Introduction to research sources and forensic investigation

Research sources and validation

The JIT has conducted various types of investigation:

• Forensic investigation
• Investigation of telecommunications
• Investigation of witnesses
• Investigation of photos and videos
• Investigation of digital sources
• Investigation of radar data and satellite images

An important part of the investigation has always been to check the investigation results in order to verify or falsify them, i.e. to examine their authenticity and evidentiary value as effectively as possible.

We refer to that here as validation.

In what follows, we will explain how the forensic investigation, the investigation of telecommunications, witnesses, photos and videos, digital sources, radar images and satellite images was carried out. In each case we will address our approach to validation, i.e. the way we assessed the authenticity and evidentiary value of the results.

Before we proceed we would like to generally discuss the methods used to validate the reliability of these sources. During the court hearing on 10 March 2020 we already discussed this matter, but we would like to bring this to your attention again.

From the start of the investigation it was clear that various parties were blaming one another for shooting down MH17. It was also clear from the start that not all parties would approach the results of this investigation with an open mind. Therefore, we have taken extra steps in terms of validating evidence.

In doing so we have followed three main paths.

Firstly, we have validated the authenticity and reliability of the individual sources. In March we have already briefly explained how we did so with regard to telecom data as well as photo and video images.

Secondly, these separate findings were described in conjunction with other sources of evidence, such as forensic findings, witness statements and satellite data. These combined findings with regard to different sources of evidence can be found in the case file and the file describing the alternative scenarios. The background information is provided in the file describing the context of the case. In that way the results of the investigation can be compared and assessed.

Thirdly, we validated the reliability of the evidence by searching for alternative evidence. After all, for the assessment of the reliability of witness statements or telecom data about the firing of a Buk-missile from DPR controlled area it is relevant if evidence can be found that the crash of MH17 was caused by something else. For that reason we have investigated the possibility of an explosion from within MH17 and an attack by a fighter jet. Several scenarios have, furthermore, been investigated. One alternative scenario is that MH17 was downed with a different ground-to-air missile than a Buk-missile. Another scenario which was investigated is – assuming that the Buk-scenario is correct – that a Buk-missile was fired from a location other than the location near Pervomaiskyi and/or by a different party to the armed conflict: the armed forces of Ukraine.

Forensic investigation

Although there was limited access to the crash site, the investigators were able to conduct an extensive forensic investigation. In this part we will provide a summarized overview of the forensic investigation that was carried out in order to answer four main questions:

1. Was there an explosion?
2. If there was an explosion, did this occur inside or outside the aircraft?
3. Can the type of weapon used be determined on the basis of forensic investigation?
4. Can a launch location be determined on the basis of forensic investigation?

In order to answer these questions, a thorough investigation has been carried out into:

• the visible damage of MH17;
• ‘foreign material’ (any material that does not belong to the aircraft) found in the aircraft debris of MH17;
• ‘foreign material’ (any material that does not belong to a body) found in the bodies of victims and their personal belongings;
• loose ‘foreign material’ (any material that does not belong to the aircraft) found in Ukraine.

For the purpose of this investigation a large collection of reference material has been built. This collection consisted, among other things, of multiple Buk-missiles and warheads, which were dismantled and - some of them - detonated specifically for this investigation.

The most important parts of the investigation into the damage were the following:

• an investigation into soot particles which were found on the outside of the fuselage;
• an investigation into the question whether these soot particles contained traces of explosives;
• an investigation into perforations, craters and other impact damage in and on the fuselage, in particular at the left front side;
• an investigation into steel residue which was found inside craters and perforations;
• a comparison of the characteristics (including the elemental composition) of this steel residue with the steel residue of fragmentation parts of a 9N314M warhead of a Buk-missile;
• a comparison of the ‘petalling-effect’ which was witnessed on the wreckage with the damage after the arena tests held with a Buk-missile and a warhead. 

The most important parts of the investigation into the fragments of the aircraft debris were the following:

• an investigation into 341 steel fragments which were found in various pieces of wreckage;
• a mutual comparison of the characteristics (including the elemental composition) of these steel fragments;
• a comparison of the characteristics (including the elemental composition, shape and manufacturing traces) of these steel fragments with the three separate fragmentation parts of a 9N314M warhead;
• a comparison of the characteristics (including the elemental composition, shape, manufacturing traces and paint) of other ‘foreign’ parts with the characteristics of separate parts of Buk-missiles with type 9M38 and 9M38M1.

The most important points from the investigation into the bodies of the victims, in particular the crew members from the cockpit of MH17, are the following:

• an investigation into 29 steel fragments which were found in the bodies of these victims;
• a comparison of the characteristics (including the elemental composition) of these steel fragments;
• a comparison of the characteristics (including the elemental composition, shape and manufacturing traces) of these steel fragments with the fragmentation parts of a 9N314M warhead;
• a comparison of the characteristics of melted glass traces which were found on steel fragments in the bodies of crew members with the elemental composition of the cockpit glass;
• a comparison of the characteristics (including the elemental composition) of a particle which was found in the body of one of the crew members with the characteristics of Buk-missiles with type 9M38 and 9M38M1.

Furthermore, seven different ‘foreign’ materials were found on the crash site. The characteristics (including the elemental composition, shape and paint) of these objects were mutually compared and also compared with the characteristics of Buk-missiles with type 9M38 and 9M38M1.

In addition, three ‘arena’ tests were conducted in this investigation. These tests have produced information, such as the speed of fragmentation parts after detonation and the angles at which these parts were ejected, which was important for the follow up investigation. Parts of these follow up investigations have been carried out to calculate the launch area. These investigations were done by experts of the Netherlands Aerospace Centre (NLR) and the Belgium Royal Military Academy (RMA). Both research institutes have made a calculation of the area from which a Buk-missile of the 9M38-series must have fired in order to have caused the damage as witnessed on the wreckage of MH17.

The NLR ultimately calculated an area of 75 square kilometres south east of the position from which flight MH17’s last signal was transmitted. According to the NLR, only Buk missiles fired from that area could have caused the damage found on MH17. The results of the calculation of the Belgium Royal Military Academy overlaps partly with this area. This can be seen on the video of this presentation (part 2). 

The Public Prosecution Service believes that the forensic investigation has been carried out comprehensively and that on the basis of the aforementioned summarized results, the four main questions can be fully answered.