Thread by @christogrozev

The MH17 criminal trial will resume in a couple of minutes. Today and in the next couple of days, the prosecution will (for the first time) present its case against the indicted suspects. The defense will be able to ask for additional investigative work.

Defense lawyers have told court that due to Covid19, they were unable to contact their client Pulatov in Russia, and were not able to prepare the defense by today.

..court has decided that defense can file preliminary objections today anyway. Defense can also submit objections later, but would have to justify what prevented them to submit them during this week. So the prosecution will proceed with presenting their case & evidence.

First, the defense will be given a chance to present objections now, and then the prosecution will begin its presentation, which will take most of this week, and likely will continue on June 22.

The judge lists preliminarily some of the additional evidence that has been added to the case file since last hearing. Notably, new satellite photos and extracts from a Russian forum site were mentioned.

Pulatov's defense, in the meantime, appealed against granting anonymous (protected) status to 13 witnesses, because "he was not given an opportunity to object". The interim court decided that this is justified only in relation to Witness 11.

Court asked prosecution if confidentially shared US sat photos showing a missile should be added to the case. Prosecution said it received a memorandum on it, and a Dutch representative was allowed to inspect the sat data to confirm accuracy of report. He/she confirmed.

(note: this relates to satellite photos - apparently - from secret military US satellites that US doesn't want to share in raw form, as then it would disclose its technical capabilities. Thus it shares this data via the proxy of Dutch security officer having seen the data)

Before handing the floor to the defense, the judge made it clear that Girkin's recent lengthy interview will be taking into account as evidence.

Defense lawyer complains there was too little time to study the 40,000 page case file, as it requires not only legal but technical knowledge.. "we don't have the capability to know if a trail from a certain missile should look a certain way"

somewhat counter-intuitively, the defense complains it got only a digital file, and not (40,000 pages of...? ) a hard copy file.

Defense says it planned to spend 2 weeks in Russia to discuss the file and strategy with client Pulatov, but that became impossible due to Covid19.

"We are surprised the prosecution asked why we couldn't discuss strategy with client via internet or phone.. This is unthinkable given that JIT itself warned about cyber-obstruction by GRU and other Russian services" (good point, actually)

...apart from the security considerations, discussing 10s of thousands of pages with client who doesn't speak languages via internet would be next to impossible.

"...last but not least, we need to establish trust from our client to us - we are a Dutch law firm, he is exposed to media messaging that the Netherlands is the source of bias and disinformation... we planned to invest time in creating trust...".

(all of these arguments are valid, but I have a suspicion the court will take into consideration the fact that it was the suspect's choice to not be present in the Netherlands.. .so at least some of these objections will be deemed as "self-inflicted")

Defense asks for deferral, but still gives a taste of what its arguments are likely to be. It now says it might invoke jurisdiction problems, as it deems the war in Eastern Ukraine a legitimate (international) armed conflict, in which combatants cannot be held criminally liable.

(Note: this is true, except for war crimes - but "combatants immunity" requires an international military conflict - not a position Russia will be very happy to accept as defense strategy)

(In our podcast last week we discussed and predicted namely this: that Dutch defense lawyers might propose defense strategies that will be totally unacceptable to the Kremlin - have a listen when you can bellingcat.com/resources/podc…)

Defense: "Without discussing with our client, to understand the role of combatants, chain of command etc... we are unable to present the combatant defense today... we need more time"

Defense gives more examples of why it's not possible to prepare defense without sitting next to client..such as listening together to intercepts and getting his interpretation.
Once again, court is likely to ask "why didn't he come here when we summoned him?"

Defense ended its preparatory statement. Prosecution now proposes to ask additional questions about the defense preparation before proceeding with the case presentation. Court agrees and gives floor to prosecutors.

Prosecution asks:
* did defense really have no contact l with Pulatov since the start of coronavirus?
* does Pulatov feel not free to communicate except personally? We don't see a risk for Pulatov insofar as his position is aligned w Kremlin. If not, let's discuss in camera.

* further, we provided a translation of Mr. Pulatov's file into Russian. Has he read it?
* how do you see further court work if you can't travel to Russia in the near future?

Defense answers:
* we had limited contact with him
* he read his own file but not all the case file evidences (tens of thousand of untranslated pages)
* we will propose timing after we hear the prosecution presentation

Prosecution counters that if Pulatov chose to have limited contact with prosecution, it is his choice. If it was impossible to have contact, he should explain why. So far no such explanation is provided. Defense lawyers are not subjects in the case, he is the sovereign subject.

(Note: this is not just sophistics, indeed, legally, court must interpret if Pulatov chose not to interact/prepare his defense team, vs was physically prevented from doing so. This will be a very interesting legal argument)

Judge interrupts the pleadings, and suggests a break until 1 pm (just over an hour from now).. Not sure if he will require an in-camera meeting in the meantime.

Court hearing resumes. Defense answers prosecution questions, says they did meet with Pulatov but before the March 9 trial launch, and it was not enough to prepare a defense. Again focus on complexity of case.

And now the really interesting part begins. The prosecution will start its presentation, trying to explain the facts and the evidence collected, and to convince the court that the investigation has been thorough.

The prosecution will describe their investigation into three different scenarios of what happened to MH17 : on-board explosion, air-to-air missile, and ground-to-air missile.
The prosecutor starts by providing context to the military hostilities in 2014

After a lengthy introduction of context, including Russia's meddling efforts in the investigation, prosecutors now delivers its presentation and begins to present the evidence. First, a discussion will be presented on the various sources of evidence.

In each case, any single source had to be validated by other sources, which was especially important given the totally conflicting and incompatible testimonies and pieces of evidence provided by various parties.

Prosecution begins by explaining why no real forensic investigation could be done on the crash site which was under control of Russian-controlled militants. Access to site was mediated only via OSCE.

There was a limited time-window of access to the crash site, and it had to be used for the priorities: recovery and identifying victims, and then the international aviation accident investigation; and not for the criminal investigation which would have interfered.

In June 2015, a limited on-site attempt for forensic criminal investigation was attempted by JIT but safety risks from ongoing fighting made it impossible to continue.

The initial forensic investigation - which was only done based on material evidence - plane wreckage, damage to victims bodies etc - sought to answer if an onboard explosion or air-to-air or ground-to-air caused crash. This allowed objective validation of further testimony.

First step was to inspect all mortal remains for "foreign objects" . This was done via CT scans and autopsy "triages"

Prosecution shows a video demonstrating the triage forensic investigation in search of metal fragments in the victims' bodies

Second step was to reconstruct the wreckage of the plane inspect all plane fragments to find for foreign objects in the wreckage.

Any piece of plane wreckage that showed perforation from foreign fragments were also taken into evidence. 1,170 photographs made on the crash site were also taken into account in the forensic investigation.

In October and November 2014, two types of BUK missiles - the older and the newer version - were dismantled in an experiment to see differences in the warhead. Both were found to have identical warheads with the same schrapnel fragments.

It became clear that both the older and the newer BUK models use a mix of fragments, including the butterfly type.

In November 2014, JIT also inspected both the electronic guiding unit of the missile and the BUK-Telar installation (right). This was done in Ukraine.

Then, in 2015 Finland agreed to conduct a detonation test of a warhead, which allowed the collection of empirical evidence of speed and direction of dispersal, which helped recreate the explosion and reverse-engineer direction of impact

Following the Finnish experiment, JIT decided to proceed with two more experiments - this time in Ukraine. This time not only the warhead was detonated but a full 9M38M1 was "test-fired" in order to compute the thrust - and compute flight pattern variants.

The test-firing was made in a stationary testing device that measured thrust and created a profile that helped computing the origin of launch site. Left- the profile test, right - the warhead explosion test.

Last, a full-missile arena explosion test was conducted to track the exact dispersal and damage from different sections of the warhead

Belgian experts were able to compute the launch location based on the vast amount of experimental data from these tests. An additional forensic test based on soil samples did not return any meaningful results as residue in soil dissipates too fast

(soil samples from an actually known launch site near Kramatorsk in Ukraine collected 6 months after the launch showed no residue... and the samples collected in the MH17 case were taken only a year after the crash)

Damage to the actual fuselage and cockpit, which was concentrated on the left front section, as well as the out-inward direction of the perforations permitted the experts to compute the direction of flight of missile before explosion. Damage was compared to the damage from test.

Some artifacts a BUK explosion that didn't make sense could only be explained thanks to the arena explosion test. For example, these ostensibly "inside-outward" petalling holes - which apparently are the result of structural damage to compressed metal layers.

Comparison of actually collected fragment samples with the ones taken from disassembled warheads show that there was a match. This meant that Russia's official claim that only the older 9M3M1 missile - used by Ukraine - could have contained the found fragments, was untrue.

in addition to shrapnel fragments, other, larger pieces of non-aircraft-belonging fragments were removed from fron and left parts of the plane wreckage, and could be identified as parts of a BUK missile.

Additionally, bow-tie shaped shrapnel were found in the body of the pilot. This was one of them.

Prosecution answers two truthist challenges. One is that only 300 out of 800 shrapnel fragments were recovered. This is logical given the omnidirectional dispersal of fragments. Second is the weight of fragments. Not all fragments retain their original shape, experiment showed

An additional 7 non-fragment and non-airplane segments were found at or near the crash site. These were investigated as either BUK 9M38/M1 missile fragments. They were found to be more similar to the newer, M1 model.

The electrical conductor section was different in the two models, and the one recovered was only similar to the reference *M1 missile. This together with the bow-tie shapes found, and the nose green color (standard for *M1, white for the older). Thus conclusion was: newer 9M38M1

The non-shrapnel (=missile) foreign segments were found either in victims' bodies or at various locations of the disaster area and were secured at different times.The consistency between the parts in victims bodies and the ones procured via witnesses validated the different parts

Now prosecution will describe how it defined the launch site. In the DSB (technical) investigation, with limited data available, the launch site was defined very broadly: 300 sq.m. But the arena test plus 3d scan of the 777 allowed for much more precise computation.

This resulted in a possible launch area of only 75 sq m, shown here.

Only a BUK fired from this shape could have caused the empirically seen damage on MH17, experts computed. However, Russia's Almaz Antey (BUK manufacturers) calculated a totally different area, much further to the south.

Using all "new data" provided by Almaz Antey, the Belgian Military Academy recomputed independently the launch site, which overlapped with the JIT's initial estimation, and was again near Snizhne, and not where Russia said it must have been.

Prosecutor now recaps the dozens of different approaches it took to validate and/or refute the various weapon and launch site theories, showing that JIT only took into account data that was consistent with one another and could be validated by several objective sources.

"We deem the forensic investigation to be complete and we are ready to answer any questions".
The judge proposes a half-hour break before resuming with - the telephone intercepts.
(The judge knows how to tease the next episode)

While we wait, here's a slow-motion video of the BUK blow-up & damage assessment experiment the JIT conducted in 2016

Prosecution now explains why SBU were able to publish intercepts several hours after the shootdown. SBU had been tracking these phones for months already. After the incident SBU engaged its field offices to listen to recent calls to find relevant conversations.

These initial "hits" were only starting points, and not the final evidence. They provided leads to look for other calls, and to start interpreting topics and references. Data was aggregated from 3 different sources: intel, ongoing criminal investigations, and MH17 investigations

Depending on the source of telecoms data, different clearances were needed under Ukraine law - the most cumbersome and time-consuming was data that came from ongoing criminal investigations. There a court decision was needed to declassify the data.

Initially, SBU searched for references to "BUK"s to find relevant convos. But soon it became clear Russia's FSB had provided special secure phones that couldn't be tapped

Some of the indicted suspects were given such phones

Here, Girkin doesn't know how to turn on the encryption...

In another call, with Vladimir Ivanovich (identified by us as FSB's Gen. Andrey Burlaka), it could be heard how encryption can be turned on and off during a call.

JIT didn't just take SBU provided intercepts at public value. It applied a holistic validation method - comparing Ukraine data with international call metadata, confirming content with some participants, and finding open-source confirmation of certain calls having taken place

In addition Dutch IT forensic experts conducted on-the-ground network experiments in Ukraine and compared it to the metadata obtained from Ukrainian mobile operators.

Network measurement near the launch site and along thte suspected BUK route could only be made a year after the crash, due to hostilities and local militant restrictions. LNR for example didn't allow measurement (red segment).

Although incomplete and delayed by a year, the network measurement data provided valuable data to both validate telecom data and to identify the location of people speaking. Care was always taken not to jump to conclusions due to distance b/n cell tower and telephone, etc.

The network connection data was used as additional, and not as primary source of data, to validate other findings (such as discussion of a movement of a suspect, or a visual sighting).

Another validation route was by cross-referencing hardware signatures (IMEI) among different operators, and call duration and timing metadata (i.e. to ensure there was no overlaps or other inconsistencies)

Dutch telecoms experts with large forensic experience analyzed the comprehensive Ukraine-provided data and concluded that its integrity is the same as would be expected in any Dutch investigation.

Whenever any Ukrainian intercept included an international call, JIT retreived the corresponding call metadata (or audio) from the other (Polish, Spanish etc) mobile operator. All such cross-checked matched.

JIT also used admissions by call participants that they did indeed speak the words contained in the intercepts.

JIT and journalists also confronted other persons of interests who claimed that they did speak the content that was heard on intercepts, but on a different date. Dubinsky was one example. However data from such other date showed no such calls were made or possible.

Another "validation" example was an intercept between Girkin and Konstantin Valeryevich (identified by us as Malofeev). The content of the call was confirmed by contemporaneous news reports in the Russian media

In one last example, suspect Dubinsky reported on 16 June 2014 that Bezler's unit had just downed a Ukrainian SU fighter jet. This was also confirmed by contemporaneous news reports.

Here's the full transcribed audio of the Girkin - Malofeev call referenced by the JIT

In summary, JIT conducted a holistic, multidisciplinary validation of all calls shared by Ukraine, and have concluded that it's implausible that any manipulation of the handed-over call data may have taken place.

Prosecutors describe how they searched for witnesses. The first way was by using tips provided by SBU from ongoing investigations. Second were other countries that provided access to witnesses. Third, repeated appeal for witnesses were made by JIT via web, radio ads etc.

JIT also targeted individual potential witnesses via DM's, phone calls and social media. Many of these targeted individuals referred JIT to other people who might have had more information. This approach led to dozens of witness statements both in and out of Eastern Ukraine

These witnesses include former Russian mercenaries, Donbass separatists, journalists, local residents. Some of them were and/or are in Russia. We took their security as our primary goal.

Different approaches to witness safety were taken depending on the risk level. In some cases they were just assigned an ID number, their identity known only to JIT investigators. In other cases parts of the testimony was excluded by the investigative judge to protect identities

Witness came forward between 2014 and 2019, and in 2019 the investigative judge started hearing each witness, and studied their individual safety situation to approve or not their anonymization. The judge also independently assessed the credibility of such witnesses.

Per Dutch law, an indicted party may challenge the anonymization of witnesses. In this case Pulatov challenged the anonymization of all secured witnesses, and a separate review court accepted that for one of them the procedure was not followed properly. All others remain anon.

JIT now will discuss the gathering of video and photo evidence, as well as the digital open source investigations, including the private investigations by journalists and citizen investigators.

Prosecutors explain the mammoth work that needed to be undertaken to monitor, capture and archive ALL potentially relevant online posts, images, video publications that might in the future provide evidence. This was done on a mass-scale basis using ML algorithms.

Initially only purely openly accessible sites were monitored and scraped. Later, JIT decided to create passive accounts to access membership status to certain closed online groups to be able to collected shared data therein. JIT obtained court-approved decisions for such access.

Following the prosecutor's presentation of the types and methods of evidence gathering and validation, the hearing for today is adjourned, and will resume tomorrow.