A base used by Russia's Rubicon drone unit was tracked down thanks to a sign above a loo. Russian propagandist Vladimir Solovyov arrived at a location to film a television report on the unit's successes, but his crew overlooked several details in the background: metal access hatches, distinctive ceiling fixtures and a bilingual sign above a toilet. These clues proved sufficient to pinpoint the base's location – the unit was stationed in exhibition pavilions at Patriot Park outside Moscow.
The discovery of Rubicon's base once again demonstrated the power of open-source intelligence (OSINT): even the smallest detail can be enough to pinpoint a target. Ukrainian arms manufacturers are exposed to the same danger. Filming at different facilities without proper precautions can give away factory locations to the enemy, even when the footage appears harmless. A still from the investigation into the location of the Rubicon unit's base Photo: Radio Liberty
A single careless photograph in an official company press release, television footage of a new weapon undergoing tests against the backdrop of a recognisable storage facility, or even a heavily blurred shot from an exclusive report can provide the enemy with valuable intelligence. Russian analysts are just as meticulous in their examination of shadows, metal roof structures, window shapes and patches of old Soviet-era tiling – all to pinpoint targets for missile or Geran drone strikes.
Ukrainska Pravda has examined Ukrainian and Russian OSINT investigations from recent years to explore how defence companies and journalists inadvertently reveal sensitive information – and how to film at defence facilities without giving away their locations to Russia.How Russian OSINT works
The principle behind OSINT is to piece together scattered information from open sources to uncover the details being sought. Even a chance photograph revealing the colour of a workshop floor can give a clue that allows analysts to work out a factory's coordinates.
Vadym Hlushko, founder of the Ukrainian community CyberBoroshno, says Russian OSINT analysts tend to work in cooperation with Russia's military intelligence agency (GRU) and Federal Security Service (FSB) rather than independently, combining open-source intelligence with information obtained through non-public means, such as informants, databases bought from third parties, and hacking.
Russia's military OSINT network consists of several major communities. The Rybar Telegram channel has links to the Russian Defence Ministry and received funding from Yevgeny Prigozhin in 2020. LostArmour has been analysing combat operations and military equipment losses in Ukraine since 2014. Smaller operations are also part of this network. What unites these communities is their connection to Russia's military and security apparatus.
In April 2022, the Russian OSINT channel Rybar identified a workshop at the Kyiv Armoured Plant from a television report broadcast by Ukraine's 1+1 channel. Investigators from the Centre for Information Resilience and GeoConfirmed have found that Russian analysts pinpointed the location using the colour of the walls, the shape of the windows and the height of the ceiling. They cross-referenced these details against archive photographs of the plant and satellite imagery from Google Earth. Two days after the footage was released, Russia struck the plant with missiles. Screenshot from the television reportEverything in the frame matters, especially the less obvious details
What should you look out for, and how can you tell whether a photograph or piece of information is safe to release?
Andrii Lisitsyn, an OSINT investigator with InformNapalm, explained to Ukrainska Pravda that the Russians determine a location not from a single clue, but from a combination of details.Outside , the shape of buildings, roads, railway tracks, the horizon and neighbouring structures can give away coordinates.Inside a workshop, clues include the layout of the premises, columns and overhead beams, gates, windows, machinery, signs, markings, boxes and suppliers' logos. Each of these details may seem insignificant on its own, but together they can provide enough clues to establish a location. Lisitsyn says: "OSINT works by cross-referencing information. If a frame can be matched against old photographs of a factory, satellite imagery, job advertisements, employees' online professional profiles or materials posted by contractors, the number of possible locations quickly narrows." One example of effective cross-referencing is a joint investigation by the CyberBoroshno and Dnipro OSINT communities. The analysts compared various pieces of information and identified the exact coordinates of a workshop at Russia's Kupol plant, using seemingly insignificant details from inside the workshop as clues. An administrator of the Dnipro OSINT community told Ukrainska Pravda: "When we analysed one video, we identified at least three distinctive features of the building: square and rectangular windows in the workshop wall and large rooftop structures with windows on their sides. We could not find a building with this combination of features at the plant's official address. This gave us reason to believe that the production workshop was located at another site, which Kupol might have purchased or leased. Further research uncovered information that the company had acquired the site of the former Production Site No. 300 of the Izhevsk Mechanical Plant. Using Wikimapia, we were able to locate the site and identify the former production buildings on it. We then began comparing buildings at this site with the features spotted in the video. Examining satellite images taken on different dates, we found one taken from a suitable angle. It showed part of a workshop wall whose configuration matched the wall seen in the video of the drone production workshop." How the Kupol plant was located Photo: Dnipro OSINT Vadym Hlushko says power lines are an important feature that can give away a location in open terrain. OSINT analysts, such as those at Bellingcat, use the GeoHints and OpenInfraMap databases . The shape of the cross-arms on electricity pylons, the number of insulators, and the angle at which power lines change direction can indicate the region where the footage was taken. Where a power line crosses a forest or railway tracks, the search area can be narrowed down using satellite imagery. Tools such as Shadow Finder can determine the exact time from the length and direction of the shadow cast by a pylon. The Russians use these methods to locate Ukrainian military training grounds and workshops. The international investigative group Bellingcat used a similar approach to identify the location from which a Russian Buk-M 1 air defence system launched the missile that shot down passenger flight MH 17 over temporarily occupied territory in Donetsk Oblast in 2014. Still from Bellingcat's investigation into the downing of flight MH 17 Photo: Bellingcat Vegetation and terrain can also give away a location. The colour of the grass, the shape of tree crowns and the density of plantings can narrow the search because vegetation is linked to the local climate. One well-known example is Trevor Rainbolt , a player of GeoGuessr, an online game in which players identify locations from images. He can identify a country or region from the type of soil or species of grass. Russian analysts compare images with botanical maps: unusual trees and shrubs near storage facilities or workshops can reveal a facility's coordinates. Bellingcat identified the crash site of an Indian MiG-21 Bison fighter jet in Kashmir Photo: Bellingcat, March 2019 Cars and windows also deserve attention. Glossy surfaces can reflect key details of a location. In 2022, Bellingcat OSINT investigators geolocated a photograph of a Russian team involved in programming cruise missiles. In a window's reflection, the investigators spotted window grilles, air-conditioning units and a cable above a window, as well as a white wall and columns belonging to a neighbouring building. These details helped them check for architectural matches and ultimately confirm that the photograph had been taken in the courtyard of the Russian Defence Ministry's headquarters in Moscow. Reflection of a white wall and columns in a window behind the location where the photograph was taken Photo: Bellingcat In 2023, the CyberBoroshno OSINT community used photographs to locate a position occupied by Russian drone operators and subsequently identified one of them. Soldiers from the K 2 unit of Ukraine's 54 th Separate Mechanised Brigade shot down two Russian drones and passed photographs of the operators to analysts. One of the images showed a gas pipe, a house and a red Niva car – details that helped narrow the search. The analysts compared satellite images of the area from different months of 2023, spotted a car under a tarpaulin and then checked their findings against Maxar satellite imagery. They passed the coordinates to the military, who conducted further reconnaissance. The position was subsequently struck with HIMARS multiple-launch rocket systems. But the investigation did not end there. One of the photographs from the geolocated position clearly showed the face of a drone operator. The analysts began their search with his wife's profile on VKontakte, a Russian social media platform. They found her phone number and used data linked to it to identify her husband, his address, his car and his military unit. The image captured by a drone Photo: CyberBoroshno This case shows how geolocating an image can be just the first step: satellite imagery, previously collected information and people's digital footprints can then be used to identify, among other things, those present at the location.After the shoot Even if footage is shot carefully and safely, that is only the beginning. The next important task is thorough post-production. The entire background surrounding a facility and details inside the premises need to be concealed: even a glimpse of a wall or the crown of a tree can provide a clue to its location. And even if the available information is insufficient to pinpoint a location with complete certainty, the details uncovered could put another facility at risk. At some point before publication, the footage needs to be blurred. It might seem like a two-minute job in any editing program. But these days, that may not be enough. The conventional method is Gaussian blur. It blends the colours of neighbouring pixels, making outlines and text indistinct. The catch is that some information remains. Imagine a drawing made with a marker that has been smeared with a wet sponge: it becomes blurry, but its outlines are still recognisable. Engineer Gonçalo Raposo explained on his blog that Gaussian blur can be mathematically reversed if the exact filter parameters and the method used to process the edges of the image are known. An image blurred using Gaussian blur and its reconstruction Photo: Gonçalo Raposo Another familiar solution is pixelation. But this does not guarantee anonymity either. In 2022, Chinese researchers developed a neural network designed to reconstruct faces from pixelated photographs. The AI first reconstructs the edges of a face and then uses them to predict what the obscured areas might have looked like. It will not necessarily recover the person's actual face, but it can produce a reasonably plausible reconstruction. The model was tested on a dataset of 182, 732 facial photographs. Diagram of an algorithm that reconstructs a pixelated image in stages Photo: Study entitled Delving deep into pixelized face recovery and defense "It is safer to crop the image or apply a completely opaque mask, then export a new final file that contains no editable layers. The file's metadata must also be checked separately," Andrii Lisitsyn says. Vadym Hlushko believes one of the safest post-processing methods is to use a brush tool in an image editor, such as Photoshop, to distort sensitive parts of a photograph. This destroys the image's original structure, turning the selected area into an indistinct mass that is difficult to reconstruct. An example of effective blurring, according to CyberBoroshno analysts In Ukrainska Pravda's experience, a spot retouching tool can also be useful for permanently removing small details. These might be labels on boxes that reveal personal information or postal addresses, or serial numbers on equipment. An example of a photograph from which sensitive details have been removed Photo: Ukrainska Pravda Finally, it is important not to forget to remove the metadata. Metadata is additional information that a photograph file may contain, such as the time it was taken, the type of camera used and sometimes even GPS coordinates. OSINT investigators analyse metadata to establish where and when a photograph was taken and check whether it has been edited, as explained in Bellingcat's guide . Speaking to Ukrainska Pravda, Vadym Hlushko recalled an incident in 2020-2021 when a Ukrainian defence company published photographs of a foreign delegation's visit on its website. The files still contained EXIF metadata, which can be recorded automatically when a photograph is taken with a smartphone or camera and may contain GPS coordinates. By uploading the original photographs to a specialised metadata-checking tool, it was possible to determine the exact location of the production facility. In 2023, the company invited journalists from a German media outlet to visit, and new photographs emerged that confirmed the facility was still at the same address.Approval is no guarantee of safety Permission from a company's management to release material, or footage filmed by a government press office, does not guarantee that a facility is safe from exposure. Those responsible may not always fully understand what can and cannot be shown. Sensitive details are sometimes released even from facilities that have already come under attack. In March 2022, for example, Kyiv police published an official report showing remnants of ammunition for 203 mm Pion self-propelled artillery systems inside the destroyed Retroville shopping centre. Remnants of Pion ammunition at the Retroville shopping centre Photo: National Police Another case involved a strike on a warehouse in Sumy Oblast in July 2026. Regional police posted a photograph of the damage that showed boxes bearing the name of Vyriy, a drone manufacturer. The photograph was later deleted and replaced with a blurred version, but the original, unredacted image had already spread across Russian social media communities. This is another lesson: once something is published online, it is almost impossible to remove it completely, so the risks must be assessed before publication. The presence of boxes or markings bearing a particular company's name does not necessarily mean that a defence industry facility is located there. Nevertheless, the enemy can, at the very least, use the images to justify its attacks on civilian facilities, as happened in this case. Ukrainska Pravda is aware of other similar incidents, but we will not publish details for security reasons and to avoid feeding Russian propaganda. A Vyriy box in Sumy Oblast Photo: National Police There are also more unusual ways of gathering intelligence. A press card or accreditation from a Western media outlet is no guarantee that a reporter is not working for enemy intelligence. Access to a facility may be subject only to superficial checks, while press officers may not know exactly what must not be shown inside production workshops. A few days before Russia's full-scale invasion, Spanish journalist Pablo González visited Motor Sich, a Ukrainian aircraft engine manufacturer. He freely photographed production lines and posted the images online. It later emerged that the man operating under this name was Pavel Rubtsov, a Russian GRU operative. Pavel Rubtsov at Yuzhmash Photo: CyberBoroshno Roman Burko, founder of the InformNapalm OSINT community, says corporate security teams can conduct initial checks to establish whether a media outlet exists, who is on the film crew and what the stated purpose of the ir visit is. However, they cannot carry out checks at the same level as the counterintelligence department of the Security Service of Ukraine (SSU). Burko says: "Private security teams do not have access to operational intelligence, international intelligence-sharing channels, counterintelligence investigations or other classified databases. The case of Pavel Rubtsov/Pablo González is a telling example. Polish prosecutors formally charged him with spying for Russian military intelligence and said he had used his journalistic activities as cover." Another threat comes from foreign television crews that broadcast live from Ukrainian cities . Their footage allows the enemy to assess the accuracy of strikes and adjust its fire. At defence industry facilities, Western journalists do not always follow established security protocols and may publish information they have obtained without seeking approval. It is therefore essential to set clear boundaries and carefully review the final footage to ensure that nothing sensitive appears, even for a split second. Reuters livestream from Independence Square in Kyiv, launched without official permission Photo: Kyiv PostBeyond OSINT OSINT in mainstream and social media is not the only threat. Russian intelligence agencies – the GRU and the FSB – combine open-source information with covert intelligence-gathering methods: hacking servers, intercepting data traffic from devices and buying leaked databases on underground forums. Roman Burko explains: "In professional intelligence work, almost no one relies on a single channel. It is more accurate to speak of intelligence fusion – the combining of different sources. OSINT might indicate: 'Here is a facility that could potentially interest us.' But further confirmation is then needed. This could come from informants, access to surveillance cameras, a hacked account, database leaks, satellite data, technical intelligence or several intelligence channels at once." Defence companies should not rely on the security of government services. CyberBoroshno founder Vadym Hlushko says government registers regularly suffer data leaks, while corruption enables enemy intelligence agencies to buy access to restricted information. Hlushko says: "Everything run by the state regularly leaks information. Officially, they claim that Diia [Ukraine's digital government services platform] has never suffered a data breach, yet for some reason Interpol is looking for a suspect who sold its database. There is a similar situation with other systems – offers to buy access through accounts with different levels of permissions appear on the black market. And this is a critical problem: often, the issue is not hacking itself, but the corruption of the people who hold the keys to these systems." Members of GRU's Unit 29155 whom the FBI suspects of hacking Ukrainian government services in January 2022 Photo: FBI Urban video surveillance systems are also vulnerable. In 2019, for example, Russia's FSB used Kyiv's Safe City surveillance camera network to track a car belonging to Kyrylo Budanov, then a major in the special forces, as it prepared an assassination attempt against him. A corrupt tax police officer assisted the FSB in the operation. In 2026, the same network was used to illegally track the movements of detectives from Ukraine's National Anti-Corruption Bureau (NABU). Russian software poses another threat: some Ukrainian defence companies still use the Russian 1 C software package for their accounting and procurement records. Apart from leaks through the media, employees' behaviour can also give away a facility's location: discussing work with relatives, taking cigarette breaks outside in company-branded clothing or ordering deliveries to the factory entrance. If the enemy is already monitoring an individual, food deliveries to the company's address or mobile phone operator data purchased from third parties can reveal the facility's exact coordinates. Budanov's car blown up on Williams Street Photo: National Police Andrii Lisitsyn said: "This is a very familiar situation from InformNapalm's experience. When investigating Russian military personnel, we often obtained the information we needed not from the serviceman himself, but from a fellow soldier, relative, acquaintance or someone else connected to him on social media." Digital footprints are also of interest to intelligence agencies: professional profiles, information about specialisations, colleagues, equipment, corporate events and changes of employment. "A single account may reveal nothing," he noted. "But if there are dozens of connected people with similar professional profiles, shared contacts or simultaneous changes in their activities, this becomes a separate body of information for analysis. Contractors are another weak link. Logistics companies, service engineers, installers, recruiters, security guards, cleaning companies or equipment suppliers may have much poorer security practices than the defence company itself." Defence companies should not expect the state to monitor all publicly available information and protect them completely from espionage. A potentially fatal leak of a facility's coordinates can occur through the camera lens of an accredited foreign journalist just as easily as through the negligence or betrayal of an official who has access to government surveillance cameras or databases. This is why manufacturers must take responsibility for their own security. An example of prices and services advertised on an underground forum in 2018 Protecting sensitive production facilities is the responsibility of every company, newsroom and press office. The founder of InformNapalm has outlined a set of security rules for defence companies. Unsupervised filming must be prohibited inside production workshops. Bringing smartphones onto the premises should be restricted, as these devices can transmit audio, video and location data through cloud services, Wi-Fi and Bluetooth. External visitors should only be granted access to areas necessary for their work. All photographs and videos must be reviewed by an operational security (OPSEC) team before publication. These rules must apply to all visitors without exception, such as investors, officials and journalists. Staff must report suspicious requests, attempts at manipulation or data leaks to the security team. Contractors, as the most vulnerable link, should be subject to additional checks. The Russians will inevitably see every published piece of material and scrutinise it under a microscope, as their goal is to put the facility out of action. This is why every public presentation must take into account the full range of potential risks. Burko concludes: "The most dangerous information leak today is not necessarily a document marked 'classified'. Far more often, it consists of dozens of small pieces of information that seem harmless individually but have been pieced together into a single picture. One big puzzle. This is why defence industry companies would benefit from a practice known as adversarial OSINT review. Before an important publication, the material should be reviewed not only by the PR department and the conventional security team, but also by someone tasked with doing the opposite: trying to uncover information from the material that the company did not intend to disclose. In essence, this is an information red team," he noted, drawing a parallel to the IT sector, where a team of cybersecurity experts simulates real hacker attacks against a company to test its defences in practice. The importance of operational security cannot be overstated. The cases described in this article, and dozens more not mentioned here, demonstrate why. A single careless image could cost human lives and damage Ukraine's industrial capacity during the war. Translated by Artem Yakymyshyn Edited by Susan McDonald