It was a dramatic video, widely shared when it appeared last Friday by Telegram channels sympathetic to Russian-backed separatists in eastern Ukraine.
It supposedly showed a barrage of gunfire and shelling by Polish-speaking saboteurs trying to blow up a chlorine tank near the city of Horlivka a week earlier — on February 11. Horlivka is in territory controlled by the separatists of the self-declared Donetsk People’s Republic.
The press service of the People’s Militia of the DPR picked it up and claimed that the saboteurs were killed and the video was recovered from their bodies.
However, metadata from the video file reveals a creation date of February 8, ten days before it was shared on Telegram, a CNN analysis shows. And three days before the alleged date of the attack.
The messaging platform preserves metadata for the videos posted there and it cannot be changed.
But that is not all. Another section of the metadata — called a “pantry creator tool” — revealed that Adobe Premiere Pro was used to edit the video using different assets — called “ingredients” — from a separate repository.
“It seems to be a composed video, meaning that it is a collection of several assets, for example, when you add audio to a video or build a collection of smaller clips, images etc.,” said Givi Gigitashvili, research associate at the Atlantic Council’s Digital Forensic Research Lab.
“The ingredients file path of this particular video contains a name ‘2021-02-04 ВИДЕО-ЗАПИСЬ ДРГ(+).mp4,’ which may indicate that some ingredients are from 2021,” he added.
The location of that and other video assets also has “2021” and “February 2” as names for project folders, again suggesting that the original timeframe dates back to last year.
Among these assets, also in the Pantry section of the metadata, is a filename “M72A5 LAW and AIPLAS live fire.mp4.”
As first noticed by Eliot Higgins, founder and creative director of Bellingcat, the filename corresponds to a YouTube video with the same name, featuring explosions and gunfire at a location in Finland.
CNN asked Rob Maher, an audio forensics expert at Montana State University, to analyze the media assets. He compared the boom sequence audio from one of the shots in the YouTube video with similar audio in the Telegram video.
“The sequence of booms is remarkably similar in timing,” Maher concluded. “For the particular boom I compared, the timing is not exactly identical, but it is inexplicably similar.”
According to Maher, in order for the boom sequences in both videos to be that similar, “the geometrical relationship between the artillery piece, target, and microphone would have to be the same” — meaning that they would have to be in the exact same position in both videos.
If the geometry was different “the relative time of arrival of the various boom sounds would be different” because the boom sound would propagate at different speeds to the microphone.
“It seems pretty unexpected and coincidental that those acoustic arrival times would be so similar in these two ‘unrelated’ videos,” Maher concluded. “If the assertion is that the separatists’ video contains edited sound, this might be one explanation.”
Maher’s findings are corroborated by other sound designers and experts on Twitter such as Ciaran Walsh, who compared the spectral analysis of the explosions in the two videos, and arrived at similar conclusions.
“I think (there’s) plenty of evidence indicating that audio is added from that YouTube video,” Gigitashvili said.
It is not the first time that separatists have been seen posting questionable videos on Telegram. A CNN analysis of the Friday video statements by the leaders of the DPR and Luhansk People’s Republic revealed that the footage was recorded 2 days earlier.
