Blockchain-based dossier could help prove Russia committed war crimes

In early March, a Telegram user posted a photo of the wreckage of a school in a suburb of Kharkiv, Ukraine. The photo showed the side of a classroom with a large blast hole and a pile of debris, including tables and chairs.

International law prohibits intentional attacks on educational facilities. That means the image could serve as evidence of a potential war crime, according to the Starling Lab, a research center affiliated with Stanford University and the USC Shoah Foundation.

Along with a team of human rights experts and expert lawyers, Starling presented evidence of this attack and four others on Friday to the International Criminal Court, which opened an investigation into allegations of war crimes in Ukraine in the months following the invasion. from Russia at the end of February.

Starling’s dossier is not your typical exhibit. Instead, the group’s submission will present publicly available online information that has been preserved and verified using the blockchain technology behind cryptocurrencies, in what it says is the first submission of such evidence to any court.

“We believe the use of this technology is uniquely appropriate and powerful in this setting,” Jonathan Dotan, founding director of Starling, told CNN .

According to Dotan, the goal is to build additional “layers of trust”. Blockchain is a ledger of data distributed over a computer network, making it more difficult to hack or manipulate. By leveraging this and other encryption technologies, Starling is able to prove the information hasn’t been manipulated and ensure it doesn’t disappear if, say, a tweet is deleted or a cloud database fails.

The invasion of Ukraine has produced mountains of valuable online information that could be of interest to prosecutors, thanks to the ubiquity of cellphones. This represents both an opportunity and a challenge, given the lack of protocols for preserving digital evidence.

Moscow denied targeting civilians, but an investigation by the CNN found that 13 of the 16 sites in Kharkiv confirmed to have been hit by Russian missiles in the first week of March were schools, residential buildings and shops.

“This is the first conflict in which much of this social media evidence appears to be about to play a role,” said Andrew Clapham, a professor of international law at the Geneva Graduate Institute and an expert on human rights.

False information and misinformation also make it more difficult to sort out in the online world what is real and what is not, as bad actors try to obscure the historical record. That’s where the cryptocurrency world can help, according to Dotan.

“As events continue to change on the ground, as knowledge networks expand, it is very important to use these tools to secure that information,” he said.

Documenting war crimes

Dotan’s team has previously used its blockchain expertise to preserve testimony about the Holocaust and document evidence of war crimes in northwest Syria. But when the war in Ukraine broke out, they quickly turned their attention to her.

In partnership with the Atlantic Council’s Digital Forensic Research Laboratory and Hala Systems, which develops technology to protect civilians, they decided to focus on two weeks of attacks on Kharkiv in March and specifically look at what appear to have been deliberate attacks on schools.

The submission details five attacks on educational facilities that took place between March 2 and 16.

“There is a very clear strategy behind attacking education and using it as a weapon of war,” said Ashley Jordana, associate director of accountability at Hala Systems. She worked with Starling to prepare the Court’s submission.

“The thinking behind this is that if you attack a building dedicated to an institution, you are not only attacking the child itself – and their well-being, development and mental health – but you are actually creating a kind of insecurity that has a truly destructive impact on the overall social and economic growth of a country”.

For starters, the team began looking for open source information that could help prosecutors build a case that the Russian military committed war crimes. When they came across a relevant Telegram message or tweet, Starling researchers used encryption technology to capture, store and verify each piece of evidence.

The goal: to prove exactly when they had custody of the information and create a way to demonstrate, over time, that it had not been altered in any way.

How it works?

First, they archived the post and its metadata – such as the author, the date it was created, and how many times it was viewed. They also captured the surrounding site context and user profile. Then they used encryption to create unique fingerprints, or “hashes,” that would change if the underlying information changed.

The fingerprint and metadata were later recorded on various blockchains. This has a similar function to when a notary confirms that someone was in possession of a legal document.

Next, the team focused on storage. The files were uploaded to two decentralized storage networks, Filecoin and Storj. The information was then cached across multiple nodes around the world, rather than being stored on a single system.

After that, Starling and her partners independently verified the information — verifying the source, diving into the post’s metadata, using geolocation tools to confirm the photos’ authenticity, and looking for corroborating evidence from organizations like the United Nations and Human Rights Watch.

These search methods are similar to those used by journalists when scouring materials online. The investigation of CNN in March included details of one of the attacks included in Starling’s presentation.

This corroborative material was then linked to other files that were uploaded to various blockchains, creating a chain of evidence that is verified and protected from tampering.

“We’re not just providing a series of links for investigators,” said Dotan.

Starling’s method can also be useful as misinformation spirals. In the group’s presentation, she noted that a “pro-Russian online source” was trying to reframe the narrative around one of the school attacks.

What happens next?

It will be up to the Court to decide whether the evidence presented by Starling Lab will be included in any case it brings.

One consideration for the court will be that it cannot try people without them, said Clapham of the Geneva Graduate Institute. This means that the prosecutor is only likely to file cases against people who surrender to the court in The Hague and will prioritize relevant evidence in those cases.

But Dotan and Jordana are hopeful that the Court will be receptive to their methodology.

The Court’s strategic plan for 2016 to 2018 said it sought to develop strategic partnerships with non-governmental organizations and academic institutions that could “support the identification, collection and presentation of evidence through technology”.

“Ten years from now, when everyone else has forgotten about it and you need to go back to that day in March when a bomb fell on a school, you now have a network of knowledge that can cryptographically prove that every step – as you capture, store and verify – has been secured by some form of technology,” said Dotan.

The Court also telegraphed its intention to step up work in cases involving children.

More work will need to be done by prosecutors to prove other elements of the alleged crimes detailed by Starling Lab, including building additional evidence about the perpetrators of the attacks and their intentions, said Kelly Matheson, a human rights lawyer and former director of the Video program. as Evidence in Witness.

Still, she said the methods Starling used are “an extremely useful tool to ensure that information received is verified to legal standard and usable by the court.”