IMINT: From Russia with love

This year, Russian President Vladimir Putin delivered his annual New Year’s address standing in front of a group of soldiers in combat uniform. This address received a lot of attention and was largely shared across social media platforms. The online community took it upon itself to analyze every element of the address thus identifying a seemingly recurrent figure among the soldiers and also questioning the President’s suit.

Here, this user is questioning whether the President is wearing a bulletproof vest (Броник = bulletproof vest) under his suit due to the square-looking shape in his back (circled in red). We are going to try to answer this question.

1. The strategy

Let’s start by elaborating a strategy.

First we need to find the official speech: it seems the picture does not come directly from the speech video because Putin is facing the soldiers and not the camera like in his address, but we need to make sure of this. In any case, the picture and the video will most likely come from the same event because the same people are present and wearing the same outfits.

If the picture is a frame from the video, we can look into it and maybe find more information about the setting. However, if indeed the picture comes from elsewhere, we need to find its origin.

Then we can try to analyze the original media with Error Level Analysis and check for any trace of editing.

Now let’s do it.

2. The speech video

This is rather easy to find, a simple Google search of “video new year’s address Putin” leads us directly to the website of the Russian Presidential Executive Office where the video and its translation in english are published.

However, we see no frame corresponding to the image we’re looking for in this video. So let’s keep searching.

3. The picture

To find the picture of origin of the tweet, my first instinct is to start with a Reverse Image Search of the picture with the red circle. I used Yandex Image for more russian results.

Unfortunately this doesn’t give us great results : no picture of the speech comes up. But we can push the browser in the right direction by searching “Putin’s address to soldiers”. Of course we’re gonna translate that to Russian using Yandex Translate : the result is “Обращение Путина к солдатам”.

Here the results are much better, the second one gives us the photo of origin from the tweet.

And if we scroll a bit more among the results we can even find a RuTube link to a video taken in this same angle.

Now this is interesting because this video allows us to follow the movement of the fabric in the back of Putin’s suit and to see if there is a recurring square-ish fold that would indicate the presence of an armored plate underneath.

4. Analyzing the video

Several frames of this video suggest there isn’t one.

First off, in the very first frame the fabric folds vertically right in the center of Putin’s back. This inward fold could not have occurred if a metal plate was between the fabric and Putin’s back. Similar folds appear several times throughout the video and the frame showing Putin’s profile does not show the bump you could expect from an extra protective layer.

Hence the video seems to indicate Vladimir Putin isn’t wearing a bullet-proof vest under his suit in his address to the soldiers. However this is a very rudimentary analysis and videos, like images, can be edited. So let’s see if we can find out more with a more sophisticated technique of image analysis.

5. Trying out ELA

ELA stands for Error Level Analysis: it shows the compression levels of an image by coloring pixels according to their compression level.

In their tutorial on how to interpret ELA results, FotoForensics explains that similar edges should have similar brightness, similar textures should have similar coloring and flat surfaces should have uniform coloring.

Any deviation from these rules can indicate that the image was edited.

Moreover, everytime an image is saved, the contrast is reduced so a picture saved multiple times will have uniform levels of compression overall.

Thus, large differences in compression levels indicate a digital modification.

Let’s visualize that with the picture of interest.

Here we see :

• similar edges for the seams of the suit ;
• similar coloring for the textures of the uniforms on the soldiers and another one for the medals they wear ;
• and the mostly-flat surface of Putin’s back is an almost-uniform color.

No element stands out in this ELA, so at first glance, nothing indicates this image has been edited.

Let’s check with an edited version for comparison.

The picture in the tweet we first looked at was undeniably edited: the red circle was added over the picture, so let’s see what it looks like in ELA.

As expected, the red circle stands out with its clear edges over the rest of the picture which has a rather uniform level of compression due to the times it was saved. The contrast between the circle and the background indicates that the circle was added over the picture afterwards.

It can also be noted that the edges of Putin’s collar strongly contrast with the image. This is likely due to its bright color that doesn’t change as much as darker colors when compressed. Moreover, the contrast of the collar compared to the rest of the picture is already present in the picture without the circle.

Hence, with my limited experience in image forensic, I can say there is no clear and definite sign indicating that this image was edited.

6. Conclusion

The video showing Putin addressing his soldiers and the ELA analysis of the picture of that event suggest that Putin was not wearing a bulletproof vest in that instance. Additional tests can be conducted to confirm this conclusion, like clone detection or by looking at the metadata.

If you are experienced in image forensics, feel free to send us your thoughts about this image on Twitter at @PredictalabOff or by email at [email protected].

Ressources

• Fotoforensic’s ELA Tutorial
• Tutorial video by Hack eXPlorer