By Dr Tristan Jenkinson

Introduction

A little delayed, but my write-ups from last month’s Bellingcat challenges are here. Last month, the theme was “Back in Time”, and the challenges focussed on the history of Bellingcat itself.

Let’s dive in.

Fresh Faced

I used a quick Google images search, which did not turn up much that was obviously useful, though it is interesting that they were all images of Eliot Higgins. I moved on to consider the text included at the bottom of the challenge image.

A quick ChatGPT query identified that the language appears to be Bosnian/Croation/Serbian:

A direct search for the quote did not find much of interest, so I focussed down on a simpler search. Running a date range until January 2014 (since our focus is 2013), and running over youtube.com (since this is the site that we are interested in).

There is an interview with Eliot Higgins in the top hit.. though this does not appear to be the one that we are looking for, since it seems to be based in English, and the video, based on the translation of text in the challenge image, seems likely to be in Bosnian/Croatian/Serbian.

The third entry could match the language we are looking for – a quick ChatGPT query to check on the language and meaning results in the below:

This appears to match the language, and could well be the video that we are looking for.

The video is located at https://www.youtube.com/watch?v=k7qd4Y6QAfY

The display on opening is:

While this does not exactly match the challenge image, it is clearly filmed in the same location, and items are in the same place, Eliot’s appearance is similar, so this does appear to be the interview that we are looking for.

Recall the address is https://www.youtube.com/watch?v=k7qd4Y6QAfY

The code we need is therefore k7qd4Y6QAfY

Solution: k7qd4Y6QAfY

Training Time

We know from the challenge text that the image is from the event that we are looking for information on. Helpfully we also have an image credit – to ARIJ Network. If they were taking photographs at the event, then the name may be tied to the event that we are looking for.

Combining this with other information that we are looking for from the text, I ran the below Google search:

We can see we have a likely search hit.

Following the link, we get to https://arij10thannualforum2017.sched.com/type/workshop/d a quick screenshot is below:

So, this is information that there was a Belllingcat training session hosted by Christiaan Triebert in December (1-3) 2017. It appears that this is the right event.

We can see that this was hosted at the Movenpick Result and Spa Dead Sea.

If we hover over the event, we get more information:

So, we can see that the Bellingcat event took place in the room Al Diwan 1 at the Movenpick resort and Spa Dead Sea… however, this is not the answer that we are looking for…

Searching the current Movenpick site, they actually have a page for this room – https://movenpick.accor.com/en/middle-east/jordan/dead-sea/resort-dead-sea/meeting-rooms/al-diwan.html.

Included on this page is an image of the room:

This doesn’t match the colour scheme seen in the challenge image. Although it is possible that the colour scheme could have been changed since 2017, this is not the room that we are looking for.

It is also worth noting that while the challenge says that “The image above shows Christiaan at that event” it does not say that the photograph was taken during the actual workshop.

Back to the Movenpick site, we can look at other rooms in the hotel, and flicking through those, we find a picture of the Grand Ball Room (https://movenpick.accor.com/en/middle-east/jordan/dead-sea/resort-dead-sea/meeting-rooms/the-grand-ball-room.html):

Here, the carpet matches the challenge image, and the walls match as well, so it was likely taken here, during the conference event.

Solution: The Grand Ball Room

Creating Community

A challenge of two halfs – we need to find the time of the Twitter announcement, and also the discord servers creation time.

The easier timing is probably Twitter, so lets search for this message across X…

A simple Google over the X site below:

site:x.com “we finally got around to creating a Bellingcat Discord server”

We get one hit:

Interestingly… the link sets the language to bg (I think Bulgarian).

Removing the “?lang=bg” from the link, we get the default English language version:

So the Twitter announcement is listed at 3:12pm May 12 2020.

How Twitter report timestamps has changed. At the time of writing, I believe that the time displayed is based on local time of your machine… however, I thought that it would be helpful to check this.

To check this, I used TweetedAt (https://oduwsdl.github.io/tweetedat).

If you use the ID from the full Twitter/X post address into TweetedAt, it will report the date and time it was posted.

The address of the post is https://x.com/bellingcat/status/1260211332437213184

We want to use the ID code 1260211332437213184.

You can check this here https://oduwsdl.github.io/tweetedat/#1260211332437213184

So we are indeed looking at 15:12 BST, or 14:12GMT, but we now also have a value for the seconds (an additional benefit that can be gained from TweetedAt).

Now we need to find when the Discord server was set up.

To do this, we can use a DiscordID.

If you are a member of the Bellingcat Discord, it is easy to identify the server ID:

Log into Discord using a browser, and click into one of the channels on the server you want to find the ID for. Your browser address contains the Discord server ID. It should look like this with a pair of numbers, the below is for the Welcome channel on the Bellingcat Discord:

https://discord.com/channels/709752884257882135/966596342258499615.

The first of the pair of numbers is the ServerID. The second is the ChannelID.

If you go to https://discord.id, you can enter the server ID to get the creation date of the server. If you put in a ChannelID, it will give you the creation date of the channel. Note that this site is not officially linked to Discord, I believe that it just uses the API to pull the info through and display it.

If we put in the serverID (709752884257882135), we can see that it was created on 12 May 2020 (as we knew from the Twitter date), but we get a time of 13:04:34 UTC.

Putting the two parts together, and using just the UTC times (assuming equivalence to GMT), we have that the server was created at 13:04:34 and the Twitter post was published at 14:12:49, a difference of 68 minutes.

So our answer is 68.

Solution: 68

Future Plans

Another multipart puzzle. Find when Bellingcat was registered… find the future plans document, then find their article closest to the date.

The first thing that we need to find out is when Bellingcat was registered in The Netherlands.

Any company in the Netherlands has to register in the Business Register of the Netherlands Chamber of Commerce (KVK). To search for this information, I headed to OpenCorporates (opencorporates.com), which pulls together the corporate registers from many different countries.

Searching for Bellingcat, I found a few entries (https://opencorporates.com/companies?utf8=%E2%9C%93&utf8=%E2%9C%93&q=Bellingcat&jurisdiction_code=&type=companies)

We can see that we have only one entry relating to Netherlands, and this is for a non-profit, so it seems that we are on the right track. If we select this entry, we can see more information (https://opencorporates.com/companies/nl/72136030).

However, there is no date reference available here for when the company was registered. Sadly it appears that this was a wasted effort.

Running a quick Google, I swiftly located the Bellingcat About page (https://www.bellingcat.com/about/general-information/) which provides some really helpful information, including:

We get a KVK reference, and so it appears that the registration with the KVK (Netherlands Chamber of Commerce) was on 11 July 2018.

We are now looking for a document outlining the Bellingcat plan for the future, which was released nearly two years later, i.e. before August 2020.

Running a quick Google, with a time filter, I located a policy plan document dated 22 Jun 2020:

This PDF document (https://www.bellingcat.com/app/uploads/2020/06/Bellingcat-Policy-Plan-2019-2021.pdf) states:

“The purpose of this policy is to describe our organisation and its structure (including management, financing and governance), its ambition and the strategies we employ to achieve our goals and amplify the effects and impact of our work. The policy also states broadly our principles and vision, and more specifically how our activities are implemented and supervised.”

This sounds like it meets the criteria of the document we are looking for.

The Document Properties of the file show it was created in June 2020 (nearly two years after the registration in Netherlands in July 2018), and lists Aric Toler as the author:

I know that Aric Toler has published articles on Bellingcat, and was lucky enough to do training with him when I did one of Bellingcat’s workshops a few years ago.

This therefore fits with the information in the challenge… so we want to now find the article on the Bellingcat website that Aric wrote, closest to 22 June 2020 (and then find the last word of that article).

I took a look at the Author page for Aric on the Bellingcat website (https://www.bellingcat.com/author/arictoler/). This does list out his articles, but without listing all the times and dates. However, when hovering on the link to the article, the address of the article is displayed in the browser, and Bellingcat use a year/month/day folder structure for uploading articles, which we can therefore use to identify the dates of each article.

Based on the date reported in the paths, the articles appear to be in reverse chronological order (as would be common on a list of articles, the most recent is at the top).

Flicking through, I found articles with the below dates on page one of Aric Toler’s author page:

2023/06/23
2023/05/09
2023/04/28
2023/04/09
2023/03/03
2023/02/13
2022/10/28
2022/04/01
2022/02/08
2020/10/14

The first two articles on page two were dated:

2020/04/15
2019/12/26

We are looking for the article closest to 22 June 2020.

This would be the article dated 2020/04/15 (15 April 2020). This article was “How (Not) to Report on Russian Disinformation” (https://www.bellingcat.com/resources/how-tos/2020/04/15/how-not-to-report-on-russian-disinformation/)

The last paragraph of the article is below:

Therefore the last word is record.

Solution:record

Toolkit Tracing

I have a copy of the PDF version of the toolkit mentioned above, which I picked up when doing a Bellingcat training workshop back in 2020. This was version 4.7 from March 2020. It was, at that time, available from bit.ly/bcat-tools, where it was shared from Google.

This link no longer works, but the page is:

https://docs.google.com/document/d/1BfLPJpRtyq4RFtHJoNpvWQjmGnyVkfE2HYoICKOGguA/edit

This IS available on archive.org

https://web.archive.org/web/20250000000000*/https://docs.google.com/document/d/1BfLPJpRtyq4RFtHJoNpvWQjmGnyVkfE2HYoICKOGguA/edit

Though it does through an error, you can still read through the content. The Handbooks section from my copy matches that of the online copy available on 11 March 2020, the text of which is below:

Note that the challenge specifically states that the Guides and Handbook section “included a link to a document that is no longer accessible”, so we are looking for a document, NOT a webpage.

The only obvious document is the PDF available from UNOCHA. Indeed, this is no longer available at the stated address (docs.unocha.org/sites/dms/Documents/FEAT_Version_1.1.pdf).

Back to archive.org and we can find a copy of the PDF at https://web.archive.org/web/20180602185058/https://www.unocha.org/sites/dms/Documents/FEAT_Version_1.1.pdf

Opening this file, we flick to page 39 (using the printed page numbers, not the number of pages in the document) and we see a table: