OSINT volunteers from InformNapalm volunteer intelligence community conducted a small experiment. We compared public reports from the General Staff of the Armed Forces of Ukraine on selected sectors of the frontline with signals from Western OSINT analysts and monitoring accounts that geolocate published footage of combat operations.

The methodology was fairly simple. We compared three layers of information: 

• what the Ukrainian side was officially reporting at a given moment;
• what could already be established from publicly available photos and videos using OSINT methods; and
• what additional conclusions external analysts were drawing from these data.

This was not an attempt to determine who “pencils the frontline more accurately.” General Staff reports and OSINT maps serve different purposes. If a settlement is not mentioned in the operational report does not mean that there is no military action there, just as the geolocation of an individual video does not in itself prove stable control over the territory. Geolocation primarily confirms occurrence or a specific event in a specific place and time period.

But when these sources are systematically compared, an interesting pattern emerges.

When OSINT gets ahead of the official picture

Sometimes external OSINT analysts effectively get ahead of official communications.

A Ukrainian unit publishes footage of a combat activity that has been cleared for release. An OSINT researcher identifies the filming location, compares it with previous geolocations and the map of combat activity, and draws broader conclusions: about an advance, a withdrawal, enemy infiltration, or the presence of Ukrainian forces in an area where official sources have not yet reported any changes.

Large analytical centers also use such geolocations. For example, in its September 17 report, the Institute for the Study of War relied on geolocated materials to assess the situation in the Kupyansk and Dobropillya directions.

This creates a certain information paradox: the primary data has already been cleared for publication, but the aggregate conclusions that can be derived by further geolocating it and cross-referencing it with other sources may go far beyond the information officially disclosed by the Ukrainian side.

In other words, publication of a video ≠ automatic lifting of OPSEC restrictions on all the information that can be extracted from that video.

The more such materials accumulate, the narrower the space for information silence becomes. External OSINT can substantially fill in the picture before the military command considers it appropriate to describe that picture publicly.

At the same time, it would be incorrect to automatically claim that OSINT publications “force” the command to disclose information. It is impossible to prove such a causal relationship with open sources. However, these publications undoubtedly change the information environment in which the military command has to operate.

Operation Vivaldi: OPSEC through the eyes of the enemy

An especially illustrative counterexample is Operation Vivaldi on the Lyman axis.

As early as September 11, before the operation was officially disclosed by the Ukrainian side, the major Russian Z-channel Voenny Osvedomitel [Military Informant[ and and the Russian Defense Ministry-affiliated Rybar reported [archive] that they were receiving information about a Ukrainian counteroffensive north of Lyman and the possible pushing back of Russian forces toward the Zherebets River.

However, the authors of the channels also acknowledged a fundamental problem: they could not reliably establish the scale of the Ukrainian advance because the Ukrainian Defense Forces were maintaining media silence and were not publishing any footage of their gains.

On September 15, the situation changed. The command of the 3rd Army Corps officially disclosed the first phase of Vivaldi: it reported clearing 75 square kilometers of Russian infiltration, de-occupying another 10 square kilometers, liberating Serednie, and clearing a number of other areas. In the following days, maps, GoPro videos of the stormtroopers, and other materials from the operation began to emerge.

The Russian channels’ rhetoric changed accordingly. Where they had previously noted the lack of confirmation due to Ukrainian media silence, they now began reporting the appearance of the first confirmations. The source of this new knowledge was precisely the geolocation of the footage released by the Ukrainian side. Using these geolocations, Russian authors attempted to reconstruct the new configuration of the Lyman salient. [archive]

What we see here is almost a laboratory demonstration of the information life cycle on the modern battlefield:

1. Ukrainian Defense Forces operation
2. media silence
3. fragmented understanding of the situation even by the adversary at higher command levels
4. controlled disclosure of a completed phase
5. publication of combat footage
6. OSINT geolocation
7. a much more detailed reconstruction of events.

Moreover, the Ukrainian side explicitly confirms that media silence was part of the plan. According to an ISW assessment, strict adherence to OPSEC helped ensure operational surprise during Vivaldi and limited the Russian command’s situational awareness.

Another significant point: after the first phase of the operation was disclosed, its OPSEC was not simply “switched off.”

The 3rd Army Corps command continued to gradually publish material from combat episodes that had already been completed, while media silence was maintained regarding subsequent phases. As of September 18, Ukrainian military personnel noted that the operation was still ongoing and that some of its details therefore remained undisclosed.

This is where a fundamental distinction lies. OPSEC is not an on/off switch. It is possible to disclose the results of a completed phase, name the units involved, show older GoPro footage, and allow the reconstruction of past combat operations while simultaneously continuing to conceal the current positions of forces, the next direction of operations, reserves, and the intent for the next phase.

An open source does not necessarily mean it is safe to disseminate

The modern battlefield has become unprecedentedly transparent. Drones, satellite imagery, fires, footage recorded by military personnel themselves, Russian strikes on Ukrainian positions, Ukrainian strikes on Russian positions, reports from local residents, and dozens of independent OSINT researchers leave a huge digital footprint.

It is becoming increasingly difficult to completely conceal the fact that an event has occurred.

But the Vivaldi case shows that it is possible to conceal the actual scale of an operation, its results, the configuration of forces, and the intent for subsequent actions long enough for the information advantage to have a practical military effect.

Even Russian information resources specializing in the war saw only individual signals for some time and were unable to assemble them into a reliable picture. After the Ukrainian materials appeared, OSINT began to quickly fill these gaps.

This is precisely why InformNapalm deliberately does not focus on daily mapping of the microscopic changes along the frontline or on mechanically transferring every geolocation produced by Western OSINT groups into the Ukrainian information space.

This does not mean abandoning OSINT mapping of the frontline. The point is understanding the difference between the ability to establish a fact and the advisability of immediately systematizing it, strengthening it with additional data, and disseminating it to a much larger audience.

There is another aspect to this. In its analysis of Vivaldi, ISW separately draws attention to a systemic problem of distorted reporting within the Russian military hierarchy: false or excessively optimistic reports can further distort the Russian command’s situational awareness and contribute to erroneous decisions.

InformNapalm has also repeatedly encountered material indicating a gap between the actual situation and what Russian commanders report up the chain of command. Some of these findings are deliberately not published, or their publication is postponed at the request of the Ukrainian side, specifically for OPSEC reasons.

Why help the enemy correct its mistakes faster?

In conclusion

To illustrate the experiment, we have prepared a schematic infographic. It is not a map of the current line of contact, but a comparison of three information layers as of September 18, 2026: official Ukrainian communications, OSINT signals available from open sources, and our assessment of the extent to which OPSEC restrictions have effectively been lifted.

The situation is fluid, so over time individual elements of such a matrix inevitably move from “sensitive” to “disclosed retrospectively.” Essentially, this is one of the main patterns demonstrated by our experiment.

The more time passes since the event, the more information becomes publicly available. But the mere presence of information in the public domain does not mean that OPSEC restrictions on that information have been lifted.

And this is why the OSINT community needs to ask not only, “Can we establish this?” but also a second question:

“Do we need to publish this now?”

The self-restraint exercised by Ukrainian and Western OSINT groups in order to contribute to the success of Ukraine’s Defense Forces is a more worthy cause than trying to “run ahead” in an effort to tell everyone who is liberating what, right as it happens. 

This publication was prepared by Andriy Lisitsyn especially for readers of InformNapalm volunteer intelligence community. Distribution and reprint with reference to the source is welcome! (Creative Commons — Attribution 4.0 International — CC BY 4.0). Subscribe to InformNapalm social media pages.

InformNapalm does not receive any financial support from any country’s government or large donors. Only community volunteers and our readers help us to maintain the site. You can also become one of the community volunteers or support InformNapalm with your donations.

Read more related material from InformNapalm

• Walking the Path of Fire: Twelve Years of InformNapalm’s War Against the Kremlin
• Ukrainian hackers uncover how Russian drone operators are using Belarus
• OKBMLeaks: classified documents from a Russian components manufacturer for Su-57 fighter and PAK DA Poslannik next-gen bomber
• CYBINT operation against the Gonets satellite system, dubbed “Russia’s equivalent of Starlink”
• Wildberries caught in the crossfire of drone strikes and cyber operations
• Ten years later: from OSINT detection to target destruction. Ukrainian Navy hits Russian Bastion missile system in temporarily occupied Crimea
• Hacktivists uncovered new classified documents from STC, Russian manufacturer of Orlan-10 drones
• CYBINT. Hacking Russian UAV manufacturer. Part 1: who assembles Geran-2?
• AlabugaLeaks. Part 2: Kaspersky Lab and neural networks for Russian military drones
• AlabugaLeaks. Part 3: Albatross, war, NVIDIA, Sony and Saito
• The Russian drone threat 2026–2027: Ukraine’s lessons for NATO