Geolocating a plane shot down in Ethiopia: mountain profiling with PeakVisor

Through the use of publicly available satellite imagery, open source investigative techniques, and a bit of creativity, we can find where and when a photo or video was taken. But sometimes, geolocating footage comes with unique challenges, all of which differ depending on the country, landscape, availability of data, or the quality of the footage you are trying to geolocate.

In these case studies we look at the geolocation of footage in remote environments, and how Google Earth’s mountain ranges can play tricks on our confidence levels of locations.

I have broken this post down into two main sections:

• A primer on use of PeakVisor, a tool that gives more accurate mountain silhouettes than Google Earth, and how it helps as a confirmation tool in geolocation work where Google Earth has not truly represented what is seen in the footage, with a case study from Yemen
• A recent case study geolocating footage circulated online showing the debris of an Ethiopian C-130, believed to be somewhere in the Tigray region

A primer on geolocation with PeakVisor

Finding where an image or a video was taken often involves searching for clues around, and in, a video or photo. I say around because there is often vital context that comes with media, such as a country, region, or possible location. By looking for clues within the imagery, can we start to consider matching that up with what we might see on a map.

When looking at regional conflict areas, often there are no obvious clues to find a location. At least, not as obvious as a street sign or a shop name.

When it comes to looking at these remote areas, clues do exist such as mountains, tree formations, bodies of water and other natural features. I have found numerous successes in using mountain ranges as a starting point in many difficult geolocations. But caution should be applied, as mountain ranges on Google Earth might not always appear as they would in real life.

For example, take the Google Earth view from a base near Najran, overlooking the border between Saudi Arabia and Yemen, and compare it against the same view in PeakVisor. Notice the difference in definition, defined peaks, and the more jagged appearance on the profile of some of the mountains.

As you can see, the level of detail is stronger. Google Earth’s meshing over its elevation data is not always as precise as we would like when we are relying on specific peaks to locate or match an image or a video. Having this added benefit of detail from PeakVisor helps substantially.

In another example, this time in Yemen, there was much more of an issue with Google Earth’s formations during the geolocation of a Saudi Air Force jet that was allegedly shot down by Houthi fighters.

The confirmation from that geolocation should have been made with two specific ridgelines seen at different intervals throughout the footage.

However, at the location on Google Earth there is barely any resemblance to the elevation data. I wrote about this example for Bellingcat in 2019, as it was a striking mismatch between what we see on the ground, and what we see on the satellite imagery layered over Google Earth’s elevation data.

In this circumstance, we can be definite of the location given the specific fingerprints unique between the satellite imagery and what is seen in the footage. For example, a rock formation creates a very definite match. But using PeakVisor creates a definite match between ridgelines.

By going through past geolocations like this, we can see just how much a little extra detail can help in the confirmation of a location.

Case study: the crash site of a C-130 in Ethiopia

In this specific geoprofiling case study, we look at the verification of footage of a crash site in Ethiopia which was circulated widely on social media. Most of the uploads claimed the wreckage was of an Ethiopian Air Force C-130 in Ethiopia’s Tigray region. The question to answer was where exactly that video was filmed.

A primary starting place is always the context and content of the media. What are the circumstances of the upload, what are people saying about it, and what do we see? First, alternative images from the debris confirm that the plane may have been a C-130, including a photograph of the aircraft’s identification tag found in the wreckage.

There were also a number of posts online that claimed the plane crashed somewhere near a town called Gijet, in the Saharti Samre area. So there was a clue as to a location, but also something to use as a keyword in further social media searches.

While searching for other imagery on Facebook, I identified a post which was helpful as it showed a possible location in the sky from where the plane was downed, some specific building types that should be identifiable on satellite imagery, and an easy to locate mountain range.

The mountain range was rolling to the left, with no other mountains seen in the back left of the image, so this led me to believe the location was on the side of a mountain range.

After a short amount of time panning around Google Earth near the area of Gijet, I identified the location of that image.

Now that the location of that image was firm, I used that to work towards the much bigger task of finding where the downing of the plane was. This was easy to do, as we can see the location in the sky where the plane might have been hit. This lines up with features on the ground. Therefore, looking along that match line would lead me to the eventual final location.

In the original footage there also appeared to be structures that looked like powerlines, and I thought that might be a helpful resource to identify on satellite imagery to see if there were powerlines that crossed my line of sight from where the plane went down.

While it took some work to identify nearby powerlines through a close inspection of the satellite imagery, I stopped at the second set as I had started to see other features that matched, such as buildings, a road, and of course, a fitting mountain profile.

From what can be seen on Google Earth, the mountain range makes a close fit with what we can imagine should be similar to the real footage. But there are some points in the elevation profile that are not accurate. As done above with the previous PeakVisor examples, layering the crash site footage over the mountain range seen in PeakVisor gives an almost perfect match.

But the final task is not yet complete. While the mountain profile is a confirmed location, further confirmation can be sought by analysing content in the footage with what is seen on the ground on satellite imagery. For example, the trees, houses, powerlines and other features. This allows me to identify an as exact as possible location.

Once I have identified some features that can create a line, I draw lines back from them to find my backbearing. This gives the exact location of where the crash site footage was filmed from.

In a more recent update, Twitter analyst @Gerjon_ further confirmed the location, and verified the date range, by using Sentinel Hub’s EO Browser with more recent satellite imagery of the area. The difference between what is seen on 20 June and 25 June 2021 shows two small black patches appearing in the centre of the imagery on the later date. That was the location of the crash site.