OSINT Exercise File #2
Introduction
I used OSINT Exercise #006 by Sofia Santos from Gralhix.com, an OSINT site, for this project. In her exercise, she provides a short introduction briefing that states: On January 19, 2023, a journalist with almost 140k followers on Twitter shared an image of a destroyed vehicle amidst a large cloud of smoke and fire. The tweet said: “BREAKING: TTP carried out a suicide attack on a police post in Khyber city of Pakistan that killed three Pakistani police officers.” She notes that the event isn’t what is being described, and wants us to verify the statement above.
Important: Ms. Santos noted that this exercise didn’t require participants to find the journalist of this post and to not harass them. For this exercise I did identify the journalist for educational and learning purposes, not to try and harass them. All assumptions that I’ve made are meant to demonstrate my OSINT skills, not to be malicious or harmful, and to clarify and provide all relevant information related to this image.
Process
For this exercise, I first focused on trying to locate the original post, and after searching for a few minutes, I was able to find the original post. Despite this exercise not requiring to locate the original post and to only identify the image, I wanted to identify the original post to provide further background information about it and the story that was shared to demonstrate my OSINT skills. This was posted by Tajuden Soroush, an Afghani journalist based in the United Kingdom who works for Iran International, a primarily Saudi-Arabian funded news channel that seeks to have Iran’s overthrown monarchy return to power. After finding the post, I did a reverse image search on the post’s image through Google Images, and found the image on Wikipedia Commons. I checked other sites as well to verify the authenticity of the information provided on Wikipedia Commons, and all the timeframes and descriptions match each other.
The original post in a screenshot
The original image is from the aftermath of a Vehicle Born Improvised Explosive Devise (or car bomb) exploding outside of a newspaper office in Wariziryia district in Baghdad, Iraq that resulted in the deaths of two people, wounding 30 and destroying more than 20 cars on the street. The photo was taken by Eli J. Medellin, a photographer for the U.S. Navy, on August 27, 2006, and this attack was perpetrated by Al-Qaeda. This means that the image wasn’t that of the attack that took place in Pakistan on January 19, 2023.
After verifying the image, I began searching for any information on about a suicide attack carried out in Khyber, Pakistan on January 19, 2023. After a quick search, I found several news articles from Reuters, The Express Tribune, and Radio Liberty Pakistan, that talked about an attack taking place on January 19 in Khyber District, near the city of Peshawar in Northwestern Pakistan and on the border to Afghanistan. Based on the information that I gathered, the story goes like this: The Police Chief of Khyber District stated that late on January 19, 4 militants attacked a police check point by shooting at officers and using grenades before a suicide bomber attacked and killed two police officers and injuring another officer. The police returned fire and pushed the militants back. The TTP, or the Pakistani Taliban, claimed responsibility for the attack. The information that I gathered and translated from the Radio Liberty article was through Google translate, which provided a better and easier to read translation compared to the direct translation the webpage provided.
From reading the articles, I noted that the Pakistani sources (The Express Post and Radio Liberty Pakistan) claimed two officers were killed and one injured, while the other sources (Reuters, Voice of America, Radio Liberty) claimed three officers were killed. Based on what is provided, my assumption is that the non-Pakistani sources counted the injured officer as a death by mistake, since their articles weren’t as detailed about the event compared to the Pakistani articles. Additionally, another assumption that I have is that Mr. Soroush published his post after he saw the Reuter’s story hoping to be one of the first journalists to break the story. While this assumption could be very wrong and Mr. Soroush could’ve received the information from his sources around the same time as Reuters, it isn’t unlikely that he saw the Reuter’s article and made the post. This is based on the information that the Reuter’s story was published at 11:16 AM EST, and Mr. Soroush’ post was published at 11:21 AM EST. Mr. Soroush also provides the same number of deaths as Reuter’s, just as the other non-Pakistani articles did, and the photo he provided wasn’t from the Pakistan attack. Additionally, Mr. Soroush provides no sources, articles, or other information on his post, which can hurt his credibility.
My Answer
There was an suicide attack on January 19 in Khyber District in Pakistan that resulted in the deaths of two police officers and injured another. The TPP claimed responsibility.
Actual Answer
The image provided in the online post wasn’t from the attack in Pakistan, but from a different terrorist attack.
Conclusions and Takeaways
My work for this exercise went further in depth compared to the work that was expected, as it only required participants to verify if the image from the post was from the attack in Pakistan or not. Instead, I worked additionally on verifying all events of the attack, who the journalist was, what the original photo was from, and noted any inconsistencies in a part of the world that’s often difficult to cover. The project itself went much more smoothly compared to the first project I did, where I was able to determine that the photo wasn’t from the attack in less than 10 minutes, where most of the time was spent on trying to verify where the original image source was from. The rest of the time was spent on the history and background of everything attached to this post, such as the author’s background and the actual story of events that happened.
The assumption that I made about the author can appear to not be entirely necessary for this project, as it isn’t entirely important to know if the author posted the story after seeing an article. I included it only to try and note any potential biases that might arise from a story such as this, as sometimes people can rush to jumping onto the immediate known facts without rectifying any mistakes that might’ve been made.