Go to content

Investigation of telecommunications

Analysis and validation of telecommunications traffic in eastern Ukraine has been an important part of the investigation and has been documented in the ‘Telecom’ case file. The telecom data retrieved in the course of the investigation can be divided into audio (intercepted calls) and metadata (data generated about telephones, telephone numbers, telephone calls and mobile phone masts to which mobile phones have transmitted signals).

This is a summary of the speaking notes of the prosecutor. The full presentation can be watched in the video.

It was already apparent on 17 July 2014 that the SBU – a Ukrainian security service with intelligence and investigative duties – had access to relevant intercepted telephone calls. Intercepted conversations were also made public on the evening of that same day. This was possible because, from the start of the armed conflict, the SBU had been investigating the armed groups involved and intercepting the conversations of various individuals. This involved the large-scale interception of telecommunications in eastern Ukraine, including the phone lines of the defendants Girkin, Dubinskiy and Kharchenko.

After the downing of flight MH17, sections of the SBU were instructed to listen to all recorded telephone calls that could be relevant in order to uncover relevant information about the downing of flight MH17. Because the downing of a plane and the possession of a Buk system were openly discussed on the phone lines of Girkin, Dubinskiy and Kharchenko, it is no surprise that it took little time to find relevant conversations.

The first selection of telecom data of relevance to the MH17 investigation was therefore carried out by the SBU. As the JIT investigation gathered momentum, the investigation of telecom data was increasingly a concerted effort by investigators from different countries. The guiding principle in this regard was to be able to assess conversations in context. An incriminating phone call was always viewed as the starting point for further analysis, not as an end result. Analysis of this kind could be conducted by listening to the other calls made on that line, and by including the other calls made by the interlocutor and the metadata of both mobile telephones in the analysis. Many callers could be identified from the content of their calls. This made it possible to consider the information from their conversations in conjunction with information from other sources.

As mentioned, the Ukrainian SBU has both intelligence and investigative duties. In both cases, the SBU is able to intercept telephone calls and retrieve metadata. Prior authorisation by a Ukrainian court is required both in intelligence investigations and criminal investigations. The Ukrainian telecom data in this Dutch case file is derived from three different sources:

  • the SBU's intelligence investigations;
  • the SBU's criminal investigation into the downing of flight MH17;
  • other criminal investigations by the SBU.

Telecom data obtained in the intelligence investigations of the SBU ended up in the case file in two separate ways.

  1. During the first phase of the investigation in July and August 2014, the General Intelligence and Security Service of the Netherlands (AIVD) has received telecom data from the intelligence department of the SBU. The AIVD has provided this information to the Netherlands Public Prosecution Service.
  2. On multiple occasions, the Ukrainian authorities have shared telecom data in the JIT. This telecom data was collected by the SBU in both intelligence and criminal investigations.

Conclusion concerning the validation of telecom data

During the investigation we have developed various ways to verify and validate telecom data which was received from Ukraine.

Based on the information we received from telecom providers in Ukraine and the network measurements carried out, we have been able to establish to which mobile phone masts a signal was transmitted at relevant locations. This helped us to determine the location of telephones at moments relevant to the criminal case.

The mutual comparison of telecom data from Ukraine enables us to state with greater certainty that particular calls did indeed take place at particular times, between particular numbers and/or telephones, and involved the transmission of a signal to particular mobile phone masts.

We have requested telecom data from countries other than Ukraine. With that information we have investigated whether international conversations in the Ukrainian data were registered in the same way by providers in the countries of the other participants in the conversations.

We have asked participants in relevant telephone calls whether they recognise their own voices in those calls. In that way we have investigated who conducted those calls. In addition, we have interviewed witnesses about the voices of (other) participants in telephone calls.

By comparing the substance of a number of telephone conversations with information from open sources it was possible for international investigators in the JIT to see whether the content of the conversation was compatible with other information from the same period.

Finally we looked into allegations of manipulation of the intercepted calls and these were investigated by forensic experts who brought expert advice to bear.

We believe that it is extremely unlikely that the conversations analysed by the JIT were manipulated, given the quantity of conversations analysed by the team, the interplay between these conversations, the connections between these conversations and other sources of data and the fact that for the great majority of these conversations they were selected from a much larger number of conversations by investigators from other countries than Ukraine.

The prosecution therefore takes the view that the most extensive investigation possible has been carried out in order to assess and identify the authenticity of the telecom data.