MH17 - The Open Source Evidence
This report can be downloaded as a PDF here.
This report summarizes the open source investigations into the downing of Malaysia Airlines Flight 17 (MH17) on July 17, 2014 in Ukraine. It draws on the work of Bellingcat and others who used open source information to uncover facts about the events that took place on July 17 and the origin of the Buk missile launcher that downed MH17.
The Buk Missile Launcher
After the downing of MH17 on July 17, a number of photographs and videos were shared online claiming to show the movements of a Buk missile launcher through separatist-controlled territory. It was possible to confirm the location where each image was recorded and discover additional information that further evidenced when and where the Buk missile launcher was on July 17. The following is an approximate timeline of where the Buk was and when:
- 10:45 am: Departed Donetsk eastbound along H21
- 11:00 am – 12:00 pm: Passed Zuhres and Shakhtersk en route to Torez along H21
- 12:00 pm – 12:45 pm: Entered and then passed through Torez (eastbound)
- 1:00 pm: Entered Snizhne
- 1:30 pm – 2:30 pm: Buk was unloaded from the Volvo low-loader truck in Snizhne; left the city (southbound)
- 4:20 pm: MH17 shot down
Before the first reports and images of the Buk missile launcher were recorded in Donetsk, communications intercepted by the Ukrainian Security Services (SBU) provided information on the earlier movements of the Buk missile launcher. Intercepts include separatists discussing the arrival of the Buk, and references to a location inside Donetsk known as the “Motel.” The Motel, located in the east of Donetsk and used by separatist forces as a base, is close to locations described in social media postings by Donetsk locals who reported sightings of a Buk missile launcher being transported through the city. These sightings are also close to the location where two images showing a Buk missile launcher being transported on the back of a red low-loader were taken, later published by Paris Match and Bellingcat.
Paris Match has claimed that the images were taken around 11 am on July 17, and social media posts indicate that the Buk was in Donetsk after 9:40 am. SunCalc shadow analysis by the Ukraine@War blog suggests that the time the photograph was taken was approximately 10 am to 10:15 am.
The next sighting of the Buk was reported from the town of Zuhres, east of Donetsk, in a social media post that included a video of the Buk being transported by a low-loader matching the low-loader photographed by Paris Match in Donetsk. The post also stated the time it was reportedly recorded and the coordinates of the Buk.
The coordinates were confirmed as being correct, and the location was later visited by teams from ARD TV, Correctiv, and 60 Minutes Australia, all of whom confirmed the location was correct.
Just after midday, posts were made on social media sites about a Buk missile launcher being transported through the town of Torez, east of Zuhres, and a photograph of the Buk missile launcher being transported by the same missile low-loader seen in the previous images was posted online several hours later. This photograph was geolocated to Torez, with the location again confirmed by ARD TV, Correctiv, and 60 Minutes Australia. As with the Donetsk photographs, camouflage netting can be seen covering the missile loaded onto the Buk.
It was also possible to estimate the time the photograph was taken based on the position of the shadows, which showed that the time was around 12:30 pm. Journalists from the Guardian (UK) and Buzzfeed visited the site a few days after July 17 and confirmed this timeframe with locals who had witnessed the Buk missile launcher traveling through the town just after noon.
The next sightings of the Buk missile launcher occurred in the town of Snizhne, east of Torez, after 1 pm. The Buk missile launcher appears in one photograph and one video shared online, which show that it was unloaded from the low-loader and traveling under its own power. Before MH17 was shot down, an AP report was published in which a journalist in Snizhne claimed to have seen a Buk missile launcher in the town after midday.
The video from Snizhne is the last publically known sighting of the Buk missile launcher on July 17. The video shows the Buk missile launcher heading south out of the town toward a large area of farmland with small, scattered settlements. It is from this area that the Buk missile launcher is believed to have fired at MH17 a few hours later.
The Launch Site
As with the movements of the Buk missile launcher, which was last seen traveling south out of Snizhne, there are a number of sources of information that provide insights into the likely launch site of the missile that shot down MH17.
A few hours after MH17 was shot down, a photograph was shared on Twitter claiming to show the smoke trail from the launch of the missile that shot down MH17.
Dutch news outlet RTL Nieuws conducted an interview with the photographer of the white smoke trail in December 2014, and two research organizations, Fox-IT and NIDF, verified the authenticity of the photographs, while two other organizations, NEO and the Delft University of Technology (TU Delft), examined the white smoke trail and geolocated the photographs. Bellingcat and others also geolocated the photographs, and the exact direction from which the smoke originated.
On July 20, 2014, social news agency Storyful shared satellite map imagery taken the same day, which showed areas south of Snizhne, including the road the Buk missile launcher was filmed heading south on three days earlier and the fields at the end of that road. Track marks in those fields were noted by a number of individuals who visited the area, including Roland Oliphant,  a reporter with the Daily Telegraph, and Christopher Miller of Mashable.
Oliphant and Miller discovered one field where a corner had been burnt over a wide area. He took a number of photographs, which were subsequently used by the Ukraine@War blog to geolocate the exact location of the field. This geolocation, which has been reviewed and confirmed by the Bellingcat investigation team and personally confirmed by Roland Oliphant, points to a field just south of where the tracks were visible on the July 20, 2014 satellite map imagery.
This location is in line with the smoke seen in the photograph posted on Twitter and verified by experts as authentic.
Digital Globe satellite imagery of the area shows that the burnt/plowed area in the northwest corner of the same field was absent the day before, on July 16, 2014.
On July 22, 2014, US intelligence officials published a black and white satellite map image depicting what they claimed to be the path of the Buk missile that downed MH17. Although the quality of the US imagery is poor, it was possible to identify the launch site shown.
Using geographical landmarks in the US imagery, it was possible to identify the same landmarks in Google Earth satellite imagery, and from that determine the launch location. The image below shows origin point in the US imagery in relation to the field visited by Oliphant and Miller, which, again, is in line with the smoke in the photograph posted on Twitter.
Locals sharing information on social media in the hours after MH17 was shot down also discussed the launch of a missile from the direction of the field, and an audio recording posted online a few days after July 17 from the Zello chat program, popular in Eastern Ukraine, includes locals discussing the missile launch and the direction it came from, again indicating the same approximate location as the field.
Journalists have also interviewed witnesses in the area who confirmed the launch of a missile from the direction of the field.   Locals also claimed they risked retribution from separatists for talking about the missile launch.
The Buk on July 18
On July 18, the Ukrainian Ministry of Interior published a video that was filmed in the separatist-controlled city of Luhansk, close to the Russian border with Ukraine, which they claimed showed a Buk heading toward the Russian border on the morning of July 18 carrying three missiles instead of the usual four. The Ukrainian Ministry of Interior later published the coordinates of where the video was recorded, which were confirmed by geolocation and by news organizations visiting the site, including 60 Minutes Australia and Correctiv. As with the images of the Buk missile launcher being transported on July 17, the same truck and low-loader is being used to transport the missile launcher in the July 18 video.
Clockwise from top left – Donetsk, Zuhres, Luhansk, Torez
The owner of the truck was contacted by various news organizations using the phone number visible in the Donetsk photograph. He claimed his vehicle yard had been taken over by separatists (the location of which was confirmed to be in Donetsk) and stated, “It is easy to recognize. We know our vehicles. Yes, it is ours, it is the only Volvo with such a cabin.” Satellite imagery from 11:08 am on July 17, 2014 shows the low-loader was absent from the vehicle yard, while in imagery before and after July 17 the low-loader and truck was visible.
The Joint Investigation Team investigating the downing of MH17 included the route of the Buk on July 17 and the July 18 Luhansk sighting as part of a video asking witnesses to come forward. It also published three SBU intercepts that had not been previously released. The intercepts included two discussions about the Buk missile launcher on July 18, recorded around 8:00 am and 8:20 am, a few hours after the Luhansk video was filmed. It was claimed by individuals in the recordings that the Buk and transport vehicles were both in Russia. Given the distance to the Russian border from the location where the Luhansk video was filmed, there would have been ample time for the Buk to have been transported across the border into Russia before 8:00 am on July 18.
The Buk’s Origins in Russia
During a review of photographs and videos shared online of Buk missile launchers in Ukraine and Russia, it was discovered that one particular Buk missile launcher seen in Russia in late June had features that matched those visible in the two photographs of the Buk missile launcher in Donetsk published by Paris Match. The Buk seen in Russia was dubbed “3×2” due to an obscured number on the side of the vehicle (as is the case with the ID numbers of many of the vehicles transported from Russia to Ukraine). The remaining parts of the numbers of the Buk photographed by Paris Match as well as the loading markings and white paint on the rubber side skirt below those numbers were in exactly the same position.
A burn mark above the exhaust visible in one of the Paris Match photographs was also in exactly the same position as the one seen on Buk 3×2 in Russia. While all of these pieces of evidence seemed to indicate that the Buk in Ukraine and Buk 3×2 were one and the same, an additional piece of evidence made the case particularly compelling. During Bellingcat’s research into the many Buk sightings, it became clear that the rubber side skirt above the tracks of Buk missile launchers can become damaged over time and that this damage creates a unique “fingerprint” allowing different Buk photographs to be matched. In the case of Buk 3×2 and the Buk photograph by Paris Match in Donetsk, the side skirts were nearly identical.
However, there was one major discrepancy. A kink in the side skirt, visible around two-thirds of the way from the left, did not match. This could be explained two ways: either the side skirt was different, or the process of flattening the Donetsk image to compare to the Buk 3×2 image was unable to factor in significant three-dimensional damage to the skirt. Additional images of Buk 3×2 in Russia confirmed that there was in fact a large tear in the side skirt, bending it outward in exactly the same position as the discrepancy in the comparison.
Comparisons were also made between the Donetsk Buk and other images of Buk missile launchers from Russia and Ukraine. None of the other Buk missile launcher images came close to matching Buk 3×2, and it was therefore concluded there was a very high probability that Buk 3×2, photographed and filmed in Russia, was the same Buk photographed and filmed in Ukraine on July 17, 2014.
Tracking Buk 3×2 in Russia
Buk 3×2 was identified as being part of a military convoy that travelled from Kursk to Millerovo, Russia, between June 23 and June 25. Multiple photographs and videos of the convoy, shared online by Russian civilians who lived along the convoy’s route, were identified. Each image was geolocated to the exact location it was recorded, providing an accurate representation of the route that the convoy traveled.
It was possible to identify the 53rd Air Defense Brigade, based outside of Kursk, as the origin of the convoy, along with details of which members and units of the 53rd Brigade were part of the convoy. Furthermore, Bellingcat’s research into the convoy identified the military transport battalions involved in the convoy, including the identities of four individuals who could have driven the vehicle transporting Buk 3×2. The information published on Bellingcat, and additional unpublished information, has been provided to the Joint Investigation Team investigating the downing of MH17.
The 53rd Anti-Aircraft Missile Brigade
The 53rd Anti-Aircraft Missile Brigade was originally linked to Buk 3×2 by matching vehicles present in the June 23 – 25 convoy with vehicles visible in photographs taken by members of the 53rd Brigade at their base near Kursk. Bellingcat has spent the last year investigating the 53rd Brigade. With over 200 soldiers’ social media profiles identified, it was possible to confirm the identity and roles of many members of the 53rd Brigade and their involvement in the June convoy that transported Buk 3×2. Due to the sensitivity of much of this information, Bellingcat is currently only sharing the majority of the research with the Joint Investigation Team. That said, the following information can be published.
The 53rd Brigade is made up of three battalions: the 1st, 2nd, and 3rd. The 1st and 2nd Battalions were active in the summer of 2014, while the 3rd Battalion was used for training students and conscripts. The organizational structure of the 53rd Anti-Aircraft Missile Brigade is shown below:
Videos of the June 23 – 25 convoy show that it contained a complete Buk battalion, with all but two vehicles coming from the 2nd Battalion. Those two vehicles – one of which was Buk 3×2 – originated from the 3rd Battalion. It is also clear that only one Snow Drift radar was part of the convoy, which may answer the question as to why Buk 3×2 was deployed without a Snow Drift radar. With only one available to the battalion, it would make sense to leave the Snow Drift radar with the other Buk missile launchers that were part of the battalion, rather than depriving all those units of a Snow Drift radar.
Alternative Theories – The Russian MoD’s July 21 Press Conference
The press conference made four main claims:
- The video published by the Ukrainian Ministry of Interior showing a Buk in separatist-controlled Luhansk was in fact filmed in government-controlled territory in another town.
- MH17 significantly changed course just before being shot down.
- Radar imagery shows an aircraft close to MH17 shortly after it was shot down.
- Satellite imagery shows Ukrainian Buk missile launchers deployed outside of their base on July 17 in Eastern Ukraine.
Since the July 21 press conference, it has been possible to establish that all four claims were false, and, in some cases, involved the Russian Ministry of Defense producing fabricated evidence to support their claims.
The Luhansk Video
Following the downing of Flight MH17 the Ukrainian Ministry of Interior published a video that was filmed in the separatist-controlled city of Luhansk, close to the Russian border with Ukraine, which they claimed showed a Buk, carrying three missiles instead of the usual four, heading toward the Russian border on the morning of July 18.
In the Russian Ministry of Defense’s July 21 press conference, they claimed that the video had actually been filmed in a government-controlled area:
For example, media circulated a video supposedly showing a Buk system being moved from Ukraine to Russia. This is clearly a fabrication. This video was made in the town of Krasnoarmeisk, as evidenced by the billboard you see in the background, advertising a car dealership at 34 Dnepropetrovsk Street. Krasnoarmeisk has been controlled by the Ukrainian military since May 11.
To support this claim, they provided an image of the billboard visible in the video along with what they claimed the line of text read.
However, it was possible to establish the true location the video was filmed using open source investigation techniques, which confirmed the billboard’s exact location in separatist-controlled Luhansk. This location was visited by a Luhansk local who took photographs of the area which both helped confirm the location, and what was written on the billboard.
It is clear that not only was the location claimed by the Russian Ministry of Defense incorrect, but the billboard’s text is very different from the text the Russian Ministry of Defense claimed was on the billboard.
MH17’s Significant Course Change
The Russian Ministry of Defense presented the following image during the press conference, claiming that MH17 had significantly diverted from its course:
The Russian Ministry of Defense stated that:
On the scheme you can see the international airway. The Boeing-777 was supposed to fly on this airway. Draw your attention to the fact that the aircraft followed inside the specified air-corridor to Donetsk, then it deviated from the route to north. Meanwhile the maximum distance from the left border of the air-corridor was 14 kilometers. Then we can see that the Boeing-777 turned back to the borders of the specified air-corridor. Nevertheless Malaysian aircrew didn’t succeed the maneuver. At 17.20 we entered the event of the aircraft rate reduction, at 17.23 the aircraft’s point blinked off on the radar. Why did the aircraft cross the border of the air-corridor? Was it the navigation mistake, or the aircrew followed the Dnepropetrovsk ground control orders? We will find the answers after “black boxes” and communication decoding
The preliminary Dutch Safety Board report answered the questions that the Russian Ministry of Defense asked, showing that MH17 had been on an entirely different course than that which was claimed by the Russian Ministry of Defense and had not changed course in the way described in the Russian Ministry of Defense’s imagery.
Russia’s Radar Data
The Russian Ministry of Defense also presented radar data showing MH17 and claimed “Russian system of air control detected the Ukrainian Air Force aircraft, purposed Su-25, moving upwards toward to the Malaysian Boeing-777. The distance between aircrafts was 3-5 kilometers.” Chief of Staff of the Air Force Lieutenant-General Igor Makushev was then invited to comment on the radar data.
At 17.20 P.M. at the distance of 51 kilometers from the Russian Federation state boundary and the azimuth of 300 degrees the aircraft started to lose its speed obstructively which is quite distinctively to be seen on the table of the aircraft characteristics. At 17.21 35 seconds P.M. with the aircraft speed of 200 km/h at the point of the Boeing crash there is a new mark of the aircraft to be seen. The aircraft was steadily monitored by radar stations of Ust-Donetsk and Butirinskoe during 4 minutes period. Air control officer having enquired the characteristics of newly appeared aircraft couldn’t possibly get them because it is in all likelihood that the aircraft had no secondary deduction system amounted on it, which is put typically for military aircraft. The early detection of this aircraft appeared to be quite impossible because the air situation control is usually performed by radars working in a standby mode which detection possibilities at the given distance are over 5000 m altitude.
The detection of the aircraft turned out to be possible as the aircraft ascend it.
However, radar experts were interviewed by a number of news organizations who gave a different opinion, with Dutch NOS news asking four experts to give their opinions. Comments included, “it is really impossible for [it to be] a fighter,” “no aircraft was in the vicinity of flight MH17,″ “it seems likely that the signals are the wreckage of MH17,″ and “falling debris are the most likely explanation.”
Russian Satellite Imagery
Russia also presented sets of satellite imagery showing three different locations, including two military bases and a field outside the town of Zaroshchens’ke. At one military base, the 1428, it was claimed that images from July 14 and July 17 showed that a Buk missile launcher had moved from the base on July 17.
However, comparisons of an image from the satellite company Digital Globe of the same location on July 17 show a number of clear discrepancies. For example, large areas of vegetation visible in the July 14 Ministry of Defense images were absent from the July 17 Digital Globe image.
Historical satellite imagery of the same location from July 2 and 21 of the same area on Google Earth confirms that the vegetation had been cleared weeks before July 17.
Patches of worn-away grass visible in the Russian Ministry of Defense imagery were also absent in the Digital Globe July 17 imagery.
But, as with some of the other discrepancies between the images, the patches of missing grass were visible in earlier historical imagery on Google Earth, clearly showing the Russian Ministry of Defense images were from weeks before MH17 was shot down.
After publishing these images, it was discovered that the same satellite imagery had been published by the SBU in July 2014. The Russian Ministry of Defense responded by claiming that the SBU was presenting falsified images. However, it is clear that the SBU images are genuine (although with the RGB color channels inverted to BGR for an unknown reason), and that the Russian Ministry of Defense presented and defended images that are purposefully dated incorrectly.
Alternative Theories – The Almaz-Antey Press Conference
On June 2, 2015 Russian arms manufacturer Almaz-Antey presented evidence claiming to show the specific type of missile used to shoot down MH17 in Ukraine. They were quoted as stating:
If a surface-to-air missile system was used [to hit the plane], it could only have been a 9M38M1 missile of the BUK-M1 system.
They went on to add:
Production of BUK-M1 missiles was discontinued in 1999, at the same time Russia passed all such missiles that were left to international clients.
The clear implication was that the Buk missile used to shoot down MH17 could have not come from Russia. The most obvious visual difference between the 9M38M1 missile, and the newer 9M317 is the length of the fins, with the 9M38M1 having longer fins, as visible below.
Despite these longer fins being visible on Buk missiles loaded onto launchers at Russia’s Victory Day Parade in Chita, the Almaz-Antey’s head, Yan Novikov claimed “that only the newer BUK-M2 systems with 9M317 missiles take part in modern parades,” adding, “even an untrained eye can tell the two apart.” Despite this claim, internet users came across numerous images of what seemed to be 9M38M1 missiles in military service.
Reuters’ photographs taken on a road near Kamensk-Shakhtinsky, dated August 16, 2014, shows Russian military vehicles heading toward the town, close to the Ukrainian border. Trucks in the photographs are carrying a number of missile crates, and their markings give a clear indication of their likely contents.
These crates are marked 9M38M1, and it was also possible to identity two vehicles in the Reuters’ photographs as being part of the June 23 – 25 53rd Brigade convoy transporting Buk 3×2 to Millerovo. It is also possible to identify missiles in videos of the 53rd Brigade convoy as having the long tail fins associated with the 9M38M1 missile.
Almaz-Antey also claimed that, based on their research, the launch site of the missile that shot down Flight MH17 was near the town of Zaroshchens’ke, 20 km west of the proposed launch site near Snizhe. Interestingly, the area highlighted as the possible launch area by Almaz-Antey includes an area the Russian Ministry of Defense included in their debunked satellite imagery, highlighted in red below.
Analysis of satellite imagery and battlefield reports indicates this area was under the control of separatist forces on July 17, 2014, and Novaya Gazeta and Correctiv also interviewed locals who stated that they saw no signs of missile launches or Buk missile launchers on July 17, 2014. Unlike the social media activity related to the Snizhne launch site, the Bellingcat investigation team has been unable to find any social media activity related to missile launches from the Zaroshchens’ke area.
Based on the information above, it can be concluded that on July 17, 2014 a Buk missile launcher, originating from the 53rd Brigade near Kursk, Russia, travelled from Donetsk to Snizhne. It was then unloaded and drove under its own power to a field south of Snizhne, where at approximately 4:20 pm it launched a surface-to-air missile that hit Malaysia Airlines Flight 17 as it flew over Ukraine. On the morning of July 18, the Buk missile launcher was driven from Luhansk, Ukraine, across the border to Russia.
Alternative scenarios presented by the Russian Ministry of Defense and Almaz-Antey are at best deeply flawed, and at worst show a deliberate attempt to mislead using fabricated evidence.
 Digital Globe catalog ID 10300100342F0300