<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-conflict-zone-investigation
description: >-
  Document events in conflict zones using open-source evidence including social
  media posts, satellite imagery, weapons identification, and casualty
  verification. Berkeley Protocol methodology for digital evidence.
domain: cybersecurity
subdomain: investigation-attribution
tags:
  - conflict-investigation
  - weapons-identification
  - war-crimes
  - berkeley-protocol
  - osint
  - bellingcat
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Conflict Zone Investigation

## Overview

Conflict zone investigation documents events using open-source evidence to
establish facts about military operations, weapons use, civilian casualties,
and potential violations of international humanitarian law. Follows the Berkeley
Protocol for digital open source investigations.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling |
| ExifTool | `sudo apt install libimage-exiftool-perl` |
| yt-dlp | `pip install yt-dlp` |
| ffmpeg | `sudo apt install ffmpeg` |

## Key Concepts

### Evidence Categories

| Category | Sources |
|---|---|
| **Visual media** | Photos, videos from social media and news |
| **Satellite imagery** | Before/after analysis of strike sites |
| **Weapons remnants** | Munition fragments, delivery systems |
| **Witness testimony** | Social media posts, news interviews |
| **Official statements** | Military communiqués, press releases |
| **Flight data** | ADS-B tracking for military aircraft |

### Weapons Identification

```
1. Photograph munition remnants from multiple angles
2. Measure dimensions if possible (reference objects)
3. Note markings: lot numbers, manufacturer codes, dates
4. Cross-reference with munitions databases (CAR, ARES)
5. Determine type: air-delivered, artillery, rocket, IED
6. Identify manufacturer and model
```

## Quick Reference

```bash
# Archive social media evidence
node agent.js archive-post --url "https://twitter.com/user/status/123"

# Extract video frames for analysis
node agent.js extract-frames --video evidence.mp4 --interval 5

# Identify weapon from image
node agent.js weapon-id --image munition_fragment.jpg

# Build incident timeline
node agent.js timeline --incident-dir ./incident_001/

# Verify casualty report
node agent.js verify-report --sources sources.json
```

## Workflow

```
1. MONITOR    — Track social media and news from conflict zone
2. COLLECT    — Archive all relevant media with chain-of-custody
3. VERIFY     — Authenticate media (geolocation, chronolocation)
4. IDENTIFY   — Catalog weapons, vehicles, units visible
5. TIMELINE   — Build chronological event reconstruction
6. CORRELATE  — Cross-reference multiple independent sources
7. ASSESS     — Evaluate against IHL (international humanitarian law)
8. DOCUMENT   — Produce investigation report per Berkeley Protocol
```

## Verification

```bash
yt-dlp --version
ffmpeg -version | head -1
node agent.js --self-test
```

## References

- [Berkeley Protocol on Digital Open Source Investigations](https://www.ohchr.org/en/publications/policy-and-methodological-publications/berkeley-protocol-digital-open-source)
- [Bellingcat Conflict Investigation Guides](https://www.bellingcat.com/resources/)
- [Conflict Armament Research](https://www.conflictarm.com/)
- [Armament Research Services (ARES)](https://armamentresearch.com/)
