How Technology Is Unraveling the Clues of Flight MH17

A look at the technology helping piece together what happened to Flight MH17 in Ukraine.

A man looks at the wreckage of passenger plane Malaysia Airlines flight MH17 on July 18, 2014 in Grabovka, Ukraine.
National Journal
Patrick Tucker, Defense One
Add to Briefcase
See more stories about...
Patrick Tucker, Defense One
July 22, 2014, 8:13 a.m.

Over the week­end, the Malay­sia Air­lines Flight MH17 tragedy turned in­to a “Law and Or­der” epis­ode on the in­ter­na­tion­al stage with Sec­ret­ary of State John Kerry ap­pear­ing on Fox News and oth­er out­lets to make a sys­tem­ic case against Rus­sia, prompt­ing Fox News in­ter­view­er Chris Wal­lace to ob­serve that Kerry was once “a pro­sec­utor in Mas­sachu­setts.”

So what does Kerry’s case con­sist of? The U.S. is con­fid­ent that the murder weapon was an SA-11 Gad­fly 9K37M1Buk -1M fired mis­sile. A dis­patch from the U.S. Em­bassy in Ukraine in­dic­ates that the rock­et launch­er was giv­en to pro-Rus­si­an sep­ar­at­ists by Mo­scow. At this point, no one is say­ing that the sep­ar­at­ists in­ten­ded to down a pas­sen­ger jet. Evid­ence (see be­low) sug­gests that rebel forces be­lieved the plane was a Ukrain­i­an mil­it­ary trans­port vehicle, since the Buk radar guid­ance sys­tem provides very, very little in­form­a­tion about the type of tar­get it’s point­ing at. Pro-Rus­si­an con­spir­acy mon­gers, mean­while, are look­ing to plant blame for the in­cid­ent on Ukraine, claim­ing that the down­ing of the plane was a de­lib­er­ate act of the Ukrain­i­an gov­ern­ment.

The en­tire fu­ture of the Ukrain­i­an con­flict could change dra­mat­ic­ally and de­cis­ively as a res­ult of last week’s events. The United States may fi­nally have the jus­ti­fic­a­tion to be­gin bet­ter arm­ing the Ukrain­i­ans, which would es­cal­ate the con­flict. So far the Pentagon has only provided non-leth­al as­sist­ance. But Kerry said the U.S. is talk­ing with the Kiev about “what they need,” and that could in­clude “any­thing ex­cept Amer­ic­an troops”

The U.S. will also look to con­vince European part­ners to im­pose tough­er sanc­tions on Rus­sia. “Four per­cent of Rus­sia’s trade is with the United States; 50 per­cent of their en­gage­ment is with Europe,” Kerry told Fox News. If the U.S. can present a case to show that Rus­sia gave the Ukrain­i­ans the arms and the train­ing to down an air­liner car­ry­ing mostly Dutch cit­izens, European part­ners may side with the U.S. in a tough­er sanc­tions re­gime.

The ar­gu­ment against Rus­sia must be in­cred­ibly per­suas­ive. Here’s a look at the forensic tech­no­lo­gies that will make the case.

In­frared Satel­lite Im­agery

“We know with a cer­tainty that we saw the launch from this area”¦we know that it oc­curred at this very mo­ment that this air­craft dis­ap­peared from the radar screen” said Kerry on Sunday.

The most im­port­ant ele­ment in in­stilling sim­il­ar cer­tainty among European part­ners will prob­ably be in­frared satel­lite im­agery. The Na­tion­al Re­con­nais­sance Of­fice, or NRO, and the Air Force Space Com­mand op­er­ate a num­ber of in­frared satel­lites, such as the Space Based In­frared Sys­tem (SBIRS). There are cur­rently two SBIRS satel­lites in or­bit but there will be six by 2022, with Lock­heed Mar­tin as de­veloper, un­der con­trol of Air Force Space Com­mand.

The NRO couldn’t com­ment on the use of in­frared satel­lites in the MH17 case, ex­cept to tell De­fense One that “facts about the NRO con­stel­la­tion, in­clud­ing cap­ab­il­it­ies and past and present op­er­a­tions are clas­si­fied.” But the U.S.has un­der­stood the im­port­ance of in­frared satel­lite im­agery for re­con­nais­sance since the 1950s when we de­veloped these sys­tems for very much the same reas­on we are us­ing them today, to track rock­et launches from ma­chines like the SA-11. For a great primer, read Sean Galla­gh­er’s piece here.

Satel­lite im­ages provide a lit­er­al smoking-gun por­trait of the events sur­round­ing the downed plane. But the U.S. has burned its fin­gers on smoking gun satel­lite im­ages be­fore. Oth­er pieces of evid­ence will likely play a role as the U.S. builds its case.

Chem­ic­al Sig­na­tures on Air­plane Parts

To prove that its the­ory of the events is true, the U.S. needs data from in­vest­ig­at­ors on the ground in Ukraine from the Or­gan­iz­a­tion for Se­cur­ity and Co-op­er­a­tion in Europe, OSCE. They, in turn, need ac­cess to the debris at the crash site to col­lect samples from evid­ence. That’s proven to be a thorny is­sue, as evid­enced by news re­ports that the con­trolling sep­ar­at­ist forces in Don­etsk are ob­stin­ate, threat­en­ing, com­monly in­tox­ic­ated and have blocked both me­dia and in­vest­ig­at­ors.

Kerry said that OSCE mon­it­ors were giv­en just three hours to ac­cess the scene on Sat­urday — and the site is already com­prom­ised. “We un­der­stand air­plane parts have been re­moved,” Kerry said.

If the Obama ad­min­is­tra­tion is cor­rect, what will the ground evid­ence show? The dis­tri­bu­tion of debris, once fully cata­logued, would con­firm a vi­ol­ent sud­den ex­plo­sion, as op­posed to a long trail of parts in­dic­at­ing a slow break­ing apart and would in­clude mis­sile shrapnel. It would also show that the radar-guided mis­sile likely ex­ploded with­in about 65 feet from the tar­get. In­frared ima­ging might show ex­plos­ive residue some­what evenly dis­trib­uted on the bot­tom of the plane. Con­versely, an ex­cess­ive amount of ex­plos­ive residue on the en­gines could in­dic­ate that the mis­sile was heat seek­ing and not shot from an SA-11 and that the U.S.was wrong.

The Black Boxes

The Boe­ing 777, like all com­mer­cial air­craft, has two com­pon­ents re­cord­ing in­f­light data. There’s a cock­pit voice re­cord­er in the front and a flight data re­cord­er in the tail of the plane, which re­cords in­form­a­tion from the vari­ous sensors and oth­er in­dic­at­ors throughout the craft. Data from these two sources is col­lec­ted in the crash sur­viv­able memory unit orC­SMU, which have been built to with­stand the heat, wa­ter, and the phys­ic­al ef­fects of a ma­jor crash.

Con­tro­versy has sur­roun­ded the con­di­tion these boxes at theM­H17 crash site, with con­flict­ing re­ports in­dic­at­ing that they were to be sent to Mo­scow. At last check, the Don­etsk rebels and Malay­si­an rep­res­ent­at­ives had brokered a deal to ex­change the boxes. Hours earli­er on Monday morn­ing, the spec­u­la­tion over their con­di­tion reached a fever pitch when the New York Post ran a scream­ing head­line de­clar­ing a “rebel plot” to steal the re­cord­ers. Cer­tainly they were in rebel hands for at least sev­er­al hours.

How hard is it to hack a black box? Ac­cord­ing to tech­nic­al ex­perts fa­mil­i­ar with their design who spoke to De­fense One, the an­swer is not very. Mod­ern-day flight data re­cord­ers use sol­id state drives, SSDs, to store in­form­a­tion. Un­like the hard drive in most PCs, SSDs con­sist of a bunch of memory flash drives stacked on top of one an­oth­er. They store memory with no mov­ing parts so they are con­sidered far more rugged than con­ven­tion­al hard drives. This is why en­gin­eers began us­ing them on planes.

Iron­ic­ally, SSDs may ac­tu­ally be more hack­able than the con­ven­tion­al hard drives they re­placed. When you over­write a file on an SSD, you don’t leave the same clear re­cord that you do when you de­lete a file on your com­puter. In fact, some mem­bers of the com­puter forensics com­munity have soun­ded the alarm about the grow­ing pop­ular­ity of SSDs and the trouble they could cause in terms of evid­ence dis­cov­ery and re­ten­tion in the fu­ture. Graeme Bell and Richard Bod­ding­ton of the Uni­versity of Mur­doch in Aus­tralia even went so far as to opine that “it seems pos­sible that the golden age for forensic re­cov­ery and ana­lys­is of de­leted data and de­leted metadata may now be end­ing” be­cause of SSDs.

In the case of MH17, the boxes aren’t likely to provide much new in­form­a­tion. Forensics teams use them to de­term­ine the mech­an­ic­al or hu­man cause of a crash. But re­cov­er­ing the boxes could be use­ful in this case to cat­egor­ic­ally rule out pi­lot er­ror or mech­an­ic­al mal­func­tion. If the data on the boxes does in fact sug­gest that something else happened to the plane, that de­vel­op­ment would no doubt fuel the con­spir­acy the­or­ies that have already taken route across the In­ter­net, which could play to Rus­sia’s ad­vant­age.

The Eye­wit­ness Testi­mony

In the case of MH17, the world already knows who the most im­port­ant wit­nesses are, mem­bers of the sep­ar­at­ist army who quickly took to so­cial me­dia to brag about shoot­ing down a plane they be­lieved was a Ukrain­i­an cargo jet. Of par­tic­u­lar sig­ni­fic­ance is a post from former Rus­si­an mil­it­ary of­ficer Ig­or Strelkov, the self-de­clared Min­is­ter of De­fense of the Don­etsk People’s Re­pub­lic. It ap­peared on VK.Com, Rus­sia’s ver­sion of Face­book, and re­portedly boas­ted that his troops had scored a hit, stat­ing “we warned you — do not fly in our sky.”

The prob­lem is that the wit­nesses are re­cant­ing. Strelkov (or someone) re­moved the post in short or­der. Sim­il­arly, as Agence France Press re­ports, pro-sep­ar­at­ist forces began tak­ing down in­crim­in­at­ing tweets and posts shortly after they ap­peared. In one par­tic­u­larly re­veal­ing ex­change, the Don­etsk Re­pub­lic Twit­ter feed, @dnr­press, ac­know­ledged that “self-pro­pelled Buk sur­face-to-air mis­sile sys­tems have been seized by theD­NR from (Ukrain­i­an) sur­face-to-air mis­sile re­gi­ment A1402,” ac­cord­ing to AFP.

In many ways, that may be the most im­port­ant tweet in the en­tire con­flict, since it now pur­ports to show not only that not only did the sep­ar­at­ists have the means to carry out the at­tack, but that they did not ac­quire the mis­sile launch­er from Rus­sia, as the U.S. be­lieves. Should Rus­sia de­cide to put more dis­tance between Mo­scow and the sep­ar­at­ists, it may use that ar­gu­ment. It’s un­clear how the so­cial me­dia posts, in total, will af­fect the U.S. case.

The good news for in­vest­ig­at­ors is that items on the In­ter­net tend to stay on the In­ter­net, es­pe­cially if they are in­ter­est­ing. Mul­tiple screen grabs caught the posts be­fore they van­ished, each one cor­rob­or­at­ing the oth­er.

All of this evid­ence tells the story of a unique mo­ment in his­tory.

In one swift com­mand ex­e­cu­tion, one man, sit­ting be­hind an old radar screen and armed with a 1,500 pound rock­et, caused the deaths of al­most 300 people, af­fected Putin’s re­la­tion­ship with the sep­ar­at­ists as well as Rus­sia’s with Europe and pos­sibly changed the dir­ec­tion of the con­flict — and his­tory. If the last sev­er­al days provide any in­dic­a­tion of what lies ahead, there will be deni­al, ac­cus­a­tion and overt ly­ing to come. We may nev­er really know what happened to MH17, but we can still get much closer to truth.

What We're Following See More »
Nuclear Bombers Preparing to Go Back on 24-Hour Alert
40 minutes ago

"The U.S. Air Force is preparing to put nuclear-armed bombers back on 24-hour ready alert, a status not seen since the Cold War ended in 1991...Putting the B-52s back on alert is just one of many decisions facing the Air Force as the U.S. military responds to a changing geopolitical environment that includes North Korea’s rapidly advancing nuclear arsenal, President Trump’s confrontational approach to Pyongyang, and Russia’s increasingly potent and active armed forces."

Senate Intel Postpones Testimony by Cohen
2 days ago
Senate Rejects Effort to Nix SALT Tax Changes
3 days ago

"Senate Democrats on Thursday failed in their first attempt to save the state and local tax deduction, which helps many residents of California and other high-cost states reduce their federal income tax bills. The Republican-controlled Senate voted 52-47 to reject an amendment that would have prevented the Senate from considering any bill that repeals or limits the deduction as part of a planned tax overhaul."

Lewandowski Meets with Senate Intelligence Committee
3 days ago

"President Donald Trump's former campaign manager Corey Lewandowski appeared on Capitol Hill for a closed-door interview with the Senate intelligence committee Wednesday, according to a source familiar with the matter. Lewandowski is the latest senior official in Trump's orbit who has met with the committee as part of its investigation into Russian election meddling and possible collusion with the Trump campaign."

Some Members Seek to Wrap Up Russia Investigations by Year’s End
4 days ago

"A growing number of key Republicans are sending this message to the leaders of the congressional committees investigating potential Trump campaign collusion with the Russians: Wrap it up soon. In the House and Senate, several Republicans who sit on key committees are starting to grumble that the investigations have spanned the better part of the past nine months, contending that the Democratic push to extend the investigation well into next year could amount to a fishing expedition."


Welcome to National Journal!

You are currently accessing National Journal from IP access. Please login to access this feature. If you have any questions, please contact your Dedicated Advisor.