How Technology Is Unraveling the Clues of Flight MH17

A look at the technology helping piece together what happened to Flight MH17 in Ukraine.

A man looks at the wreckage of passenger plane Malaysia Airlines flight MH17 on July 18, 2014 in Grabovka, Ukraine.
National Journal
Patrick Tucker, Defense One
See more stories about...
Patrick Tucker, Defense One
July 22, 2014, 8:13 a.m.

Over the week­end, the Malay­sia Air­lines Flight MH17 tragedy turned in­to a “Law and Or­der” epis­ode on the in­ter­na­tion­al stage with Sec­ret­ary of State John Kerry ap­pear­ing on Fox News and oth­er out­lets to make a sys­tem­ic case against Rus­sia, prompt­ing Fox News in­ter­view­er Chris Wal­lace to ob­serve that Kerry was once “a pro­sec­utor in Mas­sachu­setts.”

So what does Kerry’s case con­sist of? The U.S. is con­fid­ent that the murder weapon was an SA-11 Gad­fly 9K37M1Buk -1M fired mis­sile. A dis­patch from the U.S. Em­bassy in Ukraine in­dic­ates that the rock­et launch­er was giv­en to pro-Rus­si­an sep­ar­at­ists by Mo­scow. At this point, no one is say­ing that the sep­ar­at­ists in­ten­ded to down a pas­sen­ger jet. Evid­ence (see be­low) sug­gests that rebel forces be­lieved the plane was a Ukrain­i­an mil­it­ary trans­port vehicle, since the Buk radar guid­ance sys­tem provides very, very little in­form­a­tion about the type of tar­get it’s point­ing at. Pro-Rus­si­an con­spir­acy mon­gers, mean­while, are look­ing to plant blame for the in­cid­ent on Ukraine, claim­ing that the down­ing of the plane was a de­lib­er­ate act of the Ukrain­i­an gov­ern­ment.

The en­tire fu­ture of the Ukrain­i­an con­flict could change dra­mat­ic­ally and de­cis­ively as a res­ult of last week’s events. The United States may fi­nally have the jus­ti­fic­a­tion to be­gin bet­ter arm­ing the Ukrain­i­ans, which would es­cal­ate the con­flict. So far the Pentagon has only provided non-leth­al as­sist­ance. But Kerry said the U.S. is talk­ing with the Kiev about “what they need,” and that could in­clude “any­thing ex­cept Amer­ic­an troops”

The U.S. will also look to con­vince European part­ners to im­pose tough­er sanc­tions on Rus­sia. “Four per­cent of Rus­sia’s trade is with the United States; 50 per­cent of their en­gage­ment is with Europe,” Kerry told Fox News. If the U.S. can present a case to show that Rus­sia gave the Ukrain­i­ans the arms and the train­ing to down an air­liner car­ry­ing mostly Dutch cit­izens, European part­ners may side with the U.S. in a tough­er sanc­tions re­gime.

The ar­gu­ment against Rus­sia must be in­cred­ibly per­suas­ive. Here’s a look at the forensic tech­no­lo­gies that will make the case.

In­frared Satel­lite Im­agery

“We know with a cer­tainty that we saw the launch from this area”¦we know that it oc­curred at this very mo­ment that this air­craft dis­ap­peared from the radar screen” said Kerry on Sunday.

The most im­port­ant ele­ment in in­stilling sim­il­ar cer­tainty among European part­ners will prob­ably be in­frared satel­lite im­agery. The Na­tion­al Re­con­nais­sance Of­fice, or NRO, and the Air Force Space Com­mand op­er­ate a num­ber of in­frared satel­lites, such as the Space Based In­frared Sys­tem (SBIRS). There are cur­rently two SBIRS satel­lites in or­bit but there will be six by 2022, with Lock­heed Mar­tin as de­veloper, un­der con­trol of Air Force Space Com­mand.

The NRO couldn’t com­ment on the use of in­frared satel­lites in the MH17 case, ex­cept to tell De­fense One that “facts about the NRO con­stel­la­tion, in­clud­ing cap­ab­il­it­ies and past and present op­er­a­tions are clas­si­fied.” But the U.S.has un­der­stood the im­port­ance of in­frared satel­lite im­agery for re­con­nais­sance since the 1950s when we de­veloped these sys­tems for very much the same reas­on we are us­ing them today, to track rock­et launches from ma­chines like the SA-11. For a great primer, read Sean Galla­gh­er’s piece here.

Satel­lite im­ages provide a lit­er­al smoking-gun por­trait of the events sur­round­ing the downed plane. But the U.S. has burned its fin­gers on smoking gun satel­lite im­ages be­fore. Oth­er pieces of evid­ence will likely play a role as the U.S. builds its case.

Chem­ic­al Sig­na­tures on Air­plane Parts

To prove that its the­ory of the events is true, the U.S. needs data from in­vest­ig­at­ors on the ground in Ukraine from the Or­gan­iz­a­tion for Se­cur­ity and Co-op­er­a­tion in Europe, OSCE. They, in turn, need ac­cess to the debris at the crash site to col­lect samples from evid­ence. That’s proven to be a thorny is­sue, as evid­enced by news re­ports that the con­trolling sep­ar­at­ist forces in Don­etsk are ob­stin­ate, threat­en­ing, com­monly in­tox­ic­ated and have blocked both me­dia and in­vest­ig­at­ors.

Kerry said that OSCE mon­it­ors were giv­en just three hours to ac­cess the scene on Sat­urday — and the site is already com­prom­ised. “We un­der­stand air­plane parts have been re­moved,” Kerry said.

If the Obama ad­min­is­tra­tion is cor­rect, what will the ground evid­ence show? The dis­tri­bu­tion of debris, once fully cata­logued, would con­firm a vi­ol­ent sud­den ex­plo­sion, as op­posed to a long trail of parts in­dic­at­ing a slow break­ing apart and would in­clude mis­sile shrapnel. It would also show that the radar-guided mis­sile likely ex­ploded with­in about 65 feet from the tar­get. In­frared ima­ging might show ex­plos­ive residue some­what evenly dis­trib­uted on the bot­tom of the plane. Con­versely, an ex­cess­ive amount of ex­plos­ive residue on the en­gines could in­dic­ate that the mis­sile was heat seek­ing and not shot from an SA-11 and that the U.S.was wrong.

The Black Boxes

The Boe­ing 777, like all com­mer­cial air­craft, has two com­pon­ents re­cord­ing in­f­light data. There’s a cock­pit voice re­cord­er in the front and a flight data re­cord­er in the tail of the plane, which re­cords in­form­a­tion from the vari­ous sensors and oth­er in­dic­at­ors throughout the craft. Data from these two sources is col­lec­ted in the crash sur­viv­able memory unit orC­SMU, which have been built to with­stand the heat, wa­ter, and the phys­ic­al ef­fects of a ma­jor crash.

Con­tro­versy has sur­roun­ded the con­di­tion these boxes at theM­H17 crash site, with con­flict­ing re­ports in­dic­at­ing that they were to be sent to Mo­scow. At last check, the Don­etsk rebels and Malay­si­an rep­res­ent­at­ives had brokered a deal to ex­change the boxes. Hours earli­er on Monday morn­ing, the spec­u­la­tion over their con­di­tion reached a fever pitch when the New York Post ran a scream­ing head­line de­clar­ing a “rebel plot” to steal the re­cord­ers. Cer­tainly they were in rebel hands for at least sev­er­al hours.

How hard is it to hack a black box? Ac­cord­ing to tech­nic­al ex­perts fa­mil­i­ar with their design who spoke to De­fense One, the an­swer is not very. Mod­ern-day flight data re­cord­ers use sol­id state drives, SSDs, to store in­form­a­tion. Un­like the hard drive in most PCs, SSDs con­sist of a bunch of memory flash drives stacked on top of one an­oth­er. They store memory with no mov­ing parts so they are con­sidered far more rugged than con­ven­tion­al hard drives. This is why en­gin­eers began us­ing them on planes.

Iron­ic­ally, SSDs may ac­tu­ally be more hack­able than the con­ven­tion­al hard drives they re­placed. When you over­write a file on an SSD, you don’t leave the same clear re­cord that you do when you de­lete a file on your com­puter. In fact, some mem­bers of the com­puter forensics com­munity have soun­ded the alarm about the grow­ing pop­ular­ity of SSDs and the trouble they could cause in terms of evid­ence dis­cov­ery and re­ten­tion in the fu­ture. Graeme Bell and Richard Bod­ding­ton of the Uni­versity of Mur­doch in Aus­tralia even went so far as to opine that “it seems pos­sible that the golden age for forensic re­cov­ery and ana­lys­is of de­leted data and de­leted metadata may now be end­ing” be­cause of SSDs.

In the case of MH17, the boxes aren’t likely to provide much new in­form­a­tion. Forensics teams use them to de­term­ine the mech­an­ic­al or hu­man cause of a crash. But re­cov­er­ing the boxes could be use­ful in this case to cat­egor­ic­ally rule out pi­lot er­ror or mech­an­ic­al mal­func­tion. If the data on the boxes does in fact sug­gest that something else happened to the plane, that de­vel­op­ment would no doubt fuel the con­spir­acy the­or­ies that have already taken route across the In­ter­net, which could play to Rus­sia’s ad­vant­age.

The Eye­wit­ness Testi­mony

In the case of MH17, the world already knows who the most im­port­ant wit­nesses are, mem­bers of the sep­ar­at­ist army who quickly took to so­cial me­dia to brag about shoot­ing down a plane they be­lieved was a Ukrain­i­an cargo jet. Of par­tic­u­lar sig­ni­fic­ance is a post from former Rus­si­an mil­it­ary of­ficer Ig­or Strelkov, the self-de­clared Min­is­ter of De­fense of the Don­etsk People’s Re­pub­lic. It ap­peared on VK.Com, Rus­sia’s ver­sion of Face­book, and re­portedly boas­ted that his troops had scored a hit, stat­ing “we warned you — do not fly in our sky.”

The prob­lem is that the wit­nesses are re­cant­ing. Strelkov (or someone) re­moved the post in short or­der. Sim­il­arly, as Agence France Press re­ports, pro-sep­ar­at­ist forces began tak­ing down in­crim­in­at­ing tweets and posts shortly after they ap­peared. In one par­tic­u­larly re­veal­ing ex­change, the Don­etsk Re­pub­lic Twit­ter feed, @dnr­press, ac­know­ledged that “self-pro­pelled Buk sur­face-to-air mis­sile sys­tems have been seized by theD­NR from (Ukrain­i­an) sur­face-to-air mis­sile re­gi­ment A1402,” ac­cord­ing to AFP.

In many ways, that may be the most im­port­ant tweet in the en­tire con­flict, since it now pur­ports to show not only that not only did the sep­ar­at­ists have the means to carry out the at­tack, but that they did not ac­quire the mis­sile launch­er from Rus­sia, as the U.S. be­lieves. Should Rus­sia de­cide to put more dis­tance between Mo­scow and the sep­ar­at­ists, it may use that ar­gu­ment. It’s un­clear how the so­cial me­dia posts, in total, will af­fect the U.S. case.

The good news for in­vest­ig­at­ors is that items on the In­ter­net tend to stay on the In­ter­net, es­pe­cially if they are in­ter­est­ing. Mul­tiple screen grabs caught the posts be­fore they van­ished, each one cor­rob­or­at­ing the oth­er.

All of this evid­ence tells the story of a unique mo­ment in his­tory.

In one swift com­mand ex­e­cu­tion, one man, sit­ting be­hind an old radar screen and armed with a 1,500 pound rock­et, caused the deaths of al­most 300 people, af­fected Putin’s re­la­tion­ship with the sep­ar­at­ists as well as Rus­sia’s with Europe and pos­sibly changed the dir­ec­tion of the con­flict — and his­tory. If the last sev­er­al days provide any in­dic­a­tion of what lies ahead, there will be deni­al, ac­cus­a­tion and overt ly­ing to come. We may nev­er really know what happened to MH17, but we can still get much closer to truth.

Infrared Satellite Imagery

“We know with a cer­tainty that we saw the launch from this area”¦we know that it oc­curred at this very mo­ment that this air­craft dis­ap­peared from the radar screen” said Kerry on Sunday.

The most im­port­ant ele­ment in in­stilling sim­il­ar cer­tainty among European part­ners will prob­ably be in­frared satel­lite im­agery. The Na­tion­al Re­con­nais­sance Of­fice, or NRO, and the Air Force Space Com­mand op­er­ate a num­ber of in­frared satel­lites, such as the Space Based In­frared Sys­tem (SBIRS). There are cur­rently two SBIRS satel­lites in or­bit but there will be six by 2022, with Lock­heed Mar­tin as de­veloper, un­der con­trol of Air Force Space Com­mand.

The NRO couldn’t com­ment on the use of in­frared satel­lites in the MH17 case, ex­cept to tell De­fense One that “facts about the NRO con­stel­la­tion, in­clud­ing cap­ab­il­it­ies and past and present op­er­a­tions are clas­si­fied.” But the U.S.has un­der­stood the im­port­ance of in­frared satel­lite im­agery for re­con­nais­sance since the 1950s when we de­veloped these sys­tems for very much the same reas­on we are us­ing them today, to track rock­et launches from ma­chines like the SA-11. For a great primer, read Sean Galla­gh­er’s piece here.

Satel­lite im­ages provide a lit­er­al smoking-gun por­trait of the events sur­round­ing the downed plane. But the U.S. has burned its fin­gers on smoking gun satel­lite im­ages be­fore. Oth­er pieces of evid­ence will likely play a role as the U.S. builds its case.

Chemical Signatures on Airplane Parts

To prove that its the­ory of the events is true, the U.S. needs data from in­vest­ig­at­ors on the ground in Ukraine from the Or­gan­iz­a­tion for Se­cur­ity and Co-op­er­a­tion in Europe, OSCE. They, in turn, need ac­cess to the debris at the crash site to col­lect samples from evid­ence. That’s proven to be a thorny is­sue, as evid­enced by news re­ports that the con­trolling sep­ar­at­ist forces in Don­etsk are ob­stin­ate, threat­en­ing, com­monly in­tox­ic­ated and have blocked both me­dia and in­vest­ig­at­ors.

Kerry said that OSCE mon­it­ors were giv­en just three hours to ac­cess the scene on Sat­urday — and the site is already com­prom­ised. “We un­der­stand air­plane parts have been re­moved,” Kerry said.

If the Obama ad­min­is­tra­tion is cor­rect, what will the ground evid­ence show? The dis­tri­bu­tion of debris, once fully cata­logued, would con­firm a vi­ol­ent sud­den ex­plo­sion, as op­posed to a long trail of parts in­dic­at­ing a slow break­ing apart and would in­clude mis­sile shrapnel. It would also show that the radar-guided mis­sile likely ex­ploded with­in about 65 feet from the tar­get. In­frared ima­ging might show ex­plos­ive residue some­what evenly dis­trib­uted on the bot­tom of the plane. Con­versely, an ex­cess­ive amount of ex­plos­ive residue on the en­gines could in­dic­ate that the mis­sile was heat seek­ing and not shot from an SA-11 and that the U.S.was wrong.

The Black Boxes

The Boe­ing 777, like all com­mer­cial air­craft, has two com­pon­ents re­cord­ing in­f­light data. There’s a cock­pit voice re­cord­er in the front and a flight data re­cord­er in the tail of the plane, which re­cords in­form­a­tion from the vari­ous sensors and oth­er in­dic­at­ors throughout the craft. Data from these two sources is col­lec­ted in the crash sur­viv­able memory unit orC­SMU, which have been built to with­stand the heat, wa­ter, and the phys­ic­al ef­fects of a ma­jor crash.

Con­tro­versy has sur­roun­ded the con­di­tion these boxes at theM­H17 crash site, with con­flict­ing re­ports in­dic­at­ing that they were to be sent to Mo­scow. At last check, the Don­etsk rebels and Malay­si­an rep­res­ent­at­ives had brokered a deal to ex­change the boxes. Hours earli­er on Monday morn­ing, the spec­u­la­tion over their con­di­tion reached a fever pitch when the New York Post ran a scream­ing head­line de­clar­ing a “rebel plot” to steal the re­cord­ers. Cer­tainly they were in rebel hands for at least sev­er­al hours.

How hard is it to hack a black box? Ac­cord­ing to tech­nic­al ex­perts fa­mil­i­ar with their design who spoke to De­fense One, the an­swer is not very. Mod­ern-day flight data re­cord­ers use sol­id state drives, SSDs, to store in­form­a­tion. Un­like the hard drive in most PCs, SSDs con­sist of a bunch of memory flash drives stacked on top of one an­oth­er. They store memory with no mov­ing parts so they are con­sidered far more rugged than con­ven­tion­al hard drives. This is why en­gin­eers began us­ing them on planes.

Iron­ic­ally, SSDs may ac­tu­ally be more hack­able than the con­ven­tion­al hard drives they re­placed. When you over­write a file on an SSD, you don’t leave the same clear re­cord that you do when you de­lete a file on your com­puter. In fact, some mem­bers of the com­puter forensics com­munity have soun­ded the alarm about the grow­ing pop­ular­ity of SSDs and the trouble they could cause in terms of evid­ence dis­cov­ery and re­ten­tion in the fu­ture. Graeme Bell and Richard Bod­ding­ton of the Uni­versity of Mur­doch in Aus­tralia even went so far as to opine that “it seems pos­sible that the golden age for forensic re­cov­ery and ana­lys­is of de­leted data and de­leted metadata may now be end­ing” be­cause of SSDs.

In the case of MH17, the boxes aren’t likely to provide much new in­form­a­tion. Forensics teams use them to de­term­ine the mech­an­ic­al or hu­man cause of a crash. But re­cov­er­ing the boxes could be use­ful in this case to cat­egor­ic­ally rule out pi­lot er­ror or mech­an­ic­al mal­func­tion. If the data on the boxes does in fact sug­gest that something else happened to the plane, that de­vel­op­ment would no doubt fuel the con­spir­acy the­or­ies that have already taken route across the In­ter­net, which could play to Rus­sia’s ad­vant­age.

The Eyewitness Testimony

In the case of MH17, the world already knows who the most im­port­ant wit­nesses are, mem­bers of the sep­ar­at­ist army who quickly took to so­cial me­dia to brag about shoot­ing down a plane they be­lieved was a Ukrain­i­an cargo jet. Of par­tic­u­lar sig­ni­fic­ance is a post from former Rus­si­an mil­it­ary of­ficer Ig­or Strelkov, the self-de­clared Min­is­ter of De­fense of the Don­etsk People’s Re­pub­lic. It ap­peared on VK.Com, Rus­sia’s ver­sion of Face­book, and re­portedly boas­ted that his troops had scored a hit, stat­ing “we warned you — do not fly in our sky.”

The prob­lem is that the wit­nesses are re­cant­ing. Strelkov (or someone) re­moved the post in short or­der. Sim­il­arly, as Agence France Press re­ports, pro-sep­ar­at­ist forces began tak­ing down in­crim­in­at­ing tweets and posts shortly after they ap­peared. In one par­tic­u­larly re­veal­ing ex­change, the Don­etsk Re­pub­lic Twit­ter feed, @dnr­press, ac­know­ledged that “self-pro­pelled Buk sur­face-to-air mis­sile sys­tems have been seized by theD­NR from (Ukrain­i­an) sur­face-to-air mis­sile re­gi­ment A1402,” ac­cord­ing to AFP.

In many ways, that may be the most im­port­ant tweet in the en­tire con­flict, since it now pur­ports to show not only that not only did the sep­ar­at­ists have the means to carry out the at­tack, but that they did not ac­quire the mis­sile launch­er from Rus­sia, as the U.S. be­lieves. Should Rus­sia de­cide to put more dis­tance between Mo­scow and the sep­ar­at­ists, it may use that ar­gu­ment. It’s un­clear how the so­cial me­dia posts, in total, will af­fect the U.S. case.

The good news for in­vest­ig­at­ors is that items on the In­ter­net tend to stay on the In­ter­net, es­pe­cially if they are in­ter­est­ing. Mul­tiple screen grabs caught the posts be­fore they van­ished, each one cor­rob­or­at­ing the oth­er.

All of this evid­ence tells the story of a unique mo­ment in his­tory.

In one swift com­mand ex­e­cu­tion, one man, sit­ting be­hind an old radar screen and armed with a 1,500 pound rock­et, caused the deaths of al­most 300 people, af­fected Putin’s re­la­tion­ship with the sep­ar­at­ists as well as Rus­sia’s with Europe and pos­sibly changed the dir­ec­tion of the con­flict — and his­tory. If the last sev­er­al days provide any in­dic­a­tion of what lies ahead, there will be deni­al, ac­cus­a­tion and overt ly­ing to come. We may nev­er really know what happened to MH17, but we can still get much closer to truth.

What We're Following See More »
STAFF PICKS
When It Comes to Mining Asteroids, Technology Is Only the First Problem
1 days ago
WHY WE CARE

Foreign Policy takes a look at the future of mining the estimated "100,000 near-Earth objects—including asteroids and comets—in the neighborhood of our planet. Some of these NEOs, as they’re called, are small. Others are substantial and potentially packed full of water and various important minerals, such as nickel, cobalt, and iron. One day, advocates believe, those objects will be tapped by variations on the equipment used in the coal mines of Kentucky or in the diamond mines of Africa. And for immense gain: According to industry experts, the contents of a single asteroid could be worth trillions of dollars." But the technology to get us there is only the first step. Experts say "a multinational body might emerge" to manage rights to NEOs, as well as a body of law, including an international court.

Source:
STAFF PICKS
Obama Reflects on His Economic Record
1 days ago
WHY WE CARE

Not to be outdone by Jeffrey Goldberg's recent piece in The Atlantic about President Obama's foreign policy, the New York Times Magazine checks in with a longread on the president's economic legacy. In it, Obama is cognizant that the economic reality--73 straight months of growth--isn't matched by public perceptions. Some of that, he says, is due to a constant drumbeat from the right that "that denies any progress." But he also accepts some blame himself. “I mean, the truth of the matter is that if we had been able to more effectively communicate all the steps we had taken to the swing voter,” he said, “then we might have maintained a majority in the House or the Senate.”

Source:
STAFF PICKS
Reagan Families, Allies Lash Out at Will Ferrell
1 days ago
WHY WE CARE

Ronald Reagan's children and political allies took to the media and Twitter this week to chide funnyman Will Ferrell for his plans to play a dementia-addled Reagan in his second term in a new comedy entitled Reagan. In an open letter, Reagan's daughter Patti Davis tells Ferrell, who's also a producer on the movie, “Perhaps for your comedy you would like to visit some dementia facilities. I have—I didn’t find anything comedic there, and my hope would be that if you’re a decent human being, you wouldn’t either.” Michael Reagan, the president's son, tweeted, "What an Outrag....Alzheimers is not joke...It kills..You should be ashamed all of you." And former Rep. Joe Walsh called it an example of "Hollywood taking a shot at conservatives again."

Source:
PEAK CONFIDENCE
Clinton No Longer Running Primary Ads
1 days ago
WHY WE CARE

In a sign that she’s ready to put a longer-than-ex­pec­ted primary battle be­hind her, former Sec­ret­ary of State Hil­lary Clin­ton (D) is no longer go­ing on the air in up­com­ing primary states. “Team Clin­ton hasn’t spent a single cent in … Cali­for­nia, In­di­ana, Ken­tucky, Ore­gon and West Vir­gin­ia, while” Sen. Bernie Sanders’ (I-VT) “cam­paign has spent a little more than $1 mil­lion in those same states.” Meanwhile, Sen. Jeff Merkley (D-OR), Sanders’ "lone back­er in the Sen­ate, said the can­did­ate should end his pres­id­en­tial cam­paign if he’s los­ing to Hil­lary Clin­ton after the primary sea­son con­cludes in June, break­ing sharply with the can­did­ate who is vow­ing to take his in­sur­gent bid to the party con­ven­tion in Phil­adelphia.”

Source:
CITIZENS UNITED PT. 2?
Movie Based on ‘Clinton Cash’ to Debut at Cannes
1 days ago
WHY WE CARE

The team behind the bestselling "Clinton Cash"—author Peter Schweizer and Breitbart's Stephen Bannon—is turning the book into a movie that will have its U.S. premiere just before the Democratic National Convention this summer. The film will get its global debut "next month in Cannes, France, during the Cannes Film Festival. (The movie is not a part of the festival, but will be shown at a screening arranged for distributors)." Bloomberg has a trailer up, pointing out that it's "less Ken Burns than Jerry Bruckheimer, featuring blood-drenched money, radical madrassas, and ominous footage of the Clintons."

Source:
×