Khthon documents mass graves, atrocity crimes, and forensic evidence from conflict zones worldwide. Our work is strictly humanitarian and apolitical.
This site may contain imagery and descriptions of deceased individuals, violent injuries, and human remains gathered in the course of active investigations. Content is presented for accountability and documentation purposes only.
Khthon documents mass graves, atrocity crimes, and forensic evidence from conflict zones worldwide. Our work is strictly humanitarian and apolitical.
This site may contain imagery and descriptions of deceased individuals, violent injuries, and human remains gathered in the course of active investigations.
A transparent account of how Khthon locates, analyses, and documents mass graves — the sources we use, the techniques we apply, the standards we hold ourselves to, and the limits of what we can reliably claim.
Contents
Mass graves occupy a particular evidentiary position in international law: they are simultaneously evidence of the crime, a container of the victims, and a crime scene in themselves. Their location, condition, and the manner in which bodies were deposited can establish who was killed, when, how, and by whom. Their deliberate concealment — through reburial, flooding, destruction of records — constitutes an ongoing attempt to erase that evidence.
Documenting them accurately is therefore not just a humanitarian act. It is an evidentiary one. And the constraints are formidable. The environments where mass graves are created are typically active conflict zones, post-conflict areas with restricted access, or territories under authoritarian control. Independent forensic teams rarely get in. Witnesses are vulnerable. Physical evidence degrades or is deliberately disturbed.
This is where open-source investigation becomes not merely useful, but irreplaceable. Commercial satellite imagery can now resolve objects as small as 30 centimetres. Social media platforms produce millions of geolocatable data points daily. Aerial photogrammetry, machine learning, and remote sensing techniques have transformed what is detectable from a desk. These tools do not replace the forensic team in the trench — but they can locate the trench, document it over time, and produce a verifiable record that survives even if the physical evidence is later destroyed.
At Khthon, we combine these capabilities into a systematic, multi-intelligence framework. No single source is sufficient. A satellite image showing disturbed soil is not by itself evidence of a mass grave. A witness account of executions is not by itself locatable. A leaked photograph of bodies is not by itself dateable. But together, cross-verified and documented with methodological rigour, these sources can produce findings that hold up to scrutiny — including legal scrutiny.
This document explains how we do that work. It is written for journalists, researchers, legal professionals, and other investigators who may rely on or wish to evaluate our findings. Readers can verify our sources. They can challenge our methodology. That is the point.
Open-source intelligence — OSINT — refers to information collected from publicly available sources. In the context of mass grave investigation, this encompasses court documents, NGO and UN reporting, government records, academic literature, news archives, diplomatic cables in the public domain, leaked databases, and open corporate registries.
We apply a minimum of two independent sources before treating any OSINT claim as established. For high-stakes factual assertions — specific grave locations, specific death tolls, specific perpetrators — we require corroboration from sources that are independent in both origin and method. A news report and an NGO report that share the same underlying source do not meet this standard.
We maintain a source registry for each investigation, recording the retrieval date, the URL or document identifier, the assessed reliability of the source, and any known limitations or biases. We do not delete sources that are later superseded; the record of our analytical evolution is part of the record.
Satellite imagery is the backbone of our remote detection capability. Where we cannot go on the ground, a satellite can return images at sub-metre resolution on a daily or near-daily basis. This allows us to construct time-series analyses — monitoring specific sites over weeks, months, and years — to detect and document burial-consistent activity.
Mass burial typically involves mechanical or manual excavation, producing visible soil displacement. Fresh earth appears tonally distinct from surrounding soil in multispectral imagery — typically darker (higher moisture content) or lighter (subsoil exposure), depending on geology. We look for rectangular or linear disturbed areas inconsistent with agriculture or construction, particularly in proximity to confirmed detention or execution sites.
Decomposition alters soil chemistry in ways measurable by satellite. NDVI (Normalised Difference Vegetation Index) analysis over time can identify anomalous vegetation growth or die-off associated with burial sites. This technique is especially useful in temperate environments where seasonal vegetation can obscure or reveal burial indicators.
Industrial-scale burial — as documented at Manhush outside Mariupol, Ukraine — leaves visible mechanical signatures: tread marks, earth-moving equipment tracks, and orthogonal trench geometries visible in high-resolution imagery. We systematically document these signatures and compare them against open databases of military and civilian earth-moving equipment.
SAR imagery penetrates cloud cover and provides surface roughness data not available from optical sensors. We use Sentinel-1 SAR coherence analysis to detect subsurface disturbance — areas of low coherence indicate recent soil disturbance even when optically the surface has been re-vegetated or covered.
Establishing the timeline of events is as important as establishing their location. We construct temporal image sequences — typically at 30-day intervals for initial screening, narrowing to daily for active monitoring — to determine when a site was disturbed, when activity ceased, and whether any secondary disturbance (consistent with reburial or exhumation for concealment) occurred subsequently.
All satellite-identified sites are georeferenced and entered into a GIS database. We record the coordinate system (WGS84), the source imagery date, the confidence level of the identification, and the analyst responsible. Spatial analysis — including proximity to roads, detention facilities, and administrative boundaries — is conducted in QGIS and ArcGIS, producing maps suitable for legal and journalistic use.
Where we use commercial imagery not freely accessible to the public, we provide sufficient coordinate data, date metadata, and descriptive documentation that an independently resourced researcher could independently acquire the same imagery and verify our findings.
In many of the environments we investigate, survivor and witness testimony is the only available locating information. Remote sensing cannot detect a shallow grave under dense canopy. A court record may not exist. But a person who survived a massacre, or who helped bury the dead, or who lived adjacent to a disposal site may carry precise knowledge of its location.
We treat HUMINT with care, rigour, and ethical seriousness. Witnesses are not sources to be extracted and discarded. Their safety, wellbeing, and agency are primary considerations in how we gather, store, and use their accounts.
We assess HUMINT accounts on four axes: access (was the witness in a position to observe what they describe?), consistency (is the account internally consistent and consistent with other known evidence?), motivation (are there apparent incentives to misrepresent?), and corroboration (is the account corroborated by independent evidence of a different type?).
We do not publish unverified testimony as fact. We distinguish clearly in our reports between accounts that are corroborated, accounts that are consistent with other evidence but not independently confirmed, and accounts that are contested or uncorroborated but included as contextual material.
We do not include identifying information about witnesses without explicit, informed consent. In environments where identification poses safety risk, we apply mandatory anonymisation protocols regardless of consent status.
Social media platforms generate enormous volumes of geolocatable evidence. Photographs, videos, and metadata posted by soldiers, witnesses, journalists, and civilians have proven evidentially decisive in multiple international investigations — from the identification of Russian military equipment in Donbas to the verification of massacre sites in Myanmar.
Geolocation is the process of identifying where a photograph or video was taken. We use a structured methodology:
Chronolocation establishes when a photograph or video was taken. Techniques include EXIF metadata analysis (where available and not stripped), shadow angle analysis using sun position calculators, cross-referencing with dated events visible in the imagery (weather, construction states, vegetation), and platform-metadata analysis.
We archive all social media content relevant to our investigations using platform-independent storage and hash-verified copies. Social media content is ephemeral — posts are routinely deleted by platforms and users. Our archive creates a forensic chain of custody for content that may no longer be publicly accessible at the time of legal proceedings.
Manual satellite analysis is slow. When a whistleblower reports an incident, the coordinate range we need to search can span thousands of square kilometres — a region that might take a team of analysts many weeks to review frame by frame. We are building a tool, the Mass Grave Detector (MGD), specifically designed to reduce that timeframe to hours, freeing analysts to focus on report writing and verification rather than image triage. The code and architecture will be made fully open source.
MGD is a screening and prioritisation tool, not a determination system. Its outputs are probability scores that direct human analyst attention — they are not published findings in themselves. Every candidate site flagged by MGD is reviewed and assessed by a qualified human analyst before it enters our evidentiary record.
Before assessing any specific coordinate for burial activity, MGD first builds a contextual map of the region of interest. Using the Functional Map of the World (FMoW) dataset, we train a convolutional neural network on a ResNet-152 backbone to identify and classify human structures and geographic features visible in satellite imagery — including airstrips, roads, farmland, places of worship, settlements, and military infrastructure.
This classification step establishes the spatial context of a region: what is there, where it is, and how it is organised. That context is essential for the next stage, because mass graves do not appear randomly in a landscape. They appear in proximity to the infrastructure of atrocity — detention facilities, roads accessible to vehicles, areas with command presence. Mapping those features first makes the subsequent probability scoring much more grounded.
Once the structural map is complete, MGD applies spatial modelling to generate a probability surface across the region of interest — a continuously varying estimate of the likelihood that any given coordinate contains a mass grave, based on surrounding features.
This is achieved using Random Forest classifiers and spatial regression models trained on georeferenced historical mass grave data compiled internally by Khthon analysts. Feature importance scoring, cross-validation, and sensitivity analysis allow us to evaluate which environmental and structural features carry the greatest predictive weight under different biome and cultural conditions — because the spatial signature of a mass grave in eastern Ukraine is not identical to one in northern Myanmar or rural Ireland.
The resulting models can then be applied to regions of similar biome and cultural profile that lack historical data, generating spatially continuous probabilistic predictions that guide where Stage 3 focuses its analysis.
The highest-probability zones identified in Stage 2 are then processed at the individual bounding-box level. This is where time-series satellite data enters the pipeline.
For each coordinate bounding box in the search region, MGD produces two composite input images: one representing satellite data prior to the reported incident, and one representing satellite data after it. Features are extracted from both images using a convolutional neural network. The model then identifies and quantifies meaningful changes between the two — vegetation loss, soil disturbance, altered surface reflectance, the appearance of vehicle tracks or excavated areas — and scores the probability that the changes observed are consistent with mass burial activity.
We are experimenting with several model architectures for this classification step, including XGBoost, Random Forest, and a feed-forward neural network (FNN). Each has different strengths in handling the tabular feature data produced by the CNN extraction step, and our comparative evaluation is ongoing. Training data for Stages 2 and 3 is collected and labelled internally by Khthon research analysts.
MGD's models are trained on georeferenced historical mass grave data compiled by Khthon's research team. This is painstaking work: analysts identify confirmed or highly probable grave sites from prior investigations and legal records, georeference them precisely, and label the surrounding satellite imagery for model training. The quality of our training data directly determines the quality of our model outputs. We do not use synthetic or simulated data as a substitute for real labelled examples.
The resolution of satellite imagery available to us affects both the accuracy and the processing speed of MGD. Higher-resolution imagery enables finer feature detection and more precise change identification, but it also requires more processing time and storage. Funding allows us to access higher-resolution imagery with faster download pipelines — improving the tool's practical utility in time-sensitive investigations where a reported incident may be actively concealed.
MGD outputs a ranked queue of candidate coordinates for analyst review — not a list of confirmed grave sites. The pipeline is:
MGD runs on the region of interest and produces probability scores for each bounding box, ranked from highest to lowest.
Threshold filtering removes bounding boxes below a minimum probability threshold, calibrated through validation testing to balance recall against analyst workload.
Analyst review. Qualified analysts examine the flagged bounding boxes, drawing on their domain knowledge to assess each candidate.
Cross-stream corroboration. Analyst-accepted MGD findings are treated as preliminary and require corroboration from at least one independent non-AI source stream before entering the published evidentiary record.
Confidence assignment. The corroborated finding is assigned a confidence level and documented with the full analytical trail, including the MGD probability score, the analyst assessment, and the corroborating evidence.
MGD's code and architecture will be made publicly available. We believe that tools built for humanitarian accountability should be subject to the same standards of transparency we apply to our investigations. Publishing our code allows other researchers to scrutinise our approach, identify weaknesses, and adapt the tool for related applications. We will publish model performance metrics — precision, recall, and F1 scores — alongside the code.
| Level | Label | Criteria |
|---|---|---|
| High | Confirmed | Multiple independent source types corroborate the finding. MGD flag independently verified by analyst and cross-stream evidence. Physical or forensic corroboration available. |
| Medium | Probable | Two or more corroborating sources from different streams. MGD flag verified by analyst. Physical corroboration partially available or circumstantially consistent. |
| Low | Possible | Single-source or single-stream indication. MGD flag not independently corroborated. Included in reporting with explicit uncertainty framing. |
| Preliminary | Unverified | Initial MGD detection or report. Under active investigation. Not suitable for citation without further verification. |
We are explicit about what MGD cannot do. It cannot determine intent or legal responsibility. It cannot identify victims or cause of death. Its outputs reflect the biases of its training data — a model calibrated on Eastern European terrain may require retraining before reliable application in Southeast Asia or sub-Saharan environments. And like all probabilistic tools, it will produce false positives and false negatives: the human review step is not optional, it is structurally necessary.
Khthon is not a forensic investigation body. We do not excavate. We do not handle physical remains. We do not perform DNA analysis. What we do is apply open-source forensic principles — the systematic, documented, and verifiable analysis of available evidence — to produce findings that can inform and support those who do.
Our remote forensic assessments are grounded in the peer-reviewed literature of forensic anthropology, taphonomy, and conflict archaeology. Key reference works including those produced by the ICMP, INTERPOL, and academic forensic journals inform our understanding of what satellite and social media evidence can and cannot tell us about burial conditions and time of death.
Where our analyses touch on technical questions beyond our expertise, we seek review from credentialed forensic professionals. We acknowledge when findings have been externally reviewed and by whom, subject to the reviewer's consent to be named.
Years of analysis have allowed us to document recurring patterns associated with conflict-related mass burial. These include:
These patterns have been documented across multiple theatres — from Chechnya and Ukraine to Gaza and Myanmar — and inform our initial screening criteria. However, we treat pattern matching as a hypothesis generator, not a conclusion. The same visual indicators can have non-criminal explanations, and we require corroborating evidence before asserting a specific burial identification.
The evidentiary value of our findings derives primarily from the integration of multiple independent source streams. A satellite image, a witness account, a social media video, and a court record — each individually inconclusive — can together produce a finding of high confidence when they are independently consistent with the same conclusion.
Parallel collection. Each intelligence stream — SATINT, OSINT, HUMINT, SOCMINT — is collected and analysed independently by dedicated analysts. Cross-stream contamination at this stage is avoided: an OSINT analyst does not share their preliminary conclusions with the SATINT analyst until both have completed their independent assessment.
Independent assessment. Each stream produces an independent assessment — a specific claim, a confidence level, and a supporting evidence record.
Integration meeting. Stream assessments are brought together for integrated analysis. Areas of convergence increase confidence. Areas of divergence are flagged for additional investigation and explicitly noted in the final report.
Conflict resolution. Where streams produce inconsistent findings, we investigate the source of the inconsistency before proceeding. Inconsistency may indicate a false positive in one stream, a genuine complexity in the evidence, or a gap in our understanding that requires further collection.
Final assessment and publication. The integrated finding, with its confidence level and supporting evidence record, is prepared for publication. The evidentiary basis is made explicit and, where sources permit, directly accessible to readers.
All findings are spatially registered in our GIS database. This allows us to identify spatial relationships across evidence streams — for example, confirming that a satellite-detected disturbed area, a witness-described burial location, and a geolocated social media video all fall within a consistent geographic area, mutually reinforcing the identification.
All Khthon publications are subject to a minimum two-stage internal review process before publication:
For high-impact or legally significant findings, we seek external review from credentialed experts — forensic anthropologists, international humanitarian law specialists, or regional area experts. We disclose when external review has occurred and whether the reviewers raised concerns that we addressed or, in cases of remaining disagreement, note the disagreement explicitly.
Uncertainty is not a weakness to be concealed. It is a feature of honest analysis that increases the credibility of findings that do meet the evidentiary threshold.
We use explicit language to distinguish between what we know, what we assess with high probability, what we consider possible but unconfirmed, and what remains unknown. Phrases like "satellite imagery is consistent with mass burial" are preferred over "satellite imagery confirms mass burial" where the evidence does not support a confirmed determination.
When we make errors — and we do — we correct them publicly, promptly, and transparently. Corrections are published in the original report with a date stamp, an explanation of what was wrong and what has been corrected, and an assessment of whether the correction affects our overall conclusions. We do not silently update reports without disclosure.
We are honest about what we cannot do. The following limitations affect our work in ways we consider material and that users of our findings should understand.
Open-source investigation is dependent on what is visible and accessible. Sophisticated actors with resources to conceal their activities — burying at night, destroying social media evidence, suppressing witnesses — are harder to document than less sophisticated actors. This creates a systematic bias toward documenting certain types of atrocity more than others, which we acknowledge.
Open-source evidence has been admitted in proceedings before the International Criminal Court, the International Court of Justice, the European Court of Human Rights, and domestic criminal courts in multiple jurisdictions. Its admissibility is established in principle; what determines admissibility in practice is the rigour of the authentication and chain-of-custody documentation accompanying the evidence.
For evidence intended for legal use, we document the following for each piece of digital evidence:
We maintain a chain-of-custody log for each evidential item, recording every person who has accessed, analysed, or modified the item and the purpose of that access. This log is tamper-evident and is preserved in its original state even when analyses are superseded.
We are not a law enforcement body, and our findings are not by themselves a legal determination. We strongly recommend that investigators who intend to use our findings in legal proceedings contact us to discuss the completeness of our documentation and, where necessary, to arrange for expert witness testimony regarding our methodology.
We maintain a fuller evidence package for each published finding, including documentation not included in the public report. If you are a legal professional or investigator who requires access to this material for bona fide legal proceedings, please contact us at research@khthon.org.
We acquire data only through lawful means, consistent with the terms of service of the platforms and providers we use, and in compliance with applicable data protection law. We do not use hacked or unlawfully obtained material. Where we receive materials of uncertain provenance, we apply additional scrutiny to authentication and do not publish material we cannot verify was obtained lawfully.
We acquire commercial satellite imagery under licences that permit use for humanitarian and accountability purposes. We are not able to share raw imagery with users due to licence restrictions; we publish derived analysis with sufficient documentation for independent verification.
Social media content is collected using publicly available interfaces. We do not use scraping tools that circumvent platform access controls. We archive collected content immediately upon acquisition using hash-verified storage.
All directly collected witness testimony is obtained with informed consent. We explain to witnesses what we are, how we intend to use their testimony, and what protections we can and cannot offer. We do not offer guarantees of anonymity we cannot keep; we explain the realistic limits of digital security.
The following cases illustrate how our methodology has been applied in practice. Each represents a different combination of source streams and evidentiary challenges.
Ukraine · Kharkiv Oblast
Following Ukrainian forces' recapture of Izium in September 2022, our SATINT team identified satellite-visible soil disturbance in a forested area south-east of the town consistent with organised burial activity dating to the Russian occupation period. Temporal analysis confirmed activity between March and September 2022. This finding was corroborated by court records of the Ukrainian forensic investigation and multiple geolocated media reports. The spatial relationship between the burial site and a former Russian detention facility was established through GIS analysis.
Palestine · Gaza Strip
Our assessment of the Nasser Hospital site in Khan Younis combined Maxar imagery showing trench disturbance within the hospital compound with WHO situation reports, geolocated social media footage, and survivor testimony. SAR coherence analysis confirmed subsurface disturbance. The site was assessed at "Probable" confidence due to blocked forensic access; our report explicitly notes this limitation and describes the evidence that would be required to achieve a "Confirmed" determination.
Russia · Chechnya
The Dachny site near Khalkala airfield south of Grozny represents a historical case analysed using archival satellite imagery, NGO exhumation records, and court documentation from ECHR proceedings. Our analysis established the spatial relationship between the site and Russian military installations using historical Landsat and SPOT imagery from the 2000s, corroborated by detailed NGO field reports from Victims of War. This case informs our "Russian burial fingerprint" methodology.
Ireland · County Galway
The Tuam case presented a different methodological challenge: a domestic institutional context with substantial documentation but contested burial boundaries. We overlaid historical Ordnance Survey maps against current aerial imagery and ground-penetrating radar survey results, applying GIS analysis to assess whether anomaly signatures extended beyond the officially designated burial plot. Our finding — that anomalies are present beyond the official boundary — is assessed at "Possible" pending further physical investigation.
This methodology document is a living record. As our techniques evolve, our findings accumulate, and the field of open-source investigation advances, we update this document to reflect current practice. Significant changes are logged here.
Our methodology is shaped by the skills and knowledge of the people who contribute to it. If you have expertise in satellite imagery analysis, machine learning, forensic anthropology, international criminal law, or regional area studies — and if rigorous, transparent, accountable investigation matters to you — we want to hear from you.
Apply to Contribute