Exclusive: How cryptocurrency tech could help prove Russia committed war crimes

A case based on cryptography was presented to the International Criminal Court. And that can change the course of investigations.

In early March, a Telegram user posted a photo of a wrecked school in the outskirts of Kharkiv, Ukraine. The photograph showed the side of a classroom with a large borehole and a pile of debris, including desks and chairs.

International law prohibits intentional attacks on educational institutions. That means the photograph could serve as evidence of a potential war crime, according to Starling Lab, a research center affiliated with Stanford University and the USC Shoah Foundation.

Accompanied by a team of human rights experts and specialist lawyers, Starling Lab presented evidence of this attack and four others on Friday to the International Criminal Court, which opened an investigation into the alleged crimes. of war in Ukraine in the months following the invasion. from Russia at the end of February.

The Starling dossier is not a typical exhibit. Instead, the band’s presentation will show publicly available information online that has been curated and verified using block chain behind cryptocurrencies, in what would be the first such evidence in a courtroom.

“We believe the use of this technology is exceptionally appropriate and powerful in this scenario,” Jonathan Dotan, founding director of Starling, told CNN.

The goal, Dotan said, is to build “additional layers of trust.” O block chain is a record of data distributed over a computer network, which makes it more difficult To hack or manipulate. By leveraging these capabilities and other encryption technologies, Starling is able to prove that information has not been manipulated and ensure that it does not disappear if, for example, a tweet is deleted or if a cloud database is rendered inefficient.

The invasion of Ukraine has produced mountains of valuable information online that could be of interest to prosecutors, thanks to the ubiquity of cellphones. This presents an opportunity and a challenge, given the lack of protocols for preserving digital evidence.

Moscow has denied targeting civilians, but a CNN investigation found that 13 of 16 Kharkiv sites believed to have been hit by Russian missiles in the first week of March were schools, apartment buildings and shops .

“This is the first conflict in which so much media evidence seems poised to play a role,” said Andrew Clapham, professor of international law at the University Institute of Geneva and expert in human rights law.

Counter-information and disinformation also make it difficult to sort out what is real online and what is not, as malicious actors attempt to obfuscate historical records. This is where the crypto world can help, according to Dotan.

“As events continue to change on the ground, as knowledge networks expand, it is very important to use these tools to secure this information,” he said.

Documenting war crimes

The Dotan team has already used its expertise in block chain to preserve Holocaust testimonies and document evidence of war crimes in northwestern Syria. But in Ukraine, when war broke out, they acted quickly.

In partnership with the Atlantic Council’s Digital Forensic Investigation Laboratory and Hala Systems, which is developing technology to protect civilians, they decided to focus on the two weeks of attacks on Kharkiv in March and look specifically at what which appears to have been deliberate attacks on schools.

The presentation details five attacks on educational institutions that took place between March 2 and March 16.

“There is a very clear strategy behind the attacks on education and its use as a weapon of war,” said Ashley Jordana, associate director of Hala Systems, which worked with Starling to prepare the submission to the International Criminal Court.

“The thinking behind this is that if we attack a building dedicated to an institution, we are not only attacking the child themselves – and their well-being, development and mental health – but, by proxy, we are creating a kind of insecurity that has a truly destructive impact on a country’s overall social and economic growth”.

To begin, the team began seeking information from open sources that could help prosecutors build a case in which the Russian military had committed war crimes. When they came across a relevant message on Telegram or Twitter, Starling investigators used cryptographic technology to capture, store and verify each piece of evidence.

The objective: to prove exactly when they had custody of the information, and to create a means of demonstrating, over time, that it has not undergone any alteration.

How it works?

First, they archived the post and its metadata – such as the author, when it was created, and how many times it was viewed. They also captured the site context and user profile. Then they used cryptography to create unique fingerprints, or “hashes,” that would change if the underlying information changed.

Fingerprints and metadata were then stored in multiple block chains. This performs a similar function to when a notary confirms that someone was in possession of a legal document.

The team then focused on storage. The files were uploaded to two decentralized storage networks, Filecoin and Storj. The information was then stored in hidden on multiple nodes around the world, rather than being hosted on a single system like Amazon’s cloud.

After that, Starling and its partners independently verified the information – verifying the source, diving into metadata, using geotagging tools to confirm the authenticity of the photos, and seeking corroborating evidence from organizations such as as the United Nations and Human Rights Watch.

These investigative methods are similar to those used by journalists when scanning documents available online. CNN’s March investigation included details of one of the attacks featured in Starling’s presentation.

This corroborating material was then linked to the other files that had been uploaded to several block chainscreating a chain of evidence verified and protected against tampering.

“We don’t just provide a series of links to investigators,” Dotan said.

Starling’s method could also be useful in the face of whirlwinds of misinformation. In the group’s presentation, it was noted that a “pro-Russian online source” was trying to restructure the narrative around one of the school attacks.

What happens next?

It will be up to the ICC to decide whether the evidence presented by Starling Lab is included in any case. One consideration for the court will be that it cannot try people in their absence, said Clapham of the University Institute of Geneva. This means that the prosecutor will only be able to prosecute people who have gone to court in The Hague and will prioritize relevant evidence in such cases.

But Dotan and Jordana hope the ICC will be receptive to their methodology. In the strategic plan for 2016 to 2018, the ICC said it was seeking to develop strategic partnerships with non-governmental organizations and academic institutions that could “support the identification, collection and presentation of evidence through technology “.

“Ten years from now, when everyone has forgotten that and has to go back to that day in March when a bomb fell on a school, they will have a knowledge network that can cryptographically prove that every step – as ‘they capture, store and verify – was secured by some form of technology,’ Dotan said.

The ICC has also telegraphed its intention to speed up work on cases involving children.

More work will need to be done by prosecutors to prove other elements of the alleged crimes detailed by Starling Lab, including assembling additional evidence about the perpetrators of the attacks and their intentions, said Kelly Matheson, a human rights attorney. man and former video director. as a proof program.

Still, she said the methods used by Starling are “an extremely useful tool to ensure that incoming information is verified to legal standards and usable by the court.”

Leave a Comment