MH17 Three Years Later: What Have We Learned?


If you can’t explain it simply, you don’t understand it well enough. -Einstein

Three years and a day ago, about noon local time, Malaysia Airlines Flight 17 (MH17) pushed back from Gate G3 at Amsterdam’s Schiphol Airport en route to Kuala Lumpur. Just over three hours later, the aircraft — a Boeing 777-200 — crashed in a rural area of eastern Ukraine, killing all 283 passengers and 15 crew on board. Three years later, the public — not to mention the families of the dead — ought to have definitive answers to two key questions: What physically caused MH17 to crash? And, who was responsible?

However, what followed the immediate tragedy is one of the most convoluted attempts in recent memory to attribute causation  and responsibility in a major international incident. The complexity of the forensic examinations and criminal investigations into the crash has been daunting. As a result, official results have come out in drips and drabs over the course of months and years. Indeed, the final report from the authorities regarding criminal charges against the perpetrators is still pending as the investigators seek to interview all possible witnesses and analyze thousands of evidentiary items.

Further, Russia, an interested state actor, mounted a massive disinformation media campaign to discredit official reports and to impede investigations. From the beginning, the Russian government has sought to deny and obfuscate its own complicity in the deaths of nearly 300 innocent people. Had Moscow not undertaken such an obstructionist strategy, the investigations would no doubt have progressed more quickly, and the results would have been more universally accepted.

Thankfully, citizen journalists and civil society analysts, such as Bellingcat, helped mitigate these problems. They assiduously compiled detailed evidence from a variety of social media and other unofficial sources, making major contributions to the effort to determine what actually happened to MH17. This experience is the latest and most significant example of how publicly-sourced information enables greater transparency in such matters, especially when governments refuse to release relevant data out of concerns for protecting sources and methods.

By reviewing the official and publicly-sourced evidence now available — and despite the Russians’ best efforts at obfuscation — we do now know with certainty the answers to our two questions.

MH17 on July 17: The Basics

Departing Schiphol, MH17 climbed to an altitude of 33,000 ft on a route that took it over Germany, Poland, and then into Ukrainian airspace. The aircraft followed standard civil aviation flight routes and was under continuous air traffic control throughout, being acquired in sequence by successive radar tracking stations until it reached the tracking station in Dnipropetrovsk (known as Dnipro Radar), which exercises radar control over southeastern Ukraine, and which established radio contact with MH17.

After that initial contact, and following a series of routine exchanges of information over 27 minutes, controllers lost radio and then radar contact with the aircraft. A series of increasingly urgent attempts to regain radio contact with the aircraft were unanswered. Dnipro Radar contacted the adjacent Rostov tracking station, which handles air traffic in southwestern Russian airspace — through which MH17 was programmed to fly next — for assistance, but Rostov was also unable to locate or contact the aircraft. Dnipro Radar requested a nearby Singapore Airlines flight to visually acquire MH17, and check their onboard collision avoidance system for any sign of the missing aircraft, also to no avail.

The worst possible explanation for MH17’s disappearance from air traffic control radar became clear soon enough, as dozens of images of aircraft debris, body parts, and personal belongings of passengers began appearing on social media almost immediately after MH17 hit the ground. These 298 victims had found themselves among the casualties of ongoing armed hostilities between Ukraine and Russia.

The MH17 crash site was in an area of eastern Ukraine known as the Donbas, where active fighting was (and still is) underway in a conflict that had rapidly escalated from civil unrest in March 2014, to full-scale combat by July. The Russian government, which backs local separatist militias and provides them with arms, advisors, and paramilitary fighters, had already intervened directly in the conflict (although Moscow steadfastly denies this) and was steadily upping the ante in terms of its support both in men and more sophisticated weaponry.

The Official Investigations

As the full scope of the tragedy became clear through international mainstream media, calls for an urgent investigation followed from European and other leaders. On July 21, the U.N. Security Council unanimously passed Resolution 2166, which, among other things, “[s]upport[ed] efforts to establish a full, thorough, and independent international investigation into the incident in accordance with international civil aviation guidelines.”

Nowhere was the grief and anger more intense than in the Netherlands, which had 193 of its nationals on the flight. Under international civil aviation regulations, Ukraine had primary jurisdiction for the MH17 crash, which it delegated to the Dutch Safety Board — the Dutch civil authority for safety investigations — on July 23. The board’s mandate was to determine the cause of the accident, but not to attribute blame to any party. The essential documents that were published by the Dutch Safety Board are its preliminary report (September 2014) and final report (October 2015). In August 2014, the Netherlands took the lead in forming the Joint Investigation Team tasked with conducting a criminal inquiry into the shooting down of MH17 in order to “arrive at conclusive and convincing evidence that will stand firm in court.”

The Joint Investigation Team issued its interim report in September 2016, but its final report is still pending until all witnesses can be interviewed, all possible evidence examined, and individual suspects identified. All of these reporting agencies, by design, operated independently. Their investigations overlap, allowing crosschecking and confirmation of most findings.

Well Inside the Frag Envelope

Although the Dutch Safety Board team faced serious challenges in getting to the crash site (which was in contested territory and largely unsecured), investigators were able to obtain the aircraft’s cockpit voice recorder and flight data recorder, as well as photographs of sections of the fuselage (the aircraft had broken up in midair, and the wreckage was scattered over some 50 square kilometers). In its preliminary report, the Dutch Safety Board stated that analysis of the cockpit voice recorder and the flight data recorder confirmed the radio transcript from the Dnipro Radar station, which indicated that no distress calls were made. Further, there were no discussions among the flight crew or audible warnings in the cockpit, nor did systems data indicate problems with the aircraft.

However, the vital point is what the Dutch Safety Board found from scrutinizing the wreckage photos:

[T]he pattern of damage observed in the forward fuselage and cockpit section of the aircraft was consistent with the damage that would be expected from a large number of high-energy objects that penetrated the aircraft from outside.

In other words, pending more detailed analysis, the Dutch Safety Board began to focus on MH17 having been shot down, ruling out an onboard bomb explosion or other causes originating inside the aircraft. The question became: shot down by what?

Initial reporting from official sources, including the U.S. government, indicated that a surface-to-air missile was responsible for bringing down MH17, but it would take another 13 months for the forensic evidence to establish that as fact. During that period, the Dutch Safety Board painstakingly collected parts of the aircraft and transported them to the Netherlands for reconstruction and forensic analysis. They also conducted numerous ballistics simulations and ran computer models of possible missile trajectories to evaluate likely launch points.

Given MH17’s flight parameters and the extent of destruction done to the aircraft, investigators were able to rule out two of the three possible missile types (air-to-air or short range surface-to-air) that could have brought the aircraft down, or air-to-air cannon fire. This left only the third option, a powerful surface-to-air missile that incorporated both a large warhead and a high-altitude capability.

By analyzing hundreds of fragments recovered from the aircraft and bodies of the flight crew (120 fragments were found in the first officer’s body alone), the Dutch Safety Board identified the warhead as a 9N314M — a type compatible with only one model of SAM: the Russian-manufactured 9M38/9M38M1 “Buk” (NATO designation SA-11 Gadfly). Small pieces of metal identifiable as parts of a Buk missile were found in the vicinity of the crash and paint samples from those matched small foreign metal objects found in the aircraft wreckage.

Location, Location, Location: It Really Does Matter

With the cause of the aircraft’s destruction established as a surface-to-air missile, the next task was to determine the launch site. Given that the front lines between Ukrainian government and separatist forces at that time were fluid, the launch site would likely reveal the perpetrator. The Dutch Safety Board proposed a geographic area for further investigation, but — because it was not responsible for assigning blame — it did not pursue the point further.

However, the Joint Investigation Team was tasked to assign blame, and they did so in their interim report in September 2016. After confirming the Dutch Safety Board findings indicting a Buk 9M38 series SAM, the Joint Investigation Team produced evidence showing that the missile in question was launched from a field just outside the settlement of Pervomaiskiy — an area controlled by the pro-Russian separatists on the date in question.

In a series of animations, the Joint Investigation Team explained how it geolocated and recorded telephone conversations among separatist commanders who had requested that type of missile to counter air attacks by the Ukrainian Air Force. They also explained how telephone intercepts and geolocated photos and videos revealed the route taken by the transporter carrying the missile to the launch site on July 17.

By comparing time-sequenced satellite images, testimony of eyewitnesses, and photos of the missile’s smoke plume, the team determined precisely where the launch site was (including a patch of scorched farmland caused by the missile launch blast). Finally, they tracked the same missile transporter-launcher vehicle crossing back into Russia on July 18 — and this is important — with one fewer missile than it had onboard when it entered Ukraine. As convincing as the Joint Investigation Team report was, the Russian government objected strongly to the findings and launched a major effort to counter them.

The Russian Disinformation Campaign

One must admire the agility and creativity with which Russia’s state-owned media and official information outlets are able to generate story-lines supportive of government positions. On no occasion has Russia’s ability to spin information been on better display than during the MH17 crisis. Within hours of the crash, a variety of Russian sources — both government controlled and oligarch-sponsored freelancers — circulated various theories of the MH17 crash that deflected attention from Russian complicity. Online, trolls and bots piled on to narratives that served Kremlin interests.

In an impressive display of disinformation — just 4 days after MH17 was shot down — Russia’s Ministry of Defense held a briefing replete with convincing graphics and satellite imagery. Here, senior military officers presented two different scenarios that assigned blame to the Ukrainian military. One of these scenarios involved a Ukrainian missile, and the other a Ukrainian aircraft. Notwithstanding the fact that only one of these could have been true — and that both were later definitively debunked — the “evidence” quickly circulated through social media.

Then, in October 2015, the Russian defense firm Almaz-Antey — which produced the type of missile used to bring down MH17 — organized a press conference to demonstrate that investigators had misidentified the warhead, claiming that the “actual” warhead was no longer in Russia’s arsenal, but was in Ukraine’s.

Despite the fact that Russia was an official party to the investigation, Moscow denounced the Dutch Safety Board’s final report. Finally, on September 26, 2016, the Russian Ministry of Defense held another press conference at which Russian officials dismissed their own July 2014 findings blaming Ukraine. Instead, they alluded to newly-discovered radar data that ruled out any missile launch from separatist-controlled territory. These data, after a long delay, were eventually turned over to the Joint Investigation Team, but not in an internationally recognized format. As such, their evidentiary value was nil. This gambit is consistent with the obstructionist approach adopted by the Russians from the outset.

The Citizen Techies

I wrote previously in War on the Rocks about the extraordinary growth and technical sophistication of public-sourced information on matters of national security. In my article, I pointed out that this new type of data might, with appropriate caution, better illuminate events in crisis situations. This rapidly expanding capability owes especially to burgeoning internet and social media connectivity — both in terms of collection and dissemination — and the growing ability to geo-locate events or things via GPS.

The much greater resolution and coverage of commercial satellite imagery and the ubiquity of smartphones capable of shooting video have also added vast amounts of publicly accessible information. In the case of MH17, this information was synthesized almost immediately, providing a fairly informed view of the basic outlines of what happened within a day of the event.

By employing digital forensic tools, and by putting in thousands of hours of painstaking work to verify the authenticity of collected photos and arcane but important details, crucial evidence was brought to bear on key aspects of the search for answers to the MH17 puzzle.

The focus of publicly-sourced research on MH17 has been primarily on the provenance of the suspect missile (now known to be the Russian Army’s 53rd Anti-Aircraft Missile Brigade). Using publicly-sourced intelligence from social media, analysts were able to document the journey of the specific missile transporter-launcher vehicle from its base near Kursk, Russia, to eastern Ukraine, and then back to Russia. Likewise, investigating possible missile launch sites — including the attempt by Almaz-Antey to alter its own original proposed launch area to another that conformed to the Russian government’s changing storyline — complemented the official findings.

The work of the amateur analysts, especially those at Bellingcat, has been crucial in exposing the misdeeds that resulted in the deaths of 298 people aboard MH17. Indeed, over the last three years, publicly-sourced intelligence has matured to the point that the Dutch used it in the investigations. Further, the fact that the Russian government made such an overt effort to disparage their analysis — unsuccessfully, I might add — further underscores the effectiveness of publicly-sourced information.

Three Years Later

On July 29,, 2015, just over a year after the MH17 was shot down, the government of Malaysia brought a resolution to the U.N. Security Council seeking to establish an international tribunal that would prosecute those responsible for the act. Not surprisingly, Russia, a permanent member of the Council, vetoed the resolution. Two years after that veto, on July 5, 2017, the Dutch Foreign Ministry announced that it would try in Dutch courts any suspects identified by the Joint Investigation Team. This is a tall order, given that Russia will not extradite its citizens. Additionally, any suspects in the separatist regions of Ukraine remain outside the remit of the Ukrainian government, at present.

However, we do not need to wait for the trials of particular suspects to answer the two big questions at the heart of the matter. First, it was the detonation of the warhead on a Russian-made missile that caused MH17 to crash. Second, that particular missile was supplied by the Russian military to its separatist clients in eastern Ukraine, making the Russian state partially responsible for the deaths of those 298 people. That missile was launched from territory controlled by the separatists, making them also responsible. Other contributing factors, such as the failure of the Ukrainian government to close its airspace over the contested eastern regions and the lack of specific threat information to civilian airlines require corrective action, but are not the proximate causes of this disaster.

Notwithstanding the many and varied attempts by Moscow to cloud the MH17 matter through dissimulating tactics, it defies common sense that the Russian leadership was not culpable. Their failure to acknowledge complicity is fully in keeping with their recent behavior.

To deal with such situations, the United States and other democratic governments must be prepared to employ their full range of investigative powers (as the Dutch certainly did), engaging more fully with open-source citizen analysts to achieve the level of transparency that the public deserves.


Ralph S. Clem is Emeritus Professor of Geography at Florida International University, and is a retired Air Force Reserve intelligence officer.


Image: Dutch Ministry of Defence