Examining the MH17 Launch Smoke Photographs

Just three hours after the crash of Malaysian Airlines Flight 17 (MH17), a picture was published on Twitter that appeared to show a ropeway on the horizon between “Lutugina” and “Tsof” in the area of Torez, which is close to Snizhne. The timestamp of the tweet suggests it was sent at 9:23 AM on 17 July 2014. Considering the fact that the plane crashed around 16:20 local time (EEST, or Eastern European Summer Time), this timestamp is remarkable, because it would suggest that the tweet was sent seven hours before the crash. The default setting of Twitter, which is headquartered in San Francisco, displays timestamps in Pacific Time. (More precisely, Pacific Time in the US is Pacific Daylight Time [PDT] between late winter and mid-fall and Pacific Standard Time [PST] between mid-fall and late winter.)

Converting the time from PDT to EEST shows that the image was posted at 19:23 EEST, three hours after the crash of MH17. [note: since Twitter usually displays tweets in relative time and there is one hour time difference between summer and winter time, it might be expected that a tweet posted in the summer would display a different time in winter, but that is not the case, since older messages are displayed in absolute time. The mistake in this article about the time stamp has been corrected.]

Various individuals online have asserted that the picture was a fabrication of the Ukrainian Security Service (SBU). This is unlikely for the following reasons: The photograph was posted only three hours after the MH17 crash, the general location of the white smoke trail is in the same area where the Buk was seen heading toward when last seen in Snizhne, and the weather matches that of July 17 as demonstrated in subsequent photographs that were released. Additionally, the SBU did not share this photograph until two days later, while, in contrast, the 18 July 2014 Luhansk video was released very quickly by the SBU itself. The photograph did not appear on any official Ukrainian channels before it was posted on Twitter, and the earliest posting of the photograph by a Ukrainian official was by Ministry of Internal Affairs official Anton Gerashchenko on Facebook at 7:45 PM (local time).

On 21 July 2014, the blogger Ukraine@War geolocated the photograph. The Bellingcat investigation team has verified the geolocation, which indicates that the photograph was taken north of Torez in the direction of a mine in eastern Torez. This detail did not come as a surprise, as the 17 July Twitter post mentioned a ropeway between Lutugina and Tsof in Torez, close to Snizhne. Wikimapia reveals in the area of the mine both Lutugina (‘Шахта им Лутугина’, им stands for имени which means name, so a mine called Lutugina) as Tsof ‘(ЦОФ им. Киселёва’, ЦОФ being the abbreviation of ‘Центральная обогатительная фабрика’ which means enrichment plant, so an enrichment plant called Kiselev).

Wikimapia, showing Lutugina (red), the mine Ukraine@war noted (green), and Tsof (blue).

Ukraine@War’s work establishes that the houses visible in the foreground of the picture are in the east of Torez, close to the mine. He reaches this conclusion after asking a local resident to recreate the photograph of 17 July 2014, who took pictures from a hill in the direction of the mine. Ukraine@War was able to identify a number of matching features between the two photographs, including a particular pole between the houses and similar types of houses. The Bellingcat investigation team also identified houses under a hill on both photographs.

Below is the photograph recreated by a local for the Ukraine@War blog with these particular features marked:

The picture recreated by a resident from the area east of Torez several days after 17 July 2014 with a red arrow pointing to the long light pole (added by Ukraine@war) and houses marked in a red circle (added by Bellingcat)

Comparing this recreated image with the 17 July 2014 photograph, the features seem to match:

The 17 July 2014 photograph with the same houses marked by a red circle.

A photograph from Panoramio, taken from a hill next to these houses, further illustrates the scene. The description of the picture (“вид на пос. Крупский,” or, “view of the village Krupskiy”) points to a street called вулиця Крупської (Krupskoi street), where a long light pole can be seen (marked with a red circle) along with other recognizable landmarks, such as two wooden electricity poles:

Panoramio picture taken from a hill toward the east of Torez.

This Panoramio photograph was taken in 2009, making Google satellite imagery from 2010 more useful to show landmarks that are not as visible in more recent satellite imagery. In this satellite image, the wooden electricity poles are visible (orange circles), which are not visible on recent images, likely because they have been removed. The rectangular shape of ground is visible (pink rectangle), the two houses in the front match (blue and green circles), and the long light pole can be seen with a big building behind it (red circle):

2010 Google Earth satellite image showing the area near a hill in the east of Torez with the long light pole (red circle), two similar houses (blue and green circles), two wooden electricity poles (orange circles), and a rectangular piece of ground (pink rectangle).

When comparing this image with the 17 July 2014 picture, there are not many obvious matches apart from the long light pole. However, after taking a much closer look at another recreated image, some similarities become apparent, as seen in this cropped image:

A part of another recreated photograph taken by a local and published by Ukraine@war showing the hill the Panoramio picture was taken from as well as the houses marked by a blue and green circle. The wooden electricity poles aren’t in the picture here because they have likely been removed.

It’s clear that the photograph of 17 July 2014 and the recreated image taken by the local show nearly the same location: an area in eastern Torez, east of a hill, and close to a mine on the edge of Torez, near Snizhne, and photographed in the direction of that mine and Snizhne.

Further examination of the photograph when compared with the Google satellite imagery reveals additional matches, especially when the view in Google Earth is turned in the same direction.

The blue lines in the images below are the frame of the 17 July 2014 picture, the brown lines show the direction where a small trail of grey smoke is seen, the red lines show the direction where the white smoke trail can be seen, and matching landmarks are in circles with various colours:

First image with matches between the 17 July 2014 picture and the Google Earth satellite image.

Second image with matches between the 17 July 2014 picture and the Google Earth satellite image.

Third image with matches between the 17 July 2014 picture and the Google Earth satellite image.

Fourth image with matches between the 17 July 2014 picture and the Google Earth satellite image, which show correspondence between the picture and the trees near the mine at the eastern edge of Torez.

Dutch news outlet RTL Nieuws conducted an interview with the anonymous photographer of the white smoke trail in December 2014. Along with the interview, RTL Nieuws acquired additional photographs taken right after the original photograph in the same location. Two research organizations, FOX-IT and NIDF, verified the authenticity of the photographs, while two other organizations, NEO and TuDelft (the Technical University in Delft), examined the white smoke trail and geolocated the photographs. The anonymous photographer has given the original photographs, including the memory card holding them, to the official Dutch investigation of the downing of MH17.

Second picture taken on 17 July 2014, north of Torez.

With this second photograph, it becomes even clearer that the scene is the same as that of another Panoramio picture, where the same hill is visible:

Panoramio picture of the hill east of Torez.

It’s also worth investigating where the photograph was taken. Many have concluded that the picture must have been taken from a tall building in northern Torez, since a field is visible behind the houses in eastern Torez, and fork-shaped poles near the mine are visible in the distance, which could not be seen from a hill where the local photographed the same area. The Bellingcat investigation team verified this conclusion, and we judge that the assessment that the photograph was taken from a tall building in northern Torez is correct.

Approximate location the picture was taken from (red circle), the view frame of the picture (pink lines), the hill visible in the second picture (orange), the eastern part of Torez (green), and the mine with the poles visible on the 17 July 2014 picture (blue) .

Considering the previous geolocation evidence, there can be no doubt that the photographs that claim to show the Buk launch site from 17 July 2014 were taken from northern Torez and show the area of eastern Torez near the Lutugina mine in the direction south of Snizhne.

The White Smoke Trail

There are many claims that what we actually see on the picture, the white smoke trail, is not a smoke trail of a rocket that just has been launched, but just a contrail of an airplane that has been spread out by wind. Various images of contrails or vapour trails show what they look like:

Contrails or vapor trails of airplanes, arranged from fresh to dispersed.

When we look closely at the white smoke trail of the 17 July 2014 pictures, it’s clear that it doesn’t resemble the contrails of airplanes. Plane contrails are quite straight, and even after being dispersed almost entirely, the shape of the contrail stays straighter than the white smoke trail we see in the 17 July 2014 pictures.

We have also compared the 17 July 2014 white smoke trail with several pictures and movies of Buk M1 missile smoke trails. When we compare the white smoke trail of the pictures of 17 July 2014, there is much more similarity with the images of the Buk M1 missile smoke trail than with the contrails of airplanes, the main difference being that the white smoke is more dissipated and dispersed by the wind in the 17 July 2014 pictures. Even the cloud of grey smoke characteristic of the first stage of a Buk missile launch (shown on the following images) can be seen in the 17 July 2014 pictures.

White smoke trails (and grey clouds near the ground) after a Buk M1 missile launch; images and screenshots from videos found on a Russian website and YouTube.

Other type of rockets like Grads or Tornados don’t leave a long white smoke trail in the air, as they are intended for ground targets at distances of 20 to 35 kilometres and cannot be used for air targets.

So, it is very possible that the white smoke trail (and the smaller grey smoke trail) we see in the 17 July 2014 pictures was caused by the launch of a surface-to-air missile, like the Buk.

Authenticity of photographs

There have been many claims that the 17 July 2014 pictures are not genuine, manipulated, or were taken at a different date.

As part of this investigation, Bellingcat contacted the photographer who took the smoke trail images, and provided the images in a RAW image format. To protect the privacy and safety of the photographer, we have decided not to publish anything about the exact file type of the pictures or any other metadata, as it would reveal the type of camera the photographer used. What we will publish is that the second published picture was taken first at 16:25:41 EEST, and the first published picture was taken 7 seconds later at 16:25:48 EEST. According to the photographer, the first picture was taken about 30 seconds after the explosion. Because we know that flight MH17 was hit around 16:20 EEST, the camera’s time stamp was approximately 4 minutes to 4 minutes and 30 seconds ahead of the real time. The metadata (or Exif data) of the original files show that all date and time properties like camera date, digitized date, modified date, and file date show a date of 17 July 2014 and times of 16:25:41 and 16:25:48.

Images in a RAW format can be edited in photo editing software and saved as a different format, like BMP, JPG, PNG, TIFF, etc., but this will always result in a different file date, namely, the date and time the file has been saved after editing. Photo editing software is not able to save files in a RAW format, because this is not a “positive” image format. In addition, because pictures can only be edited by photo editing software, changes to the pictures will always result in modified metadata.

While software capable of saving images in RAW format does exist, it is usually the software of the camera itself and cannot edit images because images in a RAW format first have to be converted to an editable image format (e.g. BMP, JPG, PNG, TIFF). Also, when the file in RAW format is saved, the modified date of the metadata will be changed.

Based on the metadata of the RAW files we received, we can be completely certain that these files are the original files and that the pictures were taken on 17 July 2014 at 16:25:41 EEST and 16:25:48 EEST, according to the date and time set in the camera. Though it is possible to set the camera itself to a different date and time, when we take into account that the first picture was released two hours after the crash, the only scenario where what we see on the pictures is not the launch of the Buk missile that was seen above eastern Torez on 17 July 2014 is that the photographer took a picture of a missile launch on a previous date, and his camera date and time was inadvertently set to 17 July 2014 at 16:25 EEST. The probability of this being the case, of course, is close to zero.

Despite the ostensible authenticity of the images, our team sought to verify whether the second picture really was made seven seconds after the first and to show that the first published picture is not just an edited version of the second one. One image appears to be a zoomed in version of the second, so we overlaid the zoomed image on top of the unzoomed image.

As seen above, this was a perfect match, with the camera in the unzoomed image auto-focusing on the cables laid over the image in which the camera causes the background to be out of focus. Because the cables were close to the camera position, the zoomed image no longer shows the cables.

The Bellingcat investigation team noted that the small grey smoke trail is probably connected to the white smoke trail. Some assessed that it could have been the smoke from a burned field caused by the launch, though we believe this is not likely so soon after the launch. Another view, which turned out to be correct, was that the grey smoke was caused by the first stage of the missile launch. The following enhanced image shows the smoke more clearly:

We then investigated why the smoke trail appeared to take such a sharp turn:

We assess, based on the direction of the wind only a few hours earlier, that varying wind speeds at different altitudes caused this sharp turn. In an earlier video showing the Buk linked to the downing of MH17 travelling south out of Snizhne, it’s possible to make out smoke from artillery fire. Based on the movement of that smoke we can see the wind was blowing from the east:

The following image shows the smoke in the launch photographs as it is blown west after the launch:

This is congruent with local weather conditions in Snizhe on July 17th, which show that the wind was blowing from east/east-northeast around the time of launch.

Based on the visual information from the pictures and metadata of the original versions of the pictures, it is clear that the white smoke trail has moved because of the wind coming from the east, and it is our conclusion that the pictures are authentic and not fabricated or manipulated.

Uncompressed versions of both photographs are available here.

The weather

The second picture leaves no question regarding the weather on 17 July 2014. In the first picture, an almost completely blue sky is visible, and houses in eastern Torez seem to be in full sunlight, while on every video that has been published about the crash of Flight MH17 the sky is cloudy. The distance between the crash site and this area in Torez is about 15km, and the distance between the area the photograph zooms into and the crash site is about 20km, so it is possible that the weather at the crash site may have been different from the weather where the picture of the white smoke trail was taken (and/or the location from which the Buk M1 missile was fired). There was a lively discussion about the weather in eastern Ukraine on 17 July 2014, but a definitive conclusion is difficult to reach.

A satellite image from the site Sat24.com shows that the weather in the eastern Ukraine wasn’t the same everywhere around the time Flight MH17 crashed. Sat24.com displays the time in CET (Central European Time) and UTC (Coordinated Universal Time, or GMT [Greenwich Mean Time]). In the summer CET was UTC+2 (actually called CEST, Central European Summer Time). In Ukraine, which has EET (East European Time) and, in the summer, EEST (East European Summer Time), the time was UTC+3. To establish the cloud coverage around 4:20 PM (i.e., the time of the crash of Flight MH17 in EEST), the map time needs to be set to 15:20 CET/13:20 UTC. Unfortunately, only historical maps of an exact hour are available (e.g., the maps of 15:15 and 15:30 no longer can be retrieved), but the map of 15:00 CET/13:00 UTC offers the required information:

Zooming in on Ukraine makes clear that the weather in eastern Ukraine at 16:00 on 17 July 2014 EEST was not the same everywhere, as Torez is at the edge of a cloudy and sunny area:

What these images demonstrate is that Torez would have been on the edge of a cloudy region, so there’s no reason to expect thick cloud in the area. In fact, an earlier photograph taken of the Buk missile launcher inside Torez around midday on 17 July shows a fairly clear sky, which is consistent with the fluctuating weather in the area at the time.

After acquiring the original copies of the smoke pictures from the photographer it became apparent that the shutter speed differed between the two photographs, and the photographs that had been previously published had colour and brightness adjusted to make the smoke trails more visible, which also affected the visibility of clouds in the those images. Based on the original images, it is clear that the weather visible in the pictures matches the local weather conditions at the time.

More information about how this location relates to other claims and evidence about the launch location of the missile that downed MH17 can be found here.