From World of Warcraft to the world of war crimes
As he boarded his long-haul flight from the Netherlands to Malaysia on July 17, 2014, the Dutch musician Cor Pan snapped a picture of the waiting Boeing 777 and uploaded it to Facebook. “In case we go missing, here’s what it looks like,” he wrote. It was supposed to be a joke. Instead, it would become one of the last digital echoes of a terrible tragedy.
A few hours later, the plane was flying over eastern Ukraine, a region divided between the local government and Russian-backed separatists. Many of the 298 passengers and crew aboard were drowsing with the shades drawn. They were a mix of vacationers, business travellers, and a group of scientists bound for an HIV/AIDS conference. In the cockpit, the mood was similarly placid. The pilots’ biggest worry was light turbulence. We know this because all the sounds and activity on the cockpit voice recorder were perfectly normal, up until the 30 milliseconds before it stopped working.
The pilots never saw the missile as it pierced the cloud cover to their left. In a fraction of a second, over 7,600 pieces of superheated shrapnel tore through the cockpit, ripping the pilots to shreds. The blast cleaved the front of the plane from the rest of the fuselage. As the aircraft jerked and began to fall, it separated into three pieces. Many passengers in the cabin remained alive through the plane’s plummet, struggling to understand what was happening. For 90 seconds, they were overwhelmed with deafening sounds; stomach-turning acceleration; a cyclone of serving trays and carry-on luggage; fierce winds and extreme cold.
There was no surviving the final impact. All 298 would die.
As flaming wreckage fell just outside the town of Hrabove, it took under five minutes for the first reports to appear online. A local witness described the moment she would never forget: the bodies “just fell very, very hard to the ground.”
As the story rocketed across the internet, each side in the battle zone that the plane had fallen into — the Ukrainian government and Russian-backed separatists — quickly blamed the other for the tragedy. Although social media exploded with theories, actual facts were hidden in a swirling fog. The rebels barred international investigators from visiting the crash site, preventing any independent examination for the next two weeks. It seemed that whoever had just killed 298 civilians would have ample time to disappear.
What they hadn’t counted on was a soft-spoken former World of Warcraft addict. Sitting 2,000 miles away at his computer, he already had access to all the evidence he would need.
Three years earlier, Eliot Higgins had been a stay-athome dad, doting on his infant daughter in their cosy Leicester, England, home. Deciding he was spending too much time online playing video games and commenting on news stories, he turned to channel his interests into something more useful — starting a blog about the Syrian civil war that had just begun. He took the handle “Brown Moses,” from one of the iconoclastic rocker Frank Zappa’s more obscure songs, which asked, “What wickedness is dis?”
Yet, Higgins had never even been to Syria. He didn’t speak Arabic. By his own admission, his knowledge of any type of conflict was limited to what he’d seen in Rambo movies. Indeed, he rarely left his house. He didn’t have to. Thanks to millions of social media accounts, the Syrian civil war came to him.
His gifts were patience and diligence. His weapons were YouTube and Google Maps. Higgins taught himself how to find and track weapon serial numbers; how to use landmarks and satellite imaging to trace someone’s steps; how to combine and catalogue a stream of tens of thousands of videos. Soon enough, Higgins was charting each new development in a twisting, chaotic conflict. He uncovered hidden rebel weapon supply lines. He built a mountain of evidence to show that the Syrian dictator Bashar Assad had used nerve gas on his own people. From modest Blogspot beginnings, Brown Moses was soon rivalling not just the professional news media in his reporting, but some government intelligence agencies as well.
But this was only his first act. As interest in his unusual methods grew, Higgins launched a crowdfunding campaign for a new kind of online project dedicated to “citizen investigative journalists.” The organization was dubbed Bellingcat. The name was taken from the old fable in which a group of mice conspire to place a bell around a cat’s neck, so that they might always be warned of its approach.
Bellingcat had barely launched when flight MH17 fell from the sky. The first cat had come stalking.
One day after the tragedy, with international media awash in speculation and finger-pointing, Bellingcat published its first report. It was a straightforward summary of social media evidence to date, focused on sightings of a Russian Buk surface-to-air missile launcher that had been prowling near the crash site at the time of the tragedy.
On July 22, Higgins posted a followup, superimposing images of wreckage against pictures of the intact plane, tracing the pattern of shrapnel damage. He drew no firm conclusions, pushing back against sketchy accounts posted by both Russians and Ukrainians. Bellingcat would only report the facts, as the digital bread crumbs revealed them.
It took a certain kind of person to excel in this work. Social media forensics requires endless focus and an attention to detail that sometimes borders on unhealthy. “I played a lot of role-player games,” Higgins explained. “Believe me, there are a lot of obsessive people out there who could probably put their passions to a more productive use.”
A diverse crew of obsessive volunteers joined the hunt, an international online collective began forming. They ranged from a Finnish military officer who knew Russian weapons, to Aric Toler, an American volunteer from North Carolina, who sheepishly told us how his main qualification was just being “good at the internet.” He’d spend hours each day tumbling through obscure Russian social media channels, surfacing only for occasional coffee breaks and visits to the Chipotle next door.
His in-laws thought he was wasting his time online. They didn’t realize Toler was investigating war crimes.
The Bellingcat team soon tracked down multiple images and videos that showed a Buk missile launcher in the vicinity of MH17’s flight path on the day of the tragedy, clearly within separatist territory. But the team noticed something even more telling. In photographs posted from before the time of the plane crash, the vehicle carried four missiles; in photographs taken soon after the crash, only three. They’d found their smoking gun.
But then the trail seemed to go cold. Although they could find plenty of other online photos of Russian-manned Buks deployed to aid the rebels, they couldn’t find any additional matches for this particular vehicle. The images also showed that a shell game was being played. The painted vehicle number had been changed both before and after the July 17 event, and it could easily be changed again.
The breakthrough came when the analysts shifted their gaze lower. They realized that every Buk vehicle had a rubber skirt to help stop its tracks from throwing up mud and dirt. Because each vehicle has its own particular driving history, each rubber skirt has a unique pattern of wear and tear. Now the Bellingcat team had the equivalent of a fingerprint to hunt for across every photograph and snippet of video that came out of eastern Ukraine.
They soon located photos of the Buk that had shot the missile in a convoy filmed crossing from Russia into Ukraine on June 23 — and leaving again on July 20. They were then able to trace backward, finding the unit to which the Buk in the convoy belonged: the 2nd Battalion of the 53rd Anti-Aircraft Missile Brigade of the Russian army. Bellingcat posted their findings online, mapping out the odyssey of the weapon that had killed 298 people, as well as showing its Russian origin.
The weapon and even its unit had been found, but who had pulled the trigger? Here the answer was provided by the shooters themselves. Searching through Russian soldiers’ profiles on VKontakte, or VK (essentially a Russian version of Facebook), the Bellingcat team found images of military equipment, dour group photographs and hundreds of angsty selfies. One conscript had even snapped a picture of an attendance sheet for a 2nd Battalion drill shortly before its deployment to Ukraine.
It wasn’t just the soldiers who opened the lens to their war, but also their friends and families. The Bellingcat team found particular value in an online forum frequented by Russian soldiers’ wives and mothers. Worried about their loved ones, they traded gossip about the deployments of specific units, which also proved an intelligence gold mine.
After nearly two years of research, Bellingcat presented its findings to the Dutch tribunal that had been tasked with bringing the killers to justice. It included the names, photographs and contact information of the 20 soldiers who the data showed had been manning the missile system that had shot down flight MH17. It was an extraordinary feat, accomplished using only what was available on the internet. It was also damning evidence of Russian participation in a war crime.
The blast cleaved the front of the plane from the rest of the fuselage. As the aircraft jerked and began to fall, it separated into three pieces. Many passengers in the cabin remained alive through the plane’s plummet, struggling to understand what was happening.