I’ve written a few blogs about gap analysis before, but it’s an important skill for investigation and intelligence analysis work so I decided to write about it again. Daily Quiztime challenges are a good platform to demonstrate how this kind of methodology can be applied, and it is just as suitable for small scale OSINT puzzles as it is for wide-ranging and complex investigations. If you are suffering information overload, gap analysis helps you establish a framework to assess the information and decide what is important to focus on and what isn’t. Equally if you have very little information to begin with, gap analysis is a systematic way of assessing what you do have (which is often more than you think) and then working from there to plan your next steps.
Julia Bayer’s Quiztime challenge on Monday 7th October was a good opportunity to show how this kind of methodical approach can be used to solve a problem that might seem insurmountable at the outset. Julia posted this photo:
Julia said that she took the photo at the weekend (i.e. 5th-6th October) and wanted to know what date and time it was taken on. This appears to be a chronolocation question about when the picture was taken, but firstly it is a geolocation question because it is not possible to know the time until we know where it was taken. To find where Julia took this we can use a little gap analysis to plan out what we know, and then decide how we are going to find out what we don’t know.
What Is Gap Analysis?
Gap Analysis is really just a simple way of sorting the information that you have, deciding what you need to do with it, and then coming up with a structured response to take your investigation forward. It is a good servant, but it can be a poor master, so don’t let it prevent you going off-piste some times. The only way you are definitely guaranteed to go wrong in an investigation of any kind is when you make unwarranted assumptions at the start and then build your investigation on them. A case built this way will always collapse eventually.
Gap analysis asks four simple questions:
1) What do I know?
2) What does this mean?
3) What do I need to know?
4) How do I find out?
Spending time on the first question is the most important. Notice that only the fourth question leads to asking about “what tools do I use?” Planning and choosing a method comes before choosing which tools you’ll need.
So how could we apply this to Julia’s puzzle? Let’s start with the first question:
What do I know?
1) This photo was taken by Julia Bayer
2) Julia used to live in Cologne, but some of her recent Quiztime posts have been in Berlin.
3) The photo was taken on either 5th or 6th October.
4) The sun is quite low in the sky.
5) Julia is stood on a hill of some kind.
6) In the foreground is a construction site.
7) There appears to be a park or public walkway of some kind.
8) Between the “park” and the apartments there is a gap – could be a canal, railway, small river, or something similar.
9) Julia is facing some apartments.
10) There are few distinguishing features on the horizon, but there is a tall chimney in the far distance.
So already we have ten facts about the photo to begin with. Notice that point 1-3 are not contained in the photo itself, but are all to do with the photographer. Researching the messenger sometimes helps to make the message a little clearer!
Now on to the second question. Each numbered point corresponds to the numbered points for question one above. I should really set this out in a table to make it clearer, but that doesn’t work so well in a blog format.
What does this mean?
1) If we know where Julia spends her time, we can find out where she likely took the photo from.
2) Julia is probably in Berlin. Her recent Quiztime tweets have mostly been from there, and she recently mentioned that she has moved from Cologne. In the absence of any other clear city choice, we will start with Berlin.
3) Once we have the location, we have very tight parameters for finding the right time.
4) This means that it is either just after sunrise, or just before sunset. To start with I’m going to assume that this is closer to evening time. If this is the case then Julia is facing approximately west. (If this is morning time, she is facing east, and we will need to try a different approach).
5) The location is on a hill or raised ground of some kind. Berlin is quite flat, so this feature might be distinctive.
6) I don’t like this construction site! They are short term and temporary so they often don’t show up on maps and satellite pictures. It might also indicate that there has been demolition work here in the past, so some satellite images might be out of date if buildings have been removed etc. I’m not going to rely on this too much.
7) If there is a way to show all parks on a map (and there is!) it will help narrow down the area we are searching in.
8) This gap is interesting. It seems too small to be a river as big as the Spree, but it could be a canal of some kind. I can’t see any pylons that suggest a railway or any vehicle traffic. Mental note: park next to mystery gap will find the location. Hopefully I will know it when I see it.
9) This will help with the orientation of the photo. If we find the correct place, we should be able to face some apartments in Streetview or Google Earth and recreate the view that Julia had.
10) A chimney! There are not many in modern cities these days. If I assume that Julia is facing roughly west (as per point 4), I should be able to find a tall chimney in Berlin, and then orientate myself on a West-East line. As I move away from the chimney, the apartments, park, mystery gap, and hill should all come in to view. This also means that if I am wrong about point 4), and Julia is really facing east, I should still be able to find the location by tracing my steps away from the chimney in the opposite direction. Hopefully there are not too many really tall chimneys in Berlin.
What Do I Need To Know?
A little investigation framework is already starting to form. Point 10 is obviously the most important question to answer, so that will be a priority. This means that I need to know the following:
1) Where are the tallest chimneys in Berlin? What do they look like? Are they like the one in Julia’s picture?
2) How many chimneys are there? (If there are hundreds, this could take a long time)
3) If I find the chimney, can I orientate myself on an East-West line and find a location that matches all the other criteria identified above? There is only one way to find out…
4) Are there any parks in Berlin? I need to find one that is next to a canal or whatever the unusual gap is, and it also has to be correctly orientated to the chimney.
How Do I Find Out?
1) An image search for “schornstein + Berlin” (chimneys + Berlin) will bring up images of chimneys that I begin to work with.
2) I can identify and geolocate the chimney on Google Earth based on what I find by researching images in Google. I could use Google Maps 3D view too, but Google Earth will let me add annotations in that will help with orientation.
3) Google Earth will also identify parks on the map, which will help focus in on the location.
So that’s what I need to do next. If I get stuck, I just need to revisit my gap analysis plan with my updated findings and failures, and then repeat the process again until I find the answer.
Putting The Plan Into Action
The first thing to do after planning was to load up Google Images and Google Earth. Here are the results of my search for “schornstein + berlin“:
It was immediately clear that one particular chimney came up several times – it must be at the top of the search results for a reason. It has a distinctive read-and-white pattern at the top and then the same pattern again part way down. Of the first 18 results returned, it features in 5 of the matches. This is more than any other chimney in Berlin so it makes a good place to start. Clicking through the matching images quickly tells me that it is the Chimney at the Invalidenhof in Berlin-Mitte.
Now to find it and mark it on Google Earth:
I also enabled the “Parks/Recreation” layer on Google Maps. The gap analysis identified that the correct location would probably have a park in the foreground, so highlighting them would help to identify the area more quickly:
The hypothesis was that Julia had been facing roughly west when she took the image. So if this chimney was the one in the rear-left of the picture looking west, I should be able to orientate myself so that this chimney appears in the rear-left of my Google Earth view. I added two lines to Google Earth to help plan out the direction I was going to take. The aim was to align myself with the chimney I’d marked to try and recreate the same view.
If I have got the right chimney and the right time of day (i.e. evening, looking west), then the location Julia took the picture from is somewhere between the two pink lines. There are several parks in the area too that I’ll check out more closely. Next step was to orientate myself so that the chimney would appear to the rear and left of my view, as in the original photo.
As soon as I did this, it was clear that there was a park next to an empty strip of land and facing a row of apartments. This would meet all the criteria I’d identified in the gap analysis. So it was the first place I checked:
Closer…
And just a little closer still:
Ta-da! Tall chimney to the rear-left, apartments that match the photo, park in the foreground (actually the Mauerpark), a slight hill (which is actually the embankment at the rear of the Friedrich-Ludwig-Jahn Sportpark) and the unusual gap between the park and the apartments is not a canal, but actually traces the former path of the Berlin Wall. This is the view of where Julia was standing, when looking from the other direction. You can see the hill a little more clearly:
Time and Date
The hard part was done. Now all that remains is to find when Julia took the photo. She told us at the start that she took it at the weekend, which means there are only two possible dates, either the 5th or 6th October. First of all I used Suncalc to work out the approximate time based on the position of the sun and the length of the shadows:
I find Suncalc quite tricky to get an exact to-the-minute time with. I guessed that this means Julia took the image at about 17:45 local time, but it could be as early as 17:30 or even as late at 18:00, there’s only a few degrees in it.
Calculating the time was easier than working out the date! The way I chose to do this was by looking at historic weather records and trying to match the weather conditions to what can be seen in the photograph. If I’m honest, I don’t really like to rely on this kind of information. It is often wrong (how can you be wrong about the weather after it has happened?) and different sources often conflict. Weather stations are also frequently too far away from the location you’re interested in. For this challenge I used Wunderground to compare different weather patterns in Berlin on 5th-6th October, although Wolfram Alpha can also be pretty good. Note that Wunderground actually gives the results for Berlin-Tegel Airport, which is some way from where Julia was (it is to the north-west of Berlin, so to the right of her picture).
Here’s Saturday’s weather at the relevant time:
Here’s Sunday’s by way of comparison:
So on Saturday there would have been some clouds in the sky, whereas Sunday was fair with higher pressure and much lower humidity. This meant Saturday was more cloudy than Sunday, which probably had clear skies, or close to it. So I guessed Saturday 5th October was the correct date.
Credit to @MCantow for coming up with a tidier solution to this part of the challenge by using historic satellite images to check for cloud cover instead. Here’s Saturday over Berlin at the relevant time:
There are clouds to the west of Berlin, which can be seen in Julia’s picture. Compare this to Sunday, when there are hardly any clouds at all:
So Saturday is the most likely date.
Gap analysis really works. It is not magic of course, but it does help you to assess the information you have in a much more systematic way. It also helps you take an investigative approach that focuses on what is important without spending time down rabbit holes that lead nowhere.
For some of my other Quiztime posts, click here.