Government ministers hurried into an underground conference room in central London for a crisis-response meeting. A chemical weapons attack had taken place on British soil; it looked like an assassination attempt. The Skripals remained on ventilators in a hospital, pumped full of atropine, under sedation, and under armed guard. Britain needed to respond. 

Suspicions turned to the Kremlin – one victim had been a former colonel in Russian military intelligence who had worked as a double agent for the British. On 4 March 2018, he and his daughter were found slumped on a bench in the peaceful English city of Salisbury, both on the verge of death. Moscow denied responsibility.

By coincidence, the British defence lab that studies such poisons, Porton Down, happens to be a few miles outside Salisbury. Chemical-weapons experts there were urgently studying blood samples from the sixty-six-year-old Sergei Skripal and his thirty-three-year-old daughter, Yulia. The results came back: Novichok A234, a nerve agent that the Soviet Union had developed in the 1970s and 1980s, back when President Vladimir Putin was just an officer in the KGB. A smear on the skin could cause loss of vision, constricted breathing, incessant vomiting, convulsions, death. Intelligence analysts discovered that Russia had been intercepting communications between Skripal and his daughter before she flew from Moscow for a two-week holiday. Tracking Yulia, Russian operatives would have found her father.

“Either this was a direct act by the Russian state against our country,” Prime Minister Theresa May told the House of Commons, “or the Russian government lost control of this potentially catastrophically damaging nerve agent and allowed it to get into the hands of others.” Moscow had forty-eight hours to explain itself. 

At Bellingcat, we watched, awaiting a point of entry. Scattered around the globe, we are an online collective, investigating war crimes and picking apart disinformation, basing our findings on clues that are openly available on the internet — in social-media postings, in leaked databases, in free satellite maps.

Eliot Higgins. Image: Courtesy SKUP

During the months after the attack, Sergei and Yulia Skripal recovered, but Scotland Yard struggled to solve the case. As they sought answers, further poisonings occurred. A man from the Salisbury area whose addictions led him to scavenge in rubbish found what he thought was a bottle of perfume and presented it to his girlfriend. She sprayed it on her wrists and became gravely ill. On 8 July, the hospital turned off her life support. The Organisation for the Prohibition of Chemical Weapons analysed samples from this fake perfume bottle and confirmed that it contained Novichok. “The nerve agent is one of the rarest chemical warfare agents in the world and its discovery, twice, in such close proximity is beyond a coincidence,” British counter-terrorism police said. The assassins seemed to have dumped the container, which was full of enough nerve agent to kill thousands of people.

Six months after the Skripal attack, the police at last provided what we needed. Images showed two Russian men arriving at Gatwick Airport a couple of days before the poisoning, travelling together by train from London to Salisbury on consecutive days and lurking near the defector’s home. The authorities needed help identifying these two, so published images of the suspects, who had travelled under the names ‘Alexander Petrov’ and ‘Ruslan Boshirov.’ Scotland Yard hoped someone might recognise them. The Kremlin certainly did.

The future comes fast when the president demands it: the following day, 13 September 2018, the two suspects materialised in an interview on the Kremlin’s international news channel, RT. On the Bellingcat internal chat forum we fired messages back and forth, transfixed by this broadcast. The two men proclaimed themselves innocent, merely two friends who had taken a last-minute holiday to Britain to admire a provincial cathedral. They were not assassins, they protested, just entrepreneurs in the fitness industry.

Back on our internal message board, we were unanimous. These two were lying. If the British authorities could not determine who these men were, we would try. But there was little to go on. Photos of their faces. Their supposed names.

Within days, we had cracked the case.

Our Skripal investigations drew headlines around the world, and questions, too. How had a collective of self-taught internet sleuths identified a Russian “hit team”? Was that even plausible? Where had we come from? And what was “Bellingcat”?

The answers begin a decade ago, in that period when smartphones were beginning to spread globally and social media became the platform for personal relationships, opinions, images. Without intending to, humanity presented for public viewing the most revealing account of itself that the world had ever known. The innocents did not realise how much they were giving away. Nor did the guilty.

At the time I was just another computer enthusiast, an office worker in my early thirties with an unsatisfying job and an interest in the news. Then I had an epiphany. If you searched online, you could find facts that neither the press nor the experts knew yet. A smattering of other people had a similar realisation, and an online community drew together, converging around news events that had left clues on YouTube, Facebook, Twitter and beyond. As our efforts progressed, we gained sophistication, teaching each other the latest investigative hacks, cobbling together what cohered into a new field, one that connects journalism and rights advocacy and crime investigation.

This discipline is so new that it lacks a single name. Most common is “OSINT” for open source intelligence. But that shorthand derives from government intelligence, whose secretive practices diverge from the open and public mission of Bellingcat. A more accurate description is “online open source investigation.” What we do is far more than just internet research, though. We battle the counterfactual forces warping society. We insist on evidence. And we show ordinary citizens how to expose wrongdoing and demand accountability from the powerful.

This is an edited extract from “We Are Bellingcat: An Intelligence Agency for the People” by Eliot Higgins, published by Bloomsbury. It is printed here with permission. Bellingcat is a member of GIJN.

Additional Reading

How Open Source Experts Identified the US Capitol Rioters

What Journalists Can Learn from Navalny’s Investigative Team in Russia

Online Research Tools: A GIJN Resource Center Guide

Eliot Higgins is the founder of Bellingcat and the Brown Moses Blog. His work focuses on the weapons used in the conflict in Syria, and open source investigation tools and techniques.