Investigation into the main scenario
Delivered before the full-bench chamber of The Hague District Court on 9 June 2020.
Of all the scenarios examined in the course of the investigation, only one was regarded as the main scenario: that flight MH17 was downed by a Buk missile fired from an agricultural field in the vicinity of Pervomaiskyi. This is also the scenario that, from the very first day, turned up over and over again in open sources and intercepted conversations. The JIT presented various results of this investigation back on 28 September 2016 and 24 May 2018.
Within the framework of this main scenario, the investigation looked at various issues:
- the initial reactions after flight MH17 was shot down;
- the route to the launch site;
- the launch site;
- the route back to the Russian Federation;
- the origin of the TELAR;
- the chain of events that led to the downing of flight MH17.
We will now explain how the investigation examined each of these issues.
Initial reactions after flight MH17 was shot down
We discussed how we catalogued the initial reactions after the downing of flight MH17 back when we explained the investigation into alternative scenarios. When doing so, we showed how little time it took before the first alternative scenarios were presented. For example, in the evening of 17 July 2014 the first news reports started to appear, claiming that flight MH17 had been shot down by a Ukrainian S-300 missile system or a Ukrainian fighter aircraft. The latter scenario was also mentioned in intercepted phone conversations involving DPR fighters.
We also showed that these were not the very first reactions. In the earliest reactions – shortly after the downing of the aircraft – it was in fact claimed that a Ukrainian military transport aircraft had been downed from DPR-controlled territory. This was reported in tweets by ‘@Strelkov_info’ and ‘@dnrpress’, a television broadcast by the Russian channel LifeNews, a Zello conversation among local residents, a telephone conversation between a DPR spokesperson and the journalist Sessini and the first intercepted phone conversations involving DPR fighters after flight MH17 crashed. When all available sources in the investigation were collated, it became clear that the messaging in Russian and DPR sources shifted the moment it became clear that it was not a military transport that had been shot down, but rather a civilian aircraft. From that point on, the Russian and DPR sources stopped claiming that the DPR had shot down an aircraft and instead asserted that Ukraine was responsible.
The initial claim that a transport aircraft had been shot down from inside the DPR was one of the first leads in the investigation into the main scenario.
The route to the launch site
In that same initial phase of the investigation various images were found online showing a Buk missile launch vehicle being transported through DPR territory. When the images of this transport proved to be consistent with what was being said in intercepted telephone conversations between DPR fighters, the team decided to conduct an in-depth investigation into the route taken by the launch vehicle.
At first glance, the issue of whether the launch vehicle that fired the missile arrived at the launch site via route A or route B may not seem particularly relevant to the evidentiary question. As a rule, the exact route by which a weapon arrived at a crime scene is not important. This case is different, however, because it was possible to link the route taken by the launch vehicle to relevant intercepted conversations in which participants discussed the request for a ‘Buk’ or ‘Buk-M’ and the procedures for escorting and providing security for the system. This, in turn, was key to validating the intercepted phone conversations and the investigation into the various roles played by the parties to those conversations. The route was also relevant to the investigation into the launch site and the origin of the launch vehicle.
Previously, we referred to the launch vehicle as the ‘Buk-TELAR’. Later we will explain the investigation that was conducted into the workings of the Buk system itself. For the time being, it is sufficient to note that a Buk system has two types of launch vehicle: one with its own radar, the Transporter Erector Launcher and Radar (TELAR), and one without radar, the Transporter Erector Launcher and Loader (TELL). The photos and videos of 17 and 18 July 2014 which were gathered over the course of the investigation show a 9A310-series TELAR.
Sources
We will begin by discussing the investigation into the route taken by the missile to the launch site. We were able to visualise this with the help of a variety of sources: telecom data, witnesses, photos/videos and social media posts.
We will discuss the various types of sources with the help of a visual overview.
This shows the approximate route to the launch site in Ukraine which the investigation identified on the basis of the same sources: from the border area near Sukhodilsk to the agricultural field outside Pervomaiskyi. In order to give a general sense of this part of the investigation, we will zoom in on one segment of the route, starting in Yenakiieve. We will start with a general outline of the sources we obtained. The substance of this evidence can be discussed further during the consideration of the merits of the case. In this explanatory presentation we will mention only a few of these sources of evidence, as examples.
We will start with the telecom investigation. The case file describes how the investigation used telecom data to determine which telephone numbers could be tied to individuals escorting the Buk-TELAR during its transportation, the route taken and the specific individuals involved. Here you can see a visualisation of this aspect of the case file. The coloured dots on the map represent the locations of mobile phone masts of telephone providers. The different colours represent the different telephone numbers that are believed to be associated with individuals involved in transporting the Buk-TELAR.
Telecom data provides key information in a number of ways. Obviously, the substance of recorded telephone conversations – the subject matter, the participants and the users of the telephone – is relevant. But in addition to the recording itself, metadata can also reveal a great deal of information, such as the time of the call and the location of the telephone. That location can be determined by the mobile phone mast that the telephone in question happens to be using at a given time. As stated previously, it is difficult to determine an exact location, but if a telephone is moving – if it is taken from one location to another – while transmitting to successive mobile phone masts, there are certain conclusions that can be drawn about the route taken. Those conclusions become firmer if several telephones simultaneously follow the same route or if certain locations along that route are confirmed in intercepted conversations.
This is obviously a very general illustration, which is only intended to show how the route was investigated with the help of telecom data. This is described more specifically in the case file, with the inclusion of times and the names of the individuals using the phones. But this will not be addressed in depth until it is time to assess the merits of the case.
Another type of evidence is witness statements: here you can see a general indication of the places where various witnesses stated that they saw the Buk-TELAR on 17 July.
Previously, we outlined how the witness investigation was set up, how appeals for witnesses were issued and which problems had to be overcome in order for witnesses to testify in safety. Despite those problems, we succeeded in interviewing many witnesses who were able to make statements about various elements of the route. Many of these people have been designated anonymous threatened witnesses by the examining magistrate because they could experience problems if their identity were to become known. As already explained, the identity of these witnesses, who are referred to by V numbers, is known to the examining magistrate, and that magistrate extensively investigated the reliability of the statements given by the anonymous threatened witnesses. In every instance the examining magistrate first looked at the reliability of each witness as an individual. In this regard the examining magistrate looked at whether the witness had any personal, political, commercial or other interest in giving the statement. The examining magistrate then assessed the reliability of the statements themselves. The statements were examined in terms of their coherence, logic and plausibility, accuracy, consistency, compatibility with objective data (such as the witnesses’ telephone data), compatibility with other information from the case file (such as other witness statements) and the credibility of the reasons why the person in question had a particular piece of knowledge. The examining magistrate also looked into whether the witness could have seen and heard what they claimed to have seen and heard from their alleged vantage point. In each case the statement was evaluated to determine whether it related to a factual observation or a conclusion, and whether the witness had made that observation personally or heard it from somebody else.
This thorough investigation of the reliability of witnesses on the part of the examining magistrate provides a solid foundation for a critical evaluation of the anonymous statements.
This thoroughness is clear, for example, from the investigation conducted with regard to witnesses V45, V49 and V54. In the opinion of the examining magistrate, these individuals made a trustworthy impression as people, but the same cannot be said for every aspect of the statements they gave. With regard to witness V45, for example, the examining magistrate felt that the witness gave a reliable statement in terms of their observations, but noted that it is difficult to evaluate the reliability of things the witness heard from other people. In the case of witness V54, the examining magistrate determined on the basis of the witness’s telephone data that at certain times they were at a different location from the Buk they claimed to have observed. For this reason the examining magistrate concluded that those observations concerning the convoy and the centre of Snizhne could not be regarded as reliable. Finally, with regard to the statement by witness V49, the examining magistrate commented that it was difficult to interpret. In a number of respects, the statement that V49 gave to the JIT is not consistent with other information in the case file. The witness’s account on these points was different in their interview with the examining magistrate, and they offered no explanation for the discrepancy. For this reason the examining magistrate is of the opinion that witness V49’s statement cannot be considered reliable.
This critical assessment of the witness statements by the examining magistrate with regard to V49 and V54 in particular shows just how thorough and how valuable the court’s evaluation of the anonymous witnesses has been in this case. The examining magistrate concluded that all other anonymous threatened witnesses made a reliable and credible impression and, in the view of the magistrate, gave reliable statements.
Besides using telecom data and witnesses, the investigation into the route taken by the Buk-TELAR also made use of photos and videos and information from public sources. In response to calls for witnesses, video of the TELAR was provided to the investigation team. Photos, videos and reported sightings of the TELAR were also posted online. This happened both before and after the downing of flight MH17.
Taken together this evidence paints the following picture. A discussion of all the evidence gathered to establish the route taken by the missile can take place during the consideration of the merits of the case. For now, we will confine ourselves to two pieces of evidence: a video and a photo of the Buk-TELAR in Donetsk. In discussing these two examples, we hope to offer an insight into the first phase of the investigation and the way in which evidence was validated.
Example: video of Makiivka Highway (Donetsk)
We previously noted that the first concrete leads for the investigation into the main scenario consisted of images of the Buk-TELAR that were posted online. One of these shows a Volvo truck with a lowboy transporting a Buk-TELAR. This image has now been seen the world over. Later in the investigation it emerged that this image was actually a screenshot from a video. We will now explain how the investigation into this photo – and subsequently, the underlying video – proceeded.
Investigation into the origin of the Volvo truck
This image was published shortly after the crash – 24 July 2014 – by the French weekly Paris Match. A large yellow sign with a telephone number has been affixed to the side of the truck. Using this number the investigators were able to ascertain the name of the company to which the truck belonged. This proved to be the firm Budmekhanizatsiia in Donetsk.
It was possible to interview the owner of the company as a witness as early as the beginning of August 2014. He stated that his company had been taken over on 8 July 2014 by armed DPR fighters. He recognised his truck and lowboy on this image of the TELAR from 17 July 2014. The owner provided the registration papers for both the truck and the lowboy.
The owner also had a ‘certificate of confiscation’, which he was issued on 8 July 2014 by an armed DPR fighter with the call sign Batya, when he took over the company in the name of the DPR. The witness also handed this document over to the JIT. In the scan of the document shown here, the name and telephone number of the owner and the signature of the DPR fighter have been redacted. The name and signature are included in the case file, however.
The document reads as follows:
Certificate of takeover
Issued to […] because his machinery and equipment firm No. 1, consisting of the company grounds and an administration office, has been temporary taken over by the People’s Militia of the DPR for stationing vehicles and personnel.
Commander of the logistical unit of the People’s Militia [signed] Batya
8 July 2014, City of Donetsk
PS: The grounds and the building have been transferred with the personal permission of Mr […].
It later emerged, moreover, that the owner had screenshots of video footage taken by security cameras at his company on 8 July 2014. These images were added to the case file. In addition to the owner of the company, an employee who was also present on 8 July 2014 was interviewed as well.
In December 2015 an armed fighter of the DPR with the call sign ‘Batya’ was arrested in Ukraine. He proved to be the person who had signed the ‘certificate of confiscation’ above. This ‘Batya’ was also interviewed as a witness. Under his own name he gave a statement about the takeover of the company and the role he had played.
Investigators then examined the telephone data of the company owner and of this individual Batya. This telecom data could be compared to their statements about the takeover of the company on 8 July 2014. That telecom investigation also revealed information about Batya’s position in the DPR. For example a telephone conversation from 7 July 2014 was found in which Batya introduces himself as deputy commander of support and logistics.
Thus, the investigation of the Volvo truck in the Paris Match image provided information that enabled the visual material to be validated.
Investigation of other aspects of the video
But the investigation of this video did not end there. In 2015 the investigation team was given the video from which the photo originated. This video footage was investigated with a view to determining the time and the place it was taken. This was done in various ways. For example, the characteristics and name of the video file contain information about the date, time and GPS location. The location was also examined by comparing the video footage to Google Street View. In this way the investigators were able to determine that the video had been shot from a parking zone at the beginning of Highway 21 in Donetsk, in the direction of Makiivka.
In addition, an expert from the Royal Netherlands Meteorological Institute (KNMI) examined the video to determine when it might have been shot, on the basis of meteorological circumstances, such as the length and direction of the shadows.
Together with other images gathered by the investigation, the video was submitted to experts at the Netherlands Forensic Institute (NFI) in 2016 in order to determine if there were any indications that the images could have been manipulated. These forensic experts examined the video footage in terms of characteristics like shadows, perspective, lighting, focus, the rendering of colours and the borders of objects. They found no indications of manipulation.
In September 2018 the Russian authorities held a press conference in which they stated that Russian experts had determined that visual material released previously by the JIT had been falsified. This material included the footage described above. These falsifications had allegedly been discovered in the course of an analysis of the material, which focused in particular on lighting and perspective.
Their analysis looked like this.
Briefly put, it is their contention that not all parallel lines in the visual material converge at the same point. It was also claimed that a spot of light could be seen on the side of a truck that is in the shade. Their position is that both of these things suggest that the visual material was manipulated.
As already noted in March, we went further in this investigation than in other criminal investigations, and took extra steps in order to validate the evidence. This is one such example of where that was done. Back in September 2016 the investigation had already gathered concrete evidence from multiple sources about the origin of the truck and the lowboy and their theft, by the DPR, on 8 July 2014. Moreover, forensic experts had already examined the video footage and concluded that there were no indications of manipulation.
The Russian press conference raised more questions about the assertions of the Russian authorities than about the visual material itself. Anyone who studies the press conference of September 2018 can see that the perspective lines drawn by the Russian authorities are rather random. Secondly, the Russian authorities never submitted the underlying documents from their purported experts despite our outstanding request for legal assistance (which asks the Russian Federation to provide all relevant information) and the Russians’ own pledge to assist the investigation in any way possible. When it came to other information, the Russians were more forthcoming. Early on in the investigation the Russian Federation, acting on its own initiative, provided various witness statements about a Ukrainian fighter aircraft and a missile launch from Amvrosiivka. However, we did not receive any reports of the studies conducted by these alleged experts.
Nevertheless the entire Russian press conference of 17 September 2018 was submitted to experts at NFI for further investigation. These experts re-examined the video, incorporating all the information released by the Russian authorities. In contrast to the Russian authorities, however, they concluded that there were no indications that the video images had been manipulated.
With regard to the perspective analysis, the NFI experts explained that this method can be applied only to lines that are known to be perfectly parallel. In a natural setting it is not always possible to estimate this properly, especially in the case of moving objects filmed in an uncontrolled environment, as in this case: a video shot from a moving car. Moreover, this type of analysis can be complicated by numerous factors, including distortion by a lens or car window and image compression. ‘Image compression’ refers to the modification of visual material so as to reduce its size in order to free up storage capacity and facilitate its swift transmission, for example when it is being downloaded or uploaded. Recorded images can also be influenced by the ‘rolling shutter effect’. This means that at the moment an image is taken, not all the horizontal picture lines are exposed and ‘read’ at the same time. The resulting image is thus not the representation of a single moment, but rather a combination of picture lines that were captured one after another in very rapid succession. When objects moving through the image are recorded in this way, the rendering of the object may be visibly distorted. Images of objects captured with a non-steady camera, e.g. a dashboard camera or a smartphone, can be distorted in this way.
In their report the NFI experts provided examples of this in other visual material. You can see those examples here.
With regard to the image of the truck with the lowboy and the TELAR resting on top of it, the experts determined that a perspective analysis does not lead to the conclusions drawn by the Russian authorities. Speaking about this video, for example, the experts concluded as follows:
‘The objects of importance in this scene are the Buk TELAR and the truck. No lines were found on the Buk TELAR of which it can be said with any certainty that they must necessarily be parallel to lines on other objects in the image. The orientation of the Buk TELAR vis-à-vis the truck or the road is, for example, dependent on the angle at which the Buk-TELAR rests on the trailer, the angle at which the trailer hangs behind the truck, the angle of the truck in relation to the road and the extent to which the Buk TELAR is tilted forward or backward in relation to the truck and the surface of the road.’
The experts also concluded that the rolling shutter effect can be observed in this visual material. The distortion of the poles beneath the grey/blue sign and the red part of the lowboy can be clearly seen.
In addition, various NFI experts performed a perspective analysis on this image, concluding that there were significant differences in the points of intersection each of them posited. This means that on multiple occasions various neutral individuals were unable to derive the same point of intersection on the basis of apparently straight lines. The experts therefore determined that there were no conclusions that could be drawn from this. On the basis of all these consideration they concluded the following:
‘It is clear from the above observations that a perspective analysis of this visual material cannot be used to support claims that the video file was manipulated.’
The Russian authorities’ other claims about the visual material were also investigated. The experts concluded the following, for example, about other points:
’No inconsistencies were observed in the shadows cast by the Buk TELAR and the truck with the lowboy on the road, with respect to shape, direction and tint. The car with the camera is driving past the Buk TELAR and the truck, meaning that the view is shifting during the recording. No jerkiness, unnatural elements, or inconsistencies in perspective were observed. The change in view looks fluid and convincing. The same applies to other objects shown, such as cars, signs and greenery.’
The experts consistently concluded that the alleged indications of manipulation identified by the Russians could not be designated as such. The experts’ ultimate conclusion about the video footage, which took the form of answers to the questions submitted by the investigators, was therefore as follows.
‘1. Are there any indications, in light of the above claims by the RF [Russian Federation] or in any other sense, that the video has been manipulated?
No.'
'2. On the basis of an analysis of the consistency of the perspective are there any indications that the images of the Buk TELAR and/or truck with the lowboy were pasted into the video images of the street?
No.’
Summary
We will now summarise the investigation into the video of the Volvo truck with the lowboy and the Buk-TELAR.
When examining the origin of the truck in the video, investigators were able to interview the owner, an employee of the company in question and a DPR fighter. According to their statements the same truck and lowboy had fallen into the hands of the DPR on 8 July 2014. These witnesses’ statements were investigated further on the basis of various documents, including the registration papers for the truck and the lowboy, a signed ‘certificate of confiscation’ of the company, security-camera footage and telephone data. Expert investigations were conducted into the images showing the truck and the lowboy on multiple occasions. The results of all these investigations have been added to the case file.
Example: photo of Illicha Avenue (Donetsk)
Another example is this photo of a lowboy carrying a Buk-TELAR, which the investigation determined was taken on Illicha Avenue, in Donetsk. We briefly discussed the investigation into this photo on 10 March. Now, with the help of visual aids, we will do so again, taking a step-by-step approach in order to clarify how that investigation proceeded.
In July 2017, after several appeals for witnesses had already been issued, someone emailed a photo to the investigation team. The subject of that email was ‘Buk M Makeevka’. The photo contained no metadata. This meant that we had no technical information about where or when it was taken.
This photo also showed another vehicle. Alongside the lowboy with the TELAR on it is a dark Volkswagen T5 van with a flashing light on the roof. The Paris Match video mentioned earlier, which was at that time already in the possession of the investigation team, showed the same dark van with a flashing light alongside the lowboy transporting the TELAR. As mentioned, the photo was labelled ‘Makeevka’, but that tells us nothing about where it was actually taken. In this instance, too, validation was a top priority.
Public sources
The power of the online community had already become clear at several points in the course of the investigation. For that reason the JIT released this photo on 19 October 2017, asking the public for information about it, the vehicles it shows and the location where it was taken. Soon after, the research collective Bellingcat published the finding that the photo had been taken on Illicha Prospekt (Illicha Avenue) near the hairdresser’s at number 78 in Donetsk – in other words, not in Makiivka. The JIT conducted its own investigation into the location featured in the photo, on the basis of its own material obtained from public sources, and arrived at the same conclusion.
This location was found on social media. According to various posts on 17 July 2014, people had seen a Buk transport and militia members in Donetsk and even specifically on Illicha Avenue. For example, one tweet, which was secured by the investigators, spoke of a ‘Buk’ on a ‘tractor’ in Donetsk, at the intersection of Illicha Avenue, surrounded by militia members. According to this post, this Buk had been seen there at 09.15.
Expert opinion
In addition, experts conducted a more detailed examination of this photo. For example, the Netherlands Forensic Institute (NFI) examined the photo and determined that there were no indications that it had been manipulated.
The Royal Netherlands Meteorological Institute (KNMI) then compared the meteorological conditions depicted in the photo to the known weather conditions on 17 July 2014. The two matched. On the basis of the angle of the light the KNMI determined that, if the photo was indeed taken on 17 July 2014, it must have been taken between 08.48 and 09.32 local time. With regard to the shadows in the photo, the KNMI did observe that the direction of the shadow under the white car differs from that of the other shadows. According to the KNMI this can be explained by the overlapping of various shadows. Even so, this discrepancy was reason enough to resubmit the photo to the NFI with the question of whether there were any indications that the image in the lower right had been manipulated, especially with respect to the white car and the line of the shadow.
In the NFI’s view a simple explanation for the position of the shadow could be that it is a composite shadow, i.e. a shadow formed by, for example, the shadow of the car, plus the shadow of a tree branch or an irregularity in the road surface. The NFI therefore stood by its initial conclusion that there are no indications that this photo was manipulated.
Telecom data
As mentioned previously, investigators consistently examined the reliability of all the evidence, each piece of which was then examined in conjunction with other sources of evidence. This was also the case with this photo.
In addition to examining the content of the image itself, the investigation team also examined the photo with the help of telecom data, taking the time span calculated by the KNMI as its point of departure. Within this estimated period (i.e. between 08.48 and 09.32 local time) the telephones of two members of the team escorting the TELAR transport were transmitting to the mobile phone masts in Donetsk, specifically on Illicha Avenue: the user with the number ending in -1455 between 09.08 and 09.37, and the user of the number ending in -0785 between 09.23 and 09.48.
Next, an investigation was conducted into the substance of the conversation involving the user with the number ending in -1455, when his telephone was transmitting to the mobile phone mast on Illicha Avenue 111 at 9:08:26 on 17 July 2014. In that conversation this individual escorting the transport said to the person on the other end of the line that he and the Buk had arrived in Donetsk. During that same telephone conversation the individual turned to another person who was evidently nearby and said,
‘We need to stop. Let’s stand in the left lane, occupy all of it. (…) Stand in the left one, in the left one, here.’
In the investigation this request could be compared to the tweet I previously mentioned and the photo, which shows the Buk-TELAR and the black van standing next to each other in the two leftmost lanes.
Witnesses
The photo, the tweet and the intercepted phone conversation were then compared to the statements of the witnesses who were interviewed in the course of the investigation. Various witnesses stated explicitly that the truck with the TELAR was stopped in the left lane of Illicha Avenue, as can be seen in the photo and as stated in the intercepted phone conversation.
The witnesses S27, V43 and V52 each gave statements about the TELAR transport on Illicha Avenue in Donetsk.
Witness S27 stated in 2015 that he had seen a white Volvo truck with the TELAR in the leftmost lane. Witness V43 stated in 2015 that on 17 July 2014 he saw a white Volvo truck with a Buk parked in the left lane. And witness V52 also stated in 2015 that the trailer with the Buk was stopped in the far left corner, in the far-left lane on the side of the road leading to the city centre of Donetsk.
It is striking that witness S27 also specifically mentioned that one of the escort vehicles was a dark Volkswagen T5, which also appears in the photo.
These witness statements were all made in 2015, i.e. well before the photo was made public by the JIT in 2017. When interviewed by the examining magistrate in 2019, these witnesses repeated their statements that they had seen the vehicle in the left-hand lane. The examining magistrate evaluated the reliability of these statements.
Summary
The authenticity of the photo of the TELAR on the lowboy and a dark Volkswagen van was thus assessed on the basis of open-source location data and the opinion of experts. In addition, the content of the image was compared to other forms of evidence, such as social media posts, telecom data and witness statements.
This is a good example of how the investigation validated individual pieces of evidence, where necessary with appeals for assistance from members of the public.
The launch site
We will now turn our attention to the investigation into the launch site. In September 2016 the JIT announced its provisional conclusion that flight MH17 was shot down from an agricultural field near Pervomaiskyi. We have since explained that a wide-ranging investigation was conducted into various potential launch sites. We explained how the investigators examined other locations and why they ultimately concluded that flight MH17 was not shot down from any of those sites. We will now discuss the course of the investigation into the location near Pervomaiskyi.
Photo of the condensation trail
From the start, investigators secured various open-source materials that pointed to this location as the launch site. For example, on the day itself (17 July 2014) a photo of a condensation trail was shared on Twitter. This immediately led to public discussion about whether this photo showed a missile launch and where the condensation trail came from. On the basis of the landmarks shown in the photo, various parties, including the research collective Bellingcat, analysed where the trail could have originated. All these parties came to the same conclusion: a location south of Snizhne.
Witnesses
The investigative team tracked down the person who took the photo. The photographer and their partner were interviewed as witnesses in August 2014. According to their statement the photos were taken on 17 July 2014 from their flat in Torez. Shortly after the crash the photographer took more than 10 photos, including a number of a cloud of smoke in the direction of Hrabove, the area where MH17 crashed, and two of a condensation trail in another direction. We would like to show the court two of them. The first depicts the condensation trail, which can only be seen from close up. The second depicts the cloud of smoke from the crash site. According to the photographer and his partner, the condensation trail floated over their flat. Based on the direction from which the photo was taken, the landmarks it shows and the observation of an acquaintance, the photographer concluded independently that the condensation trail had come from a location south of Snizhne.
Metadata
The witness’s camera and its memory card were seized for the investigation. First it was determined that the system date and time matched the actual date and time (Ukrainian summer time). Then the investigation team examined the metadata, concluding that both photos of the condensation trail were taken in quick succession, a little over five minutes after flight MH17 crashed. The first was taken at 16:25:41. The photo of the cloud of smoke shown here was taken just under five minutes later, according to the metadata, namely at 16:30:07.
Expert opinion
The NFI was asked to examine the memory card and the camera. Specifically, experts at the NFI looked into whether there were any indications that the secured digital photo files (Nikon Electronic Format files) had been manipulated and whether they knew of any software that could be used to manipulate this type of photo file.
The photos were also submitted to the KNMI for examination. The KNMI examined whether the clouds shown on the photos of the condensation trail were consistent with the cloud patterns shown in satellite images. The KNMI also enlarged the contrast on the photo to better assess the shape of the condensation trail. This can be seen in the photo on the left. The KNMI concluded that the condensation trail was not a cloud that had formed in a natural way and moreover that it was inconsistent with a trail left by a high-flying aircraft. According to the KNMI the trail was moving in an upward direction. Finally, the KNMI investigated both the time that the photos were taken and the perspective, on the basis of the weather conditions and wind direction on 17 July 2014. In order to determine the wind direction the KNMI again made use of a video of the smoke cloud over the crash site.
Summary
In summary, there has been extensive investigation aimed at validating the published photo of the condensation trail. That investigation yielded information about the nature of the trail and the time, location and perspective of the photo. We will show this again. This information is consistent with the main scenario, which posits that flight MH17 was shot down by a Buk missile from an agricultural field near Pervomaiskyi. You can see that scenario illustrated in this image, which shows the last location of flight MH17 on the basis of the flight data recorder and the launch site as specified in the main scenario. That launch site lies along the blue line indicating the perspective of the photo.
Journalists
In that same area to the south of Snizhne, a number of pictures and videos were taken by journalists. One journalist shot a video on 22 July 2014 of a particular location near Pervomaiskyi. In the video he described finding scorched grass at that spot on that day (22 July 2014). According to the journalist the grass was scorched in an odd way. Photos of this location taken by another journalist were also secured. In the investigation this place was termed the ‘scorch mark’.
Intelligence services
In addition to examining information from journalists, the investigation team also studied reports by intelligence services. As discussed previously, the US embassy in Kyiv posted an image on Facebook on 22 July 2014 which illustrated the flight path of a Buk missile (SA-11), originating from a location on the ground near Snizhne. A short time before, the US president and Secretary of State had already spoken about the ‘evidence’ for and the ‘detection’ of a missile originating from DPR-controlled territory. As we have said, we subsequently (in 2016) received formal confirmation that the US intelligence services had detected the launch of a Buk missile on 17 July 2014, about six kilometres south of Snizhne.
In September 2014 the Dutch Defence Intelligence and Security Service (MIVD) issued an official report, which designated a specific location as a possible launch site. This was the same location as the burned field that had previously been identified by journalists. Thus, there was every reason to further investigate this location near Pervomaiskyi, south of Snizhne.
Satellite images
Satellite images of this location were requested. Previously we spoke in general terms about the investigation of satellite images: how the investigation looked for discrepancies, such as fire damage, changes in vegetation and vehicle tracks, that could point to a missile launch. At the time, we explained that while there were no available images of this location for 17 July 2014, there were images for 16, 20 and 21 July.
When these satellite images were compared in the course of the investigation, clear differences could be seen between the one from 16 July and those from 20 and 21 July 2014.
First, in the satellite images from 20 and 21 July, there is a visible path of discolouration in the upper left corner of the agricultural field. This discolouration is consistent with scorched earth. There is no such discolouration in the satellite image from 16 July 2014. The investigation into the workings of the Buk system revealed that during the launch of a Buk missile, combustion gases are released at a very high temperature as a jet of flame. According to Almaz Antey, the company that manufactures the Buk, this combustion can cause a fire at the launch site. This burned area was then investigated further.
Using information about the wind speed and wind direction on 17 July 2014, the KNMI assessed how a fire at this location may have progressed. On the basis of this analysis the KNMI designated a specific location as the logical starting point of the fire. In the report this location is designated with the letter ‘B’. You can see this on the top photo.
The satellite images were then examined by an image analyst at the Ministry of Defence. According to the analyst, the image from 20 July 2014 shows track marks that are absent from the satellite photos of 16 July 2014. This analyst also investigated the nature, width and route of those track marks. On that basis it was possible to determine whether they came from an agricultural vehicle or a vehicle with a caterpillar tread, such as a TELAR.
Finally, the European Space Agency (ESA) compared the satellite images of this agricultural field to images from other possible launch sites. It concluded that there is an anomalous patch of ground in one corner of the field, the area we previously referred to as the ‘top left corner’. ESA refers to this area as the ‘northwestern side’. In ESA’s opinion, too, the changes observed were consistent with a fire. ESA did not find any significant changes at other, alternative launch sites.
Witnesses
The investigation into witnesses also turned up a number of relevant results. Various individuals were able to provide information about the general direction, or about a larger area from which the missile must have been launched, but not about a specific launch site. In the course of the investigation several witnesses were interviewed who stated that they had seen the missile itself or the condensation trail it left.
In addition, the investigation found two witnesses who were present at or near the launch site on 17 July when the missile was fired. In 2016 witness X48 stated that he had seen a missile being launched from an agricultural field near Pervomaiskyi on 17 July 2014. This witness indicated a specific location to the examining magistrate. This was the same location the KNMI had designated as the origin of the fire (point ‘B’).
Later in the investigation a second witness who was at this location on 17 July 2014 came forward. This was in response to an appeal for witnesses by the JIT. The witness in question, M58, was a DPR fighter and gave a detailed statement about the launch. The substance of these witness statements can be discussed during the consideration of the merits of the case. The investigation team conducted an in-depth validation of M58’s statement. As part of that process his statement was compared with information from other sources. The result of this analysis was added to the case file.
Telecom data
This branch of the investigation also involved the use of telecom data. For example, an intercepted telephone conversation that was included in the case file featured separatists discussing a missile they saw in the air. Moreover, the findings with regard to the route and the destination of the Buk-TELAR which was photographed and filmed on 17 July 2014 neatly dovetailed with the findings of the investigation into the launch site on the basis of other sources. Various intercepted phone conversations about the Buk transport specifically mentioned the location south of Snizhne as the destination.
On the basis of the telecom data, we also conducted extensive investigation involving anyone thought to have been in the vicinity of the launch site near Pervomaiskyi in the afternoon and evening of 17 July 2014. The results of this can be discussed during the consideration of the merits.
Calculating the launch site
The possible launch site was also investigated on the basis of other sources, including the nature of the damage sustained by flight MH17 and the characteristics of a Buk missile. We previously mentioned this in our discussion of the forensic investigation and the consideration of alternative launch sites. On the basis of extensive research the Netherlands Aerospace Centre (NLR) calculated a launch area of 75 square kilometres, to the southeast of MH17’s last position. The agricultural field near Pervomaiskyi falls within this area. The Belgian Royal Military Academy (RMA) calculated a launch area that partially overlaps with that calculated by the NLR. The agricultural field falls partially within this area. The specific part of the field that was identified by the KNMI and the witnesses as the launch site falls within the area calculated by the NLR and just outside the area calculated by the RMA.
Summary
To summarise: in order to establish the field near Pervomaiskyi as the launch site, the investigation team examined photos, journalists’ findings, satellite images, witness statements and telecom data. In addition, a forensic calculation was performed to determine the launch site. The findings of this investigation are highly consistent with those of the investigation concerning the route taken by the TELAR, on the basis of visual material, witness statements and telecom data. The agricultural field near Pervomaiskyi was the terminus of this route. All this was sufficient reason for the JIT to announce its provisional conclusion that MH17 had been shot down from this location.
The return route
The return route taken by the Buk-TELAR was also investigated. The same principle applied here as with our investigation of the route to the launch site: determining the route, including the times at which the Buk-TELAR passed various points along the way, could uncover new witnesses and lead to the identification of those involved in shooting down flight MH17. Furthermore, like the investigation of the outbound route, this investigation could yield information about the origin of the weapon. The findings with regard to the return route could also be helpful, moreover, in assessing the evidentiary value of findings about the outbound route and the launch location of the missile. We will show the entire return route in the main scenario, from the field near Pervomaiskyi to the border crossing near Severniy. Here too, we will present a general picture of the sources gathered: first, the telecom data, then the witnesses, and finally a video. Taken together, they paint the following picture. We will not be going into all the individual pieces of evidence now. The appropriate time for that is during the consideration of the merits.
However, we can say in general terms that fewer witnesses, images and social media posts were found in the investigation of the return route than in the investigation of the outbound route. There is a good explanation for this. As gradually became clear over the course of the investigation, the missile was transported back to Russia in the evening and night of 17 July and the early hours of 18 July 2014. It is only logical that a night-time journey would be witnessed by fewer people than one that largely took place during the day, as was the case with the outbound route. Even so, extensive telecom data was found concerning individuals that the investigation determined were involved in transporting the TELAR back to Russia.
Witnesses
There is a difference not only in the number of witnesses located with regard to the outbound and return routes, but also in the type of witnesses located. The witnesses to the outbound route are all outsiders who happened to observe the convoy containing the Buk-TELAR. With respect to the return route, investigators were able to interview an insider: one of the DPR fighters who was personally involved in transporting the TELAR back to Russia and was thus in a position to say more than a witness who had merely watched the convoy as an outside observer.
This witness, S21, was a DPR fighter who stated that on the evening of 17 July 2014 he was summoned, together with a number of others, to transport a Buk-TELAR from Snizhne to Debaltseve. This opened up leads for further investigation, particularly with regard to his telecom data and those of other parties involved in that journey.
Video shot in Luhansk
Another key element of the investigation into the return route was a video of the TELAR convoy which was shot in Luhansk. We spoke briefly about this video at the hearing of 10 March. This video was posted online as early as 18 July 2014, and it was widely shared. The video shows that the TELAR is missing one missile. We will show it now. This video was also subjected to an extensive validation process.
This is one of the images that the Russian Ministry of Defence claimed on 17 September 2018 was manipulated. At the hearing of 10 March we pointed out that this ministry had previously said, on 21 July 2014, that the video of the TELAR convoy was authentic, but that it had been shot in Krasnoarmiysk, a city under control of the Ukrainian armed forces. In this way it was suggested that the Ukrainian armed forces had used this TELAR to shoot down flight MH17. As we also previously discussed, the Russian Ministry of Defence had arrived at this location on the basis of an address that allegedly appears on a billboard in the video, even though the video shows no such address.
Public sources
Shortly after the Russian press conference of 21 July 2014, the research collective Bellingcat came to the conclusion, on the basis of public sources, that this video had been shot at a particular intersection in Luhansk. On 24 July 2014 Bellingcat pointed out a photo taken by a resident of Luhansk of the same billboard, and shared it via LiveJournal. The photo shows the billboard in sharp focus: there is no address of a car dealership. You can see that in the photo below. Above it, you can see the same billboard as presented in the press conference by the Russian Ministry of Defence on 21 July 2014. This time it includes the addition of an address of a car dealership.
Metadata
As early as 2014 the investigation team obtained the camera that had been used to shoot the video. This camera was confiscated by the Security Service of Ukraine (SBU) and handed over to the JIT. The investigators then examined the video file, the memory card and the camera itself. According to the metadata this file was created on 18 July 2014 at 04:50:10, using the same type of camera as the one the SBU had provided to the JIT. The NFI compared the metadata of the video to metadata of reference recordings made with the camera provided. They were a perfect match. According to the NFI, this suggests that it is an original video recording, shot with the same type of camera. No metadata was found that could shed any light on the location of the recording.
Geolocation
The investigation team performed its own analysis of the location of the recording on the basis of landmarks in the video and other video files on the camera’s memory card, such as a building with gold domes, a reddish brown roof, distinctive street lamps and a mast or tower of some kind. These landmarks were then compared to images in open sources, such as Google Earth. On the basis of that comparison, the investigation team concluded that the video had indeed been shot at the above-mentioned intersection in Luhansk.
Experts
The KNMI was asked to determine the time of the recording on the basis of the angle of the light. According to the KNMI, if the video was indeed shot on 18 July 2014, it must have been between 04.03 and 04.42. This is very close to the time of 04.50.10 indicated in the metadata on the video.
In addition the NFI looked into the claim made by the Russian Ministry of Defence on 17 September 2018 that this video had been manipulated. This Russian claim was immediately problematic, because four years earlier, at its press conference of 21 July 2014, the same ministry had treated the footage as authentic, asserting that it had been shot not in Luhansk but rather in territory controlled by the Ukrainian armed forces. Nevertheless, the video and the Russian claims were submitted to the NFI. According to the NFI, there are no indications that the disputed images were manipulated.
Telecom data
Like the video, the telecom data associated with the return journey was also examined. For example, the content of intercepted conversations was investigated to determine if it was consistent with the mobile phone masts that the telephones were transmitting to at that moment, and whether that content and the data from the phone masts were, in turn, consistent with the Luhansk video and the observations of witnesses.
In the investigation into the telecom data from after the downing of flight MH17, investigators looked specifically at a telephone number (+380 63 342 6335), which appeared to have been in use by a crew member of the TELAR or an individual in the convoy. This number was only active on 17 July 2014, and that afternoon it was transmitting to a mobile phone mast on the route travelled by the TELAR in Snizhne, not far from the launch site posited by the main scenario. Furthermore, investigators were able to deduce from intercepted conversations between DPR fighters that the crew of the TELAR was missing one member after flight MH17 had been shot down. When a DPR fighter was asked to contact the crew about this, he then called this same number various times, but it was not picked up. Finally, there are another eight Ukrainian telephone numbers that emerged in the course of the investigation that are identical except for the last two digits (+380 63 342 63XX). It would thus appear that these nine numbers are part of a series. Further investigation revealed that one of these numbers (+380 63 342 6331) was in use by a local commander in the vicinity of Snizhne.
There were indications that the number +380 63 342 6335 was part of a series of telephone numbers in use by the DPR and issued to crew members of the TELAR or individuals in the convoy. At the time the summons was issued, there was no way of knowing how the investigation into this particular aspect of the case would proceed. At the same time we knew it would not be easy to add additional charges to an indictment in a case where the defendants were being tried in absentia. To do so it would be necessary to suspend the proceedings and serve the absent defendant with the amended indictment. This would lead to an undesirable delay to the trial. For this reason we decided to err on the side of caution and include this element of the case (the issuing of a telephone with a Ukrainian number) in the charges against the four defendants. However, to date, this suspected distribution of telephones is not sufficiently clear for the court to find that this element of the indictment has been proven.
Summary
The investigation into the TELAR’s return route was structured in a similar way to the investigation into the outbound route. This investigation also focused on telecom data, witnesses, visual material and social media posts. Evidence was gathered from each of these categories, albeit in smaller quantities than for the outbound route. This can be explained by the fact that, in contrast to the outbound route, the return route took place late at night and in the early hours of the following day. Nevertheless, various witnesses were found and interviewed, including an insider who was involved in the transport. Investigators validated the information obtained to the greatest possible extent. For example, every aspect of the Luhansk video was examined to establish its authenticity. The results of the investigation into the return route were set out in the case file in a way that demonstrates how they interrelate; this was done in part to make it easier to assess their reliability.
The origin of the TELAR
In establishing the main scenario – that flight MH17 was shot down by a Buk-TELAR from an agricultural field near Pervomaiskyi – further investigation was also conducted into the origin of the TELAR. The investigation into the vehicle’s origin and the outbound and return route turned up indications that this TELAR was from the Russian Federation. This is discussed specifically in intercepted telephone conversations. The investigation into the context of the conflict in eastern Ukraine revealed additional indications that the Russian Federation had supplied the DPR with various weapon systems, including heavy materiel.
Comparison of the images
Another element of the investigation into the origin of the TELAR involved the comparison of images. This was done using photos and videos of the TELAR, which were taken on 17 and 18 July 2014 in eastern Ukraine according to the previously mentioned findings of the investigation. Analysis of those images indicated that one and the same weapon system was being transported continuously. These images of the TELAR in Donetsk, Makiivka, Zuhres, Torez and Luhansk show the TELAR being transported on a red lowboy pulled by a white Volvo truck. In each instance the truck with red trailer was being escorted by one or more vehicles. Only in the photo and video taken in Snizhne is the TELAR shown driving under its own power, and at that point it is headed towards Pervomaiskyi.
Features of the TELAR
The investigation also sought to identify the TELAR in question. To that end, the investigation team studied the various images of this TELAR on the red lowboy and the white Volvo truck in order to find distinguishing or unique characteristics. This resulted in 15 specific characteristics, such as symbols, markings, damage to or deformation of parts of the vehicle, and types of protection bars and road wheels. The combination of these 15 characteristics makes the TELAR captured in the photos and video on 17 and 18 July 2014 unique.
The investigation team then sought out visual material of a TELAR with that same unique combination of characteristics. To that end, it gathered 2,481 images of TELARs from various public sources, predominantly from Ukraine and Russia.
Two findings emerged from that comparative investigation. First, the investigation team found no other images among the more than 2,400 produced on 17 and 18 July 2014 which show the TELAR photographed on those same dates in eastern Ukraine. Second, the visual material from other dates featured only one TELAR that had all 15 distinguishing characteristics: a TELAR belonging to the 53rd Anti-Aircraft Missile Brigade (AAMB) of the Russian armed forces, with a vehicle number that starts with a ‘3’, followed by an illegible mark and ending with a ‘2’. In the investigation this number is referred to as ‘3X2’.
The JIT released some of the results of this comparative investigation back on 24 May 2018. At that time not all 15 characteristics were discussed. The complete comparison of the images is included in the case file. In this connection we would observe that recognising and evaluating the various characteristics of the TELAR on these images demands a sharp and patient eye. It comes down to the details: not only in terms of the characteristic itself, which – given the quality of the images – is not always in focus, but also with regard to the part of the TELAR on which a given characteristic can be found and its position in relation to the other characteristics.
Characteristic 13: road wheel
In this explanatory presentation we will confine ourselves to just one of the 15 characteristics: the anomalous road wheel on the right side of the TELAR. This characteristic was previously noted in the JIT presentation of 2018. After that presentation, further investigation was conducted, which allowed for a better assessment of this characteristic in the visual material from 17 July 2014. We will explain that investigation here, and this will shed more light on how investigators went about comparing the images.
In the case file the distinctive combination of road wheels on the right side of the TELAR is referred to as characteristic 13. This can be seen in the video of the TELAR which the investigation determined was shot in Torez. This video was provided to the investigation team in 2015. To protect the source, Dutch digital investigators have obscured part of the video, so the exact location in Torez and certain identifying details can no longer be seen. The examining magistrate has seen the full recording and has allowed the altered version to be shown. This version of the video clearly shows the vehicles in question: the TELAR, the Volvo truck and its lowboy, a dark van and a military jeep. We will now show a clip from that video. As you can see, all of the TELAR’s road wheels on the right side (from the perspective of the TELAR) are spoked wheels, except for the second wheel from the back, which has no spokes. In the case file it is also referred to as a ‘closed’ wheel.
This difference can be clearly seen in images of other TELARs’ road wheels. The spoked wheel has a hub cap in the centre, with five wide spokes affixed to it. The closed road wheel also has a hub cap but no spokes.
If the sun hits the TELAR at a certain angle, a shadow can be seen in the wheel wells. The hub cap and spokes of the spoked wheel are set less deep in those wheel wells, and this has an influence on the shadow. As a result, the road wheels with spokes cast a different shadow than the closed wheels. The shadow of the closed wheel is wider than that of the spoked wheels. On the basis of the differences in the shape of the shadow, it is possible to distinguish between the different types of road wheels.
These differences can be clearly seen in the video of the TELAR in Torez. Using a clip of the video, measurements were taken of the width of the visible shadow of each road wheel. On the basis of those measurements it is clear that the shadow cast by the second-to-last road wheel is substantially wider than that of the others. This means that it is a closed wheel.
To test this finding, 3D scans were made of both types of road wheels. These scans were then fed into a computer programme that can run shadow simulations. By inputting the date, time and location of the TELAR’s position, it is possible to generate a simulation of the type of shadow cast by each type of wheel, using the actual weather conditions and position of the sun on the day in question. If we look again at the images from Torez, we can clearly see that the shadow cast by the second-to-last road wheel is wider than that of the other, spoked wheels. That second-to-last road wheel, on the right side of the TELAR, is therefore a closed wheel.
We will now return to the longer clip of the video shot in Torez on 17 July 2014. It shows the full combination of road wheels on the right side of the TELAR: the closed wheel is the second wheel from the back, and all the other wheels have spokes. The same is true of the visual material of TELAR ‘3X2’ shot in Stary Oskol in the Russian Federation on 23 June 2014. In the image the anomalous wheel can be clearly seen.
Thus, examining the shadow formation of the road wheel allows us to better evaluate this specific characteristic – one of the 15 in total. The complete comparison of images, on the basis of all the characteristics, can be discussed during the consideration of the merits.
Visual material and social media
In light of this image comparison, the TELAR ‘3X2’ of the Russian 53rd Brigade was investigated further. This TELAR was part of a convoy that was captured in photos and videos a number of times in June 2014 in the Russian Federation. An examination of these images and social media posts revealed that this convoy left Kursk on 23 June 2014, bound for Millerovo. In other words, the convoy followed a southeasterly route along the Russian-Ukrainian border to the Russian town of Millerovo, near Luhansk in eastern Ukraine. It was a eye-catching convoy which attracted considerable attention. Over the course of its journey, the convoy was regularly photographed and filmed. These photos and videos were later found online.
By determining the location of each of these images, the investigation team was able to reconstruct the route taken by the convoy. A number of images show a TELAR with the unique vehicle number ‘3X2’ on its side.
The investigation examined not only visual material but also social media posts which mentioned the same convoy. As an example, we will cite a message posted by a soldier of the 53rd Brigade on VKontakte on 25 June 2014. In it he writes that they are on their way to Rostov, causing commotion along the way and headed in the direction of the war.
Request to the Russian Federation
On 6 April and 6 June 2018 the Public Prosecution Service submitted a request for legal assistance to the Russian Federation, asking for information about the TELAR with the number ‘3X2’. Among other things the request sought to establish the whereabouts of this TELAR between 23 June and 23 July 2014, and to obtain the names of the crew members responsible for it. On 17 September 2018 the Russian Ministry of Defence held a press conference. In it Russia stated that the images of the TELAR in Ukraine had been manipulated. Over a month later we received Russia’s reply to our request for legal assistance. In it Russia reiterated the claim that the images of the TELAR in Ukraine had been manipulated. It further asserted that the images of the 53rd Brigade in the Russian Federation on 23 and 24 June 2014 also raised questions, but that additional analysis would need to be done. According to the Russian authorities there was no evidence for the presence of a Buk TELAR in eastern Ukraine, and therefore there was no reason to answer the question about the whereabouts of the TELAR bearing the number ‘3X2’ between 23 June and 23 July 2014.
Earlier we explained how we went about validating the images. In response to the Russian claims of manipulation we had the NFI conduct further investigation. That investigation found no indications of manipulation.
We sent the Russian authorities various reminders about our unanswered questions concerning TELAR ‘3X2’, pointing out that it was not up to them to assess the quality of evidence in an investigation being conducted by another state, and noting that they could not refuse to provide information on those grounds. The governments of the JIT countries also pressed for answers at diplomatic level, but none were forthcoming.
In short, then, we received no information from the Russian authorities to suggest that on 17 July 2014 the TELAR ‘3X2’ of the 53rd Brigade was in a location other than the one that emerged in our main scenario: the agricultural field near Pervomaiskyi in eastern Ukraine.
Summary
Various steps were taken in investigating the origin of the TELAR in the main scenario. First, the images of that TELAR shot on 17 and 18 July 2014 in eastern Ukraine were compared to a large number of images of TELARs in Ukraine and the Russian Federation. In that comparative investigation, it emerged that the TELAR from 17 and 18 July 2014 matched a TELAR bearing the number ‘3X2’ which belonged to the 53rd Anti-Aircraft Missile Brigade of the Russian armed forces. Further investigation gathered images and social media posts indicating that a convoy from that same brigade was travelling along the Russian-Ukrainian border in late June 2014. The Public Prosecution Service repeatedly asked the Russian authorities to provide the whereabouts of this TELAR with the number ‘3X2’ in June and July 2014. To date, we have received no reply.
Immediate cause of the downing of the aircraft
Not every element of the investigation produced results. Of course, we also tried to establish who was operating the Buk-TELAR on 17 July 2014 and what the immediate cause was for firing the missile that brought down flight MH17. This investigation did not yield any definitive findings.
To date, the investigation has not uncovered many leads that would aid in establishing the immediate cause of the downing of the aircraft. Every lead that could be pursued was pursued.
The ‘birdie conversation’
First and foremost among those leads was an intercepted conversation that the JIT refers to as ‘the birdie conversation’. This conversation took place on the afternoon of 17 July 2014 between the DPR fighter Igor Bezler (A) and a man named Stelmakh, with the call sign Nayomnik, (B) shortly before flight MH17 was shot down. We will now play the conversation.
[…]
B: Nikolayevich.
A: Four. Yes. Nayomnik.
В: Birdman, a bird flew to you.
A: A bird flew to us?
B: Yes, one for now.
A: Reconnaissance or big?
B: Cannot see behind clouds, too high.
A: Understood, received.
B: Yeah.
A: Announce upward.
(…)’
We first mentioned this conversation in our opening statement. The investigation considered whether this conversation could have led to the decision to launch the Buk missile as described in the main scenario.
First, investigators looked at the phone lines of both Bezler and Stelmakh. That did not yield any information about any previous call to Stelmakh before this conversation. Moreover, it was impossible to determine from the telecom data whether this information about an approaching ‘bird’ was passed on to anyone else after this conversation. In this sense the conversation stands in isolation. It is unclear if Stelmakh is sharing his own observations or passing on information from a third party to Bezler.
It is also uncertain if the ‘bird’ mentioned in this conversation actually refers to flight MH17. The conversation took place between 16:18:07 and 16:18:44. We know from telecom data that at that moment Stelmakh’s mobile phone was transmitting to a mobile phone mast in the vicinity of Dzerzhynsk and that Bezler’s mobile phone was transmitting to a mobile phone mast in the vicinity of Horlivka. At the start of the conversation in question, flight MH17 had passed the location of Stelmakh’s mast two minutes earlier. The aircraft was 30 kilometres beyond Stelmakh’s mast when he reported the ‘bird’. Around that time flight MH17 was not the only aircraft in the area. At 16:18:00, shortly before Stelmakh reported the ‘bird’ on the phone to Bezler, a Boeing 777 operated by Singapore Airlines (flight number SIA351) passed the location of Stelmakh’s mast at a distance of 25 kilometres to the north.
An investigation was then conducted to determine if this conversation could have prompted the shooting down of flight MH17. The short amount of time between this conversation and the launch of the missile raises questions. Less than a minute elapsed between the end of this conversation (16:18:44) and the moment the missile is thought to have been launched (16:19:31). According to a Ukrainian training manual meant for the crew of a Buk system, it takes at least 2 minutes and 30 seconds to get the TELAR from readiness phase 2 to phase 1. This means that the ‘birdie conversation’ could have contributed to the downing of flight MH17 only if the TELAR was already in readiness phase 1 at the moment the conversation took place. In this connection it should be borne in mind that a TELAR in readiness phase 1 can be detected by enemy radar systems. It is questionable whether a TELAR would be put in that vulnerable position, in which it is visible to the enemy, without a specific reason.
When viewed in the light of the other information in the case file, our investigation mainly raised doubts about whether this conversation could have contributed to the downing of MH17, and it yielded no evidence that the information from this conversation ever actually reached the crew of the TELAR.
The Aeroflot theory
The team also investigated the claim that the missile that brought down MH17 was actually intended for an aircraft of the Russian carrier Aeroflot: flight AFL2074. The plan was supposedly to hit a Russian aircraft and then blame Ukraine for it. This theory was set out in a video presentation by the Ukrainian SBU in August 2014.
According to this presentation, the mix-up was due to the Buk system being deployed to the wrong location. Instead of the location near Pervomaiskyi, the Buk system was meant to be stationed at another location with almost the same name: Pervomaiske, 20 kilometres west of Donetsk. According to this theory the Aeroflot aircraft could have been shot down from there. This scenario was also investigated.
The investigation revealed not two, but three places with similar names. Between Stepanivka and Snizhne, there is not only Pervomaiskyi (from the main scenario), but also a place almost the same name: Pervomaiske.
The third Pervomaiske, mentioned in the Aeroflot theory, is a location considerably further away from these other two places, on the far (western) side of Donetsk.
Investigators determined that this theory does not hold water. First of all, it would be illogical to choose the Pervomaiske west of Donetsk as a launch site, because the distance from this location to the flight path of the Aeroflot aircraft (AFL2074) exceeds the range of a Buk missile.
Secondly, it is clear from the intercepted telephone conversations involving personnel escorting the Buk TELAR that they did not make a mistake with the launch site but were expressly led to the location south of Snizhne. These conversations will be dealt with during the consideration of the merits. On the basis of these findings, it was possible to quickly discard the Aeroflot theory.
The mistake scenario
All in all, the case file does not offer a full account of the precise course of events during the downing of the flight MH17 or of the immediate cause of the missile launch. The case file does, however, offer several grounds for believing that the intention existed on 17 July 2014 to shoot down a military aircraft, as we noted back in March. Intercepted conversations in the case file, the statement by M58 and the fact that immediately after the crash the DPR initially claimed responsibility for shooting down a Ukrainian aircraft all point to this conclusion.
Of course, it is desirable, particularly for the next of kin, to obtain greater clarity about the immediate cause of the downing of MH17. However, such additional clarity is not necessary for assessing the charges against the four defendants in this trial. And when it comes to determining the length of the sentences, it is principally relevant to establish what the defendants themselves knew and intended, not what was in the minds of the TELAR’s crew when they launched the missile. In terms of what the defendants themselves knew and intended, they themselves are the obvious parties to provide this information. To date, they have not done so. If this were to change, there might be grounds for further investigation. But until then, in the view of the Public Prosecution Service, all necessary investigation has been conducted into the immediate cause of the launch of the missile.
Provisional conclusion with regard to the main scenario
The investigation into all these sources of evidence, and in particular the way they relate to each other, gave the JIT a sufficient basis for announcing its provisional conclusion in 2016 that a Buk launch vehicle had been taken to an agricultural field near Pervomaiskyi, where it shot down flight MH17 and afterwards was transported back to the Russian Federation. The JIT reached this conclusion through in-depth investigation and validation. Not only did they investigate the main scenario as thoroughly as possible; they also actively attempted to refute it. A wide-ranging, in-depth investigation was conducted into other scenarios, which would rule out the main scenario, i.e.:
- that the crash of MH17 was caused by an explosion inside the aircraft;
- that MH17 was shot down by a fighter aircraft;
- that MH17 was shot down by a surface-to-air missile other than a Buk;
- that MH17 was shot down by a Buk missile from a different location;
- that MH17 was shot down by a Buk missile launched by the Ukrainian armed forces.
Within the context of the main scenario, further investigation was conducted into the origin of the TELAR. On the basis of that investigation, the JIT concluded in 2018 that it had come from the Russian 53rd Anti-Aircraft Missile Brigade and bore a three-digit vehicle identification number that began with a ‘3’ and ended with a ‘2’. After that, the comparative examination on which that conclusion was based was subjected to in-depth analysis. To date, the Public Prosecution Service has received no response from the Russian Federation regarding the whereabouts of TELAR ‘3X2’ in the period between 23 June and 23 July 2014.
Finally, within the framework of the main scenario an investigation was conducted into the immediate cause of the downing of flight MH17 by this TELAR. All leads, no matter how thin, were pursued exhaustively. This did not yield any conclusive outcome. There are, however, various indications that suggest that the intention existed to shoot down a military aircraft.
All these elements of the investigation into the main scenario are included in the case file. We have also consistently investigated the reliability of the evidence supporting the main scenario. We have explained the investigation into the visual material, telecom data and witnesses, and we have discussed how all these sources of evidence relate to each other. We believe that this investigation is virtually complete.
As we explained back in March, we see only one or two points that warrant further investigation. We will later explain the Public Prosecution Service’s current view (as of June 2020) on the status of the investigation.