MH17: How Open-Source Investigators Traced the Buk Launcher - Example Timeline | Boromlia
The MH17 investigation step by step: how Bellingcat open source geolocation traced the Buk launcher from Kursk to a field in eastern Ukraine, what the Joint Investigation Team proved, and how the Dutch court, ICAO and the European Court of Human Rights ruled.
The Decision the JIT Traced to a Week in June
In the report it published on 8 February 2023, the Joint Investigation Team said intercepted calls from June 2014 showed separatist commanders in eastern Ukraine asking Russian officials for heavier air defence, and being told the request could only be granted by one person. The JIT said the decision was postponed for about a week because that person was at a summit in France, which the team placed as the D-Day commemorations of 5 and 6 June 2014. The JIT stated there were strong indications that President Putin decided on supplying a Buk system, and that the evidence was not concrete enough to charge anyone with it.
Six Buk Systems Roll Out of Kursk
The Joint Investigation Team reconstructed the movement of a convoy of the 53rd Anti-Aircraft Missile Brigade, a Russian army unit based at Kursk, on 23, 24 and 25 June 2014. Reporting of the JIT presentation describes six Buk systems in that convoy. The vehicles were filmed repeatedly by people who had no idea what they were recording, on dashcams and phones held out of car windows, and the clips were posted to Russian social networks with the town name typed into the caption. Those captions later gave investigators a rough date and place for each vehicle, which was the starting point for everything that followed.
The Convoy Stops 25 Kilometres From the Border
The convoy of the 53rd Brigade ended its journey at Millerovo in Rostov Oblast, roughly 25 kilometres from the Ukrainian border, on 25 June 2014. Russia has never told the JIT that a Buk of the 53rd Brigade was in eastern Ukraine. The Dutch prosecution service noted that it had asked the Russian authorities on 15 October 2014, under UN Security Council resolution 2166, for all information relevant to establishing the truth. Millerovo is on this map because of what strangers filmed there, not because any official ever confirmed it.
The Aircraft Comes Down Near Hrabove
The aircraft broke up over eastern Ukraine and the wreckage fell near Hrabove in Donetsk Oblast. Everyone on board was killed. The Dutch Safety Board concluded in October 2015 that a warhead of the 9N314M type, carried on a missile of the 9M38 series fired by a Buk system, detonated outside the aircraft to the left of the cockpit. The Joint Investigation Team reached the same conclusion about the weapon. Russia has disputed the warhead identification. The board investigated a technical failure and a bomb on board, and ruled both out.
Flight MH17 Leaves Amsterdam at 12:31
Malaysia Airlines flight MH17, a Boeing 777-200ER registered 9M-MRD, left Amsterdam Schiphol at 12:31 local time, 10:31 UTC, bound for Kuala Lumpur. There were 298 people on board: 283 passengers and 15 crew, of whom four were pilots and eleven were cabin crew. Most of the passengers were Dutch, and the Dutch government later put the number of Dutch nationals killed at 196. The route ran east into Ukrainian airspace. The last verbal communication from the aircraft was received at 13:20 UTC.
A Deleted YouTube Video, Geolocated the Same Night
Hours after the crash a video appeared claiming to show a Buk launcher on a road in Snizhne. Eliot Higgins downloaded it before it was deleted from YouTube, then worked out where it was filmed. He matched a dual carriageway with trees down the central reservation and a slight bend, three trees north of that bend, two junctions with a single tree between them, and a red roof, all of it visible on satellite imagery south of the centre of Snizhne. The camera sat higher than the buildings opposite, which placed it in an apartment block on the north side. He published the geolocation at 21:37 UTC on 17 July 2014.
Moscow Presents a Second Aircraft
The Russian Ministry of Defence held a briefing in Moscow four days after the crash. It presented a graphic stating that Russian air traffic control had detected a Ukrainian Air Force aircraft, described as an Su-25, climbing towards the Boeing, together with satellite images said to show Ukrainian Buk launchers in the area. Both claims were later contradicted. At a subsequent presentation the ministry no longer referred to a second aircraft, and in September 2016 the Joint Investigation Team said radar data supplied by Russia itself showed no other aircraft in the vicinity.
Five Countries Form a Joint Investigation Team
A Joint Investigation Team was set up on 7 August 2014, bringing together police and judicial authorities of the Netherlands, Australia, Belgium and Ukraine, with Malaysia joining later. Ukraine was itself a party to the armed conflict, so the members agreed the investigation would be run jointly and that every finding would be validated by the other countries. Dutch and Australian officers worked on Ukrainian territory from a field office that stayed open until February 2022. For long stretches between 100 and 200 investigators and experts were on the case.
Twelve Dashcam Clips, Placed on the Map
Veli-Pekka Kivimaki published geolocations for twelve videos of a Buk convoy moving through Russia in July 2014, most of them around Stary Oskol. He matched light rail power line poles, roadside buildings and in one case the view in a rear-view mirror against Street View, and listed a coordinate for each clip. One video carried no location at all, so he used the vehicle shadows and a solar calculator to work out which way the road ran, then searched road shapes along the likely route until one matched, at Olkhovatka. Another clip was captioned 30 July, but its tarpaulin-covered trailers matched a 19 July video vehicle for vehicle, so the caption was set aside.
The Satellite Images That Were Two Weeks Old
Bellingcat published a forensic analysis of the satellite images the Russian Ministry of Defence had shown in July 2014. The report concluded that pictures presented as taken on 14 and 17 July were in fact older imagery from June, that a launcher had been removed from one image, and that launchers had been added to another so that they appeared to be within range of the flight. Russia rejected the analysis. The Joint Investigation Team ran its own independent investigation, saying its conclusions had to rest on evidence that would stand up in a courtroom.
Russia Vetoes an International Tribunal
Malaysia put a draft resolution to the United Nations Security Council to establish an international criminal tribunal for the downing of MH17, signed also on behalf of Australia, Belgium, the Netherlands and Ukraine. Russia vetoed it on 29 July 2015. Eleven members voted in favour and three abstained: China, Venezuela and Angola. President Putin had said a tribunal was premature while the Dutch Safety Board investigation was still running. The prosecution therefore went ahead under Dutch national law, which is why the case was eventually heard by a district court and not by an international tribunal.
A Cockpit Rebuilt in a Hangar at Gilze-Rijen
The Dutch Safety Board presented its final report at Gilze-Rijen air base after an inquiry of about fifteen months. Investigators had reassembled the nose, cockpit and business class section of the aircraft from wreckage recovered in eastern Ukraine, and the reconstruction was shown to the press riddled with fragment holes. The board concluded the aircraft was struck by a 9N314M warhead carried on a missile of the 9M38 series. It drew no conclusion about who fired it, because attributing responsibility is not the task of a safety board. That question belonged to the criminal investigation.
Five Billion Web Pages and 150,000 Phone Calls
When the Joint Investigation Team presented its first criminal findings it also published the arithmetic of two years of work. Investigators had recorded and assessed five billion internet pages, examined and stored half a million photographs and videos, heard more than two hundred witnesses, and gone through dozens of containers of wreckage piece by piece, of which 1,448 parts were logged as relevant. Around 150,000 intercepted telephone calls were listened to and summarised, and more than 3,500 of those were fully transcribed, translated and analysed. Twenty weapon systems were examined. Sixty requests for legal assistance went to more than twenty countries.
A Field Near Pervomaiskyi, 500 by 600 Metres
The team named the launch site as farmland near Pervomaiskyi, a plot of roughly 500 by 600 metres, the highest ground within five kilometres, ringed by trees except on its western side. Soil samples were taken at several candidate sites and examined by the Netherlands Forensic Institute, and network measurements were made on the ground to establish the range of local phone masts. The team also examined two possible sites near Zaroshchenske, the area the Russian Ministry of Defence had pointed to, and ruled them out, adding that this area had not been under Ukrainian control. A United States report put the launch about six kilometres south of Snizhne.
The Fingerprint of a Single Launcher
Dutch police told a press conference that the team had examined every available image of the launcher from 17 and 18 July 2014 and built what it called a fingerprint from the vehicle unique features, the individual marks and damage that distinguish one machine from another. Compared against footage of the June convoy, that fingerprint matched one launcher of the 53rd Anti-Aircraft Missile Brigade at Kursk and no other. Wilbert Paulissen said in the same statement that the investigation collective Bellingcat had reached the same conclusion earlier. Russia has not accepted the finding.
The Handwriting on the Venturi
At the same press conference the Australian Federal Police commander Jennifer Hurst showed two recovered parts of the missile: the venturi, which is the exhaust, and the casing of the motor. Both carried numbers, one of them handwritten. The team put the parts in front of the cameras and asked the public four questions, including whether anyone recognised the handwriting, what the numbers meant, and which unit that missile had been issued to. Four years into the case, the investigation was publicly asking for help reading a serial number.
Four Men Are Charged, and the Crew Is Not Among Them
The Netherlands Public Prosecution Service announced on 19 June 2019 that it would prosecute four men for causing the aircraft to crash and for the murder of the 298 people on board. Three were Russian citizens and one Ukrainian. Prosecutors said they held them jointly accountable for bringing the launcher into position rather than alleging that any of them fired it. Charging is not conviction. The crew who operated the launcher were never identified. The team had by then linked about a hundred people to the weapon or its transport, and said most of them were not automatically suspects.
The Trial Opens With an Empty Dock
The trial opened before the District Court of The Hague on 9 March 2020. None of the four accused appeared in person. In its opening statement the prosecution set out the charges and also explained why several other people who had been publicly linked to the downing were not being indicted, which put the reasoning behind those decisions on the court record. Proceedings ran for more than two and a half years, and included the court testing alternative scenarios advanced by the defence and by Russia, because the prosecution had to disprove them rather than simply assert its own account.
The Intercepted Call That Led Nowhere
On the day of the crash the Ukrainian security service released an intercepted telephone call and accused a separatist group operating around Horlivka of involvement. A second intercept, released a week later, was reported as having been recorded shortly before the aircraft was hit. Both circulated widely for years and shaped a great deal of coverage. In March 2020 prosecutors told the court why the commander concerned was not among the four indicted, and in October 2020 Bellingcat published a reanalysis concluding the evidence tying him to the downing was inconclusive, while finding no support for claims that the recordings had been faked or backdated. He was never charged.
Three Life Sentences and One Acquittal
The District Court of The Hague delivered judgment on 17 November 2022. It convicted Igor Girkin, Sergey Dubinskiy and Leonid Kharchenko of causing the aircraft to crash and of the murder of the 298 people on board, and sentenced each to life imprisonment. It acquitted the fourth defendant, Oleg Pulatov. The court said it had no doubt the aircraft was hit by a Buk missile fired from the farm field, citing photographs of the smoke trail, satellite images, intercepted calls, transmission mast data, video of the launcher being brought in and taken away, and fragments recovered from the wreckage and from a crew member. It also found that Russia had overall control of the forces in eastern Ukraine.
The Prosecution Decides Not to Appeal
On 1 December 2022 the Netherlands Public Prosecution Service announced that it would not appeal the judgment. That left the three life sentences and the one acquittal final. All four men had been tried in their absence and none of the convicted is in custody in the Netherlands, so no sentence has been served. The judgment is a criminal finding against three individuals rather than a finding of state responsibility, which is why the case carried on in other forums.
The Team Runs Out of Leads
On 8 February 2023 the Joint Investigation Team shared its findings with the relatives and published a report. It set out what it had established about the chain of command and about the June 2014 decision to supply the weapon, and stated that although a great deal of new information had been found, the evidence was not concrete enough to support new prosecutions. The investigation was suspended rather than closed, with a standing request for anyone with information to come forward. Nobody was ever identified as having crewed the launcher.
A First in Eighty Years at the ICAO Council
The Council of the International Civil Aviation Organization ruled on a claim brought by Australia and the Netherlands under Article 84 of the Chicago Convention, and found it well founded in fact and in law. Twenty-two members voted in favour, three against and ten abstained. It was the first time in the eighty year history of the Council that it had decided the merits of an Article 84 dispute. Unlike the Dutch judgment, this was a finding against the Russian state rather than against named individuals. Russia rejected the decision.
Strasbourg Rules on State Responsibility
The Grand Chamber of the European Court of Human Rights gave judgment in the inter-state cases brought by Ukraine and the Netherlands. In a ruling running to 497 pages it held Russia responsible for the downing of MH17 and for the deaths of everyone on board, and responsible as well for the additional suffering caused to relatives by its continued denial of involvement and its obstruction of the investigations. The court found the armed formations in Donetsk and Luhansk were so closely tied to Russia through military, economic and political support that they could be treated as its organs. Russia has consistently denied involvement.
Russia Appeals to the International Court of Justice
On 18 September 2025 Russia filed an application at the International Court of Justice appealing the ICAO Council decision, in a case against Australia and the Netherlands. The Russian Foreign Ministry said it contested the decision on all grounds, including jurisdiction, applicable law, factual findings and what it described as fatal procedural violations. Eleven years after the aircraft came down, the criminal judgment in the Netherlands is final, the findings of state responsibility are being challenged, and no one has been identified as having operated the launcher.