the home of online investigations

You can support the work of Bellingcat by donating through the following link:

MH17 – The Open Source Investigation, Three Years Later

July 17, 2017

By Bellingcat Investigation Team

The full report can be downloaded here 

Полная версия отчета на русском языке— здесь 

Today, we are releasing a report summarizing all major open source evidence surrounding the downing of MH17 in an easy-to-read 73-page survey. This report is broken into thirteen chapters, summarizing the circumstances that led to the downing of MH17, information on the Buk missile launcher that downed the passenger plane, a summary of alternative scenarios regarding the downing, and other essential areas of information.

For those well-versed in the twists and turns surrounding the MH17 case, most of the information in this report will be familiar. This report is aimed at those looking for a more accessible introduction into the information around this tragic event, which has seen massive disinformation campaigns around it and continues to be relevant with the ongoing Dutch-led criminal investigation. Below is a summary of the findings of this survey:

  • Between June 23-25, 2014, Russia’s 53rd Anti-Aircraft Missile Brigade transported vehicles within Russia to positions close to the Russian border with Ukraine. This includes Buk 332, later photographed and filmed in Ukraine on July 17 and 18, 2014.
  • On July 17, 2014, Buk 332 was in Ukraine, and arrived in Donetsk in the morning. From there, while loaded onto red low-loader, it traveled eastwards through separatist-held territory, and eventually reached the town of Snizhne in the early afternoon.
  • After arriving in Snizhne, Buk 332 was unloaded and drove under its own power southward, out of town.
  • Buk 332 arrived at a field south of Snizhne and fired a missile that resulted in the destruction of flight MH17.
  • Buk 332 was next filmed traveling east through the separatist-controlled city of Luhansk on the morning of July 18, 2014 missing one missile. Intercepted communications indicate that the missile launcher was taken into Russia shortly after this video was filmed.
  • On July 21, 2014, the Russian MoD presented a series of fabricated and misleading information about the flight path of MH17, radar data, the location of the July 18, 2014 Luhansk video, and the inclusion of misdated and heavily edited satellite imagery.
  • Almaz-Antey presented data that was not reflected by witness statements on the ground, any open source information, or the technical assessments made by the DSB.
  • No credible evidence has been presented that shows any operational Ukrainian Buk missile launcher was near a position in range of downing MH17 on July 17, 2014.
  • The only credible candidate for the missile launcher that downed MH17 is Russian Buk 332, of the 53rd Anti-Aircraft Missile Brigade.

Additionally, we would like to use this opportunity to call for an increased focus on discovering information on two individuals central to the MH17 case: Orion and Delfin. These two men, whose first names and patronymics are Andrey Ivanovich (Orion) and Nikolai Fyodorovich (Delfin), are being sought by the Dutch-led criminal investigation into the downing of MH17. The JIT’s call for witnesses regarding these two men, along with telephone conversations with their voices, can be seen below:

Orion (Орион) has also been called “Oreon” (Ореон) in a telephone call published by the Ukrainian Security Services (SBU). This call-sign is not unique in the Donbas, with other Rusisan and separatist fighters using this name, but Delfin (Дельфин, or “The Dolphin”) is more uncommon. The transcripts of these calls can be found here (in English) and here (in Russian). Additionally, the call published by the SBU called Orion a Russian officer of the GRU, but this information has not been verified.

Bellingcat, along with other online investigators, were able to discover a large amount of information on Sergey Dubinsky, or “Khmury,” another key figure in the downing of MH17. By searching some of the same sources – old videos, popular separatist message boards frequented by fighter sand their friends and family, photographs of meetings from the summer of 2014 between separatist officials and fighters – it may be possible to discover more information about Orion and Delfin. If you find information or a possible lead, tweet it out with the hashtag #OrionDelfin or #ОрионДельфин

Bellingcat Investigation Team

The Bellingcat Investigation Team is an award winning group of volunteers and full time investigators who make up the core of the Bellingcat's investigative efforts.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.


    • Volo

      I’ve looked through the file (you link has a typo – “открЫтых” misses “Ы” letter). It is full of emotional propaganda criticizing the quality of Russian translation of Bellingcat’s report.
      1. Use the source material, i.e. English version of the report; and
      2. I failed to find much of counter-arguments in the report. No facts were proved or disproved in the document. Mostly it consists of discrediting of Bellingcat (called “sofa Pinkertons”), SBU, MIA( mocked “Na-nana-naa-nah!”) and “ever-conspiring” USA.

      I advice to spare your time and avoid looking into this low-quality propaganda product.

      • zoliballa

        I am very glad to see that at least one of the readers expressed interest to the counter-arguments in the Russian report. Thanks for the correction of the link, it is indeed Фальсификация%20открытых%20источников.pdf. Unfortunately I have not found English translation of that document. I completely agree that “this is low-quality propaganda product”. Nevertheless I list some of the counter-arguments from it which were not found by Volo.
        1. A photo of the Buk complex is shown on p. 35 with a detailed explanation on pp. 34–35. It consists of three elements: (i) command station, (ii) station of detection and targeting, and (iii) self-propelled fire installation (sorry for poor translation — I am not Russian and not a military man). The (iii) can independently detect and destroy the target but in that case its capability is restricted to 120 degrees horizontally and 7 degrees vertically and the effectiveness of the shooting is extremely low. — Bellingcat report does not say any word about that problem whereas its earlier versions followed only the (iii) element of the Buk in question from Kursk, i. e. more than 600 km to Snizhne. I do not know whether the characteristics above are true or not but Bellingcat report should have definitely cleared up this aspect. Especially when taking into account that fire was shot most probably much steeper than 7 degrees.
        2. “The Paris Match photograph published in July 2014” is one of the key documents in Bellingcat report. However, it was shown on p. 6 that sharpness of the image in general increases onwards whereas the windows cleaner in the premier-plane is outstanding with its sharpness. — In other words the photo as a whole bears traces of reworking.
        3. Another key document in Bellingcat report is “Satellite image from 11:08 am, July 17, 2014, showing the Buk convoy traveling through separatist-controlled Makiivka”. In their previous report Bellingcat stated that the source is Digital Globe. Now the source is changed to Stratfor but its link “Failed to fetch”. The image for Makiivka July 17 loaded from Digital Globe a month ago even with the maximum resolution was too small-scale to allow to see anything in the road discussed. The Russian fellow much earlier could not load that image at all. — So the “open source” does not work.
        4. Tweets about the appearance of Buk in Donetsk are controversial in sense of both the travelling direction and the amount and type of the convoying cars.
        There is no room here to continue but there are some more interesting counter-arguments. The only thing I would like to stress is that the analysis of the satellite material presented by the Russian Ministry of Defence seems to be quite convincing: this obviously is a series of fakes.

        • KimmoK

          1. If there would be TELAR (7degrees) limitation that would make it impossible to target MH17 from pervomaiske, surely the BUK manufacturer would have said so.
          Also, it is not yet proven if rebel TELAR was connected to TAR on Russian side of border.

          So far it “just” seems strongly proven that launch came from rebel area.

    • Victor Zaharov

      I don’t need 73 pages to prove ukraine guilty. Radar data say about it. What this JIT use to prove Russia guilty, only its long long tongue. Such behavior is awful.

  1. Rodolphe

    I am surprised, that we have now over thirty comments on the detailed Bellingcat report that seems logical to me, whereas the comments, that try to destroy it, are so far not able to present an equally logic report. Punished or not, that is another question. What counts, is the TRUTH !

    • Sean Lamb

      It is difficult to rebut a 73 page report in a few paragraphs in a comments field.

      I could certainly rebut sections of it – such as the conversation between Delphin and Orion clearly took place before the downing of MH17 and so presumably did the Lugansk video that is seems to match up with.

      But because MH17 is now a political event and no longer a search for truth, there isn’t much point in doing so. Not one person who believes in Russian responsibility would acknowledge these facts and the arguments that would result would be simply noisy and pointless – as noisy and pointless as online debates between Republicans and Democrats – like MH17 no one changes their minds because that is the nature of positions that are politically or ideologically determined. It is like trying to get supporters of two different football teams to agree on an on-field foul – sometimes it happens but mostly not.

      It must simply be a part of the human condition that we construct ourselves as creatures capable of logical analysis and reason, but in reality we are not.

      • Joe Kilroy

        Dear Sean Lamb, Bellingcat have a lot of expertize and a top notch reputation. Despite your poetic, frankly heart-rending lamentation about the human condition, which moved me so much, a little bit of wee came out, I think I’ll go with Bellingcat, over you. No hard feelings. Me.

        • Sean Lamb

          Well quite, but that top notch reputation is itself politically determined. A result of reliably toeing the Security State line. It is really no different than the Volkish Beobachter or Pravda having a top notch reputation in their respective societies

          • Black Star

            Sorry, “Sean Lamb”, but simply telling that somebody must be wrong does not make them wrong. Try with facts, if you want to make a believable rebuttal.

      • Ray F.

        I’m certain that your philosophical claptrap warms the hearts of the thieves and murderers who committed this crime. It must also bring deep consolation to the surviving family members of those who were murdered. After examining all the evidence, it takes an act of deliberate blindness to avoid pinning responsibility on those Russians who were/are supporting the separatist criminals in Eastern Ukraine. Shame on you!

      • CFL68

        We are capable of logical analysis and reason. There are facts related to this issue. More and more are being identified and compiled. There was a plane identified as mh17. It was destroyed by a buk over rebel held territory. The rebels took responsibility by reporting it to their Russian news outlets, as well as through social media. There are audio intercepts. Some of the people involved have been positively identified. There is photo and video evidence of the buk in rebel territory. Of course there are other layers of facts about how people and countries have responded, and what their motivations are. Some to selfishly promote the search for truth, others to selfishly hide the truth. Russian generals gave a press conference claiming that falling bodies and debris were actually a stealth hovering Ukrainian su25 ‘because they did not give off the proper transponder signal.’ Russian agents put out different stories about machine gun shoot downs, planes full of dead bodies, or Putin’s plane being targeted, etc. You can believe this debunked nonsense at face value, or simply recognize that the only fact this garbage represents is the fact that Russia is lying. “Russia is lying” in itself is another important fact.

        No doubt people will be in denial of the facts – but that does not mean facts do not exist.

    • zoliballa

      The Bellingcat report has seemed to me also logical until I did not read the “Фальсификация” report. The phraseology and style of the latter are unacceptable in discussion of scientific-technical problems. However, it is possible to focus on the presented facts and considerations. I did so and revealed that some of the “facts” in the Bellingcat report are not convincing. That is why I recommend you to read the “Фальсификация” report (of course, quietly, with no rebel against the text). The absence of an “equally logic report” does not mean that the Bellingcat report is true in all its detail. I completely agree with you: “What counts, is the TRUTH”. But the truth is independent of the existence or absence of a “logic report”.

      • oui oui

        ” The absence of an “equally logic report” does not mean that the Bellingcat report is true”
        sure , and does not mean that it is false , add that it can be true with and without that and you are a logical champion . selling an “equally” logic something that you had not to write to say Bellingcat false , as it can’t
        you used some time at saying nothing , again

        “But the truth is independent of the existence or absence of a “logic report”.”
        yes , it’s smart to say that after your logical something
        a missile can be fired with or without a camera to record it
        many words one after the other can build a sentence , but , when there is no meaning from this sentence , what is the motivation

        Exposure to propaganda corrupts you even if you don’t believe those lies.

        you will slowly change your mind and accept the fact at reading again and again that you are an idiot

      • Black Star

        “of course, quietly, with no rebel against the text”

        Russian translated into English sounds funny.

        “But the truth is independent of the existence or absence of a “logic report””
        And here I thought a “logic report” (I am not an expert in Russian clumsily translated into English, but I guess it means “article based on logical thinking”) is an excellent source of information, especially then logic is supported with facts, like in this article.

  2. Destiny of Russia

    Thank you Bellingcat . It is reassuring to know that there are honest and intelligent people in this world and that not everyone is a criminal like Putin or mentally deranged like Sean Lamb….

  3. Nick F

    Fantastic report. Hopefully it will help the relatives of those murdered by Putin get justice one day.

  4. muchandr

    Bellingcat keeps digging in the direction that is simply not there. Lets suppose for a second there was evidence that specifically #332 did it (there isn’t really) There are some ad hoc dashboard videos showing there are #332s in Russia. That doesn’t even prove a specific connection to Kursk 53rd, not to speak of a transfer to Ukraine. Again and again, these numbers repeat with every regiment / brigade in both Russia and Ukraine.

    Is piling up additional detail showing how much you know about the 53rd supposed to obfuscate the fact that you had no reason to look for evidence in Russia instead of Ukraine to start with? The most likely candidate would be a Buk belonging to the 3rd (board numbers 3xx) battalion of Ukranian 156th Regiment. Here is a full catalogue of their vehicles.

    It is likely that their #332 was not operational, which also applies to all vehicles being towed. Otherwise they moved around under own power. The #3×2 is just wishful thinking as it is a lot closer to uniquely identifiable vehicle. With second digit being companie number, it could be #312, #322 or #323. All of those repeat many times over, with there being 72 of those vehicles in Ukraine and 440+ in Russia (source Wiki)

    Normal procedure is to move the vehicles covered by a tent and using rail instead of oversized loads on public roads, so you haven’t seen most of those being moved.

    Leontiev’s “Odnako” is by no means official Kremlin position. Its even subtitled “author’s programm” and is conspirologically themed. I’d like to see better explanation for the claim that plane is over a mile large. Personally, I thought it is an image in resolution not accessible to the public. Fooled me. It was supposedly sent in by a well-meaning American fan who turned out to be Mr. Anonymous. I presume the high resolution was what attracted somebodies attention. Consequently, the image was shown to various Russian forensic experts a lot of whom were non-committal or negative about its authenticity. Russia’s official position is that it needs to be included into investigation before it has one.

  5. Baloo2

    Putin’s Troll Factory in St. Petersburg have been busy. Nice try guys, but don’t leave your daytime job…

    • muchandr

      I presume it is a comment on me?

      I’ve seen Bellingcat’s final report. Underneath a huge pile of unnecessary detail, there a basic observable that we are dealing with two disjoint sets of evidence, as all the Buks sighted in Ukraine are filmed from one side and in Russia from another. The one possible exception is the Buk seen in Stariy Oskol later, but it is seen alone, no connection to no 53rd brigade.

      The various phone intercepts require that the “separatist Buk” spent only one day in Ukraine. This makes it impossible to visit all the waypoints in Donezk and Luhansk the vehicle was supposedly sighted at before or after the shot as they are several hours away drive from Snizhne via busy city streets as plotted by Google maps. In reality, the ability to drive a badly oversized vehicle around so easily is quite questionable of course. As the same time, Russian border is only 23 minutes drive in the opposite, southbound direction of Snizhne and the next closest source of Buks is Taganrog airbase, 1:44 drive in the same direction, straight South, unimpeded by having to drive through population centers. Were the drivers utterly lost and incapable of using a navigotor or a simple compass?

      Than there is a question of missiles that deserves to be revisited. The “separatist Buk” seen in Luhansk shows 3/4 missiles with white cones. The presumed 53rd convoy only stocks red- and khaki-colored cones. Which color corresponds to which type, what is a source of a missile the 53rd didn’t bring and where is the TEL that loaded it? Also, why this additional complication?

      The serial number indicating 1987 built year is borderline possible for 9K37M1 system missile as claimed by JIT’s 2016 investigation. 1987 is supposed to be the last production year for those. JIT’s 2018 investigation claims a 9K37 system missile from original Buk-1 system from the 70ties, which is no longer found in either Russia or Ukraine and probably cannot even be fired by all those Buk-M1 vehicles studies. Also contradicts their 2016 report.

      • Baloo2

        You can tell Mr. Putin that you get a B for effort but fail miserably on producing a shred of evidence to support your fantasies. As I said, don’t leave your daytime job.

        • muchandr

          You can verify my claims by clicking the link to the report provided by Mr. Higgins himself a few posts above this one as well as compare the missile cones as they appear in his other link. Not sure if you originally responded to me or to him, but your original message is just underneath the one I am talking about.

          You need to see the JIT 2016 and 2018 conference videos to see where they differ in their missile descriptions. Those you can find on youtube as well as I can.

          So far, I only used other people’s well known evidence that is commonly used to implicate Russia for the purposes of this argument. Which ones do you find unsuitable?

          I am retired.

          • Baloo2

            Does “I am retired” mean that you no longer work for the Troll Factory? If so, surely you can let go of the side bar and join the rest of us on the field?

            How else do you e.g. explain the obvious lies of the 21 July MoD press conference? Lies that the Russian MoD even themselves later admitted were lies.

          • muchandr

            Retired means I don’t work anywhere. What sidebar, what field? Sorry, I don’t follow you.

            From this particular post, I see the MoD posted flight radar data, probably coming from Russia’s own radar? I didn’t really look at it, but I can reasonably expect it to deviate from the flight data supposedly recovered from the black box. That data has been doctored, because it deviates from this


            which has been posted based on realtime radar the very same day MH17 fell. I consider this an unassailable credential, as it preempts the black box flight data by several months and there was nothing to prove yet and no sides to pick.

  6. Baloo2

    My side bar comment was hockey talk. I thought that every true Russian was into hockey, but I guess that the Troll Factory has problems recruting true Russians nowadays?

    And no, I wasn’t referring to the fake radar images, as those were later abandoned by the Russian MoD (without of course admitting that they were fake).

    I was thinking about the billboard that the MoD claimed was from Krasnoarmeisk — and they even “found” a local address and phone number on the billboard. Total fake!

    Just days later several international as well as local sources could find the billboard in question, and confirmed that it was actually located in Luhansk. And there was absolutely no address or phone number to any local dealership on any of those billboards posted all around the neighborhood.

    Give it up mate, you’ve been had!

    • muchandr

      Sorry, not into team sports. I am a Jewish-Lapp hybrid kind of Russian.

      So, which radar images are the correct ones, given that they are not all same?

      Your billboard argument is a non-sequitur. It is quite likely that great many similar billboards at local intersections carried the same ad for a car leadership. That does not prove or disprove anything. It has been said already that the specific ad posted is not a reliable identifier of anything, because the billboard operator changes them frequently.

      That Luhansk intersection is still a cause of concern, to which effect I tweeted extensively. If you study the intersection, you can see that it is completely symmetrical on both sides of the road, both sides with an identical billboard and the later Bellingcat report has been doctored for max plausible deniability when compared even with early version of the same. Higgins himself ignored my requests to give me a single word response whether it is the on-ramp or the off-ramp side.

      See for yourself. The coordinate provided by Ukranian informers is ever so slightly too late for the off-ramp yet too yearly for on-ramp, which is only possible if the transporter was already driving on the main road/freeway. This is paradoxical. The streets leading to two ramps also have different names. One is ul. Stepana Razina, another ul. Chernomorskaya, yet nowhere is the report is either mentioned anymore.

      The likely explanation that either direction on that intersection is really a tremendously poor way to get to Russia that takes way too long given the tight timing that it all happened on the same date MH17 was shot down. No matter which border crossing in N or NE direction you pick, there is a shorter route on the map. The intersection is simply way too far into Luhansk and past its center core, such that all the faster routes from out of town to elsewhere further out tend to take a bow around the busiest city streets and turn earlier, before going too far into the city center. And that’s generic Google maps for a car, not severely oversized load towed, which may not even fit everywhere plotted.

      Moreover, the by far the most logical route to Russia from Snizne is only 23 minites into strictly S-Bound direction, opposite direction of Luhansk. Saving you some 4 hours at least. 1:44 drive same S-direction gets you to Taganrog airbase, the most logical place to borrow a Buk from. The idiotic trek from Kursk around all of Ukraine was entirely unnecessary, because there is a direct railroad link from Kursk to the very town of Torez where the “separatist Buk” was sighted first. That railroad station has been caught on camera because that is where the MH17 bodies were loaded onto refrigerator train. Of course, it too is much closer to southern Russia than to Kursk up North.

      The last obvious problem nobody seems to be interested in are the white nosecones on Luhansk Buk. The “Kursk 53rd” TELs are seen carrying red- and khaki-colored nosecones, but no whites. Where and why are were they supposed to get additional missiles? The recovered Buk nosecone the JIT has been showing is colored like a galvanized zinc bucket. I don’t know what to make of the fact it survived the blast fairly intact. It may have been colored white or khaki before it was blasted, but certainly not bright red like most of 53rd’s missiles as sighted. There would be at least some areas remaining where remaining bright red paint would be visible. Incidentally, has been that way for some blown up Buk missiles found in Syria.

  7. dating

    On July 17, Bellingcat s team of investigative journalists has released report summarizing all major open source evidence surrounding the downing of MH17 in an easy-to-read 73-page survey.


Leave a Reply

  • (will not be published)

You can support the work of Bellingcat by donating through the following link: