Origin of the Separatists' Buk: A Bellingcat Investigation

Summary

This report analyses evidence from open sources, in particular social media, relating to the Buk missile launcher filmed and photographed in eastern Ukraine on July 17^th that many have linked to the downing of Malaysia Airlines Flight 17.

While other open source information is available on other aspects of the downing of MH17, the Bellingcat MH17 investigation team believes that this particular investigation provides solid information about the origin and movements of the Buk filmed and photographed on July 17^th. The Bellingcat MH17 investigation team also believes that many of the unresolved questions about the downing of MH17 will be answered by the official investigation, and our investigation was made possible by the examination of open source material overlooked by other organisations.

The report is split into three sections. The first examines the open source evidence relating to the movements of the Buk in eastern Ukraine on July 17^th, the second presents evidence that the Buk filmed and photographed on July 17^th originated in Russia and was part of a convoy headed towards the Ukrainian border in late June, and the third looks at the activity of vehicles seen in the same convoy after July 17^th.

It is the opinion of the Bellingcat MH17 investigation team that there is undeniable evidence that separatists in Ukraine were in control of a Buk missile launcher on July 17^th and transported it from Donetsk to Snizhne on a transporter. The Buk missile launcher was unloaded in Snizhne approximately three hours before the downing of MH17 and was later filmed minus one missile driving through separatist-controlled Luhansk.

The Bellingcat MH17 investigation team also believes the same Buk was part of a convoy travelling from the 53^rd Anti-Aircraft Missile Brigade in Kursk to near the Ukrainian border as part of a training exercise between June 22^nd and July 25^th, with elements of the convoy separating from the main convoy at some point during that period, including the Buk missile launcher filmed in Ukraine on July 17^th. There is strong evidence indicating that the Russian military provided separatists in eastern Ukraine with the Buk missile launcher filmed and photographed in eastern Ukraine on July 17^th.

A PDF version of this report is available – Origin of the Separatists’ Buk A Bellingcat Investigation.

The report is now available in German here

The repoort is also now available in French here.

Explore a map showing the separatists’ Buk and June and July convoys in Russia here.

Section One: The July 17 Buk

In the aftermath of the downing of MH17, photographs and videos were posted on social media sites claiming to show a Buk missile launcher in areas close to the MH17 crash site. Using a variety of tools and techniques, the Bellingcat MH17 investigation team has been able to establish the exact location at which these images were recorded and the approximate time that many of the images were recorded. Based on this information, the investigation team has mapped the route of the Buk missile launcher through separatist-controlled territory in eastern Ukraine on July 17th.

Photograph from Paris Match of the Buk missile launcher in Donetsk, Ukraine, July 17, 2014.

Donetsk

On July 25^th, the weekly magazine Paris Match published a photograph of a Buk missile launcher being transported on a low-loader truck through the separatist-controlled city of Donetsk. The location of the photograph was precisely located, showing an eastward direction of travel along the H21 motorway.

Inquiries by Storyful with Paris Match established that the photograph was taken at “about 11 am on the morning of July 17.” Shadows cast by the vehicle are consistent with this time of day. Paris Match also confirmed this was the best quality version of the image available. A Twitter post from 12:32PM (local time) on July 17 reports the sighting of a Buk at the intersection of Shakhtostroiteley Boulevard and Ilych Avenue heading east in the direction of Makiivka. This tweet supports the location and route provided by the Paris Match photograph. Using the phone number on the side of the low-loader truck, Paris Match contacted the owner of the company, who claimed the truck had been stolen by separatists and that the vehicle was unique in the region.

Screenshot from footage filmed in Zuhres, Ukraine, July 17, 2014.

Zuhres and Shakhtarsk

On July 17th a video was uploaded to YouTube showing the Buk photographed in Donetsk travelling through the town of Zuhres, approximately 36 kilometers east along H21 from the location in the Paris Match image. Using information provided with the video, it was possible to find the exact location the video was filmed, the H21 motorway running through Zuhres, and to show the Buk missile launcher continued to travel east. It was also claimed in a now-deleted Tweet that the video was filmed at around 11:40am, although it has not been possible to verify that time with available information. A tweet posted at 12:41PM (Kyiv time) reports that three tanks and a Buk covered in netting passed by Shakhtarsk, a city that lies east of Zuhres and west of Torez, connected by the H21 motorway.

Photograph from Torez, Ukraine, July 17, 2014.

Torez

The above image was shared widely during the evening of July 17^th. The Bellingcat MH17 investigation team has been unable to find any earlier example of the photograph being shared than a post made by a user of the Russian social media site VKontakte (VK) at 8:09pm (Kyiv time) on July 17^th. The investigation team suspects that the image was originally posted in the “Overheard in Torez” VKontakte page, but has since been deleted. It was again possible to find the exact location the photograph was taken, and using shadows visible in the image it was estimated the time the photograph was taken was approximately 12:30pm.

This time is supported by posts made on Twitter and VKontakte from locals who reporting seeing a convoy of military vehicles moving eastward through Torez towards Snizhne during the early afternoon. Three tweets that describe the missile launcher and an accompanying convoy travelling through Torez were posted at 12:07pm, 12:15pm, and 12:26pm local time. Others on VKontakte report that the convoy included three tanks, with posts at 1:14PM and 2:14PM  that confirm the information was posted on Twitter before the downing of MH17.

Along with these eyewitness reports, journalists have since visited the city and received confirmation of the convoy sightings on July 17. Journalists from the Guardian and Buzzfeed visited Torez on July 22^nd and interviewed locals who confirmed both the time and route the Buk missile launcher took through Torez on the way to Snizhne along the H21 motorway.

Photograph and screenshot from footage of the Buk missile launcher in Snizhne, Ukraine, July 17, 2014.

Snizhne

A photograph and video posted on Twitter and YouTube showed a Buk missile launcher in the town of Snizhne. Unlike previous images and video, the Buk was not shown on a low-loader truck, but moving under its own power. The location shown in the video was precisely located and showed the Buk heading south out of Snizhne. The photograph was also located to 13a Karapetyan Street, less than 1 kilometer northwest of the location on the video. Based on the shadows in the photograph, the photograph was taken at approximately 1:30PM.

The AP reported on August 25^th that “On July 17, AP reporters in the town of Snizhne saw a tracked launcher with four SA-11 surface-to-air missiles parked on a street. The bulky missile system is also known as a Buk M-1. Three hours later, people six miles (10 kilometers) west of Snizhne heard loud noises and then saw the wreckage and bodies from Malaysia Airlines Flight 17 fall from the sky.” Three hours prior to the time MH17 was downed was 1:20pm local time, supporting the time indicated by the shadows in the Snizhne photograph.

Screenshot from footage filmed in Luhansk, Ukraine, July 17, 2014.

Luhansk

The final video was posted online by the Ukrainian Ministry of Interior on July 18. In this video, the Buk missile launcher is back on the low-loader truck, but is now missing at least one missile. The Russian Ministry of Defence claimed in a press conference on July 21 that this video was in fact filmed in Ukrainian government-controlled territory, stating that the “media circulated a video supposedly showing a Buk system being moved from Ukraine to Russia. This is clearly a fabrication. This video was made in the town of Krasnoarmeysk, as evidenced by the billboard you see in the background, advertising a car dealership at 34 Dnepropetrovsk Street. Krasnoarmeysk has been controlled by the Ukrainian military since May 11.”

Top, text on Luhansk billboard, as cited in the Russian Ministry of Defence press conference.
Bottom, photograph of the same billboard taken by a Luhansk resident.

However, investigations by Bellingcat have shown this statement from the Russian Ministry of Defence to be untrue, and it has been possible to find the exact location in the separatist-held area of Luhansk where this video was filmed. While it is not possible to discern the exact time this video was filmed, there are three pieces of evidence that lend credence to the Ukrainian Ministry of Interior’s claim that the video was filmed on the early morning of July 18:

• The video was filmed approximately 75 kilometers north of Snizhne.
• At least one missile is missing from the set of four missiles that the Buk missile launcher is normally armed with. Additionally, the photograph of the Buk missile launcher in Torez shows four missiles, and local witnesses noted that the Buk missile launcher moving through Torez had four missiles.
• The netting visible in the photograph from Torez is absent from the top of the missiles in Luhansk.

The Low-Loader Truck

Throughout the sequence of videos and photographs showing the Buk missile launcher in eastern Ukraine, it is clear the same low-loader truck is being used, and the vehicle has been described as unique by its owner. From the available evidence, it is clear that the separatists have used the same low-loader to move military vehicles on occasions after July 17.

Photograph from Makiivka, Ukraine, published August 6, 2014

On August 6^th 2014, a photographed was shared online showing the low-loader truck carrying a military vehicle through the town of Makiivka, just east of Donetsk. While the board with the phone number painted onto it was removed, it is still a clear match to the same vehicle used on July 17.

Left, Google Earth satellite map imagery of the low-loader at vehicle rental site on July 24, 2014
Right, Google Earth satellite map imagery of the low-loader at same location on August 9, 2014

By examining historical satellite map imagery of the vehicle rental site that the low-loader truck was taken from, it is possible to identify a red low-loader with a white cabin, only one of which is ever present at the site. By comparing satellite map imagery from July 24, 2014 and August 9, 2014, it is clear that the low-loader truck was moved during that period, which would fit with it being used elsewhere on August 6.

Left, photograph of the low-loader truck from August 26, 2014.
Right, screenshot from footage of the same low-loader truck filmed by separatists on August 26.

On August 26, 2014 a photograph and video of an identical low-loader truck were posted online. The video featured a woman who had appeared in previous separatist-filmed videos, and it appears the low-loader truck was being used to transport a damaged vehicle.

Conclusion

Based on the available information, it appears clear to the Bellingcat MH17 investigation team that separatists transported a Buk missile system through their territory on July 17, and used the same low-loader truck used to transport the Buk missile system on July 17 on at least two occasions in August. The Buk missile system was unloaded in Snizhne and was then transported on the same low-loader truck to separatist-controlled Luhansk, now missing at least one missile.

Map of the six sightings of a Buk missile launcher on July 17 and 18 in separatist-controlled territories of eastern Ukraine.

Section Two: The June Convoy and “Buk 3×2”

In late June 2014, a convoy left the 53^rd Anti-Aircraft Missile Brigade near Kursk, and travelled to the Ukrainian border, officially as part of a training exercise. Using a wide variety of open sources, it has been possible for the Bellingcat MH17 investigation team to collect evidence of the movements of the convoy, the purpose of the convoy, its links to the 53^rd Brigade, and evidence that confirms that one of the Buk missile launchers in the convoy was the same Buk missile launcher filmed and photographed in Ukraine on July 17, 2014, travelling from Donetsk to Luhansk through separatist-controlled territory in eastern Ukraine.

The Convoy

Screenshots from various videos of the June convoy taken by local residents.

The Bellingcat MH17 investigation team has collected 16 videos posted on social media sites including VKontakte, YouTube, Instagram, and Odnoklassniki that show the 53^rd Brigade’s convoy moving from Kursk on June 23^rd to Millerovo  on June 25^th. The Bellingcat MH17 investigation team has also been able to identify the exact location at which each video was filmed and, by matching vehicles visible in different videos, to confirm that all these 16 videos show the same convoy.

It was also possible to find a local news report about the movement of the convoy, which included images of vehicles from the same convoy. According to the report locals who spoke to soldiers in the convoy, they were “being sent to the border with Ukraine to ‘strengthen border control.’”

It was also possible to link the convoy to the 53^rd Brigade using social media posts by members of the 53^rd Brigade. For example, this post by a member of the Brigade, Vasily Ilyin, on June 25, 2014 shows the numbered Buk units as well as the number plate of one of the transporters being used, which matches vehicles visible in the convoy videos. Images posted to the now-deleted profile of brigade member Ivan Krasnoproshin also show vehicles that are part of the convoy.

Photograph taken posted on the VKontakte profile of Vasily Ilyin on June 25, 2014.

Left, number plate XP 8236 50 in the June convoy.
Right, the same number plate in Vasily Ilyin’s June 25th photograph.

Top, Buk 231 in the June convoy.
Bottom, Buk 231 in Vasily Ilyin’s June 25th photograph.

Left, a truck in the June convoy with number plate 0639 AH 50.
Right, the same truck in a photograph posted online by Ivan Krasnoproshin.

Images posted to social media accounts of 53^rd Brigade members show certificates issued by the unit detailing their promotion after a training exercise that took place between June 22^nd and July 25^th. These dates are significant as not only was the convoy seen heading towards the border on June 23^rd, but, as Section 3 will detail, some vehicles returned to the base before July 19th.

Images of certificates posted by 53rd Brigade members on social media accounts.

Buk 3×2

The most important feature of this convoy is the presence of the same Buk missile launcher filmed on July 17^th 2014 travelling through separatist territory and linked by some to the downing of MH17. The Bellingcat MH17 investigation team refers to this Buk as “Buk 3×2” as the middle number appears to have been worn off. It appears in 8 of the 16 videos showing the convoy travelling between June 23^rd and June 25^th, and the Bellingcat MH17 investigation team has been able to match features of the missile launcher in the convoy to those seen on the missile launcher filmed and photographed in Ukraine on July 17^th. It is the opinion of the Bellingcat MH17 investigation team that because of these matches the vehicle seen in the convoy and travelling through separatists controlled territory on July 17^th is the same vehicle.

A screenshot from footage of Buk 3×2 in Stary Oskol, Russia on June 23, 2014.

The Paris Match photograph taken in Donetsk on July 17^th has proven to be very valuable in confirming the origin and identity of the Buk missile launcher. There are two key elements that match, the white markings on the side of the vehicle, and damage to the side skirt above the tracks of the Buk.

Markings on Buk systems that were part of the June convoy.

The markings on the side of Buk 3×2 consist of the following:

• Unit designation, typically 3 digits
• Transportation-related markings, in this case a circle with a cross in the centre and the marking “H=2200”
• A white mark visible on the side skirt
• Another white mark on the opposite side of the vehicle.

As with other Russian vehicles appearing inside Ukraine under separatist control, attempts have been made to obscure the unit designation number. However, it is still possible to match the markings because these markings are not applied to Buk missile launchers in a consistent fashion. Because of this, each Buk has slightly different positions for the unit designation numbers and do not share the same additional markings, such as the transportation-related markings. When they do share additional markings, they are generally not in the exact same position. In addition to this, on “Buk 3×2” (with the middle number obscured) we have an additional white mark on the side skirt that appears to serve no purpose, and may be nothing more than an accidental splash of paint. It is also notable that some of these markings can be recognized in the photograph taken in Snizhne.

In the case of the Paris Match photograph, the top of the faded number is visible, although much of the unit designation number and the top of the “2” have been obscured. By skewing the Paris Match image, it is possible to flatten the image, which has allowed us to lay the Paris Match photograph over images of Buk 3×2 in the Russian convoy:

Overlaid comparison between Buk in Paris Match photo in Ukraine and Buk 3×2 in Russia.

It’s clear from these images that the positions of the markings match. In addition, the Bellingcat MH17 investigation team has attempted the same type of comparison with other Buk missile launchers from both Ukraine and Russia. No other comparison made by the Bellingcat MH17 investigation team has come close to matching all the matching elements between the images of Buk 3×2 in Russia and the Paris Match Buk.

Fingerprints

In addition to comparing the markings on the vehicles, the Bellingcat MH17 investigation team was also able to establish a second feature on Buk missile launchers that varies between units: side skirt damage. The side skirt that runs above the tracks of the Buk systems is prone to damage, and this creates a unique pattern of damage we refer to as the “side skirt fingerprint.” Below, a Buk that is certainly the same in each photograph shows a high correlation in each side skirt profile.

Top, image dated November 29th 2013.
Middle, image dated June 23rd 2014.
Bottom, image dated June 23rd 2014.

The Bellingcat MH17 investigation team compared the side skirt fingerprints of a number of Buk missile systems in Ukraine and Russia in order to find possible matches to the Buk seen in the Paris Match photograph. In each of the following side skirt fingerprint images, the red line is for the Paris Match Buk.

Of these Buks, the side skirt profile with the highest correlation is Buk 3×2 filmed transported near Stary Oskol in June. Many of the other photographs are clearly not matches for the Paris Match Buk, including Buk 312 filmed in Ukraine. Below, another comparison of the side skirt profiles between the two photos shows a similarity that can be seen in both the isolated amplitudes and in the photographs:

Top: Buk 3×2 filmed in Stary Oskol, Russia in June
Bottom: Buk filmed in Donetsk, Ukraine by Paris Match on July 17, 2014.

However, there is one discrepancy: on the right hand side of the comparison, there is a small but significant difference underneath the transportation-related markings, but this in fact further confirms that these two Buks are one in the same. Because the Paris Match photograph has been flattened, any damage to the side skirt that projects outwards would cause a distortion that would not be visible in any images taken directly side-on to the vehicle, such as the images used to compare the side skirt fingerprints. This means that if there is a difference, that type of damage to the side skirt would have to be visible to account for the difference, and if that damage was visible then it would be further confirmation that it was the same vehicle.

Left, the Paris Match photograph from Donetsk showing side skirt damage on Buk
Middle, screenshot from footage in Stary Oskol showing side skirt damage on Buk 3×2
Right, screenshot from footage in Stary Oskol showing side skirt damage on Buk 3×2.

This damage is in fact visible in two videos of Buk 3×2 filmed in Russia, one in Stary Oskol (2:02) showing the damage from behind, and another from Alexeyevka (0:50) showing the same damage from the opposite direction. The damage is in the same position as the discrepancy in the Buk fingerprint from the Paris Match photograph, and further confirms the Buk in the Paris Match photograph is the same vehicle travelling through Russia as part of the 53rd Brigade’s convoy towards the Ukrainian border in late June 2014.

Conclusion

In the opinion of the Bellingcat MH17 investigation team, the Buk missile launcher filmed and photographed travelling through separatist-held territory on July 17^th is the same vehicle seen in the convoy travelling through Russia towards to the Ukrainian border in late June 2014.

Map showing the route of the June convoy from Kursk to Millerovo near the Ukrainian border. Each point designates a confirmed sighting of the convoy through videos uploaded on social media.

Section Three: The July Convoy

Following the downing of MH17, videos were uploaded to various websites showing a military convoy travelling through Russia. The convoy consisted of a number of transport vehicles carrying covered units, as well as two uncovered Buk systems. The Bellingcat MH17 investigation team has been able to establish the route the convoy took and that the convoy originated from the 53^rd Anti-Aircraft Missile Brigade. In the July convoy, at least one vehicle in the July convoy was also in the June convoy. Additionally, at least one Buk missile loader seen in the June convoy was recorded on July 20th near separatist-controlled areas of the border, hundreds of kilometres away from the location it was recorded in as part of the June convoy.

The Convoy

The Bellingcat MH17 investigation team was able to identity 10 videos posted on July 19th and 20th, 2014 showing a military convoy consisting of multiple vehicles, including covered vehicles on transporters. It was possible to link vehicles in this convoy to the 53^rd Anti-Aircraft Missile Brigade with the following image taken from the Fedeseyevka video on July 20th. This video shows a BT80 with the number 993.

Screenshot from the Fedeseyevka video.

The same vehicle appears in the photos on the VKontakte page of Sanya Reznikov, who, according to his profile, served in the 53rd Brigade from 2013 to sometime in 2014.

BT80 at the 53rd Anti-Aircraft Missile Brigade.

Other members of this Brigade also posted photographs of the same vehicle with identical markings.

Although many of the vehicles in the July convoy appear to have different number plates than those in the June convoy (when discernable), at least one vehicle seen in the June convoy was also part of the July convoy.

Left, screenshot from Stary Oskol, June 23rd. Right, screenshot from Fedoseyevka, July 19th. Both number plates are XP 0030 50.

Based on the videos collected by the Bellingcat MH17 investigation team, it has also been possible to track the movements of the convoy seen on July 19th and 20th. Footage filmed in Fedoseyevka on July 19th appears to place the convoy at its earliest point in the route, travelling through the town of Stary Oskol, then to Alexeevka southeast of Stary Oskol, and the last sighting further southeast in the town of Olkhovatka on July 20th.

One video from July 20th was of particular interest to the Bellingcat MH17 investigation team. This  video was posted online from the town of Kamensk-Shakhtinsky, over 300km from the location of the other videos posted on July 20th This video shows a Buk missile loader being transported through the town. This same vehicle was seen as part of the June convoy heading to the Ukrainian border in June.

Top, the Buk missile loader in June.
Bottom, the same vehicle on July 20th in Kamensk-Shakhtinsky.

The Bellingcat MH17 investigation team was able to establish the precise location the video was filmed, establishing that the vehicle was on the M21 motorway that runs eastwards from the Ukrainian border approximately 20km away. The vehicle was heading south, possibly towards the Russian border town of Donetsk (not to be confused with Donetsk in Ukraine). Donetsk has previously been identified as a crossing point for units from Russia into separatist-controlled territories in Ukraine.

Top, a screenshot from the July 20th video in Kamensk-Shakhtinsky.
Bottom, the same location on Google Street View.

Two differences from the June recordings of the Buk are noticeable. First, the missiles are in different positions, and second, the missiles are covered in camouflage netting. While certainly not in any way conclusive, the Bellingcat MH17 investigation team notes that during their investigation, they have only seen netting used on one other vehicle: the Buk filmed inside Ukraine on July 17th.

Top, a screenshot from the July 20th video in Kamensk-Shakhtinsky.
Bottom, the photograph of the Buk missile launcher seen in Torez on July 17th.

Conclusion

Based on the above information the Bellingcat MH17 investigation team concludes that at some point in late June vehicles that were part of the June 23rd convoy from the 53rd Anti-Aircraft Missile Brigade separated. Some of these vehicles returned to the 53rd Anti-Aircraft Missile Brigade base in Kursk and joined the July 19th convoy from the base, while at least one other, a Buk missile loader, appears to have left the main convoy and towards the Ukrainian border, close to a separatist-held crossing. As yet, it has not been possible to establish when the June 23rd convoy returned to the 53rd Anti-Aircraft Missile Brigade base in Kursk, or how many units were in the convoy. However, it is clear that at least one Buk missile launcher (3×2) from the June 23rd convoy was inside separatist-controlled territory on July 17th, and 3 days later a video was uploaded showing that the Buk system loader unit was very close to the Ukrainian border. Considering the established time frames, logical routes, and photographic evidence, it is possible that this Buk missile launcher was part of the same June 23rd convoy as “Buk 3×2” and supported it. However, it has not been possible to establish that relationship between the two vehicles.

Top, a map showing the route of the July convoy from Stary Oskol to Olkhovatka. Each point designates a confirmed sighting of the convoy through videos uploaded on social media.
Bottom, a Buk missile launcher in Kamensk-Shakhtinsky, south of Olkhovatka.

Acknowledgements

The Bellingcat MH17 Investigation Team

Timmi Allen
Andrew Haggard
Eliot Higgins
Veli-Pekka Kivimaki
Iggy Ostanin
Aric Toler

This report was created collaboratively using Slack.com

Thanks to Mapbox for their help creating the maps used in this investigation