It came from Russia – or who shot down MH17?

The ‘Joint Investigation Team’ in the Netherlands has concluded that Malaysia airline MH17 which was shot down over Ukrainine in July 2014 was shot down by a BUK missile system which ‘came from Russia’.

The Investigation Team was made up of representatives from Australia, Belgium, Malaysia, the Netherlands and Ukraine. 4 of these countries are currently engaged in waging economic warfare against Russia the express aim of which is to wipe Russia off the map. [1] Much of the evidence for the inquiry was supplied by the intelligence services of the country in direct conflict with Russia – Ukraine. It is an accepted part of the role of intelligence services to supply either fabricated or at least selectively misleading information in pursuit of their national interests. The inquiry has no basis of credability. It is hardly news that it found that the missile launcher came from Russia.

The press release of the Joint Investigation team makes interesting reading. [2] We can note the following:

The text claims irrefutable evidence that the flight was shot down by a BUK missile. But we can note that the claim relating to where the missile was fired from (a field in militia held territory) is not described as irrefutable.

Nonetheless the report claims that the BUK missile was driven into Ukraine from Russia. This is the relevant text:

The JIT has been able to identify a large part of the route concerning the arrival and the departure of the BUK-TELAR. This was the result of intercepted telephone conversations, witness statements, photographs and videos that had been posted on social media, and a video never shown before which was obtained from a witness. The system was transported from Russian territory into eastern Ukraine and was later transported on a white Volvo truck with a low-boy trailer. The truck was escorted by several other vehicles and by armed men in uniform.

Once again – social media seems to feature surprisingly heavily in accusations of ‘Russian involvement’ – and in places where you’d least expect it – such as State Department briefings and criminal investigations. One would hope that justice in an ordinary court in the Netherlands does not depend on “photographs and videos that had been posted on social media”.  The intercepted telephone calls were provided it seems by Ukrainian intelligence (at least such calls were released by them very soon after the event). The “video never before shown” sounds like a trailer for an edition of Crimewatch, not a serious piece of investigation. And, again, one wonders who supplied this material? Was the investigation team aware that videos can be fabricated? That, for example, a video shot at twilight of a BUK missile launcher with an empty tube clearly visible driving through a village in the direction of Russia could be staged theatrically?

More information on the “intercepted telephone calls” including audios of the calls themselves can be found on the Joint Investigation Team’s web site. [3] The case that the militias were supplied with a BUK missile system from Russia seems to depend on these calls. That the calls are what they purport to be we have to take on trust… The claims about the location from which the missile was fired seem to depend on unnamed witnesses. (It is also possible that two missiles were fired – one destroyed MH17 and one missed another target. In this scenario the witness sightings may be valid but not the proof they are taken to be).

Immediately after the downing of the flight the US claimed to have satellite data showing that the missile came from militia held territory. [4] This information has never made it into the public domain. However it seems that intelligence staff from the US have briefed the investigation and this briefing is claimed to be material which could be ‘used in  court’. (In fact anything can be ‘used in court’ so it is not quite clear why this meaningless phrase appears in the report, other than to add shine to some shaky evidence):

In response to a Dutch request for legal assistance, the US submitted a report in which they present their assessment of the information regarding the shooting down of flight MH17. This report can be used in court. The conclusion of the American authorities is that flight MH17 was shot down by an SA-11 surface-to-air missile, i.e. a BUK-missile, which was launched from a site about six kilometres south of the village of Snizhne in Eastern Ukraine. This is consistent with the distance to aforementioned launch site near Pervomaiskiy. The US also explain how they reached this conclusion. In addition, they mention that they are sure of the fact that the Ukrainian air defence systems could not have done it and that an air-to-air scenario is impossible.

The Dutch Military Intelligence Service (MIVD) and the (Dutch) National Public Prosecutor on Terrorism have been able to view the underlying state-secret (intelligence) material and based on that information and the explanation provided, they support the fact that this conclusion is drawn. [3]

Again – we can ask is a claim by a highly interested party that they are “sure” one side (their allies as it happens) “could not have done it” really a normal standard for a criminal trial? Obviously not.

The political, media and think-tank classes in the West have been screaming for 2 years that Russia is arming the militias in Eastern Ukraine and is denying it. Ie. the claim is that Russia is operating a policy of plausiable denilability. It is very difficult to see how to equate this policy (if it is indeed the policy of Russia – which it may well be) with supplying a BUK missile system to the militias. Such a system – even without the tragic shooting down of a civilian airliner – would quite obviously be traced to Russia. Other aspects of the story developed by Ukranian intelligence are unlikely. For example; they spent months telling everyone about convoys of Russian armour crossing the border but were not able to provide photos or videos. But straight after this event they happened to have an agent in place who was able to film the BUK missile launcher being driven back to Russia with one of its missile tubes guiltily empty. [5] If this really was the implicated BUK launcher surely someone would have thrown a tarpaulin over the back of the truck? And – what about the ‘armed men’ who the JIT claims accompanied the truck on its way into Ukraine? [2] No sign of them on the way back.

There are 4 main possible scenarios of how this tragic event happened:

1. It was a plot by a cell within the Ukrainian intelligence to frame Russia and whip up support for their cause in the West. Certainly there was a strong feeling amongst the post-Maidan Ukrainian nationalists that the West was not fully supporting them and did not appreciate how dangerous Russia was. What better way of changing this attitude than shooting down a jet full of Dutch holiday-makers and pinning the crime on Russia?

2. It was accidentally shot down by Kiev’s forces mistaking it for a Russian jet. They had been claiming that Russian fighter jets had invaded their air-space. Russia showed satellite imagery which they claimed showed Kiev’s BUK’s deployed within range of the destroyed airline. [6] This has not been explained.

3. The militias captured an old BUK system from the Ukrainian army. Not knowing properly how to use it they made a mistake and shot down a civlian airliner. This is quite possible. However; the Ukranian Ministry of Defence has repeatedly said that all their BUKs were accounted for. [7] Without this statement this hypothesis would have to be seriously considered.

4. Russia supplied the militias with a BUK – either with or without operatives. Since it would not have been in the militias’ interests to shoot down a passenger plane this scenario envisages a mistake being made. This in turn suggests untrained operators. Would Russia really hand over one of their advanced air-defence systems to the militias in Eastern Ukraine and leave them to get on with it? There is also an insiduous suggestion from the JIT that it could have come from Russia but without state involvement. [8]

A final possible scenario is a combination of 1. and 4. or 1. and 3. The militias shot down the civilian airliner but they were tricked into doing so by a Kiev fighter jet luring them to launch a missile close to an airliner.

As long as the investigation is conducted by one side and is based on ‘intelligence’ material provided by intelligence services of countries who are party to the conflict we cannot sensibly rely on it. At this point then a rational person cannot form a definite view.



1. As is graphically depicted in this State Department video.


3. Full report by the Joint Investigation team. Audio:







The Bellingcat report on MH17 and the media treatment of it

After the tragic downing of Malaysian airlines flight MH17 over Ukraine the Russian Defence Ministry released some satellite images at a conference. They said that these showed Ukrainian BUK missile systems which were within range to have shot down the Malaysian plane.

A UK based blogger called Eliot Ward Higgins appears to be the sole director of a Ltd company called Brown Moses Media Ltd. [1] Eliot Ward Higgins runs a web site called Bellingcat. He has released a report in which he claims to have shown that the Russian satellite images were manipulated in Photoshop. [2]

According to the Guardian Mr Higgins has “a background in finance and administration”. He was “made redundant” in October 2013. He has “taught himself” “how chemical weapons are made, how to use Google Earth so that he can pinpoint the exact place footage was filmed, and how to identify shells and find out where they come from”. [3]

The reality then appears to be that Mr Higgins is a solo operator, with no professional background in forensic image analysis. He uses social media and Google Earth for his stories. This has not stopped the Western press describing his operation variously as:

“investigative journalist organisation Bellingcat” and “Bellingcat investigators” (Daily Mail) [4]

“Bellingcat investigative group” (Daily Telegraph) [5]

“Investigative group” (Huffington Post) [6]

Mr Higgin’s report is available online. [7]. He analyses just two of the images provided by the Russians.

Mr Higgins”s main methods appear to be i) he looks at the meta information in a file, ii) he looks to see if the jpeg compression levels are evenly distributed across an image – a procedure known as Error Level analysis (ELA), and c) he compares them with Google Earth.

Mr Higgins first presents his “Forensic analysis” of Image 4. (Images 4 and 5 can be seen on the Russian Ministry of Defence web site and on RT and of course in Mr Higgins”s report). – In passing we can note that the images on the Russian Ministry of Defence web site – which Mr Higgins says he used in his report [7] – are at 900px x 600px and are unlikely to be originals. And as the tutorial on Error level analysis explains to get the best results you should use the originals. However there are more serious problems than that.

Based on his “Error level analysis” Mr Higgins claims to be able to show that parts of Image 4 were “added later”. He explains that “It is highly probable that clouds were digitally added on the left and right sides of the image, which obscured details that could have been used for additional comparisons with historical imagery.” We discuss Error Level analysis below and explain how it should be used correctly. (Even then it is an interpretative skill not a science).

Mr Higgins’s next step is to look at 5 images from Google Earth taken over a period of time and of the same area as Image 4. Based on an analysis of vegetable growth he claims to be able to date the Russian image to a date some weeks earlier than the date given for the image by the Russian Ministry of Defence. The Russians said that it was taken on 17 July.

His next step is to use a similar method to re-date the image focussing on another section. This time the comparator is what he explains is a pool of oil leaking from a vehicle. The pool is bigger on 19 June (from Google Earth) than it is in the Russian images. Therefore the Russian images were taken before 19 June (not on 14 and 17 July as the Russians claim) because; “It is common knowledge that a leaking liquid tends to pool, and that, over time, the pool grows as more liquid is added”.

Then he returns to his vegetable analysis. Again he uses Google Earth to show that a certain area in the image was covered with vegetation by June 19 whereas in the image produced by the Russians it was covered in soil. Therefore the image must date before 19 June. Indeed “It can therefore be stated unequivocally” that this is the case.

He then addresses himself to a second of the Russians” 5 images.

Here again he uses the technique of comparing what is on the ground; this time he compares “soil structures”. He compares Image 5 with another one the Russians said was taken a day later (Image 6) with two images from Google Earth. Based on a part of the image from the Russian images (Image 5 and 6) being darker than the Google Earth ones taken on 16 July and 13 September he explains that Image 6 must have been taken prior to 16 July and therefore (presumably because the Russians said it was taken a day previously) Image 5 must have been taken before 15 July. The Russians said that Image 5 was taken on 17 July. The logic of lighter and darker soil colours is not actually explained. That is it is not clear why darker soil means an image must have been taken before one which has lighter soil. Though we are told that “We can therefore conclude beyond a doubt that Picture 6 was not taken after 15 July 2014…”

So, for Image 5 the “Bellingcat team” explain: “We assess with a high degree of probability that a number of areas of the original satellite image were digitally altered.” And that it was taken before July 15 not on July 17th as the Russians said.

That’s it. Quite a disappointment really.

There is quite a lot of “probably”. There seem to be certain assumptions that dark patches are “oil”. There is a gaping hole in the vegetation method of analysis – and the “oil pool” analysis. He does not appear to allow for the possibility that oil pools (if that is what it really is) can be cleaned up and then re-occur. That fact alone collapses his analysis. I’m not sure what the darker/lighter soil is supposed to indicate but, again, compost can be dug into a field making it darker. Or it can rain. Poly tunnels can be put in place and removed. Whatever; it seems quite possible that a piece of ground can appear light on 16 July, darker on the 17th and then light again on 13 September. It is also worth pointing out that he is comparing images taken with different imaging systems and processed in different ways. Despite the word “forensic” being littered all over the place he does not appear to have considered issues of calibrating his devices.

Error level analysis is explained on this web site. And on this one. Mr Higgins may have used the free tools on the first of these sites – called Fotoforensics. The text in his report describes Error Level Analysis thus:

Error level analysis (ELA): Error level analysis (ELA) identifies areas within an image that are compressed at different levels. With JPEG images (the format of the photographs under consideration here), the entire picture should be at roughly the same level of compression. If a section of the image is at a significantly different error level, then it likely indicates a digital modification.

And this is the same text as on the Fotoforensics web site.

Error Level Analysis (ELA) identifies areas within an image that are at different compression levels. With JPEG images, the entire picture should be at roughly the same level. If a section of the image is at a significantly different error level, then it likely indicates a digital modification.

Though the same text does appear to have been copied quite widely across the web.

Error level analysis works like this: a image is compressed and then compared to the original. All compression introduces a degree of error. When the compressed image is compared to the original it is possible to work out how much the error level is for each part of the image. The error level is how far off it is when you try to re-constitute the original from the compressed version. In general areas of pure colour compress well. These have low error levels. This is represented as black in an Error Level image. Areas with more detail, such as areas where there are high contrast boundaries, will compress less well. These are represented in an Error Level image as white areas. For example the unmodified image of the bookshelves in the tutorial from the Fotoforensics site shows how the pure white book has a low error level represented by black whereas the other books have a higher error level represented by white. Note that this is an unmodified image and still has white and black areas in its Error Level image. Referring to the same tutorial we can see an example of how a modified image can be detected by Error Level analysis. The image with the dinosaur and the books shows how these elements have been added digitally. Note that the point is that the added in books differ from their surroundings. They have been added in after the image has already been saved. If they had not been added in we would expect them to have the same error level as the other books around them. This concept is explained in this tutorial as well (on the original Error Level analysis web site). Note that in this image the vertical line in the wall at the left shows as white in the Error Level analysis image. This is because it is an area of high contrast with its surroundings. It has not been digitally altered. The areas on the lips, eyes and shirt have been. These areas show as having a different error level than their surroundings.

We can note that Error Level analysis is not an exact science. It is an interpretative skill. You have to understand it conceptually to use it. Even then as the words of the Fotoforensics tutorial explain:

ELA is only one algorithm. The interpretation of results may be inconclusive. It is important to validate findings with other analysis techniques and algorithms.

Mr Higgins applies Error Level analysis to the two images he analyses. These are Images 4 and 5. (These images are available here. And of course Mr Higgin’s Error Level images are in his report).

Mr Higgins claims that Error Level analysis shows that Image 4 has been digitally modified and it is “highly likely” that clouds have been added. This is a mistake. The ELA image he prints shows a swathe of white speckled area across the centre of the image and black either side. This is exactly what we would expect. The area in the centre has more detail. The areas at either side are clouds. These areas are blockier. They compress better than the centre area with its detailed landscape. Thus the centre area has some white speckling and the sides are black. This is the same as the unmodified image in the tutorial. Mr Higgins includes an image from Google Earth as a “reference photo” and he shows the ELA image for this. This shows the same pattern: a white area in the middle where there is more detail – in the landscape – and darker areas either side where there is cloud. These patterns are just what we would expect with an unmodified image of this kind.

Mr Higgins makes the same mistake with Image 5. Here he shows an ELA image which shows vehicles in a field. The vehicles show as white in the ELA. And the surrounding field as black. Mr Higgins and his team believe that this makes it “highly probable” that the images have been altered. Again; this is what we would expect. The soil is a uniform colour and so compresses well. Hence the black in the ELA image. The vehicles have more detail (as well as contrast with the soil) so there is a higher error level in these areas. Again; the reader can look at the sample unmodified image in the tutorial and observe the same result. Blockier areas of pure colour come out black in the ELA and areas with more detail as white.

To determine that an image has been modified with Error Level analysis you have to look at similar features (similar in terms of texture and adjacent to each other) and compare them. This is how in the tutorial we can detect that the books have been added. They are of the same level of detail as their surroundings so they should have the same error level. They don’t. Hence we know (or may believe) that they have been digitally added. In the case of these satellite images what Mr Higgins would need to do is show how the error levels differed between two vehicles parked next to each other. (Even then we would be making certain assumptions such as they both had similar markings. Most Error Level analysis examples and tutorials do not envisage working with satellite images and this clearly creates its own set of problems).

Apparently RT invited Mr Higgins to be interviewed and he declined. That is hardly surprising. [8]

The point of this really is how such a bungled report by someone with no professional background in this subject has been picked up by several papers. The author’s (apparently) one man company is described as an “investigative journalist organisation” or “investigative group” and the shaky material is promoted as “”Clear and unequivocal” that Russia faked MH17 evidence”. It is alarming that the anti-Russia campaign has reached the level where even the mainstream press will print this sort of stuff from the “blog-sphere” and treat it as credible.

[On a technical note. Error Level analysis works because every time a jpeg image is saved some compression takes place. Artefacts which are added after one or more initial saves will be subject to less overall compression and will have a lower error factor. Anyone who wanted to manipulate an image and avoid detection by Error Level analysis would simply need to keep the image in (for example) Photoshop until all the editing was complete and then make a single save to a jpeg.]


1. Mr Higgin”s company number is on his web site and you can look up the Company directors at Companies House.