How war crimes investigators do their jobs in evidence-rich Ukraine

Belkis Wille met a boy who wouldn’t open his eyes at a shelter in Lviv, Ukraine. There, she was recording potential war crimes for Human Rights Watch and had started interviewing the boy’s mother, a beauty salon owner whose face wore new lines of stress and exhaustion.

The day before, the boy, his mother, and his grandmother had fled Kharkiv amid shelling. His father and grandfather stayed in case they needed to fight. Leaving on the train, all three generations of this family watched their home city being bombarded, as their own apartment had been. The youngest, barely 2 years old, had decided he no longer wanted to see. 

“Look at my son,” his mother told Ms. Wille. “He hasn’t opened his eyes since we left Kharkiv.”

Ms. Wille listened and asked for more details, talking next to 20 or so other Ukrainians who had just reached Lviv and needed a place to rest. When they finished, she had three more pages in her notebook to archive on her laptop that night at the long kitchen table in her apartment, where she and her team worked into the late hours.   

Ms. Wille, speaking to the Monitor by phone, is a senior conflict researcher for Human Rights Watch. Those pages were just three out of the hundreds her team – conducting more than 150 interviews over three weeks – compiled in Ukraine in March. From those interviews, they wrote reports on human rights abuses and war crimes that Ms. Wille hopes will help hold the Russian military accountable. 

More than any conflict before, the war in Ukraine is on the record. Around 70% of the country has internet access, which means almost anyone with a smartphone can watch. And prosecutors are. 

In the past five weeks nongovernmental organizations, governments, intelligence units, and international investigators have all started documenting alleged war crimes in Ukraine. Each group has a different mandate, and their work isn’t all coordinated. But the number of people investigating, combined with near-limitless open-source information – from videos of Russian strikes to satellite images of troop movements – makes it more likely that specific charges are filed, a rarity in these investigations.

“It’s impossible today to conduct any small-scale, let alone large-scale, military operation or to violate human rights ... without outing yourself and who you are,” says Scott Edwards, senior adviser for crisis response at Amnesty International.

A nationwide crime scene

Russia outed itself when it invaded Ukraine this February. Now, its soldiers, officers, and leaders have become suspects in a nationwide crime scene. Millions of civilians experiencing attacks are witnesses. Everything from missile containers to military communications is evidence.

The detectives are dozens of investigators rushing to preserve that evidence while they still can. 

“There’s a lot of work to be done, and it will not be easy to do that work in circumstances where there’s shooting and shelling all over the place,” says Chile Eboe-Osuji, president of the International Criminal Court from 2018 to 2021.

That work starts with documenting the “crime base,” or the actual offense. Through witness testimony and open-source information available online, investigators build a detailed record of the war crime – or, more often in an actual case, a series of crimes.

In effect, Ms. Wille and her fellow investigators were in Lviv to do just that. Each day, she woke up around 7 a.m. and visited the train station to find witnesses fleeing Kharkiv who could confirm reports of civilian shelling and cluster-bomb attacks. Inside the station was too chaotic – too many people, moving too quickly, making too much noise. So she stood near the street out front, facing the station's columns, statues, and giant gray dome, and watched thousands of Ukrainians with pets, bags, and other personal possessions stream in and out.

She approached people who’d stopped for a break and, asking through an interpreter if they could speak and where they were from, explained the investigation. Each witness was different. Some had spent the previous week sheltering in a basement; others had taken videos of the attacks or even watched. Some had started processing the destruction; others were still in shock. 

“These interviews are very difficult because you’re talking to people who are quite traumatized and obviously you don’t want to do harm when doing the interviews,” says Ms. Wille. “But getting those crucial details is really important.”

She asked what the attacks sounded like, distinguishing the rumble of cluster munitions from the singular boom of other shells. Often, she pulled up a map on her phone and confirmed precise locations. 

Then she asked sources for photos and videos – shared over cables, AirDrop, or email to maintain the metadata, or digital fingerprint – which would help verify their testimony before the team used it in a report. All this she filed into a digital archive each night, so Human Rights Watch analysts could review and supplement her work. 

Mr. Edwards leads a similar team of analysts at Amnesty. On Feb. 24, soon after the war began, Amnesty researchers spoke with local sources to document a hospital strike in the southeastern town of Vuhledar. They sent their notes, along with photos and videos, to Amnesty’s weapons investigator, who identified the kind of missile used and noted that it was too inaccurate a weapon to responsibly fire near civilians.

These are the components of a crime base. Once investigators establish one, they can start building their case. 

A clue as tiny as a rifle serial number

That’s the easy part, says Bill Wiley, executive director of the Commission for International Justice and Accountability, who’s investigated war crimes for decades in Europe, the Middle East, and Africa. In all, he says, establishing a crime base should take up around 10% of an investigation. The other 90% is connecting the crime base to specific perpetrators through “linkage evidence.”

“The challenge from an investigation’s perspective is it’s not enough to just show that the crimes have happened,” says Rebecca Hamilton, a professor at American University’s Washington College of Law and a former lawyer for the International Criminal Court. “You need to figure out who can you hold criminally responsible.”

More than 10 years ago, on one of his first cases, Mr. Edwards received evidence of a clear war crime: a five-minute video of a mass execution during Nigeria’s fight against the terrorist group Boko Haram. 

The killers wore Nigerian military fatigues, but Mr. Edwards knew the Nigerian leaders could claim they weren’t government soldiers. He needed, somehow, to confirm their identity. Watching the video carefully, he caught just a few frames in which a serial number on a soldier’s rifle became visible. Through Nigeria’s Ministry of Defense, he confirmed that the rifle hadn’t been reported stolen and belonged to a specific unit. 

“If we hadn’t noticed just in the two or three seconds that the serial number presented itself, that information would have been lost forever,” he says.

The war in Ukraine won’t offer such smoking guns, says Dr. Wiley. Unlike prosecuting an individual incident, cases built around the way a war is being fought – called a “conduct of hostilities” case – require piecing together evidence like an amorphous puzzle. 

The key is looking for the right information and the right sources, says Dr. Wiley. 

“You have to take a cold, practical approach to this stuff, rooted in the requirements of the law,” he says. Witnesses may have powerful stories about an attack and its effects. But they can rarely help link it to specific perpetrators. In most cases, the law demands proof of knowledge or intent. If Russians bomb a theater, investigators need to show a specific leader ordered it, that it wasn’t near a military target, and that it didn’t house military assets. Without that, they would need to show a leader was aware such abuses were occurring but didn’t stop them. 

In the past, evidence like that has almost only come from the enemy, making it difficult to collect and difficult to preserve, says Dr. Wiley. He suggests Ukrainian soldiers should fleece prisoners and casualties for “pocket debris,” like notes, cellphones, encryption keys, and laptops. They should also monitor Russian military cellphone and radio communication, which so far has often been unencrypted and easy to hack.

Connecting dots from bomb back to launch 

The advent of open-source investigations helps solve the linkage evidence problem. Researchers like Eliot Higgins, founder of the open-source investigative group Bellingcat, can now compensate for distance from the conflict with the volume of information available online.

Early in March, Mr. Higgins played connect-the-dots with remnants of cluster munitions dropped on Kharkiv. 

These weapons hit the ground in three stages, and each piece points back toward the other. From abroad on a computer, Mr. Higgins marked the three points, drew a straight line through them, and repeated the process with nearby impacts. Altogether, he could trace the attacks to a single artillery site – geolocated on a map Bellingcat helped develop – with the right number of launchers, in the right range, pointing in the right direction. 

“If we can complete that kind of chain of responsibility, it means it’s a lot easier for accountability processes to actually accuse specific units, governments, and commanders, which is often what’s missing,” he says. 

Bellingcat started monitoring Russia’s military buildup this February through satellite images and later through TikTok videos of troop movements, tracking and indexing specific attacks. “We’ll dig for every single possible scrap of information that we can find,” says Mr. Higgins. 

Those scraps may link all the way up Russian leadership, which is perhaps already accountable for not stopping existing attacks, says Dr. Eboe-Osuji, the former International Criminal Court president. “What everybody’s seeing on television ... I’m sure Mr. [Vladimir] Putin is seeing,” he says. “That is, Russian fire directed at apparently civilian facilities.”

Justice isn’t always enforceable

That doesn’t mean he will face consequences. Russia is already ignoring a “provisional measure” from the International Court of Justice to stop fighting. Soviet dictator Josef Stalin once quipped, “‘How many divisions has the Pope?’” says Stephen Rapp, the U.S. State Department’s ambassador-at-large for the Office of Global Criminal Justice. 

In other words, justice isn’t always enforceable.

But Ambassador Rapp, who prosecuted former Liberian President Charles Taylor for war crimes in neighboring Sierra Leone, has seen it enforced. Former Yugoslav leader Slobodan Milošević too would likely have been convicted for war crimes in Kosovo had he not died in custody. 

Mr. Putin may not reach trial, but the war he began will be recorded. 

After speaking for an hour with the family in Lviv, Ms. Wille could see they needed to stop. The son had started crying. His mother and grandmother looked drained. She thanked them for their time, asked if they could speak again if necessary, and left.

But the moment stuck with her. The boy was too young to understand what was happening or why he had to leave his father and home. He couldn’t understand an investigation, war crimes, or accountability. He could only feel the trauma, and show what it felt like – forcing his eyes shut in snow pants and a thick jacket on his mom’s lap.

Maybe, that feeling would help other people see.