Case Study 21-1: Bellingcat and the MH17 Investigation — When Open-Source Imagery Became Evidence

Background

On July 17, 2014, Malaysia Airlines Flight 17 was shot down over eastern Ukraine while en route from Amsterdam to Kuala Lumpur. All 298 people aboard were killed. The aircraft came down over territory controlled by Russian-backed separatists. Almost immediately, competing narratives emerged about who was responsible — the Ukrainian government, Russia, and various proxy actors each offered different accounts. The Russian government denied any involvement and suggested Ukraine's own military had shot down the aircraft.

Within days of the crash, a British blogger named Eliot Higgins, who ran a site called Brown Moses documenting weapons used in the Syrian civil war, was already applying his open-source methodology to the MH17 evidence. Higgins would formalize this work into Bellingcat, an investigative journalism collective that would go on to produce some of the most rigorous and consequential accountability journalism of the 2010s — almost entirely through publicly available information.

The Investigation

The core of Bellingcat's MH17 investigation focused on a single question: could the specific Buk surface-to-air missile launcher that downed the aircraft be traced to a specific origin?

Step 1: Social Media Geolocation

In the hours before the shootdown, social media users had photographed and filmed a military convoy moving through eastern Ukraine — including a vehicle that appeared to be a Buk missile launcher. Using Google Maps, Street View, and local geographic features visible in the photographs (specific buildings, road signs, distinctive trees), Bellingcat researchers geolocated each photograph to a specific GPS coordinate. The convoy's route could be reconstructed from social media posts by ordinary people who happened to be present as it passed.

Step 2: Satellite Imagery Analysis

Here is where satellite imagery became central. Bellingcat obtained commercial satellite imagery of military installations in Russia — specifically, the 53rd Anti-Aircraft Missile Brigade based in Kursk, Russia. By comparing satellite imagery of the base before and after July 17, 2014, analysts counted Buk launchers visible in parking areas. Analysis showed one launcher was absent from the base in imagery taken after July 17 — and later returned.

The imagery also enabled comparison of specific identifying features. The particular Buk seen in eastern Ukrainian social media posts bore specific damage and distinguishing characteristics — a missing panel, distinctive coloring — that matched imagery of a specific vehicle from the Kursk base, visible in open-source photographs and satellite imagery predating the crash.

Step 3: Cross-Referencing and Corroboration

Satellite imagery alone would not have been sufficient. Bellingcat corroborated the satellite data with: - Social media photographs by Russian soldiers posted to their personal accounts, geolocated to the Kursk base - Russian government media coverage that inadvertently showed the same distinctive Buk in a promotional broadcast - Flight path modeling by Boeing and commercial aviation analysts - The investigative findings of the Joint Investigation Team (JIT), a formal law enforcement body comprising investigators from the Netherlands, Australia, Belgium, Malaysia, and Ukraine

The Outcome

The Joint Investigation Team formally concluded in 2019 that MH17 was shot down by a Buk missile from the Russian military's 53rd Anti-Aircraft Missile Brigade. Four individuals were indicted — three Russian nationals and one Ukrainian national — for their roles in the shooting. The Russian government continued to deny involvement.

Bellingcat's parallel investigation reached the same conclusion, and its findings were consistent with and partially incorporated into the JIT's formal work. It was the first time that open-source investigation, anchored in part by commercial satellite imagery available to anyone with internet access, had contributed materially to a formal international criminal investigation.

Analysis

Satellite Imagery's Role in the Accountability Chain

The MH17 case demonstrates what the chapter calls the democratization of surveillance power. The satellite imagery used in the investigation was not classified. It was not obtained through government intelligence channels. It was purchased from commercial providers — or in some cases accessed through free platforms — by civilian researchers with no formal law enforcement authority.

This democratization had a specific political effect: it made denial by the Russian government harder to sustain. In previous eras, a government could claim that foreign accusations were based on classified intelligence — possibly fabricated or mischaracterized. When the evidence is commercial satellite imagery that any journalist or member of the public can access and evaluate, that denial strategy fails. The evidence is open; the methodology is transparent; the conclusions are reproducible.

Discussion Point: The chapter distinguishes between the democratization of surveillance tools and the equalization of surveillance power. How does the MH17 case fit this distinction? Bellingcat is not a government, but neither is it a marginalized community being surveilled. Who benefited from the democratization of satellite imagery in this case?

The Limits of Open-Source Evidence

Despite Bellingcat's success, the MH17 case also illustrates the limits of open-source satellite evidence in accountability contexts. Four individuals were indicted — but as of 2024, none had been prosecuted. Russia did not extradite anyone. The formal legal system could not fully leverage the evidence that open-source investigation produced, in part because the suspects were in a sovereign nation that denied jurisdiction.

Satellite imagery and open-source evidence can establish facts at the bar of journalistic and public opinion. Whether it can establish facts at the bar of international criminal law is a different question — one that depends on political will, jurisdictional authority, and the willingness of states to cooperate with international legal processes.

Function Creep in Reverse?

The chapter discusses function creep as the phenomenon of surveillance tools expanding beyond their original purpose. The MH17 case presents an interesting inversion: commercial satellite imagery designed for agricultural monitoring, weather assessment, and mapping was repurposed for international criminal investigation. This is function creep in a potentially positive direction.

But the precedent is worth examining. If commercial satellite imagery can be used to investigate military crimes, it can also be used to surveil political dissidents, track the movements of journalists, or monitor religious gatherings. The same openness that enables accountability journalism enables other uses. The technology does not select its applications.

Discussion Questions

1. The Bellingcat methodology depends on the availability of commercial satellite imagery to the general public. What would the implications be if satellite imagery access were restricted to government agencies and licensed institutions? Would the accountability benefits of open access outweigh the privacy risks?

2. Russia's denial of MH17 involvement was ultimately unsuccessful — not because a government intelligence agency exposed it, but because civilian researchers using publicly available tools did. What does this suggest about the future of propaganda and disinformation in an era of ubiquitous satellite coverage?

3. The chapter argues that satellite surveillance serves simultaneously as a tool of accountability and a tool of repression. Using the MH17 case as a foundation, identify one concrete scenario in which the same open-source satellite investigation techniques could be used in a way that is harmful to civil liberties rather than protective of them.

4. The Joint Investigation Team — a formal legal body — incorporated open-source findings into its official investigation. What standards of evidence should govern when open-source satellite imagery is used in formal legal proceedings? Who should verify it, and how?

5. The MH17 victims included citizens from many nations, including Australia, the Netherlands, Malaysia, and others. The perpetrators were Russian nationals protected by Russian sovereignty. How does this jurisdictional complexity affect the ability of satellite imagery evidence — however compelling — to produce legal accountability?

This case study connects to Chapter 33 (activist and journalistic uses of surveillance tools) and Chapter 38 (AI-assisted image analysis).