the home of online investigations

Is this the Launch Site of the Missile that Shot Down Flight MH17? A Look at the Claims and Evidence

January 27, 2015

By Daniel Romein

In a previous investigation related to the 17 July 2014 downing of Malaysian Airlines Flight 17 (MH17) in eastern Ukraine, the Bellingcat investigation team provided the origin and movements of a Buk M1 missile launcher filmed and photographed that same day that travelled from Donetsk past Zuhres, through Torez and Snizhne. Before reaching Snizhne, the Buk M1 missile launcher was transported on a red low-loader hauled by a white Volvo truck featuring a telephone number and unique blue stripes. In Snizhne, however, the Buk was unloaded off the hauler and driven south out of Snizhne under its own power. In the early hours of 18 July 2014 the missile launcher was spotted in Luhansk, where it was again being hauled by the same white Volvo truck, but this time it was missing one missile.

The location of the Buk between its last sighting in Snizhne and its appearance in Luhansk the following morning is a vital question that will shed light on the culprits and circumstances of the MH17 tragedy. This report will consider four vital clues that allow us to estimate the launch location for the missile that downed MH17: 1) photographs of a white smoke trail taken a few moments after the crash of flight MH17, 2) visible burn damage to a wheat field that appeared between 16 and 20 July 2014, 3) audio recordings reportedly from 17 July 2014, and 4) a US intelligence satellite image from 22 July 2014.

Two hours after the crash of the MH17, a photograph that showed a vertical white smoke trail and a smaller grey smoke patch to the left of the white smoke trail was posted on Twitter by someone who claimed that this photograph, provided by an anonymous photographer, depicted the launch site of the Buk launcher that downed MH17. A few days later, a number of bloggers geolocated features in the image, including the approximate location of the photographer and an approximate origin point of the white smoke trail. In December, the photographer provided additional photographs, and a Dutch news outlet enlisted the help of outside research experts to review the pictures. They assessed that they were authentic.

On 20 July, 1 August, and 15 August 2014, Google updated its satellite imagery to include images of Snizhne and Torez, revealing suspicious tracks in wheat fields and a part of what seemed to be a burned wheat field with scorched earth south of Snizhne.

On 22 July 2014, US intelligence officials published a blurry black and white satellite image with the flight paths of both MH17 and the Buk M1 missile that downed the passenger plane. Because of the relative low quality of the image, many were disappointed by the declassified intelligence. However, after re-examining this image, it turned out to be far more informative than first thought.

On 24 July 2014, conversations in Snizhne and Torez over the smartphone app Zello recorded at the time of the downing of MH17 were posted on YouTube. One conversation was of a woman recounting that she saw a missile flying overhead while she was in a garden and describing the direction of the missile. In addition, tapped phone conversations on 17 July 2014 between pro-Russian separatists published by the Security Service of Ukraine (SBU) provided information about the destination of the Buk missile launcher on 17 July 2014.

In consideration of all of these clues, this report concludes that the likely missile launch location was in a burned wheat field south of Snizhne.

The Separatists’ Buk Missile Launcher in Snizhne

In Bellingcat’s earlier investigation, “Origin of the Separatists’ Buk,” the Bellingcat investigation team established the route of the Buk on 17 July 2014: Donetsk to Zuhres to Torez to Snizhne and then to Luhansk the following morning. The first of two Snizhne sightings took place in the center of the city, where it was moving under its own power. A photograph taken of the missile launcher was posted on Twitter on 18 July, and after this photograph was taken, a video was shot of the missile launcher driving south through Snizhne. This video was first posted on YouTube on 17 July 2014. Both the picture and the video have been geolocated by Bellingcat and others.

1

The picture and video raise two important questions: Why was the Buk headed south toward the city limits of Snizhne? And why was the Buk no longer being hauled and instead driving under its own power? From various sources it is apparent that from July until the end of August, an ongoing battle between pro-Russian separatists and the Ukrainian army was taking place south of Snizhne in the villages of Stepanivka, Marynivka, and near the monument hill of Savur-Mohila in Saurivka. The road south of Snizhne (T0522) leads directly to this area, so it is possible that the Buk intended to provide anti-air support in the area. This may shed some light on the second question, as the Buk must be unloaded from the truck in order to fire its missile.

Map of the area south of Snizhne on Google Maps with the conflict area in a green circle, the location of the picture of a Buk M1 missile launcher in a small red circle and the location of the video of a Buk M1 missile launcher in a small blue circle.

Map of the area south of Snizhne on Google Maps with the conflict area in a green circle, the location of the picture of a Buk M1 missile launcher in a small red circle and the location of the video of a Buk M1 missile launcher in a small blue circle.

To our knowledge, no other pictures or videos have been made of the Buk M1 missile launcher in this area, and only one other video was posted on YouTube on 18 July 2014 of the missile launcher being hauled again by the white Volvo truck in Luhansk, this time clearly missing one missile.

July 2014 photographs of the white smoke trail

Just three hours after the crash of MH17, a picture was published on Twitter that appeared to show a ropeway on the horizon between “Lutugina” and “Tsof” in the area of Torez, which is close to Snizhne. The image was posted at 7:23 PM local time, three hours after the crash of Flight MH17.

1

Several claims have been made that assert that the picture was a fabrication of the Security Service of Ukraine (SBU). This is unlikely for the following reasons: The photograph was posted only three hours after the MH17 crash, the general location of the white smoke trail is in the same area where the Buk was seen heading toward when last seen in Snizhne, and the weather matches that of July 17 as demonstrated in subsequent photographs that were released. Additionally, the SBU did not share this photograph until two days later, while, in contrast, the 18 July 2014 Luhansk video was released very quickly by the SBU itself. The photograph did not appear on any official Ukrainian channels before it was posted on Twitter, and the earliest posting of the photograph by a Ukrainian official was by Ministry of Internal Affairs official Anton Gerashchenko on Facebook at 7:45 PM (local time).

On 21 July 2014, the blogger Ukraine@War geolocated the photograph. The Bellingcat investigation team has verified the geolocation, which indicates that the photograph was taken north of Torez in the direction of a mine in eastern Torez. A detailed look at the geolocation of this photograph can be found here.

Dutch news outlet RTL Nieuws conducted an interview with the anonymous photographer of the white smoke trail in December 2014. Along with the interview, RTL Nieuws acquired additional photographs taken right after the original photograph in the same location. Two research organizations, FOX-IT and NIDF, verified the authenticity of the photographs, while two other organizations, NEO and TuDelft (the Technical University in Delft), examined the white smoke trail and geolocated the photographs. The anonymous photographer has given the original photographs, including the memory card holding them, to the official Dutch investigation of the downing of MH17.

Second picture taken on 17 July 2014 from the north of Torez.

Second picture taken on 17 July 2014 from the north of Torez.

Considering the previous geolocation evidence, there can be no doubt that the photographs that claim to show the Buk launch site from 17 July 2014 were taken from northern Torez and show the area of eastern Torez near the Lutugina mine in the direction south of Snizhne.

Authenticity of photographs

There have been many claims that the 17 July 2014 pictures are not genuine, manipulated, or were taken at a different date.

As part of this investigation, Bellingcat contacted the photographer who took the smoke trail images, and provided the images in  a RAW image format. To protect the privacy and safety of the photographer, we have decided not to publish anything about the exact file type of the pictures or any other metadata, as it would reveal the type of camera the photographer used. What we will publish is that the second published picture was taken first at 16:25:41 EEST, and the first published picture was taken 7 seconds later at 16:25:48 EEST. According to the photographer, the first picture was taken about 30 seconds after the explosion. Because we know that flight MH17 was hit around 16:20 EEST, the camera’s time stamp was approximately 4 minutes to 4 minutes and 30 seconds ahead of the real time. The metadata (or Exif data) of the original files show that all date and time properties like camera date, digitized date, modified date, and file date show a date of 17 July 2014 and times of 16:25:41 and 16:25:48.

Images in a RAW format can be edited in photo editing software and saved as a different format, like BMP, JPG, PNG, TIFF, etc., but this will always result in a different file date, namely, the date and time the file has been saved after editing. Photo editing software is not able to save files in a RAW format, because this is not a “positive” image format. In addition, because pictures can only be edited by photo editing software, changes to the pictures will always result in modified metadata.

While software capable of saving images in RAW format does exist, it is usually the software of the camera itself and cannot edit images because images in a RAW format first have to be converted to an editable image format (e.g. BMP, JPG, PNG, TIFF). Also, when the file in RAW format is saved, the modified date of the metadata will be changed.

Based on the metadata of the RAW files we received, we can be completely certain that these files are the original files and that the pictures were taken on 17 July 2014 at 16:25:41 EEST and 16:25:48 EEST, according to the date and time set in the camera. Though it is possible to set the camera itself to a different date and time, when we take into account that the first picture was released two hours after the crash, the only scenario where what we see on the pictures is not the launch of the Buk missile that was seen above eastern Torez on 17 July 2014 is that the photographer took a picture of a missile launch on a previous date, and his camera date and time was inadvertently set to 17 July 2014 at 16:25 EEST. The probability of this being the case, of course, is close to zero.

Another interesting detail noted by the Bellingcat investigation team is that, based on the movement of the smoke between the photographs, the smoke was moving toward the east, which corresponds to reports about the wind direction that day. The weather conditions in the photos are also consistent with the weather conditions that day, with clouds visible in the unzoomed photograph. A more detailed examination of the photographs can be found here.

Full-sized, uncompressed copies of the original RAW files can be found here.

The Possible Launch Location

With the smoke photographs geolocated, it was then possible to establish where the smoke was originating from. Early attempts by the person who tweeted the original photograph and the Ukraine@War blog pointed to fields to the south of Snizhne, where the Buk filmed heading out of Snizhne would have had easy access. The following image was created based on Bellingcat’s own geolocation and analysis of the photograph and closely matches the work done previously on Ukraine@War:

View lines of the first picture of 17 July 2014 with the view frame (blue lines), the view lines of the white smoke trail (red lines) and the view lines of the smaller grey smoke trail (brown lines).

View lines of the first picture of 17 July 2014 with the view frame (blue lines), the view lines of the white smoke trail (red lines) and the view lines of the smaller grey smoke trail (brown lines).

On 20 July 2014, social news agency Storyful shared satellite map imagery taken the same day that showed areas south of Snizhne, including the road the Buk missile launcher was filmed heading south on three days earlier and the fields at the end of that road. Track marks in those fields were noted by a number of individuals, including Ukraine@War and Roland Oliphant, a reporter with the Daily Telegraph who visited the area.

Oliphant discovered one field where a corner had been burnt over a wide area. He took a number of photographs, which were subsequently used by the Ukraine@War blog to geolocate the exact location of the field. This geolocation has been reviewed and confirmed by the Bellingcat investigation team and shows a field just south of where the tracks were visible on the 20 July 2014 satellite map imagery.

Part of a wheat field where scorched earth and burned wheat was seen by Roland Oliphant of the Telegraph from 15 August 2014 satellite image.

Part of a wheat field where scorched earth and burned wheat was seen by Roland Oliphant of the Telegraph from 15 August 2014 satellite image.

In the map below, the partly burnt  and ploughed area of the field has been highlighted in yellow, and is in line with where the grey smoke was visible on the photographs of the smoke trail, marked with brown lines:

6

Audio Recordings

Shortly after the downing of Malaysian Airlines Flight 17 (MH17) on July 17th, an audio clip was shared on social media sites claiming to be a recording of civilians near the town of Snizhne discussing the crash on the audio chat application Zello. Zello is a popular service in separatist areas, and this particular recording purports to capture what would be a key discussion about events on July 17th.

The individuals in the video describe both an “upward” missile launch and the crash of MH17. While it is difficult to independently verify the authenticity of the audio, it is possible to compare what is described in the audio with other evidence about the downing of MH17, including the launch location of the missile.

Multiple times throughout the recording, people are heard referring to the location they are in or the location where they can see something happening. Two people talk about KhimMash (Химмаш in Russian), an industrial plant to the north of Snizhne, probably because they saw smoke rising from north of Snizhne. Other locations, like “mine 8” (“Шахта №8”) in the west of Snizhne and “Cheryomushky” (“Черемушки”) next to the KhimMash plant, are also mentioned, but one person describes a missile flying over her while she was in a garden. She says the missile came from the direction of Saurivka, a small village to the south of Snizhne near Stepanivka, where the Savur-Mohyla monument is located. The woman claims that the loud noise of the launch caused her to seek shelter in the basement of her home with her mother. This would seem to indicate the missile was launched relatively close to her house.

The woman describes herself as being in “Oktyabr” (“Октябрь”), which can be found south of Snizhne on the Russian Yandex Maps site:

1

With some uncertainty, she goes on to describe the direction she believes the missile was launched from, namely, Saurivka, which is south-southeast of her location.

On 18 July, the Security Service of Ukraine (SBU) published another audio recording relevant to identifying the missile launch location. In this conversation, we first hear separatists talking about a Buk M1 surface-to-air missile system and later that the Buk is in Donetsk. We then hear that the Buk was unloaded somewhere and driving under its own power and that the Buk has to be delivered to an area nearby called “Pervomaiskoe.”

A search for this location yielded a “Pervomaiske” near Donetsk, a “Pervomaisk” near Luhansk, a “Pervomaisk” near Mykolaiv, a “Pervomaskyi” near Kharkiv, a “Pervomaiske” near Dnipropetrovsk, a “Pervomaiskyi” to the southeast of Snizhne, and another village north of Snizhne called “Pervomaiske.”

The image below shows the locations mentioned in the audio recordings in relation to the suspected launch site visited by Roland Oliphant:

10

US Intelligence Satellite Map Imagery

On July 22nd, 2014, US intelligence officials published a black and white satellite map image showing what they claimed to be the path of the Buk missile that downed MH17.

Although the map marks Snizhne as the launch site of the missile, the exact location of the site was not immediately clear due to the quality of the image.

0

While the quality of the declassified satellite map image is relatively poor, it is nonetheless possible to find the approximate launch site indicated on the map. Certain large geographical features are visible on the satellite map image, and by examining Google Earth satellite map imagery, it is possible to find these same features.

For instance, there is a curved lake and two areas of forest northeast of the location identified as the launch site:

1

To the southwest, there are a series of small lakes running north to south which match perfectly with what is visible on both sets of satellite map imagery:

2

Zooming in closer, we can make out other features, including an oddly shaped field just south of the launch location:

3

The oddly shaped field is a just to the south of the village Chervonyi Zhovten, which is north of the Savur-Mohila monument in Saurivka and slightly west of Stepanivka. Due to the width of the line and the resolution of the US satellite map imagery it is not possible to find the exact location the line originates from, but it appears that it would be very close to the area where the lines below intersect, south of Snizhne:

5

Based on the image above, the line comes very close to originating from the suspected launch site:

11

Conclusion

Based on the foregoing information, it seems clear there are a number of pieces of evidence pointing toward one specific location south of Snizhne. Photographs published online two hours after MH17 was shot down point directly to an area that is clearly visible on satellite map imagery, showing a field that was unburnt on 16 July 2014 but visibly burnt only a few days after that date. On 17 July 2014, a Buk missile launcher was filmed only a few kilometres to the north of this site heading south in the direction of the location we have identified. US intelligence also points to the same field, and audio recordings, while difficult to authenticate, also point to roughly the same area.

Taken separately, these pieces of evidence are not particularly compelling. When combined, however, they provide strong support for the assertion that the missile that downed MH17 originated from the potential launch site we have identified.

Daniel Romein

Daniel Romein is an IT-specialist and open source investigator focused on the MH17 case and the conflict in Ukraine. He started as volunteer in 2014 and currently works as full time employee for Bellingcat.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

Support Bellingcat

You can support the work of Bellingcat by donating through the below link:

100 Comments

  1. karlis

    Thank you for your work!

    There’s an error in your article: “What we will publish is that the SECOND published picture was taken first at 16:25:41 EEST, and the SECOND published picture was taken 7 seconds later at 16:25:48 EEST”

    What’s the point of keeping identity of photographer secret if anyone who’s interested can easily find him?

    Can you please find out if he was using tripod when taking the photos? I’m asking because some people are having doubts because of angle in both photos is very similar.

    Reply
  2. Daniel Romein

    Hi Karlis,

    it’s not an error: the FIRST published picture (on 17 July 2014) was taken 7 seconds after the SECOND published picture, which was published much later (in December 2014).

    The photographer prefers to be anonymous for safety reasons and we respect that wish. We can ask about the tripod, but we can’t guarantee an answer to that one.

    Reply
    • karlis

      Than it is in his own best interests to know that pro-russians know his identity, the house from which the photo has been taken, his homepage and also the city he lives in now.

      Specific model of camera and lens has also been known since December, but I’m pretty sure that photographer disclosed this information himself.

      Daniel, it’s probably worth mentioning in your article that photographer has given away his camera too: http://ukraineatwar.blogspot.nl/2014/12/interview-with-eyewitness-who-made.html

      Reply
      • Daniel Romein

        Hi Karlis, some information about the photographer has been leaked,
        this is known to us and to the photographer. Still we choose not to
        mention these details. Indeed the camera itself and the memory card
        are part of the official investigation in the Netherlands.

        Reply
  3. Mike

    I believe there are tools available to modify the date and time of the RAW file. So these photos could have been made earlier with the date adjusted to prove it was made on July 17. With a small error to make it look less suspicious

    Reply
    • Daniel Romein

      Yes, those tools exist and work quite easy, but even these tools leave changes in the exif data. There is always the modification date of the file, but changing the time of your PC would fix that. But the original raw images are on a memory card that is now in possesion of the official investigation. Investigation of those images can confirm the authenticity totally. Still, even when someone could produce such an image made on an earlier date, we still see a launch of a surface-to-air missile to the south of Snizhne, which isn’t a regular thing to happen in the area.

      Reply
  4. Michal

    Hello,
    Very good work. Very convincing material.
    I would like to point out though that changing the recorded dates and times or, in fact, any metadata – be it exif or file system data – is a very easy task to anyone with a moderate skill.
    It is a good thing to make sure the dates are consistent, as that could indicate a falsification, but in no means do they contribute to the proof of authenticity.
    In other words, in the dates you can find evidence of modification but not evidence of lack of modification. The lack of evidence is not the evidence of lack, as they say.

    The raw images, as opposed to compressed images do provide an excellent material for confirmation through image analysis , because they contain more original, difficult to reproduce information (such as the sensor noise), which would make modifications quite easy to spot (you might need an algorithm for that though).

    Reply
  5. Damon

    Even though you are trying to protect the identity of the photographer, you did give away valuable information that could lead people to identify him/her. I don’t think the risk was worth the story.

    1) Not many cameras take pictures in RAW format. Mainly DSLRs do. Even fewer people use RAW – mosly those who do photo editing in Photoshop, etc including professional and hobby photographers.

    2) Your uploaded drop-box pictures have the format: XXX_####. Only XXXXX cameras save pictures in this naming convention.

    3) Your uncompressed drop box pictures have a resolution of 4928 by 3264 pixels. That’s 16084992 pixels, or 16 Megapixels. It was taken with a 16 Megapixel camera.

    The takeaway: The photo was taken by someone who is obviously into photography and owns a mid-range XXXXX interchangeable lens camera.

    We know the location of the building from which the pictures were taken from the geo-location work of bloggers. So an interested party could talk to residents of that building and track down and track down the owner of this particular type of camera.

    That said I hope the person and his family are safely out of the conflict zone and under European protection.

    Reply
    • Damon

      What I am saying is you need to be careful what you put into the internet. Just as you follow digital clues in your investigations, others can follow the clues that you leave.

      Reply
      • Daniel Romein

        Thanks for the comment, I have edited a part of your comment.
        You are right that the converted versions of the original pictures
        give away more information then the published ones before.
        The photographer and family are safe at this moment.

        Reply
        • Daniel Romein

          We have changed the filenames, so the type of camera can not be revealed anymore through these filenames.

          Reply
  6. bohdan

    The sad part is that while the Truth is here to believe………So What!

    The time for that justice has passed as has even the memory of outrage.

    The Russians lied their way out of it and the western leaders lacked the courage to press for justice as can be seen by how far they let Putin have his way in Ukraine.

    The airliner could be substituted for an ocean liner as the exact scenarios of annexation and invasion were played so far in 1939. Only time will reveal the magnitude of this WAR!

    Reply
  7. bohdan

    Such crimes against humanity are just too outrageous to be bartered for the rebels by their propaganda and I fear that your findings as concise as they may be will no doubt be “twisted by knaves” or buried in the tattered lost pages of all bloodshed.

    Your findings, unfortunately probably won’t matter anymore. I hope I’m wrong.

    Nevertheless, thank you all for the finding and for your printing it.

    Reply
  8. tal

    This is all stupid propaganda.
    This is what happened really: http://de.scribd.com/doc/253024818/Mas-17-Dam-Final
    There you may see differences between low speed ammo and highspeed ammos look like. All the pictures are proven by system there were shot down.
    So you may easily see that there major differences everyone can see. Do not believe in western NATO propaganda about camouflaged tanks and camouflaged surfaced anti-aircraft-missile. That is totally stupid !

    Reply
  9. Bill Gibson-Patmore

    Despite what has been commented, I DO think this report matters, and will matter for years to come!
    This investigation was the basis for other “official” investigations.

    I commend the Bellingcat contributors for steadfastky sticking to the orinciples of truth and accuracy. Also for the discretion regarding privacy.

    Best wishes, and thanks to all involved in this paper.

    Bill Gibson-Patmore

    Reply

Leave a Reply

  • (will not be published)