Masih ur-Rahman Mubarez was working away from home when the airstrike hit his house in Wardak Province, Afghanistan. In the early hours of September 23, 2018, a bomb killed Mubarez’s wife, seven children and their four teenage cousins. Just hours before, at 4am, he had spoken to Amina, his wife, on the phone. She had told him soldiers were raiding the village and she had been told to turn off her phone. He would never speak to her again.
It wasn’t until the next day when Mubarez learned about the deaths. Yet it would take him eight months to find out what had really happened. The answer all rested on a single photograph showing a four-pronged mark in the wreckage. Both the US and Afghan militaries – the only forces carrying out air strikes in the country – denied responsibility.
Only after months of work by the Bureau of Investigative Journalism (TBIJ) and the The New York Times was it possible to prove the US military had struck the house. For one family, the question was answered. But there are still many without answers. Last year, as the air assault on Afghanistan intensified, there were 1,045 civilian casualties by strikes carried out by Afghan and US forces – 700 people were killed and 345 injured. And, behind each death, is a family left behind searching for the truth.
Research by TBIJ showed 21 strikes in 2019 that were devastatingly similar – all were reported to have hit buildings, and many were thought to have destroyed family homes. Investigating on the ground in Afghanistan is perilous. Strike sites can be in remote areas, where security is a very real concern. Even with a reporter in Kabul, contacting an affected family can often mean weeks of waiting; telephone lines are often damaged.
In an attempt to uncover the truth, the Bureau turned to Bellingcat. The independent journalism project has built up a reputation for open source investigations, using satellite imagery as well as information and photos posted on social media to get to the truth. “I realised you could get a good idea of where the front lines were in Libya and who was fighting where, just by closely following information shared online,” says Eliot Higgins, the site’s founder, who rose to prominence using open source intelligence (OSINT) to help track the people who brought down the MH17 plane over Ukraine.
Bellingcat has created a community of OSINT investigators – some professional, some hobbyist, all working remotely. When it put out a call for a team of volunteers to investigate the Bureau’s list of 20 strikes, more than 150 volunteers signed up. For each incident, two key questions were put to the group: could they prove the strike took place and could they prove it killed civilians? If those were answered, there was another: who was behind the strike? Attribution is always difficult, but one thing the project has found is this: if you can narrow down the first two questions, you get a better chance with the third.
To piece together what had happened, investigators spent months trawling through photos and videos of rubble, dead bodies and the angry aftermath of strikes, all of which could serve as proof – at a minimum – that these incidents had occurred. Most of this evidence came from social media. When volunteers found information online, it was passed to contacts with experience reporting on Afghanistan to follow up, for example by finding a family member to contact, or calling an official in the region.
This is a big part of the value this type of work can have, says Nick Waters, an investigator for Bellingcat. “It means we can do intelligence-led on the ground reporting. It means we can sit here and say if we go to this village and exactly this house, we may find what we’re looking for.”
One of the strikes on the Bureau’s list had hit a building – a home – in Baghlan province, north of Kabul, on July 9, 2019. Early narratives around this incident were conflicting. A few brief lines in news reports said the Afghan Ministry of Defence had admitted civilians had died in a strike, but stopped short of taking responsibility. And while the US denied carrying out strikes in the area, the governor of the province was on camera blaming Nato forces – a common shorthand for the US, the only Nato member still conducting air operations in Afghanistan.
Coordinating an OSINT operation involves setting priorities for different strikes – what is known already, and what’s most important to find out? Do we know for sure that a strike happened, or are we trying to pinpoint where and when?
In the Baghlan case, the key missing information was the strike’s coordinates. In incidents like this, where responsibility is not clear, finding the exact location of the strike can make a huge difference. In the strike on Mubarez’s house, it was this detail that prompted a reversal of the US military’s response.
Finding the coordinates of a single house is a difficult mission. In this case, the village hit by the strike had been named in a Taliban video. That name could be cross-referenced with a report by Humanitarian Response, a part of the United Nations Office for the Coordination of Humanitarian Affairs, to get a better understanding of its location. The OSINT group then used the video and other photos found online that showed the aftermath of the strike to identify distinctive features of the building hit that might be visible from above.
There was a compound with an L-shaped building in its northeastern corner, a small grove of trees inside that compound and a line of trees and a low line of vegetation that flanked it. The OSINT volunteers looked for those features in the area identified on satellite maps, until one user found a strong match. Looking at the building before July 9 and after on satellite imagery could prove the coordinates were correct – if damage consistent with an airstrike was present. Would there be an outline of a house in one photo, gone in the next? There was one snag: the week the project launched, TerraServer, the main provider of affordable satellite imagery, announced it was withdrawing its services. The investigation into the strike on Mubarez’s house was able to use satellite imagery to not only see the damage to his house, but also to see evidence of his children’s graves from above. It was a crucial piece of the puzzle.
In other cases, finding similar proof has not been so easy. Even spending hundreds of pounds on satellite imagery does not guarantee good quality, as certain areas are only available in very low resolution. “It’s deliberately degraded. Most of the aerospace industry is inextricably bound up with defence and diplomacy,” says Waters, all of which makes it more difficult to investigate events in certain countries.
In February 2020, the Bureau and Bellingcat investigators pressed ahead without satellite images. But they had the coordinates. Or so they hoped. The original Afghan Ministry of Defence statement also said civilians had died in the strike – but who were those people? Accountability isn’t just about admitting the fact of a strike, but also its key details – most crucial of all, putting names to impersonal fatality numbers.
Finding those names began with online searches. In this case, the community was able to uncover a large volume of visual evidence. Attached to a news report on the strike in Dari, one of the main languages in Afghanistan, was an image said to be from the scene. It showed the remains of four children and what looked to be another two adults, although damage to their bodies made it difficult to tell.
It is vital to check the authenticity of such images. An initial step can include running reverse image searches, via sites such as TinEye or the Russian search engine Yandex, to check whether similar images have appeared elsewhere. The searches turned up a match, leading to social media posts containing additional close-up images of children’s bodies. The photos had not been shared before the date of the alleged attack, making it more likely they were from this incident.
Searching through imagery like this can take its toll. People working or regularly volunteering in the field have been known to struggle with trauma as a result of exposure to graphic images and videos. And not all of that evidence is clear cut. There were possible red herrings in the case, including a video showing fragments of weapons said to have been found in the wreckage, which appeared to be from an American bomb. However, this section of the video had been tacked onto what appears to be a modified version of a longer video produced by the Taliban, which didn't show any fragments. The area surrounding the fragments was also not shown making it hard to verify whether it was filmed in the same location.
Militant sources are treated with caution, but they are still useful, according to Abdullahi Hassan, an Amnesty International researcher investigating strikes in Somalia. “When [al Shabaab] share photos or videos, it does not mean they are useless, especially for people like us struggling to get evidence related to an incident,” he says. In Somalia this can be the only visual evidence coming from a strike site, given that the militant group has banned mobile phones in the otherwise inaccessible territories they control.
This makes verification all the more important. Among the pro-Taliban accounts sharing details of the Baghlan strike was a Twitter user who described himself as a lead political analyst. His profile picture showed him appearing on Afghan television. He posted a photo and wrote that the victims were all members of his family, whom he had met three months earlier.
Finding an affected family in Afghanistan can be like finding a needle in a haystack. Poor phone lines, shifting Taliban territory and rural locations all add complications. But sometimes social media can help provide that missing link. This was one of those times. Within a few days of a direct message on Twitter, this relative led the team to Ismael Khan. On the phone, Ismael was quiet and shy, but although the call broke up several times he pressed on, calling back several times in the hope of a better signal. He spoke slowly; his speech had been affected by a head injury from the night his home was bombed.
Ismael had been sleeping on his family’s terrace. “The bombing woke me up,” he recalls. “I wasn’t fully under the rubble and one of my hands was stuck in it. I wasn't very conscious but I could reach and touch one of my son's bodies. I knew that he was dead.” He was taken to hospital. When he came round, he learnt that it wasn’t just his son that had died that night. His wife, Naseema, and six of his children were gone. The youngest was just two years old.
Ismael provided photos of his children: his sons, Khairullah, 15, Bakhtullah, 12, Shirullah, ten, and Sunaullah, the youngest, and his daughters Ruqia, nine, and Nazmeena, seven. For the first time, we saw his children as they had been before the strike – wrapped up in warm winter coats, very much alive.
On May 24, 2019, a NGO building in Farah, a city in western Afghanistan, was allegedly hit in a strike that killed two people. The incident was reduced to a few lines in a general monthly update on the violence in Afghanistan. Even in a dossier full of tragedy, the case stood out. A strike may have hit a charity and killed two staff members. What was the charity? Who were the workers?
The US military had deemed this alleged strike “possible”, a term meaning it had not accepted responsibility, but had not denied it either. The military had also said the strike on Mubarez’s house was “possible” following evidence published by the Bureau. For him and others, the word “possible” can rob survivors of closure. The admission that the allegation of civilian harm was “possible”, however, did mean that a strike had occurred – the team did not have to establish coordinates or find satellite imagery to prove it had taken place. Instead, the work narrowed down to finding out who had been killed.
It came in a eulogy for a man named Abdul Hamid Alkoazay. It was posted on Facebook on the day of the incident and underneath were tens of comments mourning his loss. Key details matched – his name tallied with a tweet. There was also mention of a plane.
More searching uncovered the alleged victim’s Facebook page. The profile revealed a young man with a love of sport and a wide circle of friends. His photos showed him with friends in their graduation caps and gowns and one of him holding his newborn niece. Here, among all these memories, were his coworkers, friends and family. Each was a potential connection with more information about him, and the day he died.
This is how his brother, Abdul Hadi Alkoazay, was found. He describes Abdul Hamid as kind, hard working, honest and pious. “His death is a huge loss for us,” he says. Their mother was still deep in grief. Abdul Hamid had also been supporting the family financially as their younger brother studied at university, he adds.
The OSINT team also uncovered an article that gave a name for the charity and one of its directors – who was then tracked down via social media. It was called Coordination of Humanitarian Assistance (CHA), and had been working in Afghanistan since 1987 on health, environmental issues, education, water provision, community development and disaster and emergency response.
Haji Malik, the charity’s provincial director, confirmed Abdul Hamid’s death and provided the name of the other man who died that night: Abdul Rahim Jan. Malik could not understand why the office had been targeted and his employees killed, saying there was no Taliban presence in the immediate vicinity.
Speaking with Malik helped the team piece together the events of that night. Abdul Hamid and Abdul Rahim had stayed the night at the charity’s office, which was not uncommon – the building served as an office, but also as a safe place to stay for staff; Taliban fighters have repeatedly targeted NGO staff. At about 1.20am, a strike hit, killing them both instantly.
Abdul Rahim was 22 and had married a month before his death. He worked as a supervisor at the charity, which he had joined relatively recently. “He was such a softly spoken person. He was a very good man with the best manners,” says one of his colleagues. Malik claims the local governor had told CHA the strike had been conducted by US forces – but no one from the US military had contacted the charity, and, he says, no compensation had been paid to the families.
Read more: The ruins of Mosul have exposed the future of high-tech warfare
Using open-source investigation tools – starting with tweets and international media – created enough new leads to get closer to the truth. Progress – be it big or small – was possible in all the 21 cases opened up to the online community. In some cases it was only possible to uncover additional reporting or unverifiable social media posts about the strikes, but in others it was possible to confirm strikes and their civilian death toll, putting names to numbers.
The OSINT team took its findings to the US military press office based in Bagram airfield, Afghanistan. The US military did not respond to any of the specific allegations put to it. “The global community has been very clear – the best way to protect civilians in Afghanistan and prevent civilian casualties is to stop the fighting,” a US Forces - Afghanistan spokesperson says. “Reducing the violence is an absolute necessity – and this is up to the leaders of all military forces. Attacks generate attacks, while restraint produces restraint. All sides must choose restraint to prevent more killing and violence.”
The spokesperson cites “a drastic increase in Taliban violence” since the agreement was signed at the end of February and added: “We call on the Taliban to live up to their commitments, reduce violence now, take part in intra-Afghan negotiations, and make real compromises for a lasting peace that benefits all Afghans.”
In its response, the US Forces did not make any reference to civilian casualties in 2019, when all of the strikes we investigated took place. The Afghan military did not respond to questions.
Despite the lack of official answers, there are still reasons to hope for better. Contributors from across the globe helped collect information that can be added to the Bureau’s database, making the picture of what happened clearer. “There is so much information on the internet,” says Rawan Shaif, an open source investigator, who is not connected to the project. “Open source gives you accessibility to locations that are hostile, it’s using the power of people who are there.”
Shaif began employing these techniques to examine airstrikes in Yemen carried out by the Saudi-led coalition. By looking at freely available satellite imagery, she could see entire civilian areas obliterated by bombs. She turned this into a more comprehensive investigation, working with Bellingcat to collect and preserve evidence. “Part of the project was to prove a point to the government that post-strike assessments could be done using open source data,” Shaif says. “And if we could do it, they should be able to do it too.”
Abdullahi Hassan agrees that poor responses from military forces do not undermine the value of OSINT work. “Documenting and gathering evidence on each strike with civilian casualty allegations is extremely important,” Hassan says. “You don’t know when people will be held accountable. Justice might happen for these families one day.”
Rawan has similar hopes for Yemen. “Accountability isn’t always immediate,” she says. “I’m pro long-term preservations, long-term archiving, making sure this information exists in years to come. One day Yemen may have a legal system that is wholesome and transparent. One day they may pick this up and there may be local reckoning.”
Jessica Purkiss is a reporter at the Bureau of Investigative Journalism who has investigated air strikes for the past four years. This piece forms part of the Shadow Wars investigation into civilian casualties and accountability in Afghanistan
This article was originally published by WIRED UK
