Sage Journals: Discover world-class research

Abstract

Online media is a blessing and a curse for academic research on war. On the one hand, the internet provides unprecedented access to information from conflict zones. On the other hand, the prevalence of disinformation can make it difficult to use this information in a transparent way. This article proposes digital forensic process tracing as a methodological innovation to tackle this challenge and make case study research on the causes of war fit for the social media age. It argues that two important features of process-tracing methodology – source criticism and Bayesian updating – are well developed in theory but are rarely applied to the study of armed conflict. Digital forensic process tracing applies these features to online media sources by drawing on the journalistic practice of open source intelligence (OSINT) analysis. This article uses the case of the war in eastern Ukraine’s Donbas region to illustrate the usefulness of the proposed methodology.

Keywords

disinformation open source intelligence (OSINT)process tracing Russia social media Ukraine

Introduction

Finding out why war occurs is an important objective of social science research. However, there is little agreement on how this can and should be done in practice. Reviews of the conflict studies literature highlight a wide variety of approaches and findings (see, for example, Cederman and Vogt, 2017; Dixon, 2009; Levy, 1998). Current research on the role of mass media in armed conflicts suggests that modern information technology further complicates this situation. The rise of the internet and the emergence of social media have dramatically increased the volume of information that accompanies war. Conflict parties and their supporters have tried to use this development to their advantage and turned the internet into a propaganda battleground (Bradshaw and Howard, 2017; Hoskins and O’Loughlin, 2015; Koltsova and Pashakhin, 2020; Siapera et al., 2015).

Researching the use of modern information technology for propaganda purposes is important for the understanding of modern warfare. However, a focus on disinformation leads to an overly pessimistic picture of the internet’s role in the study of armed conflict. It overlooks important research opportunities that come with the access to conflict zones provided by the internet.

Modern information technology presents researchers of armed conflict with a choice. One option is to abandon the search for causes of war and focus exclusively on a more interpretivist research agenda that investigates how war is framed and perceived by various actors. Alternatively, researchers can stay in a post-positivist lane and try to gain new insights into the causes of war by exploiting the fact that the internet offers access to conflict zones at an unprecedented scale. This article argues that the latter option is both feasible and worth pursuing but requires a new qualitative research agenda that approaches armed conflict in a more forensic way. The methodology of choice for this research agenda is digital forensic process tracing.

This argument will be presented in five parts. The first part will introduce process tracing. It will argue that existing theoretical work on the methodology proposes four benchmarks that process tracing researchers should consider. The second part will discuss the state of empirical process tracing research on armed conflict. It will argue that the current empirical literature neglects two of the four benchmarks – source criticism and Bayesian updating. At the same time, the current literature does not pay sufficient attention to the potential of online media as a data source. The third part will introduce the case of the war in eastern Ukraine’s Donets Basin (Donbas). It will argue that, in order to operate in the abundant but murky information environment surrounding this conflict, online media, source criticism and Bayesian updating are precisely what process tracing research needs to focus on. The fourth part will discuss how scholars can draw on the use of open source intelligence (OSINT) analysis by journalists and activists to shift process tracing in this direction. The result of this shift is digital forensic process tracing. The fifth part will return to the case of the Donbas to demonstrate the usefulness of this methodology. It will show that a digital forensic process tracing analysis of the April 2014 occupation of Sloviansk and Kramatorsk – an important critical juncture in the conflict – casts doubt on the way in which a sizeable part of the academic literature currently looks at this war. Finally, this article will conclude that digital forensic process tracing is relevant beyond the Ukrainian context and could play an important role in the future of social science research on armed conflict.

Process tracing: Definitions and methodological benchmarks

Process tracing is a social science methodology which tries to open the black box between cause and effect. In contrast to frequentist approaches, which infer cause and effect from the correlation of variables across multiple cases, process tracing takes a detailed look at individual cases and tries to find evidence of how a cause brings about an outcome. Hence, defined in its broadest sense, process tracing includes any academic writing that underpins a claim about cause and effect with a detailed case-based narrative. According to this definition, the academic literature that uses process tracing for the study of armed conflict is vast. However, some scholars have made attempts to formulate standards that define process tracing in a narrower way. In general terms, this methodological literature develops four benchmarks for methodologically rigorous process tracing research.

Process tracing researchers should separate their empirical evidence and their theoretical causal mechanism. Beach and Pedersen (2013: 33) stress that process tracing has to go beyond recounting a sequence of events. It has to compare the empirical evidence of the particular case to the hypothetical evidence a researcher would expect to see if a particular causal mechanism were at work.

Process tracing researchers should investigate alternatives to their proposed explanation. Bennet and Checkel’s (2015) list of best practices places particular emphasis on this point. They argue that ‘failing to consider a potentially viable explanation that readily occurs to the readers and critics of a case study can make the process tracing unconvincing’ (p. 23).

Process tracing researchers should be wary of taking their sources at face value. Beach and Pedersen (2013: 125–129) argue that, in order to turn observations into evidence, process tracing has to ‘assess the content’ and ‘evaluate the accuracy’ of observations. Fairfield and Charman (2017: 370) go a step further and argue that ‘evidence E should typically take the form “source S stated X”.’ Rather than postulating evidence as a statement of fact that is referenced to a source, process tracing analysts should evaluate the context and background of the source and the evidence contained in it. In other words, they should follow the example of historians by practising source criticism.

Process tracing researchers should address uncertainty through probabilistic reasoning. Many process tracing theorists advocate the use of Bayesian inference for this purpose (Beach and Pedersen, 2013: 83; Bennett and Checkel, 2015: 16; Fairfield and Charman, 2017). Bayes’ Theorem postulates that the probability of a hypothesis being true increases or decreases as pieces of evidence for or against it accumulate. In the words of Bennett (2009: 8), ‘the more unlikely a piece of evidence [E] is in light of alternatives to explanation H, the more that evidence [E] increases our confidence that H is true . . .’ Although it remains controversial whether it makes sense to assign specific numerical probabilities to qualitative evidence (Beach, 2017: 15; Fairfield and Charman, 2017; Zaks, 2021), applying the general principles of Bayesian inference can be considered another benchmark for process-tracing research.

It is primarily the last two benchmarks that make process tracing the methodology of choice for research that aims to use online media to investigate the facts of a contemporary war. The volume of information available online and the prevalence of disinformation make it absolutely essential to explicitly address the context of source material and the probabilistic conclusions that a researcher draws from this assessment. At the same time, the four benchmarks present an ideal type that few if any empirical studies are able to meet. Limits imposed by time, space or research design force researchers to prioritize certain benchmarks while neglecting others. In the recent empirical process tracing literature on war, source criticism and Bayesian updating usually fall victim to this. In turn, the de-prioritization of these two benchmarks may be a reason why the relevant literature has not paid much attention to online media as a data source.

Process tracing and war: The neglect of online media

Recent process tracing research on armed conflict has largely focused on the first two benchmarks – the creation of causal mechanisms and/or the testing of competing hypotheses (Bateson, 2017; Bukkvoll, 2019; Ceccorulli and Coticchia, 2015; D’Amato and Del Panta, 2017; Dawson, 2021; Eisenman, 2019; Ghais, 2019; Goodman, 2020; Hafez, 2020; Holtermann, 2019a, 2019b; Idler, 2020; Jenne, 2018; Mosinger, 2019; Pedersen and Reykers, 2020; Schenoni et al., 2020; Schwartz and Straus, 2018; Wolff, 2021). This is not to say that these studies are careless in their treatment of sources and have not considered potential limitations of their data. It simply means that source criticism and Bayesian updating are not key components of their empirical analyses. This may not be necessary within the specific research designs and source environments of these studies. However, source criticism and Bayesian updating are crucial for process-tracing research that aims to use primary information from a conflict zone which appears online to investigate politically contentious issues relating to the wars of the social media age.

At present, such research is rare. The examples of high-quality process tracing cited above mainly draw on interview data gathered during fieldwork, archival material, statements by government officials and secondary literature. Online media sources are used by some authors but play a secondary, supplementary role. An exception is Ceccorulli and Coticchia’s (2015) study that draws on a dataset of Italian newspaper reports as a key source of data. However, their research focuses on the statements and decisions of Italy’s political elite rather than on primary information from combatants or a conflict zone. Another exception is Hafez’s (2020) work on the Algerian civil war, which cites three YouTube videos. Two of these videos feature archival footage from the conflict, while the third one features a radio interview with a former rebel leader. In cases of more recent wars, however, the volume of important primary information from conflict zones available on both traditional and social media is much larger. A prime example of this is the Donbas war.

The Donbas war: A murky information environment

The war in the Donbas has been subject to a high level of media scrutiny from news outlets as well as local residents and freelance conflict analysts posting material on social media. This means that a large volume of information on the conflict is available online. At the same time, the political messaging surrounding the conflict is characterized by fundamental disagreements about its causes (Hauter, 2019: 96). The Ukrainian authorities have portrayed the war as a Russian act of aggression from its very beginning. The Russian authorities, on the other hand, have consistently denied any involvement. These two diametrically opposed narratives have shaped the way in which the conflict is discussed and analysed in politics and media. Supporters of either side try to give credence to their narrative and discredit the narrative of their opponents. The result is a large amount of disinformation that is added to the information mix and makes it difficult to separate facts from fiction. It is in the context of this abundant but murky information environment that academic research on the war has to operate.

Although the academic debate on the Donbas conflict is more nuanced than the positions of Kyiv and Moscow, it shows a divide that is similar to the divide in the political discourse (Hauter, 2019: 96–97, 2021a). One group of scholars argues that the conflict is an internationalized civil war, in which local rebels receive some support from Russia. Another group argues that the conflict is an invasion in disguise, in which agents of the Russian state receive some support from locals. Each hypothesis has different implications, not only for conflict resolution efforts but also for the way the war is used for further comparative research. Neither hypothesis, however, has been backed up by methodologically rigorous process tracing, let alone by process tracing that focuses on source criticism and Bayesian updating. These two dimensions, however, are indispensable in the abundant but murky information environment surrounding the Donbas conflict. To make good use of this source environment, process tracing research has to emphasize source criticism and Bayesian updating and move in a more forensic direction. It can do so by learning from the digital forensic work of civil society activists and investigative journalists.

Introducing digital forensic process tracing

The vast amount of information that modern information technology has made available to the general public through news websites, social media platforms, or other online tools is often referred to as Open Source Intelligence (OSINT). The origins of this term lie in the work of government intelligence agencies, where it is used to describe publicly available information (Gibson, 2013). OSINT analysis is the analytic technique that is used to identify, structure and verify OSINT data. In recent years, OSINT analysis has become a popular term to describe not only the work of government agencies but also investigations by activists and journalists based on openly available information. The investigative journalist group Bellingcat is the most prominent example. Long before an official report came to the same conclusion, Bellingcat succeeded in confirming the Russian origin of the missile launcher that downed Malaysian Airlines flight MH17 over the Donbas in July 2014. The key source of their investigation was photo and video material of the launcher that was published online around the time of the tragedy (Allen et al., 2014). This success story of OSINT analysis did not go unnoticed in the academic literature (Clem, 2017; Sienkiewicz, 2015). However, even though OSINT analysis has been the subject of academic work (see also Dyer and Ivens, 2020; Hayes and Cappa, 2018; McDermott et al., 2021; Pastor-Galindo et al., 2020; Senekal and Kotzé, 2019; Wheatley, 2018), its synergy effects with process tracing methodology have remained unnoticed. Naturally, the use of OSINT analysis by journalists and advocacy groups does not focus on academic debates and methodologies. At the same time, there is no academic work so far that explicitly incorporates OSINT analysis into process tracing methodology to answer research questions. The present article is trying to bridge this gap.

The methodological approach of OSINT analysis mirrors the requirements of the third and fourth process tracing benchmarks outlined in this article. Source criticism and the principles behind Bayesian updating are an integral part of any qualitative evaluation of OSINT data. The added value of OSINT analysis lies in its focus on the potential of online sources. In many cases, all it takes to harness this potential is the skilful use of online search engine algorithms to find primary sources of evidence followed by careful contextual analysis and cross-checking of these sources (Myers, 2020; Toler, 2020). In some cases, OSINT researchers may also use a number of tools to make source discovery and verification more effective – Bellingcat’s (nd) Online Investigation Toolkit database provides a good overview.

Whether it contents itself with careful online searches and content analysis or makes use of more complex tools, the incorporation of OSINT analysis enhances process tracing research on the causes of war in two important ways. Firstly, it shifts the methodological focus to source criticism and Bayesian updating. Secondly, it shifts the empirical focus towards the abundance of primary information from conflict zones that is available on the internet in general and on social media in particular.

Moreover, the origins of OSINT analysis in the intelligence community point to a potential compromise in the debate on the use of numerical probabilities in the assessment of qualitative evidence in process tracing (Beach, 2017: 15; Fairfield and Charman, 2017; Zaks, 2021). Instead of assigning specific numerical probabilities to hypotheses, process-tracing researchers could adopt the terminology of the Professional Head of Intelligence Analysis (PHIA) Probability Yardstick. This is a scale of probabilistic language widely used by UK intelligence and law enforcement agencies (UK Government, 2019: 10). It defines specific terms to describe specific margins of probability. These terms and margins are: remote chance (≈5%), highly unlikely (≈10–20%), unlikely (≈25–35%), realistic possibility (≈40–50%), likely (≈55–75%), highly likely (≈80–90%), and almost certain (≈95%). Using this terminology adds a probabilistic dimension to process tracing and follows the general principles of Bayesian updating without creating a false impression of mathematical accuracy. This article calls this approach informal Bayesian analysis, in contrast to the formal Bayesian analysis discussed by Fairfield and Charman (2017) and Zaks (2021).

Case study: The occupation of Sloviansk and Kramatorsk

The remainder of this article will demonstrate the usefulness of digital forensic process tracing by investigating the causes of an important turning point in the Donbas war. On 12 April 2014, a group of armed men seized police stations in the towns of Sloviansk and Kramatorsk in the north of Ukraine’s Donetsk region (YouTube, 2014c, 2014g). The following morning, some of these men attacked Security Service of Ukraine (SBU) operatives just outside Sloviansk. One person died and several were injured. On the same day, Ukraine’s interim President announced the launch of an ‘antiterrorist operation’ involving the Ukrainian Armed Forces (YouTube, 2014d). The killed SBU operative was the Donbas conflict’s first battle-related casualty, which means that the armed clash of 13 April marks the dividing line between peace and armed conflict according to the Uppsala Conflict Data Program’s coding rules (UCDP, nd). For this reason, the occupation of Sloviansk and Kramatorsk was an important critical juncture in the war’s formative escalation sequence (Hauter, 2021b: 154, 158). This does not mean that an investigation of this episode is sufficient to establish the causes of the entire war. However, the immediate causes of the events of 13 April 2014 are an important piece in the larger puzzle of the war’s causes and a key point of contention in the academic debate on the topic.

An important actor and information source in the context of this critical juncture is Igor Girkin (also known as Igor Strelkov or Strelok), the head of the armed group that occupied Sloviansk and Kramatorsk. Girkin has made frequent media appearances both during and after his time in the Donbas. He provided a particularly detailed account of his activities in an interview with Ukrainian journalist Dmytro Hordon, which was published in May 2020. As on previous occasions, Girkin confirmed in this interview that he was a Russian citizen and worked for Russia’s internal FSB intelligence service until 2013 (YouTube, 2020: from 13:05). However, he challenged Hordon’s assertion that he and his men were Russian agents. Girkin claimed that his group mainly consisted of Ukrainian volunteers and that neither he nor any other group members were working for the Russian state (YouTube, 2020: from 58:14).

This disagreement between Girkin and his interviewer has important implications for the academic debate between scholars who stress the importance of local causes and those who stress the importance of Russian intervention in the Donbas conflict. If Girkin and his group were acting on behalf of the Russian state, the actions of Russian state organs would be the immediate cause of an important critical juncture early in the Donbas war. Even though there are limits to the role of a single critical juncture within the war’s larger context, this finding would make it more difficult to argue that the Donbas war was primarily a domestic phenomenon. Hence, it is not surprising that the divide between proponents of domestic and foreign causes of the war is also visible in different scholars’ characterization of Igor Girkin. Some portray Girkin and his men as mavericks, who were not acting on behalf of the Russian authorities (Katchanovski, 2016: 479–480; Kudelia, 2016: 14–17; Robinson, 2016: 511). Others portray Girkin as an agent of the Russian state (Kuromiya, 2019: 257–258; Mitrokhin, 2014: 167–170; Wilson, 2016: 648).

This divide in the characterization of the key actors leads to two contradicting hypotheses regarding the causes of the occupation of Sloviansk and Kramatorsk. Each of the two hypotheses is associated with a specific causal mechanism (Figures 1 and 2). Naturally, both causal mechanisms are simplifications. They are examples of ‘linear colligation’, in which the ‘most disruptive or abnormal’ conditions were selected from a large web of contributing factors (Roberts, 1996: 109–110). Neither mechanism presents an exhaustive explanation. However, the two mechanisms represent the two primary causal dynamics that dominate the political and academic debate on the events in question.

H1: Igor Girkin and his men were non-state actors who participated in the conflict as part of a domestic separatist movement.

H2: Igor Girkin and his group were agents of the Russian state and their participation in the conflict was an act of external intervention.

Figure 1.

Sloviansk/Kramatorsk internal conflict escalation sequence. © Jakob Hauter.

Figure 2.

Sloviansk/Kramatorsk Russian intervention sequence. © Jakob Hauter.

These two contradicting hypotheses and the two associated causal mechanisms will now be tested against the available online media evidence. As a starting point for informal Bayesian analysis, it is appropriate to begin with the assumption that H1 is likely while H2 is unlikely. This assumption is based on two philosophical principles that are widely known as Occam’s razor and the Sagan standard. Occam’s razor calls for the rejection of ‘theoretical constructs that are “superfluous”, in the sense that they are not strictly demanded by the evidence’ (Pigliucci and Boudry, 2014: 493). In the present case, the hypothesis that a group of volunteers decided to seize Sloviansk and Kramatorsk does not require the additional theoretical construct of Kremlin instruction or approval, unless there is evidence that demands this addition. The Sagan standard, on the other hand, postulates that ‘extraordinary claims require extraordinary evidence’ (Pigliucci and Boudry, 2014: 500). In the present case, an act of Russian aggression against its neighbour is a more extraordinary claim than conflict escalation by a group of maverick volunteers. This means that, in order to overcome the initial burden of proof, H2 requires strong evidence in its support. Such evidence could come from eyewitness accounts, intercepted communications, or circumstantial observations which point at a principal–agent relationship between Girkin and the Russian state.

Updating Stage 1: The militia’s Crimean origins

Even though H2 starts off as the weaker hypothesis, the available online media evidence allows for three stages of informal Bayesian analysis which not only flip the balance of probabilities but raise the probability of H2 to almost certain. The first stage is based on evidence that Girkin’s group formed in Crimea and included many people who had been involved in Russia’s takeover of the peninsula. Girkin himself never made a secret of this and at least two journalists working for nationalist Russian websites confirmed his leading role. Sergey Shargunov said that he had met Girkin in Crimea in late February 2014 as an authority figure among the paramilitary groups which supported the Russian takeover (Svobodnaya Pressa, 2014). Oleg Kashin also wrote that he met Girkin in Crimea in March as an influential figure (Sputnik i Pogrom, 2014a, 2014b, 2014c). In his interview with Hordon, Girkin again confirmed his involvement in the events (YouTube, 2020: from 30:00).

Numerous other members of Girkin’s group have either spoken about their involvement in the Crimean takeover on social media or have been mentioned in the accounts of their comrades-in-arms.

Yevgeniy Skripnik appears with Girkin in the first seconds of a video taken in Sloviansk on 12 April (YouTube, 2014g). Later, Skripnik confirmed in an interview that he had come to Sloviansk from Russia via Crimea, where he took part in the takeover of the peninsula (YouTube, 2014e: from 06:48 and at 15:55). He also confirmed that he had known Girkin since their involvement in the Transnistrian conflict in 1992 (YouTube, 2014e: at 09:35).

Vladimir Kollontay died near Sloviansk in June 2014. In an obituary on the Russian social network VK, Andrey Afanasyev (2016), a well-connected supporter of Donbas separatism from Novosibirsk, wrote that Kollontay had served as a Russian intelligence operative in Chechnya and had taken part in the takeover of Crimea. In a post in the forum of the Novorossiya Movement, which Girkin founded after he returned to Russia, Girkin (2016) confirmed that Kollontay had served with him in Transnistria and both Chechen wars.

Ilya Khokhlov and Viktor Anosov talked about their involvement in the Sloviansk operation on a Russian nationalist YouTube channel. Anosov posted his remarks in response to Khokhlov and accused him of misrepresenting various details. However, he confirmed that both of them were from Simferopol, took part in the takeover of Crimea and went to Sloviansk as part of Girkin’s group (YouTube, 2019b, 2019c).

Igor Bezler was a member of Girkin’s group who, according to Anosov and Khokhlov’s consistent testimonies, was sent from Crimea to the Donbas early on a reconnaissance mission. In an interview with a Russian state news agency, Bezler confirmed that he was a Russian citizen and army veteran who had taken part in the takeover of Crimea (RIA Novosti, 2014).

Aleksandr Mozhayev, a Russian citizen from the town of Belorechensk in Russia’s Krasnodar District, identified himself by showing his passport to Vice News journalist Simon Ostrovsky in Kramatorsk (YouTube, 2014a). Speaking to another journalist, Mozhayev also talked about his involvement in the occupation of Crimea (Time Magazine, 2014).

Igor Georgiyevskiy, a resident of Simferopol, is visible in the background of Ostrovsky’s video and was also photographed together with Mozhayev by photojournalist Maxim Dondyuk (Ukrainska Pravda, 2014). He was later identified by Ukrainian activists through his social media profile, where he posted personal information and pictures of himself among paramilitary forces in Crimea (Garmata.org, 2014).

Four other members of Girkin’s group, Andrey Savelyev, Vadim Ilovchenko, Igor Druz and Dmitriy Zhukov, appeared together in Crimea’s Sevastopol at a promotion event for a book written by Savelyev (YouTube, 2019a). At this event, Savelyev, Druz and Zhukov described themselves as pro-Russian residents of Kyiv who went to Crimea after the Euromaidan revolution and participated in the Russian takeover under Girkin’s command before following him to Sloviansk. Ilovchenko described himself as a Crimean Cossack leader. He said he met Igor Girkin in early March, served with him in Crimea, and followed him to Sloviansk. These basic facts of the four militiamen’s accounts are consistent with two investigative articles on their identity and background published by Ukrainian journalists (Espreso TV, 2018; TSN, 2019).

According to Girkin, the group that he led from Crimea to Sloviansk comprised a total of 54 men (YouTube, 2020: 57:48). Background information on many group members remains patchy or non-existent. Nevertheless, the described social media evidence on 11 of them offers considerable insights into the group’s composition. It suggests that Girkin’s men were recruited primarily from the paramilitary forces which supported the Russian takeover of Crimea. These forces included Russian military and intelligence veterans as well as residents of Crimea and some pro-Russian activists from Kyiv. However, as Crimean Cossack leader Vadim Ilovchenko openly admitted, paramilitary groups in Crimea coordinated their actions with Russia’s intelligence agencies from the very beginning of the operation (YouTube, 2019a: at 33:15). There is no reason to doubt his words. In a March 2015 Russian TV documentary, Vladimir Putin himself admitted that the takeover of Crimea was planned in the Kremlin and that Russia’s military and security apparatus was in charge of its implementation (Rossiya 24, 2015: from 1:47, from 1:06:44 and at 1:13:32). Hence, it is almost certain that any paramilitary group assisting the Russian takeover was under the close supervision of Russian state structures.

Evidence that the men who occupied Sloviansk and Kramatorsk were the same people who helped the Russian state annex Crimea shifts the burden of proof from H2 to H1. Against the backdrop of this evidence, the hypothesis that Girkin’s group continued to act on behalf of the Russian state is both simpler and less extraordinary than the hypothesis that they went rogue and acted on their own. In the absence of evidence to the contrary, it appears unlikely that a paramilitary group that collaborated with Russia’s security services was able to travel from Crimea to the Donbas without their knowledge and approval. This does not necessarily imply that Girkin and his group were following an explicit command from the Russian state when they moved to the Donbas. However, this is of secondary importance, as this article will discuss further below.

Updating Stage 2: The oligarch and the ‘Prime Minister’

The second stage of updating draws on a series of recordings that the SBU published on 14 April 2014. According to the SBU, the recordings were phone conversations of militiamen in Sloviansk that were intercepted the previous day. In one of the recordings, a person addressed as ‘Strelok’ reports to a person addressed as ‘Konstantin Valeriyevich’ about an armed clash with Ukrainian security operatives (YouTube, 2014b: from 04:05). Strelok says that his group fired at three cars. In response, Konstantin Valeriyevich asks if Strelok has ‘briefed Aksyonov’. After Strelok says that he has not been able to get hold of Aksyonov, Konstantin Valeriyevich tells him to keep trying but also mentions that Aksyonov ‘will land here tonight’ and that he ‘will meet with him tomorrow’.

The voices in the recording almost certainly belong to Igor Girkin (call sign Strelok) and Konstantin Valeriyevich Malofeyev, a Russian oligarch and campaigner for conservative Russian Orthodox values. The recording is almost certainly an authentic conversation between these two men for the following reasons:

Although Malofeyev denied collaborating with Girkin in Sloviansk and Kramatorsk, he admitted in a newspaper interview that Girkin used to work for him and had travelled with him to Kyiv as recently as January 2014 (Vedomosti, 2014). Girkin confirmed this and even admitted that Malofeyev had financed him during the Crimean operation and that he had bought the combat gear for the Sloviansk operation with Malofeyev’s money (YouTube, 2020: from 28:15 and from 1:20:40).

Russian journalist Oleg Kashin wrote that he had met Girkin in Crimea in early March as a senior member of Crimean ‘Prime Minister’ Sergey Aksyonov’s staff (Sputnik i Pogrom, 2014a, 2014b, 2014c). Girkin himself confirmed that he closely collaborated with Aksyonov in Crimea (YouTube, 2020: from 28:45) and even admitted that he went to Sloviansk ‘with Aksyonov’s direct support’ (YouTube, 2020: at 52:52).

According to a Crimean news agency, Aksyonov participated in an event in Crimea on the morning of 13 April (KrymInform, 2014). According to the Kremlin’s official website, he met Vladimir Putin in Moscow the following day (Kremlin.ru, 2014). This is in line with Malofeyev’s description of Aksyonov’s travel plans, assuming that Malofeyev was in Moscow at the time of the conversation.

Girkin’s description of the armed clash near Sloviansk matches footage from the scene that was shown on Russian TV channel LifeNews, which features three damaged cars (YouTube, 2014f).

The SBU published its recordings on 14 April. Fabricating a recording with plausible voice imitations and the observed degree of detail within a day does not seem realistic, especially given that the SBU was facing a crisis situation at the time.

The fact that Girkin reported back to Malofeyev and Aksyonov after the occupation of Sloviansk further decreases the probability that Girkin’s group stopped acting as an agent of the Russian state after moving from Crimea to the Donbas. The amicable, respectful tone of the conversation between Girkin and Malofeyev, combined with Girkin’s claim that Aksyonov supported his actions, make it highly unlikely that Girkin was no longer acting on behalf of the two men. In turn, there is only a remote chance that Malofeyev and Aksyonov did not coordinate their actions with the Kremlin. Malofeyev’s links to the Kremlin are corroborated by a set of leaked emails published by Ukrainian activists and attributed to Kremlin officials. According to these emails, Malofeyev had met Kremlin advisers Sergey Glazyev and Vladislav Surkov in late 2013 to discuss ways to prevent Ukraine’s integration with the West (Hosaka, 2018: 361, 2019: 753–755). Hosaka (2018: 322–323) reports that he examined the context, content and metadata of sample emails and is confident that the leak is authentic. Of course, there remains a chance that he is mistaken and the emails are fabrications, but this can be considered unlikely. Hence, combined with the general proximity between oligarchs and the state in modern Russia, the emails are strong evidence that Malofeyev acted with Kremlin approval. Crimean ‘Prime Minister’ Sergey Aksyonov’s links to the Kremlin are even clearer. According to Russian law, Aksyonov was heading a newly incorporated Russian Federation subject. This means that a newly appointed Russian state official was directly involved in the Sloviansk operation and met Vladimir Putin one day after the first armed clash. Considering Aksyonov’s dependence on the Kremlin, it is hard to imagine that he risked acting without Putin’s knowledge or against his wishes. For these reasons, Girkin’s continuing communication with Malofeyev and Aksyonov after the start of the Sloviansk operation increases the probability of H2 to highly likely and make it highly unlikely that H1 is correct.

Updating Stage 3: Refuge in Russia

The third and final stage of updating draws on the absence of any actions by the Russian authorities to restrict or sanction the activities of Girkin, Malofeyev, or Aksyonov. If Girkin’s armed group and its backers acted without the knowledge and the support of the Russian authorities, it could be expected that the Russian state take actions to either stop their activities or punish them. Neither was the case. In the years that followed, Girkin and Malofeyev lived in Moscow without ever facing an investigation. On the contrary, Girkin was able to create his Novorossiya Movement within Russia’s strictly regulated NGO environment. Andrey Savelyev was able to publish a book on how he fought for Girkin’s group at the age of 16 and promote it in Russia and Crimea together with his former comrades-in-arms. Aksyonov is still leading Crimea at the time of writing. Added to the previous two stages of updating, this inaction on the part of the Russian authorities makes it almost certain that Girkin and his group acted as agents of the Russian state. It leaves only a remote chance that they participated in the conflict as non-state actors who were part of a domestic separatist movement.

Caveats: Informality and local support

Although the available online media evidence strongly supports H2, the explanatory power of the causal mechanism associated with this hypothesis comes with two important caveats. Firstly, the causal mechanism does not specify whether the Kremlin ordered or merely approved Girkin’s Donbas operation. This question is left open deliberately because conclusive evidence in relation to it is virtually impossible to find. Any official order to intervene in the Donbas would almost certainly be a top-secret matter that none of those involved would consider disclosing. If any written documentation of such an order exists, it is almost certainly stored in Russian intelligence archives and remains inaccessible for the foreseeable future. At the same time, several subject matter experts argue that the informal practices of Russia’s security apparatus avoid explicit orders and make it difficult to draw a dividing line between command and approval. According to Russian journalist Oleg Kashin, Putin may have told Malofeyev to ‘do whatever’ rather than giving precise instructions (Kashin et al., 2014). This is in line with the assessment of former Kremlin consultant Gleb Pavlovsky (2016), who argues that the Putin regime’s ‘new governance style relies on indirection and interpretation rather than command and control’. Pavlovsky highlights the importance of ‘otmashka, which can be translated as “go-ahead,” implying not so much an order as a license to act in a desired direction.’ Bellingcat’s lead Russia investigator Christo Grozev (2020) makes a similar point, arguing that the Russian state outsources interference abroad to private actors, who offer ‘competing, but always deniable, solutions to the Kremlin, and enjoy significant freedom’. All these interpretations appear plausible, but, like the potential existence of an explicit order, they are extremely difficult to prove. However, the question of who exactly initiated the Sloviansk operation is of secondary importance. Following the historical explanation paradigm of abnormalism (Roberts, 1996: 96–99), Kremlin knowledge and approval of the operation is sufficient to establish Russian state responsibility as its primary cause. It is not surprising that there were some actors in Russia who were willing to intervene in Ukraine for ideological reasons. Far more abnormal, and hence more important as a cause, is the fact that the Russian state was prepared to approve and support their actions, de facto co-opting them to act on its behalf.

The second caveat that has to be addressed is the role of local residents supporting Girkin’s intervention. Girkin claims that ‘about 300 activists were ready and waiting when we arrived’ (Svobodnaya Pressa, 2014). This number may be exaggerated, but the claim that a group of local separatists was ready to actively support Girkin is in line with the available evidence. Video footage from Sloviansk from 12 April not only shows cheering local bystanders but also a group of people in civilian clothing, who help the armed men guard the occupied police station (YouTube, 2014g). However, it is undisputed that Girkin’s men not only initiated the Sloviansk operation, but also remained in charge of the separatist forces in the area until their forced withdrawal in early July. Moreover, there is no evidence that local separatist activists in Sloviansk would have been able and willing to organize an armed occupation on their own if Girkin’s group had not come. Hence, even though Girkin’s group depended on local support, the abnormalism paradigm points to Girkin’s intervention as the primary condition for the occupation and the subsequent escalation of the conflict. In the context of the political situation in eastern Ukraine in April 2014, it is not surprising that there were some activists in Sloviansk and Kramatorsk, who were willing to support a Russian intervention. The arrival of a group of heavily armed men from Russia is far more disruptive to the normal course of events than the fact that a group of locals was willing to jump on this group’s bandwagon.

Hence, despite these two caveats, an informal Bayesian analysis of the available online media evidence strongly suggests that the crossing of the threshold between peace and armed conflict in the Donbas was primarily the result of Russian intervention. A more detailed account of the causal dynamics at play should mention the difficulty of tracing decision-making processes within the Russian elite and the fact that the intervention was supported by locals, while stressing the secondary nature of these factors. A reductionist account aiming to single out the most significant factor should focus on the intervention sequence.

Conclusion

This article has demonstrated how social scientists can use online media to gain a better understanding of the causes of war. It has argued that the internet is a treasure trove of information rather than just a propaganda dump. Online sources have provided conflict-studies researchers with access to valuable primary data from conflict zones on an unprecedented scale. This information has the potential to greatly improve case-study research on the causes of war. Harnessing this potential, however, requires methodological rigour and argumentative transparency. This means that process-tracing research on armed conflict needs to pay additional attention to source criticism and Bayesian updating.

For this purpose, this article has proposed a forensic approach to process tracing that incorporates OSINT analysis into the methodology. This digital forensic process tracing enables transparent and methodologically rigorous case-study research that can deliver reliable findings even in murky information environments. It sheds light on causal processes while making use of the internet’s full potential as an access route to primary information from conflict zones.

This article has used the proposed methodology to analyse the occupation of Sloviansk and Kramatorsk – an important critical juncture in the Donbas conflict. The analysis has shown that, in the light of the available online media evidence, it is almost certain that the primary cause of these events were the actions of an armed group that was an agent of the Russian state. Local separatist activism played a secondary, auxiliary role.

This finding represents a serious obstacle for the hypothesis that the Donbas conflict is primarily a domestic phenomenon that was caused by local separatist forces. The present case study proves that Russian intervention was the primary cause for the conflict’s first armed clash and its first battle-related casualty. However, this is only one piece in a much larger puzzle. The occupation of Sloviansk and Kramatorsk was followed by outbreaks of violence in many other parts of the region (Hauter, 2021b: 154, 158–160). This means that more research is required to assess the interplay of local factors and Russian intervention throughout the conflict’s formative phase. Nevertheless, the findings of the present case study are an important component of this bigger picture and the methodology developed in this article offers a solid foundation for further investigations of other episodes of the conflict.

Moreover, the forensic methodology proposed in this article has potential beyond the case of the Donbas. It can be used to research causal processes in any conflict that has been subject to extensive first-hand coverage on the internet. An obvious example is the war in Syria, where digital forensic process tracing could be used for a variety of purposes: to identify shifts in the composition and strategy of different rebel groups, to evaluate the impact of foreign intervention on the course of the conflict, or to track the use of chemical weapons. A large quantity of potentially useful OSINT has been gathered and catalogued by the Syrian Archive project. Similarly, digital forensic process tracing could yield valuable insights into the alleged intervention of Russian state-sponsored mercenaries in several African countries. Another topical case is the latest escalation of violence in Nagorno-Karabakh in autumn 2020, which was subject to intense media scrutiny while Armenia and Azerbaijan and their respective allies were pushing contradicting accounts of events. This list of potential cases is by no means exhaustive.

Finally, the use of elements of digital forensic process tracing at the data-gathering stage of a research project may also benefit scholars who use frequentist approaches. The use of source criticism and informal Bayesian analysis could significantly improve the quality of event data on war. Treating data points as mini case studies would enable more precise coding and the inclusion of a wider range of sources in conflict datasets. Naturally, this would also increase the workload involved in the creation of such datasets. However, the combination of abundance and murkiness that characterizes information on armed conflict in the social media age could make this effort worth the while. In any case, the internet’s dominance over the information environment in which armed conflict takes place is highly unlikely to disappear, which means that the importance of digital forensic process tracing for research on war will only grow.

Footnotes

Acknowledgements

The author would like to thank two anonymous reviewers for their helpful comments which greatly improved the present article. The author would also like to thank his PhD supervisors, Professor Andrew Wilson and Dr Ben Noble, for encouraging him to publish this article and for their feedback on earlier drafts.

Funding

The author received no financial support for the research, authorship and publication of this article, and there is no conflict of interest.

ORCID iD

Jakob Hauter

Author biography

Jakob Hauter is a PhD candidate at UCL SSEES. His PhD project focuses on the causes of the armed conflict in Ukraine’s Donbas region. His general research interests are Ukrainian and Russian politics and the use of internet data for the analysis of political developments. He is the author of the academic articles “Delegated interstate war: Introducing an addition to armed conflict typologies” (Journal of Strategic Security, DOI: 10.5038/1944-0472.12.4.1756) and “How the war began: Conceptualizing conflict escalation in Ukraine’s Donbas” (Soviet and Post-Soviet Review, DOI: 10.30965/18763324-20201380). He is also the editor of the volume Civil War? Interstate War? Hybrid War? Dimensions and Interpretations of the Donbas Conflict in 2014–2020 (Stuttgart: ibidem-Verlag).

References

Afanasyev

(2016) Pamyatnoye slovo o Voine-Rodnovere. Available at: http://archive.vn/k8QwW (accessed 22 September 2020).

Allen

, et al. (2014) MH17: Source of the Separatists’ Buk. Available at: https://bit.ly/3oa1ZTa (accessed 13 May 2021).

Bateson

(2017) The socialization of civilians and militia members: Evidence from Guatemala. Journal of Peace Research 54(5): 634–647. DOI: 10.1177/0022343317721812.

Beach

(2017) Process-tracing methods in social science. Oxford Research Encyclopedia of Politics. DOI: 10.1093/acrefore/9780190228637.013.176.

Beach

Pedersen

(2013) Process-Tracing Methods: Foundations and Guidelines. Ann Arbor: University of Michigan Press.

Bellingcat (nd) Bellingcat’s Online Investigation Toolkit. Available at: https://bit.ly/bcattools (accessed 13 May 2021).

Bennett

(2009) Process tracing: A Bayesian perspective. In: Box-Steffensmeier

, et al. (eds) The Oxford Handbook of Political Methodology. DOI: 10.1093/oxfordhb/9780199286546.003.0030.

Bennett

Checkel

(2015) Process tracing: From philosophical roots to best practices. In: Bennett

Checkel

(eds) Process Tracing: From Metaphor to Analytic Tool. Cambridge: Cambridge University Press, 3–37.

Bradshaw

Howard

(2017) Troops, Trolls and Troublemakers: A Global Inventory of Organized Social Media Manipulation. Computational Propaganda Research Project Working Paper No. 2017.12. University of Oxford. Available at: https://bit.ly/3bpBXpL

10.

Bukkvoll

(2019) Fighting on behalf of the state – the issue of pro-government militia autonomy in the Donbas war. Post-Soviet Affairs 35(4): 293–307. DOI: 10.1080/1060586X.2019.1615810.

11.

Ceccorulli

Coticchia

(2015) Multidimensional threats and military engagement: The case of the Italian intervention in Libya. Mediterranean Politics 20(3): 303–321. DOI: 10.1080/13629395.2015.1042245.

12.

Cederman

L-E

Vogt

(2017) Dynamics and logics of civil war. Journal of Conflict Resolution 61(9): 1992–2016. DOI: 10.1177/0022002717721385.

13.

Clem

(2017) Clearing the fog of war: Public versus official sources and geopolitical storylines in the Russia–Ukraine conflict. Eurasian Geography and Economics 58(6): 592–612. DOI: 10.1080/15387216.2018.1424006.

14.

D’Amato

Del Panta

(2017) Does rentierism have a conditional effect on violence? Regime oil dependency and civil war in Algeria. Extractive Industries and Society 4(2): 361–370. DOI: 10.1016/j.exis.2017.01.002.

15.

Dawson

(2021) ‘No future for Libya with Gaddafi’: Classical realism, status and revenge in the UK intervention in Libya. Cambridge Review of International Affairs, advance online publication. DOI: 10.1080/09557571.2021.1888879.

16.

Dixon

(2009) What causes civil wars? Integrating quantitative research findings. International Studies Review 11(4): 707–735. DOI: 10.1111/j.1468-2486.2009.00892.x.

17.

Dyer

Ivens

(2020) What would a feminist open source investigation look like? Digital War 1(1): 5–17. DOI: 10.1057/s42984-020-00008-9.

18.

Eisenman

(2019) China’s Vietnam War revisited: A domestic politics perspective. Journal of Contemporary China 28(119): 729–745. DOI: 10.1080/10670564.2019.1580430.

19.

Espreso TV (2018) Kak Kiyevo-Pecherskaya lavra vospityvala boyevikov dlya Girkina. Available at: https://bit.ly/3odSUZl (accessed 22 September 2020).

20.

Fairfield

Charman

(2017) Explicit Bayesian analysis for process tracing: Guidelines, opportunities, and caveats. Political Analysis 25(3): 363–380. DOI: 10.1017/pan.2017.14.

21.

Garmata.org (2014) Igor Georgiyevskiy. Available at: https://bit.ly/2RS9CkR (accessed 17 April 2020).

22.

Ghais

(2019) Consequences of excluding armed groups from peace negotiations: Chad and the Philippines. International Negotiation 24(1): 61–90. DOI: 10.1163/15718069-24011163.

23.

Gibson

(2013) Open source intelligence. In: Dover

Robert

, et al. (eds) Routledge Companion to Intelligence Studies. London: Routledge, 123–131. DOI: 10.4324/9780203762721.ch12.

24.

Girkin

(2016) Voprosy k Igoryu Strelkovu. Available at: https://bit.ly/3w1zk5p (accessed 22 September 2020).

25.

Goodman

(2020) ‘In the wider view’: The geostrategic determinants of counterinsurgency strategy and adaptation, evidence from the Arab and Jewish rebellions in the Palestine Mandate. Security Studies 29(1): 162–198. DOI: 10.1080/09636412.2020.1693622.

26.

Grozev

(2020) Russian spying is privatized and competitive: Counterespionage should be too. Available at: https://bit.ly/3obLmXf (accessed 6 August 2020).

27.

Hafez

(2020) Fratricidal rebels: Ideological extremity and warring factionalism in civil wars. Terrorism and Political Violence 32(3): 604–629. DOI: 10.1080/09546553.2017.1389726.

28.

Hauter

(2019) Delegated interstate war: Introducing an addition to armed conflict typologies. Journal of Strategic Security 12(4): 90–103. DOI: 10.5038/1944-0472.12.4.1756.

29.

Hauter

(ed.) (2021a) Civil War? Interstate War? Hybrid War? Dimensions and Interpretations of the Donbas Conflict in 2014–2020. Stuttgart: ibidem-Verlag.

30.

Hauter

(2021b) How the war began: Conceptualizing conflict escalation in Ukraine’s Donbas. Soviet and Post-Soviet Review 48(2): 135–163. DOI: 10.30965/18763324-20201380.

31.

Hayes

Cappa

(2018) Open-source intelligence for risk assessment. Business Horizons 61(5): 689–697. DOI: 10.1016/j.bushor.2018.02.001.

32.

Holtermann

(2019a) Blinding the elephant: Combat, information, and rebel violence. Terrorism and Political Violence, advance online publication. DOI: 10.1080/09546553.2019.1630383.

33.

Holtermann

(2019b) Diversionary rebel violence in territorial civil war. International Studies Quarterly 63(2): 215–230. DOI: 10.1093/isq/sqz007.

34.

Hosaka

(2018) The Kremlin’s ‘active measures’ failed in 2013: That’s when Russia remembered its last resort – Crimea. Demokratizatsiya: The Journal of Post-Soviet Democratization 26(3): 321–364.

35.

Hosaka

(2019) Welcome to Surkov’s theater: Russian political technology in the Donbas War. Nationalities Papers 47(5): 750–773. DOI: 10.1017/nps.2019.70.

36.

Hoskins

O’Loughlin

(2015) Arrested war: The third phase of mediatization. Information, Communication & Society 18(11): 1320–1338. DOI: 10.1080/1369118X.2015.1068350.

37.

Idler

(2020) The logic of illicit flows in armed conflict: Explaining variation in violent nonstate group interactions in Colombia. World Politics 72(3): 335–376. DOI: 10.1017/S0043887120000040.

38.

Jenne

(2018) When conquest would have paid: Domestic mobilization and political constraints in the Thai–Cambodian border conflict 2008–2011. Global Change, Peace & Security 30(1): 17–36. DOI: 10.1080/14781158.2018.1438385.

39.

Kashin

Merkulova

Solomin

(2014) Intervyu – V gostyakh: Oleg Kashin. Available at: https://bit.ly/3f1PzJQ (accessed 24 September 2020).

40.

Katchanovski

(2016) The separatist war in Donbas: A violent break-up of Ukraine? European Politics and Society 17(4): 473–489. DOI: 10.1080/23745118.2016.1154131.

41.

Koltsova

Pashakhin

(2020) Agenda divergence in a developing conflict: Quantitative evidence from Ukrainian and Russian TV newsfeeds. Media, War & Conflict 13(3): 237–257. DOI: 10.1177/1750635219829876.

42.

Kremlin.ru (2014) Vstrecha s Sergeyem Aksyonovym. Available at: https://bit.ly/3vXA0sk (accessed 26 March 2019).

43.

KrymInform (2014) V Simferopole prokhodyat torzhestva, posvyashchennyye 70-letiyu osvobozhdeniya. Available at: https://bit.ly/33EtzOP (accessed 26 March 2019).

44.

Kudelia

(2016) The Donbas rift. Russian Politics & Law 54(1): 5–27. DOI: 10.1080/10611940.2015.1160707.

45.

Kuromiya

(2019) The war in the Donbas in historical perspective. Soviet and Post-Soviet Review 46(3): 245–262. DOI: 10.1163/18763324-04603003.

46.

Levy

(1998) The causes of war and the conditions of peace. Annual Review of Political Science 1(1): 139–165. DOI: 10.1146/annurev.polisci.1.1.139.

47.

McDermott

Koenig

Murray

(2021) Open source information’s blind spot. Journal of International Criminal Justice advance online publication. DOI: 10.1093/jicj/mqab006.

48.

Mitrokhin

(2014) Transnationale Provokation. Russische Nationalisten und Geheimdienstler in der Ukraine. Osteuropa 64(5/6): 157–174.

49.

Mosinger

(2019) Balance of loyalties: Explaining rebel factional struggles in the Nicaraguan revolution. Security Studies 28(5): 935–975. DOI: 10.1080/09636412.2019.1662481.

50.

Myers

(2020) How to conduct discovery using open source methods. In: Dubberley

, et al. (eds) Digital Witness: Using Open Source Information for Human Rights Investigation, Documentation, and Accountability. Oxford: Oxford University Press, 107–142.

51.

Pastor-Galindo

, et al. (2020) The not yet exploited goldmine of OSINT: Opportunities, open challenges and future trends. IEEE Access 8: 10282–10304. DOI: 10.1109/ACCESS.2020.2965257.

52.

Pavlovsky

(2016) Russian politics under Putin. Available at: https://fam.ag/3blmxD6 (accessed 24 September 2020).

53.

Pedersen

Reykers

(2020) Show them the flag: Status ambitions and recognition in small state coalition warfare. European Security 29(1): 16–32. DOI: 10.1080/09662839.2019.1678147.

54.

Pigliucci

Boudry

(2014) Prove it! The burden of proof game in science vs. pseudoscience disputes. Philosophia 42(2): 487–502. DOI: 10.1007/s11406-013-9500-z.

55.

RIA Novosti (2014) Igor (Bes) Bezler: nachnyem nastupleniye, kogda protivknik vydokhnetsya. Available at: https://bit.ly/3y7bgzL (accessed 3 March 2020).

56.

Roberts

(1996) The Logic of Historical Explanation. University Park, PA: Pennsylvania State University Press.

57.

Robinson

(2016) Russia’s role in the war in Donbass, and the threat to European security. European Politics and Society 17(4): 506–521. DOI: 10.1080/23745118.2016.1154229.

58.

Rossiya 24 (2015) Crimea: The Way Home. Documentary by Andrey Kondrashev. Available at: https://bit.ly/3w69QUi (accessed 11 May 2021).

59.

Schenoni

Braniff

Battaglino

(2020) Was the Malvinas/Falklands a diversionary war? A prospect-theory reinterpretation of Argentina’s decline. Security Studies 29(1): 34–63. DOI: 10.1080/09636412.2020.1693618.

60.

Schwartz

Straus

(2018) What drives violence against civilians in civil war? Evidence from Guatemala’s conflict archives. Journal of Peace Research 55(2): 222–235. DOI: 10.1177/0022343317749272.

61.

Senekal

Kotzé

(2019) Open source intelligence (OSINT) for conflict monitoring in contemporary South Africa: Challenges and opportunities in a big data context. African Security Review 28(1): 19–37. DOI: 10.1080/10246029.2019.1644357.

62.

Siapera

Hunt

Lynn

(2015) #GazaUnderAttack: Twitter, Palestine and diffused war. Information, Communication & Society 18(11): 1297–1319. DOI: 10.1080/1369118X.2015.1070188.

63.

Sienkiewicz

(2015) Open BUK: Digital labor, media investigation and the downing of MH17. Critical Studies in Media Communication 32(3): 208–223. DOI: 10.1080/15295036.2015.1050427.

64.

Sputnik i Pogrom (2014a) ‘Eto GRUshnik, Rossiyskiy, deystvuyushchiy:’ Oleg Kashin o svoyem znakomstve s rekonstruktorom, za-voyevavshim pol-Ukrainy. Available at: https://bit.ly/3w3LZEQ (accessed 16 April 2020).

65.

Sputnik i Pogrom (2014b) Oleg Kashin: Vtoroy reportazh iz kryma. Available at: https://bit.ly/3hoj7Ds (accessed 16 April 2020).

66.

Sputnik i Pogrom (2014c) Reportazh iz Sevastopolya: Kak glavkom VMS Ukrainy pereprisyagal narodu Kryma. Available at: https://bit.ly/2R7nW9v (accessed 16 April 2020).

67.

Svobodnaya Pressa (2014) Semnadtsat kilometrov my shli marshem cherez granitsu. Available at: https://bit.ly/3tS94cp (accessed 26 March 2019).

68.

Time Magazine (2014) Exclusive: Meet the pro-Russian separatists of Eastern Ukraine. Available at: https://bit.ly/3uM7klU (accessed 17 April 2020).

69.

Toler

(2020) How to verify and authenticate user- generated content. In: Dubberley

, et al. (eds) Digital Witness: Using Open Source Information for Human Rights Investigation, Documentation, and Accountability. Oxford: Oxford University Press, 185–227.

70.

TSN (2019) Ataman Terets. Available at: https://bit.ly/3hnSKNN (accessed 22 September 2020).

71.

UCDP (nd) Ukraine: Donetsk. Available at: https://ucdp.uu.se/#/conflict/13246 (accessed 30 August 2019).

72.

UK Government (2019) Intelligence collection, analysis and dissemination policy framework. Ministry of Justice, HM Prison & Probation Service. Available at: https://bit.ly/3w40lFu (accessed 21 July 2021).

73.

Ukrainska Pravda (2014) V Slavyanske Nochyu Zamecheny Russkiye Diversanty. Available at: https://bit.ly/3oa6JYY (accessed 17 April 2020).

74.

Vedomosti (2014) Intervyu – Konstantin Malofeyev, osnovatel Marshal kapitala. Available at: https://bit.ly/3obNPki (accessed 26 March 2019).

75.

Wheatley

(2018) British open source intelligence (OSINT) and the Holocaust in the Soviet Union: Persecution, extermination and partisan warfare. Intelligence and National Security 33(3): 422–438. DOI: 10.1080/02684527.2017.1410516.

76.

Wilson

(2016) The Donbas in 2014: Explaining civil conflict perhaps, but not civil war. Europe–Asia Studies 68(4): 631–652. DOI: 10.1080/09668136.2016.1176994.

77.

Wolff

(2021) Enhancing the robustness of causal claims based on case study research on conflict zones: Observations from fieldwork in Donbas. Nationalities Papers 49(3): 542–561. DOI: 10.1017/nps.2020.29.

78.

YouTube (2014a) First video evidence of Russians among Ukrainian separatists. Available at: https://bit.ly/3tKUqTU (accessed 16 April 2020).

79.

YouTube (2014b) GRU Sloviansk. Available at: https://bit.ly/33GkYLK (accessed 26 March 2019).

80.

YouTube (2014c) Kramatorsk, Zakhvat Otdela MVD. Available at: https://bit.ly/3gT145L (accessed 28 March 2019).

81.

YouTube (2014d) O. Turchynov: My ne damo Rosii povtoryty krymskyi stsenarii u skhidnomu rehioni Ukrainy. Available at: https://bit.ly/38a4CwD (accessed 6 November 2018).

82.

YouTube (2014e) Opolchenets Novorossii ‘Prapor’ v Studii ARI TV ch.1. Available at: https://bit.ly/3ocPcze (accessed 17 September 2019).

83.

YouTube (2014f) Video posle perestrelki pod Slavyanskom. Ostorozhno, v kadre yest ubityye. Available at: https://bit.ly/34k12Ph (accessed 26 March 2019).

84.

YouTube (2014g) Zakhvat UVD g. Slavyansk. Available at: https://bit.ly/3mnp6Hq (accessed 28 March 2019).

85.

YouTube (2019a) Presentatsiya Knigi ‘Voyna v 16’ v gorode-geroye Sevastopolye. Available at: https://bit.ly/3w4w8Gg (accessed 22 September 2020).

86.

YouTube (2019b) Viktor Anosov. Pravda i Bayki Oborony Slavyanska. Available at: https://bit.ly/2SLY9nE (accessed 17 April 2020).

87.

YouTube (2019c) Voyna Vzvodnogo ‘Makhno’. Available at: https://bit.ly/3ob9BVx (accessed 17 April 2020).

88.

YouTube (2020) Girkin (Strelkov). Available at: https://bit.ly/3tDpR2A (accessed 21 September 2020).

89.

Zaks

(2021) Updating Bayesian(s): A critical evaluation of Bayesian process tracing. Political Analysis 29(1): 58–74. DOI: 10.1017/pan.2020.10.

Forensic conflict studies: Making sense of war in the social media age

Abstract

Keywords

Introduction

Process tracing: Definitions and methodological benchmarks

Process tracing and war: The neglect of online media

The Donbas war: A murky information environment

Introducing digital forensic process tracing

Case study: The occupation of Sloviansk and Kramatorsk

Updating Stage 1: The militia’s Crimean origins

Updating Stage 2: The oligarch and the ‘Prime Minister’

Updating Stage 3: Refuge in Russia

Caveats: Informality and local support

Conclusion

Footnotes

Acknowledgements

Funding

ORCID iD

Author biography

References