JIT: Preliminary results of MH17 investigation
28 september 2016 - Landelijk Parket
The Joint Investigation Team (JIT) is convinced of having obtained irrefutable evidence to establish that on 17 July 2014, flight MH-17 was shot down by a BUK missile from the 9M38-series. According to the JIT there is also evidence identifying the launch location that involves an agricultural field near Pervomaiskyi which, at the time, was controlled by pro-Russian fighters. This was announced today by the JIT during a presentation for the relatives of the victims. Members of the JIT, Australia, Belgium, Malaysia, the Netherlands and Ukraine, are working together on the criminal investigation into the crash of flight MH17.
Today, the interim results of the criminal investigation which included the findings regarding the weapon and launch location were presented. The investigation into those responsible for the crash will take more time.
All forensic examinations, witness statements, telecom information, satellite images, radar data, findings by experts and other supporting evidence point to an attack by a ground based air defence system. In addition, the JIT has also investigated other alternative scenarios.
Of these alternative scenarios, an accident and evidence for a terrorist attack from inside the aircraft have been ruled out. Results from the forensic investigation support the scenario of an attack from outside the aircraft. The scenario that flight MH17 was shot down by a military aircraft was explored and discounted on the basis of radar data, witness testimonies and forensic research. The JIT has obtained sufficient radar data, both from Russia and Ukraine, which – when viewed in conjunction – provide a full picture of the airspace over eastern Ukraine. This shows that at the time of the crash, no other airplanes were in the vicinity that could have shot down flight MH17.
The Russian Federation mentioned last week that they have found ‘new’ primary radar images. Based on those images the Russian Federation concludes also that there was no second airplane that could have shot down MH17.
The investigation demonstrated that flight MH17 was shot down by a 9M38 series BUK missile. Investigators have compared parts of the alleged weapon which were found at the crash site with reference material. This involved the dismantling of various types of BUK missiles from the 9M38 series and comparing this reference material with the metal parts recovered from the crash site.
On the right side animation 1: the weapon
The investigation team had to establish a link between the parts found and the downing of flight MH17. It had to be proven that the parts had not been in the area prior to the crash, and that they had not been placed there by third parties after the crash. The crash site was not fenced off for the purpose of forensic examination. It was clear that persons other than the investigators had access to the crash site.
Two examples of the link were presented:
• During the autopsy of the bodies of the cockpit crew, several fragments were found that belonged to the warhead of a 9M38 series BUK missile. One of these fragments found showed traces of cockpit glass on the surface, which was the same unique type of glass that is used for the a Boeing 777. It was determined that the fragment pierced the aircraft from the outside through the cockpit window.
• In the frame of one of the cockpit windows a metal piece was found which was identified as a part of a 9M38 series BUK missile. This piece was located in a twisted position in the frame, making it clear that it was shot into the window frame with great force.
On the right side animation 2: Forensic investigation
Transport of the missile installation
The JIT has been able to identify a large part of the route concerning the arrival and the departure of the BUK-TELAR. This was the result of intercepted telephone conversations, witness statements, photographs and videos that had been posted on social media, and a video never shown before which was obtained from a witness. The system was transported from Russian territory into eastern Ukraine and was later transported on a white Volvo truck with a low-boy trailer. The truck was escorted by several other vehicles and by armed men in uniform.
The final destination of the BUK-system was on farmland near Pervomaiskyi. Evidence that supports this includes multiple witnesses who saw and photographed the condensation trail of the BUK missile and its movement through the air. Other witnesses were able to link the trail to the BUK-TELAR which they had seen earlier on 17 July 2014.
Witnesses were interviewed who had seen a plume of smoke, the BUK-TELAR at the launch site in Pervomaiskyi, and the missile right after it had been launched.
Journalists have spoken to witnesses who had seen the launch of the missile at a very short distance from the launch location. These witnesses testified that they heard a very loud noise and a high whistling sound.
After the BUK missile had been fired, the BUK-TELAR initially drove off under its own power. A short time later it was reloaded onto the Volvo truck and transported back to the Russian border. During the night, the convoy crossed the border into the territory of the Russian Federation.
On the right side animation 3 regarding the transport route and the launch site
Now that we have established what happened, the investigation now focuses on the perpetrators. This will be a matter for the long haul. So far, the JIT has identified approximately 100 people who can be linked to the downing of MH17 or the transport of the BUK-TELAR. The JIT has been investigating these people through various sources, such as intercepted telephone conversations and witness statements.
In addition, an investigation is conducted into the chain of command. Who gave the order to bring the BUK-TELAR into Ukraine and who gave the order to shoot down flight MH17? Did the crew decide for themselves or did they execute a command from their superiors? This is important when determining the offences committed by the alleged perpetrators.
The JIT wishes to emphasise that it continues to seek additional information and evidence, including information from insider witnesses. Ukrainian law provides for lower sentences, and in certain circumstances relief from criminal liability, for those who cooperate with the investigation.
Furthermore, the website www.jitmh17.com now includes a number of intercepted telephone conversations. The JIT is now asking for information about certain people who participated in these conversations. People who can identify these voices are requested to report this to the JIT.
The JIT will be actively involved in the investigation in the coming period and for that reason the JIT agreement was extended yesterday, until 1 January 2018.
Today, the Joint Investigation Team (JIT) presents the first results of the criminal investigation into the downing of flight MH17 on 17 July 2014.
In the JIT Australia, Belgium, Malaysia, the Netherlands and Ukraine are working together.
Image: figures of the investigation
This is an extensive and complex investigation. To illustrate this, I herewith you some figures that may demonstrate the scope of the investigation:
For quite some time, between 100 and 200 investigators and other experts of the JIT have been working on the case and currently, on a daily basis almost 100 investigators, public prosecutors and other experts are still working on the case. During the past two years, dozens of containers with thousands of wreckage parts were examined in detail, piece by piece. Of those parts, 1448 were processed in a databank as being relevant to the investigation. Sixty requests for legal assistance were sent to more than twenty countries and we received reactions on many of them. Twenty weapon systems were examined. Five billion internet pages were recorded and assessed for their relevant content. Half a million videos and photographs were examined in detail and saved, and more than two hundred witnesses were heard. In addition, approximately 150.000 intercepted telephone calls were listened in on, summarised and assessed for their relevance and authenticity. After this, more than 3500 intercepted conversations were processed entirely, translated and analysed. All this was recorded in more than 6000 official reports.
Earlier, the Dutch Safety Board (OVV) presented their investigation results. And furthermore, many journalists carried out their own investigations, as did research collectives like Bellingcat. This resulted in different scenarios and theories being raised, both in the media and on the internet.
The criminal investigation focusses on truth finding and its ultimate goal is tracing and prosecuting the perpetrators. The big difference with a journalistic documentary or an internet-based investigation report is that in our case conclusions based on probability will not suffice. The most important in the JIT investigation is that we can substantiate our conclusions with legal and convincing evidence. In doing so the bar is high: the evidence must stand before a court. We are confident that the evidence which we have collected removes any kind of doubt about the cause of the crash. Of course, ultimately it will be up to the court to render a final judgment.
In the meantime we have collected so much evidence that we – as announced earlier – can answer the question as to which weapon was used and, even more important, where this weapon was launched exactly. The investigation into those responsible is a matter for the long haul and will take more time.
Normally we exercise restraint when it comes to disclosing interim findings in ongoing investigations; we only present our investigation results in the court room. But this case has such a profound impact worldwide that we have looked at possibilities to present the results of the criminal investigation at an earlier stage. We cannot and do not want to tell you everything yet; in that case we would run the risk of playing into the perpetrators’ hands. Also, we will not show all our evidence. We have made a selection that is meant to illustrate how we reached our conclusions.
• First, we will discuss the different scenarios which have been investigated and how we reached our conclusions with respect to these scenarios.
• After that, we will discuss the results from the investigation with regard to the weapon and the launch site.
• At the end, we will briefly discuss the further investigation into the perpetrators.
The presentation will provide information about the progress in the investigation. We also want to explain that in the meantime we have gathered sufficient evidence to build a criminal case which will demonstrate the cause of the crash without any doubt.
I The investigation into different scenarios
The JIT has carried out the investigation as broadly as possible and has investigated different scenarios. Although early in the investigation one scenario seemed the most likely one, it was important to keep investigating the other possibilities carefully. After all, it had to be an unprejudiced and impartial investigation. In future court proceedings those other scenarios may possibly play a role as well, because they might be presented by the defendants and their lawyers as alternative possibilities. In that case the Prosecution will have to be able to demonstrate that they did not take place.
Two scenarios could be ruled out quickly, as already mentioned previously. This concerned the possibility of an accident caused by technical or human failure, and the possibility of a terrorist attack from inside the aircraft. We have investigated both scenarios and there were no indications for these scenarios. The OVV had already drawn this conclusion on 13 October of last year.
Then, two scenarios remained:
First, the possibility that flight MH17 had been shot down by another airplane equipped with a weapon system. This is the air-to-air scenario.
In the investigation so far, we have come to the conclusion that we can also rule out the air-to-air scenario.
What follows is the explanation about how we reached that conclusion.
If flight MH17 would have been shot down by another airplane, this plane would have been shown on the radar images. There has been quite some discussion about the radar data. The JIT has acquired sufficient and crucial radar images. These images were made available to the JIT by both Ukraine and the Russian Federation. Recently, through intensive investigation, the JIT found another video file containing relevant primary radar data of the area which had been recorded by a mobile radar in Ukraine. At the time, this radar was used to test new software. Although it had a limited range, it still detected flight MH17 and this completes the image further.
As far as we are concerned, the discussion about the radar images can be concluded. Today we wish to emphasize that the material that we now have is more than sufficient to draw conclusions in the criminal investigation. For building up a solid criminal file, it will not be necessary to gather more evidentiary material.
In addition to the radar images that we have, witnesses have been heard, such as the air traffic controllers who were working at that time; the JIT has an audio file of the conversations between the Ukrainian air traffic controllers and the airplanes that passed through the Ukrainian airspace on 17 July 2014, including flight MH17.
All these data together provide a sufficiently complete picture of the air traffic in the direct vicinity of flight MH17 and based on this picture the JIT concludes that there was no other aircraft flying in the vicinity of flight MH17 that could have shot it down. This conclusion in itself can already rule out that scenario.
The Russian Federation mentioned last week that they have found ‘new’ primary radar images. Based on those images even the Russian Federation concludes that there was no second airplane that could have shot down MH17.
Moreover, there is much other evidence that contributes to the evidence of the final scenario, being: Flight MH17 was shot down by a ground based air defence system.
On the basis of a large amount of evidence we can conclude that this is indeed the scenario which took place.
The results of the criminal investigation with regard to the weapon used and the location from where this weapon was fired will be illustrated with the aid of three videos in which we show a selection of our evidentiary material. For a part real images will be shown, for another part there will be animated images, i.e. images created by us. In this respect, two remarks. In some of the intercepted telephone conversations, names of certain persons are mentioned. This does not mean that these persons are automatically suspects. The other remark concerns the spelling of place-names in Eastern Ukraine. Some place-names are spelled differently, which is partly due to the differences in Ukrainian and Russian.
Image: map of Russia – Ukraine
In the explanation of the situation in Eastern Ukraine in July 2014, the word ‘separatists’ is used regularly. The JIT believes it is important to explain that the term separatists refers to any person, regardless of his nationality or citizenship, who is fighting against the Ukrainian government troops in Eastern Ukraine.
Image: map of Eastern Ukraine
In July 2014, heavy fighting was going on in the area southeast of Donetsk. The pro-Russian fighters were engaged in an offensive to force a passage to the border with the Russian Federation south of the conflict zone. During these fights, the Ukrainian army carried out many air strikes in order to stop this offensive. The pro-Russian fighters suffered greatly: there were many losses, both human and material. Intercepted telephone conversations show that during the days prior to 17 July, the pro-Russian fighters mentioned that they needed better air defence systems to defend themselves against these air strikes. In this respect, a BUK was discussed explicitly. Fact is that a BUK has a higher range than the air defence systems in use by the separatists at that moment, such as the Strela and Igla.
This can be illustrated with several intercepted conversations between two Russian speaking persons, who are fighting on the side of the pro-Russian fighters. These conversations are relevant to the investigation and took place in the evening of 16 July and the early morning of 17 July 2014.
On the right: intercepted call on 16 July 2014 at 19:09 hours
(first word: Oh, shit)
And the intercepted call on 17 July 2014 at 09:08::26 hours
(first word: and where should)
The above shows that the pro-Russian fighters were in great need of a BUK air defence system and that it was actually delivered.
Based on the results of the criminal investigation it can be concluded that flight MH17 was shot down on 17 July 2014 by a missile of the 9M38 series, launched by a BUK-TELAR. This is consistent with the conclusions drawn by the OVV of 13 October 2015. The BUK-TELAR was brought in from the territory of the Russian Federation and subsequently also taken back to the Russian Federation.
The following animation explains what kind of weapon the BUK-TELAR and BUK missile actually is.
On the right animation 1
In the animation it was explained how the weapon works. This is important to know in the criminal investigation and also to determine the question of guilt.
III Forensic investigation
In the investigation we have made extensive use of forensic research. Partly thanks to this research, we have been able to establish that flight MH17 was shot down by a missile from the 9M38 series.
In the next animation it is explained how the forensic investigation has contributed to this conclusion.
On the right animation 2: the forensic investigation
In addition to the forensic investigation, so-called Arena tests were performed. This means that a group of forensic experts from the JIT countries detonated a warhead and a complete missile in a prepared test environment. In this test environment aluminium panels, simulating an aircraft wall, were placed around the warhead and the missile. Surrounding the test area measuring equipment including high-speed cameras had been installed.
During these arena tests several measurements were carried out, such as the velocity of the fragments from the warhead after detonation. Also, the damage pattern became visible by the perforations of flying fragments from the warhead and the missile in aforementioned aluminium panels. The results of these tests were compared with other investigation data, including the different metal parts which were found during the forensic investigation. The main purpose of these tests was calculating the trajectory of the missile and comparing the nature of the damage with the traces found at the crash site.
On the right: video of Arena test
IV The route and launch site:
The BUK-TELAR that was used was brought into Eastern Ukraine from the territory of the Russian Federation. The investigation team has been able to make an accurate reconstruction of a large part of the route which was followed by the BUK-TELAR and accompanying vehicles. Initially, we did this mainly based on intercepted telephone conversations and videos and photographs on the social media. Following the call for witnesses last year, several witnesses replied and were interviewed by the JIT. They also stated that they had seen the BUK-TELAR driving by.
Image: map of Ukraine with Zaroschenke
The JIT investigated several possible launch locations, including two locations in the vicinity of the town of Zaroschenke or Zaroshchenskoye. Among other locations, this area was indicated by the Russian Ministry of Defence as being the launch site. It was also mentioned that this area was allegedly controlled by Ukraine. However, the investigation showed that this was not the launch location. And besides this, it appeared that this area was not being controlled by Ukraine, but by pro-Russian fighters. To illustrate this there is the following intercepted telephone conversation between two pro-Russian fighters:
On the right: conversation 2 June 2015 at 14.02.13 uur
This conversation took place in June 2015 and is about the information that apparently was distributed at that time, saying that the Boeing (flight MH17) was allegedly shot down from the city of Zaroshchenskoye (or: Zaroschenke) by an air defence system. One of the participants in that conversation knows for sure that Zaroshchenske was not the launch site and that, at the time, Zaroshchenske was not controlled by the pro-Russian fighters. The JIT also has other evidence in support of these conclusions.
In order to establish the exact location of the launch site, the JIT conducted different kinds of investigations. These investigative activities were carried out Ukraine, Belgium, Australia and the Netherlands and involved forensic, tactical and digital investigations. Among other activities, a team of specialists visited the disaster area in June 2015. Ground samples were taken at different locations that were regarded as possible launch sites. These samples were examined in detail by the Dutch Forensic Institute (NFI). Network measurements were also carried out on the spot in order to determine the locations, as well as the range of the telephone towers. Furthermore, all kinds of visual material was evaluated and checked for authenticity. Witnesses were interviewed as well, among others by a Dutch Investigating Judge.
Image: Launch site
During the past two years, the investigation team collected a large quantity of evidentiary material about the launch site. Our conclusion is that the location of the launch site is an agricultural field near Pervomaiskiy. It concerns a field of approximately 500 x 600 metres. This is the highest spot in the area within a radius of 5 kilometres. The farmland is surrounded by trees, except for the western side. Previously the OVV had already concluded that the missile must have been launched from an area of 320 square kilometres south east of Grabovo. The farmland near Pervomaiskiy is located in this area.
This conclusion is supported by the material which the investigation team recently obtained from the United States and the European Space Agency. I will explain this briefly:
In response to a Dutch request for legal assistance, the US submitted a report in which they present their assessment of the information regarding the shooting down of flight MH17. This report can be used in court. The conclusion of the American authorities is that flight MH17 was shot down by an SA-11 surface-to-air missile, i.e. a BUK-missile, which was launched from a site about six kilometres south of the village of Snizhne in Eastern Ukraine. This is consistent with the distance to aforementioned launch site near Pervomaiskiy. The US also explain how they reached this conclusion. In addition, they mention that they are sure of the fact that the Ukrainian air defence systems could not have done it and that an air-to-air scenario is impossible.
The Dutch Military Intelligence Service (MIVD) and the (Dutch) National Public Prosecutor on Terrorism have been able to view the underlying state-secret (intelligence) material and based on that information and the explanation provided, they support the fact that this conclusion is drawn.
The European Space Agency (ESA) has aided the investigation team extensively in the search for relevant images from satellites. This has shown to be of great value: Not only did ESA obtain images of all relevant civilian satellites, but they also have experts who have assessed these images. The conclusions drawn by ESA confirm the conclusions of the investigation team with regard to the launch site.
In the following animation we will show a selection from our investigation results.
On the right: animation 3 arrival, launch site and removal
Based on the above the JIT concludes that flight MH17 was shot down on 17 July 2014 by a missile of the 9M38 series, launched by a BUK-TELAR, from farmland in the vicinity of Pervomaiskiy (or: Pervomaiskyi). At that time, the area was controlled by pro-Russian fighters. Furthermore, the investigation also shows that the BUK-TELAR was brought in from the territory of the Russian Federation and subsequently, after having shot down flight MH-17, was taken back to the Russian Federation.
V Those involved
So much for our conclusions regarding what happened. Probably not everything of this, is new. But what matters today is that the criminal investigation has now advanced to the point where we can substantiate abovementioned conclusions with evidence. Of course, at the end of the day it is up to a court to render judgment.
What remains is the answer to the question: who were responsible for this? Which persons were involved in the delivery, security and removal of the BUK-TELAR and/or the shooting down flight MH17? In this part of the investigation significant progress has been made during the past two years, but more investigation is needed. Now that we know for sure what happened to flight MH17, in the coming period the investigation can fully focus on the answers to these kinds of questions.
Image: those involved
Although today we have not been able to provide investigation results regarding the perpetrators, we can say that in the meantime, we have identified approximately 100 persons who in one way or the other can be linked to the crash of flight MH17 or the transport of the BUK. We have been able to establish the identity of these 100 persons, whom we found through different sources such as intercepted telephone conversations and witness statements. This concerns people who have played an active role in getting hold of the BUK-TELAR and organising the transport to the launch location. There are also persons who had a facilitating or supporting role. This group includes the people who escorted the transport of the BUK-TELAR.
These persons are not automatically suspects. To assess whether persons who were involved acted culpably, and can therefore be regarded as suspects, it is important to get a better picture of the chain of command with regard to the use of the weapon. Who gave the orders for the delivery of the BUK-TELAR? Who gave the order to shoot down MH17? Did the crew take their own decision or did they execute a command from higher up? What did the persons who were involved in this operation know? All these kinds of circumstances play a role when answering the question whether someone should be regarded as a witness or as a suspect.
It is important to the JIT to gain more insight into the role of the different parties involved, which is also the reason why today, we once more call witnesses to report to us. In particular we invite insider witnesses, who can tell us more about the role that different persons have played, to report to the JIT.
Ukrainian law provides for lower sentences, and in certain circumstances relief from criminal liability, for those who cooperate with the investigation. Information about how to report as a witness can be found on the website of the JIT. (See: www.jitmh17.com)
Furthermore, this afternoon we will post a number of intercepted telephone conversations on the website of the JIT, requesting information about certain participants in those conversations. Anyone who knows who these persons are, is requested to report this to the JIT.
Finally, the question as to how long will it take to conclude the criminal investigation cannot be answered yet. It depends on further developments in the investigation and the witnesses we can still hear. After today, this investigation will continue unabated.
In view thereof, the JIT agreement that was to expire next month, was extended. We will continue as a Joint Investigation Team to see this important investigation to a good end.