MH17 and open source intelligence, a suspicious narrative – part 1

This blogpost is the first part of a series that I will publish in the last months before the MH17 trial starts, on March 9, 2020. It will review important parts of the evidence as publically disseminated or (implicitly) endorsed by the JIT. Subtitle will be: “The SBU and its voluntary intelligence unit”.

the Buk_Odeith.all grafitti

Part 1: Open source intelligence

The story about the way that evidence has been built-up and disseminated to the public sphere in the case of the downing of flight MH17, seems to be part of a new phenomenon. Perception management to gain popular back-up for political decisionmaking founds itself in cases of international importance more and more on “open source intelligence” (OSINT [1]), collected and explained by non-state actors (bloggers, NGOs).


The Ghouta gas attack in 2013 in Syria was for the public the start of the quest for OSINT, lead by British blogger Eliot Higgins alias Brown Moses, who fought himself a position as a reliable collector of freely available information. [2] From open sources could be established, the narrative went, that the Syrian government was responsible for chemical warfare against the rebels, a way of waging war with an especially bad reputation (World War I, the Holocaust).

This way Higgins, who would found Bellingcat a few days before MH17 crashed, actually was responsible – in a way – for building up pressure on president Obama, who had drawn a red line against the violence that the Assad government was permitted to use against the jihadi rebels. So, the OSINT blogging way of influencing could not be regarded as childsplay from that moment on and was heralded throughout the western media.


In principle OSINT comprises every information that has been published overtly, but not in the least by ordinary people on social media. Key words in this respect are neutrality, authenticity and spontaneity. It is immediately clear why this type of information has its force of attraction. It is juxtaposed to information coming from official sources, sources that have clear selfinterests and have often been implicated in spin and lies. Messages from ordinary people shared on social media inherently present themselves as neutral, bottom-up and pure, being cleared from the very same manipulations that permeate our society of advertising, PR and “public diplomacy” (state propaganda) on an every-day basis.

The same goes for collected information from sources that can be used to construct important context for planning and decisionmaking, like reconnaissance work normally does. Social geography, physical geography, anthropology – studies of the “environment” – they can all be used for gathering intelligence.

Of course, important for the OSINT community is Google, that supplies a powerful search engine, collects staggering amounts of data and also publishes satellite maps from all over the world, which all are indispensable assets for OSINT gatherers. It cannot be underestimated how valuable their products are and so it should not make waves that this organization has strong ties with the US State Department and also is a Bellingcat sponsor.


Methodological limitations

Although OSINT techniques offer a lot of advantages to retrieve isolated facts, the method also knows its limitations. Obviously the distance of the actual source that has released a certain part of personal information on the internet to the agent that retrieves it, is quite huge. There is no face-to-face contact to engage in a discussion about the precise meaning of the information and under what circumstances it came about. One could get a picture by only thinking about “Whatsapping” in relation to a real conversation, in which many types of information can be shared.

In other words, the context from which a certain part of isolated information has been drawn might be unknown and unclear. For the OSINT gatherer this leaves open the way to interpret the information retrieved the best way (s)he can, or, in other words, as (s)he pleases (within certain boundaries of course). Therefore, in the process meaning is added by the researcher [3] which – unfortunately – in many cases leads to confirmation bias.

According to Wikipedia confirmation bias is:

(…) the tendency to search for, interpret, favor, and recall information in a way that affirms one’s prior beliefs or hypotheses. It is a type of cognitive bias and a systematic error of inductive reasoning. People display this bias when they gather or remember information selectively, or when they interpret it in a biased way. The effect is stronger for desired outcomes, for emotionally charged issues, and for deeply-entrenched beliefs. [4]


From research is known [5], for example, that especially the interpretation of imagery in newspapers is altered easily by providing different context in a caption. This leads the public to adopt certain conclusions that are favored by the publishing agency. The same effect might be observed when OSINT groups publish their results. So the processed information as relayed through the middle layer of OSINT gatherers is often not as neutral as it is presented.


Another problem of this method, tied to what has been explained above, is that authentication is inherently difficult. Source and its information need not be what they seem or purport to be. It seems that the Dutch Prosecutors Office has concerns [6] about some new methods to manipulate information, also called “deep fakes” [7]. Ironically, this might raise some questions about their own method of investigation in the MH17 case, that pivots around a lot of unauthenticated social media information that, as we will see later on in this series of blogposts, is tied to the Ukrainian secret service, SBU.

Well known may be the position of the socalled “astroturf organization” [8] in the civil society. One could say that in the mass media this role has been played by the OSINT collecting propaganda community that is tied ideologically, financially and logistically to vested interests. It offers an image of bottom-up grassroots neutrality, spontaneity and authenticity, whereas in fact huge interests are lurking underneath.

Organizations in the civil society should reflect civil interests to counterbalance the influence of the big players of state and market. The mass media should assist in creating a space, that could be used by the people and their organizations to generate informative opinions, as an informed public is a necessary precondition for the government of a democratic society.

However, astroturf organizations serve special interests – as is common good in the world of Public Relations – and well known OSINT organizations do not provide unbiased, neutral and impartial information. Actually, sometimes even the impression arises social media and OSINT organizations are used as a cleaning layer for information coming from the intelligence community or others to wash it clean of suspicion before it reaches public opinion making.


Social media, OSINT and the JIT

Speaking about the MH17 case, also the Joint Investigation Team (JIT), commissioned to lead the criminal investigation, could not detach itself from the fruits of this new technique of manipulated opinion making. Actually, their entire public performance relied on it, which on its own showed a remarkable step towards the way public opinion nowadays is prepared for certain decisionmaking, in this case of legal nature.

For example, in their press conference on June 19, 2019, alleged evidence of the border crossing of a Russian Buk into Ukraine was suggested by showing a chat retrieved from Russian Facebook, [9] Standard policework would entail secrecy as a precondition to perform further investigation, i.e. questioning the source and the people playing their parts in the “tip-off” received. This investigation would be needed to clear up the context in which the presumed facts about the information are embedded and how their authenticity and meaning should be assessed.

M and Anastasia

The way the JIT handeled this, was a clear-cut example of the way OSINT collectives like Bellingcat operated from the first moments after the crash. The JIT presented the chat as a part of isolated information, cut-out of its context, then spinning it by replacing the left-out, uninvestigated context with a context that supported the standing narrative. Actually we were dealing here with a clear example of confirmation bias. There is a narrative and then a part of information found, is interpreted to fit the desired story.

As an example, we could assess another account of a presumed soldier asserting he was part of the 53rd Kursk brigade and therefore had come to know about culpability of the unit sent out to the Donbass to fire its deadly missile (see chat on below [10]).

Rafael Kursk

Is this evidence? Or is this just untrue tall talk or a joke and should we actually assess the information as being false? Do you trust the poster when he says he is bound to silence because of a contract?

And when I tell you this guy Rafael was still 16, according to his profile, when MH17 was shot down? Obviously he couldn’t have been a soldier then, so in that case he must have picked up rumours from his comrads much later – if, of course, he was really part of the 53rd brigade at some point.

And if all this would have been proven, how trustworthy would these rumours be? Maybe they were just reflections of the JIT accusations. But if you are willing to interpret to a desired story, dismissing all uncertainties and unknowns from a distance, you might support the idea that the truth about MH17 is going around through the barracks in Kursk, right?

It is clear that because the OSINT method, as argued, often leads to filling in blanks between isolated facts, or “points”, of information, often a lot of speculation is needed to draw a storyline between the dots. This speculation might be done reasonably in an educated way or biased, unsound and even bad intended.

This last approach might lead to situations in which the overall storyline is maintained, though the parts of evidence, or “points/dots”, that are conveyed to support it, differ from time to time. Especially when new, contradicting information surfaces. The movement of the launchspot 300 meters to the east, away from the “charred earth”, may attest to this. The story remained the same – a Buk launch had set on fire a piece of farmland, and this charred earth proved it – but the specific site was replaced later on to a part of the same field that actually did not show those charred spots. (See my blogpost here).

In the first Kursk soldier case above Bellingcat asserted in a report, following certain leads, it was “most likely” that none of the soldiers of the 3rd battalion, so including first lieutenant XXX from the JIT “point” of information, traveled with the Kursk convoy. According to them there were no “cool guys from the 3rd” that offered soldier Sergey M. a good time on their way to the “west”.

2nd batta;ion manned 3.2

It will be interesting to follow Bellingcat’s quest for the Buk button presser, whom they presumably found in the 2nd battalion.

Romijn knows shooter

The “mounting evidence” trap

In a handfull of pressconferences the JIT has been releasing slowly presumed evidence over the years, which appeared to be originating from neutral sources, but actually was embedded in a preconceived frame. Apparently the OSINT based investigation that the astroturfers from Bellingcat cooked up, has been very useful to portray a story of advancement in the investigation. Hence JIT presented each pressconference “new pieces of the puzzle” from which we arrived “step-by-step closer to the truth” as there was “mounting evidence”.

In the media the “mounting evidence” soundbite was used from the start, on every occasion when people that were attached to the desired and official storyline, found new proof by interpreting information in a confirmation biased fashion. See e.g. my series of blogposts here, in which I laid down 5 examples of the way how confirming evidence was fabricated from separatist’s own words.

mounting evidence

On its own this mounting evidence trap invites the use of even more confirmation bias when the next “evidence” will be found. It is a self-reenforcing process, in which circular referencing establishes more and more trust in the narrative that serves as the dogmatic frame for interpretation. Eventually, this goes on until every doubt will be erased, which is more or less the way the public is responding to the JIT revelations.

In the following blogposts of this series the origins of the open source intelligence that plays a pivotal role in the criminal case of MH17, will be reviewed. These blogposts might be read in two ways. One might assume the gathered OSINT is indeed neutral and arrived from bottom-up sources – though with a little help from the Ukrainian secret service – only to be relayed to the mass media by a neutral player, that is: Bellingcat and associates.

Another, more critical way of looking at the information laid out here might stimulate to become more receptive to the red flags of suspicion that were raised along the way – scrutinizing these seemingly neutral, but through-and-through manipulated information packages.

In a full report I have assessed critically all parts of the OSINT evidence that have been publically used to support the leading narrative. This narrative has pivoted around a Russian transport of the air defense missile system “Buk” that allegedly went in and out of Ukraine within a day, in the meantime firing its deadly missile from a separatist controled farmfield south of Snizhne. Studied items are photo’s, video’s and written messages about the transport, witness accounts in the (pro)western mass media and calls between separatists as intercepted by the SBU.

The report, Problems of the track-a-trail evidence, shows more than 120 notes with links for verfication, next to links to the original sources when still available. It also contains specific information about first time publication of these sources. In bulletpoints I address the saliencies and problems that have emerged out of many debates on these topics.

For the trial that the Dutch prosecutor, Het Openbaar Ministerie, will start on March 9, 2020, this report could be a fine reference book. Furthermore, the blogposts I will post in time will present an overall picture about how the evidence came about and who were behind it. A lot has been posted already on this blog, though in parts and pieces put into updates. I hope with this series to tell a complete story. I think this is indispensable information, needed to keep a clear view on the trial.






[5] “What Does This Picture Say?” Reading the Intertextuality of Visual Images – Werner Walter, International Journal of Social Education, v19 n1 p64-77 Spr-Sum 2004






Geef een reactie

Vul je gegevens in of klik op een icoon om in te loggen. logo

Je reageert onder je account. Log uit /  Bijwerken )

Google photo

Je reageert onder je Google account. Log uit /  Bijwerken )


Je reageert onder je Twitter account. Log uit /  Bijwerken )

Facebook foto

Je reageert onder je Facebook account. Log uit /  Bijwerken )

Verbinden met %s