MH17 – ‘Buk launch photo’s’ are cheats

May 20, 2015

One of the reasons I visited the MH17 crash area in April 2015 was my desire to verify the authenticity of the only two existing photos showing a smoke plume claimed to be generated by a Buk missile.


This picture posted 3 hours after MH17 crashed shows an almost completely blue sky. On social media many people immediately questioned the authenticity of the picture because the weather in and around Snizhne was cloudy with 8/8 overcast at that moment.

More than four month’s later, on December 22nd 2014, Dutch RTL News presented another picture of which the photographer claims it was taken moments before the picture published on July 17th 2014.


How odd, in this picture that supposedly was made only seven seconds earlier the sky is cloudy and has a totally different colour….

Daniel Romein of the Bellingcat research team explains:
“On the original published photographs the color settings were adapted to make the white smoke trail more visible, the result is that the grey smoke is lighter on the first picture and darker on the second.” (Source)

The anonymous photographer explains:
“My camera was near the window. I grabbed it and ran upstairs to the roof to take a picture. I took my first picture but saw I had electric cables right in the middle, so then maximized the zoom and took the second. Then I turned round and on the other side, to the north, saw a trail of dark blue smoke. I decided that the missile must have hit a petrol station. I climbed to another part of the roof to take a picture from there. It took me three minutes, and I took the third picture. I had no idea that my third picture was the smoke from the just crashed plane.”
(Source)

RTL News and Bellingcat refuse to publish the Exif data of the photos

Motivation: it would jeopardise the safety of the photographer. Unfortunately no ‘open source social media’ this time and we earthlings have to do our own research with completely useless BMP-files.
By the way, isn’t it strange this photographer trusts blogger Bellingcat and yet is worried about his anonymity and safety? And if “as part of this investigation, Bellingcat contacted the photographer who took the smoke trail images”, how difficult can it be to find this ‘anonymous’ person if a blogger can do it?

I first checked the geolocation performed by Ukraine@war verified by Bellingcat. While they estimate the location from where the photographer took the pictures vaguely in the green circle I was pretty sure

the red circle must contain the exact building,


because the GSM-antenna on the third photo the photographer took is clearly visible on the sat pic and the direction of the MH17 crash plume matches too.

Location from where pictures were taken: Torez. Microrayon 3, Building 2


Trying to get access to the roof of building 2 in Microrayon 3

During my stay in Donbass most people were very friendly. However, as I asked an inhabitant of building 2 to give me access to the roof he insisted I show my passport plus a document proving my legal status. After I did just that and explained the purpose of my request only then the man relaxed.
Then I showed him both plume photo’s. “These photo’s are fake”, he said. “Everybody knows that”. We took the elevator to the top (ninth) floor.

“Here, this is Pasha’s apartment”, the man said. “He is a master photographer. A real expert. Unfortunately he chose to join the wrong side and left.”


After spending more than eight months behind my laptop trying to find out the truth about the plume pictures I was excited being so close to a reality check. After climbing two stairs and a small metal ladder attached vertically to a concrete wall I finally reached the roof……

The video is clear proof of the fact there are no cables on the roof as shown in the ‘cable picture’ which RTL News on December 22nd presented as scoup and new “crucial evidence” in the MH17 case. And these cables were never there because on the part of the roof from where the trees in the foreground are visible there is no higher point to which the cables could have been attached.

Conclusion: The first of three pictures the photographer claims to have taken is a fraud.

Who is the lying anonymous photographer?

Just hours after the sunny ‘Buk plume’ picture was posted on Twitter account @Wowihay the name of the photographer was circulating on Internet: Павел Алейников. In Latin script his name is spelled Pavel Aleynikov.

In Torez I have spoken to people who live in the same building as Aleynikov did, spoke to a former classmate who joined the rebel forces and I talked to two of his former colleagues. They all regretted ” ‘Pasha’ went to the other side” and expressed disappointment he took part in what they regard as faking evidence smearing the rebels and Russia.
What struck me most however was the complete absence of verbal aggression. I would expect cursing and foul language from people who felt betrayed by him. None of the kind.
Aleynikov’s apartment on the ninth floor was neither raided by the new authorities nor violated by anyone. Not the kind of behaviour one would expect from ‘terrorists’, would you?

Anonymous witnesses have huge propaganda advantages

– claims made by witness become harder to verify
– anonymity because of ‘life in danger’ demonises the political opponent
– possible motives of witness can be covered up

As a news consumer I understand that sometimes it can be necessary to keep the identity of a witness secret, but certainly I want journalists to inform me about the strong pro-Kiev stance of a witness when he incriminates anti-Kiev rebels and Russia while he claims “my only goal is justice”.

In a previous article I’ve accused RTL News of hardcore Dutch war propaganda. Today I add it is unforgivable that RTL News decided to deliberately keep the political agenda and real motives of their ‘anonymous’ witness hidden for the Dutch public.

More lies made by the ‘Anonymous’ witness

Having identified the witness it becomes easy to do an online quick scan. Turns out on different dates Aleynikov gave at least four interviews to various media. In chronological order:

Business Insider – July 17, 2014, published the same day
RTL News – published December 22, 2014 (English translation)
Meduza – blog of Russian journalist Parkohmenko, published March 17, 2015
Daily Mail – published March 22, 2015

This Tweet from July 17th 2014 at 4:46pm (local time) prompted Aaron Gell from Business Insider to contact Aleynikov:

В Торезе сбили самолет! Упал в районе квартала!”
[In Torez a plane was shot down! Fell in the area of Kvartal!]

Aleynikov later deleted the tweet, but others had already stored it.

Excerpt from the Business Insider article:
“Although he did not see the plane crash, he said he ran to his window after hearing the sound of an explosion after the plane fell to the ground. He could not see the situation from his balcony, so he climbed to the roof of his house and “saw the smoke on the horizon.”
And later, he “learned that the terrorists shot down a civilian plane,” he said. The man added: “I’m in shock! The terrorists must answer for their actions!” Regarding the passengers on the plane, he said (again, translated from Russian): “According to the information of the local residents, all the passengers on the plane died. And X [amounts] of bodies are thrown over the field next to the poultry farm settlement Grabovo.” He said, “I anxiously await the arrival of Ukrainian legal power!”

Well, well, well. At 4:46pm local time Pavel Aleynikov surely knew “In Torez a plane was shot down“, but many months later he tells Daily Mail: Then I turned round and on the other side, to the north, saw a trail of dark blue smoke. I decided that the missile must have hit a petrol station.”

Why months later the witness changes his story and suddenly claims he thought not a civilian plane, but a petrol station was hit?

Why didn’t he tell Business Insider about his earlier pictures with the “missile trail”?

Few hours after MH17 vanished from radar, Aleynikov is absolutely sure a civilian plane crashed, yet he does not mention to his interviewer at Business Insider that prior to the crash plume picture he took two pictures of “a white trail” at the horizon. He says in the same interview: “The terrorists must answer for their actions!”, but the thought did not occur to him that the very unusual “white trail” he photographed might be the contrail of a missile that was fired by the ‘terrorists’.

I’m convinced the official Dutch investigators don’t buy Aleynikov’s lies and surely repeated professional interrogations and a polygraph test would expose many other inconsistencies in his bogus stories.

Witness claims he handed over the pictures to his friend.

His friend Владимир ДюковVladimir Djukov runs the @wowihay Twitter account and is also involved in the pro-Kiev propaganda site Torez.info 
Djukov has been very busy the evening MH17 crashed.


4:40pm Djukov tweets the third picture Aleynikov says he took after the crash. On the tweet photo a moiré pattern is clearly visible. Why? Moiré patterns can occur when a photo is taken of an image on a computer monitor or TV-screen. If Aleynikov really physically handed over a flashcard with the picture why would Djukov take a picture of a picture? Also notice less then fifteen minutes passed from Aleynikov taking the picture and Djukov tweeting it. Not much time to go down the elevator, move to another part of Torez, hand over the data device and then have his friend tweet the picture.


6:38pm Djukov rushed to the crash site and posted a picture showing a dead baby. Or did somebody else take the picture and Djukov as spider in a web of ‘friends’ took care of redistribution? I blurred the corpse. If you wish unblurred footage, here is the original tweet.


7:23pm he posted the famous picture with plume but not before he first altered the colour settings “to make the white smoke trail more visible” as Bellingcat already explained. Or did not Djukov but another entity Photoshop the picture?


2:27am July 18. Djukov has been very busy geolocating the origin of the “white trail”.

It’s more than obvious Djukov is an info warrior serving a pro-Kiev agenda and possibly an asset of the Ukrainian secret service SBU. Not just a friend of a photographer who claims his “only goal is justice”.

RTL News conducted smoke plume and photo analysis

The 28 page report (in Dutch) “Summary Smoke Plume Analysis” is written by reputable Dutch institutes TU Delft and NEO and can be downloaded here.

The last sentence of the report:
“Op basis van de hierboven uitgevoerde zichtlijn analyse en schroeiplek analyse achten wij het mogelijk dat de rookpluim afkomstig is van dit afwijkende tarweveld.”

Translation:
“Based on the conducted analysis of the line of sight and scorched spot, we consider it possible the smoke plume originated from this differing wheat field.

Internet sources claiming the conducted smoke plume analysis contains proof a missile was fired from the differing wheat field did not read the report or deliberately distort its contents for propaganda purposes.

Fox-IT and NIDF have carefully studied the photo files and according to them there is no indication of post-processing, fraud or manipulation of the three photos”, RTL News writes on its webpage.

This is interesting. RTL News never published these reports. Why not?
I contacted Fox-IT and NIDF with the request to send me their reports. Both declined and told me to contact RTL News. Of course this is the only correct and professional response these companies could give to protect the interests of their commercial client.

I contacted RTL News several times and asked them to show the reports. The news station declined. Why? RTL never published the photo analysis reports. Why not?


Not being able to find out if a photo is manipulated is not the same as being sure the photo is not manipulated.

Years ago the “Russian company Elcomsoft found a vulnerability in Canon’s OSK-E3 system for ensuring that photos such as those used in police evidence-gathering haven’t been tampered with. The result is that the company can create doctored photos that the technology thinks are authentic. To illustrate its point, it released a few doctored photos that it says passes the Canon integrity checks.” (source) Nikon camera’s have similar issues.

Manipulation of digital images can be detected with FotoForensics’ Error Level Analysis – ELA. Here’s a sample with explanation.

[No signs of manipulation? Source & credit Michael Kobs]

Governments and their secret services certainly have the knowledge and resources to produce fake images that are almost impossible to falsify.

Charles Wood, a professional forensic analyst and expert witness with specific expertise in digital media, manipulation of images, metadata and micro-meteorology dissects much more issues about the pictures in this article.

The story behind the three pictures – an alternative explanation


July 17th, 2014, Torez, Ukraine. Around 4:20pm local time flight MH17 was destroyed in midair.

Picture3
Thousands of people have seen the dark smoke plume at Grabovo rising into the sky. Many people took pictures and various videos were posted on social media. A selection can be viewed and among others picture3 is also listed here.

Picture3 was published about fifteen minutes after the crash and its authenticity is undisputed.

Picture2
– Except Pavel Aleynikov nobody until today claims to have photographed the contrail visible on this picture.
– After ten months not a single video has appeared showing the contrail.
– Although mostly cloudy that day, lateral visibility was excellent. More than 40,000 people live in the area in which people could have seen both the crash plume and a very unusual missile contrail.
– Many pictures and videos were taken of the crash plume in Grabovo. Pictures and videos uploaded shortly after the crash with different angles and many different positions, but none of them showing any trace of a missile’s contrail.

Let these facts sink in for a moment.

a) Possibly this picture2 is real and not manipulated, but shows another event and was NOT taken on July 17th. People claiming they can proof the picture is 100% legit and taken on July 17 do not know what they are talking about.
b) Possibly this picture2 is doctored, for example by Ukraine’s secret service SBU.

Picture1
We know by now the cables shown in the picture do not exist and cannot have existed.

The following chain of possible events can explain why it was necessary to produce the picture with the fake cables in the first place:

– After publishing picture2 huge criticism on social media appeared the weather as shown in the picture differs too much from the real weather situation south of Snizhne shortly after the crash.
– Anticipating tough questions soon to be asked by official investigators it was decided to produce another picture that would make picture2 more credible.
– Picture1 is carefully Photoshopped. Nice clouds. The white contrail is positioned slightly more left compared to the one in picture2. Exactly what is to be expected due to the wind. An overlay of picture1 & 2 looks like this:

– It all matches, or not? There is one problem for the cheater(s). They had many days to doctor picture1 but it remains hard to pixel by pixel insert a white trail into an image without making the fraud detectable.
– Solution: in the final stage of the production the image was blurred to make signs of manipulation undetectable. To make the blurring ‘credible’ the cables were inserted. Aleynikov’s camera supposedly autofocused on the (non-existing) cables.

Final thoughts

Propaganda is only effective when disseminated by sources that have credibility in the eyes of the information consumer. Secret services know this
all too well and therefore target professional journalists and news channels with carefully crafted fake stories, spins and other forms of disinformation. This targeting of journalists and media can be done directly and indirectly.
To increase the chances of success ‘open sources’ and ‘social media’ are used as intermediates to influence opinion makers and gatekeepers.

Propaganda depends on framing the issue first. No one reads corrections once a false story is disseminated.