MH17 properly investigated?

In this article the contents of four leaked MH17 Joint Investigation Team documents are analysed by me on behalf of Bonanza Media:

DOC 1. Is a ‘Record Of Interview’ (ROI) between an officer of the Australian Federal Police and journalist Billy Six.

DOC 2. As part of ‘OPERATION AVANELLA’ imagery specialist Shaun Ellis and geospatial specialist Tim Johns from Australia examined four images.

DOC 3. WITNESS TESTIMONY is a Record Of Interview with a witness refuting the claim Ukrainian Air Force did not fly.

DOC 4. LETTER about BUK Positions from the Dutch Military Information and Investigation Service legal affairs department addressed to the public prosecutor at the National Prosecutor’s Office on Counter Terrorism.


DOC 1.

One of the unpublished documents is a ‘Record Of Interview’ (ROI) between an officer of the Australian Federal Police and journalist Billy Six. The latter confirmed to me he was interviewed a day before the Dutch Safety Board held a press conference on 13 October 2015. This information matches with the transcript mentioning 12 October 2015 as the date of the ROI, a strong indication that the batch of JIT documents leaked to us is authentic.

The full 15 page record can be read here (PDF link).

The words “Not to be shared with Ukraine” might come as a surprise for some, but exactly the same precondition I made before agreeing to be interviewed by Dutch officers of the MH17 Joint Investigation Team myself. The officers assured me Ukraine will have no access to my data.


Between 22 April 2015 and 2 July 2015 “in the matter of AFP Case Reference No. 5667342 (Operation AVANELLA)” took place. Imagery specialist Shaun Ellis and geospatial specialist Tim Johns from Australia examined four images related to this operation.

Metadata and assessments mentioned in their report.


“NOTE: Metadata contains General: Image, Video and Audio information. Metadata should only be used as a guide as data fields can be altered manually. The following extraction has been selected for this report:

File Name: Donetsk01.jpg
File type: JPEG file
File size: 470 kb
Dimensions: 1380 x 945
Date created: 24/07/2014, 1:41:30PM
Modified: 24/07/2014, 7:42:38PM

File Name: Donetsk02.jpg
File type: JPEG file
File size: 303 kb
Dimensions: 940 x 626
Date created: 30/06/2015, 10:53:51PM
Modified: 19/08/2014, 10:41:42PM

File Name: Snizhne01.jpg
File type: JPEG file
File size: 157 kb
Dimensions: 800 x 1423
Date created: 30/06/2015, 10:54:09PM
Modified: 20/08/2014, 12:09:08PM

File Name: Torez.jpg
File type: JPEG file
File size: 130 kb
Dimensions: 1024 x 768
Date created: 30/06/2015, 10:54:09PM
Modified: 18/07/2014, 5:52:04PM

The extracted metadata from these four files appears to have been  manipulated. For example, the date modified is prior to the date the file was created. Various reasons could explain why this is so, none can be proved without additional information. The image dimensions vary suggesting that the images have been cropped. The image files are small also suggesting the files have been resaved to be smaller and are not primary images that were taken.”

End quote.

Let’s split up this information in smaller bits and have a closer look.

Files Donetsk02.jpg, Snizhne01.jpg and Torez.jpg have been created 30 June 2015. That is two days before the end of Operation AVANELLA. Writers of the report surely would have mentioned if the images were created later than they conducted their analysis. Therefore it is fair to assume the image files were analyzed by them after 30 June 2015.

Thus two questions come to mind:

Why nearly a year passed before the Australian police obtained and analyzed these images?

Why would the Australian police waste precious time and resources analyzing four non primary images?

The ‘Donetsk01.jpg’ was published by the French magazine Paris Match in small format on 23 July 2014, eight days after the tragedy. The Donetsk02.jpg’ was also published by Paris Match on 25 July 2014.

That these are non primary images is very obvious since the Paris Match logo was inserted into the originals and had then to be resaved.

More important, Paris Match star reporter Alfred de Montesquiou claimed the first published image was taken in Snizhne he later had to correct to Donetsk, about 70 kilometers to the west. Then the story changed again and it was explained that not a Paris Match journalist but a freelancer had taken the images, which later again was changed into the story that a hired driver of the French journalists crew had taken a video and went back to the hotel in Donetsk to show it to the French who initially did not pay much attention to it.

Who is this driver?

Why Paris Match only published two images but not the video?

And, why were the Australians analyzing non primary images/screenshots and not the ‘originals’ from Paris Match even a year after the tragedy?

The Snizhne01.jpg image analyzed by the AFP team has dimensions 800 x 1423.

Visually identical image (with dimensions 337 x 600 pixels) was posted on Twitter on 17 July 2014 by an anonymous account named GirkinGirkin. Aspect ratios of 800 x 1423 and 337 x 600 are the same.

Note. The process of downsizing photos reduces the pixel count used by objects in the photo. Together with artifcial noise, this process can be used to conceal some of the object’s details. Most importantly, if something was added to the photo with Photoshop and had flaws visible to the naked eye, resizing it to a smaller size may either hide the flaws or make them less obvious.

In the documentary “MH17 – Call for Justice” a witness testifies and explains why image Torez.jpg could not have been taken on 17 July 2014.

Same questions as for Snizhne01.jpg:

Where is the original image, when was it taken, who took it?


Why is the date modified prior to the date the file was created?

For more detailed information about issues with these four images I refer to examinations of evidence from social media by Sergey Mastepanov published June 2015 and October 2015.

DOC 3. WITNESS TESTIMONY (refuting the claim Ukrainian Air Force did not fly)

Record Of Interview Nr 26DLPRPrimo4905 was conducted by a Dutch police officer on 28 July 2015. Interviewee is a male witness from Ukraine. Prior to the interview the witness has sent an email on 2 April 2015 with following content:

“Good day. I want to tell you something about that happened in the town of Torez last summer. It was 17 July around 17:00hrs (I cannot exactly recall) local time. At that point in time I was beside my house in the village of Krupskoje (This village comes under the town of Torez). There was military activity at the time, aircraft were circling overhead all day (fighter jets of the Ukrainian BBC (remark translator: airforce).
Before that Boeing fell down, I heard a very loud bang over my head. I saw that the sky was overcast. Between the clouds I saw something falling down. I focussed on this object and when the airplane was no longer in the clouds I saw it was an airliner coming down. A couple of minutes before the fall, I saw a fighter jet in the sky, which circled over the town. No missiles were fired from the surface, in the town.
This photograph that served as evidence of the missile is erroneous, since the photograph showed different weather conditions. Because at that time the sky was rather heavily overcast. The position of the sun in that photograph is unlike the sun you see at 17:00hrs. In the evening. I can clarify this / tell you in a simpler way, at that moment no sun could be seen because of the clouds. In the photograph you can see my village, in the centre, store nr. 95 and the MTC tower (remark translator: MTC = telephone antenna of company from Moscow).
*privacy sensitive information deleted by me*
That photo was taken from the location of a lot of farms. After this Boeing went down, I went with my father to the crash site by car. When we arrived, everything was cordonned off and we were not allowed to go further. In the ploughed field next to the road I saw 2 naked dead bodies. I cannot tell anything else about this.”

Comment: The reporting officer contacted the witness by telephone in presence of a Russian interpreter on 28 July 2015. The witness speaks Russian only and an interpreter translates everything the witness and the criminal officer say.

C = criminal investigator
W = witness
I = interpreter


C :How many airplanes did he see?

I :How many aircraft were in the air at that moment?

W :Two airplanes were audible, not the big one, the Boeing, but fighter jets were audible since these were constantly flying overhead, the noise had already become familiar.

I :Two fighter jets, that is what I could clearly hear, so not the sound of the Boeing. Why? Because where we live the fighter jets were in the sky on a daily basis, so then you immediately recognize them as fighter jets.

C :And this sound was not different from the fighter jets?

I :Did the sound resemble the sound of fighter jets or didn’t it?

W :The exact sound of fighter jets and it was not on its own, there were two of them.

I :It was the sound of fighter jets.

W :One of them [interpreter: fighter jets]

I :Hold on, please, the sound of fighter jets. There were two fighter jets in the sky

I :What else? Please continue what you stated.

W :The sound of fighter jets flying overhead, and after that…at some point they were, I was outside at that point, there was a bang overhead, a very loud bang. And after that I deliberately started gazing at the sky, at what [had] exploded over my head and I saw a vapor trail in the sky. Whether the smoke came from the airplane or from a missile, or was from a missile.. [interpreter inaudible] but in between the clouds..was just a trail.

I :I have not been able to understand this. You said: “was the smoke..the trail came from the airplane or from a missile, you were unable to tell”?

W :Yes, it was a trail, I saw it between the clouds, there were heavy clouds.

I :One moment you saw a trail in the clouds. One moment.

I :So, fighter jets in the sky, I could clearly hear that. At some point there was a bang. I was outside at that moment and was obviously curious to know where that sound came from. I looked up to the sky, it was very cloudy that day, and I saw a clear trail, but I do not know if it was the trail of an airline or a missile, I do not know this. But I could clearly see a trail.

C :What exactly does he mean when he says a trail? Can he describe the sound of the explosion?

I :You were telling about a trail. What kind of trail was that? Could you describe it? And the sound of the explosion, can you describe that as well? So in short: the sound and the trail.

W :It was a loud bang, a heavy bang, can I describe that more clearly…this here in the chest was thumping, a very loud bang, not clear but rather muffled [interpreter: subdued??], a muffled loud bang.

I :One moment, a loud bang, but it was somewhat muffled, as if it was a thump, not like…clear, but really a muffled bang. And what about the trail?

W :The trail was, if you…I saw this from the ground, which was roughly about 200 meters. If you…look at the trail from the ground. And it was white.

I :What colour?

W :It was white.

I :Clear in white.
W :Not dark or turbid…not grey but in white.

I :So you were looking up and you saw a white-coloured trail, about 200 meters in length. Did I understand that correctly?

W :Yes.

I :I looked up in the sky and saw a white-coloured trail of about 200 meters in length, so it was not gray or what have you, it was white.

W :White. Was it horizontal or vertical trail?

I :This trail. What was the line of the trail in the sky, was it horizontal or vertical?

W :The trail was horizontal, but not in a line, it was already blurred, maybe because I saw it too late. The trail of..a bit was no longer straight line.

I :That was not a line, it was already a bit blurred, as if all of it had dispresed a bit, may be I saw the trail late, I don’t know, but I did not see one straight line, but [it was] rather a bit blurry.

W :Matches the photograph this gentleman forwarded, of which he said that photograph cannot be fully correct as there where heavier clouds [remark translator Dutch-English: this is probably the criminal investigator speaking, not the witness]

I :You sent us a photograph, correct?

W :Yes, I sent that photograph to refute the allegation that it could have been launched from my village. From a Buk or something like that.
*privacy sensitive information deleted by me*

I :That is my village.
*privacy sensitive information deleted by me*
And I sent that photograph especially to refute the allegations that the missiles was supposedly launched from my village.


W :The trail I have told you about, wether that was the trail of a missile or of an airplane was not clear to me. With my eyes I searched for the cause. I looked at the sky and saw this plane coming down.

I :Do you refer to the Boeing?

W :Yes, I saw the Boeing and how it was falling down from the sky. I saw it crashing down, the smoke coming from the airplane went up.. black smoke. I saw something after it [interpreter: airplane] had come down, it looked like strips of ribbons, they came down.

I :Ribbons?

W :Ribbons, long white ribbons.

I :one moment. So, a loud bang, I looked up and saw [interpreter: inaudible] some kind of trail from a missile or an aircraft, I cannot define it. I saw the Boeing falling down, so basically from the sky it came down and I saw black smoke and after the aircraft had crashed, I saw white ribbons in the sky, they were also falling down.


Connection was cut due to technical problems.

End of transcription.

This is the image the witness sent by email to the Investigation team. He mistakenly thinks on internet is claimed a missile was fired from his village (visible in the image) while the appointed launch location is about nine kilometers away near the village of Pervomaiskyi.

Map: left bottom crash site Grabovo, white line is line of sight from where image was taken to the alleged launch field. Witness lives in village Krupskoie, which lies exactly on the line of sight and right behind the village is the highest point which blocks the view of what’s behind it.

Important is what the witness saw and heard himself, he:

  • reports 2 fighter jets in the sky, which circled over the town a few minutes before the Boeing went down.
  • heard a loud bang over his head, looked at the sky and saw a HORIZONTAL white trail. (unclear remains in what direction he looked when he saw the trail)
  • watched the Boeing coming down
  • describes long white ribbons coming down after the crash. This matches with what has been reported by the Dutch Safety Board (appendix K page 73) and identified as textile rolls.

DOC 4. LETTER about BUK Positions (Russian and Ukranian)

Letter from the Dutch Military Information and Investigation Service legal affairs department addressed to the public prosecutor at the National Prosecutor’s Office on Counter Terrorism.

Date 21 September 2016
Re Official Notice

Herewith I am informing, pursuant to Section 38 of the Intelligence and Securty Services Act 2002, of data that is possibly of importance for the criminal investigation into the crashing of flight MH17.

In addition to my official notice of 24 June 2015 MIVD has, on the basis of reliable sources and analyses of locations relating to the 9K37M1 Buk-M1 (SA-11A GADFLY) that were listed in the official notice of 24 June 2015, examined whether 9A310M1 radar and launch vehicles on these locations could have been involved in the downing of MH17.

In addition, MIVD looked into the other ground based air defence systems present in the region in July 2014 and that were, as far as operational deployability, specifications, performance and location goes, capable of hitting flight MH17.
In July 2014 the Ukrainian armed forces had operational S-300PS Volkhov-M6 systems (referred to as SA-10B GRUMBLE by NATO) at their disposal.
In July 2014 operational S-300 PM2 Favorit [systems] (referred to as SA-20B GARGOY by NATO) of the Russian armed forces were present the border region with Ukraine.

The table below lists the 9K37M1 Buk-M1 systems (referred to as SA-11A GADFLY by Nato) mentioned in my official notice of 24 June 2015, including their operational status, deployability and distance to the point of impact with flight MH17

9K37M1 Buk-M1 Air Defence Systems present in the region (range 42km).

COUNTRY                  LOCATION                          DATE 2014         DISTANCE

1  Ukraine   48°36’38.00″N 39°14’00.00″E        No                 67 km

2 Ukraine   48°5’58.00″N 37°45’13.00″E            No                  66 km

3 Ukraine  47° 6’25.00″N 37°28’28.00″E            No                  135 km

4 Ukraine   45°13’11.00″N 33°22’42.00″E        June + July     515 km

5 Ukraine   49° 0’34.00″N 37°18’42.00″E        June + July     137 km

6 Ukraine   48°42’23.00″N 37°38’1.00″E          June + July     98 km

7 Ukraine   48°13’14.00″N 36° 1’20.00″E           June + July     191 km

8 Ukraine   47°58’12.00″N 36°34’26.00″E        June + July     154 km

9 Russia     48°44’14.00″N 40° 1’36.00″E           11 – 19 July      122 km

10 Russia   48°38’54.00″N 39°50’18.00″E      From 18 July    106 km

11 Russia    48°17’51.00″N 40° 4’42.00″E          From 20 July   108 km

From the table it becomes apparent that flight MH17 was flying beyond the range of all identified and operational Ukrainian and Russian locations where 9K37M1 Buk M1 systems were deployed.

In view of the locations of the systems identified and the speed with which these can be moved, as well as the nature, development and conflict and border zone of the fight against the separatists on July 2014 it is unlikely that a 9A310M1 launch vehicle originating from the Ukrainian armed forces could have been moved in time for flight MH17 to come within its range and be hit.

All operational Ukrainian S-300PS Volkov-M6 identified were at least 250 kms away from the point were MH17 was hit. The S-300PS Volkov-M6 system has a maximum range of 75kms. On this basis MIVD draws the conclusion that S-300PS Volkhov-M6 system was not used for the downing of flight MH17.

The only operational system identified with a range wide enough to shoot down flight MH17 concerned two Russian S-300PM2 Favorit systems near the Russian town of Rostov na Donu. MIVD does have (partner) information that would indicate the use of the 36N85 (referred to as TOMB STONE by NATO) fire control radar for the guidance of and/or launch of a surface-to-air missile from the 48NS series (referred to as GARGOYLE by NATO) on 17 July 2014.
These locations are in the immediate vicinity of large population centres and the launch of a missile would most likely have led to messages on social media or other public media. MIVD is not aware of such publications.

By order of the


The Director of the Military Intelligence and Security Service

O. Eichelsheim

Major general

End of Official Notice.

Plotting the given coordinates of eleven locations on a map gives this result:

Green pin : crash site Grabovo
Yellow pins: Ukrainian Buk M1 locations according to MIVD.
Blue pins : Russian Buk M1 locations according to MIVD.
Yellow line : Border Ukraine – Russia

One of the conclusions that can be drawn from this Official Notice by the Dutch Military Intelligence and Security Service is that on the basis of sources it considers reliable it “becomes apparent that flight MH17 was flying beyond the range of all identified and operational Ukrainian and Russian locations where 9K37M1 Buk M1 systems were deployed.”

The main conclusion: the Dutch Military Intelligence and Security Service on 21 September 2016 (ONE WEEK before the JIT press-conference on 28th September 2016!) had no information from any reliable source that any Russian Buk-M1 had crossed the border with Ukraine during any time during the conflict.

How is that possible?

When we zoom in on the map and look at the three locations (blue pins) of Russian Buk-M1 we notice these three locations are not only too far from the crash site, but even on the Russian side of the border.

Now let’s have a closer look at Location (10) 48°38’54.00″N 39°50’18.00″E where according to MIVD a Buk-M1 was stationed 18 July 2014 and onwards is only 6,8km from the border with Ukraine.

Google Earth has limited options to chose satellite images by date. We checked this location and four different dates showed:

28 June 2014 – no vehicles

2 July 2014 – 8 vehicles visible

17 July 2014 – no vehicles

25 July 2014 – no vehicles

No Google Earth data for 18 July 2014 is available for this location.

Striking is the fact that the Dutch military has detailed information about positions of mobile Russian Buk system positions thus not stationed on their regular bases, while most Ukrainian Buks are only mentioned at stationary positions at their military bases.

Is it credible Ukraine kept almost all its Buk systems at their bases and did not at any moment during the ‘Anti Terrorist Operation'(ATO) move its air defense assets to mobile locations outside their bases? How likely is that, knowing 12 July 2014 Ukrainian air defense forces have been put on full combat alert?

Coming back to the question raised at the beginning of this article: was MH17 properly investigated?

From the analyses I conducted over the years I have substantiated doubts and the content of the freshly leaked information from these four documents only makes my doubts stronger.

Stay tuned and subscribe to the Bonanza Media newsletters for more to come.


Please keep Bonanza Media going! Donation options:

Bank transfer: M.B.W. van der Werff
IBAN NL77 INGB 00076630 89