Bellingcat trolls Russian Ministry of Defense, we all lose


Last april the information war hanging over the MH17 disaster took a surprising turn when NATO affiliated research collective Bellingcat and the Russian Ministery of Foreign Affairs (MFA) got into an open clash. Eliot Higgins, Bellingcat founder, used some crafty ¨trolling¨ techniques to provoke the Russians and this way he managed to squeeze some respons out of them. Assessing some of the arguments and alleged facts used in the dispute one might come to the conclusion both parties actually were not very convincing.

Some effective trolling

Ratcheting up of this interesting open quarrel it was Russian spokeswoman Maria Zahkarova who first threw oil on a smoldering fire of Russian irritation of the well designed Public Relations strategy Bellingcat applies to cast as many suspicion as possible to the Russian side. In a 6 april briefing Zakharova lashed out, calling Bellingcat ¨an instrument to divert attention¨ that ¨continue[s] to use all possible “fakes,” to create quasi-evidence to blame Russia¨.

It seems Eliot Higgins had waited for this. With some well targeted assaults he lured the MFA into a debate about fake or not fake evidence concerning the question of guilt about who shot down the Malaysian plane. This way the MFA acknowledgded Bellingcat as an important party to deal with, which was a breach in policy until then of only responding at state-level and in the realm of international relations.

Why the Russians caved in, could not easily be infered from the information they handed over in this dispute. In fact the only evidence of Bellingcat fakery they gave originated from an Albert-lex blog written by Russian citizen Albert Naryshkin. Though its not hard to understand the MFA would not be inclined to give any new information about intelligence gathered about the disaster, it remains a big question why they gave Higgins what he wanted: a stage to shine on. Interesting feature of his act was his cockyness and selfconfidence wrapped up in an annoying kind of arrogance. He obviously is a man really convinced of the splendidness of his own work.

To shed some light on the dispute it might be interesting to pick some topics that ran between MFA and Bellingcat. The Russians expressed their doubts about the infamous BUK 3×2, roaming around in a Russian convoy weeks before the disaster and, according to Bellingcat, driving allegedly in Donetsk in the morning of 17.7.2014 as is shown on 2 pictures published by French magazine Paris Match. Furthermore the Russians used Albert-lex´ blog to point to the assertion the ¨unique¨ truck driving from Donetsk to the alleged launchsite showed in fact some different features on different images of the BUK trail.

Bellingcat supported the idea of a Russian/separatist 17.7.14 BUK trail through the Donbass by reiterating there also were witnesses, on social media as well as in different press articles, who had seen the BUK on tour. Besides, they claimed once more the satellite imagery the Russians had issued, which allegedly showed Ukrainian BUKs in shooting range, were faked. Furthermore Higgins averted Russian criticism of an alleged launch plume, seen on a photo published on twitter 3 hours after MH17 crashed.


I. A ¨unique¨ truck

The trail of an alleged Russian BUK moving around the Donbass on that fateful day, shooting down a civilian airliner and then fleeing across the border back to Russia, consists of 4 images on which the unique truck and red lowloader carrying the BUK can bee seen; The Paris Match Donetsk picture, the Zuhres video, the Torez picture picture and the Luhansk video.

According to the Russians, in fact the Albert-lex blog, only one of the images shows the truck has a spare tyre, so apparently there are more trucks involved than only a ¨unique¨ one.

Tire-1-MFAThe truck had, when it still was in the possession of a Donetsk rental company, a spare tyre attached to the red box with the yellow plate.


Unsurpisingly Higgins managed to see a spare tyre in all images. Actually seeing all those spares could well be a kind of wishfull thinking, especially when one takes into account some of these images are very vague and blurred.

Tire-2-MFATop-left: Higgins as well as Albert-lex and the MFA are seeing a spare tyre on the Paris Match picture; Top-right: Higgins manages to see the spare in the red box on a still from the Luhansk video, but its impossible to distinguish it from the BUK itself; Bottom-right: Is this a tyre or just crap carried in the wooden red box with the yellow plates on the Zuhres video? Bottom-left: If there is a spare tyre to see on the Torez picture, it hides behind a square object (see cut off shadow). This could also be just part of transported crap.


Moreover, there are other features of the truck to look into. Kusaka Arato, a Japanese tweeter, brought to my attention the blue striping on the Torez cabin looked different than the one on the other images. It would allegedly show a rather wide white part between two blue stripes. Bellingcat blocked this criticism by pointing to the leaves of a tree next to the cabin hanging over the striping, looking as if there were two separated blue stripes. The reader can watch for him/herself what (s)he deems is the most plausible account.

different striping


Speaking about this picture made in Torez, it always bothered some the cabin of the truck looked so ¨squarish¨. Maybe one could expect a small ¨taper¨ on the top-right side, like the cabin on the Paris match picture seems to have.

taper truck cabin

Back of a white Volvo truck with an extended cabin, showing a ¨taper¨, i.e. the top is less wide. The question raised: Does the cabin (without extension) on the Paris Match picture show a taper contrary to the one on the Torez picture? Credit @JonKriet.

On the top-left side, the location where a black air-shaft for ventilation is attached, one would see also a kind of ¨bulge¨ on top of the cabin where the air-shaft emerges above the upper edge of the cabin. In the Paris Match picture we can see such the bulge very clearly – because the air-shaft has a rounded shape, so it rises in a clear fashion above the cabin roof. On the other hand on earlier pictures that show the truck from the Donetsk rental company, allegedly seized by the rebels on 8 July, we can detect a flat air-shaft that makes the upper edge of the cabin look rather straight. This can be seen on the cabin of the truck photographed in Torez also.

torez vs paris match truck Do the Torez picture and the Paris Match picture show different taper and/or air-shaft pipes? Credit @JonKriet. Discussion is still going on at time of writing.


Most importantly, if there were a difference in air-shaft shape the truck on the Paris Match picture could well be another one as the truck on the Torez picture. This would obviously match with the idea propagated earlier on this blog the images of the truck with BUK could well have been made on different days (and in that case with different air-shafts). In each case, it doesn´t seem plausible the perpetrators who took the truck from Donetsk to Snizhne, changed the ventilation installation somewhere between Donetsk and Torez.

trucks with round inletsRoundish air inlet pipes for Volvo cabins. Credit @JonKriet. Image credits: @JonKriet and @Deus_Abscondis


So maybe the tyre or taper proof is not that convincing, it looks as if there were more white truck cabins with blue striping in the area (see image below). Then maybe the truck wasn´t that unique after all.

the other BUK


II. The launch plume

The Russians also expressed they had problems with Bellingcats propagation of the pictures of an alleged launch plume, though they didn´t mention any of the doubts listed in a blog on this website.


List of ten problems of the plume picture, elaborated in this longread.

Actually they claimed the plume could not be from a BUK launch, because ¨a missile´s trail cannot be vertical¨. Of course Higgins was already prepared as this argument was kind of old. And in fact his point of view was valid. If a BUK is fired and flies in line of sight of the photographer right over him, it seems clear the plume will look to be vertical from this perspective. At least, right after the launch when the trail hasn’t been moved and disformed by the wind.



There was only one thing Higgins forgot. In the forementioned report Ole and Micha Kobs already had proven the origin of the white trail would be well eastwards of the origin of the black smoke. And if more eastwards, let´s say in the middle of Pervomaiskoye village as was calculated, the straight red line drawn in the image above, will not be so straight again.

Moreover, the launchsite is not the spot photographed, for as the plume has moved with the wind in the time between launch and taking of the photo.

So what do the disputing parties mean exactly when they discuss a “vertical” plume? It seems the Russians point to the white plume only, because in fact that is the only one clearly visible on the original, unenhanced picture. On the other hand Bellingcat argued the trail, including a part of black smoke, had a curve due to some unexplained metereological effects.

Ole showed with some straightforward calculations, see my blog “The mystery of the two-faced launchplume”, the black smoke (not-so vertical part) and white smoke (rather vertical) showed different origins when windspeed was taken into account. Moreover, the white part didn’t show windshear effects, i.e. completely held its shape when moved by the wind, contrary to the spreading black smoke. Therefore, conclusion should be, the curved Bellingcat launchplume is not a vertical plume disformed by windshear effects at the time it was photographed.

not vertical at allThis is not a wind-deformed vertical smoke plume in line of sight of the photographer. Image from Bellingcat report


So what to make of all this? Obviously what this part of the dispute does show is how the information war is being waged, what methods parties use when they perform OSINT (open source intelligence) and the difficulties for the public how to assess the information given.

Also very interesting, not mentioned by both parties, was that on the 17th Anton Gerashchenko, advisor for the Ministry of the Interior, was reported as saying for the “112 Ukraine” TV at about 2.5 hours after the crash (approx. at 18:45 EEST) the following statement:

“Our military has detected [or recorded? or filmed?] the missile launch.”

Since then the Ukrainians never published any proof for this statement. Unless, of course, Anton Gerashchenko meant the picture of the alleged launch plume, a piece of evidence he got control of after tweeter @WowihaY handed it over to him soon after the crash. He himself already posted the plume on Facebook at 20:45 EEST, an hour after first appearance.

Though @WowihaY said in an interview later on there was a middleman involved, the photographer (@rescuero) already had made clear in an interview that he had given the picture to @WowihaY because of his contacts with the SBU and apparently with Gerashchenko too. Because of this contacts, as it is assumed, the photographer also was invited by Business Insider at the evening of the crash, surprisingly not to be interviewed as the photographer of the only evidence of a BUK launch, but as a witness of the crash pointing his finger to the ¨terrorists¨ (separatists).

So @WowihaY claimed a local politician was the relay and this man gave the photo evidence to Gerashchenko around midnight. But because the top Ukrainian official posted the plume on social media long before midnight, it could be infered Gerashchenko was already in direct contact with @Wowihay and the photographer and the story of a middlemen was probably invented. This can be corroborated by the fact Gerashchenko posted with his picture a clear clue that led to the location from where the photo was taken, i.e. “Microrayon 3” in Torez.

More importantly, if we assume that at the moment Gerashchenko told about Ukraine ¨detected/recorded/filmed the missile launch¨ he meant this picture (which is the only candidate), we can infer he already had knowledge of this photo almost an hour BEFORE it was first published on the net. If that is true, dissemination – and what more – was executed in full cooperation.


III. The Russian satellite imagery

One of the most painful faux-pas Bellingcat made during its 2 years of existence, was the effort it undertook to debunk the Russian satellite imagery of Ukrainian BUK launchers standing in a field near Zaroshchenskoye village on 17.7.2014. In an outright embarrasing attempt to discredit this imagery, they performed a digital forensic tool, ELA, to perform analysis. Many experts, including the developper of the tool, Neal Krawetz, claimed this technique was used in a way it wasn´t meant for. Krawetz, also quoted by the MFA, even spoke horrified about this abuse: ¨This is a clear example of how NOT to do ELA!¨.

Still not recuperated from this shameful excercise, Higgins mentioned in his letter to the MFA rather euphemistically there were in fact some ¨disagreements¨ about Bellingcat´s use of ELA. That is also a way to put it. It is obvious in an infowar you never admit that you are wrong anyway.

Unfortunately it didn´t impede Higgins to come up with evidence from a technique also heavily disputed, namely reference analysis using Google Earth imagery. This way Bellingcat established some Russian satellite images were falsely dated, because some bushes appeared on their satellite image which in fact were cropped – at least, according to the dated Google Earth and Digital Globe (supplier of imagery to GE) imagery used as reference.

Sat-image-MFAFrom Higgins´ respons to the MFA: Plantations near Ukrainian airforce base A-1428, Avdeevka. The 14 July Russians satellite image of this site (on the right) would show plantations that already would have been cropped before that date according to Google Earth and Digital Globe (supplier of satellite imagery) images.


In fact critics had warned Bellingcat to obtain some official documents about authenticity of the Digital Globe/Google Earth images if used for forensic purposes like establishing a timeline. Bellingcat never did. Or at least they didn´t publish them.

To show the trouble one gets himself into when using this un-authenticated method, we could show the same plantations as they popped up in Google Earth for the year 2012.

bushes google earth

(False) conclusions reach us really swiftly. As can be seen, the sparsely vegetated area in april saw a very sudden and full boom in green growth in only three weeks. Second, 2012 must be a very rainy year compared to 2014, because the plantations still are full grown whereas in 2014 drought has fallen in much earlier. Third, the plantations from 7 May 2012 and 14 August 2012, three months apart, both show full vegetation patterns, so 2012 must be a very moist and fruitful year compared to the dried up July fields of the 2014 Bellingcat study.

Hopefully the reader gets the drift (i.e. the plantation part of the GE image dated at 14.8.12 image is exactly the same as the one dated three months earlier). If one would perform some reference analysis during all these months in 2012 or wishes to establish the vegetational constitution in August by looking at 2012 and 2014, one would be puzzled by the magic rise, existence and fall of these rare plantations. In fact it is shown no reliable timeline can be established by using Google Earth imagery at face value.


IV. The track-a-trail BUK movement

Higgins´ Bellingcat has taken care vigilantly of the job to guard, polish and expand the 17.7.2014 BUK trail through separatist controled area. Higgins showed himself overconfident in taking the MFA on with this treasured chain of evidence. Nonetheless many dots of the trail have faded out after scrutiny by others. At this time a fairly large body of counterevidence has come to light. Recent danger for his trail was an attack on the Luhansk video, which met some interesting criticism from Kemet, administrator of, a Russian discussion forum.

Of course, this video of the ¨unique¨ truck with a BUK on a lowloader missing one missile, already struggled in the trail as a lame duck. From a presser with Ukrainian spokesperson Andrey Lysenko it appeared the Ukrainians already had possession of a video of a BUK movement in Luhansk before they had knowledgde of the downed Malaysian plane.

So from the morning of the 18th on, when they allegedly shot the video in Luhansk of the fleeing BUK that shot down MH17, they should have had two BUK videos in their possession. They published only one, so the question arose if in reality there actually was only one video available. If so, then the video of the fleeing BUK could not have been made on the 18th, but before according to the statement Lysenko made at the presser, so wasn´t part of the BUK trail.

Kemet added more doubts to the 18 July dating of the video. Acording to a screenshot of this video he infered the street lights were still on, though only on one side of the road which allegedly was not uncommon.

luhanks lightpoleScreenshot form the Luhansk BUK video shows a shining lightbulb of a lightpole in the yellow circle. Credits: Kemet.


Time of dawn – the video was set on 4:50 AM – would allow for this to happen. But it seems at about midnight on 17/18 July an electrical sub-feeder was bombed which lead to an almost total black-out in the city of Luhansk. There was no electricity, no water, no internet for about 12 hours at least. Therefore, at 4:50 in the morning the street lights could not have been switched on.

Though the discussion is still running at the moment of writing, if this observation is true, this would mean a final blow to the Luhansk video as part of the BUK track-a-trail narrative.

Kemet also showed a video of BUK 312, the BUK the Ukrainians had falsely assigned the ¨murder BUK¨ role to a few days after the downing, with an overlay of BUK 3×2, the Russian BUK Bellingcat later on connected to the Paris Match picture.

Because BUK 3×2 seemed to have been plan B to discredit the Russians when was found out BUK 312 was in fact owned by Ukraine themselves, it could well be BUK 312 was the one used to create a fake image of a BUK in Donetsk on the morning of the crash. It would be interesting to compare the side-skirts of BUK 312 with the ones at the Paris Match picture, like Bellingcat did when they claimed to see BUK 3×2 from a Russian convoy resurface on this picture (with a technique they called ¨side-skirt fingerprinting¨).

side skirt comparisonSide-skirt comparison by using the video uploaded by Kemet and part of a screenshot from the originally published Paris Match picture.


Also the Torez picture was reviewed once more, at first by Bellingcat themselves in a  report about finding a Jeep from a 15 July separatist convoy.

uaz469-white squareBellingcat comparison of a separatist Jeep with white markings (left) with the Jeep visible on the 17.7.2014 picture of a BUK in Torez.


It was Kusaka Arato again who pointed to an interesting feature of this Jeep UAZ: it had a white cross painted on the side (This is not unusual; it is known the Ukrainians paint their vehicles with white stripes, i.e. vertical ones on the front of tanks). According to Arato he found an example from this Jeep in a video showing Ukrainian army movements (see image below; This is a video in which some of these painted Jeeps and tank appear).

Army Jeep BUK siteFind by Kusaka Arato; provocative question is mine.

It could be the separatists had stolen such a Jeep or used the one from their convoy with the small painted white square Bellingcat used to identify it with. But, nevertheless, what it certainly made clear was, that we should be careful stating with full certainty observations from social media as facts. In that way Arato´s Ukrainian Jeep managed to challenge Bellingcat dogmatism.


The infowar, trolling and facts

After more than 1.5 years MH17 crashed on separatist soil, causing almost 300 people to die, the information war is still raging at full speed. With the information bureau of the Russian Ministry of Defense going into full combat with NATO affiliated social media investigators of Bellingcat, this war seems even to have reached new frontiers. It is the first time, to my knowledge, an official Russian entity gets into direct discussion with a non-state actor about this case.

About the reasons the Russians have to get themselves entangled in a realm Bellingcat seems to be taylored for, we can only guess. Its not that they have to win something by engaging in this dispute when looking at the evidence they put into the debate, like the spare tyre and the vertical plume topics.

Neither Bellingcat’s proof is really convincing by the way. The use of questionable methods, the confirmation biased approach and their eagerness to score in the infowar begs the question what this organization really is all about. Finding facts or creating suspicion? Of course, when asking Aric Toler, Higgins’ aid, which PR firm is advising them on the background, no response was recevied.

Though OSINT gathering by scrutinizing social media is an interesting way to perform investigation and launch discussion, we always should take into account hard evidence is not very likely to pop-up. The photo Paris Match published, of which almost everyone can see at face value it seems to have been doctored, is a fine example of this observation. The real forensic qualities behind this picture – the original dashcam video and its metadata – in reality belong to another, closed realm.

In that respect there is no such thing as “open source”. Maybe Paris Match has this information, maybe Bellingcat has. (They do know who is the provider). But as with the plume pictures, only Ukraine friendly parties got hold of the real thing. Its very telling these two items of key-evidence remain safely in secure private (pro)western hands, as is the almost as important witness account of an AP reporter, who allegedly saw a BUK in Snizhne on that fateful day, but didn’t make pictures nor made himself publically known. Open source journalism seems to go hand-in-hand with anonymous journalism.

When stating in a twitter discussion the real information behind the Paris Match picture should be revealed and become really open source to give dissenters the possibility to investigate, I got a reply from Dutch journalist Rudy Bouma, reporter in Ukraine for the Dutch state-sponsored news show “Nieuwsuur”:

Why would a (possibly endangered) witness turn over exhibits to you? Are you the general prosecutor on MH17 now?”

Well, why wouldn’t (s)he? Paris Match got it, Bellingcat got it, so why not others? Are they prosecutors? Well, in a way, maybe they are actually. (Of course the “endangered” argument is ludicrous. The more people know publically, the less need to get the “freelancer” out of the way, because there is no longer a reason to impede him/her).

This really says a lot. Open becomes privileged and closed, journalism seeking truth becomes PR hiding and spinning information. So hard facts are hard to get, impressions and suggestions to influence the public mind are superfluous. Lessons have to be learned from this. Maybe even the Russian MFA could pay attention. This way not only victims and next of kin, disregarded in this media-led blame game, lose. We all lose.

With special thanks to many people including the Bellingcat twitter troll group.


3 gedachtes over “Bellingcat trolls Russian Ministry of Defense, we all lose

Geef een reactie

Vul je gegevens in of klik op een icoon om in te loggen. logo

Je reageert onder je account. Log uit /  Bijwerken )

Google+ photo

Je reageert onder je Google+ account. Log uit /  Bijwerken )


Je reageert onder je Twitter account. Log uit /  Bijwerken )

Facebook foto

Je reageert onder je Facebook account. Log uit /  Bijwerken )


Verbinden met %s