Investigating PS752 with Open-Source Intelligence

Jeffrey Lewis 0:06

You are listening to the Arms Control Wonk Podcast, a podcast on arms control, disarmament, and nonproliferation. I'm Jeffrey Lewis, the founding publisher of the Arms Control Wonk blog, and a professor at the Middlebury Institute of International Studies at Monterey. Today, we have a special guest, Patrick Kerley, a.k.a. Paddy Careley of UT Dublin. Introduce yourself, sir.

Patrick Kerley 0:31

T.U. Dublin.

Jeffrey 0:33

T.U. Dublin. I said UT. I turned it into Texas. Is Texas like Ireland?

Patrick 0:38

We do talk ourselves about as much as Texans talk about Texas, so I'd say so, yeah. So yeah, I'm a cybersecurity student at TU Dublin who also occasionally gets to do some really fun research into privacy and security. And occasionally I teach lectures through a student-led teaching initiative at the university as well.

Jeffrey 1:00

And I should say you go by Paddy, which is not a thing I would call an Irish person in the United States, but since you're Irish-Irish, it's your call, man.

Patrick 1:07

Yeah, like everybody calls me Paddy, so...

Jeffrey 1:11

It's not a thing in Ireland, right?

Patrick 1:13

No, no. There's a bus company called Paddy Wagon, and they literally do nothing but take American tourists around Ireland. So to us, that's pretty funny.

Jeffrey 1:21

I find this horrifying that there is a bus company in Ireland called Paddy Wagon. So the reason that we have Patty on is that the Arms Control Wonk Slack channel has been... is going crazy about the right word. Yeah, I think so. On the shootdown of the Ukrainian airliner. And at the end of the last episode, I did briefly mention that Slack was doing stuff, but I wasn't sure...

Whether in some cases you had been first or second with Bellingcat. And I don't like getting all like Jetson Sharky because like one of the beauty of open source is that there's so many people all doing work. And so I was uncertain and I pulled back and that was maybe not the right decision because as you've pointed out, there's been an enormous amount of great work on Slack that you then shared with us on Twitter.

Patrick 2:19

Yeah. And I don't want to badmouth Bellingcat. I think literally minutes between a tweet from one of their researchers and our first spot, I think it's like two minutes.

Jeffrey 2:34

We love them, in fact. I mean, that's the real joy.

Patrick 2:37

Dave, actually, we're working on... There's a second video of the shootdown that's come out since. And if you look at... That they were able, like they did it privately siloed away from everyone else because there was a bit of an incident where the guy who took the first video appears to have been picked up by the IRGC or the police in Iran or something like that.

So like I get why Doing it siloed away but like that kind of like open sharing nature of OSINT kind of vanished and while we were really quick at certain elements of it there's really complicated areas which we're just still working our way through so in some ways they've been much faster than us but in one respect we've been fantastic and we're kind of proud of it

Jeffrey 3:20

Yeah, so I wondered if you would walk me through all the things you've done because for people who are listeners but not subscribers and don't have access to the Slack channel, it can be overwhelming. There is just an enormous, I mean, I think sometimes people think like the Slack community is this thing that's, you know, somehow a function of the podcast.

But in fact, you all have really built your own community to which Aaron and Scott and I are like completely irrelevant. Yeah.

Patrick 3:49

I wouldn't say irrelevant, but it's the kind of thing where we've kind of been let run it. And in running it, we kind of have our own ways of doing things with our own little bits here and there. So like these guys who are keeping an eye on the flu outbreak in China that's related to SARS that could break into something else.

There are people who are doing nothing but satellite watching. I do a lot of plane watching of Cobra Balls and Constant Phoenix. There's people who are talking... Just everything nuclear all of the time. So it's more the kind of thing of where we're allowed to discuss our own interests and while your stuff gets posted occasionally for different things, we're kind of running our own thing and doing our own thing.

While a lot of us, like me personally, I'm very North Korea focused. A lot of the people there have their own interests and their own areas that they want to do. So because we're allowed to just run away and do whatever we want within reason, really, we just go and do it. There's some people who are there for...

Not just video games, but, like, there's an entire channel where, you know, we'll just organize to play video games, we'll put up some game servers. There's a bunch of tabletop board games starting now as well. So, it is real, like, it's not just OSINT and it's not just North Korea or, like, making fun of... Which...

Jeffrey 5:11

Which channel has the board games in it? Because I am sitting on a copy of Next War Korea, which is an update of Korea 1995, and I can't find anybody to play with me.

Patrick 5:23

There's actually a hidden channel, and it's in the hidden channel.

Jeffrey 5:27

It's hidden from me!

Patrick 5:30

Well, it's not so much that it's hidden, it's just it's not a default channel. So you need to go looking for it. But we've started announcing it to people. Like, every time there's a big jump of people entering, it gets mentioned in the introductions and announcements channels.

Jeffrey 5:45

Oh, we have to make sure Melissa Hanham knows about this. You know, she and her husband love games.

Patrick 5:50

Yeah, well, we're getting started on a diplomacy campaign, hopefully shortly. That'll play out over the next, like, month or two, so...

Jeffrey 5:56

All right. But today we want to talk about PS725 and the work you all did, which actually I think is an incredible example of distributed OSINT. And so I don't know where to start. I think the thing that kind of like slightly blows my mind were the flight charts.

Patrick 6:18

Yeah. The easiest place to start is just a little before the flight charts, because where it really starts is there was a thread where we were just discussing the fact that the plane crashed. Because, like... You have a bunch of missile strikes, you have an earthquake, and you have a plane crash all in the same day in Iran.

And we don't know that it's been shot down or anything yet, and there's nothing but conspiracy theories floating around on the internet. Just kind of talking about it, one of the guys just dropped in flight charts just to show us what the kind of, like, major routes are in the... But this is the thing about where, like, we're allowed to be our own wonks running around and doing it because there are people who just do nothing but monitor the movements of certain planes because the planes are of huge interest to us, you know?

So because they're doing that, like, there's a series of flight charts that one of the guys has that he has no problem sharing. And... We basically look at that and where the plane goes in relation to that to see is there anything unusual about it, and doesn't really appear to be anything. and the real standard thing that kind of got everything started was there's a post by one of the guys, Andrew, one of the army of Andrews, because there's like 50 of them now. I'm serious, I'm, I think they're plotting against us.

Jeffrey 7:44

Is it pretty soon it's going to be the Andrew Wonk podcast?

Patrick 7:47

It might be. Don't give them any ideas. But he made a really interesting post where he basically, through looking at the few shots on social media, started to lean towards the convinced it was shot down thing. And some of them, like Elliot Higgins from Bellingcat had said, no, that kind of looks like it did at MH17 and it's just dirt that it picks up on from flying across the ground or something like that.

But there were two images. One of them was the rear stabilizer on the plane, which had a very clear puncture. And, you know, it's not as, like, bang on as you would expect with, like, shrapneling. But a puncture is very unusual. So that was one of his. And the engine had what appeared to be shrapneling. But when the excuses, the engine failed...

The specific engine on the 737, I don't remember the name of it, but I read on the AV Herald that it is prone to an uncontained engine failure. So if it's going to just start shooting bits of the plane everywhere, or bits of the engine everywhere, you would expect... There to be shrapnel on the engine. So we kind of like left it at that and had nothing to say further beyond that.

And then it's only like the next day when a report started to come out from US intelligence that it was in fact a shoot down. And, you know, we kind of seen the whole thing that then we really kicked it into super OS int mode.

Jeffrey 9:24

Yeah. And I mean, just early on, it looked like you were modeling the plane, right? The behavior of the plane, where the plane was. I mean, we had, I mean, there's what, flight radar data, but then you also have the flight charts. And then there was like a little bit of modeling because the thing turned around and tried to go back.

Patrick 9:42

Yeah. Well, the... So when it... The thing about... It looked like the last pass of the flight radar data, it looked like it had started a turn. And, like, we... That's probably because it was hit by a second or a first missile and then another one and started to do the turnaround then because it was hit. But, like, there were...

It didn't seem that far away, the crash site. So is it possible for the plane to make that turn and basically start doing some geometry? And one of the guys knows a 737 pilot, so he talked to the 737 pilot, and another one of the guys has a... I had a calculator basically for calculating the ability for certain planes to turn in certain distances.

And it basically all pans out to, it's a perfectly reasonable turn. It just crashed for some reason. Like, it's another stage in the initial investigation of, like, at what point do you decide there is enough evidence to investigate further? So you just start eliminating possibilities, and there's nothing that seems crazy.

Jeffrey 11:01

Right, well, I mean, that's kind of what I like about the story, because... You know, there's an endless amount of noise all the time, right? So there's also, as you said, that earthquake. And so, you know, we often focus on the cases where something interesting happened. And I think what I like about the story is the degree to which, as a community, people weren't jumping to conclusions.

I mean, people were... Slowly processing what happened in a kind of deliberate and careful way. I mean, which to me is like exactly the opposite of like the Twitter world that I live in.

Patrick 11:37

But, but like, we've kind of learned that through not like hard lessons, but like, it's one of those tips that we've picked up from doing this enough because like a great example of it is after North Korea tested the thermonuclear weapon A few of us started going through papers on the geology of the area to see if there were any formulas or anything related to how nuclear weapons tests in Pyeongi-ri would be modeled.

And we actually found a paper on it that does the whole thing. We had a formula up and ready to go where you just drop the different numbers into it, and we just started looking at earthquakes in that area. And turns out, in the Ring of Fire, the Pacific Ring of Fire, there is a lot of earthquakes all of the time, and none of them are nuclear weapons. So like from us just kind of like looking at the USGS website for like quakes within 50 kilometers of that spot.

Turns out you get a lot of them and a lot of them look like, you know, several tens of kiloton tests, but they're not. So it's the kind of thing where like over time we've kind of like we've basically matured as a community in that we don't necessarily jump to a conclusion, but we kind of sit down and work the problem and see where we come out with it.

Jeffrey 13:04

And I would say that the, I mean, I think from your perspective, I'm curious, I suspect that it's the verification then of the social media videos that ultimately makes you pretty convinced that this is a shoot down.

Patrick 13:19

Well, not just that. There's more to it than that. There's a lot of stuff that lines up and makes a lot of sense that isn't necessarily a coincidence. So a great example of that is when we find the videos and we look at the videos, like the first video is a guy just standing at the corner of a T-junction in a road and basically videoing the thing.

And when you look at that, you can use geometry to map back where, Well, you can use the speed of sound to estimate how far he is from it to give you a ring to look at. And then when you know his position, you can then kind of adapt two-dimensional geometry onto the three-dimensional space. And when you do that and map the missile's track back, you get how far back he goes, or how far back the missile came from, I should say.

Which, when you do that, that basically gives you a rough range estimate. And when you start looking at that, six kilometers from where the rough spot where that plane was hit just so happens to be an Iranian missile base.

Jeffrey 14:31

Right, so that's the Bid Ghanai site that... Yes. ...that gave us one of our favorite users, Tehran Mohaddam's head. Yes. People may not necessarily get this joke that there's a user on Twitter who's also a Slack user, who we all quite like, who's adopted as his avatar, the head of Tehrani Mochadam, who was an Iranian missile scientist who was killed in an explosion at Bid Ghanai, and who, as our friend Fabian Hinz points out, his head was never recovered.

Patrick 15:03

Yeah, so, like, that is the kind of asset that Iran would probably protect with air defenses in the event of anything happening with the United States.

Jeffrey 15:15

So... And which they might presumably would expect to be the subject of a U.S. retaliation.

Patrick 15:21

Oh, yeah, like, if you degrade their capability to build missiles, that's a big advantage for the United States.

Jeffrey 15:30

And so... In the end, you ended up finding the spot where the plane went down.

Patrick 15:39

Yep.

Jeffrey 15:42

And do you want to talk about that a little bit? Because I thought that was kind of interesting.

Patrick 15:46

Yeah, so there was the AV Herald, which is great for any plane crashes or anything, if that's your hobby. Which kind of is. They have really great images. I don't know where the guy who finds it runs it, but he has a fantastic website with some of the best information around you'll find on this. And he, when I woke up that morning, because like I'm what, like, Eight or ten hours ahead of you. so when I woke up the next morning and kind of started looking into it, that was the first place I went. He had imagery from that morning in Iran, and basically ground truth imagery. Yeah, for, I don't, I don't know if it came from social media or what it was, but it was like people coming out of their houses, and like he's photo and video imagery. So just kind of start looking at that, and one of them, one of the guys shared an image that's basically.

A panoramic view from where the plane hit down and then went forward and we see something like that we kind of geolocate it so we just start working backwards from where we think it is the kind of route that the plane took. That also was an advantage when it came into like modeling the turn the plane took because we know the path it took so then we can look at where it touched down as well.

Jeffrey 17:11

And I apologize if I missed this. We spent a lot of time looking at the two images of missile debris that we saw. But of course, they were incredibly difficult to geolocate because there wasn't really a lot of surrounding area, although they were kind of consistent with the area that we were looking at. And we couldn't find any, you know, Fabian reverse image searched them and couldn't find any evidence that they had been published before.

Patrick 17:37

Yeah, they might be new images, but you're talking about a less than half a metre across rectangle perspective at the ground. Unless you can figure out how to reverse the travel of light through images, it's going to be really difficult to find that spot. So maybe they are new, and maybe they are related to this, but... We've no way to know.

Right.

Jeffrey 18:06

So for you, it's really what would you if you were going to just say to a person who had not followed this all in the series of things that lined up for you? And obviously now we know that. Right. You're right, because the Iranians admit that they they accidentally shot down the plane. What would that list be?

Patrick 18:26

Oh, there could be a lot in the list. I think the biggest parts of what are on the list are the... The fact that the missile is shot from... So we have two different sites where we think the missile is shot from. And there's a second piece of video that the New York Times have on there. This is the one with the missile going straight up, right?

It's the one with two where the missile is shot twice and you can see at least the first impact and I don't remember if the second one is in there. And when you look at that one, it looks like a different size and that's probably because you can't take two-dimensional geometry on a 3D space and expect it to work perfectly.

And if you look at that one, it looks more like the missile came from about 11 kilometers out. And if you count the distance traveled per frame and estimate that, you kind of come out to like 11 and a half to 12 kilometers, which is basically the range of it. That's basically the range of a tour system.

So that one more neatly matches up with everything. And if you were the United States and you were coming in, if you were coming in from bases in Iraq, this would be right in your way. So that matches up. The base that it's protecting, which is the Bidken and Missile Base, matches up as well. If you look at the...

Like if you count or not. Well, I've talked about that, counting frames, and it's, it's more like, like I could talk, like I have a huge list of everything that's here, but the bottom line is like like we started looking at, like we have a master list that's been compiled of different air defense sites that we've got from various different sources, and if you look at them.

This place stands out a mile away. The two different sites that we think it came from, both of them stand out a mile away as important protectable assets for Iran that you would put air defenses at. The path the plane took as well, one of the other standout things that I didn't mention actually from before was the one interesting kind of fishy thing from When this happened initially was there was talk that the plane was delayed for an hour.

And it would be the last flight out of Tehran. So if you were sitting in a TLR or something like that somewhere in a desert at like six in the morning, and the last plane should have gone past an hour beforehand, and then something peers up on radar, that's one of those like escalation control situations you talked about in the last podcast that you can't control for.

Right. So if he's sitting there and not like this is outside of the schedule he's expecting. Right.

Jeffrey 21:36

Because what he is expecting is a cruise missile. And it turns out when you expect that you're going to find everything's a cruise missile. Right. Yeah. I mean, I think the reason I ask is just because it is it's it's such an interesting case study to me because the Iranians end up admitting what they what what the unit did, because, you know, we we have the MH 17.

But the Russians have never owned up to it, and there's always an army of trolls who are out there muddying things up. And so here we have this kind of beautiful case study. I mean, it's a horrible event, but you have this event that happens, and it happens. We know what the correct answer is, but it's so elegant that you can see it in the open source information without being told.

Patrick 22:27

Well, that's the power of open source. And one of the things I said on Twitter is that we basically went from the day before being completely skeptical to completely convinced. Because... I'm not really doing justice to the pile of evidence, but there's a thousand messages, roughly, and we would be forever talking about them.

Jeffrey 22:46

Which, by the way, is my defense for why I don't know. In and out, it's sort of like we're working in parallel and we can see this other conversation, but like... Holy cow, you know, I mean, the level of work is incredible. You mean, at one point you broke Slack, right?

Patrick 23:05

Yeah, Slack breaks when you fill threads with enough of these things to the point where, like, there's a separate thread of people complaining about the fact that Slack has become so slow. So, yeah, like, I don't know if we're using it in its intended function. And the other thing as well is, like, we're putting images that are, like...

Crops of satellite imagery and sometimes full-size satellite images in Slack. So, like, we've went out and looked for Pleiades imagery. We looked at Sentinel Hub. We looked at... We looked for Terrasar X imagery at once because we were wondering if, like, if... There's weird berms and stuff all over these facilities for whatever reason. Now, I know some of them are test stands and have burn scars, but there are other ones that are...

It's just a hill with a pile of sandbags around it, which doesn't make a whole pile of sense. And that's a perfect place for a radar or a missile battery. So when we're looking for that kind of stuff, it gets really difficult.

Jeffrey 24:12

Yeah, so I think one of my big questions is to sort of ask what you think as a community you need. Because as I said at the beginning, this community now exists independent of anything that those of us who host the show do. And so if I'm talking to my corporate partners or if people who are interested in this are listening, what do you all need to be able to do this work more efficiently and more effectively?

Patrick 24:52

That's a hard question. For the longest time, anytime we've wanted to geolocate anything, we've just went straight to Google Earth and worked off whatever imagery we have, which luckily on Google Earth, the imagery we were working from was from the 8th of January, the day it happened. But for other stuff, like sometimes, like if you look at places in North Korea, like my favorite spot in North Korea, Which makes no sense to me at all and is a completely bizarre place where power lines lead to a mountain for no reason.

Like, the most recent imagery of there is from, like, 2014. So... Where is that? There's a place... I'll send you the exact coordinates. But there's a place not far from where they built the 50 megawatt... Not the 50. You know the big reactor? Yeah. There's a place not far from that at a hydroelectric dam where there's a pile of...

There's some electrical switching equipment. And then a bit off to the northeast, there's like... Old imagery has what looks like a place being dug out, but I don't know if it's being dug out or not, and there's power lines that go to it for no reason.

Jeffrey 26:10

I think I know that spot. Okay. We've done that. Oh, have we?

Patrick 26:15

I'll talk to you about that off pod. Okay. If it's the one I think it is.

Jeffrey 26:19

Okay. Yeah. Okay, so... And I'm mindful of Scott's goal that we should stay under, like, 30 minutes, because he gets cranky at me when I talk too long.

Patrick 26:29

No, that's fine. So, apart from imagery, the other big thing I'd say is... There's a few people who've been looking for a collaborative GIS-type tool. And all it would be is that we would have... If I draw lines for field of view of a camera, that is also visible to the other guys in Slack. Because one of the places where we ran into issues in the big thread of geolocating stuff was just...

I'm doing it in my Google Earth. I think 20 of us worked on it in total. So if you have 20 different instances on 20 different computers of Google Earth trying to find the same needle in the same haystack, how do we know who's looking at what? Who is getting this bit and who's getting another bit? Because all we can do is send a message back and forth that I'm looking at A, B and C and then report back.

Whereas if we had a collaborative tool and we were actually looking at these things as we worked on them, that kind of thing would be amazing. Just to be able to share the information in some form of an easy way, because like Google Earth's great, but There's useful things that are missing from it.

Jeffrey 27:44

Well, it's not a collaborative tool.

Patrick 27:46

But that's it as well. And even if you read their support pages, one of the guys actually dug them up and posted them on Slack. And they even say, we don't want to store any of your information online, which is weird for Google to decide is their place on something.

Jeffrey 28:03

Well, I mean, much as I love Google Earth, they didn't even like the idea that people could post the panoramio pictures. Yeah. Which I regarded as like the most useful aspect of Google Earth was the ability to immediately integrate to ground truth images. And they replaced them with those little 360 degree views. Although I think lately I've seen some pictures again.

The last thing I want to ask you... Is about other things that people are doing on the Slack channel. Because this is such a great case study, but it's not the only thing that's been done. And there's a menagerie of weird and wonderful things going on. And I was wondering if you would just share some of those.

Patrick 28:48

Yeah, there's a couple of guys like myself who are really into plane tracking, and one of the guys is just tracking planes and helicopters doing circles over LA, and he's built a bot that just automatically posts them to Twitter. I'm really interested in whatever a Cobra Ball or a Constant Phoenix is doing anywhere in the world. There's other guys who've done nothing recently but just track American transport planes headed to the Middle East and back, because it's kind of incredible to be able to view the scale of logistics that the US Air Force can muster when it wants to.

There's guys who are, there's one guy actually who after watching some of the geolocating that we're doing have started teaching himself geolocation and just anytime he runs into something he doesn't understand, he just posts it in an open source intelligence channel we have and he gets piles and piles of responses and maybe, like there was one he was looking at the other day where a place is like 90 kilometers from where Google Maps thinks it should be And he just like posted that.

And like a few minutes later, he had someone just there. And it's like, oh, I know that place. That's like just if you go down this side of the map and just like here, it's actually there. So if you start looking in this AOI here, area of interest, it just it's there. Know there's other people who are they're just organizing board games at the moment. We have if you like the video game Factorio, we have a Factorio server running, and there's people who are just there to talk politics. There's other people who are like there to talk really deep about like military strategy or developments in artillery systems.

So yeah, like there's loads of different things. There's loads of people, loads of different interests. There's tons of people from all over the world as well who have different perspectives on everything, so you might find, find one thing or another thing, or there's even like writers who, who are in there, not even necessarily looking for the next best story or anything, but just to talk interesting things that they've found. So like there's someone who shares like poetry and interesting articles and stuff as well.

So it's one of those things where it's much broader than just arms control or open source intelligence, but we're really like, we're a broad, diverse church of people who are interested in different things.

Jeffrey 31:23

Well, I think this has just been a fantastic conversation. You know, this is the obligatory ending where we try to find a happy note. But this is like, you know, generally, pretty speaking, a happy podcast about a terrible event. Right. Which is to say that there is this community of of people who are doing really interesting work.

So are we going to call that a happy note?

Patrick 31:46

I definitely think that's a happy note.

Jeffrey 31:49

And, I mean, it's a little strange to end this particular podcast with this, but, you know, if you want access to this Slack channel, then you can support us by going to our Patreon page. It's $5 a month, and there is a student discount for $3 a month. I guess it's patreon.com slash armscontrolwonkpodcast. Hey, Patty, thank you so much for giving us sh** on Twitter and then coming on today.

Happy.

Patrick 32:21

Happy to do so.

Jeffrey 32:22

And thank you for listening.