Tag: MH17

The Finnish Investigation

On By Corporal FriskIn Russia1 Comment

One of last week’s major stories was the Joint Investigation Team (JIT) presenting their ‘interim results’, again confirming what has been seen as the most likely explanation since the immediate aftermath of the 2014 tragedy: that MH17 was brought down by a Russian-supplied Buk-M1 surface-to-air missile. I won’t discuss the details here, as they have been given in a number of different forums, including by Bellingcat as well the earlier investigative report and now the JIT. Suffice to say, the amount of evidence found in both open and non-open source has reached such levels that the question of whether a Russian supplied Buk shot down MH17 can now be considered a litmus test for whether you are under the influence of Russian propaganda or not.

9k37_buk_m1_sa-11_gadfly
Finnish Buk-M1 TELAR with missiles mounted. Source: Wikimedia Commons/Finnish Defence Forces
For Finland, the interesting part came when Dutch newspaper Telegraaf broke the story that Finland had provided data and performed secret tests on our Buk-missiles, which are of the same M1-version as the TELAR used for downing MH17. To begin with, this ‘important contribution’ by the Finnish authorities was cheered by Finnish media (#Suomimainittu), but the party was cut short by the announcement that JIT had in fact not been allowed by Finnish authorities to see the evidence. This in turn caused a minor uproar that was rapidly shaping into a political storm when the Finnish President called a press conference on the issue.

But first, let’s rewind to how the by now infamous SAM-system ended up in Finland. By the end of the Cold War, the Soviet economy was in a very poor shape. This was also seen on the clearing accounts which formed the basis for Finnish-Soviet trade. Under this system, anything exported by Finland was ‘cleared’ from the account when items to a corresponding value were imported by Finland from the Soviet Union. When the Soviet Union disintegrated, the Soviet balance sheet was squarely in the red, i.e. the Soviets owed Finland goods. During the years since, this has gradually been paid off as goods, services, and cash payments, until the last payment was made three years ago.

One of the early payments was the Buk-system, which arrived in Finland in the mid-90’s and replaced the earlier (and outdated) Soviet-made S-125 ‘Neva’ (SA-3 GOA), local designation ItO 79. The Buk-M1 was introduced under the ItO 96-designation (now ITO 96), and served for roughly a decade until concerns over its vulnerability to countermeasures caused its gradual withdrawal in favour of the medium-ranged NASAMS II (ITO 12). The last batch of conscripts trained on the system in 2005, but the system was scheduled to remain in service at least for a further ten years.

Fast forward to 2014, when the Dutch prosecutor’s office contacted Finnish authorities and asked for technical assistance as part of the criminal investigation into the fate of the MH17. Exactly which Finnish authority received the request is unclear, but eventually a small circle of top politicians were the ones who made the decision on whether to answer the call or not. The decision was made to collaborate with the Dutch prosecutor’s office in full,  and to keep the cooperation secret from the general public. The last part was due to the Dutch authorities requesting that this would be the case, and was not seen as anything unusual given the circumstances. Evidence gathering is a tricky matter even in a ‘normal’ case, and as such it was understood that the cooperation would not be disclosed until during the eventual trial, at the earliest.

aankomst_slachtoffers_mh17_foto_4
The third arrival of the bodies of MH 17 victims. The coffins were transported from Kharkov to the Eindhoven Air Base. Source: Wikimedia Commons/Hille Hillenga – defensie.nl

All this was revealed during the press conference, where the President stressed that the decision was not taken lightly. The acquisition document of the Buk, which isn’t public, forbids the disclosure of information concerning the system to third parties. This was then weighted against the UN Security Council Resolution calling upon all parties to provide any requested assistance to the investigation(s). During the investigation a number of requests have been made, with the most ‘special’ one probably being the request to detonate a warhead and collect part of the shrapnel (contrary to some reports, no missile firings seems to have taken place). This was done in an undisclosed location in Finland by the Finnish Defence Forces in the presence of Dutch officials, and the requested shrapnel was handed over to the Dutch authorities.

Key to the story is that throughout it was the Dutch prosecutor’s office that was in contact with the Finnish authorities. According to president Niinistö, Finland has handed over all information requested by the Dutch authorities, and at no single point have the investigators expressed any kind of disappointment that the data wouldn’t have been thorough enough. The current issue came about as a result of the Dutch prosecutor asking permission that the evidence be handed over to JIT. The letter which requested this did not include any time frame for when the answer was needed, and as such it was decided to send a small committee over to the Netherlands to discuss how this change had come about, and exactly which part of the evidence was needed (the president confirmed that it was preferred and legally more straightforward to cooperate with the prosecutor’s office rather than the JIT). Before the Finnish administration had had time to put their plan into action, the JIT published their interim report and the fact that Finland was involved was leaked.

mjyp5460
President Niinistö and Foreign Minister Soini at the MH17 press conference. Source & copyright: Matti Porre/Tasavallan presidentin kanslia
The President was clearly not happy with how the Finnish actions had been portrayed in the media, or with the fact that the Dutch had leaked the info after being the ones who originally requested secrecy.

Enter the follow-up discussion on what the press conference meant, and how Finland’s reactions should be seen (especially in the light of our relations vis-a-vis Russia).

Some have been quick to argue that there are traces of Finlandisation all over the handling of the issue. The simple fact that the decision to supply the evidence was taken by the political leadership and not by the officials normally handling these kinds of requests point in this direction, as do the continued emphasise on how hard the decision was due to the acquisition document forbidding this kind of information sharing. The critics also point to the fact that Finland did inform the Russian authorities of the request for evidence and that we were going to collaborate with the Dutch investigation. ‘We told no-one, except the Kremlin’, does indeed have a somewhat bad ring to it.

On the other hand, there are also a number of issues here that point directly in the opposite direction, perhaps the main point being that Finland decided to inform Russia that we were going to disclose technical details of their SAM system to an investigation that quite likely was going to result in Russian citizens being charged. The key word here is ‘informed’, the government never asked for permission, something the president clearly stated had been decided against when asked about the issue. The investigation has also spanned over the latest set of parliamentary elections, showing that there is broad support for it to continue.

(A third point of view was the pro-Russian trolls who now argued that this shows that the JIT isn’t trustworthy and that the ‘true source’ of the bow tie-shaped fragments now has been revealed. As noted, the disinformation campaign on the MH17 has long since lost all its credibility.)

I am personally a bit torn over the issue, and felt the beginning of the presser emphasised how hard the decision was a bit too much considering the nature of the issue. On the other hand, I find it hard to be too shocked over the fact that the request for assistance wasn’t dealt with as a run-of-the-mill case. It should be noted that as the original acquisition deal for the Buk-missiles was handled through the government-to-government discussions on the clearing account, the ban on publishing the information is not a buyer-supplier NDA, but most likely part of a government-to-government agreement. Pointing to this is also the fact that it indeed was the president and the Foreign Minister who hosted the press conference, showing that this was dealt with as a matter of foreign policy and not one of a strictly legislative nature.

There has also been discussions regarding if the information handed over to the Dutch actually included such data that was covered by the ban in the first place. This is all pure speculation, as no-one in the public has seen neither the acquisition document nor the details on what information has been requested. However, my personal opinion is that if the information was indeed of such a nature that the Dutch prosecutor needed to get it from an operator of the system, it is also likely to be covered by the secrecy clauses.

In the end, while the exact pattern of decision making might or might not have followed the letter of the law to the point, the whole issue was probably best described by FIIA’s Mika Aaltola who noted that the whole issue is a “storm in a teacup”. This has been further confirmed by the Dutch Foreign Minister Koenders apologising to FM Soini for the leaks, as well as by the chair of the JIT, Gerrit Thiry, who clarified that it certainly wasn’t his intention to criticise the Finnish authorities, but that it was an unfortunate misunderstanding between the Finnish journalist and the Dutch police making the statement. Thiry is extremely satisfied with the assistance provided by the Finnish authorities, and as such everything is back to normal.

MH17 – Thoughts upon the closing of the story

On By Corporal FriskIn Air

After fifteen months of hard and extremely thorough work, the Dutch Safety Board (Onderzoeksraad) has today released their final report on the downing of MH17. The report is clear; it was a Buk missile sporting a 9N314M warhead that exploded close to the left side and in front of the cockpit. The warhead was identified based on the small pre-formed fragments it sprays out upon detonation, the force of which was enough to sever the cockpit from the rest of the plane.

A few days after the downing I wrote my first blog post on the issue, named The Buk and MH17, in which I went through some of the pictures, tweets, and images that had been drifting around on the internet. I’d like to stress that I have never been in any kind of a professional or military setting where I have encountered any air defence system more advanced than the NSV heavy machine gun (or “Itko”, as it is known here in Finland). As such, the post only represented what was available to an ordinary non-air force/air defence guy, spending half a day looking around on the internet.

Almost all conclusions presented in the post are corroborated by the report.

This does not come as a surprise. Throughout the year, more and more details have surfaced, not least from the Bellingcat group, which have painted a very clear picture of the movements of the Buk TELAR from Russia to Ukraine, via the fateful day it shot down the passenger jet, and back to Russia.

The answer from Russia has been a hailstorm of disinformation, some of which apparently have been serious attempts at creating an “alternative truth”, as well as some which are little more than an attempt at flooding the market with conspiracy theories to drown the truth. The (in)famous “Shot down by a Su-25” is an example of the former, with the “It was an Israeli Python-missile” being an example of the latter. All of these have been easily debunked, and in the end the Russian version of the events have all the time crept closer to the true story. What a year ago seemed like the most likely chain of events has slowly moved into a position where it is the only alternative left. Today, the official Russian version is that it indeed was a Buk that brought down the MH17, but with a missile so old it can’t come from Russian stocks. This version of the events was discredited by the Dutch Safety Board being able to prove which warhead was used in the attack (besides the question whether the solid-propellant rocket engine of a 30+ year old missile would function at all).

As noted in the report (as well as touched upon in my blog post), the Ukrainian authorities are not without indirect blame, as they failed to close the airspace despite the downing of aircrafts at such an altitude that a medium- or long-range air defence system had to be present in the area.

Some have criticised the investigation for taking too long to recover the wreckage, for wasting too much time until the final report, and for only stating the obvious. I do not feel this to be the case. As said, the general picture was rather clear from the outset, however, that is not the way official accident investigations are handled. By the very nature of their mission, they have to look into every detail, match tiny shrapnel found on the accident site, run a whole range of analyses, find and interview assorted experts, and most importantly they can’t take any shortcuts, ever, no matter how obvious something seems. The report has been able to provide solid evidence, based on a range of evidence unavailable to the general public and OSINT analysts. The case is now, officially, closed.

It is now clear that Russia was the force behind the attack. I personally believe the crew thought they targeted a Ukrainian Air Force plane. However, this does not exonerate them from responsibility.

Comment on the US Assessment of the Downing of Flight MH17

On By Corporal FriskIn Ukraine

The following is the complete text of the statement published on the homepage of the US embassy in Kyiv, with my comments in italics. Original text here.

United States Assessment of the Downing of Flight MH17 and its Aftermath

We assess that Flight MH17 was likely downed by a SA-11 surface-to-air missile from separatist-controlled territory in eastern Ukraine. We base this judgment on several factors.

The SA-11 designation corresponds to the versions 9K37 Buk and 9K37M Buk-M1.

Over the past month, we have detected an increasing amount of heavy weaponry to separatist fighters crossing the border from Russia into Ukraine. Last weekend, Russia sent a convoy of military equipment with up to 150 vehicles including tanks, armored personnel carriers, artillery, and multiple rocket launchers to the separatist. We also have information indicating that Russia is providing training to separatist fighters at a facility in southwest Russia, and this effort included training on air defense systems.

Note the difference in wording: the US have “detected” the vehicles coming into Ukraine, meaning that they have observed this happening (likely either by satellite, UAV, or boots on the ground). However, they have only “information indicating” the presence of a training facility where air defence systems are taught, signaling a lower degree of certainty. The specific mention of anti-air training given by the Russians to separatists adds credibility to the charges that the Buk-M1 is indeed Russian supplied (and possibly crewed), as opposed to stemming from captured Ukrainian stocks.

Pro-Russian separatist fighters have demonstrated proficiency with surface-to-air missile systems and have downed more than a dozen aircraft over the past few months, including two large transport aircraft.

This is not necessarily relevant. As far as I know, one single transport has been downed at height, the other aircraft and helicopters all having been shot down at low altitude and/or during take-off or landing. The single Antonov An-26 is the sole plane shot down at a height which rules out the use of MANPADS, and it is better described as a medium-sized transport.

At the time that flight MH17 dropped out of contact, we detected a surface-to-air missile (SAM) launch from a separatist-controlled area in southeastern Ukraine. We believe this missile was an SA-11.

This is the core evidence of the statement. The US has detected the launch of a missile from separatist-controlled area happening at the same time the MH17 was downed. It is unclear what kind of intelligence indicates (note the word “believe”) that it indeed was a Buk, but it is still a very strong piece of evidence.

Intercepts of separatist communications posted on YouTube by the Ukrainian government indicate the separatists were in possession of a SA-11 system as early as Monday July 14th. In the intercepts, the separatists made repeated references to having and repositioning Buk (SA-11) systems.

Having perhaps the world’s best intelligence network, and then using easily faked videos of separatist communications posted on YouTube as evidence sure has a degree of ridicule attached to it, but is also an inidcation that US intelligence believes at least some of these transcripts are real.

Social media postings on Thursday show an SA-11 system traveling through the separatist-controlled towns of Torez and Snizhne, near the crash site and assessed location of the SAM launch. From this location, the SA-11 has the range and altitude capability to have shot down flight MH17.

See the earlier post where I discuss some of the OSINT evidence available.

Ukraine also operates SA-11 systems, but we are confident no Ukrainian air defense systems were within range of the crash. Ukrainian forces have also not fired a single surface-to-air missile during the conflict, despite often complaining about violations of their airspace by Russian military aircraft.

Yet another indication that the US is closely monitoring the Ukrainian crises, probably through the use of recce satellites as well as SBIRS. This raises questions about what kind of intelligence the US has on the claimed use of BM-21 Grad MLRS by both the separatists, Ukrainian armed forces, and from Russian territory, as well as the alleged civilian targets these were used against.

Shortly after the crash, separatists – including the self-proclaimed “Defense Minister” of the Donetsk People’s Republic Igor Strelkov – claimed responsibility for shooting down a military transport plane on social media.

In an intercepted conversation that has been widely posted on the internet, a known-separatist leader tells another person that a separatist faction downed the aircraft. After it became evident that the plane was a civilian airliner, separatists deleted social media posts boasting about shooting down a plane and possessing a Buk (SA-11) SAM system.

This is nothing new, but has been openly available since the day of the downing.

Audio data provided to the press by the Ukrainian security service was evaluated by Intelligence Community analysts who confirmed these were authentic conversations between known separatist leaders, based on comparing the Ukraine-released internet audio to recordings of known separatists.

Compared to the brief mentioning of YouTube-videos above, here it is explicitly said that the Intelligence Community have evaluated the videos, and believes these are real.

Video posted on social media yesterday show an SA-11 on a transporter traveling through the Krasnodon are back to Russia. The video indicated the system was missing at least one missile, suggesting it had conducted a launch.

The video is found on my earlier post. Note that in this statement the location of Krasnodon is not doubted, but seen as confirmed.

Events on the ground at the crash site clearly demonstrate that separatists are in full control of the area.

This comes as no surprise for anyone. In itself, it is not evidence of the missile stemming from separatist held territory, the missile has a range of roughly 30-35 km, and the plane didn’t not fall straight down when hit. However, taken into consideration with the other evidence presented here, it does strengthen the case against the Russian-backed separatists.

In conclusion: The US authorities seem sure that the missile was launched by the separatists, but so far lacks hard proof that they were trained in Russia, or that the crew would indeed have been made up of Russian regulars or volunteers.

The Buk and MH17

On By Corporal FriskIn Ukraine13 Comments

The shooting down of Malaysian Airline’s MH17 turned yet another page in the Ukrainian crisis. To begin with, I want to assure that although this text will focus on the technical side of the shoot-down, my heartfelt sympathies are with the next of kin of those onboard the flight.

To shoot down an airliner flying at its cruise altitude, in this case somewhere around 33 000 feet (~10 060 meters), requires at the very least a medium-ranged surface to air missile system, with some kind of radar for target data. There has been much use of the word “advanced” in reference to these systems, but this is somewhat misleading. Already the crude “flying telephone poles” of the S-75 Dvina (SA-2 Guideline) had a high enough ceiling to be able to down Gary Power’s U-2 in the famous incident in 1960. A quite large number of different systems could be used to down an airliner flying straight and level in a low-noise environment. However, what they all share in common, is the fact that an untrained person (or, rather “persons”, as these usually aren’t crewed by a single operator) will not be able to get a missile of, let alone actually hit anything.

S-75 Dvina launcher and missile in Egyptian service. Source: Wikimedia Commons

Note that “untrained” is a relative word. As James Mashiri notes, to be able to fire at a “soft” target the operator needs relatively little training (a few hours of seeing the system in action and getting some answers to the “why did you push that button?”-type of questions).

The prime suspect in this case is the Soviet-made Buk-system. This was created as a successor to the earlier 2K12 Kub (SA-6 Gainful), which had proved to be a serious threat to aircrafts operating at high and medium altitude during the Yom Kippur War of 1973. What was noteworthy with the Kub compared to the earlier S-125 Neva (SA-3 Goa) in that it was carried on a tracked transporter erector launcher (TEL), giving it the ability to rapidly change firing positions, making it harder to destroy. Still, the weak link was that the launchers relied on the 1S91 radar vehicle accompanying each battery, meaning that if the radar was taken out or malfunctioned, the whole battery went blind.

To solve this issue, the 9K37 Buk (SA-11 Gadfly) was normally mounted on a TELAR, which not only transported and fired the missiles, but also held a 9S35/9S35M1 (Fire Dome) tracking and engagement radar. The radar is not meant for acquiring targets, notably it lacks the 360o field needed to do this properly, but gives the launcher a degree of autonomy in the event that the 9S18/9S18M1 (Tube Arm/Snow Drift) target acquisition radar of the Buk battery is knocked out.

9A310M1 Buk-M1 TELAR in Finnish service. Radar in dome to the right in picture. Source: Wikimedia Commons

The Buk is a widespread system, being found both as regular exports and in a number of former Soviet states. The 9K37M Buk-M1 is also found in Finnish service as the ItO 96, but is expected to be phased out in the near future. Another noted user is the Georgian armed forces, which used the Buk-M1 to down a single Tu-22M and possibly up to three Su-25 during the 2008 war. The Ukrainian armed forces operate at least the M1-version, but it is unclear to me what other versions might be in their arsenal.

A number of pictures and videos have surfaced, purportedly shot in the area of the downing of MH17. A reminder is needed: the conflict in Ukraine has seen both purely photoshopped pictures, pictures from e.g. Syria, and pictures taken out of context, which allegedly show different events which might or might not have happened at all.

This video claims to show the downing of the Ukrainian air force An-26 that took place on July the 14th prior to the downing of MH17. It has also been claimed to show the downing of MH17, which is false, as the plane in the video isn’t a Boeing 777. It obviously might be from somewhere else, but the language and vegetation fits Ukraine this time of the year.

The downing of the Antonov is not contested, and was admitted by both the separatists and the Ukrainian government as it happened. Of interest is the fact that according to the Ukrainian government the plane was flying at 6 500 meters (21 300 feet), meaning it was outside the target envelope of handheld systems like the 9K38/9K338 Igla/Igla-S (SA-18 Grouse/SA-24 Grinch). If the stated altitude is correct, this in itself proves the existence of a medium-altitude system in the area around Krasnodon in the middle of July. The crash sites of the two aircraft are separated by a roughly 150 km long trip by road from each other.

As a side-note: it is open to speculation why the airspace above 32 000 feet was deemed safe on July the 17th, as the Antonov proved that 21 000 feet wasn’t. I for one can’t come up with a system with a ceiling between these two values.

On his blog Cornucopia?, Lars Wilderäng has listed a few pictures and videos claimed to show the movement of a single 9A310M1 Buk-M1 TELAR along Ukrainian roads in the area. The two most interesting are found here and here. Both seems to be authentic, and fits the description of the situation.

A video that surfaced after the downing of the plane shows a single TELAR (the same?) being transported by a civilian truck. Note the fact that only two out of the normal load of four missiles are visible, and that using white civilian trucks to transport (unmarked?) TELAR’s is not standard operating procedure (at least not in Finland). A still frame from the video is shown below.

9A310M1 Buk-M1 TELAR transported on civilian truck.
9A310M1 Buk-M1 TELAR transported on civilian truck. Source: Video linked above

All in all, there seems to be enough evidence to indicate the existence of a single 9A310M1 Buk-M1 TELAR in the area of the crash site of MH17. If the TELAR operated independently, target acquisition would have been somewhat problematic. As said, the system has a limited capability in this field. However, using the radar requires fuel for the gas turbine as well as emitting radiation which can be picked up by Ukrainian ELINT-planes. Another possibility is that the target was first picked up visually by a spotter (in the crudest version by a crew member standing outside the TELAR), who relayed an approximate position to the operators. These then proceeded to shoot down the plane, most probably believing it was a military transport. On the juridical part of this, see James Mashiri’s detailed analysis.

Of interest is also the evidence in the case. Although currently most facts seem to indicate it was the separatists who shot down the plane, hard evidence is so far lacking. The US almost immediately pointed finger on the separatists (and Russia). The interesting part is that the US very well could have the proof for these charges, namely by being able to pinpoint the launch site through the satellite based SBIRS and/or by ELINT-measures based in nearby NATO-countries (e.g. planes orbiting over Romania). Here SBIRS seems to be the most likely case, but it is possible the US withholds the form of the evidence as not to show the exact capabilities of one of their major strategic defence systems. The less than proper handling of the crash site by the separatists on the other hand, seems to indicate that they are either covering up something and/or are simply worthless at public relations management.