the home of online investigations

How to Uncover Corruption Using Open Source Research

September 5, 2016

By Aric Toler

Translations: Русский

When most people think about open source research, they think about uncovering social media materials of soldiers on the front-lines of the wars in Ukraine and Syria, or geolocating video footage of significant events with Google Earth. While open source materials have led a mini-revolution in how conflicts are reported online, there is another area where there has been just as much impact: corruption investigations. This guide will provide instructions on how to start doing your own research into corruption using open source materials, and also include advice from experts who have uncovered corruption in eastern Europe, the Balkans, Caucasus, and elsewhere.

Flashing Gold

One of the most obvious ways to find corruption is also the easiest and visually appealing for audiences: comparing the cost of watches and jewelry to declared income. Alexey Navalny and his anti-corruption group FBK famously conducted an investigation into a watch worn by Russian President Vladimir Putin’s press secretary Dmitry Peskov. The watch cost over a $600,000, despite a declared income of a quarter of that.

FBK parlayed this research into a cooperative piece with Max Seddon at Buzzfeed News highlighting the cost of jewelry and watches worn by members of Russian legislators and officials. In most cases, the jewelry would have taken a significant percentage of their yearly salaries to pay for.

More on the assets worn by politicians indicating corruption:

Rich Kids of Instagram

A common trend with corrupt officials is that they will rarely flaunt their ill-gotten wealth, in comparison to their children, spouse, or close friends. Thus, browsing the open source materials related to these people close to a potentially corrupt official gives researchers the opportunity to find evidence of  undeclared income and property, such as houses, vehicles, and lavish vacations.

You may be familiar with the Instagram account “Rich Kids of Instagram,” which shows the extravagant wealth of the children of the 1%–or, in most cases, 1% of the 1%. There are equivalent accounts showing the wealth of the children of businessmen and politicians of many countries, such as “Rich Russian Kids,” “Rich Kids of Azerbaijan,” “Rich Kids of Kazakhstan,” and so on. The vast majority of these photographs and kids will not bear any fruit for meaningful corruption investigations, but in some cases, there could be links that work back to a politician, judge, or other government official whose declared income is incongruous with the assets flaunted by their children.

Diana Munasipova and Anna Shamanska of Radio Free Europe/Radio Liberty followed leads from “Rich Russian Kids,” finding photographs of a 2013 Camaro from the Instagram user “ddanexx” (account has become private since the investigation). Today, if you buy a used 2013 Camaro in Moscow, it would run you at least $30,000.

Picture1
Picture2

Photograph from “ddanexx” geotagged for Red Square in Moscow, taken from inside his Camaro.

The interior posted by “ddanexx” matches that of a 2013 Camaro.

The interior of a 2013 Chevrolet Camaro, matching the photograph posted on Instagram.

The interior of a 2013 Chevrolet Camaro, matching the photograph posted on Instagram.

This Instagram user was not just a “Rich Kid of Instagram,” but also one whose father clearly had connections to high levels of governments, judging by the people he posted selfies with, including Putin and his press secretary Dmitry Peskov. This photograph also appeared on “Rich Russians Kids.” Unfortunately, Peskov’s watch is not visible in the selfie.

Picture6 Picture5

However, “ddanexx” does not publicly share his identity or who his influential parent is. After some more digging, Diana and Anna found that he did reveal these identities in a comment on a friend’s Instagram account. In a picture of a friend looking at a newspaper, “ddanexx” replies that his dad is in the photograph.

Picture7

The man on the front page of the newspaper is Aleksandr Galushka, the Minister for the Development of the Russian Far East. Combining this with the information from “ddanexx” account–including his likely first name, Daniel/Daniil, and that he is a student at Moscow State University in the Social Sciences Department–leads us to a roster of applicants on the Moscow State University site, confirming the identity of his father.

Profile of "ddanexx" mentioning that he studies at Moscow State University

Profile of “ddanexx” mentioning that he studies at Moscow State University

Geotagged photograph from "ddanexx"'s Instagram profile for Moscow State University, and a comment that he is in the social sciences department.

Geotagged photograph from “ddanexx”‘s Instagram profile for Moscow State University, and a comment that he is in the social sciences department.

Roster list from the Moscow State Univeristy's site, listening Daniil Aleksandrovich Galushka as a student in the social sciences department.

Applicant list from the Moscow State University’s site, listing Daniil Aleksandrovich Galushka (son of Aleksandr Galushka) as a student in the social sciences department.

Thus, with all of this information combined, Diana and Anna were able to confirm that the “Rich Kid of Russia” with the expensive car (among other assets, elsewhere in his Instagram account) is the son of a high-ranking Russian minister. The official tax declarations of Aleksandr Galushka for 2015 list his income as about 6.6 million rubles (about $100,000), and ownership of a Toyota Alphard, RAV4, and the Chevrolet Camaro that his son shared photographs of on Instagram.

In this case, the father of “ddanexx” officially declared the Camaro as his (or, to be more precise, his wife’s) property, but the collection of vehicles, apartments, and other assets seen in this Instagram account, along with other members of the Galushka family (including over $40,000/year tuition at a foreign private school), seem to outweigh the minister’s salary. This research did not identify any secret, undeclared assets, but the discovery, research, and verification process can be replicated in other cases both in and outside of Russia to add evidence in corruption investigations.

More on the social media materials of friends and family of politicians uncovering corruption:

Searching Databases

Much of this guide has described how to find leads in corruption cases, but that is only one part of the research process. Most corruption research is conducted with checking public and semi-public databases, such as tax declarations, offshore records, land deeds, and so on. The best collection can be found at the OCCRP’s Investigative Dashboard, which centralizes millions of files, including hundreds of business registries, land tribunals, court registries, and other databases for countries all over the world. The dashboard also includes news articles, Wikileaks State Department Cables, and other documents that can provide additional context to the individual or entity you are researching.

For example, searching for Leyla Aliyeva, the daughter of Azerbaijani President Ilham Aliyev, provides us with a plethora of information, including Wikileak cables, news articles, UN documents, and court archive documents from Baku.

Screenshot from the OCCRP Investigative Dashboard search for Leyla Aliyeva

Screenshot from the OCCRP Investigative Dashboard search for Leyla Aliyeva

These documents are all freely accessible and downloadable from the OCCRP’s website, including notations of exactly where in these files–which are sometimes quite large–you can find relevant information.

The OCCRP also has a comprehensive list of external databases, as not every database has been centralized onto the Investigative Dashboard. There is no one-size-fits-all guide for navigating these databases, as they differ in effectiveness, ease of use, language accessibility, and other factors.

Screenshot of the OCCRP's Investigative Dashboard listing of public databases.

Screenshot of the OCCRP’s Investigative Dashboard listing of external public databases.

Looking for Money Laundering

Investigating money laundering seems like a complex task that is better left to dedicated researchers at places like the FBI and OCCRP, and to a large extent, this is completely correct.  To effectively unearth, investigate, and prosecute money laundering, one must have access to financial records, be able to follow paper trails through foreign banks, closely read loan contracts with shell companies, and other processes. However, it is still possible to conduct some open source research that complements a more exhaustive investigative process.

The process of laundering money often includes multiple corporate entities using numerous transactions, all under the guise of a legitimate business. As described in the 2012 text Fraud Examination, there are some indicators that raise suspicion, including businesses that:

  • Are set up with no apparent commercial purpose
  • Receive large amounts of money from overseas, which are matched by payments of similar size to other overseas countries.
  • Purchase goods and services at prices significantly above or below market price.
  • Pay or receive agents fees or commission that appear out of line with the norm within their business sector.
  • Have a high turnover in relation to the size of their business.
  • Have an unduly complex business structure that serves no apparent purpose.

As seen in the aforementioned OCCRP dashboard, most countries have their own standards for making information public that can help you determine if an organization (often shell companies) fit any of these criteria. For the United Kingdom, Companies House (now in beta) allows us to search through companies and the documents and individuals linked to them. A new requirement in the United Kingdom requires that all live companies in the country file the identities of their beneficial owners at Companies House–for more information on this new requirement, find a summary here and information on how the legislation came about here.

A company’s filing history will be available, along with who incorporated it, the shareholdings and shareholders in the company, and so on. Analyzing this open source information assists one in finding out who the beneficial owner of a company really is, which (theoretically) should be much easier with Companies House and the legislation requiring most companies to disclose key pieces of information. Additionally, the annual reports allow one to identify suspicious behavior, such as an significant loans and investments the company has made, dramatic increases in turnover, and if identical amounts are both owed to creditors and owed from debtors–indicating that the company is likely a thoroughfare through which money can flow.

Open source information alone will not allow you to conduct a full investigation into money laundering, but this type of research can give you leads to further investigation and follow through on further research.

Advice from the Experts

Iggy Ostanin is an investigative journalist at the Organized Crime and Corruption Reporting Project (OCCRP) and Bellingcat contributor. He is interested in open source investigations, anti-corruption research, and the use of disinformation in media.

Investigating corruption can be effective when trying to combine multiple pieces of evidence from different sources. A yacht can lead you to company records and shipping registries, and ownership or use can be verified using social media such as Instagram. Information from social media can then be verified using geolocation and trying to find other contextual information about the time and place. If someone traveled to the coast of Italy to get aboard a yacht, could they have been in town for an event? Similarly looking at the crew members or other people who work on the periphery of the asset you are looking, whether it’s a mansion or anything else can be facilitated by social media. This can be a good way of finding sources for interviews.

We asked for advice from journalist Yulia Makarenko and a producer from Ukrainian television news channel 112 Ukraine. Yulia and the producer work on the corruption-based television program “People’s Procurator” (“Народная прокуратура”).

Producer: Before we treat any subjects for investigation, we conduct basic research on social networks and in the mass media. We had an investigation where we showed the secret life of a lustrated Yanukovych-era prosecutor. In this program, we talked about how he gave a Ferrari as a birthday gift to his 13-year old son, and also showed all of his other cars (such as a Land Cruiser 200, BMW 740, Jaguar F-Type, Lexis RX 360), the luxurious life that his wife leads, their expensive trips, real estate, and plenty more that would be impossible to pay for with the salary of a Ukrainian prosecutor. We found all of this with open source information, and the social network page of his wife was particularly valuable. After finding this information, we checked and confirmed it all via government registers, using “data journalism,” and receiving answers to our requests to informational resources, plus going to the guy’s house.

Yulia: Of course, openness and sometimes the bragging of relatives can help us to expose government officials. And it’s not just the teenage relatives who brag. Many times we find the social networks pages government officials’ wives where they post photographs showing off gold Rolexes that cost as much as a one-bedroom apartment in the capital. Very often, they use long-forgotten social networks, such as “Odnoklassniki” [a Russian-language social network that has waned in popularity in recent years due to the emergence of Vkontakte, Facebook, and Instagram]. Perhaps they do this in hopes that no one will look there?

When looking for the property of government servants in their income statements, we often find empty sections [when officials leave categories such as “place of residence” blank, in order to publicly conceal their often lavish residences obtained by illicit means or funds]. In such cases, it is important to ask for information not only from the official register of real estate rights, but also to duplicate the request with the telephone directories that everyone with an internet connection can access. There were times when information was not accessible in the registry, but in the directory we would find a street name and number. At first it seemed like no one lives at the address we found, but upon arrival, neighbors confirmed otherwise.

Ruslan Leviev is the founder of the Conflict Intelligence Team and assisted in open source research with Alexey Navalny’s anti-corruption group FBK in 2012-13.

When investigation corruption with government officials, the imprudence of people close to them (family, friends, colleagues) in publishing information online helps us. As they do not have any skills with information security, they believe that the property shown in published photographs does not show any connection with the official they are close to, thus they often publish revealing information. I remember many examples of how the connection between an official and company that won a tender was established thanks to profiles on social networks–they were friends with one another. I remember how the children of officials published photographs of cars and dachas on their social network accounts. The researcher’s task: finding this information. Find the profiles of the official’s relatives. And then closely watch the profiles of the friends of these relatives. A multistage search with a little bit of improvisation will help you find information.

Aric Toler

Aric Toler started volunteering for Bellingcat in 2014 and has been on staff since 2015. He currently heads up Bellingcat's training efforts and its Eastern Europe/Eurasia research.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

Support Bellingcat

You can support the work of Bellingcat by donating through the below link:

37 Comments

  1. James

    Very interesting, but can I just ask how you know the watches, jewellery, etc, aren’t fakes? Many people who want the bling lifestyle but can’t afford it will buy a counterfeit at a fraction of the cost. Similarly, some “rich kids” might claim/give the impression that a car, yaucht, etc, in a photograph is theirs, but it could just as easily be a friends, be hired, or borrowed.

    Please note, I am not trying to pour cold water on your work, or imply that the techniques you outline are worthless. Undoubtedly, the open source techniques/tools that you outline are useful and can be revealing. All I would say however is that we need to exercise a degree of caution when we draw conclusions, and if possible seek further evidence from elsewhere to support our findings.

    Reply
    • Black Star

      So mr. Putins press secretary would carry a fake watch in order to look rich and corrupt, when he should try his outmost to not look corrupt… I bet the watch is 100 % real and he is just as corrupt as his watch, jewellery, cars and houses give out.

      Reply
      • Shadynuk

        I think you require some type of proof that these articles are indeed genuine and as expensive as you say. YES, I think Mr. Putin’s press secretary could have several reasons to wear a fake watch. It gets him attention, it is trendy, the women like it and he has a safe explanation if asked about the cost – “it’s only a fake – don’t be ridiculous.”

        Reply
        • Aric Toler

          That’s always a question, but with Peskov it’s easier to resolve. If you read the original Navalny investigation into the watch, you’ll see that only *thirty* of these watches were made. You won’t get a lot of fake watches pretending to be a super-limited release of that size.

          Reply
          • stranger

            You should not rely on Navalny, inform napalm, Syrian terrorists and their propagandists for you own conclusions. You should investigate yourselves and be able to defend your evidences, your way of thinking and your logical chains, and specify all assumptions and guesses. Unfoturnatelly you usually rely on very questionable third sources.

          • Yuri

            Well, either people like Peskov are corrupt, or they are little losers who pretend to wear expensive stuff. Either way it’s pathetic.

    • Remo Williams

      How about an International Criminal Enterprise guilty of every crime known to human kind being investigated right now using open source techniques?

      The series begins here, you will be shocked.

      Bipartisan Criminality.
      Day 53 – Where is Eric Braverman?
      https://www.youtube.com/watch?v=rCTzFNrsKns

      Whole Series
      https://www.youtube.com/user/georgwebb/videos?flow=grid&view=0&sort=da

      The latest
      Day 102 – DynCorp Harvest, Why Killing Is Good Business, Part 1
      https://www.youtube.com/watch?v=wQSv_kZH0fo

      This is VERY dangerous to all of us, regardless of politics.

      It is the beginning of Open Sourced Investigative Journalism.

      Connect the dots, consider helping them.

      PLEASE Share, everywhere.

      Make sure you read the comments on each and every page. WOW, evil.

      Reply
      • Bob Dole

        Way to go Remo. Just watched a couple of your “major Hillary conspiracy videos”. I think you need to buy a new tinfoil hat.

        Reply
  2. Samirr

    Batman and Motorola

    Funny that Russians name themselves after American icons.

    PS, I know Motorola is no longer American.

    PSS, still laugh at Strelkov wearing Nike gear, being such an anti-American nationalist.

    Reply
    • Sergey

      Strelkov is pro-Russian nationalist, he might be anti-American or pro-American depending on the policies of American administration.

      Reply
  3. Adolf Hilter

    Sigh! Putin is a nationalist, right? Imperial nationalist with fascist ideas.
    Our terrorist friend Strelkov is in his mind a natiolist too, a imperial nationalist
    he has told us this many times but his favoruite time is pre 1917 and he wants to protect Putin but recently got disapointed with friend Putin so now Strelkow
    looks for job in Moskov and is about to start a nationalist party something Putin dont like since its competition and totalitarian nationalist imperialists hate competition.

    So now 51% of the US retarded citizens have elected Trump as president you do understand that Trump is also a nationalist, imperial nationalist so that’s why it makes all sense that Strelkov wears NIKE gear!

    Best wishes to you all from banana republic Sweden!

    Reply
  4. Tito

    Good post. Russia is so hypocrite: all this antiwest, anticapitalist rhetoric and all its elite are among richest people of Earth and their kids live, study in the West.

    Reply
    • stranger

      There is no any anti capitalist and anti west rhetoric in Russia. Don’t forget Russia is a wild capitalism itself, much wilder than your countries. And Russia got to this state from the ever wilder oligarchy of 90s. You just mess up all anti Russian and anti communism propagandistic slogans together, without understanding what actually is going on..

      Reply
      • Yuri

        You obviously don’t know anything about Russia if you think there is no “anti west rhetoric” in Russia.

        Reply
  5. Sergey

    Russia does not have problem with capitalism, Russia has problem with “promotion of color revolutions” foreign policy of some western countries. What does Strelkov’s Nike shoes have to do with anything? You can just as well to ask western consumers to stop using gas, oil and fertilizers produced by nationalist Russia, oil produced by undemocratic Saudi Arabia, and all products including Nike shoes produced by communist China and Vietnam.

    Reply
  6. Zaida

    All central Asian countries like Russia, Kasachstan etc.. are incredibly corrupt.
    East and West will never meet.

    Reply
    • stranger

      I’m not sure that is Russian fault. Russia is open for respectful mutually beneficial collaboration with the west. Aggression against Russia is coming from the west now! There are also Balkans, some Latin American and Middle East countries who are nice to Russia, as well as the second largest Slavic country – Belarus. The relationships with Russia were intentionally ruined by Obamas administration, after they supported the anti Russian coup in Ukraine. Look at yourself first before blaming others and think more than allow emotions driving you.

      Reply
      • Zaida

        Like in Soviet times, all Russian allies seem to be rogue countries: Belarus, Iran, Syria, Venezuela, Cuba, Nicaragua …

        Reply
        • stranger

          Who’s fault?? Russia is open for respectful and fair collaboration with the west. The west doesn’t need partners, but vassals.
          Your list is not full, how about reasonably good relationships with Israel, close historical ties with Serbia, BRIC block with Argentina and India (china is a different story), some other countries in the Middle East? You see what you want to see.
          Russia is open to others, but if her interests will be persistently ignored, will stay her ground.

          Reply
          • inot

            it’s russia’s fault. they’re the ones invading neighboring countries left and right. that’s not respectful mutually beneficial collaboration you dolt. take your propaganda somewhere else

          • stranger

            How about the violent government overthrow in Ukraine which was supported by Obamas administration and succeeded largely because of that support, if not organized, clearly against Russia? Is it a respectful mutually beneficial relationships? Everything else was the consequence. Russia didn’t invade neigbours. People of Crimea decided to go to Russia, because they were fed up with the new Ukrainian policies. Donbas is more difficult, but anyway local people are fighting there, that is not a Russian army, regardless of how many times you was told that. Ukraine is not uniform, split into east and west, many people support Russia. Russia and Ukraine have a very long history and lots of ties. Even if there is such a family quarrel now. That is all complicated. The simple answers are not true.
            How is it related to Syria and the chemical attack ascribed to Assad without evidences?
            I was answering another question. That is not propaganda, I’m honest and not trying to convince anybody, especially because it’s useless, I just try to show you what you are missing. That is wrong to blame only Russia, even if you want to play a war as kids do.

      • Zaida

        Like in Soviet times, all Russian allies seem to be rogue countries: Belarus, Iran, Syria, Venezuela, Cuba, Nicaragua,,,

        Reply

Leave a Reply

  • (will not be published)