the home of online investigations

Examining the MH17 Launch Smoke Photographs

January 27, 2015

By Daniel Romein

Just three hours after the crash of Malaysian Airlines Flight 17 (MH17), a picture was published on Twitter that appeared to show a ropeway on the horizon between “Lutugina” and “Tsof” in the area of Torez, which is close to Snizhne. The timestamp of the tweet suggests it was sent at 9:23 AM on 17 July 2014. Considering the fact that the plane crashed around 16:20 local time (EEST, or Eastern European Summer Time), this timestamp is remarkable, because it would suggest that the tweet was sent seven hours before the crash. The default setting of Twitter, which is headquartered in San Francisco, displays timestamps in Pacific Time. (More precisely, Pacific Time in the US is Pacific Daylight Time [PDT] between late winter and mid-fall and Pacific Standard Time [PST] between mid-fall and late winter.)

Converting the time from PDT to EEST shows that the image was posted at 19:23 EEST, three hours after the crash of MH17. [note: since Twitter usually displays tweets in relative time and there is one hour time difference between summer and winter time, it might be expected that a tweet posted in the summer would display a different time in winter, but that is not the case, since older messages are displayed in absolute time. The mistake in this article about the time stamp has been corrected.]

1

Various individuals online have asserted that the picture was a fabrication of the Ukrainian Security Service (SBU). This is unlikely for the following reasons: The photograph was posted only three hours after the MH17 crash, the general location of the white smoke trail is in the same area where the Buk was seen heading toward when last seen in Snizhne, and the weather matches that of July 17 as demonstrated in subsequent photographs that were released. Additionally, the SBU did not share this photograph until two days later, while, in contrast, the 18 July 2014 Luhansk video was released very quickly by the SBU itself. The photograph did not appear on any official Ukrainian channels before it was posted on Twitter, and the earliest posting of the photograph by a Ukrainian official was by Ministry of Internal Affairs official Anton Gerashchenko on Facebook at 7:45 PM (local time).

On 21 July 2014, the blogger Ukraine@War geolocated the photograph. The Bellingcat investigation team has verified the geolocation, which indicates that the photograph was taken north of Torez in the direction of a mine in eastern Torez. This detail did not come as a surprise, as the 17 July Twitter post mentioned a ropeway between Lutugina and Tsof in Torez, close to Snizhne. Wikimapia reveals in the area of the mine both Lutugina (‘Шахта им Лутугина’, им stands for имени which means name, so a mine called Lutugina) as Tsof ‘(ЦОФ им. Киселёва’, ЦОФ being the abbreviation of ‘Центральная обогатительная фабрика’ which means enrichment plant, so an enrichment plant called Kiselev).

Wikimapia, showing Lutugina (red), the mine Ukraine@war noted (green), and Tsof (blue).

Wikimapia, showing Lutugina (red), the mine Ukraine@war noted (green), and Tsof (blue).

Ukraine@War’s work establishes that the houses visible in the foreground of the picture are in the east of Torez, close to the mine. He reaches this conclusion after asking a local resident to recreate the photograph of 17 July 2014, who took pictures from a hill in the direction of the mine. Ukraine@War was able to identify a number of matching features between the two photographs, including a particular pole between the houses and similar types of houses. The Bellingcat investigation team also identified houses under a hill on both photographs.

Below is the photograph recreated by a local for the Ukraine@War blog with these particular features marked:

The picture recreated by a resident from the area east of Torez several days after 17 July 2014 with a red arrow pointing to the long light pole (added by Ukraine@war) and houses marked in a red circle (added by Bellingcat)

The picture recreated by a resident from the area east of Torez several days after 17 July 2014 with a red arrow pointing to the long light pole (added by Ukraine@war) and houses marked in a red circle (added by Bellingcat)

Comparing this recreated image with the 17 July 2014 photograph, the features seem to match:

The 17 July 2014 photograph with the same houses marked by a red circle.

The 17 July 2014 photograph with the same houses marked by a red circle.

A photograph from Panoramio, taken from a hill next to these houses, further illustrates the scene. The description of the picture (“вид на пос. Крупский,” or, “view of the village Krupskiy”) points to a street called вулиця Крупської (Krupskoi street), where a long light pole can be seen (marked with a red circle) along with other recognizable landmarks, such as two wooden electricity poles:

Panoramio picture taken from a hill toward the east of Torez.

Panoramio picture taken from a hill toward the east of Torez.

This Panoramio photograph was taken in 2009, making Google satellite imagery from 2010 more useful to show landmarks that are not as visible in more recent satellite imagery. In this satellite image, the wooden electricity poles are visible (orange circles), which are not visible on recent images, likely because they have been removed. The rectangular shape of ground is visible (pink rectangle), the two houses in the front match (blue and green circles), and the long light pole can be seen with a big building behind it (red circle):

2010 Google Earth satellite image showing the area near a hill in the east of Torez with the long light pole (red circle), two similar houses (blue and green circles), two wooden electricity poles (orange circles), and a rectangular piece of ground (pink rectangle).

2010 Google Earth satellite image showing the area near a hill in the east of Torez with the long light pole (red circle), two similar houses (blue and green circles), two wooden electricity poles (orange circles), and a rectangular piece of ground (pink rectangle).

When comparing this image with the 17 July 2014 picture, there are not many obvious matches apart from the long light pole. However, after taking a much closer look at another recreated image, some similarities become apparent, as seen in this cropped image:

A part of another recreated photograph taken by a local and published by Ukraine@war showing the hill the Panoramio picture was taken from as well as the houses marked by a blue and green circle. The wooden electricity poles aren’t in the picture here because they have likely been removed.

A part of another recreated photograph taken by a local and published by Ukraine@war showing the hill the Panoramio picture was taken from as well as the houses marked by a blue and green circle. The wooden electricity poles aren’t in the picture here because they have likely been removed.

It’s clear that the photograph of 17 July 2014 and the recreated image taken by the local show nearly the same location: an area in eastern Torez, east of a hill, and close to a mine on the edge of Torez, near Snizhne, and photographed in the direction of that mine and Snizhne.

Further examination of the photograph when compared with the Google satellite imagery reveals additional matches, especially when the view in Google Earth is turned in the same direction.

The blue lines in the images below are the frame of the 17 July 2014 picture, the brown lines show the direction where a small trail of grey smoke is seen, the red lines show the direction where the white smoke trail can be seen, and matching landmarks are in circles with various colours:

First image with matches between the 17 July 2014 picture and the Google Earth satellite image.

First image with matches between the 17 July 2014 picture and the Google Earth satellite image.

Second image with matches between the 17 July 2014 picture and the Google Earth satellite image.

Second image with matches between the 17 July 2014 picture and the Google Earth satellite image.

Third image with matches between the 17 July 2014 picture and the Google Earth satellite image.

Third image with matches between the 17 July 2014 picture and the Google Earth satellite image.

Fourth image with matches between the 17 July 2014 picture and the Google Earth satellite image, which show correspondence between the picture and the trees near the mine at the eastern edge of Torez.

Fourth image with matches between the 17 July 2014 picture and the Google Earth satellite image, which show correspondence between the picture and the trees near the mine at the eastern edge of Torez.

Dutch news outlet RTL Nieuws conducted an interview with the anonymous photographer of the white smoke trail in December 2014. Along with the interview, RTL Nieuws acquired additional photographs taken right after the original photograph in the same location. Two research organizations, FOX-IT and NIDF, verified the authenticity of the photographs, while two other organizations, NEO and TuDelft (the Technical University in Delft), examined the white smoke trail and geolocated the photographs. The anonymous photographer has given the original photographs, including the memory card holding them, to the official Dutch investigation of the downing of MH17.

Second picture taken on 17 July 2014, north of Torez.

Second picture taken on 17 July 2014, north of Torez.

With this second photograph, it becomes even clearer that the scene is the same as that of another Panoramio picture, where the same hill is visible:

Panoramio picture of the hill east of Torez.

Panoramio picture of the hill east of Torez.

It’s also worth investigating where the photograph was taken. Many have concluded that the picture must have been taken from a tall building in northern Torez, since a field is visible behind the houses in eastern Torez, and fork-shaped poles near the mine are visible in the distance, which could not be seen from a hill where the local photographed the same area. The Bellingcat investigation team verified this conclusion, and we judge that the assessment that the photograph was taken from a tall building in northern Torez is correct.

Approximate location the picture was taken from (red circle), the view frame of the picture (pink lines), the hill visible in the second picture (orange), the eastern part of Torez (green), and the mine with the poles visible on the 17 July 2014 picture (blue) .

Approximate location the picture was taken from (red circle), the view frame of the picture (pink lines), the hill visible in the second picture (orange), the eastern part of Torez (green), and the mine with the poles visible on the 17 July 2014 picture (blue) .

Considering the previous geolocation evidence, there can be no doubt that the photographs that claim to show the Buk launch site from 17 July 2014 were taken from northern Torez and show the area of eastern Torez near the Lutugina mine in the direction south of Snizhne.

The White Smoke Trail

There are many claims that what we actually see on the picture, the white smoke trail, is not a smoke trail of a rocket that just has been launched, but just a contrail of an airplane that has been spread out by wind. Various images of contrails or vapour trails show what they look like:

Contrails or vapor trails of airplanes, arranged from fresh to dispersed.

Contrails or vapor trails of airplanes, arranged from fresh to dispersed.

When we look closely at the white smoke trail of the 17 July 2014 pictures, it’s clear that it doesn’t resemble the contrails of airplanes. Plane contrails are quite straight, and even after being dispersed almost entirely, the shape of the contrail stays straighter than the white smoke trail we see in the 17 July 2014 pictures.

We have also compared the 17 July 2014 white smoke trail with several pictures and movies of Buk M1 missile smoke trails. When we compare the white smoke trail of the pictures of 17 July 2014, there is much more similarity with the images of the Buk M1 missile smoke trail than with the contrails of airplanes, the main difference being that the white smoke is more dissipated and dispersed by the wind in the 17 July 2014 pictures. Even the cloud of grey smoke characteristic of the first stage of a Buk missile launch (shown on the following images) can be seen in the 17 July 2014 pictures.

White smoke trails (and grey clouds near the ground) after a Buk M1 missile launch; images and screenshots from videos found on a Russian website and YouTube.

White smoke trails (and grey clouds near the ground) after a Buk M1 missile launch; images and screenshots from videos found on a Russian website and YouTube.

Other type of rockets like Grads or Tornados don’t leave a long white smoke trail in the air, as they are intended for ground targets at distances of 20 to 35 kilometres and cannot be used for air targets.

So, it is very possible that the white smoke trail (and the smaller grey smoke trail) we see in the 17 July 2014 pictures was caused by the launch of a surface-to-air missile, like the Buk.

Authenticity of photographs

There have been many claims that the 17 July 2014 pictures are not genuine, manipulated, or were taken at a different date.

As part of this investigation, Bellingcat contacted the photographer who took the smoke trail images, and provided the images in a RAW image format. To protect the privacy and safety of the photographer, we have decided not to publish anything about the exact file type of the pictures or any other metadata, as it would reveal the type of camera the photographer used. What we will publish is that the second published picture was taken first at 16:25:41 EEST, and the first published picture was taken 7 seconds later at 16:25:48 EEST. According to the photographer, the first picture was taken about 30 seconds after the explosion. Because we know that flight MH17 was hit around 16:20 EEST, the camera’s time stamp was approximately 4 minutes to 4 minutes and 30 seconds ahead of the real time. The metadata (or Exif data) of the original files show that all date and time properties like camera date, digitized date, modified date, and file date show a date of 17 July 2014 and times of 16:25:41 and 16:25:48.

Images in a RAW format can be edited in photo editing software and saved as a different format, like BMP, JPG, PNG, TIFF, etc., but this will always result in a different file date, namely, the date and time the file has been saved after editing. Photo editing software is not able to save files in a RAW format, because this is not a “positive” image format. In addition, because pictures can only be edited by photo editing software, changes to the pictures will always result in modified metadata.

While software capable of saving images in RAW format does exist, it is usually the software of the camera itself and cannot edit images because images in a RAW format first have to be converted to an editable image format (e.g. BMP, JPG, PNG, TIFF). Also, when the file in RAW format is saved, the modified date of the metadata will be changed.

Based on the metadata of the RAW files we received, we can be completely certain that these files are the original files and that the pictures were taken on 17 July 2014 at 16:25:41 EEST and 16:25:48 EEST, according to the date and time set in the camera. Though it is possible to set the camera itself to a different date and time, when we take into account that the first picture was released two hours after the crash, the only scenario where what we see on the pictures is not the launch of the Buk missile that was seen above eastern Torez on 17 July 2014 is that the photographer took a picture of a missile launch on a previous date, and his camera date and time was inadvertently set to 17 July 2014 at 16:25 EEST. The probability of this being the case, of course, is close to zero.

Despite the ostensible authenticity of the images, our team sought to verify whether the second picture really was made seven seconds after the first and to show that the first published picture is not just an edited version of the second one. One image appears to be a zoomed in version of the second, so we overlaid the zoomed image on top of the unzoomed image.

18

As seen above, this was a perfect match, with the camera in the unzoomed image auto-focusing on the cables laid over the image in which the camera causes the background to be out of focus. Because the cables were close to the camera position, the zoomed image no longer shows the cables.

19

The Bellingcat investigation team noted that the small grey smoke trail is probably connected to the white smoke trail. Some assessed that it could have been the smoke from a burned field caused by the launch, though we believe this is not likely so soon after the launch. Another view, which turned out to be correct, was that the grey smoke was caused by the first stage of the missile launch. The following enhanced image shows the smoke more clearly:

17

We then investigated why the smoke trail appeared to take such a sharp turn:

20

We assess, based on the direction of the wind only a few hours earlier, that varying wind speeds at different altitudes caused this sharp turn. In an earlier video showing the Buk linked to the downing of MH17 travelling south out of Snizhne, it’s possible to make out smoke from artillery fire. Based on the movement of that smoke we can see the wind was blowing from the east:

21

The following image shows the smoke in the launch photographs as it is blown west after the launch:

22

This is congruent with local weather conditions in Snizhe on July 17th, which show that the wind was blowing from east/east-northeast around the time of launch.

Based on the visual information from the pictures and metadata of the original versions of the pictures, it is clear that the white smoke trail has moved because of the wind coming from the east, and it is our conclusion that the pictures are authentic and not fabricated or manipulated.

Uncompressed versions of both photographs are available here.

The weather

The second picture leaves no question regarding the weather on 17 July 2014. In the first picture, an almost completely blue sky is visible, and houses in eastern Torez seem to be in full sunlight, while on every video that has been published about the crash of Flight MH17 the sky is cloudy. The distance between the crash site and this area in Torez is about 15km, and the distance between the area the photograph zooms into and the crash site is about 20km, so it is possible that the weather at the crash site may have been different from the weather where the picture of the white smoke trail was taken (and/or the location from which the Buk M1 missile was fired). There was a lively discussion about the weather in eastern Ukraine on 17 July 2014, but a definitive conclusion is difficult to reach.

A satellite image from the site Sat24.com shows that the weather in the eastern Ukraine wasn’t the same everywhere around the time Flight MH17 crashed. Sat24.com displays the time in CET (Central European Time) and UTC (Coordinated Universal Time, or GMT [Greenwich Mean Time]). In the summer CET was UTC+2 (actually called CEST, Central European Summer Time). In Ukraine, which has EET (East European Time) and, in the summer, EEST (East European Summer Time), the time was UTC+3. To establish the cloud coverage around 4:20 PM (i.e., the time of the crash of Flight MH17 in EEST), the map time needs to be set to 15:20 CET/13:20 UTC. Unfortunately, only historical maps of an exact hour are available (e.g., the maps of 15:15 and 15:30 no longer can be retrieved), but the map of 15:00 CET/13:00 UTC offers the required information:

23

Zooming in on Ukraine makes clear that the weather in eastern Ukraine at 16:00 on 17 July 2014 EEST was not the same everywhere, as Torez is at the edge of a cloudy and sunny area:

24

What these images demonstrate is that Torez would have been on the edge of a cloudy region, so there’s no reason to expect thick cloud in the area. In fact, an earlier photograph taken of the Buk missile launcher inside Torez around midday on 17 July shows a fairly clear sky, which is consistent with the fluctuating weather in the area at the time.

After acquiring the original copies of the smoke pictures from the photographer it became apparent that the shutter speed differed between the two photographs, and the photographs that had been previously published had colour and brightness adjusted to make the smoke trails more visible, which also affected the visibility of clouds in the those images. Based on the original images, it is clear that the weather visible in the pictures matches the local weather conditions at the time.

More information about how this location relates to other claims and evidence about the launch location of the missile that downed MH17 can be found here.

 

 

Daniel Romein

Daniel Romein is an IT-specialist and open source investigator focused on the MH17 case and the conflict in Ukraine.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

121 Comments

  1. Mrs. V.

    Bellingcat, since you haven’t noticed my last question, I’ll ask it once again:
    did Aleynikov zoom in, when he took the photo with the two wires?

    Reply
    • Mrs. V.

      Thank you.
      I know the properties of the first picture — 1/1600 sec at f/8.0, ISO 320; 55 mm (55.0 – 300.0 mm f/4.5 – 5.6), but I am not a photographer and they mean nothing to me. Are you sure that none of these properties indicates that the landscape was “brought” closer in some way, or maybe cropped?

      Reply
  2. d_le_nen

    I would wish more explanation and clarification as to how the cable in the vicinity can become practically unperceivable by zooming and focusing on the horizon.

    Reply
    • boggled

      d
      Have you ever looked at the horizon as you were walking and missed a tree right in front of you and ran into it?

      Same concept, as you focus on distance, things up close get blurred.
      Sometimes so blurry that immediate close by objects disappear in a long distance photo.
      When you focus in on one thing, other items loose focus.
      A photographer and an expensive camera can almost eliminate that with correct settings and do strange photo effects.
      You should try it with your own camera and see if you can duplicate it.
      For more clarification write an email to Pentax or one of the other camera companies.
      Or visit a local photographer and ask him while you have him do a few photos for Christmas this year.

      Fare thee well

      Reply
  3. d_le_nen

    I I measured the ratio between a horizontal and a vertical angle of the same object boundaries in the two pictures (smoke trail with wide angle and cables vs. smoke trail with zoom without cables) and found a small difference.
    Measuring a vertical angle measures the angle between a near and a far object. If the height of the camera slightly changed, this angle changed too. More specific, if the camera was in a lower position for the picture without the cables, the vertical angular distance between a near and a far object decreases, while the horizontal angular distance between two objects on the horizon line stays the same. So the ratio between vertical and horizontal angular distance should decrease – a small distortion is introduced.
    And that’s exactly what I found. It seems that the picture without the cables has been taken from a slightly lower position, just enough to get them off the picture.
    It would be valuable, if somebody else could repeat this analysis.

    Reply
    • boggled

      Really d, I do not think it is that complicated.
      It is possible the photographer moved slightly the camera any combination of left or right or lower.
      But as you can see in photos 3 and 7 above, with perspective from the camera and the zooming the wires ‘fade’ out.
      Get a pair of binoculars or telescope, to prove it to yourself.
      Set it on a tripod or table or clamp them down in place, how ever you want to do it.
      Focus in on an object through a tree 50 feet away or a quarter mile for a telescope.
      Then while not moving the binoculars (or camera but it is easier to notice with binoculars or telescope) use the quick adjust lever on binoculars or the focus adjustment on a telescope.
      Do this slowly and you will see the object, as well as the tree branches, you were focus on before, slowly disappear while you can see other items appear.
      They go in and out of focus.

      I know a little about Trig and Geometry, but not enough if I see where this conversation is leading.
      Your measurements are the simple ones.
      You have to also allow for the refracting image inside the camera on the other side of the lens and some other items.
      The distortion you mention can be seen in the wires in photographs of photos 3 and 7, as items lose focus, they blend in the background.

      It is not simply by moving a camera to a lower position that causes distortions in the image, it is caused by lens shape, distance to object, how much you zoom, how well it is focused when zoomed in, how much available light and a variety of other technical photography issues, but those are the big ones.
      Yes, if you move it lower, it is changing the angle to the wires.
      And if the camera is kept with the same settings, you get a different perspective on the image your looking at.
      The images above were zoomed in.
      That causes nearby object to fade out to varying degrees especially loose wires that are vibrating in a wind at the top of an apartment 10 stories up on a windy day and hanging loose like they are.
      Trying to it with Trig is not impossible, but you have to cover all the variables and know about distortions in images as well.
      Things that can be affected by lens shape, lens composition, a scratch in the lens, etc.
      You and I do not have those variables and it would drive you batty to go through it all.
      Let the people who get paid to do it, do it.
      Especially when there is a simpler way to conduct the experiment for yourself.
      If you do not have telescope, camera, or binoculars or friend that does.
      Instead of buying brand new, run your experiment in a department store that sells them.
      or a cheaper way then buying new, would be to look at Goodwill or Salvation Army stores or a hobby store.
      Many hobby stores have older equipment in good shape for sale.
      Another place would be various Flea Markets or Antique stores.
      Or like I said above, go to a photography store above and have them explain how a close up feature in an image gets distorted or fades out as you zoom in on a far away object.
      Really, there are a lot of variables in image distortion measurements, and your just beginning to scratch the surface with what you have done so far.

      Fare thee well

      Reply
  4. Dog

    Why does the smoke trail go vertically up? Shouldn’t it be angled to the ground if it went towards the plane at some disrance from the launch site? All photos of the real buk launches show roughly 45 degree angles.

    Reply
  5. Deus Abscondis

    Basic trigonometry (cosine rule) results in the plume being in the order of 100m wide to subtend an angle of 1° from the point of the camera and the 12km or so from which the photo is taken.

    No rocket exhaust in photo’s shown of BUKs is a 100m wide.

    Should a BUK exhaust persist long enough to disperse to 100m in width it would be so diffuse as to be indistinguishable from the clouds in the background. To verify/refute show a photo or video of BUK launch shot at a distance of 12km against a cloudy sky. You can’t because there would be nothing to see comparable with the photo in question. Show a photo of a BUK launch against a blue sky at 12km, if you can find one, the subtended angle would be much less than 1°

    Therefore this plume is not a BUK exhaust.

    Further, all examples shown of BUK missile launches show the angle of trajectory around 45°. This would result in the exhaust trail being wider at the top as it came closer to the camera.

    If this analysis is correct, and you can’t refute it, you are obliged to modify the analysis in the article to include that it is not a plume from a BUK. Anything less would be fraudulent, Agreed?

    Any acceptable analysis needs to exclude alternative explainations, through evidence, such as the mine and associated equipment being a source of smoke or burning off fields.

    @Deus_Abscondis

    Reply
  6. Marcel

    I have a couple of issues with the two photos of the smoke plume.
    I hope Bellingcat is willing to discuss these issue here in the comments.
    The first issue is determining the windspeed and roughly time of the impact of the main fuselage.

    Did Bellingcat receive the exact time in hours, minutes and seconds of the serie of photos Pavel Aleynikov made showing the black smoke plume originating from the main crash site?

    Of not, is Bellingcat willing to ask Pavel Aleynikov about the exact times?
    The times are extremey important in calculating if the photos are genuine.
    I cannot think of any argument to not made these times public.

    Reply

Leave a Reply

  • (will not be published)