Early in the morning of May 11, 2022, a group of journalists in the Israeli-occupied West Bank donned vests prominently marked “PRESS” and gathered on a street corner in the city of Jenin to cover a raid on a Palestinian refugee camp by the Israeli military.

By 7 a.m., several social media posts had made a claim that turned out, tragically, to be true: Palestinian-American journalist Shireen Abu Akleh – a senior correspondent for Al Jazeera, and a household name in the Middle East – had been shot and killed.

Initial statements by Israeli officials suggested that Abu Akleh had either been killed by an individual Palestinian fighter, or by a stray Israeli round fired at a Palestinian attacker, or that it was “not possible to unequivocally determine the source of the gunfire.”

However, investigative reporting teams from The Washington Post and the open source investigative nonprofit Bellingcat were among several organizations that concluded that, in fact, all the bullets fired toward the journalists were most likely fired by a single member of the Israeli Defense Forces (IDF) convoy.

In a GIJN webinar on Abu Akleh’s killing, Meg Kelly, a video reporter for The Washington Post’s visual forensics team, and two Bellingcat investigators – Giancarlo Fiorella and Nick Waters – shared the techniques they used to pick apart the Israeli narrative and find the likely true culprit behind the tragedy.

While the teams could not corroborate allegations from some witnesses that the group of reporters was targeted because they were journalists, Bellingcat did provide evidence suggesting that several shots were carefully aimed at the group and were not stray rounds.

Piecing Open Source Evidence Together

The Post’s reporting included witness interviews and original video at the site, while the Bellingcat team used high-resolution satellite imagery and ballistics analysis. Both teams used social media posts and open source forensic methods to detail where the parties were positioned, and their lines of sight at the critical moments.

As with other recent breaking news events — such as the storming of the US Capitol on January 6, 2021 – both organizations began with “discovery”: finding time-relevant livestreams and social media posts near that street in Jenin, and using online tools to download every video for later analysis.

The Post story described Abu Akleh’s last moments from a video they obtained: “A second burst of seven gunshots comes. The group again scrambles away from the corner. Someone calls out, ‘Who was hit?’ [Journalist Shatha] Hanaysheh yells for an ambulance because Abu Akleh had been shot.” The story continues: “Three more shots ring out. Then someone shouts, ‘Shireen! Medic! Medic!'”

The investigation centered on a 250-meter (270 yards) section of Balat Al Shuhada Street on the west side of the city. Arrayed along this generally-straight stretch: the group of Al Jazeera journalists at an intersection near the north end, an IDF column of five vehicles and several dismounted soldiers moving toward them from the south, and small groups of armed Palestinians hunkered down in side streets southeast of the column.

In the wake of the tragedy, all that was clear to global media was that both IDF soldiers and armed Palestinians had fired their rifles in the area that morning, and that no autopsy details would be available for weeks. So how did these teams conclude the IDF convoy was likely culpable in the killing?

The Washington Post’s investigation pieced together witness testimony and user-generated content, such as videos posted online, to piece together the moments around Abu Akleh’s killing. Image: Screenshot

Countering Official Versions of Events

All three of the webinar panelists said they examined the various official claims about the incident before reaching their own, very different conclusions.

Kelly said a video provided by one NGO helped dispel Israeli claims about one particular Palestinian fighter when the Post team geolocated his position relative to Abu Akleh on a satellite image. The overhead image showed the fighter’s view of the reporters was obstructed by several city blocks.

“The NGO video showed exactly the route where the gunman was moving, so we were able to say – ‘If you look at where she was, and where the Palestinian fighter was, it’s clearly impossible that he was responsible for the shooting’,” Kelly explained.

Meanwhile, Bellingcat used deep analysis of social media video and satellite imagery to dispute an alternate theory: that Abu Akleh may have been struck by a bullet shot by an IDF soldier returning fire on a Palestinian fighter standing between the convoy and the reporters. Their reporting pointed out that there were neither eyewitness reports nor video footage of any other armed men in between the IDF and the journalists.

In the webinar, Waters also shared images of three bullet marks grouped closely together in a tree behind Abu Akleh’s position at a street corner, as well as audio evidence that suggested a series of controlled shots using the same type of 5.56-caliber ammunition that is used by the IDF.

“We see videos showing Palestinian fighters firing on automatic, but the cadence of those shots is very different to the rhythm of the shots that hit at Shireen’s position,” Waters noted. “The gap between the shots suggests the person was aiming at this target. Also, to get that tight grouping, you have to be aiming carefully, and that was a good indication that these were aimed and deliberate shots.”

Bellingcat used spectrogram data analysis by a ballistics expert to determine the features of each rifle shot. Waters described the basic principle behind ballistic audio analysis: “When a rifle is fired, it produces two sounds. You get a sonic boom, or ‘crack,’ and you then have the sound of the muzzle blast, or ‘thump.’ So the further away you are as the target, the bigger the gap between the crack and the thump.”

Waters said reporters should bear in mind that rounds of the same caliber – like 5.56mm – can travel at different speeds, based on the weapon used.

Forensic Steps

Fiorella said the investigation began with a single credible tweet from early that morning.

“The first piece of data I found in real time was a tweet from Al Jazeera English, saying Shireen had just been shot, with a timestamp of 6:48 a.m.,” Fiorella explained. “So we had the timing to work with.”

Waters refined the timeline further, after finding a Facebook video of the incident from a resident that was timestamped at 6:40 a.m. However, the Bellingcat team chose not to publish that video for ethical reasons.

“It looked as if it was recorded from inside the home of a resident, and we didn’t want to link to the video out of concern the person might face some sort of consequences,” said Waters. “But it gave us an upper time limit of when the incident happened.”

Kelly said the reporting sequence for the Post team was the following: discovery, chronolocation, geolocation, verification, expert analysis, witness interviews, and on-site filming.

“When we learned she was killed, we immediately got on social media and pulled every video and visual we could find from TikTok, Twitter, Telegram, Instagram, Facebook,” she said. “We pulled all that into a spreadsheet, with as much information as we could tell on when they took place. We then started geolocation to understand where these things happened.”

Kelly’s team then sent audio and video evidence to an audio expert.

“We gave pieces of the audio to an expert who has worked with the FBI,” she said. “He was able to use the 13 gunshots from the two first bursts to identify that the gunman was 175 to 195 meters away from where the videos were filmed. Using that radius, we could see that the IDF vehicles were almost exactly at that distance.”

Fiorella said image resolution limits have been placed on major satellite platforms involving the Israel-Palestine region, but that Bellingcat was able to use a high-resolution Israeli satellite portal to examine the street in detail.

“With this resolution, we could move to the question of who was where,” he said. “We also had a very useful bodycam video released by the IDF, which shows the line of sight from the IDF convoy. This began to tell us the IDF had a much clearer line of sight to Shireen’s position than anyone else.”

Other tips for unmasking these kinds of shootings that emerged from the panel included:

• Put yourself in the social media shoes of witnesses. Bellingcat uses various automated discovery techniques – like grabbing the longitude and latitude of an event from Google Maps and pasting this code into TweetDeck along with the term “geocode:” to channel all social media posts from that place into one column. However, Fiorella said it’s also important to manually search for posts by thinking about how bystanders to events might share information. “You need to get creative, and ask yourself: ‘If I was there, and had the demographic characteristics of people there, where would I be on social media?’” he explained. “If I live in downtown Miami, maybe I’d use Twitter; in this case (Jenin), it would be TikTok or Instagram or Facebook.” He added: “Then you ask, ‘What are the words I’d be using to describe what happened?’ The first mentions of this event probably won’t say ‘Shireen Abu Akleh has been shot,’ because they likely wouldn’t know. Instead, they might say a ‘journalist’ or a ‘person’ has just been shot, so you search for those. Then you think, ‘What language would they use for those words?’”
• Use auto-archivers or third party sites to download social media videos. There are several options for rapidly downloading social media videos in the hours after incidents. For teams with basic command-line skills, the youtube-dl tool – used by the Post team in this case – is an excellent free option, which also includes new scraping features. An approach that requires no coding skills – used by Fiorella in the Abu Akleh case – is to manually download via a third party site, like Twitter video downloader. But Fiorella says the best workflow option is to set up an auto-archiver tool that can automatically archive video evidence in Google Sheets. “Our tech team put together an auto-archiver that you can find on the GitHub page. It’s a script you put in a Google Sheet, and any link you put in will be automatically downloaded to a server – TikTok, YouTube, whatever,” he said.
• Even videos that “show nothing” can be useful. The Post team found one long livestream shot in the area that did not show anything significant about the incident. But they found they could use the sheer length of that uninterrupted livestream – and audio and visual markers within it – to synchronize other, shorter videos that did show parts of the incident. “I want to stress that nothing visual was particularly interesting, but it was really just the fact that it was still streaming that we were able to match audio signatures to other videos that became really important,” she explained. The team used the Adobe Premiere Pro tool to sync the video clips.
• Verify videos without reliable timestamps using shadow analysis tools. Fiorella verified the time of some social media clips from the site by analyzing the long, early-morning shadows with an open source tool. “One technique we use a lot is shadow analysis – if the video has shadow in it, you can use a free tool called SunCalc, which you can use with an accuracy of a few minutes as to when an event occurred,” he explained.
• Seek more data from the people who film key videos. Having found one short TikTok livestream from a unique perspective, Kelly’s team reached out to the witness directly, and then found important additional data. “He provided us with his full livestreams as well as his metadata,” she said. Kelly added: “If I need to quickly get in touch with someone, maybe I’ll write a quick note, put it into Google Translate, and send them a direct message. Often, people will respond – maybe they’ll say ‘Actually, my friend shot this video; here’s how to get in touch with her.’ I’m lucky in that I work with several folks who speak Arabic fluently, so when it gets to the point of an interview, I can turn it over to them.”

Fiorella said open source investigations represent a fast-growing field in journalism, and recommended that young reporters consider learning some of the skills involved.

“Newsrooms should become skilled in open source forensic techniques,” Waters added, “but it must be combined with traditional sources of information – human sources and documents.”

Additional Resources

How the NYT’s Pulitzer-Winning Series Exposed Civilian Deaths in the Air War on ISIS

10 Lessons from Bellingcat’s Logan Williams on Digital Forensic Techniques

How Open Source Experts Identified the US Capitol Rioters

Rowan Philp is a reporter for GIJN. He was formerly chief reporter for South Africa’s Sunday Times. As a foreign correspondent, he has reported on news, politics, corruption, and conflict from more than two dozen countries around the world.