MH17 and open source intelligence, a suspicious narrative – part 5: Common goals


The JIT, the SBU and the intercepted calls

In parts 1-4 of this series we have seen that the evidence as comprised of photos, videos and written reports about a transport and a launch of a Buk air defense missile system allegedly implicated in the downing of flight MH17 has connections to an organization tied to the Ukrainian Interior Ministry in cooperation with the Ukrainian secret service SBU. In fact, it seems the SBU is main provider of the evidence as it has a stake in almost everything, from the social media proof to the conversations of high-ranked separatists that they intercepted.

In this blogpost the most important intercepts that have been published on open channels will be reviewed. Three modes of manipulation of the tapes will be suggested to account for the contradictions and irregularities that surface from close inspection of the conversations displayed. Investigation lays bare that the transcripts of the tapes should not be consumed at face value, as they don’t show clear leads for accusations when closely read. Furthermore, the story that unfolds in this blog leaves behind some profound questions that need to be answered, not only about the MH17 evidence itself, but also about the conduct of the investigating and prosecuting parties.

Conclusion should be that the SBU is implicated in demonstrable pieces of manipulation or even outright fraud, not only supported by the uncritical anti-Russian OSINT community, i.e. Bellingcat, but also fully backed-up and endorsed by the JIT, which seems to have merged their objectives with those of the post-Maidan Ukrainian state. Reading this elaborate report will provide a “treasure trove” of information that is necessary to assess the value and quality of the evidence that will be presented by Het Openbaar Ministerie in the MH17 trial, which will start March 9th, 2020.

There is a lot more to the Ukrainian intelligence agency SBU in which the JIT has all confidence. Their operations even had an earlier connection with the Netherlands:

Eleven years ago, 24 paintings and 70 pieces of silver were stolen from the Westfries Museum in Hoorn. This includes works by Jan van Goyen from 1632 and Hendrik Bogaert from 1671-1675. There was no trace of the perpetrators until last year. In December 2015 it appeared that the stolen art from the Golden Age [17th Century] was in Ukraine and was circulating among criminals, militia leaders and corrupt officials. They were stuck in their stomach with the stolen items because they are unsaleable on the international art market.

In Ukraine investigations into the matter were obstructed and a policy of denial seemed to reign:

“We get signals from people who have been interviewed in Ukraine that statements are not being fully taken over, things are being added and it seems that people are mainly trying to prove that Ukraine is not actually involved,” says Geerdink, director of the Westfries Museum.

Unfortunately they were not only implicated in art thievery but also in more gruesome aspects of the work of an intelligence agency, for example concerning acts of torture:

In 2017 Amnesty International reported that during the War in Donbass there were overwhelming evidences of ongoing war crimes, including torture and mass murders of prisoners. Particularly, in Eastern Ukraine Security Service of Ukraine (SBU) operates special hidden prisons for alleged Donbass rebels where unacknowledged detention is accompanied by widespread torture and different kinds of human rights abuses. Ukrainian government tried to deny the existence of the blacksites, but it was confirmed by multiple reports of UN monitoring mission in Ukraine, Amnesty International and Human Rights Watch.

SBU logo

In part 3 was revealed that the extremist militia corps Tornado was organized and led by officials of the Interior Ministry and the political party they were representing. Witness accounts about the repugnant conduct of this provider of evidence in the MH17 case, at least responsible for the imagery of the alleged 17 July Buk transport in Torez and probably more, sound like a true horror story:

Ukrainian volunteer battalion “Tornado” became another infamous example of a mass torture and sadistic practices used by Ukrainian paramilitary forces. According to Der Spiegel the prisoners captured by “Tornado” were held in basements, stripped totally naked, placed on a concrete wall, doused with water and tortured by applying electricity to testicles, genitals and other body parts. Also some prisoners were forced to rape each other under threat of death. According to what has been videotaped by the officers of the “Tornado” there were local civilians among their victims including women.

The investigation revealed that the commander of “Tornado” had several prior criminal convictions, but for his political supporters it wasn’t a reason to worry about. The absence of war crimes charges (including rape, murder, cruel treatment, sexual violence) remains as another unexplained question. The similar pattern has been documented in other investigated cases of Ukrainian atrosities.

For many people in the Netherlands, home of the MH17 Prosecutor and leading investigators of the international team JIT, these acts will be dealt with by simply ignoring. For others, awareness of these truths will be experienced as new and rather shocking. For the few people knowing about the recent history of western imperialism, especially of the US and this country’s assistance to neoliberal/neofascist regimes in Latin America in particular (almost a rulebook for US policy in Ukraine), this just is business as usual.

secret prison

However, and this cannot be stated enough: This is the party the Dutch Prosecutor leading the MH17 case is working with and, even more alarming, is almost entirely dependent on. Even not that reluctantly, it seems. This invites questions about the purported objectivity of this organization and its investigations, in a time when also other institutions like the OPCW (i.e. the Douma Syria gas attack) are under suspicion of being led by the political interests of western countries.

5.1 JIT and SBU

First signs of total adherence of the JIT to the SBU agenda were seen in a video concerning a “Call for witnesses”, issued on March 30th, 2015.

In this video the narrative of the Russian Buk that was transported through the Donbass to a site south of Snizhne, where it launched a missile, got all the attention. Actually it was said that this was only “one” of the “main scenarios” the JIT was working on. However, apparently only one main scenario was important enough to find witnesses for, implicitly denying – for example – the fact that many local witnesses had seen fighter jets in the area some time before or after the shoot down.

Secondly, the video clearly meant full embrace of the OSINT method by showing the Buk trail consisting of the Paris Match stills, the Torez photo, the Snizhne Karapetyan photo, the Snizhne T0522 video and the Luhansk video. The call for witnesses video also displayed calls from subcommander of the DPR forces “Khmuryi” alias Sergey Dubinsky, allegedly intercepted by the SBU on the morning of the 17th and published a day later (see section 5.3). By doing all this, publication of the video also meant full acceptance of the SBU as a reliable partner and main evidence provider.

main scenario

only confirming witnesses

A clear example of the JIT succumbing to the Ukrainian/SBU narrative and taking on the Russians head on was the release of a video after they held a press conference on September 28th, 2016. Russia had worked on counter evidence to the Buk trail story by issuing satellite images of what were alleged to be two Buk vehicles standing in a farm field south from the tiny settlement of Zaroshchenske. Also Buk manufacturer Almaz Antei reported calculations from which was concluded that if a Buk was fired, it had to be a missile that was launched from an area some kilometers east from Zaroshchenske.

The released video with a call intercepted by the SBU, showed a conversation in which a DPR militant was asking for verification of the situation around Zaroshchenske at July 17th. This conversation proved it was not under Ukrainian control by this time, according to the JIT.


Actually it was not very strong proof, as the video only showed a testimony from one soldier who had to dig deep in his memory to come up with the answer the DPR controled Zaroshchenske. Besides, as an American engineer showed in an elaborate report about this topic, the Ukrainian army occupied semi-permanent positions near the proposed launch site only from July 15th (p. 44) until July 21st., a very short time lapse.

Pro-separatist news boards mentioned that on the 16th a convoy of the Ukrainian army was shelled with GRAD, right near Velyka Shyshivka/Bolshaya Shishovka. This was a village 4 kilometers east from Zaroshchenske and actually also the site to which Almaz Antei had assigned the biggest probability of a Buk missile having been fired. Apparently, the Ukrainian army had been there.


At about the same time, we also covered a Ukie column with GRAD near Amvrosievka (DPR), in the area of Bolshaya Shishovka [Velyka Shyshivka] village.”

From this it was clear that the JIT merged totally with the Ukrainian position and even publically confronted the Russian Federation with flimsey and dubious evidence provided by the SBU.

The JIT even decided to throw in some PR to soften up the image of the Ukrainian secret service. A classy styled “e-magazine” was published on the internet – not very informative with respect to the actual forensic investigation, but apparently meant to convey some “human interest” content. In the e-zine published in June 2016, three months before the Russian Buk trail was officially endorsed as only possible scenario on a press conference, the SBU representation was praised as a team of solid co-workers:

Since the first week of September 2014, investigating officers from The Netherlands and Australia have worked here. They work in close cooperation here with the Security and Investigation Service of the Ukraine (SBU). Immediately after the crash, the SBU provided access to large numbers of tapped telephone conversations and other data.

At first rather formal, cooperation with the SBU became more and more flexible. “In particular because of the data analysis, we were able to prove our added value”, says Van Doorn. “Since then, we notice in all kinds of ways that they deal with us in an open way. They share their questions with us and think along as much as they can.”


The late and missed Robert Parry pointed to the obvious, which was that the main goal of the secret service is to protect their own state and its secrets and therefore, in the MH17 case, also a possible Ukrainian involvement in the shoot down:

[This control by the SBU, combined with its past obstruction of the UN torture probe], suggests that the SBU also would steer the JIT away from any evidence that might implicate a unit of the Ukrainian military in the shoot-down, a situation that would be regarded as a state secret which could severely undermine international support for the U.S.-backed regime in Kiev. Among the SBU’s official duties is the protection of Ukrainian government secrets.”

The Netherlands and Australia, who both took the forefront in the accusations against Russia and the indictment of four DPR soldiers, did not seem to worry about cosying up to the feared Ukrainian secret service, also implicated in torture. Neither the fact that Ukrainian JIT member Vasyl Hrytzak was involved in the creation of fake evidence in the Babchenko murder case (see part 3, section 3.5), was a reason for distrust. The Dutch nor the Australians even raised an eyebrow when their co-worker, head of the Ukrainian team within the JIT Vasyl Vovk, made despicable antisemitist statements in the media or when he blabbed the Buk actually came from the Crimea.

Another suspicious move by an Ukrainian official close to the investigations, Valentyn Nalyvaichenko, who was heading the SBU until 2015, should have alarmed the team. Nalyvaichenko openly supported a theory of Russian culpability for the MH17 crash in which was claimed the Russians had deployed a ¨False Flag Operation¨. By downing the Russian flight AFL-2074 from Moscow to Larnaca, Cyprus, and blaming the Ukrainians for it, they would have been able to fabricate their so needed casus belli for invading Ukraine. When they hit MH17 instead, that was by mistake.

Nalyvaichenko conspiracy


Screenshots from SBU website mentioning the Russian army had devised a false flag operation, which went wrong.

Although the fatal mistake narrative did fine in different versions of the story (as will be recalled in section 5.2), this should have been just a bridge too far for the responsible professional law enforcement officers of the JIT. Nonetheless Nalyvaichenko was never reprimanded for this by sources from or close to the JIT.

These examples do not claim that the JIT partners of Ukraine are clueless sockpuppets of the SBU. The JIT actually did distance themselves from Vovk and Nalyvaichenko. Eventually in 2018 the two former co-workers were officially denounced on the website of the Dutch Prosecutor’s Office, Het Openbaar Ministerie:

“The Joint Investigation Team (JIT) wishes to stress that Mr Vovk and Mr Nalyvaichenko left the SBU in 2015. It is clear from that moment on, they did not have any access to the MH17 investigative results. In fact, even when they were still employed by the SBU, they were never involved in the process of gathering evidence and analysing that evidence, nor in the position to advise or decide on whether any person has the status of suspect.”

However, they were not recalled because of their conspiracy stories or because of their other doubtful statements, but because they were interviewed by Dutch news show Zembla on March 7th, 2018, In this report they pointed to Sergey Dubinsky as a suspect to be indicted, before the JIT did this officially. Torture, fakery, antisemitism, conspiracy thinking, the Dutch and Australians didn’t seem to mind at all. Leaking true information, on the contrary, proved to matter.

Zembla NalyvaichenkoZembla Vovk

5.2 Framing the “main scenario”

At the moment parts of the plane exploded on the Donbass soil, it was evident the question of guilt would first pass on to the people controlling the land. A screenplay written after a book of the famous Dutch writer Harry Mulisch plays with the phenomenon and won an Academy Award with it. In ¨The Assault¨ a collaborator with the nazi occupation is murdered by the Dutch communist resistance. Because the dead body of this man is found in front of the house of the family of protagonist Anton, he and his family are captured and their home is burnt to the ground.


Except Anton himself his family perishes in the death camps, because the Nazis made a connection between the murder and the place where the body was found, though the people living there had nothing to do with the act. That such a connection can raise – possibly undeserved – suspicion is all the more clear when MH17 crashed in rebel controlled territory.

The connection was used immediately – within 2 hours – by pro-Kiev propaganda channels. Most important example of disingenuous thinking to boost evidence about separatist guilt was the story that was fabricated around the retraction of a posting from pro-separatist news board on, “Strelkov_info”. In two blog posts I de-constructed logically the narrative that commander of the DPR forces, Igor “Strelkov” Girkin, had deleted a posting in which he tacitly admitted having shot down a Ukrainian cargo plane AN-26, which subsequently appeared to be flight MH17.

See: Myth of the “fatal mistake”: how the MH17 infowar started

and Down the rabbit hole with Putin haters: old narrative fails but Strelkov did it anyway

Citizen investigator Arnold Greidanus took the story to its final grave by proving that the original poster of the information, someone with the nickname Margo-Donetsk, had posted statements, a video and speculations that she had copied from locals near the crash site. Her message and edits appeared on the web forum, the only forum on which also Igor Girkin posted. Because she posted on this webforum, the administrators of Strelkov_info, who read her posts, labelled her information as “coming from the militia”.

Eventually Greidanus had to concede to an assessment that I had made before:

All in all, Margo was just another pawn, unintentionally reporting the ‘facts’ as she perceived them to be, within the context of what was known at that time. She most likely picked up some pieces of information from within militia circles, but she was not informed accurately on what had actually happened.”

One of the sources behind this apparent fabrication was pro-Kiev propaganda organization Euromaydan, that posted a message on Facebook only 54 minutes after the Strelkov_info message board – so in fact a fan site, not related to the commander himself – posted the information they had retrieved from other sources on social media.

It said:

Apparently, the terrorists shot down a Malaysia Airlines plane. Strelkov brags on Vkontakte. There are videos.”

Euromaydan strelkov

Also Ukraine Crisis Media Center followed with a posting mentioning that:

Terrorists probably mistook passenger plane of Malaysia airlines for Ukrainian transport aircraft.”

UCMC Strelkov

The anti-Russian OSINT community, represented by Jeffrey Lewis in the example below, showed exactly where it went wrong. They even went from the false assumption that the posted videos, which were clearly recorded by locals, were captured by the shooters themselves.

Lewis premature

Lewis 1

Group Think in action. Jeffrey Lewis, distinguished member of the anti-Russian OSINT community, takes over at face value the disinformation spread by a.o. pro-Kiev propaganda channels Euromaydan and Ukrainian Crisis Media Center about a retracted message, allegedly posted by separatist commander Igor Strelkov. By deleting this post the commander would tacitly have admitted guilt for mistakenly downing a cargo plane of the Ukrainian army which subsequently appeared to be MH17.

In this article by Mashable’s Christopher Miller, written on the 17th, an example is shown of how the pro-Kiev site was dealing with the story and how easily it was copied throughout the western media.

The facts were different and not hard to find. Administrators of a group, dedicated in name to the commander, had posted – directly and indirectly – information and speculations from locals. Misinterpretation was caused by a hyper partisan inability to think logically and by imminent reliance on desired narratives, which were based on unauthenticated “points” of manipulated social media information. The observed behaviour emanated from the inherent difficulties of the OSINT method when a biased point of view is maintained, as described in part 1of this series.

The constructed narrative spread itself over the internet and finally even ended up in a “Note of Suspicion” that the Ukrainian judiciary wrote about Igor Strelkov Girkin (see screengrab below) after the JIT indicted him, as was made public on a press conference on June 19th, 2019.



16:37 – Opening textbox first message by administrators of Strelkov_info on, as shown in message;

16:41 – Actual posting first message on according to unix timestamp. About the same time also a tweet was posted;

16:50 – Opening textbox second message by administrators of Strelkov_info on, as shown in message;

17:16 – Actual posting second message on according to unix timestamp. About the same time also a tweet was posted.

timestamp first posting

Example of the first posting on Strelkov_info mentioning an AN-26 fell down in the Snizhne region near the mine Progress. The posting was timed on 17:37 Moscow Time, 16:37 local time. This was the time the textbox was opened. The actual posting was on 1:41 PM UTC, 16:41 local time, according to the unix timestamp.

The use of certain hidden premisses, false assumptions and unsound logic was behind the construction of this story, as I wrote in my first blogpost about this topic. It was assumed Strelkov himself had written the report about a downing of an AN-26, with his (or his minion’s) fingers still on the trigger.

Statements from a source high up in the chain of command suggested knowledge of inside information close to the event and so it was preconceived that the information arrived from first-hand witnesses implicated in an actual downing. At the same time other possibilities – ie. the forum had received information from others, local residents for example – were cancelled out.

Even until now this fabrication is taken very seriously, begging the question what this says about the pro-Kiev OSINT gatherers and the (pro-)western media who copied them blindly.

Second building-block of the fatal mistake narrative that arrived to the public on the evening of the 17th were tapped conversations shown in a video published by the SBU on YouTube on 22:11 local time, so within 6 hrs. after the crash. The full video comprises of five parts of intercepted conversations, which are:

Part 1 (allegedly intercepted on July 17th, 4:40 local time): a conversation between Igor Bezler (DPR sub-commander) and Vasili Geranin (GRU Russia), which said: The Miner’s group shot down a plane, it went down beyond Enakievo” (for the conversation see screenshot from Bellingcat report below).


Part 2 (allegedly intercepted on July 17th, 4:33 local time): Major (separatist) – Grek (separatist); The Cossacks from the Chernukhino checkpoint shot it down;

Part 3 (allegedly intercepted on July 17th, 5:11 local time): Major Grek; Plane broke into pieces and a body found at Petropavlivka (cockpit section);

Part 4 (allegedly intercepted on July 17th, 5:32 local time): Major – Grek; “We are 100% sure it was civilian”

Part 5: Kozytsin (Cossack commander)DPR militant (allegedly intercepted on July 17th, 5:32 local time): “Why were they flying overhere? They must have been spies”.

SBU manipulation

Some guidance between part 1 and part 2 provided by the SBU.

Soon after publication of the tapes technical analysis proved manipulations by heavy editing. Also Micha Kobs detected irregularities as mentioned in Haunt the Buk, his 100 pages report (p. 9-11). Eventually, in 2019 the Malaysian forensic expert Akash Rosen conducted technical analysis and concluded the conversations were severely edited and manipulated at such a level that it rendered the tapes forensically useless. (Download Rosen’s report here).

In 2015 I wrote a blogpost in which I performed text analysis on these conversations based on Information Manipulation Theory and a little research into the backgrounds. To me it seemed that the conversations of part 1 and part 2 possibly were from July 16th, as the information mentioned matched an event on this day. Rosen proved subsequently that the conversation in part 3 displayed the same Major and Grek characters as featured in part 2. This conversation was clearly intercepted on July 17th as it concerned finding debris of a civilian plane near a site where also parts from MH17 were found. Part 4 was also recorded on July 17th, but showed another Major and Grek, according to Rosen’s analysis.

Most important manipulation I detected was the glueing of parts 1 and 2 (about a plane that fell beyond Enakievo and a downing from Chernukhino) to parts 3 to 5 (about MH17), as this inflicts the impression all conversations concern one event on the same day, which was the downing of civilian plane MH17. This was supported by the impression that two interlocutors, Major and Grek, participated in part 2 (about a shooting by Cossacks from Chernukhino) as well as in part 3 (about the MH17 disaster). To inflict a better adherence the times of these two conversational parts were falsely set within minutes apart, when the intercepts actually were recorded on different days.

Rosen part 2

Screenshot from the report by Akash Rosen. It could not be established technically that part 2 was intercepted on July 17th. Furthermore the part showed editing. The tapes are forensically worthless.

Eventually this story about a downing beyond Yenakieve/Enakievo and a shooting by Chernukhino Cossacks was deviating from the official narrative at such a profound level that virtually nobody brought it up for almost 5 years. Reason for this was that the mentioned launch site, Chernukhino, was silently put aside for the Ukraine@war/Oliphant farm field as it did not match any of the other alleged evidence.


After five years Bellingcat gave it a try. In a report named “Birdie is flying to you”, published on 19 June 2019, Bellingcat brazenly tried to make sense of the tapes, including the Birdie-comes-to-you tapes that supported these conversations. Struggling with logic and proposing a myriad of theoretical possibilities the collective tied this story to the disaster that happened on the 17th.

The fact that Bezler gave in his conversation with GRU man Geranin the Miner’s group the credits for the downing was based on a possibility this group could allegedly have had some minor involvement in the events on the 17th “… which prompted Bezler to boast to Moscow [Geranin; HR] about the involvement of his own subordinates in the downing [of MH17]”. In other words, they did not shoot it, but Bezler told “Moscow” anyway to gain credits for it.

The part of the tapes in which Bezler said “the plane fell just outside/beyond Enakievo” was solved by Bellingcat by dismissing the 13:00 shooting of a Su-25 near Gorlovka/Horlivka on July 16th, 2014, as also registered in the ASN Wikibase.

ASN database

Also according to pro-seperatist message boards a plane was hit near Horlivka – a city north-west from Enakievo, so “beyond Enakievo” from the Chernukhino perspective. Colonel Cassad live journal and Vineyard of the Saker, both brought the news a few hours later:

[16:35 MSK, 15:35 EEST] “UPD 2: A Sukhoi jet was shot down over Gorlovka [Horlivka], it was leaving towards Mirgorod with a dense black smoke, it is not likely that it is going to make it.¨

17:05 MSK (16:05 EEST)– July 16, 2014 – Briefing from the Militia
We did a bit of damage to a Su jet over Gorlovka. It left in the direction of Mirgorod garnished with a thick black tail of smoke. Don’t think it will make it to the airfield with damage like that.

However, the Ukrainian Ministry of Defense reported that the plane had returned, dispatched also by the Kyiv Post. It was forced to land, but in the end apparently managed to fly back to airforce base Mirgorod.

Ukr MoD Horlivka

Today, July 16, at about 13.00 during a combat mission in the area of the anti-terrorist operation an SU-25 was damaged by terrorists from a portable anti-aircraft missile system. The pilot (…) made an emergency landing successfully. The commander of the plane was not injured. The plane has minor damage and is subject to restoration

Apparently Bezler was not aware the plane had been able to get away at the time of his conversation with Geranin, when his people were still looking for the plane to photograph it. Having read the above confirmations, we should remember the following lines from the tapped conversations, in which Bezler also made notice of the smoke, as also was reported by the pro-separatist message boards:

Igor Bezler: We have just shot down a plane. That was the “Miner’s group¨. It fell down beyond Enakievo (Donetsk Oblast).

Vasili Geranin: Pilots. Where are the pilots?

IB: Gone to search for and photograph the plane. It is smoking.

Based on initial reports, pro-separatist message boards copied information provided by the militia that the plane left, emitting a dense black smoke, towards Mirgorod, which is the home of the 831st Tactical Aviation Brigade, a location further to the north-west. However, according to Bellingcat the hit, which eventually led to an emergency landing, did not count as an attempted downing and neither Bezler reporting that the plane was emitting smoke, rang any bells:

With no other known incidents reported, Bezler’s main argument—that his conversation with Geranin concerned talk over an Su-25 aircraft downed on 16 July near Yenakieve—appears to be an attempt at manipulation.”

Reasoning behind this conclusion was that it would be unclear if the 13:00 hit as mentioned in the dispatch from the Ukrainian Ministry of Defense was the same as the Horlivka hit. At first a separatist commander had reported on FaceBook two downings of jet fighters involved in attacks over Savur Mohyla, but it appeared that only one of them was hit. This was set straight by the Ukrainian Ministry of Defense in its official dispatch (i.e in the line before the above translated part of their message), although they only mentioned 13:00 and not a site of the forced landing.

An article on, timed 17:52 MSK, more or less corroborated this, as the separatists had not confirmed the second downing yet at the time.

Militia on Wednesday shot down two Su-25 Ukrainian air force [fighterjets] attacked positions of self-proclaimed supporters of Donetsk National Republic in the area of Saur-grave [Savur Mohyla], [as was] said to “Interfax” in the information center of the National militia of Donbass.

“One of the planes was shot down from a portable missile system near Gorlovka [Horlivka]. He left, Smoking heavily, in the direction of Mirgorod airfield. On the second the situation is specified”, – militiamen speak.

Interfax has no information on this from other sources.

Militias regularly claim downed aircraft of the Ukrainian air force. However, this information is not always confirmed.

Bezler’s soundbites “beyond Enakievo” and “it was smoking” seemed to have been followed up by reports on separatist news boards mentioning “Horlivka” (which is beyond Enakievo), “we did a bit of damage to a Su” and “it left with dense black smoke”, which were relayed to them before 15:35 local time.

This seemed to match the content of the official Ukrainian dispatch of a plane that was damaged at 13:00, but managed to fly back after it had made an emergency landing. Besides, also the ASN Wikibase mentioned 13:00 hrs. for the Horlivka hit, based on a military source. Finally, also the Interfax article showed that they heard from the DPR press center that the hit over Horlivka was related to the two reported downings of the Savur Mohyla attacking planes. The Ukrainians contested that two planes had been downed, but confirmed one hit. This had to be the Horlivka hit.

In any event, the Chernukhino checkpoint as a launch site was really off base, so that was still a thing that could not be solved. Bellingcat decided to just leave it with that:

It remains unknown why Major initially reported to Grek that the Chornukhine Cossacks were responsible for the downing of MH17.” (p. 35)

Actually, Major did not say this. This character says nothing about MH17 in relation to the Chernukhino Cossacks shooting he is reporting. This only was suggested by the SBU by manipulatory glueing the events to each other by splicing conversations from different days and display them as being from the day of the crash. This was an apparent fabrication, which was taken over uncritically by Bellingcat, discarding clear leads and facts.

Nonetheless, the facts as established by Bellingcat in their report were that MH17 was not shot by the Miner’s group and not from the Chernukhino checkpoint. Still, Bellingcat speculated out of its way to glue this event from 16 July to the MH17 downing, whitewashing a clear SBU forgery along the way.

Another intercepted conversation featuring commander Bezler was published in the famous “Birdie comes to you” video, also revitalized in the same Bellingcat report from June 19th, 2019. Apparently the SBU tried to stick this conversation to the events on the 17th by mis-timing and mis-dating the intercepts. A few times it was emphasized that the conversation allegedly took place on July 17th, two minutes” before MH17 was hit, as also was displayed in the upper right corner of the video.

Then the conversation went as follows, as the screengrab below from the Bellingcat report shows:

Bezler Birdie

I assessed, assisted by a statement by the JIT that it took at least a few minutes to start up launch after a decision was taken to fire, the 1 to 1.5 minutes that were left consisted of too little time for going through the chain of command and launch sequence.


Furthermore it was my impression that the actual information conveyed – the spotter sees nothing because it is too high and clouds are covering the sky – was too imprecise to base any action on by a stand-alone Buk with limited vision. In a recent blogpost I addressed the illogical behaviour of a Russian Roulette scenario which should have accompanied the making of a fatal error:

How, then, should we interpret the story? A trained crew, which according to the official narrative would have accompanied the Buk, finds itself in the field for several hours. The chain of command knows nothing about airliners flying over the area, so the crew has not been briefed about the presence of civilian flights. With the radar vehicle of the unit absent the capabilities to monitor the airspace are quite limited.

Only in a scenario like this the Buk crew operated from the assumption that every aircraft flying over was an enemy target. Then every spotting, how empty of clear leads it had been, would be sufficient to open fire without any confirmation:

According to the SBU-taps a spotter does notice something, but cannot identify it because of the cloud cover. ‘Something big?’ He doesn’t know. The Buk then activates its own radar for the first time – as the crew doesn’t seem to be aware of flights at high altitude [from its own radar capabilities]. Next it notices MH17 coming into view, whilst a Boeing 777 of Indian Airways coming right behind it, at about 30 kilometres, is apparently not in sight.”

Then they launch a missile, in fact immediately after the plane reaches the utmost target boundary of 32-35 km. Another version could be that they did not rely on their own radar capabilities at all and went from kind of a blind mode:

It may also be that the Buk operated in the so-called ‘limited detection mode’, in which the radar only covers a small portion of the sky, and therefore lost sight of the planes at high altitude altogether. This cannot be called any differently than kind of a full-blind mode. In that case the crew apparently decided to play Russian roulette in the air, with only vague information from a spotter to go by. Otherwise, the launch would be inexplicable (and just happened).

The two minutes time lapse also did not fit Bellingcat‘s speculations with which the collective was trying to stick the SBU’s “Birdie comes to you tapes” to the events that led to the crash of MH17.

Bellingcat Birdie

Naemnik/Naimanets made an error or the SBU did, by making a tiny mistake in their timing, repeated several times with capitals and underscores. Or Bcat was wrong, and this was an intercept of a conversation about another spotting, from unknown origin, that was deliberately falsely timed and dated by the SBU. Apart from the 2 minutes in relation to the apparently false timing of July 17th, 16:18 local time, nothing actually points to MH17 or to the 17th of July. For all we know it could have been intercepted on the 16th of July or during any other event that matched a route under control of Bezler’s spotters.


Consensus of opinion throughout the (pro-)western world. Kiev propagandists, the Ukrainian secret service, reporters, newspapers and also the State Department assure that background of the MH17 crash was based on a fatal mistake. Disinformation about a retracted posting on news board Strelkov_info and manipulated intercepts were enough to make this narrative accepted.

Chief investigator Westerbeke called these tapes authentic through and through”. If he was refering to the voices heard, he probably was right. But that’s not the crucial thing. Question is how it is possible that he missed clear leads of manipulation.

The e-zine the JIT issued in 2016 stated:

By now, the investigators are certain about the reliability of the material. “After intensive investigation, the material seems to be very sound”, says Van Doorn, “that also contributed to the mutual trust.”

Labelling of the conduct by the JIT has to be changed from naive to bad-intended, reading this opinion, and entirely in line with the objectives of the post-Maidan Ukrainian state and the SBU.

By the way, not only was Valentyn Nalyvaichenko the man behind the narrative of the Russian false flag operation. He was the mastermind behind the Chernukhino tapes as well. “Now you know who carried out this crime. We will do everything to assure that the Russian military who carried out this crime will be punished,” Nalyvaichenko stated to Interfax after the demonstration with the audio recording of the “negotiations”.

His concoction of the Russian false flag operation pivoted around an assumption that the Russians had brought in a Buk to shoot down a Russian civilian plane. To intercept this plane they should have moved the Buk to Permovaiske at 20 km. north-west from Donetsk. However, they mistakenly drove to the wrong Pervomaiske, the “namesake village” south from Snizhne, and shot down MH17 from there instead. See the text below for the scenario as it unfolded, according to Nalyvaichenko. Take also notice of the use of the connection between crash site and guilt.

Nalyvaichenko fasle flag Pervomaiske

Pervomaiske was the settlement where Khmuryi allegedly had ordered the Buk to go, as was displayed in part of the so-called Motel intercepts, in a conversation between him and a subordinate (see below). South from this village in the neighbourhood of Snizhne the DPR hosted a blockpost/checkpoint next to the T0522, actually at the opposite of the alleged launch field. Also Strelkov’s provisional headquarters were nearby.

Khmuryi Pervomaiskoe

Nalyvaichenko used his story to explain the weird movement of the Buk from Russia to the west by Luhansk all the way to Donetsk and then back to the east to Snizhne again. Did Nalyvaichenko know the “Pervomaiske” as named in the intercepts of Khmuryi was not the Pervomaiske near Snizhne, but another Pervomaiske, that is, Pervomaiske north-west from Donetsk? Was Khmuryi mentioning this village used as a focal point to concoct a Buk trail eastwards that never was?

Anyway, with such friends, you don’t need enemies. Unless you want to start investigations from the principle that “the enemy of my enemy is my friend” and merge your objectives. I can’t think of any other possibility why the JIT endorsed these clear pieces of fraud.

5.3 Intercepted calls: markers and edits

My general impression about the videos showing intercepted calls, which were published by the SBU and (implicitly) endorsed by the JIT, is that they support the leading narrative as long as this narrative is taken as a dogmatic frame for interpretation of what is said. In fact, the contents of the conversations often present themselves rather vaguely or ambiguously and at times even incomprehensibly – apart from a few keywords that trigger the attention. Therefore they are prone to be multi-interpretable.

Certainly, because of these triggers the conversations show “points of information” from which it is possible to construct a steady belief that a Buk air-defense missile vehicle was brought to the DPR, re-routed to a site south of Snizhne and then brought back to Russia.

On the other hand, from section 3.5 we know the SBU was capable of manipulating information and creating fakes and from section 5.1 we concluded that the organization was involved in criminal acts during the period of time the JIT conducted its research with the SBU’s indispensable assistance (let alone the conventional goals of a secret service). From section 5.2 – the Beyond Enakievo/Chernukhino Cossacks fabrication – it is also clear the SBU framed the narrative within 6 hours after the crash with a demonstrable piece of forgery. On its own these leads should make everybody very wary when interpreting the events as laid out in the other intercepts.

TABEL A. The most important intercepts allegedly related to MH17



Official date/ time intercept

Alleged topic




June 8, 11:46

Buk arrangement




July 14,19:12

Buk possession





Buk transport



Khmuryi/San Sanych

July 16, 19:09

Buk order




July 17, 16:32

MH17 shoot down




July 17, 16:18

MH17 spotting




July 17, 9:08

Buk delivery Donetsk




July 17, 9:22

Buk “crossed the line”



Khmuryi/San Sanych

July 17, 9:23

Buk to Motel



Khmuryi/militant (Krot)

July 17, 9:54

Buk to Vostok




July 17, 13:09

Buk to launchsite




July 17, unknown

Buk shot Su-25




July 17, 21:32

Buk crew member




July 18, 7:41/8:00

Buk in Russia




July 18, 7:44

Buk in Russia


Some transcripts:

Interpretation is difficult as it is. In the first place, because it is hard to interpret what information people exactly intent to transfer when they have a history of shared interactions together and therefore have built up many subtle ways of conveying meaning. This is not only true for a subculture, like a distinct military organization, but even for two individuals.

The saying (as we have in Dutch) “only needing half a word” might cover this aspect. The other half of the understanding by an outsider might have been added by his own interpretative frames and might not have anything to do with what the interlocutors were trying to say to each other. It is obvious this other half is sensitive for even slight manipulations and preconceived frames for interpretation.

Second, as the characters in the SBU tapes obviously were aware they were monitored, they used code language to convey messages to each other. The enigma behind the code might not be decoded so easily as it looks like. Obviously, the use of coded language by the interlocutors could also lead to misinterpretations.

Finally, and this cannot be underestimated, one of the tactics used in war is the dissemination of disinformation. Obviously the tapped lines were used to infect the enemy with wrong information, meant to misdirect the SBU and the troops they provided with intelligence.

It is clear that in order to detect ways by which the conversations might have been manipulated by the SBU to convey a desired story, one has to engage in close-reading. By doing this, roughly three modes of manipulation can be envisioned:

1 – Manipulation of interpretation by using keywords or triggers that lead all attention to desired parts of the information and away from other parts and the overall picture. The intercepts work from soundbites instead of visual markers, as are used in biased OSINT based  narratives. For example, when we hear and read triggers like “Buk”, “low-loader”, “camouflaged” or “Snizhne” and are strongly aware of the official narrative they are embedded in, we are inclined to interpret the entire conversation to match this narrative. For an example, see the conversations between Oreon and Delfin (3) below and the Khmuryi/Motel tapes (7, 8, 9, 10 also related to 4) – see for discussion section 5.4.

2 – Falsification or alteration of information to present suggested facts that are not part of the actual conversation, ie. by false timing (see section 5.2), false dating (see also section 5.2) or even by editing content (splicing, cutting, adding parts from other conversations). Suspected of being an example of this type is the conversation between Khmuryi and Botsman about having received a Buk to shoot down “the second today” (12), as discussed in section 5.5.

3 – The conversation displayed (mostly also mistimed and misdated) is totally unrelated to the preconceived frame for interpretation. In other words, if one wants or is led to believe a conversation is about the events on the 17th, related to the downing of MH17, one is inclined to interpret the story displayed to match this narrative. A clear example of this way of manipulation is the conversation between Leonid – Lyonya – Kharchenko (“Krot”) and Oleg the alleged Buk driver (“Zmey”) in (11), see section 5.7. Also the conversation between commander Igor “Strelkov” and Sergey Aksyonov, acting head of the Crimea, in which allegedly is agreed on a Buk delivery (1), falls into this category.

In fact, the ways of manipulation as mentioned above look a lot like the manipulations that arise from abuse of OSINT as explained in part 1 of this blogpost series. Some isolated points of information are presented and taken out of the full context that is needed to establish clear meaning and/or authenticity. Then a new context is added to provide a frame for interpretation. The conversations appear to be conveying facts, but the meaning of – and the relation between – these alleged “facts” have been manipulated.

Ad 1. Keywords and triggers – Example: The Orion/Delfin tapes (3)

The Oreon/Delfin tapes from (3) in Tabel A comprise of 5 intercepted calls. Below a screengrab of the first conversation from the website of the Dutch Police:

Oreon Delfin 1

Obviously this conversation, which on its own is rather vague and incomprehensable, ends with a keyword/trigger. A command post vehicle is also part of a complete Buk unit, so instinctively the reader understands how he should interpret these lines. Apparently they show something about the LPR and about a Buk. Perhaps this conversation should cover the fact that only a Buk TELAR was transferred from Russia, through the LPR, but without its supporting vehicles. (Actually, the remark is about a battle situation, not about a transfer per se).

In Conversation 2 Oreon acts as person A, who says: „I have arranged everything on the lowboy and a crane.“ and „I have arranged it for the evening. …[inaudible] it …[inaudible] at/for around 5-6“. His interlocutor [Delfin] gives some superfluous directions: „It has to be loaded, camouflaged and driven away.“

This part could fit the story of the netted, camouflaged Buk that was loaded on the red low-loader hauled by a unique truck to be transported. However:

1. Time nor date are mentioned;

2. A Buk is not mentioned (so „everything“ might mean anything at any time);

3. Destination is not mentioned.

Actually the trigger „Snizhne“ is only pointed to in Conversation 3. In this call Oreon rephrases the wordings from another person:

Yes. “We weren’t waiting for the escort. We are heading to Snezhnoye. Stand off for today.” It’s the way it was said.

However, we don‘t know at all if this conversation is related to Conversation 2. Offering them both in sequence obviously triggers us to interpret the keyword „Snizhne“ and the keywords „lowboy“ and „camouflaged“ together to match the narrative we know about a netted Buk that drove to Snizhne on a low-loader.

4. The timing is off base entirely. In fact, 5-6 ‘o clock in the evening is not corresponding with an arrival on 1 AM at night, according to a statement by Viktor Nayda, and subsequently departure on 4:28 in the morning from the border to Donetsk as reported in the Notes of Suspicion on the four indicted soldiers (see screenshot below).

route luhansk perevalsk

5. The Notes of Suspicion claim that the Buk was brought to Donetsk by the M04 through Luhansk and Perevalsk (see also screenshot above), but this part of the road, including Bile and Yubileine in between these two cities, were under control of ATO troops on the 17th.

Reading these 5 calls – including the last two that seem to depict conversations about an Ukrainian convoy through Sabivka, a town west from Luhansk, towards the Luhansk airport area – don‘t make a very robust impression. Perhaps that‘s why the Dutch prosecutor did not indict the individuals playing their parts in these tapes.

LiveUAmap 17 juli

LiveUAmap of July 17th. After days of fighting the Ukrainian army broke to the Luhansk airport, occupying part of the M04/E40 from Luhansk to the west. The arrow points to the site where the Buk was filmed by a covert surveillance operation, allegedly on July 18th, 4:50 AM.

Roadblock Yubileine 16.7

Roadblock Yubileine 17.7

During the war a roadblock in the centre of Yubileine was erected (48°33’24.06″N 39°10’27.05″O), also protecting the route to the north to Oleksandrivs’k. It was also there on July 16th and 17th. According to the Ukrainian judiciary the Buk transport went through unimpededly on the route towards Donetsk as well as on the flight back to Russia.

5.4 More keywords and triggers

A second example of possible manipulation by the use of keywords and triggers is the appearance of the phrase “Buk” in the tapes featuring subcommander of the DPR forces Khmuryi alias of Sergey Dubinsky. See in Tabel A nrs. (4), (7), (9) and (10).

Intercepted call (7) was part of a package of five calls that were displayed in a video published by the SBU on July 18th, 2014 (Tabel A, nrs. 7, 8, 9, 10 and 12). It refers to the conversation Khmuryi had with “Buryat” in the morning of the 17th, 9:08 AM. Allegedly the Buk was delivered in Donetsk by then.

At first it seemed the participants did their best to cover up to what they were referring, by calling the brought item “that beauty” (Buryat) and “Is it the one I am thinking about, the one B…M?” (Khmuryi). Then suddenly Buryat decided to break the cumbersome talk and blabbed: “Yes, yes, yes, Buk, Buk!!”

Notwithstanding this sudden revelation, Khmuryi asked another militant [allegedly Leonid Kharchenko] to go to the Motel to pick up the “you know what” and to guard “the thing” (10). Before this order Khmuryi called the subcommander of battalion Vostok, San Sanych. In this conversation was agreed that “my Buk-M” – at this time apparently no need for code language was felt – would be parked behind the Motel from where it allegedly would be picked up to join the Vostok convoy to go to the east (9).

Khmury San Sanych join the column

The intercepts seemed to convey a clear story mentioning all important markers, “Buk”, “hauler” and even Pervomaiske”, not far from the official launch location. Conversation (8), with Bibliothekar apparently using the same telephone number as Buryat in (7), also mentioned it crossed the line”, which was translated by the SBU as the Ukraine-Russia state border – and not as any other line or border (i.e. DPR-LPR, DPR-Ukraine).

Khmuryi Motel close reading

Close reading the Khmuryi/Bibliothekar conversation (8), based on Bellingcat transcripts.

The JIT also released another phone call intercepted by the SBU, after their press conference on September 28, 2016. From this conversation was concluded the separatists (ie. Khmuryi) indeed had “ordered” a Buk on the evening of the day before the crash, see Tabel A, nr. (4).

Bellingcat confirmed in their June 2019 report earlier mentioned my assessments from 2016 about the characters playing their parts in this call. The person whose transcripts are displayed in the white boxes is Sergey Nikolayevich Dubinsky, alias “Khmuryi”, second in command of the DPR forces after commander Igor “Strelkov” Girkin . Khmuryi can be recognized foremost by his voice and his patronym.

The soldier whom he is talking to is San Sanych (transcripts in black boxes), a person who has been identified in other SBU intercepts as a commander of a column of pro-separatist fighters assisted by veterans from the eastern regions (Chechenia, Ossetia), belonging to battalion “Vostok”. In fact, this appeared to be the same person as featured in the Motel tapes (9)!

In an article reviewing the evidence that the JIT showed on this presser, I gave an assessment of this conversation. Contrary to the JIT position in my view Sanych would not deliver a Buk himself:

Official story is Khmuryi, commander of troops pounded by Sukhoi jet fighters and GRAD bombings at Marinovka [Marynivka], orders a Buk and San Sanych is vowing to deliver it. [Last lines say]:

Khmuryi: “If I can receive a Buk in the morning and can send it over there that would be good. (…) If not, things will go totally fucked up.”

Sanych: “Well, look Nikolayevich… If you need it… we’ll send it over… to your area.”

A different interpretation is more appropriate. Khmuryi is complaining about the situation at the front area and expresses a desire, actually an urgent need, to possess a Buk to make things easier. San Sanych probably was at the Vostok base, in Donetsk, as he would be busy on the 17th moving three tanks and an Ural (armoured truck) from there to the front.

Probably he just wants to show his willingness to help, that in case Khmuryi actually would get hold of a Buk – as in fact the commander expresses uncertainty about that! – Sanych is willing to accompany it to Marynivka with his column. Then the “it” from “If you need it”, as Sanych spoke, refers to the sending, not to [actual delivery of] the Buk. If you need sending [it to the frontline], we could take care.

Furthermore I drew the following conclusion:

Taken into account his subordinate position acting as a commander of a column of non-Russian auxiliary forces, it´s not very probable that San Sanych would have the power to arrange at short notice a high-value war asset at the general’s office in Russia – or even, as is suggested, to come up with a Russian Buk himself.

So I expected this conversation was just some small talk in which situational impressions and wishes were conveyed, which on their own had nothing to do with arranging the arrival of the Buk.

Although Khmuryi wouldn’t get his Buk straight from San Sanych, at least he seemed to have obtained an option for a guided transport. In the morning of the 17th a meeting near the Motel was arranged to get the Buk in the Vostok column, according to the tapes (9). In both calls with San Sanych Khmuryi did not try to cover up the sensitive three letter B-word.

About 40 minutes after they had made the agreement, convoy Vostok left its base in the eastern outskirts of Donetsk. Without the Buk. On 9:54 AM, just before they left, Khmuryi told a subordinate [allegedly Leonid Kharchenko] (10) “to keep in touch if anything happens

Khmuryi If anything happens

Apparently something did happen. Perhaps they did not get into contact when the Buk stood waiting alongside the road in Donetsk for another hour after having missed the Vostok departure. Or the SBU did not intercept this follow-up. Anyway, the SBU decided to publish the intercept of the agreement that did not work out, but they did not publish anything about the long stay of the Buk in Donetsk.

In earlier parts of this series we suspected the SBU of leaking information about a Vostok-led convoy to a few trusted propaganda channels. Most important lead for the suspicion was the connection that was made between two stills from vehicles belonging to the Vostok convoy and one still from the Buk transport as seen in a video made in Zuhres (part 2, section 2.1).

Despite the agreement going wrong, the keyword “Buk” together with information about its movement in a column of “machines and terrorists” (Vostok) were probably put through by the SBU to Euromaydan, to defense expert and politician Dmytri Tymchuk, to InfoResistance and to blogger Ukraine@war. Eventually the disinformation showed up on the SBU website and on the press conference that counter intelligence chief Viktor Nayda organized on the 19th. (see part 2, section 2.1). From this could be concluded the SBU was not aware of an agreement that went wrong or, more plausible, that there was another reason to disseminate the story of the larger convoy.

Another intriguing aspect was the fact that the special Kropachev/Gerashchenko/Avakov unit did report the Buk apart from the Vostok convoy, contrary to the aforementioned channels. Apparently they were not (yet) supplied by the SBU bureau that had access to the intercepts. Perhaps they had their own conduits within the secret service – ie. Avakov/Gerashchenko trustees – that cooperated with them.

So on July 17th/18th two strains of information appeared. One strain showed info based on the SBU intercepts about a Buk that was poised to be transferred in a column of battalion Vostok. For this a combination of the Buk transport and the Vostok convoy moving through Zuhres was invented. The other strain showed information about a separate Buk transport accompanied by only two cars, (which actually were also seen on the Zuhres video by Andrey A. He might have been working together with the special unit, because Anonymous mentions a source in Zuhres; see part 3, section 3.3).

Route A.

1. Intercepted call (SBU), “Buk goes with Vostok” => Euromaydan edits its Facebook message initially started at 12:17 when the first information from a Torez local (probably WowihaY) about a Buk arrived. A few hours later they re-upload the 10 July video of the Vostok parade in Donetsk. Tymchuk, who also re-uploads this Vostok video before the crash, and InfoResistance also get information about a larger Buk convoy => This would explain taking over Vostok vehicles from the video to plant them into the transport;

2. Acquired videos of movements by Zuhres (SBU); Zuhres Buk still + Zuhres Vostok stills => received by Ukraine@war and InfoResistance and shown in the SBU presser by Nayda;

Both 1 and 2 pointed to a large Vostok-led Buk transport, despite the agreement between Khmuryi and Sanych going wrong.

Route B.

Mysterious secret source, possibly a soldier/militia member belonging to the Kropachev/Gerashchenko/Avakov unit, well-versed in weaponry => keywords “Buk”, “two cars”, “awning”, “towards Snizhne” to WowihaY & Roman => Euromaydan gets the keywords “Buk” and “from Torez towards Snizhne” from WowihaY and merges it with info about “machines and terrorists” received by route A. => This would explain their pre-crash edits and their re-upload of the 10 July Vostok video and Gerashchenko’s posting after the crash describing separate convoys, contrary to Tymchuk and InfoResistance. (part 2, section 2.1)

If the tapes show genuine information, the SBU must have had a reason for surpressing the Zuhres Buk and Vostok videos and for not publishing a follow-up between Khmuryi and Kharchenko or San Sanych about the failed agreement. Apparently they wanted to invent a larger Buk convoy, by putting a phantom Buk in a convoy that actually was moving from Donetsk towards Snizhne that day. The question was why.

As a matter of fact, also after the crash two different stories surfaced about the escape route of the Buk. It concerned the same players and the same inconcistency.

Half an hour after midnight InfoResistance published “operational data”, as they had done earlier about the Buk transport in Snizhne (see part 2, section 2.1 and part 4, section 4.4). Not long after them also Euromaydan issued the same information on Twitter. It seemed another Buk transport was invented based on false information funneled by intel operatives, probably from the SBU again, to these preferred channels:

According to operational data of the group “Information Resistance” Russian terrorists quickly evacuate the territory of the Russian Federation SAM “Buk”, which shot down a passenger airliner “Malaysia Airlines”. At the moment the terrorist machine column routed from the town of Snizhne in the direction of the state border on the highway Т0522. The column of the SAM “Buk” has passed the point 48.011623, 38.763036.”

The message contained a few important features. First, as was the case when the Buk was reported by InfoResistance and Euromaydan driving in Snizhne on mid-day in a convoy with vehicles belonging to battalion Vostok, a column was mentioned again.

Second, the direction mentioned suggested a flight back to Russia along the shortest route, by the T0522 south via Marynivka to the state border. In fact, as fights were still going on and a border passage to Russia was not secured at the time this route was very unlikely.

Third, the coordinates displayed pointed to the exact spot where Vita V. had filmed the Buk driving under its own power on the T0522 in the direction of the alleged launch site.


Later that day minister Avakov published the Luhansk Buk video on his FaceBook account (part 3, section 3.3), mentioning the Buk drove by Krasnodon, which also was close to the Russian border but in LPR territory. Most important, it did NOT show a column. This again suggested a split in the information about a Buk transport as was seen as well a day before. (The only divergence was that also Anton Gerashchenko picked up the information from InfoResistance and copied their message on 1:41 AM local time).

Thinking within the frame of the alternative scenario, it is possible Avakov’s people realized they were in possession of the Luhansk Buk video (as was given away by National Security spox Andrey Lysenko, see also part 3, section 3.3) and could use it to construct a more plausible story of immediate flight to Russia than the route by Marynivka could provide. That the video was shot in Luhansk, and not in Krasnodon near the state border, was a minor glitch in the story, set straight by Avakov on the 19th.

The fact that it was imperative to put the Buk over the border as fast as could be done, could have been incited by the need to attain some “plausible deniability”. As long as the Buk only had stayed in Ukraine for less than a day, the Ukrainian state could reasonably be exonerated of responsibility for its presence.

5.5 Text editing – Example: Khmuryi/Botsman (12)

Khmuryi was interviewed by Yana Yerlashova in the documentary “Call for Justice”, which she made in cooperation with Max van der Werff, published on July 17th, 2019. He confirmed his voice was heard on the tapes, however, he insisted that the SBU had misdated and edited the conversations (see here from min 13:00)

In particularly in this fragment of the interview he pointed to the conversation he had with “Botsman”, which was the last intercepted call in the package of 5 that were published by the SBU a day after the crash (Tabel A, nr. 12). The conversation went as follows, according to the SBU and Bellingcat transcripts:

Khmuryi Botsman

The official SBU/Bellingcat version would be that Khmuryi received his Buk in the morning of the 17th and shot down with it the second plane of the day from somewhere near Marynivka. This allegedly matched the official narrative, as the alleged launchsite is 10 kilometers north-west from Marynivka and the other tapes in this package would prove he had received his Buk from Buryat and Bibliothekar the same morning.

Not aware of the mistake made – the second Sukhoi actually was MH17 – the time of the conversation was set by Bellingcat within minutes after the launch. (The SBU had set it on 9:08 AM, but this obviously had been a mistake, according to Bellingcat, as also the Buryat call (7) was set on this time).

Furthermore Bellingcat claimed to have found a consistency with known facts of the day, at the same time introducing an uncertainty by phrasing “one/two” downings and not an exact amount. Of course, matching the tapes with real events is a lot easier this way:

Bcrap erkent 16 juli shooting mbt Today the 2nd

The call confirmed the narrative because on the 16th one Sukhoi fighter jet had been hit and another was downed near the frontline south of Snizhne, reasoned Bellingcat. In the Birdie report it says:

planes downed on 16.7

The first downing of two planes attacking Savur Mohyla, as confirmed by the separatist press office, was only a hit over Horlivka, as already was concluded in section 5.2. On 17:52 MSK (16:52 local time) mentioned that one of the Su’s that bombed Savur Mohyla was hit over Gorlovka. The Horlivka/Gorlovka hit was also mentioned on 15:35 local time on pro-separatist news boards.

A message of a second downing appeared on 21:50 Moscow time in militia briefings on Strelkov_info:

21:50 – Briefing from Igor Strelkov
From Snezhnoye, they are reporting that
a second Su-25 was shot down with three shots from a portable anti-aircraft unit. This is the work of anti-airfact personnel of Battalion Oplot.

This probably was confirmation of the downing of the second Savur Mohyla attacker. After the Hryhorivka downing separatist press officer Vladislav Brig confirmed this particular downing was the third of the day.

Shot down over Grigorovka [Hryhorivka] [was a ]third SU-24 [probably he meant SU-25; HR], [it] fell into a sand pit, the pilot ejected over the territory controlled by dill [curse word for Ukrainian army].

In official statements from Igor Strelkov and in militia briefings on the 16th appeared a message that one more plane was downed:

20:58 – July 16, 2014 – Briefing from Igor Strelkov
At 09:20, a Ukie Su-25 was shot down over Dmitrievka.

Only one, next to the 13:00 hit, was mentioned in official statements of the Ukrainian state, which was the Sukhoi that crashed near Hryhorivka on 18:55 local time, the one allegedly shot down by a Russian MiG according to the Ukrainians.

At least 4 hits were mentioned in total on the 16th: one in the morning on 9:20 over Dmytrivka/Dmitrievka, one near Horlivka/Gorlovka, one near Snizhne/Savur Mohyla by Oplot and one on 18:55 near Hryhorivka. It is unclear which hits or downings out of 4 Khmuryi meant in his conversation with Botsman.

Strelkov stated in an official briefing in the morning of the 17th that two planes were downed, but with it he mentioned “over the area”, possibly alluding to the Marynivka area that was on topic in the lines displayed before (see screenshot below). This would exclude the Horlivka hit.

sukhois no show 17th

17.07.2014, 12:02: “After yesterday’s defeats (over the area were shot down 2 su-25’s) enemy aircraft did not appear in the air.

In the briefings from the 16th Strelkov pointed to the Dmytrivka and Oplot downings. Probably this was originally stated before a Su-25 was downed near Hryhorivka, also near Marynivka. Then, as pointed to above, on the 17th he only claimed two downings “over the area”. It was unclear which ones out of 3, which were: one over Dmytrivka, one near Snizhne/Savur Mohyla area and one near Hryhorivka. Possibly he meant the Dmytrivka and the Hryhorivka downings. Then the Oplot downing of one of the Savur Mohyla attacking planes was dismissed and the one over Horlivka/Gorlovka was not included, as the commander limited himself to the downings over the Marynivka] area.

That Khmuryi would mention to Botsman the two hits that were also confirmed officially by the Ukrainians (Horlivka and Hryhorivka) – according to the “one/two” of Bellingcat, but contrary to Strelkov – would be unlikely. Besides, those weren’t two downings, but one hit and one downing.

One possibility could match the Bellingcat conclusion, sort of. Both Strelkov and Khmuryi meant the Dmyitrivka (not confirmed by Ukraine) and Hryhorivka downings AND dismissed all other reports AND Bellingcat was wrong that Khmuryi included the Horlivka hit.

Next to the difficulties matching the two downed planes as mentioned in the intercept, allegedly on the 17th – according to the SBU tapes and Bellingcat – Khmuryi mentioned he just downed a plane, the second of the day. The Ukrainian authorities insisted there had been no sorties of fighter jets on the 17th. Neither did they issue reports on the 17th that they had resumed flying. Even Strelkov issued a statement in which was claimed the Ukrainian army had no aircraft in the sky at least until mid-day (see also screenshot above).

There has been no confirmation of a hit between this mid-day statement and the time when people thought a AN-26 had been hit near the mine Progress (MH17). If Khmuryi had downed the second plane of the day, then there obviously also had to be a first one. There is no information at all about this particular downing.

Summarizing, if the furnishing of proof is limited to counting and matching (attempted) downings – and Bellingcat does not provide more solid proof – we encounter problems to date the Khmuryi/Botsman conversation. Based on the information known, we can’t say the conversation was on the 17th, because Khmuryi mentioned two downed planes on the day before.

Micha Kobs performed technical analysis on this intercepted call, published in Haunt the Buk p.12-15, and found some questionable edits. Khmuryi claimed in the interview with Yerlashova that the conversation with Botsman about shooting down a Su-25 while staying in Stepanivka/Stepanovka originated from the 16th.

This is equally hard to match with the entire conversation based on the limited information we have, even more so without assuming that the lines with “Buk” were added. “Today the second” matches, but on the 15th there were no reports about downed planes. On the 13th two Su-25’s were downed, so then Khmuryi must have mixed-up yesterday with two days before yesterday, which is not very likely.

Khmuryi Botsman Yana 2

Khmuryi and Yana 2

Occam’s razor may suggest a slightly different scenario, based on our knowledge about a temporary moratorium on sorties on the 17th and the struggle matching all the allegedly downed planes. Maybe only the mysterious parts “We just struck an aircraft – a Sushka [Sukhoi]” and “Today the second” were taken out of another conversation and inserted to inflict the impression the conversation with Botsman was all about MH17, which was targeted as if it was a SU-25. Without these two lines, the conversation could be dated on the 17th and the suggestion laid out – a Buk was received to shoot a Sushka with it, the second today – was a forgery.

The conversation would develop as follows:

Botsman: What is it?

Khmury: What do you think? Grads are hitting all the time, only now there is a lull. We have a Buk-M, we received it. So… Well, they are trying to break out from [the village of] Zelenopillya, and they have only one passage — via me, see? Yesterday two Sushkas were shot down. Thank god, at least the Buk-M arrived this morning. Things became easier. But in general, of course, [the situation is] difficult.

Nota Bene, in this scenario – I will return to this later – the lines mentioning “Buk” are genuine, that is, genuinely recorded as part of a 17 July conversation with Botsman. In that case in the interview with Yerlashova Khmuryi only pointed to the SU-25 parts as recorded on the 16th.

If true, it is not hard to see why the SBU manipulated the conversation by simply adding two short lines about Khmuryi’s downing of a Sushka. In the Zembla documentary, earlier mentioned, reporter Vincent Verweij invoked the fatal mistake scenario claiming Dubinsky had said they shot down an SU-25 with a Buk. (Zembla, 22:30); The causality might have been invented by the above suggested edits, but it is true that the impression was there in the transcripts.

Bellingcat confirmed this in their report. They supported this version of the fatal mistake narrative, the one pivoting around a downed SU-25 that appeared to be MH17, by pointing to a video made by Oplot commander Zmuk. (See p. 86 in the Birdie report). In this video of the arrival of a reconnaissance team at Hrabove/Grabovo about 20-30 minutes after the crash, Zmuk is heard saying: “They say the Sukhoi (fighter) brought down the civilian plane and ours brought down the fighter.

In part 3 of a blogpost series that I wrote on disinformation by sloppy, illogical and biased thinking, I proved that the hidden premisse that Zmuk got his info from the chain-of-command, which was tied to first hand knowledge about a shooting, was based on false assumptions and confirmation biased interpretations. It seemed to be far more plausible Zmuk received the information on which he drew his preliminary conclusion, from locals near the crashsites. See here.

A method detected often when assessing reports from Bellingcat and western journalists alike is also seen here again. Evidence is created from weak proof – or actually even from unfounded assumptions – that refers to other weak or assumed proof, making each other stronger by circular referencing. The strange text of Khmuryi’s call with Botsman on the 17th is validated by referring to the Zmuk video. And vice versa.

As to the Ukrainians, they evidently support two different versions of the fatal mistake narrative – or even three if we include the Nalyvaichenko false flag scenario! They used the Strelkov_info fabrication with the AN-26 in their Notes of Suspicion and obviously they still endorse the Khmuryi/Botsman tapes pivoting around a SU-25 shooting.

A final remark has to be made about the possibility also translation or slight alterations in rendering the text might cause more suspicion. In the Khmuryi/Botsman conversation causality between shooting down a Sushka and the reception of a Buk is suggested. “We just struck an aircraft – a Sushka. We have a Buk, we received it”. Another translation was suggested in this article:

We knocked out an airplane just now, a Sushka [a Sukhoy fighter jet]. And we already have a Buk-M, we received it.”

It is obvious the shoot down and the reception of the Buk appear to be unrelated by just adding the word “and”. A comparable manipulation of the displayed text by providing little changes, ie. by translation, might be an intercepted call from Leonid Kharchenko that was paraphrased by the SBU. As a matter of fact it also would be another piece of evidence for the fatal mistake narrative pivoting around a SU-25. It was put in the Notes of Suspicion as well:

Kharchenko 16.48

Holding on to the preconceived frame one would be inclined to interpret “they” as the Buk crew and “the spot” to be the launchsite, concluding they thought they shot down a Sukhoi instead of MH17. In the blogpost “The Kharchenko intercepts I proposed, based on events documented, another translation, in which “they are at the spot” would point to an arrival of a reconnaissance unit on the crash site. In this case a tiny mistranslation and transformation of passive voice into active voice were the sources of the raised suspicion:

They (=the recon unit) arrived at the spot (=crash site). And a (not: already one) Sushka has been shot down (as many people around the crash site suggested).

Hopefully these examples make clear how cautious one should be when interpreting the calls as intercepted by this agency.

5.6 The “Buk” tapes: DPR disinformation?

Also on July 18th, 2014, issued with the same package of 5 conversation featuring Khmuryi, a short call between Oleg Bugrov, deputy Minister for the Defense of the LPR, and Oreon (alias Oleg Ivannikov, officer of the Main Directorate of the General Staff of the Russian Ministry of Defence GRU) was published (Tabel A, nr. 2). It also showed the triggering keyword “Buk” and went as follows:

Bugrov: I worked out a plane near Stanitsa. I missed it

Oreon: Excellent. They are avenging for planes today. But we have a couple of days more. We already have Buk. We will shooting them down to hell.

Oreon answering „excellent“ after the LPR official reported a failure, invites the suspicion that the lines from both interlocutors may have been spliced to suggest a high level conversation between an official of the LPR and the Russian GRU about a Buk. Nonetheless, from the line „We already have a Buk“ one has to conclude that at least the LPR was in possession of a Buk on the 14th. This contradicts the official narrative of a Buk that „crossed the line“ only in the morning of the 17th.

Perhaps more than one Buk was present in the area on this particular day and Oreon‘s Buk was not the murder Buk. However, the Dutch Committee overlooking the secret services, CTIVD, issued a report in April 2015, in which was claimed the intel community had not received any information about presence of mid or long range surface to air missile systems before the 17th (p. 24):

Although there were indications that the separatists were supplied with heavy weapons from the Russian Federation, there were no indications that they were powerful anti-aircraft systems. Certain documents from the end of June 2014 state that material was collected at assembly points in the west of the Russian Federation and then distributed to the separatists.

One document (from a publicly accessible source) dating from 14 July 2014 states that advanced anti-aircraft systems (further details unknown) had also arrived at a collection point. However, according to this document, the stage had not (yet) reached that such systems, if it were powerful anti-aircraft systems, had been delivered to the separatists in Ukraine.“

Furthermore, the intelligence community had found no proof the AN-26, which was shot down on the 14th near Izvarino, was hit on high-altitude, as Ukraine probably asserted to drag the west into the war (p. 25):

According to the MIVD [Dutch military secret service; HR], the wreck and the eyewitnesses supported the fact that the aircraft was shot from the sky with a MANPADS from Ukrainian territory. This is only possible if the Antonov flew substantially lower than 6,200 m or 6,500 m. Another possibility was that a vehicleborne anti-aircraft system with a short range was deployed. The information from the MIVD does not indicate the use of a powerful anti-aircraft system.”

With this in mind, it is conceivable that a complicated scenario was developping in which disinformation from the separatists was used by Ukraine for their own disinformation strategy and vice versa. It certainly is possible the Oreon statement belonged to a disinformation campaign, together with pro-separatist messages from June 29th, July 13th, 14th and 16th.

The Ukrainian timing of the Oreon intercept was set on July 14th (but published on the 18th) and the alleged high-altitude hit of an AN-26 was as well. Both pieces of information were confirmed on that very day by messages that were disseminated by pro-separatist channels. See the screenshots below from South-East News and Strelkov_info.

Buk in donbass 14.7

strelkov_info 14.7.14

Translation: 14.07.14. The message from the experts.

“Today, the host for the destruction of the plane an-26 of the enemy at a height of over 6,000 meters was Pronino SAM “9K37M1” (better known as “Buk”). A few weeks ago, the capture of these systems by the militia was reported. Now they are repaired, manned and commissioned. These systems allow to shoot down planes at altitudes of over 4,000 meters. Earlier, the militia was powerless against enemy aircraft, flying at such heights as neither the MANPADS nor the memory to work on such heights were there.

The “few weeks ago” obviously referred to the events of June 29th, after DPR forces raided Ukrainian airforce base A-1402 in Donetsk. Although most channels and papers showed more restraint, Vesti (and others) reported that: “The sky over Donetsk will be protected by anti-aircraft missile systems “Buk”” , claiming the separatists had captured one or more Buks from this airforce base.

Also the press center of the DPR verified this message, for instance on their @DNRPress twitter account (see screenshot below), also copied on Strelkov_info. With it they published a photo of a Buk, which afterwards proved to have been taken in 2011 on sister base A-1428, north from Donetsk between Avdeevka and Spartak.

DNR disinfo

The news about separatists capturing Ukrainian army Buks compelled anti-terror operation chief Alex Dmytrashkovskyi to issue a statement that a Buk was captured, but that it was non-working junk. Anyway, satellite imagery testified that the first Buk battalion of the 156th Brigade was located on A-1428, on which 4 vehicles (2 TELARs, 2 TELs) were left behind after evacuations in March 2014. There had been no Buks on A-1402 (48° 3’38.54″N 37°44’39.43″O).

A-1402 north field

A 1402 19.6.2014

Airforce base A-1402 on June 19th, 10 days before the raid.

A second piece of information in the separatist 14 July messages, claiming “Now they are repaired, manned and commissioned”, probably was hooked on to a video of Russian politician Sergey Kurgynian, the person who had assaulted Igor Strelkov publically for his surrender of Slavyansk on July 5th. In this video, made on the 13th, Kurgynian claimed “civil society” would solve the problem of the non-working Buk by fixing it:

¨But, our very talented and even brilliant electronics experts will of course repair — I think they’ve even already repaired, it seems to me — the Buk system seized from the Ukrainian bandits — the Banderaites — I don’t want to say ‘the Ukrainian people’ but the bandits and the Banderaites and in the very near future, I simply know a brilliant electronics expert who has flown there — precisely as a representative of civil society who will help the fraternal people. In very short time it will get it back working. It will be fixed, yes? It might even turn out there are even several systems.”

Only a day later the separatists claimed they possessed a Buk that was repaired and manned. On the 16th, militia briefings again mentioned the possession of a combat-ready Buk in the Luhansk area:

lpr buk cassad

Strengthening air defense of the LPR (…) The appearance of a combat-ready Buk is a significant aid. The operational Su-25 is for now a cherry on a pie, but also not unnecessary.”

Apparently it was given away to the public that the junk Buk was now combat-ready and even a “not unnecessary” SU-25 was operational!

Overlooking the possibility of a quick repair and the fact that no Buks had been positioned on the raided airforce base A-1402 the conclusion might be that the separatists engaged in a propaganda campaign. Goal of spreading this disinformation about Buk possession is uncertain. With respect to the open sources one could assume this was all about boosting moral of the pro-Russian audiences in the Donbass and outside of it. The media reports about keeping the airspace safe would certainly have been appreciated.

From the messages issued on the 14th and the 16th is clear they built on earlier reports about seizure, repairs AND the possible disinfo from the Ukrainians about the high-altitude hit on July 14th. In this case – if we trust the CTIVD assessments – the separatists used Ukrainian disinformation for their own disinformation.

According to Bellingcat the disinformation had a clear function (Birdie report, p. 46):

(…) all available evidence suggests that this was just a cover story to hide the planned dispatch by the GRU of one or more Buk missile launchers with serving officers from Russia.” .

The assertion that all available evidence would suggest this is another example of interpretation within a preconceived frame. The suggestion follows only from speculation based on holding the standard narrative. In fact, there is no direct evidence it was a cover up. It might be true, it might not be. Anyway, at least Bellingcat confirmed it was disinformation.

Regarding the intercepted calls the separatists might have been anticipating publication, indirectly channeling a boost of moral to their own audiences. On its own, this doesn’t sound implausible, as the SBU made a habit of publishing intercepts to support their information war long before the 17th.

Obviously the separatists knew they were listened in to. According to the JIT:

In addition to regular telephones, DPR-members used secure means of communication. A number of these seem to be provided by the Russian Federation and, moreover, used by Russian top officials in their contact with the fighters.

If they funneled disinformation about Buk presence, mentioning the (upcoming) reception of a Buk on unsecured communication channels, an important question is if they planned to use leakage of this info to deter the Ukrainians. One may assume the SBU had plenty of ways to confirm or refute disinformation from the separatists where necessary. Or perhaps it is just not this simple and the separatists thought they could inflict disarray within the ranks of the Ukrainian airforce by spreading fake news.

On the other side, if the conversations show genuine information about Buk presence, main question would be why leaders like Khmuryi and Oreon gave away this kind of tactical information with game-changing features on unsecured channels. Actually, two options surface. They did it unwillingly because they were sloppy and stupid or they did it willingly, to alarm and deter the Ukrainian airforce.

Possibility Matrix: Buk is present or not/ Mentioning “Buk” in tapes or open sources is disinfo or not

A. Buk yes, disinfo yes: To cover-up for Russian delivery

B1. Buk no, disinfo Yes: To alarm and deter

B2. Buk no, disinfo Yes: Anticipation on possible public display

C1. Buk yes, disinfo No: Giving away tactical information by stupidity/sloppyness

C2. Buk yes, disinfo No: Giving away tactical information to alarm and deter

D. Buk no, disinfo no: The  Khodakovsky scenario (Buk was on its way from Luhansk area, but returned unused after MH17 was shot down).

5.7 The disinformation theory and its implications

In summary, the package of disinformation of June 29th and the Kurgynian option was used for disinfo by the Ukrainians (the alleged 6.250 meters hit on the 14th) to get the west involved in their anti-terror war by implying that a plane was downed at high altitude by a weapon that was possibly delivered by Russia. Then on the same day the separatists confirmed this disinformation for their own purposes.

From this perspective it is not in dispute if there was an Ukrainian or a Russian Buk in possession of the separatists (ie. a Russian Buk under the cover of being Ukranian, as Bellingcat supports), but if there was a Buk or no Buk at all.

Starting from this position speculation about the development of the events as depicted in the tapes is appropiate, as there is a plenty of room for it, which on its own says a lot about the defects, fragmentation and manipulations of the information conveyed in these intercepted calls. Furthermore, we concluded from part 2-4 in this series there is a possibility the social media evidence that surfaced on the 17th/18th was manipulated, or even (partly) created, by a central source.

So let‘s ponder on a possible development. Now the enemy had confirmed Buk presence, within the ranks of top officials belonging to the Ukrainian Interior Ministry and the SBU an idea was conceived. To supply the European Union and NATO with more proof against the separatists a Buk trail could be constructed.

At the same time high-ranked separatists – Khmury and Oreon – did not cautiously try to conceal anything and talked openly on unsecured lines with other high-ranked soldiers (San Sanych, Botsman, Bugrov) about the reception of a Buk launcher. In fact, there was no actual delivery of a Buk by San Sanych, as the tapes were wrongly interpreted by the JIT. Actually, the observation that the conversation confessed something odd, might support the idea that neither an actual transport was planned in the conversation on the 16th.

To elaborate on this, as it happened the last words heard of the interceptsthough not transcripted – showed a very strange continuation of the conversation. According to a native speaker Khmuryi would have said (as a joke) to kill Sanych for his proposed delivery of the anti-aircraft hardware to a location near Marynivka. Hearing this questions the conversation of a day later in which Khmuryi still made an appointment with San Sanych.

In this follow-up (9), Khmuryi made it easier for Sanych to understand what he wanted from him, remembering their chat of the evening before in which Khmuryi kind of threatened him for his offer to accompany the Buk. At first, Khmuryi started his request by saying “Where should I…”. Then he stopped, perhaps because he was thinking he should clarify things first before Sanych would respond to Khmuryi’s contradictive request. He resumed again by explaining what this actually was all about – “the thing is my Buk-M will go together with yours”. After this Khmuryi finished his question where to bring it. Sanych seemed to understand the role he had to play and answered

Khmury San Sanych join the column

Next to Khmuryi’s joke in (4), also the change in word gender in (9) arrested attention of a reader.

Let’s assume further the tapes did not show genuine content, but disinformation about a Buk that did not exist. Maybe Khmuryi got an idea after their earlier conversation to use Sanych’s (apparently provocative) offer for a disinformation operation that was going on since June 29th. Then Sanych was supposed to know that the 17 July call was only for show. The reason why Khmuryi kept on making arrangements with Kharchenko for a pick-up when the Vostok convoy already was leaving its home base, was that there was no real Buk to be picked up.

If true, then this was also the background of the fact that the SBU could not, and did not, publish any follow-up on the broken arrangement, as there was no follow-up to intercept. Furthermore, the talks provided ad-hoc information about involvement of the Vostok convoy, which subsequently was used to invent a larger Buk convoy. However, this was not shared (on time) with the others – some people of the Kropachev/Gerashchenko/Avakov unit – that were preparing to unfold a Buk trail on the same day.

Perhaps people within the SBU connected to Tymchuk cum suis heared “Buk” (and Vostok), and subsequently used “Buk” (and Vostok) for their own disinformation relays. They visually constructed a Vostok led Buk convoy with assistance of the Zuhres footage that had arrived at their desks from Andrey A. and funneled it to InfoResistance and Ukraine@war.

At the same time the special operation of the Kropachev/Gerashchenko/Avakov unit started with their own disinformation campaign about a Buk transport, in which the Vostok convoy did not play any part at all. As said above, the information from the taps was not available to them at the time and the disinformation about the larger convoy probably was disseminated without the Avakov/Gerashchenko unit knowing. So in the operational phase plans that were circulating within the Interior Ministry/SBU to construct a Buk trail, split into two different directions not entirely consistent with each other. The LPR/DPR were trolled by two strains of disinformation at the same time, that both used their own disinformation about Buk presence against them.

Undeniably, the shoot down was real. The consequence of a Buk hoax would be that the DPR separatists had no Buk, so the shooting came from an Ukrainian weapon. To be more specific, perhaps a small operational unit tied to the Interior Ministry/SBU and the army/volunteer battalions – a part that knew about the plans to create a fake Buk trail – took care of reality by engaging in a false flag operation.

Take note of the fact that it was not necessary that this was also the goal of the people that constructed the trail, let alone of the people furnishing templates for fakes (the spotters) or relaying disinformation unknowingly (the infowarriors). All the planners wanted was to inflict the impression that the separatist had a Buk that could take out planes at high altitude.

What this scenario entails is in any case that the JIT should convey more about the whereabouts of all Ukrainian Buks/SAMs and missile inventory in conflict area. Until now the JIT only copied a statement by the US claiming that the Ukrainians “could not have done it”.

Of course, the scenario as outlined above contains a lot of speculation, although it would explain important observations and contradictions. One might want to further discuss the implications for the evidence in the JIT/OM case.

Point is that we don’t know full context of the intercepts or even full conversations and some parts shown aren’t very clear. Secondly, it is obvious incentives to disseminate disinformation played an important part on both sides and the exchange of disinformation on July 14th cannot be denied. Finally, keeping the credibility level and modus operandi of the SBU in mind, as well as the clearly manipulated Bezler tapes and the fake Zuhres convoy, every distrust is legitimate.

Again, as with all publicly available SBU intercepts, on a superficial level they sound quite convincing. They show the right keywords and if you adhere to the standing narrative you will hear or read what you are supposed to hear or read. 

Sergey Dubinsky aka Khmuryi suggested in the documentary by Max van der Werff and Yana Yerlashova that the JIT should show the entire and authentic content of the intercepted calls to reveal the editing. This would be a good thing to start with. But even then we have to consider the option of disinformation.

Content analysis of what is played out seems to lead to incomprehensable or sometimes even inconsistent or provocatingly absent parts of information. The perception of most SBU video viewers will be influenced sufficiently, but actually the alleged pieces of information that are conveyed are quantatively and qualitatively dissatisfactory and not sufficient to draw sound and clear-cut conclusions on. Based on the blogpost series, we cannot say decisively the Buk transport was a hoax, but it would be unwise to not entertain the possibility, overlooking the information and uncertainties we have at hand.

As the evidence from the intercepts (at least from those that have been presented publically) is insufficient, the judges need to clear up a lot of things before they will reach a guilty verdict. Answers are needed to:

The question if the observed manipulations of the conversations can be established by impartial investigations (as was done by Akash Rosen concerning the Bezler tapes) and why the JIT ignored the possibility of tampering;

The question why code language on unsecured lines was not maintained consistently and leaders openly discussed Buk presence;

The question why the SBU invented the larger Vostok-led Buk convoy;

The question if a Buk was present earlier than the 17th, with respect to the implications of the CTIVD report;

And more, as will surface in the next section.

5.8 Indictments and the ICJ case

In section 5.3 three general modes of manipulation of interpretation have been introduced. The first method makes use of keywords and triggers. The second method goes a step further and contains manipulation of the provided information itself, by forging intercepted time and date and editing content of the conversation. Finally, in the last method meaning of the conversation shown is entirely dependent on a preconceived frame of interpretation. Actually the conversation has nothing to do with what is suggested. Examples of this last way of manipulation will be discussed below.

Ad 3. Conversation unrelated to MH17- Example: Kharchenko/Zmey (11)

The first and most explicit example is a conversation between Leonid “Lyonya” Kharchenko and Oleg “Zmey”, the alleged Buk driver (see screenshot below), as published by the JIT after their press conference on September 28th, 2016 (Tabel A, 11).


I wrote about this intercepted call before, as it seemed obvious the talk does not convey what the JIT said it would, which was directing the Buk to its launch site.

From the conversation I concluded that Lyonya gave the alleged Buk driver directions in the opposite direction to the official Buk route, a conclusion that in the meantime also has been confirmed by Bellingcat in their Birdie report (see my blogpost). I wrote:

When Lyonya says to go from Stepanivka [Stepanovka] to the right towards fucking Snizhne, so actually to go from south to north, he in fact gives Oleg a clue in an opposite direction to the alleged Buk route!

Indeed, if one should go from Stepanivka/Stepanovka rightwards towards Snizhne, the way continues along the T0522 through a rural area and the alleged launch field is passed by. Next to this field the DPR hosted a blockpost [checkpoint]. Maybe Oleg was on its way – for whatever reason, as columns and vehicles drove regularly through Snizhne to the southern front those days – to this checkpoint at the left side of the road [as perceived from Snizhne].

The impression remains the two persons talking here, did actually not participate in the same conversation at the same time.”

Lyonya Oleg Stepanivka

Of course, they could have engaged in the same conversation if Oleg just used the perspective as seen from Snizhne to point to “the last checkpoint on the left before Stepanivka”, as reader Brendan pointed out to me. Brendan proposed a slightly different route, foremost because Kharchenko is heard saying Oleg has to go rightwards in Stepanivka and then move “across the field”.

Then the route looks something like this:


According to Brendan:

Even if we assume that the recording of the phone call is authentic, it reveals nothing unusual. All it tells us is this:

Kharchenko/Lyonya is at or near the checkpoint [which matches with the assertion by the JIT that one of the participants logged in on the telephone network close to Pervomaiskyi; HR]
– and he is giving instructions about how to get there to someone called Oleg
– and Oleg is nowhere near any reported location or route of the BUK.

Conclusion is that the conversation on its own has nothing to do with a Buk transport, as it is rather implausible the Buk was brought in from the frontline near Marynivka, although the JIT is providing a preconceived frame for interpretation.

In the same blogpost mentioned above, titled The Kharchenko intercepts, I published transcripts of another conversation in which Kharchenko featured, his conversation with “Ryazan” about a missing Buk crew member (Tabel A, 13). A few things about this talk are noticable.

First, it was my impression that in this call of July 17th, 21:32 local time Kharchenko acts rather surprised when he is confronted with a Buk in a report about a missing crew member:

The person addressed as commander (person A, so presumably „Krot“ alias of Leonid Kharchenko) reacts surprised when his interlocutor mentions that it was a Buk launcher‘s crew that lost its member – as if all panic about the downed passenger plane and its launcher was not immediately at the forefront of his mind.“

Secondly, an interesting aspect of this call is obviously that the keyword “Buk” is mentioned in a conversation in which leaders like Khmuryi and Oreon are not participating. The conversation does not seem to show content that could easily match the disinformation scenario presented in section 5.7. In this way it is clearly an outlier with respect to all calls publically known in which the triggering keyword “Buk” plays an important part.

All publically known intercepts mentioning “Buk”.

Tabel A




Publication date



July 14, 19:12


July 18 (*)



July 16, 19:09


Sept. 28, 2016 (**)



July 17, 9:08


July 18 (*)



July 17, 9:23


July 18 (*)



July 17, unknown


July 18 (*)



July 17, 21:32


March 30, 2015 (**)

(*) Published on YouTube by the SBU in one video; (**) First publication by the JIT.

Finally, this “Buk” tape is also an outlier because it is the only intercept published by the SBU and the JIT about the events after the shoot down on 16:20 local time until the morning of the 18th, when Kharchenko enlightens Khmuryi on what has been going on all this time (more on this below).

Ad 3. Conversation unrelated to MH17 – Example: Girkin/Aksyonov (1)

To indict commander op de DPR troops Igor “Strelkov” Girkin for assisting in bringing down MH17, the JIT showed a video of a conversation on their 19 June 2019 presser . On their website they wrote, as an introduction to the video with the incriminating conversation:

JIT Strelkov Aksyonov

Transcripts of a call between the assistant of Sergey Aksyonov and Igor Girkin, June 8th, 11:30:

Assistant: Hello

Igor Girkin: I am listening

Assistant: Hello Igor, this is Mikhail. Sergey told me you want to get hold of me to share some information.

Girkin: Well, I wouldn’t that call sharing information. In fact, this information is widely known. If no large-scale support arrives in the nearest time, they will strangle us, then we are done. What we need is truly large-scale support. What we get is already not sufficient. Giving… by dribs and drabs as they do it now, can’t make any difference any more. We are outnumbered by the enemy. If the issue of Rusian support – air cover or at least artillary support – is not dealt with, than we are not able to hold ground here in the east. We won’t hold. No way. We need anti-tank artillary, we need tanks, we need decent anti-aircraft defense, because we can’t last on MANPADs alone any more. All manned with trained personnel of course, as we have no time to train them.

About 15 minutes later, on 11:46, Girkin engages in a direct call with Aksyonov.

Sergey Aksyonov: Hello

Igor Girkin: Hello

Aksyonov: About 10 ‘o clock tonight, I will get in touch with… well, with those who already have made this decision. There is already a person and a joint coordination center in place that are dealing with this situation. I just don’t want to give names over the phone.

Girkin: I understand. OK, I’ll be available at that time. But in general, do you understand what the situation is like?

Aksyonov: I do understand what the situation is like, Igor. Anyway, the documents necessary for the support are already being prepared. I will deal with all this stuff tonight.

Voice-over: Aksyonov, the Russian commander of the Crimea assures Girkin that support is already taken care of.

Girkin Aksyonov 1

In these conversations Girkin seems to confirm general information about the dire position of the DPR in the war, asserting that he needs a lot of equipment from the Russians to maintain their position. Although the conversation doesn’t show anything specific, the suggestion is layed down there is an agreement between him and Aksyonov implicating that descent anti-aircraft machines (read: Buk) are on their way.

Again this conversation might not have anything to do with a Buk transfer. Girkin expresses a need for air defense systems that are more efficient than MANPADs (shoulder carried rocket launchers), but what he actually would receive, is not clear at all. Besides, with all documents in preparation and Aksyonov on top of it, Strelkov had to abandon Slavyansk on July the 5th, 4 weeks later, not having received anything of importance.

Indeed, Khmuryi received three Gvozdikas artillary weapons on July 15th, which were filmed moving from the Luhansk area to Donetsk with Russian flags on top. With respect to anti-aircraft weaponry, maybe Strelas would come over. Battalion Vostok showed a Strela-10 in a parade on July 10th in Donetsk and in an interview with LifeNews on July 16th Girkin was seen near Marynivka with a Strela-10 (see image below).

interview Strelkov met Strela 16.7

Although not impossible when interpreting in line with the official narrative, on its own the Girkin/Aksyonov conversation is no direct proof of Buk delivery. Furthermore, obviously the transfer of descent Russian assistance took a lot more time, as the separatists were still losing ground on July 17th – more than a month after the documents allegedly had been drafted up – and only managed to push back the Ukrainian army at the end of August. By this time, 2.5 months after the alleged agreement, Strelkov had stepped down from office and returned to Russia.

As an interesting sidenote, perhaps this conversation was the information from which former JIT member Vasyl Vovk concluded that the Buk came from the Crimea, as mentioned in section 5.1. Actually, until the Girkin-Aksyonov tapes came to light, this Crimea connection was never heard of again, as the JIT went through with the narrative of a Buk that arrived from the Kursk convoy. It seems the JIT is entertaining the possibility that Aksyonov was able to wield his powers in the Kremlin to arrange heavy military equipment.

Importantly, only the first call, with the assistant Mikhail, entered the official complaint of Ukraine against the Russian Federation to the International Court of Justice (ICJ). Below a screengrab from the complaint with all the tapes concerning the MH17 case.

ICJ complaint intercepts

The list of intercepted calls concerning the MH17 case in the official Complaint of Ukraine against the Russian Federation to the ICJ comprises of 7 calls also listed in Tabel A.

Notable is the absence of the Bezler/Geranin and Bezler/Naimanets tapes (Beyond Enakievo, Birdie comes to you), cornerstone of the fatal mistake narrative. Furthermore the Khmuryi/Sanych tapes (Where to bring the Buk?) and the Khmuryi/Botsman tapes (We have downed a Sushka, we received Buk) don’t show up in the MH17 related evidence listed in the Complaint.

Another omission is also quite remarkable. The tapes in which Oreon and Delfin are featuring have not been brought in as evidence to the ICJ. Neither has the JIT indicted these persons, although very much effort has put into work to ascertain their identities.

Reading the Notes of Suspicion on Igor Girking and the other three that have been indicted, it is clear these two LPR men allegedly played a very important part in the distribution of Russian armaments (see screengrab below). As a matter of fact the Notes speak about a joint coordination center with the DPR, as agreed on with Igor Girkin, which would function as a storage and distribution center of military equipment that Russia would provide. Delfin would be in charge of this center, assisted by two deputies, the persons with codenames Oreon and Elbrus. On July 15th the transport of three Gvozdikas for Khmuryi and Strelkov would have been the first outcome of the agreement.

Centraal wapendepot

The Notes provide another interesting aspect. According to the Ukrainians the sealing of the Southern Cauldron (small sliver of land between Russia and DPR/LPR under Ukrainian control) by taking in Marynivka at the border area on the 16th was meant to provide a corridor for a “full-scale Russian invasion”.

In part 4 defense expert and pro-Maidan politician Dmytri Tymchuk was quoted on July 18th, saying that Ukraine had escaped imminent invasion because of the MH17 crash. One could ask himself the question how big the odds are that if you really need a gamechanger of this proportions, it also drops out of the sky immediately.

An intercepted call that did appear in the list of the Complaint was the tapped conversation between Khmuryi and Krot aka Leonid Kharchenko, dated in the morning of the 18th. Actually two conversations between them have been published, timed respectively on 7:41 and 8:00 AM (14). Furthermore, in between these calls Khmuryi also deliberated with Strelkov, in a conversation that was timed on 7:44, a few minutes after the first call with Kharchenko (15). Bellingcat discussed all three calls in their Birdie report.

Kharchecko Dubinsky getaway taps 1 close reading

Call between Krot and Khmuryi, allegedly intercepted on July 18th, 7:41 AM

It is obvious that the keyword “vehicle” has to be interpreted as “Buk”, as the need for code language apparenty was felt again. Although the vehicle arrived succesfully at some crossroads in the right direction, and eventually even in Russia, Khmuryi was kept in the dark during the entire evening and the following night.

getaway taps what was going on

Remarkably, Khmuryi knows nothing about the adventures of this vehicle, allegedly the hottest weapon on earth, and Krot – who does seem to know everything – did not get into contact with his superior Khmuryi through the entire evening and the following night. Krot’s “comrade” returned, about which Khmuryi was informed, but apparently this soldier wasn’t debriefed to inform Khmuryi further about the whereabouts of the vehicle. Khmuryi told unknown people – but not his only superior, Igor Strelkov, as we shall see – he did not know where the vehicle was.

Strelkov did get into contact with Krot’s comrade that was responsable for the vehicle, as he phoned him and introduced himself. It is unknown why Krot thought the incoming calls were “strange”, as it would be obvious that the man in control of a hot piece of equipment, would be held accountable somehow.

Kharchecko Dubinsky getaway taps 2

A very notable observation that can be made about this second call between Kharchenko and Dubinsky is that it almost appears as if the first call between them never took place, because the same emotions and information are shared. In the first call Krot/Kharchenko already said the vehicle was in Russia and arrived succesfully, but in the second call Khmuryi again shows panic about this disaster of losing sight of the vehicle, because soldier X returned without and switched off his phone.

Only difference is that this time the participants do not speak about strange incoming calls, but mention “Bibliotekar” as the soldier who took care of the transfer to Russia. Although this call would make more sense if Khmuryi’s interlocutor would actually be another person than Krot, in any case he should have calmed down, because he was already informed about the succesful arrival.

Important for verification that this talks are all about the flight of the Buk to Russia are obvioulsy the keywords “lowboy” and “Bibliotekar”, apparently responsable for movement of the Buk in as well as out of the Donbass. This way in this call “Bibliothekar” features as the connection with the Khmuryi/Motel tapes from the morning before, in which this person allegedly said “it crossed the line” and that he brought in one and not two – never mentioning the B-word.

According to Bellingcat (Birdie report, p. 74):

It is notable that Kharchenko mentions that “the vehicle” was transported back to Russia on a low-loader by the person with the call sign “Bibliotekar” — a clear indication that they were indeed talking about the Buk missile launcher.

It would be interesting to know what Bellingcat thinks about the topic they don’t mention, which is the line that explains that Bibliotekar will bring a new “vehicle” (a Buk as they claim) from Russia:


Bibliothekar will bring a new ¨vehicle¨ (read: Buk) back from Russia. This is interesting news. Right after they put a Buk over the border, according to the SBU at least four units that night, Russia had decided to bring in a new one immediately, as it seems.

In between these two calls Khmuryi aka Dubinsky also spoke with Igor Strelkov, three minutes after his first call with Kharchenko. Strelkov is, according to Bellingcat, informed about the arrival of the vehicle in Russia.

Khmuryi-Strelkov 18.7 7.44

A few things itch though. First, as seen in the transcripts of the first call, Strelkov was already in contact with X, who apparently brought the vehicle in the right direction (read: Russia). Then he asks Khmuryi why he hadn’t reported to him about the events. As Strelkov did get into contact before X switched off his phone, he actually must have known more than Khmuryi, unless Krot’s comrade kept his mouth shut after Strelkov had introduced himself.

Secondly, it seems strange Khmuryi claimed he had nothing to report about a murder Buk, the hottest weapon on earth at the time, that was somewhere lost in the Donbass.

Thirdly, it would be interesting to know to whom “he f*cking handed over it at once” and why the conversation was cut here, as obviously “Bibliotekar” was expected to be mentioned at this point.

Finally, the SBU nor the JIT shed any light on the most important period of time when the separatists realized they had shot down a civilian airliner and were stuck with a hot piece of equipment. No clear intercepts have been reported about the disarray within the ranks of the separatists between hit and the morning calls, except for the missing crew member tapes, an intercepted call of minor importance. Apparently, as the content of Khmuryi’s talks with Krot and Strelkov confirmed, there were no conversations at all between the commanding officers of the DPR until the next morning!

TABEL B. The intercepts, indicted persons and the ICJ complaint




Indicted persons

In ICJ complaint

(1) Strelkov/Aksyonov Descent anti-aircraft” Strelkov


(2) Oreon/Bugrov Buk


(3) Oreon/Delfin Low-loader, camouflaged, Snizhne


(4) Khmuryi/San Sanych Buk Khmuryi


(5) Bezler/Geranin We shot down plane


(6) Bezler/Naimanets Birdie


(7) Khmuryi/Buryat Buk, Vostok Khmuryi


(8) Khmuryi/Bibliothekar It crossed the line” Khmuryi


(9) Khmuryi/San Sanych Buk, “your column” Khmuryi


(10) Khmuryi/Krot You-know-what”, Motel Khmuryi, Krot


(11) Krot/Zmey Snizhne Krot


(12) Khmuryi/Botsman Just downed Su-25”, “We received Buk” Khmuryi


(13) Krot/Ryazan Buk’s crew member Krot


(14) Khmuryi/Krot Buk in Russia” Khmuryi, Krot


(15) Khmuryi/Strelkov Buk in Russia” Khmuryi, Strelkov


5.9 A political game surrounding the intercepts

On November 14th, 2019, the JIT published another “call for witnesses”:

“The JIT is looking for information on the individuals within the military and administrative hierarchy who enabled the shooting down of MH17 in Eastern Ukraine using a BUK TELAR. The JIT wants to get in touch with further witnesses who are able to testify about these command lines and the role that Russian government officials might have had.”

Apparently the investigators are trying to create incentives for defection and “whistle-blowing” as ordinary people not tied in any way to the chain of command does not seem to be JIT’s main audience – apart from the propaganda effect of course. Seen this way this is another way of seeking confrontation with Russia.

The JIT is claiming to investigate the “important link in the decision-making process in the Russian Federation” as “the intensity of Russian influence is relevant to investigating further individuals involved in the downing of MH17”. The question is if it really is useful to map the chain of command and the relations between DPR and Russia, as this would be already obvious. It may sound cynical, but it would not take a lot of time for the Syrian Prosecutor’s Office to look for the Dutch top of the chain of command responsible for the murder on 70 civilians in a illegal bombing over Syria a few years ago.

In short, in the tapes no hard orders about Russian Buk delivery can be found. Closest the JIT could get until publication of this blog is the conversation between Igor Girkin and Sergey Aksyonov and his assistant (1), also listed in the ICJ complaint. Surprisingly the JIT asked confirmation about their own accusation based on these intercepted calls, as can be seen in the screengrab of the questions listed below. This seems to arrive from a principle like accuse first, try to prove later.

question JIT. what they dont know

The JIT wants to know if Sergey Aksyonov was involved in the deployment of the BUK TELAR on 17 July 2014. At the presser on 19 June 2019 it was claimed, by showing a video of a conversation between Girkin and Aksyonov, that the indictment of Igor “Strelkov” Girkin had to be found in the fact that he asked Aksyonov for descent airdefense systems (Buk), although the JIT still seems to need proof for Aksyonov’s actual involvement.

Reporter John Helmer phrased it like this in his article on the 14 November tapes:

“In fact, as lawyers and analysts of the MH17 case now realize, last week’s disclosure of the top-secret interceptions reveals the JIT has no tape evidence of communications with Moscow on July 17 and 18, 2014, in the immediate aftermath of the aircraft crash.”

In the period when the Russian involvement is most likely to have been direct, as the Dutch allege, and communications ought to have been intense over many hours, the JIT, and its NATO and US sources, have nothing to show.”

Also Max van der Werff comments:

“Not even in one tap is there any mention of MH17, Boeing, BUK, or the crash. Wouldn’t you expect soldiers panicking and round-the-clock consultations between the rebels and the centre, if that’s where the orders came from, as the JIT has already concluded? To me the pattern is clear. After five years the JIT has still not presented any solid evidence.”

Reviewing the tapes published so far reveals the total dedication of the JIT to the pro-Maidan cause and what it stands for in the international realm. A lot of problems have arrived to interpret the tapes the way JIT, SBU and Bellingcat advise us to do. At least the following conclusions have been drawn:

– The Bezler/Geranin and Major/Grek conversations seem to be an early attempt to disseminate disinformation about the causes of the MH17 crash, framing the narrative of the fatal mistake by manipulating the intercepts. Next to this, official Ukrainian sources have provided three possible fatal mistake scenario’s, concerning respectively an AN-26, a Su-25 and a Russian civilian airliner;

– The Khmuryi/Motel tapes show an arrangement of a Buk transport with a Vostok column that never took place in reality. The Ukrainians did not provide any information about the agreement going wrong and its aftermath. On the contrary, the SBU kept this false story alive at least until the Nayda press conference of July 19th;

– The Khmuryi/San Sanych conversation allegedly intercepted on the 16th is not conveyeing a Buk order;

– The Khmuryi/Botsman conversation cannot be matched with known events;

– The Oreon/Bugrov conversation, if no disinformation, displays Buk possession of the LPR at least from the 14th, contrary to all other official sources, which claim the Buk arrived on the 17th.

– It is suggested the Oreon/Delfin tapes convey preparations for a Buk delivery based on appearance of a few keywords. From known facts it is clear that at least the last two conversations out of five do not display events that have anything to do with the Buk transport. Then why have they been published?;

– The JIT doubts its own accusation that the Strelkov/Aksyonov tapes convey evidence of an arrangement for Buk delivery by Russia;

– The Khmuryi/Krot conversation is not able to explain why the Russians apparently sent another vehicle – which should be read as “Buk” in the rest of the intercepts – to the Donbass right after the murder Buk was allegedly brought back to Russia.

– It cannot be explained why the top commanders of the DPR, Strelkov and Khmuryi, were not informed about the entire operation of moving the alleged murder weapon to Russia during the rest of the 17th until the morning of the 18th. Neither is clear why the two most important commanders of the DPR did not get into contact until the morning of the 18th.

5 gedachtes over “MH17 and open source intelligence, a suspicious narrative – part 5: Common goals

  1. It was the USA more than anyone else that pushed the idea that Russia had supplied the BUK before 14 July.

    An anonymous US official told the Washington Post on 19 July that ‘US intelligence was “starting to get indications… a little more than a week ago” that the Russian launchers had been moved into Ukraine’.

    In a statement on 19 July – now deleted but still archived – the US embassy in Kiev appeared to present Oreon’s “We already have Buk” phone call from the 14th as evidence of guilt for the MH17 shoot-down:

    “Intercepts of separatist communications posted on YouTube by the Ukrainian government indicate the separatists were in possession of a SA-11 system as early as Monday July 14th. In the intercepts, the separatists made repeated references to having and repositioning Buk (SA-11) systems.”

    That statement also mentions the video of the BUK on the trailer going “back to Russia”, as if that was where it came from.


    • AFAIK Ukraine never said that the BUK (that allegedly shot down MH17) arrived before the 17th. There have been vague claims from various sources that there were a number of BUK systems brought in from Russia, but nothing official that I’m aware of.

      Even in the above-mentioned Youtube video with the phone call allegedly recorded on the 14th, the SBU say that the BUK crossed the border on the 17th. That recording ends with “We already have Buk, we’ll be shooting them down to hell” and is immediately followed in the video by a report of the transport of the killer BUK from across the Russian border in the early hours of 17 July (three days later, so the rebels could not “already have BUK”).

      The Ukrainian government published similar details on the 19th:
      “In the morning of July 17, the day of a tragedy, the SSU CI acquired reliable information that capabilities of at least one BUK-M system with a crew are available to DNR militants. They were moved across the state border from Russia in the vicinity of Sukhodolsk at approximately 1 a.m. The crew comprised Russian militaries who immediately committed the terrorist act.”

      Ukraine and its western allies have more or less stuck to that story since then, but they still have not adequately explained the mysterious functioning BUK that the rebels’ allegedly talked about on 14 July.


      • I think you are right. With respect to a possible captured Buk, official Ukr channels were disambiguous. Officially only the capture of a broken Buk was confirmed by top -officials, see my blogpost “Another Buk, another day”. Interestingly, NATO commander Breedlove alluded to transfer of SAM’s in a 30 June presser, a day after some pro-separatist and Russian channels/papers claimed the separatists had seized a Buk after their raid on airforce base A-1402. I will come back to this in part 6 of the series.

        As to the arrival of a Russian Buk, theUkrainians never officially mentioned “Buk”, but they alluded to mid range SAMs – obviously provided by Russia – concerning the downing of the AN-26 near Izvarino on the 14th. They even alerted the ambassadors of western countries that day in a joint briefing.


  2. Dubinsky – of all people – should have been aware of the possibility that the Ukrainians were tapping his phone. He was head of military intelligence in the DNR at the time, and he had worked in intelligence with the Russians since the Afghan war in the 1980’s. But for some reason, he and his comrades apparently used unsecured lines to discuss the details of the transport of a BUK system.

    Igor Girkin should also have been too strict to allow his men to accidentally reveal any real military secrets – he was with the FSB for many years and had fought in a very bloody war in Chechnya.

    This background supports the other evidence that Dubinsky and others deliberately let the Ukrainian listen in on their ‘BUK’ conversations. If that’s true, it’s also possible that they staged the transport of a BUK around Donetsk for the same purpose.

    That doesn’t mean that Ukraine’s images of the BUK are all authentic. Some could be doctored, especially those that were published long after MH17 was shot down (that gave months, in some cases even years, to create a convincing a fake of a real Russian BUK). And there’s no proof either that those images were taken on 17 July.

    Nonetheless it’s hard to believe that every single Ukrainian image was a total fake. Some of them could show a real but non-working BUK being paraded around Donetsk and Snizhne, after it was captured from a Ukrainian base. The separatists could have done that to send disinformation to the Ukrainians.


    • It is beyond doubt Dubinsky knew he was tapped. I have seen intercepts, a.o. with Strelkov and Kozytsin, from which it was clear they knew.

      About the forgery of images and videos. The imagery of the 17th all show compositions in which the Buk is only a tiny aspect of the entire picture and it is not in sight for a very long time. Mastepanov showed how easy it is to fake the Snizhne Karapetyan pic (many artefacts visible by the way), the T0522 video (Buk not in focus, not zoomed) and the Torez picture (hidden for half a part behind bushes).

      In the Zuhres video also a very degraded, tiny Buk is visible in a very short time span. To make these would not have taken much time.

      The plume pictures are an enigma and do not show a Buk launch from the alleged field. The Luhansk video might have been in storage, but is also not hard to fake.

      The PM images are much harder to fake, all the more when it appeared to be a video.

      It is hard to believe the trail was a set-up and in fact, without the launch plume pics, it only shows presence of weapon somewhere in the Donbass, not that it has been used. Thats why the launch plume pics are key evidence. Imho they are also the weakest parts.


Geef een reactie

Vul je gegevens in of klik op een icoon om in te loggen. logo

Je reageert onder je account. Log uit /  Bijwerken )


Je reageert onder je Twitter account. Log uit /  Bijwerken )

Facebook foto

Je reageert onder je Facebook account. Log uit /  Bijwerken )

Verbinden met %s