A fugitive convict from the Netherlands is taunting Dutch police with provocative pictures and videos from Iran, playing a game of “catch me if you can” on Instagram. “I love my freedom. And the weather,” he has stated.
Bellingcat was able to reveal the last known location of the criminal with the help of over 60 Twitter users. Here’s how we did that.
Shahin Gheiybe is a convicted criminal hiding in Iran
The fugitive, 35-year-old Shahin Gheiybe, ranks #1 on the Dutch “Most Wanted” list. On July 5, 2011, Gheiybe was sentenced for two attempted murders. In the city of ‘s-Hertogenbosch, on July 6, 2009, he tried to kill two individuals by shooting at them. He also robbed them of 175,000 euros. Gheiybe, born in Iran, was sentenced to a term of imprisonment of thirteen years.
He managed to escape from prison on October 6, 2011, and has been on the run ever since. The police in the Netherlands have searched for this individual since then.
The convict posts on Instagram (there are over 170 photos and videos) about his whereabouts (here is the original link to his private account, and a backup link), mostly in Iran. He has almost never tagged himself with a specific geolocation, just towns and places. Only once, for a street in Teheran, the coordinates were very precise. Gheiybe’s Instagram account was created in July 2015. It became private this month, after he landed on the list of most wanted criminals.
His last Instagram post is a clip from Scarface (archived post). Gheiybe’s Instagram account contains provocative material, like personal videos accusing the ruling judge in the Netherlands, claiming “the truth is very different.” He tries to explain to his followers he is a nice guy who made a mistake.
A Dutch police spokesperson called this “shocking” and added, “It is unbelievable how he distorts the facts and that he cares so little about his victims and our society. Apparently he considers himself untouchable in Iran.”
Problems To Solve
A problem with scrutinising any of the Instagram posts is that the convict can deceive the police by using bogus location tags in Instagram, backdating the information, or otherwise hiding his real whereabouts. We looked mostly at clues where the convict is clearly visible and, at the same time, is near a traceable object (Gheiybe near a car, in a club, holding a branded knife).
Using that method, we tried to reduce the risk of being deceived ourselves.
Another problem centered on the ethics of impacting the investigation. If we can find a last known location — as we ultimately did — any convict undoubtedly becomes aware that they are being zeroed in on.
Without crowdsourcing, any fugitive’s last address will be much harder to find. Bellingcat got the help of over 60 people who researched with us via Twitter. That research was conducted mostly on March 18, 2019.
The police told us they didn’t know the location. But the public (via crowdsourcing) ultimately did.
This is an example of how transparency works both ways: It can be used by both good and bad people. We decided that we would send the police even the tiniest leads during our investigation. And that we would alert them the moment we would find something actionable, so they had at least a head start.
To get our hands on all the Instagram posts, we needed to prepare first. We followed these three steps:
Browse Instagram On Desktop
We didn’t want to fiddle with a mobile or tablet, but work on a desktop computer. To do that, we downloaded Desktop for Instagram, a Chrome plug-in.
Downloading over 170 Instagram videos and photos manually is time consuming. We used a plug-in for Chrome called Downloader for Instagram. It’s fast, downloads all material in full resolution, and also supports Instagram stories downloads.
Find Hidden Connections
To find the hidden connection between Instagram users, to find what our target liked, and much more, we used Helper Tools for Instagram, again a plug-in for Chrome.
In the picture above, for example, the convict is next to a liquor display — focusing in on specific objects can sometimes lead to finding connections. Or, at the very least, you find something about the target’s likes and lifestyle.
Question 1: Whom Did He Meet?
Last week, Dutch police asked the Dutch public for help with this case on TV.
For English followers: translation of “Opsporing Verzocht” (17/17) so you understand my last tweets a little better. Full explainer coming up tonight.221:18 – 19 Mar 2019See ʜᴇɴᴋ ᴠᴀɴ ᴇss’s other TweetsTwitter Ads information and privacy
One question was: Who did the convict interact with? Maybe his interlocutors know his possible bogus identity, like a false passport or a false name. We concentrated on that question first.
A Man And A Statue:
This picture, uploaded on November 27, 2018, shows our target play-fighting a statue, which perfectly suits our need to have an identifiable object and our target in the same photo. We did reverse image search in Google and Yandex — and, as it is often the case, Yandex was the better choice.
This is how we found Kish Island, some 200 kilometers away from Dubai.
A slightly bizarre promotional story about this island tells you what you can do there:
“Women sit with cigarette in hand, wearing colorful headscarves pushed right back to reveal plenty of make-up and expensive hair-dos” and “The wide, palm tree-lined boulevards that circle the island of 100 square kilometers are full of top-end cars, including luxury American models.”
On the same day, November 27, 2018, we found a video where our target was near a car with a recognizable license plate. The video shows our target getting into a red car and driving away in it.
The next step was for people with a great amount of patience. We tried to find hotels in Kish via Google Streetview that matched the building in the video background. In the end, we found the exact spot (pictured here in daylight):
Reverse imaging the license plate didn’t work at first. Sometimes, Google simply doesn’t recognize a blown up detail of a photo.
You can, however, approach this problem by just typing in words you can see into Google Images, without reverse searching the photo itself:
This leads to images of tourists driving the same red Chevrolet Camaro with the same license plate.
Eventually, we found the Camaro supplier by clicking on some Instagram posts featuring happy clients.
Our convict didn’t steal the car. After he drove the Camaro, people were still renting it, as we found out after checking another series of posts by satisfied renters. So, we assume he had rented the vehicle as well.
Kish Rent Car, a local car rental place, can shine a light on the current identity of our target. We have a first possible answer to our initial question: Whom did our target meet?
Finding Replies Sent To Other Instagram Accounts
Did our target reply to other instagrammers? To find out, we used this formula in Google.
We don’t want to see postings from the target’s own account (hence we exclude site:instagram.com/shahin) but are still interested if he (hence shahin.mzr) posted comments on the Instagram posts of others (hence site:instagram.com). This is what we found:
Around August 3, 2018, our target asks knife._.store, the Instagram account of an Iranian knife seller, if he can buy a knife and if it can be sent to him. We were able to find the Farsi Telegram account and exact address of the dealer, another answer to the question as to whom our target was contacting. He was prepared to pay 65,000 Thoman, which is around around $15, for the knife.
Later that year, on October 22, 2018, Gheyibe posted a photo of two knives on his own Instagram account. The one to the left is the Phrobis III Buck Gen 4 Fighting Knife M9 Scabbard USGI Military Wire Cutter. This model had gone on sale for a short moment in the autumn of 2018, at the previously mentioned knife storein Iran.
A summary of our findings up until finding the specific knife reference on the target’s account was published this week in a Dutch newspaper, which had asked Bellingcat for assistance. I also presented the preliminary findings at a conference of the VVOJ.
#LROJ19: scoop van Bellingcat https://www.vvoj.org/2019/03/18/terugblik-op-lroj19-scoop-van-bellingcat/ …910:55 – 19 Mar 2019Twitter Ads information and privacy#LROJ19: scoop van Bellingcat | VVOJNiet eerder vertoond tijdens de VVOJ Trainingsdag Lokale en regionale Onderzoeksjournalistiek 2019: één van de sprekers komt met een scoop. Het was een extra spannend besluit van de toch al zeer…vvoj.orgSee Bellingcat’s other Tweets
Question 2: Where Is He Now?
Because things were going smoothly, we tackled the hardest question: Where is the target now? We concentrated on a video from March 9, 2019.
Henk, are you sure this is Iran ?
The foliage looks like further north.
Where is the original footage ?
In this video, Shahin Gheiybe mocks the police while standing in front of a house.
More Technical Preparations
We dissected the 35 seconds of video from March 9, 2019 and exported it into over 1200 separate images, each covering a different part of the area, resulting in just one photo of all of the frames the video. For that, we used a sophisticated program called Agisoft Metashape, and this method (the description is currently only available in German). You see our target more than once because he was moving in the frame.
The reason behind doing this conversion is that we get a better view of all the details of the video, a method that was also used in “Inside the trenches of an information war”
Problems To Solve
Our target posted the video on March 9, 2019, but he may have filmed it months ago.
We needed to find something in the video that helped with chronolocation, i.e., finding out exactly when it was shot.
Besides the when, we needed more proof of the where: There is no hint of a location and no geotag in the Instagram post itself.
Staring At The Magnolias
We stared long and hard at the white flowers, but only thanks to botanicalexperts was our next lead found.
The plant is called the Magnolia stellata. It bears large, showy white or pink flowers, most of them in early spring, before its leaves open. These flowers don’t last long. The magnolia from the video probably blossomed at the end of February or in early March, very near to the publication date of the video. It was probably shot in the northern part of Iran, because Magnolia stellatawouldn’t be comfortable with the climate in the south of the country. We believed it to be a wealthy neighbourhood, because of the well-maintained garden and the size of the house.
The Garbage Can
We were able to sharpen the Iranian (?) bin. Now compare this bin to some bins we are sure that they are from Iran. Can they be the same? What do you think? (7/7)712:25 – 18 Mar 2019See ʜᴇɴᴋ ᴠᴀɴ ᴇss’s other TweetsTwitter Ads information and privacy
A Reflection Offers More Clues
If you look closely at the house in the background, you see a window:
And there is a reflection in the window as shown here. There is another house in that reflection.
We had to focus on a wealthy area in the north of Iran with at least three houses in the middle of what looks like the woods.
The Architectural StyleView image on Twitter
And our public @bellingcat quest continues! Look at the architecture of the building in video compared with something @Tohn_Jitor found in this area https://firstname.lastname@example.org,51.5297549,3a,90y,341.46h,94.95t/data=!3m8!1e1!3m6!1sAF1QipOEZy95Lcl5aVeaDyQXrr1luePcIP-rwKTtWFXL!2e10!3e11!6shttps:%2F%2Flh5.googleusercontent.com%2Fp%2FAF1QipOEZy95Lcl5aVeaDyQXrr1luePcIP-rwKTtWFXL%3Dw203-h100-k-no-pi-0-ya312.95752-ro0-fo100!7i8192!8i4096?hl=nl … Can you help to find the building in first photo? (7/7)1412:32 – 18 Mar 2019See ʜᴇɴᴋ ᴠᴀɴ ᴇss’s other TweetsTwitter Ads information and privacy
The details from the balcony are typical of some buildings in the Iranian province of Mazandaran, local people told us via Twitter
Going Through Reference Material
We went back to the Instagram videos of Shahin Gheiybe looking for material that could be from Mazandaran. In one video, published on October 5, 2018, he is driving through the rain.
In front of him is a car, to the left of him you can see a sign of some sort of shop (1). The shop is a real estate firm in Abbasabad, Mazandaran. The license plate (2) is also local. It starts with the number 82, which is specific to the area, as Iranian journalist Ershad Alijani from France 24 Observers found out.
We have a new clue. In one of his videos, this still can be found. The real estate firm to the left is from Abbasabad . And the license plate is also from Abbasabad/ Tonekabon Can all #osint lovers research for a house near Abbasabad that matches the house on the right? (8/8)2812:48 – 18 Mar 201920 people are talking about thisTwitter Ads information and privacy
The architectural style we previously honed in on is present in Abbasabad. At this point, Twitter was going wild. Some Iranians started spontaneously hunting for magnolias and orange garbage cans in the area, by car.
The mystery, however, was solved in London. Nathan Lee, a reporter of ITV, recently followed a workshop from Bellingcat with Eliot Higgins and the author of this piece. “The Bellingcat course helped a lot. I did various Google image searches of Abbasabad, Tonekabon, Amirdasht and went on the premise of it being a rich/well to do area of Iran,” he wrote. Just 15 kilometres from Abbasabad, in Amirdasht Town, Nathan spotted the house of the convicted fugitive.
Hi @henkvaness , @bellingcat @EliotHiggins – I think I’ve found it. Amirdasht in Iran. 36.691453, 51.258657
Matching pillars, lamp outside directly above doorway and to the side, shrubbery, plinths outside which can be seen at the end of the video.21413:34 – 18 Mar 201942 people are talking about thisTwitter Ads information and privacy
If you turn the 360 view around, to the house across the street, there is a clear view of the same orange bin we found earlier.
With the help of crowd sourcing, the second question was finally answered. I couldn’t find the right words, as evidenced by my typo:View image on Twitter
I am tremendous proud of all the #OSINT people who helped @bellingcat this morning in finding a fugitive criminal person. The exact location is https://email@example.com,51.2587189,3a,75y,231.73h,101.27t/data=!3m8!1e1!3m6!1sAF1QipPFPcjF6z1nfaNOWn5m56HwTJtABhJlSsmzG5U5!2e10!3e12!6shttps:%2F%2Flh5.googleusercontent.com%2Fp%2FAF1QipPFPcjF6z1nfaNOWn5m56HwTJtABhJlSsmzG5U5%3Dw365-h260-k-no-pi-14.933861-ya301.5-ro-0-fo100!7i8704!8i4352!4m3!8m2!3m1!1e1 … and the police has been notified. Thanks all! Unsung heroes are @ErshadAlijani and @NathanLeeTV ! (10/10)18714:08 – 18 Mar 201983 people are talking about thisTwitter Ads information and privacy
We asked a local Iranian to find out more about the house. It is heavily guarded. The houses in the area are not vacation homes, and the neighbourhood consists of people who own their own places.
Gathering all of our findings, we went to the Dutch police. They were very happy with the information and used it in their daily briefing, when they decided what to do next.
The Dutch Public Prosecutor’s office then announced that they would not be able to arrest our wanted convict: “We have no extradition treaty. We studied our options, but we don’t have any legal basis to arrest him or ask the Iranian government to do that.”
While this answer may be a bit underwhelming, our quest demonstrates how social media and crowdsourcing can help pinpoint a criminal’s location. Even if said criminal thinks he is playing a clever cat-and-mouse game.