Uncovering War Crimes in Occupied Territories of Ukraine
Two Case Studies from Schemes (RFE/RL)
Valeriya Yegoshyna
Investigative constraints in occupied areas
•
•
•
•
•
No communications, blocked access, risk to sources, active hostilities
Disinformation and staged content from occupiers
Solution: multi-layer verification + remote sensing + human confirmation
Human verification occurs DURING occupation (secure channels with locals) and AFTER liberation (direct interviews)
Evidence chain: collect → verify across methods → preserve → corroborate with witnesses
Cutted ear in Pisky-Radkivski (Borova), Kharkiv region
How to investigate the actions of Russian military personnel in settlements that have not yet been liberated by the Armed Forces of Ukraine?
No on-the-ground access, no phone connection. We built the picture remotely, then validated it with multiple sources.
Full investigation
Starting point: an SBU intercept
•
•
•
Objective: verify identity, location, unit presence, and described crimes
Intercepted calls of Russian soldier - as we established later - this is Stanislav Shmatov (21), 15th Motor Rifle Brigade
Boasted about: shelling homes, torture of POWs, looting food from civilians
SIGINT + phone traffic mapping
•
•
•
•
Data showed nearly 70 calls between Shmatov and his father while in Ukraine
Cell-tower hits traced device from Chernihiv region (Mar 3–31) → later to tri-border of Donetsk/Luhansk/Kharkiv (mid-April)
Built a time-stamped route of the brigade movement across Ukraine
Correlated with Ukrainian General Staff reports of Russian withdrawal and redeployment
– Is the village big, or what? Like Novotulka? (referring to the village in Russia's Samara region, Shmatov's birthplace – Ed.) – the father asked Stanislav.
– Bigger, probably, like twice, two and a half times bigger.
– Like Khvorostyanka (a village in the same Samara region – Ed.)?
– Probably even bigger than Khvorostyanka, I'm telling you! It's f***ing huge!
*The official population of Pisky-Radkivski is ≈2500 people.
GEOINT from conversations
•
•
•
•
•
Call clues: railway bisecting the village; presence of river/water reservoir and forest; armored vehicles (~15)
Candidate area narrowed to Borova territorial community based on geographic features mentioned in intercepted calls
Location matched to Pisky-Radkivski village near Oskil Reservoir in Kharkiv region
Russian soldier's description confirmed the precise location despite his own uncertainty
Cell tower data placed the Russian brigade in the area in mid-April (~15th of April)
Borova Village Council Head Oleksandr Tertyshnyi:
"I can say with almost 100% certainty that this is the village of Pisky-Radkivski. It is the second largest village by population and size in our territorial community after Borova, with about 2,000 residents. It has a forest, it has a river. Not just a river, but the wonderful Oskil Reservoir. Unfortunately, there is almost no water there now. This is the last village in our community that was occupied; there were battles there around April 14th or 15th."
Human sources: verification and testimonies
•
•
•
•
Russian soldiers described ongoing process in their conversations and social media
Former residents confirmed occupation timeline, location details, described crimes
Human rights advisors identified potential war crimes and shared statistics
Established pattern: indiscriminate attacks on civilian objects and mistreatment of civilians
"Tanks and all that bullsh*t. The battalion commander simply said f***ing destroy houses and all"
Satellite confirmation of destruction
Residential Area Impact
Overhead imagery revealing the pattern of destruction across the village following artillery strikes described in intercepted calls.
“Before And After”
Destruction of residential buildings consistent with Russian soldier Shmatov's description of using tanks to destroy civilian homes.
Artillery Strike Pattern
Visual evidence matching testimonies that Russian forces "surrounded the village from three sides and fired" indiscriminately at civilian targets.
Satellite + Photo
Imagery of Sadova and Myru streets showing systematic targeting of civilian homes, confirming Russian forces "destroyed all houses" as ordered.
Bonus
Shmatov confirmed the presence and movements of Russian troops in specific villages in Ukraine during the occupation and described acts of destruction of civilian property carried out by the soldiers. He also spoke about witnessing or hearing about abuse and violence against civilians, including beatings and mistreatment of prisoners, which helped us geolocate incidents and corroborate other sources such as videos, satellite imagery, and eyewitness accounts.
– I can play you a recording of your conversation where you said: 'He didn't want to talk, so we cut off his ear.' Who are you talking about? – the 'Schemes' journalist asked.
– F**k it. Ahh... That was the first time in, the guys, basically... (laughs)... He was a spotter, basically, at the factory.
– And what happened?
– They gave him a good beating. And then they shot him.
Bonus 2
April 2022
Pisky-Radkivski during Russian occupation. The image shows damage to civilian infrastructure from Russian military action described in intercepted communications.
January 2023
The same location after liberation. Post-occupation imagery allowed verification of damage patterns that matched descriptions from intercepted communications and satellite data.
CASE STUDY 2
The Redut PMC system
A secret GRU-controlled recruitment and combat structure disguised as a 'volunteer' formation. Operated in Kyiv, Kharkiv, Donetsk, and Luhansk regions. Engaged in looting, detaining and torturing civilians, hiding military equipment in homes, searching for alleged 'Nazis' and 'NATO biolabs,' and forcibly relocating civilians. Verified through OSINT, phone data, leaked documents, and eyewitness testimony, combined with fieldwork including physical document searches and interviews with PoWs, revealing recruitment networks and systematic abuses.
Video investigation
What is Redut? Findings at a glance
•
•
•
•
•
Recruitment network: Redut systematically recruited fighters through fake 'volunteer' companies.
GRU control: Operations coordinated and overseen by Russian military intelligence.
Geographic reach: Active in Kyiv, Kharkiv, Donetsk, Luhansk regions.
Civilian abuses: Looting, detentions, torture, forced relocations, and occupation of homes.
Unit composition: Identified ranks, personnel structure, and deployment patterns of Redut fighters.
Prisoner interviews and local corroboration
•
-
-
•
•
•
•
Detained mercenaries provided key testimony:
Ruslan Kolesnikov "Bulat", Mykhailo Ivanov "Pokrov"
Valentyn Bych "Rashid", Maksym Volvak "Eskadra"
Admitted detaining/torturing civilians in Borova
In interviews claimed "following orders" from GRU curator
Residents identified specific perpetrators, including ex-Kyiv resident Vereshchagin
Locals reported bizarre interrogations about "Nazis" and searches for "NATO biolabs"
"They asked if we were breeding pigeons for biolabs..."
— Yulia, Kachaly resident
Digital forensics of captured phones
Video diaries revealing criminal behavior
Russian mercenaries recorded themselves looting civilian property and occupying homes. One soldier states: 'This is our trophy!' while displaying stolen items.
Aug-Sep 2022: Detainee roundups in Borova
Footage shows civilians being taken by 'Redut' members for interrogation on GRU 'Amur' orders. Soldiers called these operations 'BlaBlaCar' for 'passengers' they transported.
Frame-by-frame geolocation
By analyzing background details, landmarks, and shadows in the videos, our team located the exact houses and streets where mercenaries operated, creating precise evidence maps.
Internal documents + traffic data
Contracts & Recruitment Documents
Undercover engagement with Redut recruiters allowed us to obtain authentic contract templates and payment terms (200–250k RUB/month), confirming the role of front companies used to hire fighters.
Personnel Files from Abandoned Bases
Personnel records, unit lists, and internal paperwork left at abandoned Russian positions revealed unit composition, call signs, and deployment structure.
Phone Traffic & Movement Patterns
Cell tower data traced Redut fighters' movements from Belarus into the Kyiv region (Katiuzhanka, Zahaltsi, Hostomel, Borodianka) and later to the Kharkiv region, aligning with eyewitness accounts of the occupation timeline.
Our investigative stack (field + tech)
•
•
•
•
•
•
•
•
GEOINT: Satellite imagery, terrain analysis, damage signatures
OSINT: Social media, unit patches, procurement trails
SIGINT: Intercepted calls, phone billing data
HUMINT: Local testimonies, officials, POW interviews
Forensics: Device extraction, metadata, document analysis
Data Analysis: Large-scale document analysis, custom coding for pattern detection
Infiltration: Calls to Russia verifying recruitment process and organizational structure, revealing how Redut operates from inside
+Cross-check
Key takeaways and recommendations
•
•
•
•
Hybrid model works: Remote methods sustain investigations under occupation; fieldwork confirms and expands findings after liberation
Use layered verification: Independent evidence streams strengthen reliability and impact
Protect sources & evidence: Secure storage, anonymization, and clear chain of custody
Be empathetic: Consider trauma-informed journalism training to work safely and ethically with local communities
Contact: valeria.egoshina@gmail.com