the home of online investigations

You can support the work of Bellingcat by donating through the following link:

A Post Mortem Of Russia’s Claim That Crucial MH17 Video Evidence Was Falsified

March 10, 2020

By Bellingcat Investigation Team

During day two of the MH17 criminal court proceedings in the Netherlands, the prosecution team disclosed that the Russian Federation had challenged the authenticity of a video recording of the BUK Telar, made on 17 July 2014, near the presumed launch site at Snizhne. This video is a crucial piece in the chain of evidence showing the contiguous movement of the BUK Telar convoy from its permanent base in Kursk, Western Russia, all the way to the launch site. Based on the information from the Dutch prosecutor, Russia made this claim in its written defense in the legal case of MH17 victims’ next of kin vs. the Russian state, which is ongoing in parallel at the European Court of Human Rights. This disclosure can be heard in the video below.

According to the Dutch prosecutor, the Russian Federation argued to the ECHR that the video showing the Russian BUK Telar near the launch site, which was posted on YouTube on 17 July 2014, is not authentic. In particular, Russia claims that an analysis of the metadata of the uploaded video file shows that its creation date was 16 July 2014, i.e. one day before the shoot-down. Russia went on to argue that the video pre-dated the shoot-down and therefore could not have shown the BUK Telar that caused the downing.

“The Russian Federation’s written statement in the ECHR proceedings claims that a YouTube version of the video of the TELAR in Snizhne gives 16 July 2014 as its ‘encoded date’, i.e. one day before the downing of flight MH17 and the making of the other images of the TELAR. The Russian Federation argues that the encoded date can never be earlier than the date on which the video is actually uploaded, and consequently the video must already have been uploaded on 16 July 2014.”

Below is one version of the video of the Buk in Snizhne that the Russian Federation refers to in its defense. This concerns one of the earliest videos uploaded to YouTube which the uploader quickly deleted afterwards; however it was re-posted on that same day by a number of other users, including Bellingcat founder Eliot Higgins, who in 2014 operated a YouTube account under the alias Brown Moses. Below is Higgins’s re-post of this early video. Later it turned out that this was not the original video, as a higher-resolution copy surfaced one year later.

Analysis Of Russia’s Claim

Russia’s claim is based on its analysis of an undefined YouTube posting of the video in question, and not of the original file (whether the JIT has managed to obtain the original file remains unclear). Thus Russia’s claims relate to a secondary copy of the file, but given that Russia asserts that the secondary copy contains markers that pre-date the shoot-down, its allegations deserve to be looked at.

While the original YouTube upload that appears to be the focus of Russia’s non-authenticity claim is no longer available, Russia’s assertion that its metadata had a time-stamp from an earlier date is not only plausible but unavoidably true. This happens to be so, because at the time of the video’s uploading in 2014, a glitch in an open-source video format conversion algorithm used by Google structurally caused videos to be uploaded with a timestamp preceding the actual upload time by approximately 24 hours. In fact, up until 2019, all videos uploaded to YouTube on 17 July 2014 carried a metadata timestamp of 16 July 2014.

Bellingcat’s investigator, Christo Grozev, blogged about this same bug one day after the shoot-down of MH17, when a number of Russian conspiracy websites had claimed that the telephone intercepts published by Ukraine’s security service were fake, citing the post-dating clues gleaned from metadata on YouTube videos.

On 18 July 2014, at 12:55 p.m., Christo recorded and uploaded to YouTube a short test video. The screenshot from YouTube’s Video Manager tool can be seen below.

Screenshot from YouTube’s Video Manager, dated 18 July 2014, 12:55

Immediately after the upload, he downloaded that same video from YouTube and ran a metadata analysis tool (ffprobe.exe) on it. It showed a file creation date at 10:55 on 17 July 2014. That implied that the file had been created on the day prior to the actual recording and uploading, a total of 26 hours earlier.

Screenshot from the metadata analysis of downloaded file performed with Ffprobe.exe

The cause for this discrepancy — which was unclear at the time of the experiment, and which Christo attributed in his blog post to simply a wrong calculation of time zones involved — was explained subsequently by a Google software engineer. Anatoly Vorobey, who works for YouTube’s parent company from Israel, provided his explanation on his personal blog two days later, on 20 July 2014.

The rather technical explanation boils down to the mundane fact that the prevalent video format used by YouTube (Mpeg-4, or mp4) was originally proprietary to Apple.  As a result, its metadata container has a timestamp field that measures “time” as the number of seconds passed since 1 January 1904, the start of the so called Macintosh Epoch. However, all modern servers use a different “epoch” to measure time. That is the Unix Epoch: namely, the number of seconds elapsed since 1 January 1970. Thus, in order to embed the correct timestamp into an mp4 file, a well-coded server must (1) obtain the Unix timestamp, (2) add the difference between the Unix and Macintosh Epochs, and (3) embed the sum of 1 and 2 into the mp4 timestamp field.

Most computer code that converts raw video into the mp4 format uses a set of open-source reference libraries, available here. These libraries, however, contain a constant number for the difference between the Unix and Macintosh Epochs equal to 2082758400 (search for this number in the library’s source code). However, a proper computation of the difference in seconds between 1 January 1904 and 1 January 1970 gives us a number of 2082844800. The difference between this correct number and the reference library (incorrect) number is exactly 86400 seconds, i.e. 24 hours less than the true timestamp.

This simple error, which Google fixed in 2019 by re-encoding all its videos without applying buggy ISO/IEC 14496-5 standard libraries, plus the time-zone differences between users’ PCs and the YouTube servers, explains away the complete “post-dated conspiracy” which Russia has used on and off since 2014 to discredit the investigation into MH17.

What remains without explanation is why the Russian Federation would submit a formal defense statement to the European Court of Human Rights without the most basic of due diligence into its validity and into the probity of its arguments.

Bellingcat Investigation Team

The Bellingcat Investigation Team is an award winning group of volunteers and full time investigators who make up the core of the Bellingcat's investigative efforts.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

37 Comments

  1. Alex

    Well, these are the standard Russian arguments (remember Skripal’s case?) that are made solely for distraction purposes. But if this is the best of their arguments, will they give up further upon more true facts appear? Keep pressing them, world needs truth!

    Reply
  2. Richard

    Off to a good start! I don’t think the Russian State actors really care one way or the other if their “evidence” is real. And they don’t do due diligence. The usual trolls will be here soon. I hope Bellingcat posts reports on the trial. It should be interesting.

    Reply
  3. David Barneby

    I’m sorry to say that I don’t trust Bellingcat. I believe the create the evidence to fit the end result required. The Skripal poisoning was a prime example. I am not alone in believing that Mrs May and Boris Johnson lied to cover an inside job by MI6/MI5/CIA . After the MH17 shooting down, the US announced that it had full satellite coverage of the area that would show what happened. The US has never disclosed it’s findings, I suspect because the showed Ukraine was responsible and that politically was unacceptable. The missile casino found was of an older model delivered years before to Ukraine’s military. The transportation of a BUK launching system seems to imply a pre-planned shooting down, which is unlikely. I am firmly of the belief that Ukraine forces were responsible, but internationally that is politically unacceptable .

    Reply
    • Jeroen

      You are either not informed or deliberately lying.
      The US did present its findings to the JIT team, and the JIT stated that.
      The rebels, i.e Girkin requested Russia for military hardware including “decent anti aircraft wapons”. Sergey Aksyonov then assured him help was coming.
      The Buk was brought to Ukraine to shoot down probably Ukrainian military aircraft, the civil airliner probably was a mistake.

      Reply
      • Andrew

        Then you have probably seen those coverage data, haven’t you? It’s been five and a have years, and we only know that some data were supposedly presented but no one in the world has ever seen it. Not on the Internet or anywhere else. In five years. Are you serious? Do you believe that yourself?

        Reply
        • Jeroen

          The trial will make things clear just be patient. There were enough witnesses on the ground present near and at the launch location.

          Reply
      • Dissident Voice

        Jeroen, maybe you are forgetting that the importance of the Girkin-Aksyonov conversation was degraded by the JIT themselves when they issued their last call for witnesses. In this call they asked for witnesses who can testify if Aksyonov played any part in procurement of a Buk missile system. This says, they don’t have evidence.

        Reply
      • Jeroen

        Evidence will be presented to the judges, Pulatov may present evidence about his actions.
        He may give his cellphone as evidence.
        The judges will decide what will be accepted, and if guilt can be proven.
        Be patient time will come.

        Any energetic attempts to discredit this trial certainly at this stage will make you suspect, and will make Russia suspect it has something to hide. Would could that be?
        We will see.

        Reply
    • Servus

      I’m sorry to say but your high level geopolitical analysis weights very little in comparison with material evidence, hundreds of concordent photos and video evidence and hundreds of concordent personal witness accounts.
      ———

      By the way, why do you talk about the BUK Telar ? Putin, Lavrov and RF top generals stated it was an SU25, a gem of Russian technology flying well above it’s altitude range and carrying a missile twice its size. Any Buk thing is a shameless dutch invention, any Russia Today addict must agree with me .
      RT repeated that so many times that it must be true don’t you agree with me ?
      Who are you to challenge mr Putin and Mr Lavrov? Are you not ashamed to compare a BC article with serious RT, Sputnik journalism or words of Kremlin’s spokesman mr D. Peskov ?
      Shame on you !

      Hope your supervisor sees your shameless contradictions of official Russian position and take appropriate punitive actions. Russian state’s employees lack of loyalty with mr Putin and RF official position can not be tolerated

      Reply
    • fyodor mihailovitch

      David , you’re wrong in all your conclusions and are not thinking clearly . Try to think more deeply about things otherwise no-one will respect you….

      Reply
    • Wing

      David Barneby: sounds English, regardless of actual nationality, so well chosen and probably trusted with caution by Bellingcat.

      Reply
      • Jolene

        Not to me. Not particularly.

        He says “the” twice in place of “they”. Also, a lot of the phrasing is slightly off or out of order from the way an American or British native speaker, (at least) would say things. He also uses “it’s” with an apostrophe as the possessive, though plenty of native speakers are guilty of that.

        Reply
  4. Gerhard

    I find it amusing that there is a clear line back and forth between the trolls’ logic and the actual defense Russia officially presents..just more suggestion that these are planned, concocted, and executed on an official level and disseminated throughout the intelligence apparatus. In Western democracies we’re more likely to see genuine, homegrown nonsense (which Russia is happy to toss into the mix as well), but I must say I’m impressed that they can not only manage to keep a straight face throughout the proceedings, but embrace each and every theory that deflects from the truth, however inconsistent the conspiracies may be. I’d be more impressed if these tactics actually worked, but that is clearly not the case recently with MH17 and Syria.

    So just a fun idea for a discussion — when did the USSR/Russia’s propaganda really stop becoming a truly effective global force? Stalin’s death? Sometime in the 1970s? Glasnost/perestroika? The fall of the USSR? Just a lull between Gorbachev and Putin? The advent of the global Internet? Chechnya? Georgia/South Ossetia? Seizure of Crimea? Donbass campaign?

    …or never?

    Reply
    • Russian

      Gerhard, thumbs up! I couldn’t have said it better myself.
      However, I’m not sure I share your optimism and satire of the second paragraph. We’re living in the most dynamically evolving era humanity has ever seen, so predictions are far from exact science, but if current trends are anything to go by, I have very grave concerns about the Liberal Democracies’ ability to withstand the onslaught of disinformation and propaganda from serious players like China and Russia. The general populace in the West is is not much less gullible and prone to irrational and self-destructive behavior than their counterparts in said regimes. I mean look at how Putin has managed to undermine the US with Trump and the growing divide and sectarianism there? Or how he managed to drive a wedge within the EU countries? The freedoms we take for granted in the West are, imo, a double edge sword and the jury’s still out on which blade is the sharpest. The West is stronger in some regards, but extremely fragile in others, which are ripe for picking by cunning manipulators like Putin and his Chekisti buddies.

      Reply
      • Servus

        ´shameless inventions’ please, – apparently they have been told to appeal to the westerners’ sense of decency or just encountered this obscure idea in a recent english lesson .

        Strange that people that say things like «  rebels carried out chemical weapons attack in Douma or it did not happen st all » remember even a concept of ´shame ´.

        Reply
  5. Victor

    But most of Russia issues about videos is not a timestamp, but a montage and sign of video editing. Why thus long article explain only thing that everyone in the world know – that YouTube messing with timestamps

    Reply
    • Russian

      Vitya, if that’s your actual name, for the life of me I don’t get why you paid Russian trolls are not sophisticated enough to use non Slavic sounding names at least to lend yourself an iota of credibility. There are some here that have mastered this art of disguise enough to warrant reasonable doubt. I mean how amateurish can you be

      Reply
  6. Dissident voice

    Maybe Bcat might ask why the Balodya Familiev account on Youtube, on which only this video was published, was opened on 12:27 local time, one hour before the official capture of the video.
    Furthermore Bcat might want to investigate the plumes of smoke that can be seen at the background, plumes that point to several fires on farmland on the 16th?
    https://hectorreban.wordpress.com/2016/07/06/dating-the-undated-evidence-and-showing-a-broken-trail-the-snizhne-buk-video/
    I want to ask Bcat if it is costumary to take a prosecutors word for divine truth. If this is a general principle, why should one bother to have court cases anyway if the judge only has to rubberstamp accusations.

    Reply
    • Rob

      One of the core assumptions in Reban’s piece is that the picture posted by @parabellum_ua was taken on July 17, 2014.

      However, it now turns out that that picture was taken June 10, 2014, and thus has no relation to MH17 :
      https://twitter.com/parabellum_ua/status/607483473125900289

      I can’t see that any of Reban’s conclusions still hold after this core assumption turned out to be false.

      Reply
    • Jeroen

      Bellingcat is a collective for investigative journalism. your question, adressed at the wrong adress, is not even a real question, it is a failed attempt to smear.
      You do not seem to grasp the most basic principles of Justice.
      Maybe you grew up somewhere where people think or experience judges are corrupt, rubberstamp what the (local) governement, oligarchs want them to?

      The MH17 trial is very important, for the families, for many countries, for the world.

      Reply
  7. Jeroen

    Another one bites the dust, trying to smear both BC and the MH17 trial.
    Please adress what the commander of Kursk 53rd anti aircraft brigade reported about his missing TELAR? Did he gave a medal to its crew? For shooting down a civilian passenger airplane?

    Reply
  8. bart looren de jong

    bellingcat has presented open source investigations that have been confirmed so far you do not believe them because the us does not make their surveilance capabilities public? what has bellingcat to do with us intelligence? you seem to ignore confirmed evidence to blindly believe russian federation who has been proven to peddle propaganda and falsehoods like carlos the flight controller ,the plane was shot because they were shooting after putins plane, it was full of dead people beforehand ,it was an ukrainian su plane so forth and so on evrything points to a buk that traveled from russia the ammunition recoverd from bodies and plane pieces ,communications and eyewitnesses from the russian citizens in sepratists, video and images posted . and more but no the mountain of evidence is to be ignored according to you seems you are either a troll or completly uninformed

    Reply
  9. Servons

    Vitya,
    BC article is an answer to official Russian complant about quality of the video evidence .
    ´Why long article explain only thing that everyone in the world know’
    Everybody, except Russian representatives? How do you dare to insinuate that Russian representatives are incompetent, know nothing and are simply bit stupid?
    Hope you get sanctioned with an exemplary Olgano fine .

    Reply

Leave a Reply

  • (will not be published)

You can support the work of Bellingcat by donating through the following link:

TRUST IN JOURNALISM - IMPRESS