Bellingcat - Back in Time - OSINT

https://bellingcat-challenges.beehiiv.com/p/back-in-time-with-sofia-santos

Time to complete: ~3 hours

Challenge 1 - Fresh Faced

Challenge - Finding the founder

The story of Bellingcat starts with its founder, Eliot Higgins.

In 2013, numerous media outlets reached out to him to learn more about his groundbreaking discoveries. Some featured him in print, others published articles online, and a few produced and aired video reports.

The image above shows a screenshot from a newspaper article. That interview was also recorded.

Your task is to find footage of this interview on YouTube, and provide the code at the end of the link (answer format: dQw4w9WgXcQ).

Answer - Find the video

Using Google, I searched for results that contained the string eliot higgins, where from the website youtube.com and were dated in 2013.

On the 9th page I found a result for a video with a thumbnail that was similar to the sample image. The video title was also in a language that appeared similar to the language in the sample image (Slovenian):

Link to the search result.

About 1:50 is the exact point the screenshot is from:

The URL for the video is https://www.youtube.com/watch?v=k7qd4Y6QAfY:

So, the answer to the challenge is: k7qd4Y6QAfY:

Challenge 2 - Training Time

Challenge - There's a lot to learn

Find the event

A search for bellingcat christiaan triebert reveals Christiaan’s Twitter account:

The account appears quite active. There’s a good chance that Christiaan would have tweeted something to do with the workshop he was leading at the time.

I use Twitter’s advanced search to see all tweets by @trbrtc (Christiaan) that contain the phrase workshop and are dated between 1st December 2017 and 31st December 2017 (the workshop was said to take place in December 2017).

There are only three results, the first of which says “participants of the Bellingcat workshop at ARIJ17”:

I see what else has been tweeted about ARIJ17, and consequently find a tweet containing a photo that appears to show the same room:

It appears this is the event that the source photo was taken at. Now I need to find where the event was held…

Find the building

Another tweet using the ARIJ17 tag has a photo of a woman (possibly an attendee) standing in front of, what appears to be, an event poster:

The tweet’s text (roughly) translates to The tenth annual ARIJ Forum for Arab Investigative Journalism kicks off:

A Google search for arij forum 2017 leads to an ARIJ Forum Q & A webpage which appears to reveal the event’s location as the Mövenpick Resort and Spa Dead Sea:

Answer - Find the name of the room

A Google search for Mövenpick Resort and Spa Dead Sea conference rooms gives the first result for a webpage on the hotel’s website which gives several of the available conference rooms, one of which looks similar, if not the same, to the room in the source photo - it’s called The Grand Ball Room:

A bigger photo of The Grand Ball Room on this webpage:

Correct!

Challenge 3 - Creating Community

Challenge - A new place to connect

Find the tweet and the Discord server

Using Twitter’s advanced search I searched for any tweets by @bellingcat which contained the phrase discord server and was dated between 1st May 2020 and 31st May 2020 (the discord server was said to have been created in May 2020):

The source tweet is the first result:

The Twitter UI gives the tweet’s timestamp as 15:12 on 12th May 2020, which is assumed to be my local time, British Summer Time:

After clicking the link within the tweet, I added myself to the server:

Find when the Discord server was created

To get an idea how this could be done, I asked ChatGPT (arguably this is a more direct way of getting an answer compared to a Google search).

ChatGPT suggests if I know the Server ID then I can use a decoder to get the creation timestamp for that server:

After enabling Developer mode within my Discord account’s settings, I copy the Server ID for the Bellingcat Discord server:

I search for discord snowflake, which finds a Discord Snowflake to Timestamp Converter:

I paste in the Server ID, which returns a timestamp of 12th May 2020 14:04 (BST):

Answer - Finding the difference in time

So, the Discord server was created at 14:04 (BST) on 12th May 2020 and the tweet was made at 15:12 (BST) on 12th May 2020. This gives a time difference of 68 minutes.

Challenge 4 - Future Plans

Challenge - A timely document

Find when Bellingcat registered their organisation in The Netherlands

A Google search for bellingcat foundation netherlands returns the Bellingcat’s About page, which suggests the organisation was registered in the Netherlands on 11 July 2018 (the KvK number suggests this the Netherlands registration - KvK being the number assigned when a business registers in the Dutch Business Register):

Find the document and the author

The document is said to have been released nearly two years after the organisation was registered in The Netherlands. This gives a period between 11 July 2018 and 11 July 2020.

A Google search for a document of several types (see screenshot), from the site bellingcat.com, containing the word future and dated between 11 July 2019 and 11 July 2020 returns one result - a Policy Plan 2019 - 2021 PDF.

This policy plan appears to have been posted on 22 June 2020 - almost two years since the organisation was registered within The Netherlands:

Using exiftool, the document’s metadata has a metadata author tag set to Aric Toler:

Answer - Find the article and its last word

To find a list of articles authored by Aric Toler, I first search Google for bellingcat artiles, which leads me to Bellingcat’s articles page. From here, I click the first article, then click on the first listed author’s name:

This results in a webpage with the URL [...]/author/merl.

I change it to [...]/author/aric, in the hope that it would list Aric’s articles instead, but no luck:

I see what the other author’s URL is, and notice this time the format is [...]/author/<first name><last name>:

So I try [...]/author/arictoler instead, and this time it lists articles by that author:

Now it’s just a case of going through these articles to find the one published closest to 22 June 2020. I’m assuming the articles are sorted from newest at the beginning to oldest at the end. I find this article posted on October 14, 2020 and the one before it posted on April 15, 2020. The latter was posted nearest to 22 June 2020:

The article’s last word is record:

Success:

Challenge 5 - Toolkit Tracing

Challenge - Tool tips new and old

Find a version of the Toolkit from 2020

A Google search for osint landscape (another name for the tool going round, as shown within the source screenshot) from 2020 reveals a start.me URL that comes up repeatedly:

That link has expired:

However, the contents of the link were preserved within the WayBack Machine:

In it, there’s a link to a Google Docs document. The link, when visited not through the WayBack Machine, is also not available:

But it is available through the WayBack Machine:

Answer - Find the missing document and the word within it

The WayBack Machine version of the Google Docs Bellingcat OSINT Toolkit from 2020 contains a link to a FEAT VERSION 1.1 PDF:

That link can’t be clicked, but a Google search for FEAT_VERSION_1.1 returns the document we’re after within the first result:

Within that document we find a table on page 39, the first hazard within that table being Explosive:

Success