Images, Video & Geospatial Sources

Learning Objectives

• Choose the right reverse image search engine for a task and explain why using several matters
• Explain what face-search engines are, why they’re controversial, and why they’re off-limits for this class
• Identify map, street-level, and satellite imagery sources by region and by need (current vs. historical, free vs. paid)
• Use supporting sources (OpenStreetMap, sun position, weather history, webcams, Wi-Fi maps, flight and ship trackers) to confirm a location or time
• Know which tools help verify video

Why Visual Sources Matter

Photos and videos leak more than people realize: a street sign in the background, the angle of a shadow, a distinctive building, a Wi-Fi network name on a screen, or GPS coordinates hidden in the file. Visual OSINT answers three questions:

1. Where was this taken? (geolocation)
2. When was it taken? (chronolocation)
3. Is it what it claims to be? (verification, covered more deeply in Module 7)

This file catalogs the sources. The step-by-step techniques (how to geolocate, how to read EXIF) live in Module 4 Collection Techniques.

Reverse Image Search Engines

Reverse image search takes an image instead of keywords and finds matching or similar images online. Each engine has a different index and a different matching style, so always try several.

Tips:
- Crop first: Search just the building, logo, or face region instead of the whole image.
- Oldest copy wins: Old images recycled as “breaking news” are a classic misinformation pattern, and TinEye’s Oldest sort exposes them quickly.
- OPSEC: Uploading an image sends it to that company. Don’t upload sensitive client material to services you haven’t vetted.

Attacker use: Finding a person’s other accounts from a profile photo, or locating a home from a photo.
Defender use: Finding stolen product photos or brand impersonation, and debunking fake images.

Face-Search Engines (Awareness Only)

Face-search engines (facial recognition search) take a photo of a face and return other photos of that person from around the web.

• PimEyes is the best-known public example. It offers a limited free search, paid subscription tiers (about $29.99, $79.99, and $299.99 per month), and paid “PROtect” plans (about $89.99–$299.99 per month) to exclude photos from public results.
• Clearview AI sells facial recognition built from scraped images to law enforcement and has been fined by several European data protection authorities (verify before class for current fines and status).

Why they’re controversial:
- Anyone can upload a photo of a stranger and potentially find their name, workplace, or home. Critics call this a tool for stalking, doxxing, and mass surveillance.
- In the EU, face data is biometric data, a special category under GDPR. The privacy group noyb has taken legal action against Hamburg’s data protection authority, arguing it failed to enforce GDPR against PimEyes. After five years, the Hamburg authority concluded PimEyes’ processing of biometric data may be unlawful under GDPR.

Class rule: Face-search engines are not used in this class, not even on yourself, because using them means uploading biometric data to a controversial third party. Discuss them as a case study in “technically possible vs. ethically acceptable.”

Photo & Video Metadata

• ExifTool (command line, free): Reads and writes metadata in images, video, and documents: GPS coordinates, device make/model, timestamps, editing software, and sometimes a camera serial number.
  

  exiftool photo.jpg
  exiftool -gps:all -datetimeoriginal photo.jpg
  

• Where metadata survives: Original files on websites, forums, cloud share links, email attachments, and document repositories.
• Where it usually doesn’t: Most major social platforms strip EXIF when you upload.
• Image forensics (covered in Module 7): Tools like FotoForensics and Forensically help spot edits.

Maps & Street-Level Imagery

Street-level imagery lets you “stand” on a street and compare it to a photo.

Tip: If Google has no coverage, check the local market leader. Every region has one.

Satellite & Aerial Imagery

Resolution matters: At 10 m per pixel, a car is less than one pixel. At 30–50 cm (commercial), you can count vehicles. Match the source to the question.

Use cases: Confirming a building existed on a date, tracking construction at a facility, and checking a claimed event against before-and-after imagery.

OpenStreetMap & Overpass Turbo

OpenStreetMap (OSM) is a free, crowdsourced world map with rich tags (building types, shop names, power lines, bus stops).

• Overpass Turbo is a web tool for querying OSM data and showing results on a map, for example “every church within 100 m of a gas station and a river.” It’s powerful but requires learning the Overpass query language.
• Bellingcat OpenStreetMap Search is a simplified tool built on the same idea: pick features you can see in an image and a maximum distance between them, and it returns candidate locations.

// Overpass Turbo example: find all railway stations in the current map view
node["railway"="station"]({{bbox}});
out;

Time & Conditions Verification

• SunCalc (suncalc.org): Shows the sun’s position and shadow direction for any location, date, and time. If shadows in a photo point the wrong way for the claimed time, something is off.
• PeakVisor: Identifies mountain peaks from a viewpoint, which helps geolocate landscapes (verify before class for current features).
• Historical weather:
• Meteostat: Free, open historical weather and climate data from thousands of stations; no sign-up needed for bulk downloads.
• Weather Underground historical data and NOAA’s Climate Data Online are also widely used (verify before class for current access).
• Question to ask: “The photo shows snow. Did it snow there on that date?”

Public Webcams

Live and archived webcams show current conditions at a place: traffic, weather, crowds, and construction.

• Windy Webcams: A large worldwide webcam directory with a map and an API (free API key with rate limits) searchable by location and category.
• State DOT traffic cameras (often through 511 traveler information sites).
• Ski resorts, beaches, city tourism sites, and universities often run public cams.

Ethics: Only use webcams intentionally published by their owners. Directories of unsecured private cameras exist; viewing them raises legal and ethical problems and is off-limits.

Wireless Network Data: WiGLE

WiGLE (Wireless Geographic Logging Engine) is a public database of over a billion Wi-Fi networks and cell towers collected by volunteers (“wardriving”).

• Search by SSID (network name), BSSID (the access point’s MAC address), or map area.
• A free account is required for most search features (WiGLE says you don’t need to give a real email, just a unique one).
• OSINT value: A photo or screenshot showing a distinctive Wi-Fi name can lead to a location. Defenders can check whether their corporate SSIDs are mapped.

Video Verification

• InVID-WeVerify verification plugin (free browser extension, open source, maintained by AFP Medialab): Splits a video from a URL (YouTube, Facebook, X, TikTok, and more) or an uploaded file into keyframes you can reverse-search on Google, Yandex, TinEye, and Baidu. It also includes metadata, magnifier, and forensic tools. Keyframes differ from the thumbnails platforms serve, which makes them better for finding the original source.
• Platform details: Upload dates, channel history, and comments often reveal whether a video is being reposted.

Flight & Ship Trackers as Location Sources

Covered in detail in 5.7-public-records.md. For visual investigations:
- ADS-B Exchange, Flightradar24, FlightAware: Match an aircraft in a photo to a flight path and time.
- MarineTraffic, VesselFinder: Match a ship in a port photo to AIS position history.

Source Selection Cheat Sheet

Key Terms

• Reverse image search: Searching with an image instead of words.
• Geolocation / chronolocation: Determining where / when an image or video was captured.
• EXIF: Metadata embedded in image files (camera, time, GPS).
• Biometric data: Data from physical characteristics like faces or fingerprints; specially protected under GDPR.
• Resolution (ground sample distance): How much ground one pixel covers in satellite imagery.
• Keyframe: A representative frame extracted from a video.
• SSID / BSSID: A Wi-Fi network’s name / its access point’s hardware (MAC) address.

Key Takeaways

• Use multiple reverse image engines; TinEye’s “Oldest” sort finds where an image first appeared
• Face-search engines exist, but they raise serious legal and ethical concerns and are off-limits in class
• Every region has a street-level imagery leader; Google isn’t always it (e.g., Naver/Kakao in South Korea)
• Free satellite imagery (Sentinel-2) is 10 m resolution: good for change detection, not for details
• Google Earth Pro desktop downloads end June 25, 2027; historical imagery is also in the web version
• Sun position, weather, and webcams let you check a claimed time and place
• InVID-WeVerify keyframes help trace a video’s original source

References

• TinEye Blog: Introducing sort by date
• TinEye Blog: How to use TinEye
• Cybernews: Privacy group sues Hamburg over PimEyes inaction
• NPR: Why a search engine that scans your face is dangerous
• Entrepreneur: Controversial Tech PimEyes Fuels Privacy Concerns
• Google Earth Versions
• Google for Developers: Historical imagery in Google Earth
• Bellingcat Toolkit: Google Earth Pro
• Copernicus Browser
• Copernicus Data Space Ecosystem: Sentinel-2
• SpaceNews: Maxar rebrands as Vantor and Lanteris
• Mapillary: An Introduction
• Mapillary: Images and data for OpenStreetMap
• Look Around (Apple) — Wikipedia
• MacRumors: Apple Maps on the web gains Look Around
• South of Seoul: Naver Maps vs. Google Maps in Korea
• Bellingcat: Finding Geolocation Leads with the OpenStreetMap Search Tool
• Bellingcat Toolkit: Overpass Turbo
• awesome-overpass-turbo (GitHub)
• Meteostat
• Windy Webcams API
• WiGLE FAQ
• OSINT Curious: Tracking All the WiFi Things
• InVID Verification Plugin
• AFP-Medialab verification plugin (GitHub)