mandate, primary-language collection.


11. Sources

Foundational — High

  • Berkeley Protocol on Digital Open Source Investigations (UN OHCHR / UC Berkeley Human Rights Center, 2020).
  • ICC — Prosecutor v. Mahmoud Mustafa Busayf Al-Werfalli, Pre-Trial Chamber I Arrest Warrant (15 August 2017).
  • Joint Investigation Team (JIT) — MH17 Criminal Investigation Final Report (Dutch Public Prosecution Service, 2019).
  • ICJ — South Africa v. Israel, Order on Provisional Measures (26 January 2024).
  • ICJ — The Gambia v. Myanmar, Order on Provisional Measures (23 January 2020).

Institutional and Investigative — High

  • Bellingcat — Evidence in Practice (ongoing publication series).
  • Bellingcat — MH17 investigation series (2014–2022).
  • ASPI Xinjiang Data Project — documentation portal and methodology notes.
  • Human Rights Watch Digital Investigations Lab — methodology documentation.
  • UNOSAT — damage-assessment methodology and operational reports (Gaza, Ukraine, Sudan, Syria).
  • Mnemonic (formerly Syrian Archive) — archival methodology and case dossiers.
  • Forensic Architecture — Investigative Aesthetics methodology series.
  • BuzzFeed News — Xinjiang detention-facility reporting (Rajagopalan, Killing, Buschek, 2020–2021).

Academic — Medium-High

  • Koenig, Alexa — Graphic: Trauma and Meaning in our Online Lives (UC Press, 2022).
  • Dubberley, Sam; Koenig, Alexa; Murray, Daragh (eds.) — Digital Witness: Using Open Source Information for Human Rights Investigation, Documentation, and Accountability (Oxford University Press, 2020).
  • Aronson, Jay D. — work on forensic science and human rights at Carnegie Mellon’s Center for Human Rights Science.

Legal — High

  • ICRC — Customary International Humanitarian Law Study (Henckaerts & Doswald-Beck, 2005, updated database).
  • Rome Statute of the International Criminal Court (1998), Articles 7, 8, 28, 69.
  • Koblenz Higher Regional Court — Anwar Raslan judgment (13 January 2022).

Cross-References


This thematic study consolidates field-level methodology and institutional precedent as of 2026-05-15. Updates will be issued when the next ICC trial-stage decision testing standalone OSINT evidence is rendered, when the Berkeley Protocol receives its first formal revision, or when a precedent-setting universal-jurisdiction case is concluded.