Eurasia Press & News
The news headlines that emerged after the October 7 attack — when Hamas and a coalition of other militant groups launched a coordinated armed incursion into Israel, killing 1,200 people and kidnapping hundreds — described it as a “surprise” attack.
The following month, however, the BBC News report “Hamas training for raids on Israel revealed,” showed that the preparations were sophisticated, coordinated with other factions, stretched back at least three years — and conducted in plain sight.
The journalists behind the exposé were a team of reporters and investigators collaborating across BBC Arabic’s digital forensics unit and BBC Verify, a department set up in 2023 to fact-check, confirm video content, and counter disinformation. With open source methods, they analyzed footage of Hamas training sessions dating back to 2020, located 14 sites around Gaza used for attack drills, and identified several other militant groups involved in the training exercises and the October 7 assault.
The team is still collecting, analyzing, and verifying footage and images from October 7 and after, which includes tracking and verifying news about hostages.
For this story, GIJN spoke with the team — Abdirahim Saeed, Benedict Garman, Richard Irvine-Brown, Emma Pengelly, Jamie Ryan, and Alex Murray — behind the training video investigation and the hostage tracking project about the methods and tools underpinning their reporting.
Telegram — ‘Operation Strong Pillar’
In early October 2023, Saeed, an open source investigations editor for BBC Arabic, was preparing to launch a new digital forensics team when news broke about the Hamas offensive.
“With the unfolding events, the launch couldn’t wait,” Saeed explained at a BBC World Service Presents event on the broadcaster’s use of digital forensics and open source journalism. “We scrambled and started working within hours.”
“As soon as the war started, all eyes were focused on the daily events on the ground,” he told GIJN. “Then bits and pieces of news started emerging that Hamas had been preparing for this.” In fact, the team would soon learn that Hamas and other allied groups allied had been posting footage of their training drills on social media for years before the attack. “The clues were out there if you knew where to look.”
“I know from experience that militant groups tend to post, and tend to be more resilient and stable on Telegram rather than mainstream social media sites like X and Facebook,” Saeed explained. The messaging platform has grown increasingly popular among armed groups, where they face less scrutiny and are less likely to get suspended.
So, Saeed started looking into Hamas’ channels. “On Telegram, it’s not like these groups are verified…. So we had to cross-reference Hamas’ own statements, and whether they have cross-referenced Telegram channels in the past from their website and so on,” he said.
“My personal strategy with Telegram is to follow a ton of channels related to a specific story, and organize those into folders, then when you run a search using Telegram’s default global search, you’re more likely to get results.” — Benedict Garman, BBC Verify investigative journalist
Once the team was confident that these were official Hamas channels — the mainstream political Hamas channel and that of its armed wing, the Izzedine Al-Qassam Brigades — they started looking into how far back their planning posts went. “A Palestinian outlet had started talking about this hashtag, which was the codename for the training sessions… Operation Strong Pillar.” Notably, the first posts he encountered had the hashtag #StrongPillar4.
“When I saw that, I said, ‘Well, if we have four, there must have been training sessions three, two, and the original,’” he said. He then began meticulously searching through the previous iterations of the hashtag. “What happened is that Hamas and Hamas Al-Qassam channels brought up all the videos.”
Saaed and his team worked out that there had been four major training sessions over three years. These drills started in December 2020, with the final one held just 25 days before the October 7 attack. These training sessions involved military-style exercises in which Hamas stormed buildings, attacked mock Israeli villages and tanks, demolished replicas of the border wall, practiced hostage taking, and prepared for counter attacks by land, sea, and air. All of this footage was posted publicly on Telegram.
“Hamas has a strategy of editing and clipping their drills so they can drip out a continuous feed of propaganda,” added Richard Irvine-Brown, a senior broadcast journalist with BBC Verify. As a result, the reporting team didn’t have to sift through hours of unedited footage; the videos were already broken down into minutes-long, easily shareable segments.
Geolocation: ‘Two Ends of a Puzzle’
The team also sought to identify the locations of training drills, going through hundreds of videos posted on Telegram.
“My personal strategy with Telegram is to follow a ton of channels related to a specific story, and organize those into folders, then when you run a search using Telegram’s default global search, you’re more likely to get results,” explained Benedict Garman, an investigative journalist with BBC Verify. “I use Telegram Premium as well because it includes features like auto-translate, and allows following and organizing more chats/channels.”
With other sources such as satellite imagery and Google Earth, the team ultimately geolocated 14 training sites in nine locations from the far north to the far south of Gaza, including a mock Israeli village that had been built only one kilometer (0.6 miles) from the Erez border crossing with Israel. The team used Google Earth to find historic satellite imagery from around the time that footage was published: “The historic imagery would maintain the same look of that training arena or environment, so you can cross-reference it with that,” Irvine-Brown pointed out.
He also explained that there is no Google Street View in Gaza, but because it’s a small territory they were able to identify locations in video footage by pinpointing individual features on Google Earth — such as roofless buildings, fences, and mock runways — that weren’t near residential areas. “Then we had to find the videos that went with these locations. It was like having two ends of a puzzle and starting to put them together,” said Irvine-Brown.
“One thing I think often goes underutilized with geolocation is reference footage, and cross-referencing in general,” added Garman. For example, they found militant training sites less than one kilometer (0.6 miles) from a United Nations aid agency distribution center. These sites were visible in the background of a promotional video published by the UN in December 2022.
By analyzing insignia and emblems on headbands and uniforms, the BBC team also visually identified at least five armed groups who trained alongside Hamas and went on to post videos claiming to show them taking part in the attack, visually backing up statements from Telegram channels about who had joined them. These groups included Palestinian Islamic Jihad (PIJ), the Mujahideen Brigades, the Al-Aqsa Martyrs Brigades, the Abu Ali Mustafa Brigades, and the Omar Al-Qassim forces. (Several additional groups participated in the training drills.) The loose coalition of militant factions was overseen by a “joint operation room,” set up in 2018 to coordinate Gaza’s armed factions under a central command, which also had a dedicated Telegram channel.
“A lot of the coverage tends to focus on Hamas, and to a certain extent, Palestinian Islamic Jihad as the other group, whereas in our reporting we were able to verify it wasn’t just those two. It was a number of other groups who trained with them, and some of these groups also crossed into Israel,” explained Irvine-Brown.
Always Check the Metadata
Despite posting so much of their activity on social media, the militant groups took care to conceal some specific details about their training. But at times they were still careless in covering their digital tracks.
“There was one instance at least where all the metadata had been kept on a file, including the longitude and latitude of where it had been uploaded,” said Irvine-Brown. He pointed out that metadata from Twitter images gets wiped and WhatsApp metadata gets overwritten, but Telegram keeps some metadata — a common misconception about the messaging platform’s privacy bona fides.
“Sometimes they don’t take care, because it’s so assumed now that you lose metadata, but Telegram preserves it better than most [platforms],” he added.
“We imagined that there was this chap who must have been new to Hamas or PIJ, who’s just been told to upload this stuff and he hadn’t wiped the data — an operational security failure,” said Irvine-Brown, adding that the person who uploaded it even left the name of the mp3 file they’d used for the music in the video (which was from the “Call of Duty” video game). This kind of metadata can give you a better idea — beyond publication dates — of when things may have happened, Irvine-Brown said.
Tracking Hostages
The team is still analyzing footage from October 7 and after to get a fuller picture about the locations of the more than 100 remaining hostages — whose fate is key to achieving any resolution to the conflict.
Since October 7, Emma Pengelly and Jamie Ryan — who work alongside Irvine-Brown on the User-Generated Content (UGC) Hub, a team of journalists within BBC Verify that specializes in obtaining and verifying user-generated content — have kept a comprehensive list of every individual who was taken. “Every time there is news of a hostage, they are some of the first to let everyone else at the BBC know this changes the number of people we know who was taken, who were killed in airstrikes, who have been seen in videos,” said Irvine-Brown.
“We have a team tracking updates about all the hostages, which we share across BBC News teams,” said Alex Murray, verification lead for BBC Verify. “That means that tracing information always comes back to the same source, and makes it easier to be confident in how we know something.”
“The way we manage information came out of lessons we learned during major news stories like the Grenfell Tower fire in London in 2017 and COVID-19,” said Murray, where they also worked with user-generated media. “It’s crucial to avoid duplication and focus our efforts, so having a single place for the information and a small team gatekeeping it meant we could distribute effectively,” he added.
Verifying Identities
Pengelly and Ryan used a variety of open source methods and tools to track and verify the identities of hostages and continue to analyze any new information.
“We cross-referenced our social media checks with other credible reporting of that individual being taken hostage, for example, a local paper interviewing family.” — Emma Pengelly, UGC Hub and investigations journalist, BBC
“We’d joined public Israeli Facebook pages; for the festival, various Kibbutzim’s pages, pages for people living in various cities across Israel, as people desperately posted pleas for help and information about their loved ones,” said Ryan, senior journalist in the UGC Hub. “We were in some cases able to match up footage posted by Hamas to these [Facebook] photos or videos — if they had distinguishing features like tattoos.”
“On October 7, Telegram, X, TikTok, and Instagram were flooded with footage showing the kidnappings,” explained Pengelly, investigations and UGC Hub journalist. “In some cases, family members recognized their loved ones in the videos… Verifying the video then came down to locating where it was filmed by matching roads, buildings, junctions, and trees to what can be seen in satellite images.
“If the name had not been published by official government channels, we identified open source lists of names put together by campaign groups or Kibbutzim,” said Pengelly. Once they had a name, they carried out in-depth social searches in English and Hebrew, to identify close family relatives confirming they believed their relative was being held hostage. “We cross-referenced our social media checks with other credible reporting of that individual being taken hostage, for example, a local paper interviewing family,” said Pengelly.
They also checked to confirm whether a video was new by splitting it into multiple keyframes and reverse-searching each one: “Essentially, asking the internet if it had seen any keyframe before October 7,” said Pengelly.
“Other processes included checking historical weather data matching the day and location, and measuring shadow length to estimate the position of the sun, and therefore the time of day,” she added.
“Since October 7, little video of the hostages in Gaza has surfaced,” added Pengelly. The occasional footage released on Hamas-affiliated Telegram channels of Israeli and foreign hostages speaking on camera under duress doesn’t contain any features that allow them to geo- or chrono-locate.
“What we hoped for, ideally, we’d have been able to say, ‘Of all those factions working with PIJ and Hamas, we know exactly where each one of them went, and therefore which hostages they took and which route they took back into Gaza,” said Irvine-Brown. “What we’ve got is a patchwork, where we can say faction X entered at this point, and were seen at this road junction, and we think they went back into Gaza here, but it’s incomplete.”
‘Battlefield of Information’
Getting information out of Gaza is incredibly challenging. Local journalists operating within Gaza face great danger and difficulty in reporting, and there are almost no international journalists on the ground. As a result, the BBC team has to be vigilant about disinformation from all fronts.
“The biggest issue with Gaza misinformation… is that video and imagery emerges, and often the footage is legit but the caption tells a narrative that the media doesn’t support.” — Benedict Garman, investigative journalist, BBC Verify
“Everyone knows the power of information in this conflict, and everything is tightly in control,” observed Irvine-Brown. “Nothing seems to get out by mistake at the moment. And if it does come from a Gazan source, or it does come from the IDF, you have to calibrate for that,” he warned.
“The biggest issue with Gaza misinformation, in my opinion, is that video and imagery emerges, and often the footage is legit but the caption tells a narrative that the media doesn’t support,” added Garman.
“We’re double-checking what everyone says, because this is not just a war on the ground. It’s a battlefield of information,” added Saeed. “One of our key objectives at BBC Arabic, in my own forensics unit and also working with BBC Verifiy in the main newsroom, is transparency. Not only do we tell you how we verified something or debunked it, but we also tell you how we did it. How did we reach that conclusion? So, in our main piece, you will see our headline, but we also tell you throughout the piece how we did that jigsaw.”
Garman added that an important aspect of this story that gets overlooked is that we shouldn’t ignore these kinds of videos, or the groups posting them. “It’s easy to overlook or disregard stuff like propaganda videos from groups like these, on the basis that it’ll never happen, or that it’s so public it’d never be allowed to happen,” he explained. “This story showed us that these drills are leading somewhere.”
