the home of online investigations

You can support the work of Bellingcat by donating through the following link:

Examining the MH17 Launch Smoke Photographs

January 27, 2015

By Daniel Romein

Just three hours after the crash of Malaysian Airlines Flight 17 (MH17), a picture was published on Twitter that appeared to show a ropeway on the horizon between “Lutugina” and “Tsof” in the area of Torez, which is close to Snizhne. The timestamp of the tweet suggests it was sent at 9:23 AM on 17 July 2014. Considering the fact that the plane crashed around 16:20 local time (EEST, or Eastern European Summer Time), this timestamp is remarkable, because it would suggest that the tweet was sent seven hours before the crash. The default setting of Twitter, which is headquartered in San Francisco, displays timestamps in Pacific Time. (More precisely, Pacific Time in the US is Pacific Daylight Time [PDT] between late winter and mid-fall and Pacific Standard Time [PST] between mid-fall and late winter.)

Converting the time from PDT to EEST shows that the image was posted at 19:23 EEST, three hours after the crash of MH17. [note: since Twitter usually displays tweets in relative time and there is one hour time difference between summer and winter time, it might be expected that a tweet posted in the summer would display a different time in winter, but that is not the case, since older messages are displayed in absolute time. The mistake in this article about the time stamp has been corrected.]

1

Various individuals online have asserted that the picture was a fabrication of the Ukrainian Security Service (SBU). This is unlikely for the following reasons: The photograph was posted only three hours after the MH17 crash, the general location of the white smoke trail is in the same area where the Buk was seen heading toward when last seen in Snizhne, and the weather matches that of July 17 as demonstrated in subsequent photographs that were released. Additionally, the SBU did not share this photograph until two days later, while, in contrast, the 18 July 2014 Luhansk video was released very quickly by the SBU itself. The photograph did not appear on any official Ukrainian channels before it was posted on Twitter, and the earliest posting of the photograph by a Ukrainian official was by Ministry of Internal Affairs official Anton Gerashchenko on Facebook at 7:45 PM (local time).

On 21 July 2014, the blogger Ukraine@War geolocated the photograph. The Bellingcat investigation team has verified the geolocation, which indicates that the photograph was taken north of Torez in the direction of a mine in eastern Torez. This detail did not come as a surprise, as the 17 July Twitter post mentioned a ropeway between Lutugina and Tsof in Torez, close to Snizhne. Wikimapia reveals in the area of the mine both Lutugina (‘Шахта им Лутугина’, им stands for имени which means name, so a mine called Lutugina) as Tsof ‘(ЦОФ им. Киселёва’, ЦОФ being the abbreviation of ‘Центральная обогатительная фабрика’ which means enrichment plant, so an enrichment plant called Kiselev).

Wikimapia, showing Lutugina (red), the mine Ukraine@war noted (green), and Tsof (blue).

Wikimapia, showing Lutugina (red), the mine Ukraine@war noted (green), and Tsof (blue).

Ukraine@War’s work establishes that the houses visible in the foreground of the picture are in the east of Torez, close to the mine. He reaches this conclusion after asking a local resident to recreate the photograph of 17 July 2014, who took pictures from a hill in the direction of the mine. Ukraine@War was able to identify a number of matching features between the two photographs, including a particular pole between the houses and similar types of houses. The Bellingcat investigation team also identified houses under a hill on both photographs.

Below is the photograph recreated by a local for the Ukraine@War blog with these particular features marked:

The picture recreated by a resident from the area east of Torez several days after 17 July 2014 with a red arrow pointing to the long light pole (added by Ukraine@war) and houses marked in a red circle (added by Bellingcat)

The picture recreated by a resident from the area east of Torez several days after 17 July 2014 with a red arrow pointing to the long light pole (added by Ukraine@war) and houses marked in a red circle (added by Bellingcat)

Comparing this recreated image with the 17 July 2014 photograph, the features seem to match:

The 17 July 2014 photograph with the same houses marked by a red circle.

The 17 July 2014 photograph with the same houses marked by a red circle.

A photograph from Panoramio, taken from a hill next to these houses, further illustrates the scene. The description of the picture (“вид на пос. Крупский,” or, “view of the village Krupskiy”) points to a street called вулиця Крупської (Krupskoi street), where a long light pole can be seen (marked with a red circle) along with other recognizable landmarks, such as two wooden electricity poles:

Panoramio picture taken from a hill toward the east of Torez.

Panoramio picture taken from a hill toward the east of Torez.

This Panoramio photograph was taken in 2009, making Google satellite imagery from 2010 more useful to show landmarks that are not as visible in more recent satellite imagery. In this satellite image, the wooden electricity poles are visible (orange circles), which are not visible on recent images, likely because they have been removed. The rectangular shape of ground is visible (pink rectangle), the two houses in the front match (blue and green circles), and the long light pole can be seen with a big building behind it (red circle):

2010 Google Earth satellite image showing the area near a hill in the east of Torez with the long light pole (red circle), two similar houses (blue and green circles), two wooden electricity poles (orange circles), and a rectangular piece of ground (pink rectangle).

2010 Google Earth satellite image showing the area near a hill in the east of Torez with the long light pole (red circle), two similar houses (blue and green circles), two wooden electricity poles (orange circles), and a rectangular piece of ground (pink rectangle).

When comparing this image with the 17 July 2014 picture, there are not many obvious matches apart from the long light pole. However, after taking a much closer look at another recreated image, some similarities become apparent, as seen in this cropped image:

A part of another recreated photograph taken by a local and published by Ukraine@war showing the hill the Panoramio picture was taken from as well as the houses marked by a blue and green circle. The wooden electricity poles aren’t in the picture here because they have likely been removed.

A part of another recreated photograph taken by a local and published by Ukraine@war showing the hill the Panoramio picture was taken from as well as the houses marked by a blue and green circle. The wooden electricity poles aren’t in the picture here because they have likely been removed.

It’s clear that the photograph of 17 July 2014 and the recreated image taken by the local show nearly the same location: an area in eastern Torez, east of a hill, and close to a mine on the edge of Torez, near Snizhne, and photographed in the direction of that mine and Snizhne.

Further examination of the photograph when compared with the Google satellite imagery reveals additional matches, especially when the view in Google Earth is turned in the same direction.

The blue lines in the images below are the frame of the 17 July 2014 picture, the brown lines show the direction where a small trail of grey smoke is seen, the red lines show the direction where the white smoke trail can be seen, and matching landmarks are in circles with various colours:

First image with matches between the 17 July 2014 picture and the Google Earth satellite image.

First image with matches between the 17 July 2014 picture and the Google Earth satellite image.

Second image with matches between the 17 July 2014 picture and the Google Earth satellite image.

Second image with matches between the 17 July 2014 picture and the Google Earth satellite image.

Third image with matches between the 17 July 2014 picture and the Google Earth satellite image.

Third image with matches between the 17 July 2014 picture and the Google Earth satellite image.

Fourth image with matches between the 17 July 2014 picture and the Google Earth satellite image, which show correspondence between the picture and the trees near the mine at the eastern edge of Torez.

Fourth image with matches between the 17 July 2014 picture and the Google Earth satellite image, which show correspondence between the picture and the trees near the mine at the eastern edge of Torez.

Dutch news outlet RTL Nieuws conducted an interview with the anonymous photographer of the white smoke trail in December 2014. Along with the interview, RTL Nieuws acquired additional photographs taken right after the original photograph in the same location. Two research organizations, FOX-IT and NIDF, verified the authenticity of the photographs, while two other organizations, NEO and TuDelft (the Technical University in Delft), examined the white smoke trail and geolocated the photographs. The anonymous photographer has given the original photographs, including the memory card holding them, to the official Dutch investigation of the downing of MH17.

Second picture taken on 17 July 2014, north of Torez.

Second picture taken on 17 July 2014, north of Torez.

With this second photograph, it becomes even clearer that the scene is the same as that of another Panoramio picture, where the same hill is visible:

Panoramio picture of the hill east of Torez.

Panoramio picture of the hill east of Torez.

It’s also worth investigating where the photograph was taken. Many have concluded that the picture must have been taken from a tall building in northern Torez, since a field is visible behind the houses in eastern Torez, and fork-shaped poles near the mine are visible in the distance, which could not be seen from a hill where the local photographed the same area. The Bellingcat investigation team verified this conclusion, and we judge that the assessment that the photograph was taken from a tall building in northern Torez is correct.

Approximate location the picture was taken from (red circle), the view frame of the picture (pink lines), the hill visible in the second picture (orange), the eastern part of Torez (green), and the mine with the poles visible on the 17 July 2014 picture (blue) .

Approximate location the picture was taken from (red circle), the view frame of the picture (pink lines), the hill visible in the second picture (orange), the eastern part of Torez (green), and the mine with the poles visible on the 17 July 2014 picture (blue) .

Considering the previous geolocation evidence, there can be no doubt that the photographs that claim to show the Buk launch site from 17 July 2014 were taken from northern Torez and show the area of eastern Torez near the Lutugina mine in the direction south of Snizhne.

The White Smoke Trail

There are many claims that what we actually see on the picture, the white smoke trail, is not a smoke trail of a rocket that just has been launched, but just a contrail of an airplane that has been spread out by wind. Various images of contrails or vapour trails show what they look like:

Contrails or vapor trails of airplanes, arranged from fresh to dispersed.

Contrails or vapor trails of airplanes, arranged from fresh to dispersed.

When we look closely at the white smoke trail of the 17 July 2014 pictures, it’s clear that it doesn’t resemble the contrails of airplanes. Plane contrails are quite straight, and even after being dispersed almost entirely, the shape of the contrail stays straighter than the white smoke trail we see in the 17 July 2014 pictures.

We have also compared the 17 July 2014 white smoke trail with several pictures and movies of Buk M1 missile smoke trails. When we compare the white smoke trail of the pictures of 17 July 2014, there is much more similarity with the images of the Buk M1 missile smoke trail than with the contrails of airplanes, the main difference being that the white smoke is more dissipated and dispersed by the wind in the 17 July 2014 pictures. Even the cloud of grey smoke characteristic of the first stage of a Buk missile launch (shown on the following images) can be seen in the 17 July 2014 pictures.

White smoke trails (and grey clouds near the ground) after a Buk M1 missile launch; images and screenshots from videos found on a Russian website and YouTube.

White smoke trails (and grey clouds near the ground) after a Buk M1 missile launch; images and screenshots from videos found on a Russian website and YouTube.

Other type of rockets like Grads or Tornados don’t leave a long white smoke trail in the air, as they are intended for ground targets at distances of 20 to 35 kilometres and cannot be used for air targets.

So, it is very possible that the white smoke trail (and the smaller grey smoke trail) we see in the 17 July 2014 pictures was caused by the launch of a surface-to-air missile, like the Buk.

Authenticity of photographs

There have been many claims that the 17 July 2014 pictures are not genuine, manipulated, or were taken at a different date.

As part of this investigation, Bellingcat contacted the photographer who took the smoke trail images, and provided the images in a RAW image format. To protect the privacy and safety of the photographer, we have decided not to publish anything about the exact file type of the pictures or any other metadata, as it would reveal the type of camera the photographer used. What we will publish is that the second published picture was taken first at 16:25:41 EEST, and the first published picture was taken 7 seconds later at 16:25:48 EEST. According to the photographer, the first picture was taken about 30 seconds after the explosion. Because we know that flight MH17 was hit around 16:20 EEST, the camera’s time stamp was approximately 4 minutes to 4 minutes and 30 seconds ahead of the real time. The metadata (or Exif data) of the original files show that all date and time properties like camera date, digitized date, modified date, and file date show a date of 17 July 2014 and times of 16:25:41 and 16:25:48.

Images in a RAW format can be edited in photo editing software and saved as a different format, like BMP, JPG, PNG, TIFF, etc., but this will always result in a different file date, namely, the date and time the file has been saved after editing. Photo editing software is not able to save files in a RAW format, because this is not a “positive” image format. In addition, because pictures can only be edited by photo editing software, changes to the pictures will always result in modified metadata.

While software capable of saving images in RAW format does exist, it is usually the software of the camera itself and cannot edit images because images in a RAW format first have to be converted to an editable image format (e.g. BMP, JPG, PNG, TIFF). Also, when the file in RAW format is saved, the modified date of the metadata will be changed.

Based on the metadata of the RAW files we received, we can be completely certain that these files are the original files and that the pictures were taken on 17 July 2014 at 16:25:41 EEST and 16:25:48 EEST, according to the date and time set in the camera. Though it is possible to set the camera itself to a different date and time, when we take into account that the first picture was released two hours after the crash, the only scenario where what we see on the pictures is not the launch of the Buk missile that was seen above eastern Torez on 17 July 2014 is that the photographer took a picture of a missile launch on a previous date, and his camera date and time was inadvertently set to 17 July 2014 at 16:25 EEST. The probability of this being the case, of course, is close to zero.

Despite the ostensible authenticity of the images, our team sought to verify whether the second picture really was made seven seconds after the first and to show that the first published picture is not just an edited version of the second one. One image appears to be a zoomed in version of the second, so we overlaid the zoomed image on top of the unzoomed image.

18

As seen above, this was a perfect match, with the camera in the unzoomed image auto-focusing on the cables laid over the image in which the camera causes the background to be out of focus. Because the cables were close to the camera position, the zoomed image no longer shows the cables.

19

The Bellingcat investigation team noted that the small grey smoke trail is probably connected to the white smoke trail. Some assessed that it could have been the smoke from a burned field caused by the launch, though we believe this is not likely so soon after the launch. Another view, which turned out to be correct, was that the grey smoke was caused by the first stage of the missile launch. The following enhanced image shows the smoke more clearly:

17

We then investigated why the smoke trail appeared to take such a sharp turn:

20

We assess, based on the direction of the wind only a few hours earlier, that varying wind speeds at different altitudes caused this sharp turn. In an earlier video showing the Buk linked to the downing of MH17 travelling south out of Snizhne, it’s possible to make out smoke from artillery fire. Based on the movement of that smoke we can see the wind was blowing from the east:

21

The following image shows the smoke in the launch photographs as it is blown west after the launch:

22

This is congruent with local weather conditions in Snizhe on July 17th, which show that the wind was blowing from east/east-northeast around the time of launch.

Based on the visual information from the pictures and metadata of the original versions of the pictures, it is clear that the white smoke trail has moved because of the wind coming from the east, and it is our conclusion that the pictures are authentic and not fabricated or manipulated.

Uncompressed versions of both photographs are available here.

The weather

The second picture leaves no question regarding the weather on 17 July 2014. In the first picture, an almost completely blue sky is visible, and houses in eastern Torez seem to be in full sunlight, while on every video that has been published about the crash of Flight MH17 the sky is cloudy. The distance between the crash site and this area in Torez is about 15km, and the distance between the area the photograph zooms into and the crash site is about 20km, so it is possible that the weather at the crash site may have been different from the weather where the picture of the white smoke trail was taken (and/or the location from which the Buk M1 missile was fired). There was a lively discussion about the weather in eastern Ukraine on 17 July 2014, but a definitive conclusion is difficult to reach.

A satellite image from the site Sat24.com shows that the weather in the eastern Ukraine wasn’t the same everywhere around the time Flight MH17 crashed. Sat24.com displays the time in CET (Central European Time) and UTC (Coordinated Universal Time, or GMT [Greenwich Mean Time]). In the summer CET was UTC+2 (actually called CEST, Central European Summer Time). In Ukraine, which has EET (East European Time) and, in the summer, EEST (East European Summer Time), the time was UTC+3. To establish the cloud coverage around 4:20 PM (i.e., the time of the crash of Flight MH17 in EEST), the map time needs to be set to 15:20 CET/13:20 UTC. Unfortunately, only historical maps of an exact hour are available (e.g., the maps of 15:15 and 15:30 no longer can be retrieved), but the map of 15:00 CET/13:00 UTC offers the required information:

23

Zooming in on Ukraine makes clear that the weather in eastern Ukraine at 16:00 on 17 July 2014 EEST was not the same everywhere, as Torez is at the edge of a cloudy and sunny area:

24

What these images demonstrate is that Torez would have been on the edge of a cloudy region, so there’s no reason to expect thick cloud in the area. In fact, an earlier photograph taken of the Buk missile launcher inside Torez around midday on 17 July shows a fairly clear sky, which is consistent with the fluctuating weather in the area at the time.

After acquiring the original copies of the smoke pictures from the photographer it became apparent that the shutter speed differed between the two photographs, and the photographs that had been previously published had colour and brightness adjusted to make the smoke trails more visible, which also affected the visibility of clouds in the those images. Based on the original images, it is clear that the weather visible in the pictures matches the local weather conditions at the time.

More information about how this location relates to other claims and evidence about the launch location of the missile that downed MH17 can be found here.

 

 

Daniel Romein

Daniel Romein is an IT-specialist and open source investigator focused on the MH17 case and the conflict in Ukraine. He started as volunteer in 2014 and currently works as full time employee for Bellingcat.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

121 Comments

  1. MBobrik

    Hi,
    I would like to ask you a few questions. In fact only one. Did the metadata of the picture contain any cryptographic features ? like digital signature and stuff… Because if not, any skilled programmer can just back up the metadata, convert to raw, doctor the image in any way he pleases, recompress and re-attach the metadata…
    (Didn’t see any obvious way to register on your site to post replies, so this reply most probably won’t go anywhere, but in case you see it in the moderation queue … …and bother to read it. )

    Reply
    • Daniel Romein

      Hi MBobrik, back up all exif data and reattach it again indeed would need some skills, since the exif data is more than only the metadata. Experts still would be able to see modifications have been made if not all exif data is reattached properly. Digital manupilation of the image with photo editing software in a way experts would not be able to detect these manupilations is quite impossible or at least will even need more advanced skills. To make a perfect forgery in 2 hours that matches with other evidence pointing to the same location is very unlikely.

      Reply
      • MBobrik

        exif is just a file format. anyone with the appropriate software for low level access can do to it what ever he wants. The only problem is metadata that is dependent on the rest of the data so that it will be corrupted when the data changes, and is either proprietary and undocumented, so that it can not be regenerated, or contains outright cryptographic features that prevent such manipulation. I agree though that 2 hours is an improbable deadline. If the metadata contained such hard to forge parts, it would be not just very improbable, it would be practically impossible.

        Reply
  2. Gabriele Gordon

    Dear Mr. Romein,

    would you please tell us when exactly you contacted the fotographer?

    I’m quite surprised that you’ve got the RAW-Data, as he turned over his camera and the memory card to the SBU some days after he made the picture. His friend “WowihaY” sent the “original picture” to the SBU immediatly after receiving it from his friend, and the guys were interested.

    You write:

    “While software capable of saving images in RAW format does exist, it is usually the software of the camera itself and cannot edit images because images in a RAW format first have to be converted to an editable image format (e.g. BMP, JPG, PNG, TIFF). Also, when the file in RAW format is saved, the modified date of the metadata will be changed.”

    I’d like to read more about this device of saving images in RAW format. Did you ask the fotographer whether he knew and used this software?

    Do you have an explanation concerning the difference between the foto twittered by “WowihaY” (blue sky) and the original grey version consistent to the RAW-Data? Why would W. manipulate the “original foto” his friend had sent to him?

    Being an amateur fotographer I wonder how the second foto – the zoom-version – could have been created 5 seconds after the first, without showing the “near” cables. Imho the second foto without the cables must have been taken from a decisively lower position which takes more time to take than 5 seconds.
    A zoom into the area between the two cables wouldn’t show the horizon – any idea?

    Admiring your work I’d like to know how you geolocated Torez in this satellite-foto?
    “Zooming in on Ukraine makes clear that the weather in eastern Ukraine at 16:00 on 17 July 2014 EEST was not the same everywhere, as Torez is at the edge of a cloudy and sunny area:”

    Last but not least I’ve got a question concerning this statement:

    “What these images demonstrate is that Torez would have been on the edge of a cloudy region, so there’s no reason to expect thick cloud in the area. In fact, an earlier photograph taken of the Buk missile launcher inside Torez around midday on 17 July shows a fairly clear sky, which is consistent with the fluctuating weather in the area at the time.”

    As everybody can see, this Torez-foto doesn’t show a “fairly clear sky”, but a bright sunshine day. The German foreign secret service BND claimed that the SBU which published this foto on its homepage used “manipulated” fotos.

    http://www.spiegel.de/international/europe/german-intelligence-blames-pro-russian-separatists-for-mh17-downing-a-997972.html

    Did you check this allegation?

    Best regards,

    Gabriele Gordon

    Reply
    • Daniel Romein

      Hi Gabrielle,

      thanks for your comment. We had contact with the photographer quite recently.

      It’s always possible to make a copy of the original photograph (RAW image), this does not modify the metadata of the image, but it of course changes the metadata of the file (creation date of the file is the date the copy is made). There is software that is able to save images in RAW format, but photo editing software can not save images as ‘negative’ RAW format. Whatever software used, the metadata always will be changed when the image is saved (modify date).

      The photograph that was tweeted was an edited version, some color settings were changed to make the white smoke trail more obvious. The images on our website are not edited, only converted into a different format.

      The first published picture was zoomed in a lot, which resulted in the black cables not being in the photograph aymore. Maybe the picture was taken from a lower position, which I think is possible within 7 seconds.

      Geolocation of Torez on the weather satellite image isn’t 100% accurate, but comparing with the satelite image of Google Earth gives a good estimation. The weather in east Ukraine that day changed from sunny to a clouded sky, which can be seen with the same weather satelite image of an earlier time that day: http://sat24.com/history.aspx

      The claim of BND was not known by me, but since the picture was already published the same day, it isn’t likely the picture is a forgery.

      Reply
  3. Void

    How does it corresponds?

    >Note that all of the images on the next page have been taken from a few to 20 seconds after launch, while the 17 July 2014 pictures have were taken hours later.

    And later in this article https://www.bellingcat.com/news/uk-and-europe/2015/01/27/is-this-the-launch-site-of-the-missile-that-shot-down-flight-mh17/:
    >According to the photographer, the first picture was taken about 30 seconds after the explosion. Because we know that flight MH17 was hit around 16:20 EEST, the camera’s time stamp was approximately 4 minutes to 4 minutes and 30 seconds ahead of the real time. The metadata (or Exif data) of the original files show that all date and time properties like camera date, digitized date, modified date, and file date show a date of 17 July 2014 and times of 16:25:41 and 16:25:48.

    So are these photos from “hours later” or “30 seconds after explosion”?

    Reply
    • Daniel Romein

      Thanks for your comment, good you noticed this mistake in the text. I have deleted that sentence, the 17 July photographs were taken 30 seconds to two minutes after the crash, not hours of course (the photographer first mentioned 30 seconds, but later said it was about 1 or 2 minutes). The picture that was zoomed in was *published* 2 hours after the crash (in a Twitter post).

      Reply
  4. ava

    Good work, but I really wonder about the sharp turn the smoke trail takes !

    When the picture was taken 1-2 minutes (or even just 30 seconds) after the launch
    the wind (only near the ground ?) must have been very strong that day ?
    The russians argue contrary: the wind was very calm (so a smoke trail of a launched missile would have been visisble up to 10 minutes).
    Do you know anything more exactly about the wind force in different altitudes that day and that location ?

    Reply
    • Daniel Romein

      The wind was not that strong that day, a breeze of 4 m/s (or 10 mph), so that is a gentle breeze of 3 beaufort. Still within 1 to 2 minutes the white smoke trail would have been moved 240 to 480 meters, which seems quite correct when looking at the photographs. It is well known that wind close to the ground has much more friction (in this case of trees and villages nearby) and for that reason a lower speed. The grey smoke also might be thicker and heavier, so less easy to be affected by wind.

      Reply
  5. ava

    There is just another doubt i would like to know your point of view:
    If you see a smoke trail, so extraodinary you take pictures of it, wouldn’t you follow that trail up to its end ?
    So what would you see at its end ? If the smoke trail picture was taken 30 sec – 2 min after launch you would see the downgoing airplane, at least (if the plane was already gone) you would see that unusual roundish smoke structure, left behind after the missiles explosion. And surely you would take pictures of it !
    But there are no pictures, which means for me the claim the picture was taken 30 sec (1st statement) or 1-2 min (corrected statement) after launch of missile is not very credible anymore.
    Maybe we better should confide in the time stamp of the camera which proves the picture was taken 4 minutes to 4 minutes and 30 seconds after launch. This would explain why there probably is nothing anymore in the sky worth to be pictured and this also would be a better match to the state of disintegration of the shown smoke trail.
    But what does this mean ? 30 secs, 2 Mins or 4 Mins – is that of importance ?
    After all the apparently wrong information from the photographer creates some doubts regarding the authenticity of the picture.
    I am confident that the picture is not a fake but i am not so sure it really shows the smoke trail of the launched BUK missile.

    Reply
    • Daniel Romein

      The photographer took the camera after hearing the explosion of the then already crashed MH17. Realize that the speed of the missile caused the downing of the plane already 20 to 30 seconds after its launch. As we know in the direction of Torez the sky was very clouded and probably there was not much to see in the sky of the explosion of the plane. I also can imagine that the photographer does not remember exactly after how much time the pictures were taken, 1 or 2 minutes. It was half a year ago and I guess the photographer took the camera as quick as possible after the sound of the explosion of the crash, so an estimation of 1 to 2 minutes is reasonable, but is indeed not even that important.

      Reply
  6. Daniel Romein

    Hello Mr. Charles Wood,

    thanks for reading our article so thoroughly and thanks for the constructive feedback, which we are happy to receive. Despite the fact you have noticed some minor errors in our article, we have noticed a lot of your comments are not correct and we also have noticed that you don’t provide any source that support most of your claims. This is especially astonishing looking at the fact you accuse Bellingcat of providing images of unknown provenance and creating spoof. Apart from that we are not able to verify you are a professional forensic analyst, but we do have noticed your Twitter account, which gives us a different impression of your expertise.

    About the time the Twitter message of 17 July 2014 with the Torez picture was posted you are right: this time was 19:23 and not 18:23. We have corrected this mistake in the article. As you might have noticed in our article we also used the site timeanddate.com, we were very aware of the time difference of 10 hours this website indicated, but we had doubts if the displayed time in pacific time (9:23 am) was right, since Twitter usually displays relative time. Taking into account the one hour time difference between summer and winter, we subtracted one hour. However it turns out older messages on Twitter are displayed in absolute time, not relative. The other error you noticed already was corrected before you wrote your article and was a minor error, I wrote “hours” instead of “minutes”, probably mixed it up with the fact the picture was published several hours later.

    The launch of Grad rockets can be clearly seen in the next video:
    http://www.youtube.com/watch?v=hiAudmHkFN8
    As you obviously can see the trails of Grad rockets are grey and the rockets are not fired high in the sky, but with an angle of approximately 45 degrees. It wouldn’t make much sense to fire a Grad straight up in the air, since the Grad rocket is supposed to hit a ground target. Sounding rockets in a Grad artillery unit we haven’t seen in any video, but if you can provide a source, it would be very helpful.

    We have chosen deliberately not to publish any metadata of the photographs of 17 July 2014, which is clearly written in our article, to protect the privacy and safety of the photographer. Publishing this metadata would reveal the identity of the photographer and the type of camera that was used. This does not mean we have not examined the metadata of the photographs (we did with various tools like ExifTool). We can add that the camera supports automatic daylight saving and also leap years (almost all modern cameras support both).

    The moment a photograph is copied to an external device, the destination file will have not only a different creation date (which indeed could be altered), but also modified fields in the metadata. Every OS changes fields in the metadata (and not only the exif data), which can be revealed with tools like ExifTool. A forger would need to have in depth knowledge of all metadata codes, since the risc the file becomes corrupt when altering the data with a hex editor is quite big. As far as I know Photo editing software that saves images in RAW format does not exist, but if you can provide an example, it would extend my knowledge significantly. For Photo editing software it wouldn’t make any sense to save images back in negative format, since the purpose of this software is to generate a visible (positive) image. However, converter tools that convert positive image format back in negative format do exist, but this proces would change metadata as well. More information about RAW images can be found here:
    http://www.luminous-landscape.com/tutorials/understanding-series/u-raw-files.shtml

    In our article a darkened version of the photograph shows clearly the grey plume is connected with the white smoke trail and a less stronger ground wind is not an impossible meteorological effect, it is well known that ground wind suffers more friction. Nowhere in our article do we mention a storm or inversions. As you can see on historical weather websites as meteo.ua and worldweatheronline.com the wind was blowing east before 17:00 and changed to east-northeast only after 17:00. See:
    http://meteo.ua/archive/319/snejnoe/2014-7-17
    http://www.worldweatheronline.com/Snizhne-weather-history/Donetska-Oblast/UA.aspx
    Your claim about the cloud density goes without source, but it doesn’t make
    much sense. The higher the density is, the better it will be visible on a
    satellite image, the relation to the height of the clouds is not clear to me,
    especially not when realizing weather satellites orbit the earth at altitudes
    of several thousands of kilometers (http://en.wikipedia.org/wiki/Weather_satellite),
    while clouds don’t go above 13 kilometers (http://www.windows2universe.org/earth/Atmosphere/clouds/cloud_heights.html).

    Your claim that Bellingcat would have destroyed evidence is completely untrue. The photographer made copies of the original photographs on an external device before sending the files to us, this never can have influenced the original images. The memory card and the camera are being investigated by an official forensic institute in the Netherlands.

    Reply
  7. Ukrainian Terrorist

    Metadata can’t edited? Is this some joke? And where are any proof that you contacted anyone or this photographer really exist?

    Reply
    • Daniel Romein

      We explained metadata can be edited, but then codes will be added to the exif data, which can be noted by a photograph expert. Since a photograph has been made, it is obvious that the photographer really exists. The photographer was interviewed for Dutch television, the camera and memory card are being investigated by a Dutch forensic institute and a special police team.

      Reply
      • szrg

        It is possible (and it is not hard) to modify EXIF without any traces. And no, no codes will be added. If some software can’t do it, it doesn’t mean one can’t create a specialized software just for that purpose. A skillful Indian programmer will do it for $100 in a day. If you know how to program, you could do it by yourself, e.g. using python (a programming language) and a handy library https://github.com/bennoleslie/pexif

        Reply
        • Daniel Romein

          With the right skills and software it IS possible to modify the exif data, but it isn’t that easy: the file easily can be corrupted if someone doesn’t know exactly what he/she is doing. To write such software isn’t necessary, it already exists. The fact is that everything had to be done in just 3 hours, from the moment the plane crashed. Already the communication to find a good programmer and photo editor takes already an hour and to create a perfect forgery in a few hours just is not possible. Keep also in mind that the SBU (Ukranian Security Service) was very slow with posting the smoke photograph on their website and that they even accidently put a screenshot of a video of a wrong Buk on their website (Buk 312, filmed in March 2014, an Ukrainian Buk, which never was in the area controlled by separatists/rebels). And then realize that the perfect forgery had to match with satelite images, with audio recordings and a burned field south of Snizhne. Especially the last one just would be impossible, since Ukraine had no access to that field, since it was in separatist controlled area.

          Reply
  8. Ukrainian Terrorist

    And why upload “original” BMP files and not the RAW files? No real files, just claims of their possession.

    Reply
    • Daniel Romein

      We have written in the article that the privacy of the photographer has to be protected and so we have chosen to upload converted versions in BMP format without any metadata. You can see the resolution is much higher then the previous published versions, also the color settings are not adepted.

      Reply

Leave a Reply

  • (will not be published)

You can support the work of Bellingcat by donating through the following link:

TRUST IN JOURNALISM - IMPRESS