How internet sleuths exposed a celebrity “volunteer soldier” in Ukraine as a fraud

In March, the month after Russia declared war on Ukraine, a new account joined Twitter under the handle CanadianUkrain1, the user claiming to be a North American citizen joining the frontlines of the Ukrainian efforts against the Russian invasion. “Fighting the Russian invader along the Mykolayiv-Kherson axis,” read its bio. “Glory to Ukraine!”

CanadianUkrain1 shared videos and images he claimed to have taken himself from combat, alleging to have killed a Russian soldier with a tomahawk on one occasion and writing a tweet thread about a top-secret bicycle mission through Kherson on another. But most of the account’s posts resembled the work of amateur open-source intelligence researchers, known commonly as OSINT: often anonymous social media users who analyze conflict zones by using publicly accessible information gleaned from platforms like Google Maps. CanadianUkrain1 would repost content, mostly from Telegram, adding his own commentary. 

His follower count skyrocketed, but the ruse did not last long.

“He was putting out some fanciful BS,” Calibre Obscura, a popular pseudonymous OSINT Twitter user, who specializes in weapon identification, told Rest of World. “It was the internet falling for fun, movie narratives.”

Soon after the account’s creation, CanadianUkrain1 began to draw scrutiny from the online OSINT community — including Aric Toler, a researcher from the professional open-source publication Bellingcat — who began to poke holes in his story. One Twitter user, known as Nexus Intel, was able to track down CanadianUkrain1’s IP address, proving that he was in fact tweeting from Ontario, Canada, not the frontlines of Ukraine. OSINT investigators have identified an individual suspected to be tied to the account. Rest of World has reached out to the account but not received a response from the individual. 

In the years since amateur open-source sleuths gained traction across social media, dissecting atrocities in Syria, Iraq, and eastern Ukraine on social media, the most recent Russian invasion and war in Ukraine have pushed the amateur OSINT community even further into the limelight, with accounts gaining hundreds of thousands of followers and mainstream outlets citing their work. 

With this growing fame, the community has to reckon with the challenges of people who are after internet glory. Rest of World spoke with four members of the amateur OSINT community, along with three open-source experts, who told Rest of World that the case of CanadianUkrain1 is representative of deeper issues — where inaccurate and sensational information is encouraged by the incentives of platforms like Twitter. “With social media, you get rewarded for being the first,” said Calibre Obscura. “It doesn’t encourage a culture of verification, and it doesn’t encourage a culture of waiting to see if something is right.” 

While amateur OSINT accounts on social media have existed since the early days of the Syrian civil war, the field has become increasingly professionalized in the decade since, said Steven Seegel, a historian of Eastern Europe for the University of Texas at Austin.

“With social media, you get rewarded for being the first.”

Bellingcat served as the model, often hiring previously amateur OSINT investigators, such as Aric Toler, the director of training and research at Bellingcat, to become salaried researchers. Now, publications like the New York Times and Washington Post have their own visual forensics teams that borrow from OSINT work. 

Seegal said that the increased hireability of researchers has also led to desperation within the amateur OSINT community. “A lot of people are acquiring skills on the side and pitching themselves for employment.”

Some account users have taken to inserting OSINT into their handles or bios, capitalizing off the buzz of the term, to gain followers or get jobs, experts say. “They’re pretending like they’re intelligence agents,” said Toler, who described these account users as “cosplaying CIA or FBI people.” 

CanadianUkrain1’s combination of supposed original content from the frontlines alongside open-source-style analysis proved irresistible for his social media audience. By the end of April, his account had over 100,000 followers. “Aspiring amateur OSINT people — the most aggressive ones — want to be media personalities,” Seegel told Rest of World.  

As quickly as CanadianUkrain1’s profile exploded, though, it collapsed in spectacular fashion when he posted a picture of his assault rifle. Another OSINT account user — known as Kung Flu Panda — pointed out that it was an airsoft gun. “Exposing a fraud is like figuring out a magic trick,” Kung Flu Panda said. “The first step is to stop believing in magic.”

On July 1, CanadianUkrain1 deleted his account and left Twitter.

Joanne Stocker, a journalist at the open-source intelligence and news outlet Storyful, who utilizes the work of amateur OSINT researchers, praised the meticulous and transparent nature of OSINT investigations. Even so, she warned of the increasing noise created by accounts chasing clout and reposting content from Telegram as their own. The obvious danger, as CanadiaUkrain1 demonstrated to the community, is the spread of incorrect or false information. That challenge has spread outside the confines of war. Toler said that QAnon acolytes often present themselves as OSINT analysts, benefitting from the growing legitimacy of the community. “It makes actually verifying information very difficult,” Stocker told Rest of World. 

But the very risks posed by accounts such as CanadianUkrain1 draw on the same skills that take down a fraud. The accounts that employed visual forensics techniques to discredit CanadianUkrain1 — Nexus Intel and Kung Flu Panda — are far from professional, or even run by major figures in the amateur community. Both have fewer than 3,000 followers. And yet, thanks to their open-source prowess, they were able to expose the hoax. 

“It would be a warning to anyone who aspires to be like [CanadianUkrain1],” Seegel said. 

Justin Peden, the user behind the popular The Intel Crab account, thinks of the amateur OSINT community as a decentralized one that was able to rally together against the common cause of debunking CanadianUkrain1. “It’s such a collaborative space when it wants to be and when it has to be — to shoot down this poseur like that,” he told Rest of World. “It’s a really cool feeling.”

Even so, Peden lamented that the rise of OSINT’s influence means an accelerated spread of mis- and disinformation from hangers-on and opportunists. “A majority of us have shifted from not only making discoveries but debunking a lot,” he said. “I notice a lot of what I do — compared to this time last year — is I’m spending half my day shooting down nonsense.”