Case Study 39-A: Russia's "Firehose of Falsehood" Doctrine in Operation

The MH17 Information War and the Ukraine Disinformation Campaign (2014–2022)

Overview

On July 17, 2014, Malaysia Airlines Flight MH17 was destroyed over eastern Ukraine, killing all 298 people aboard. Investigators from the Joint Investigation Team — a joint criminal investigation by the Netherlands, Australia, Belgium, Malaysia, and Ukraine — subsequently established, to criminal standards of evidence, that the aircraft was struck by a Buk surface-to-air missile launched from Russian-controlled territory by Russian-affiliated forces, using equipment belonging to the 53rd Anti-Aircraft Missile Brigade of the Russian Armed Forces.

What makes MH17 a defining case in information warfare is not primarily the crime. It is what happened next.

Over the days, weeks, and months following the shootdown, Russian state media, Russian government spokespeople, social media accounts, and affiliated online actors promoted at least a dozen mutually contradictory explanations for MH17's destruction — most of them pointing to Ukrainian or Western responsibility. The contradictions were not concealed. They were simultaneous. Multiple explanations were promoted in the same time period, through the same channels, to the same audiences.

This was not confusion. It was doctrine.

The Operation: Anatomy of the Firehose in Action

The Immediate Response (Days 1–7)

Within hours of MH17's destruction, Russian state media and official government channels began promoting what researchers at Bellingcat, the investigative journalism organization that would conduct some of the definitive open-source investigation into the crash, later catalogued as an "information firewall."

Explanations promoted in the first week included:

• A Ukrainian fighter jet had shot down MH17 (promoted by Russian Defense Ministry spokespeople with reference to Ukrainian military flight activity)
• MH17 was confused with President Putin's presidential aircraft, which had a similar livery, and was shot down intentionally
• The wreckage showed evidence of damage inconsistent with a ground-launched missile, suggesting it had been hit by an air-to-air missile
• The crash was staged by Western intelligence to create a pretext for sanctions against Russia
• Ukraine had deliberately routed the flight over a conflict zone to create the crash
• The crash was the result of Ukrainian military equipment malfunction

These explanations were not presented as competing hypotheses pending investigation. They were presented with confidence and specificity, complete with references to alleged radar data, supposed witness testimony, and purported physical evidence — all fabricated, manipulated, or misrepresented.

The Technical Disinformation Phase (Weeks 2–12)

As investigators began producing verified evidence, Russian information operations shifted to technical disinformation — producing sophisticated-appearing but false technical analyses that mimicked the form of legitimate forensic investigation while reaching opposite conclusions.

The Russian Ministry of Defense published radar data at a press conference that it claimed showed Ukrainian military aircraft in the vicinity of MH17 at the time of the crash. The data was subsequently shown to have been fabricated: the flight paths depicted were impossible given known radar limitations, and at least one of the depicted aircraft had registration data inconsistent with any known Ukrainian military aircraft.

Social media accounts — many subsequently identified as part of coordinated networks — produced detailed analysis of blast patterns, wreckage photographs, and flight trajectory data, each designed to appear as citizen investigation while pointing toward non-Russian responsibility. The appearance of grassroots investigation was engineered.

The Long-term Entrenchment Phase (2014–2022)

As the Joint Investigation Team produced its findings — the 2016 report establishing Russian involvement in principle, and the 2019 report naming the specific missile unit — Russian information operations shifted again. The new focus was not providing alternative explanations for who was responsible but attacking the credibility of the investigators: claims that the JIT was politically compromised, that its evidence chain had been manipulated, that Western governments had influenced its conclusions. The target was no longer the specific question of MH17 responsibility but the epistemic authority of the institutions conducting the investigation.

This shift is diagnostic. When the specific false claims about an event become harder to maintain in the face of evidence, the operation moves to attacking the institutions that produced the evidence. The goal remains the same: not to convince audiences that Russia is innocent, but to prevent the crystallization of confident public belief that Russia is responsible.

The Ukraine Disinformation Campaign: Scaling the Doctrine

MH17 was one operation within a much larger information warfare campaign running alongside and in support of Russia's military intervention in Ukraine. The broader campaign illustrates the full scope of the firehose doctrine at strategic scale.

Narrative Themes

Research by the NATO StratCom Centre of Excellence, Bellingcat, StopFake, and the Atlantic Council DFRLab catalogued thousands of specific false narratives promoted by Russian state-affiliated channels about the Ukraine conflict. These narratives operated across several interconnected themes:

Neo-Nazi characterization. Ukrainian government, military, and political figures were consistently characterized as neo-Nazis in Russian state media, official government communications, and social media operations. Specific incidents — photographs taken out of context, selectively reported events, fabricated testimonies — were deployed to support this characterization. The goal was not to establish that the Ukrainian government was literally composed of Nazis but to prevent the formation of an international consensus sympathetic to Ukraine's position.

Western-puppet characterization. The Ukrainian government was simultaneously characterized as a puppet of Western powers — NATO, the CIA, George Soros — installed by a U.S.-engineered coup during the 2014 Maidan revolution. This narrative served to delegitimize Ukrainian sovereignty and frame any Western support for Ukraine as evidence of the puppet relationship rather than as support for an independent state under attack.

Humanitarian crisis manufacturing. False reports of Ukrainian military attacks on civilian infrastructure, hospitals, and schools in Russian-controlled or Russian-aligned areas were systematically circulated — often with photographs taken in other conflicts or manipulated images — to create the impression of Ukrainian military atrocities preceding and justifying Russian military operations.

Russian-speaker persecution narrative. A sustained narrative maintained that Russian-speaking populations in eastern Ukraine were being persecuted by Ukrainian authorities — subjected to language discrimination, cultural erasure, and violence — in a manner that required Russian intervention for their protection. This narrative was central to Russian justifications for both the 2014 intervention and the 2022 invasion.

What Is Distinctive About This Operation

Several features of the Ukraine campaign distinguished it from even sophisticated predecessor information operations:

Multi-modal simultaneity. The campaign integrated print, broadcast (RT, Sputnik), social media (coordinated account networks), diplomatic communications, official government statements, and covert media placement in foreign press simultaneously. The same narrative was supported by evidence fabricated across multiple independent-appearing channels, creating the impression of convergent independent verification.

Prebunking of rebuttals. The campaign included operations specifically designed to preemptively discredit anticipated rebuttals: framing Western verification of Russian military involvement as Western propaganda before the verification was produced, so that when the evidence arrived, audiences who had been exposed to the preemptive rebuttal interpreted the evidence through the frame the preemptive rebuttal had established.

Exploitation of genuine uncertainty. Many information operations succeed by exploiting genuinely uncertain situations. The Ukraine conflict involved genuine complexity — Ukraine did have nationalist movements, did have documented corruption, did have internal political divisions — and Russian information operations systematically exploited these genuine features of Ukrainian society as entry points for false or exaggerated narratives. The presence of genuine ambiguity made the false claims less obviously false.

The 2022 Invasion: The Doctrine at Full Scale

The February 2022 full-scale invasion of Ukraine provided the most comprehensive demonstration of the firehose doctrine in operation. Russian information operations in the months preceding the invasion deployed the established narrative framework — denazification, NATO expansion threat, persecution of Russian speakers — at high volume to prepare the international and domestic information environment. The goal was not to convince Western audiences that Russia's case was correct but to prevent the formation of a clear, confident international consensus against the invasion before it occurred.

The operation partially failed. International consensus against the invasion formed faster and more durably than Russian planners appear to have anticipated — suggesting that years of documented, publicized Russian information operations had, in some markets, produced the prebunking effect (warning about the technique before it is deployed) that Paul and Matthews describe.

But it succeeded significantly in the domestic Russian information environment, where state media control is near-total, and in specific international markets where distrust of Western governments had been cultivated over years: parts of the Global South, communities with strong ideological antipathy to U.S. foreign policy, and audiences reached by RT's multi-language operations.

Research Resources

Bellingcat (bellingcat.com): Produced definitive open-source investigation of MH17, Russian military involvement in Ukraine, and numerous documented disinformation campaigns.

StopFake (stopfake.org): Ukrainian-based fact-checking organization tracking Russian disinformation targeting Ukraine and Central/Eastern Europe.

EU vs Disinfo (euvsdisinfo.eu): EEAS-operated database of documented Russian disinformation cases, including extensive Ukraine-related entries.

Joint Investigation Team MH17 website (prosecutionjit.org): Official criminal investigation website with full documentation of findings.

Discussion Questions

1. The MH17 information operation shifted from providing alternative explanations to attacking the credibility of investigators as evidence accumulated. What does this shift reveal about the operation's ultimate strategic goal?

2. The chapter argues that the firehose model achieves its goals through "confusion, not conviction." Looking at the Ukraine disinformation campaign, identify two specific examples where the goal appears to be preventing the formation of confident conclusions rather than producing specific false beliefs.

3. The 2022 invasion information operation "partially failed" in Western markets but succeeded in the domestic Russian and some international markets. What factors might explain these differential outcomes? What does this suggest about the relationship between information warfare effectiveness and the target audience's existing information environment?

4. Compare the MH17 operation's initial rapid deployment of multiple contradictory explanations with the Big Tobacco model analyzed in Chapter 26. In what respects do they share strategic logic? In what respects is the firehose model a more aggressive or comprehensive version of the manufactured uncertainty strategy?

5. The chapter's Action Checklist (Section 39.14) lists several technical and content indicators of state-sponsored information operations. Apply this checklist to the MH17 operation as described here. Which indicators are present? Which are absent or not observable from the available description?