JIT presentation of first results of the MH17 criminal investigation (28-09-2016)

Today, the Joint Investigation Team (JIT) presents the first results of the criminal investigation into the downing of flight MH17 on 17 July 2014. In the JIT Australia, Belgium, Malaysia, the Netherlands and Ukraine are working together.

Extensive and complex investigation

This is an extensive and complex investigation. To illustrate this, I herewith you some figures that may demonstrate the scope of the investigation:

For quite some time, between 100 and 200 investigators and other experts of the JIT have been working on the case and currently, on a daily basis almost 100 investigators, public prosecutors and other experts are still working on the case.

During the past two years, dozens of containers with thousands of wreckage parts were examined in detail, piece by piece. Of those parts, 1448 were processed in a databank as being relevant to the investigation.

Sixty requests for legal assistance were sent to more than twenty countries and we received reactions on many of them.

Twenty weapon systems were examined.

Five billion internet pages were recorded and assessed for their relevant content.

Half a million videos and photographs were examined in detail and saved, and more than two hundred witnesses were heard.

In addition, approximately 150.000 intercepted telephone calls were listened in on, summarised and assessed for their relevance and authenticity. After this, more than 3500 intercepted conversations were processed entirely, translated and analysed. All this was recorded in more than 6000 official reports.

Earlier, the Dutch Safety Board (OVV) presented their investigation results. And furthermore, many journalists carried out their own investigations, as did research collectives like Bellingcat. This resulted in different scenarios and theories being raised, both in the media and on the internet.

The criminal investigation focusses on truth finding and its ultimate goal is tracing and prosecuting the perpetrators. The big difference with a journalistic documentary or an internet-based investigation report is that in our case conclusions based on probability will not suffice. The most important in the JIT investigation is that we can substantiate our conclusions with legal and convincing evidence. In doing so the bar is high: the evidence must stand before a court. We are confident that the evidence which we have collected removes any kind of doubt about the cause of the crash. Of course, ultimately it will be up to the court to render a final judgment.

In the meantime we have collected so much evidence that we – as announced earlier – can answer the question as to which weapon was used and, even more important, where this weapon was launched exactly. The investigation into those responsible is a matter for the long haul and will take more time.

Normally we exercise restraint when it comes to disclosing interim findings in ongoing investigations; we only present our investigation results in the court room. But this case has such a profound impact worldwide that we have looked at possibilities to present the results of the criminal investigation at an earlier stage. We cannot and do not want to tell you everything yet; in that case we would run the risk of playing into the perpetrators’ hands. Also, we will not show all our evidence. We have made a selection that is meant to illustrate how we reached our conclusions.

First, we will discuss the different scenarios which have been investigated and how we reached our conclusions with respect to these scenarios.

After that, we will discuss the results from the investigation with regard to the weapon and the launch site.

At the end, we will briefly discuss the further investigation into the perpetrators.

The presentation will provide information about the progress in the investigation. We also want to explain that in the meantime we have gathered sufficient evidence to build a criminal case which will demonstrate the cause of the crash without any doubt.

The investigation into different scenarios

The JIT has carried out the investigation as broadly as possible and has investigated different scenarios. Although early in the investigation one scenario seemed the most likely one, it was important to keep investigating the other possibilities carefully. After all, it had to be an unprejudiced and impartial investigation. In future court proceedings those other scenarios may possibly play a role as well, because they might be presented by the defendants and their lawyers as alternative possibilities. In that case the Prosecution will have to be able to demonstrate that they did not take place.

Two scenarios could be ruled out quickly, as already mentioned previously. This concerned the possibility of an accident caused by technical or human failure, and the possibility of a terrorist attack from inside the aircraft. We have investigated both scenarios and there were no indications for these scenarios. The OVV had already drawn this conclusion on 13 October of last year.

Then, two scenarios remained:

First, the possibility that flight MH17 had been shot down by another airplane equipped with a weapon system. This is the air-to-air scenario.

In the investigation so far, we have come to the conclusion that we can also rule out the air-to-air scenario.

What follows is the explanation about how we reached that conclusion.

If flight MH17 would have been shot down by another airplane, this plane would have been shown on the radar images. There has been quite some discussion about the radar data. The JIT has acquired sufficient and crucial radar images. These images were made available to the JIT by both Ukraine and the Russian Federation. Recently, through intensive investigation, the JIT found another video file containing relevant primary radar data of the area which had been recorded by a mobile radar in Ukraine. At the time, this radar was used to test new software. Although it had a limited range, it still detected flight MH17 and this completes the image further.

As far as we are concerned, the discussion about the radar images can be concluded. Today we wish to emphasize that the material that we now have is more than sufficient to draw conclusions in the criminal investigation. For building up a solid criminal file, it will not be necessary to gather more evidentiary material.

In addition to the radar images that we have, witnesses have been heard, such as the air traffic controllers who were working at that time; the JIT has an audio file of the conversations between the Ukrainian air traffic controllers and the airplanes that passed through the Ukrainian airspace on 17 July 2014, including flight MH17.

All these data together provide a sufficiently complete picture of the air traffic in the direct vicinity of flight MH17 and based on this picture the JIT concludes that there was no other aircraft flying in the vicinity of flight MH17 that could have shot it down. This conclusion in itself can already rule out that scenario.

The Russian Federation mentioned last week that they have found ‘new’ primary radar images. Based on those images even the Russian Federation concludes that there was no second airplane that could have shot down MH17.

Moreover, there is much other evidence that contributes to the evidence of the final scenario, being: Flight MH17 was shot down by a ground based air defence system.

On the basis of a large amount of evidence we can conclude that this is indeed the scenario which took place.

The results of the criminal investigation with regard to the weapon used and the location from where this weapon was fired will be illustrated with the aid of three videos in which we show a selection of our evidentiary material. For a part real images will be shown, for another part there will be animated images, i.e. images created by us. In this respect, two remarks. In some of the intercepted telephone conversations, names of certain persons are mentioned. This does not mean that these persons are automatically suspects. The other remark concerns the spelling of place-names in Eastern Ukraine. Some place-names are spelled differently, which is partly due to the differences in Ukrainian and Russian.


In the explanation of the situation in Eastern Ukraine in July 2014, the word ‘separatists’ is used regularly. The JIT believes it is important to explain that the term separatists refers to any person, regardless of his nationality or citizenship, who is fighting against the Ukrainian government troops in Eastern Ukraine.

In July 2014, heavy fighting was going on in the area southeast of Donetsk. The pro-Russian fighters were engaged in an offensive to force a passage to the border with the Russian Federation south of the conflict zone. During these fights, the Ukrainian army carried out many air strikes in order to stop this offensive. The pro-Russian fighters suffered greatly: there were many losses, both human and material. Intercepted telephone conversations show that during the days prior to 17 July, the pro-Russian fighters mentioned that they needed better air defence systems to defend themselves against these air strikes. In this respect, a BUK was discussed explicitly. Fact is that a BUK has a higher range than the air defence systems in use by the separatists at that moment, such as the Strela and Igla.

This can be illustrated with several intercepted conversations between two Russian speaking persons, who are fighting on the side of the pro-Russian fighters. These conversations are relevant to the investigation and took place in the evening of 16 July and the early morning of 17 July 2014.

The above shows that the pro-Russian fighters were in great need of a BUK air defence system and that it was actually delivered.


Based on the results of the criminal investigation it can be concluded that flight MH17 was shot down on 17 July 2014 by a missile of the 9M38 series, launched by a BUK TELAR. This is consistent with the conclusions drawn by the OVV of 13 October 2015. The BUK TELAR was brought in from the territory of the Russian Federation and subsequently also taken back to the Russian Federation.

In the animation it was explained how the weapon works. This is important to know in the criminal investigation and also to determine the question of guilt.

Forensic investigation

In the investigation we have made extensive use of forensic research. Partly thanks to this research, we have been able to establish that flight MH17 was shot down by a missile from the 9M38 series.

In the next animation it is explained how the forensic investigation has contributed to this conclusion.

In addition to the forensic investigation, so-called Arena tests were performed. This means that a group of forensic experts from the JIT countries detonated a warhead and a complete missile in a prepared test environment. In this test environment aluminium panels, simulating an aircraft wall, were placed around the warhead and the missile. Surrounding the test area measuring equipment including high-speed cameras had been installed.

During these arena tests several measurements were carried out, such as the velocity of the fragments from the warhead after detonation. Also, the damage pattern became visible by the perforations of flying fragments from the warhead and the missile in aforementioned aluminium panels. The results of these tests were compared with other investigation data, including the different metal parts which were found during the forensic investigation. The main purpose of these tests was calculating the trajectory of the missile and comparing the nature of the damage with the traces found at the crash site.

The route and launch site

The BUK TELAR that was used was brought into Eastern Ukraine from the territory of the Russian Federation. The investigation team has been able to make an accurate reconstruction of a large part of the route which was followed by the BUK TELAR and accompanying vehicles. Initially, we did this mainly based on intercepted telephone conversations and videos and photographs on the social media. Following the call for witnesses last year, several witnesses replied and were interviewed by the JIT. They also stated that they had seen the BUK TELAR driving by.

The JIT investigated several possible launch locations, including two locations in the vicinity of the town of Zaroschenke or Zaroshchenskoye. Among other locations, this area was indicated by the Russian Ministry of Defence as being the launch site. It was also mentioned that this area was allegedly controlled by Ukraine. However, the investigation showed that this was not the launch location. And besides this, it appeared that this area was not being controlled by Ukraine, but by pro-Russian fighters. To illustrate this there is the following intercepted telephone conversation between two pro-Russian fighters.

This conversation took place in June 2015 and is about the information that apparently was distributed at that time, saying that the Boeing (flight MH17) was allegedly shot down from the city of Zaroshchenskoye (or: Zaroschenke) by an air defence system. One of the participants in that conversation knows for sure that Zaroshchenske was not the launch site and that, at the time, Zaroshchenske was not controlled by the pro-Russian fighters. The JIT also has other evidence in support of these conclusions.

This conversation took place in June 2015 and is about the information that apparently was distributed at that time, saying that the Boeing (flight MH17) was allegedly shot down from the city of Zaroshchenskoye (or: Zaroschenke) by an air defence system. One of the participants in that conversation knows for sure that Zaroshchenske was not the launch site and that, at the time, Zaroshchenske was not controlled by the pro-Russian fighters. The JIT also has other evidence in support of these conclusions.

In order to establish the exact location of the launch site, the JIT conducted different kinds of investigations. These investigative activities were carried out Ukraine, Belgium, Australia and the Netherlands and involved forensic, tactical and digital investigations. Among other activities, a team of specialists visited the disaster area in June 2015. Ground samples were taken at different locations that were regarded as possible launch sites. These samples were examined in detail by the Dutch Forensic Institute (NFI). Network measurements were also carried out on the spot in order to determine the locations, as well as the range of the telephone towers. Furthermore, all kinds of visual material was evaluated and checked for authenticity. Witnesses were interviewed as well, among others by a Dutch Investigating Judge.

During the past two years, the investigation team collected a large quantity of evidentiary material about the launch site. Our conclusion is that the location of the launch site is an agricultural field near Pervomaiskiy. It concerns a field of approximately 500 x 600 metres. This is the highest spot in the area within a radius of 5 kilometres. The farmland is surrounded by trees, except for the western side. Previously the OVV had already concluded that the missile must have been launched from an area of 320 square kilometres south east of Grabovo. The farmland near Pervomaiskiy is located in this area.

This conclusion is supported by the material which the investigation team recently obtained from the United States and the European Space Agency. I will explain this briefly.

In response to a Dutch request for legal assistance, the US submitted a report in which they present their assessment of the information regarding the shooting down of flight MH17. This report can be used in court. The conclusion of the American authorities is that flight MH17 was shot down by an SA-11 surface-to-air missile, i.e. a BUK-missile, which was launched from a site about six kilometres south of the village of Snizhne in Eastern Ukraine. This is consistent with the distance to aforementioned launch site near Pervomaiskiy. The US also explain how they reached this conclusion. In addition, they mention that they are sure of the fact that the Ukrainian air defence systems could not have done it and that an air-to-air scenario is impossible.

The Dutch Military Intelligence Service (MIVD) and the (Dutch) National Public Prosecutor on Terrorism have been able to view the underlying state-secret (intelligence) material and based on that information and the explanation provided, they support the fact that this conclusion is drawn.

The European Space Agency (ESA) has aided the investigation team extensively in the search for relevant images from satellites. This has shown to be of great value: Not only did ESA obtain images of all relevant civilian satellites, but they also have experts who have assessed these images. The conclusions drawn by ESA confirm the conclusions of the investigation team with regard to the launch site.

In the following animation we will show a selection from our investigation results.


Based on the above the JIT concludes that flight MH17 was shot down on 17 July 2014 by a missile of the 9M38 series, launched by a BUK TELAR, from farmland in the vicinity of Pervomaiskiy (or: Pervomaiskyi). At that time, the area was controlled by pro-Russian fighters. Furthermore, the investigation also shows that the BUK TELAR was brought in from the territory of the Russian Federation and subsequently, after having shot down flight MH17, was taken back to the Russian Federation.

Those involved

So much for our conclusions regarding what happened. Probably not everything of this, is new. But what matters today is that the criminal investigation has now advanced to the point where we can substantiate abovementioned conclusions with evidence. Of course, at the end of the day it is up to a court to render judgment.

What remains is the answer to the question: who were responsible for this? Which persons were involved in the delivery, security and removal of the BUK TELAR and/or the shooting down flight MH17? In this part of the investigation significant progress has been made during the past two years, but more investigation is needed. Now that we know for sure what happened to flight MH17, in the coming period the investigation can fully focus on the answers to these kinds of questions.

Although today we have not been able to provide investigation results regarding the perpetrators, we can say that in the meantime, we have identified approximately 100 persons who in one way or the other can be linked to the crash of flight MH17 or the transport of the BUK. We have been able to establish the identity of these 100 persons, whom we found through different sources such as intercepted telephone conversations and witness statements. This concerns people who have played an active role in getting hold of the BUK TELAR and organising the transport to the launch location. There are also persons who had a facilitating or supporting role. This group includes the people who escorted the transport of the BUK TELAR.

These persons are not automatically suspects. To assess whether persons who were involved acted culpably, and can therefore be regarded as suspects, it is important to get a better picture of the chain of command with regard to the use of the weapon. Who gave the orders for the delivery of the BUK TELAR? Who gave the order to shoot down MH17? Did the crew take their own decision or did they execute a command from higher up? What did the persons who were involved in this operation know? All these kinds of circumstances play a role when answering the question whether someone should be regarded as a witness or as a suspect.

It is important to the JIT to gain more insight into the role of the different parties involved, which is also the reason why today, we once more call witnesses to report to us. In particular we invite insider witnesses, who can tell us more about the role that different persons have played, to report to the JIT.

Ukrainian law provides for lower sentences, and in certain circumstances relief from criminal liability, for those who cooperate with the investigation. Information about how to report as a witness can be found on the website of the JIT

Furthermore, this afternoon we will post a number of intercepted telephone conversations on the website of the JIT, requesting information about certain participants in those conversations. Anyone who knows who these persons are, is requested to report this to the JIT.

Finally, the question as to how long will it take to conclude the criminal investigation cannot be answered yet. It depends on further developments in the investigation and the witnesses we can still hear. After today, this investigation will continue unabated.

In view thereof, the JIT agreement that was to expire next month, was extended. We will continue as a Joint Investigation Team to see this important investigation to a good end.

N.B. The animations have been included for illustrative purposes only. They are not intended to be an exact rendering of the results of the investigation. This is due, in part, to considerations regarding confidentiality of witness identities and investigative methods.