MH17: The Buk videos are fake

February 23, 2016
Sergey Mastepanov

Time to read —1 hour

Introduction

There are only four photos and three videos of the alleged separatists’ Russian Buk launcher. Most of them were uploaded to the social media within hours after MH17 was shot down, others were published elsewhere within days. A website called Bellingcat uses them as evidence of Russia’s and separatists’ culpability in the MH17 case. The photos were examined in my previous article. This article is about the videos (Picture 1).

It is possible to not only fake certain photos, but to also fake certain videos with the help of software. Just because the source of the material is a social media site, it does not mean that the material is authentic by default nor that the uploader doesn’t serve someone’s interests. Social media can be used to anonymously spread disinformation, fake photos and videos. It also allows certain entities to upload their own fake material, to show it later at a press conference and claim that its source is social media.

In order to determine the authenticity of a video uploaded to the internet, it is helpful to first check the account’s activity and creation date and to find out if it is possible to reach the author. If the account is new, anonymous, has no activity, doesn’t respond to messages, then the account was made for only one purpose — to anonymously spread the video and to not answer any questions. Of course, the video itself is more important. Since fake videos are usually made under time constraints, it is sometimes possible to spot inconsistencies, for example, with the weather or to see specific video artifacts. Finally, it is helpful to know certain photo and video manipulation software, how to create fake videos, and to know the software’s limits: what fakes can be made relatively easy and what is near impossible (without the help from Hollywood).

If you look to the right and read the table of contents, you will notice that the article is divided into three main sections. Each section is dedicated to a specific video and has subsections explaining where on YouTube you can download the video with the highest resolution, what are the coordinates of the area shown in the video, the video’s history (who was the first to upload it, what title it had, when it was removed, who provided the coordinates, who showed it at a press conference, etc.), and what is wrong with the video. The last subsection (“How to fake”) shows the relevant video, but into which a new vehicle was added. It was done to show how it is possible to add vehicles into these videos. It also roughly explains the process.

It is recommended that the article be read from start to finish, because some subsections rely on information presented earlier.

Note that you can save the videos from this article by right-clicking on them and choosing “Save video” (you might need to play the video first). You can then watch them with software, such as “VLC media player.”

Summary

All three videos have problems suggesting that the vehicles, including the Buk launcher, were added into the videos with the help of photo and video manipulation software, such as Adobe Photoshop and Adobe After Effects. The vehicles in the videos are most likely just photoshopped images. The videos have common characteristics: the vehicles have low picture quality and are blurry, they are shown at a far distance (excluding the Luhansk video), at a limited angle, you cannot see the wheels spinning of any vehicles, and in two videos, the truck with the Buk are visible only for about four seconds. Two videos were uploaded by anonymous accounts that have no other videos, one of which was created on the day of the incident. The third video was uploaded by Ukrainian officials. Evidence exists of deliberate deception by Ukrainian officials concerning the location of the area shown in the Luhansk video.

Snizhne video. The copy at the highest resolution (1088 x 1920) shows a video artifact when the Buk is moving behind the tree, which looks like something that can appear due to an error in the fake video-making process in After Effects, rather than because of some video compression. The video was uploaded to YouTube by an anonymous account within a few hours after MH17 was shot down. The account was created on the same day and has no other activity. The video’s title said that this is the weapon that shot down MH17, as well as the place (Snizhne), and the date (July 17, 2014). The uploader removed the video within a few hours. The head of the Security Service of Ukraine showed the video the next day at a press conference.

Zuhres video. In the video, the wind is blowing from the south, but in Zuhres, on the day when this video was allegedly recorded at (July 17, 2014), the wind was blowing from the east or northeast. In the stabilized version of the video, the truck and the Buk look like mostly just an image moving from one location to another. The video was uploaded on July 17, 2014 on YouTube, had no description, and had “IMG 0647” as title. The uploader added the description between July 23 and July 27, 2014, which said, “coordinates of this and other videos: [link].” The account is anonymous and has no other videos. Between July 17 and July 22, 2014, a Twitter user named 3Andryu sent a message to a blogger named Ukraine@War that had the link to the Zuhres video and details, such as the coordinates, the date and time the video was recorded at. The tweet was retweeted by another user to Bellingcat on July 22. There doesn’t seem to be any copies of this video uploaded to YouTube before July 21, 2014, which means that the public was not aware of the video until around July 22, 2014. On July 19, 2014, Ukrainian spokesman showed a cropped screenshot from the Zuhres video at a press conference before the video was publicized, but not the video. He also did not say that it was Zuhres and showed a tank and a truck loaded with people that look like they are a part of the Zuhres video, but the Zuhres video does not show these vehicles. The video uploader removed the video from YouTube in March 2015. Twitter account named 3Andryu or his tweet with the video’s details were deleted by August 28, 2014.

Luhansk video. The video is of low quality and is blurry, just like the truck with the Buk. You cannot even see the wheels spinning. It shows the vehicles at a limited angle for only four seconds. It is possible to create the animation of the truck and the Buk as seen in the video with just having one photoshopped photo of the truck and the Buk. The Buk has its back covered, but is clearly advertising the missing missile. Based on the truck’s direction and the road shown in the video, the truck would have to come from the west of Luhansk via road M04, but according to Kiev’s own military map shown at a press conference on July 18, 2014, Kiev's forces were right by Luhansk city, to the west and to the north of it. Since according to Ukrainian officials, this Buk was in Snizhne the day before and was being transferred to Russia after it shot down MH17, moving it from Snizhne to Russia via a major city of Luhansk makes no logical sense, as this is not the safest nor the quickest route. It was uploaded on July 18, 2014 to YouTube by Ukrainian Ministry of Internal Affairs and was allegedly recorded by Ukrainian surveillance team on the same day. The day before, Ukrainian spokesman said during a press conference, which was held about 30 minutes after MH17 was shot down, that they know that separatists have Buk and that they even have a video of [it] recorded in Luhansk, but there are no other publicly known videos of Buk in Luhansk except this one. Ukrainian officials have claimed that the video was recorded in Krasnodon, not in Luhansk city. On July 18–19, disinformation appeared on the Russian internet concerning the location of the video, claiming that the city is Krasnoarmeysk. The coordinates of the area shown in the video (Luhansk city) were revealed by Ukrainian official in a Facebook comment on July 22, just a day after Russia’s MoD briefing.

Zuhres video

The video shows a moving truck carrying a Buk launcher for about four seconds in Zuhres, Ukraine (Video 1).

Where to download

The highest resolution of this video is available at 1920 x 1080 (1080p), at 29.97 frames per second.

The original YouTube video was deleted. Most of the re-uploaded versions only have 720p resolution or lower, but a blogger named Ukraine@War has downloaded the 1080p version when it was available and uploaded it to his YouTube channel on July 3, 2015.

Location

Zuhres, Ukraine (Picture 2).

History

The earliest known source is this deleted YouTube video. A link to the YouTube video with the same video ID can be found, for example, on Bellingcat’s and on Ukraine@War’s pages.

If you go to archive.org and enter the link of this deleted video, you will see that the Internet Archive website took a snapshot of the video's YouTube page on July 23, 2014 (Picture 3, top half). The snapshot tells us that the video was uploaded on July 17, 2014, it had “IMG 0647” as title, it had no description, and it was uploaded by someone named “Adrei And” (Picture 3, bottom half).

The Internet Archive also made two snapshots on July 27, 2014. If you click on either one, you will notice that now the video has a description (Picture 4).

The description, written in Russian, translates into “Coordinates of this and other videos” and links to: http://ukraineatwar.blogspot.nl/2014/07/russian-transport-of-buk-into-ukraine.html

What this all means is that the video was uploaded on July 17, 2014. When the Internet Archive took a snapshot of the page on July 23, 2014, the video didn’t have a description. The video uploader added the description to the video somewhere between July 23, 2014 and July 27, 2014.

Searching YouTube for “Zuhres Buk” (or the Russian and Ukrainian equivalents — "Зугрес Бук" or "Зугрэс Бук") shows earliest Zuhres video copies dated July 22, 2014. It is just a day after Russia’s Ministry of Defense briefing on MH17 and about 5 days after MH17 crashed. This means that the public was mostly unaware of either this video or its location or both until July 22, 2014, because, most likely, someone would have re-uploaded it before July 22 with a more meaningful title. I’m also not aware of any other sources of the Zuhres video with any other title that would have a date of July 17-20.

On July 19, 2014, Ukrainian spokesman showed a screenshot from the Zuhres video during a briefing (Picture 5).

The same picture is present on Ukrainian SBU web page.

The text at the top says in Ukrainian: “Buk-M1 in the terrorists’ column (Donetsk Oblast [province]).”

During the briefing, at 3:03, the spokesman, when talking about the photos shown in Picture 5, says in English: “These are pictures. They were taken on the way of that column. You see there is a tank, terrorists have, then a military vehicle […] and also there was, in that column there was a tug vehicle with this Buk-M1 system.”

So, on July 19, “Ukraine Crisis Media Center” showed a screenshot from the Zuhres video of a truck carrying Buk, but for some reason, they didn’t show the Zuhres video itself (and the public was mostly unaware of it until July 22), and they didn’t say that the location was Zuhres. They showed photos of another truck carrying people and showed a tank, the backgrounds of which make the pictures look like they belong to the Zuhres video, but the Zuhres video itself doesn’t show these vehicles.

There is a screenshot of a Twitter post in Arnold Greidanus’ article “What you see is all there is” (Picture 6).

The name of the author of the tweet shown above, Anrei A (“Анрей А”), is similar to Adrei And, the uploader of the Zuhres video (Picture 3). The Twitter account name is @3Andryu (Andryi, Andrei, etc., is a real name). According to the screenshot, @3Andryu sent a message to @djp3tros (aka @DajeyPetros, aka Ukraine@War, aka Putin@War) that contained not only the same link to the now deleted Zuhres video, but also the exact coordinates, the date and time it was allegedly filmed at (Zuhres, 17.07.14 at 08:40 UTC (11:40 EEST)). The time of this tweet is July 18, 00:06 UTC (03:06 EEST).

The reason why @3Andryu sent a message to @djp3tros (aka Ukraine@War) was probably because of the blogger’s popularity at that time regarding Ukraine and MH17 (for example, Ukraine@War’s tweet about Snizhne video got about 2500 retweets). (Bellingcat was just founded at that time.)

@3Andryu knew about the Zuhres video and some intimate details, such as the location, the date and time the video was allegedly filmed at before the video had a description, which was added on July 23 or later. Therefore, it is possible that @3Andryu is the same person as the uploader of the YouTube video or has a connection to him.

Even though it is hard to confirm the authenticity of the screenshot shown in Picture 6 through open sources (especially the date and time of this tweet), because, for example, Twitter account named @3Andryu no longer exists, there are retweets of that same message that are still online: on July 22, 2014, a Twitter account named @yqxo retweeted @3Andryu’s message to @Brown_Moses (aka @EliotHiggins, aka Bellingcat) (Picture 7).

When was @3Andryu’s account or his tweet with the information about the Zuhres video deleted? In Bellingcat’s article named “Origin of the Separatists’ Buk: A Bellingcat Investigation,” there is the following text and a link that points to some now-deleted @3Andryu’s tweet (Picture 8):

Since the link points to Twitter account “3Andryu” and Bellingcat’s article claims that the tweet is about the Zuhres video and says the same time (“11:40am”) that we see on the screenshot of @3Andryu’s tweet (Picture 6), we can assume that the article points to the same @3Andryu’s deleted tweet with the details about the Zuhres video. The Internet Archive has one snapshot of that tweet dated August 28, 2014. The snapshot tells us that the page no longer exists. This means that @3Andryu’s tweet with the information about the Zuhres video or the Twitter account itself was deleted by August 28, 2014.

When was the original Zuhres video deleted from YouTube? The Internet Archive made a snapshot of the YouTube page with the Zuhres video on March 4, 2015 and on March 31, 2015. On March 4, the video was still available, but the snapshot dated March 31 says, “This video has been removed by the user.” Therefore, the uploader removed the video somewhere between March 4, 2015 and March 31, 2015.

If you visit the page of a YouTube account that uploaded the Zuhres video (“Adrei And”), you will see that the account was created on September 27, 2013. As of December 2015, it has no videos.

The Zuhres video has a shady history. To summarize:

• On July 17, 2014, a YouTube account named Adrei And uploaded the Zuhres video, but the video had insignificant title (“IMG 0647”) and no description. The YouTube account practically had and has no activity.
• Practically nobody knew about the Zuhres video until July 22, 2014, the day after Russia’s Ministry of Defense briefing on MH17. The earliest YouTube videos that had “Zuhres Buk” keywords (or the Russian and Ukrainian equivalents) in the title that I’ve seen are dated July 22, 2014.
• On July 19, 2014, Ukrainian spokesman showed a screenshot from the Zuhres video (first video frame, zoomed-in), didn’t say that it was the city of Zuhres, didn’t show the video itself, but instead said that the Buk was a part of a “terrorist column” and showed photos of a tank and another truck that look like they belong to the Zuhres video, but the Zuhres video doesn’t have those two vehicles (this doesn’t mean that those vehicles are a part of some other video).
• Between July 17, 2014 and July 22, 2014, a Twitter account named @3Andryu sent a tweet to a blogger Ukraine@War with not only the YouTube link to the Zuhres video, but also the coordinates, the date, and the exact time the video was allegedly made at, and before the video had a description. On July 22, 2014, someone retweeted @3Andryu’s message to Bellingcat (which was founded just a week before). The Twitter account @3Andryu or his tweet with the details about the Zuhres video was deleted by August 28, 2014.
• Somewhere between July 23, 2014 and July 27, 2014, Adrei And, the original Zuhres video uploader, added a description to the Zuhres video, which said: “Coordinates of this and other videos: http://ukraineatwar.blogspot.nl/2014/07/russian-transport-of-buk-into-ukraine.html.”
• YouTube account Adrei And that uploaded the original Zuhres video removed the video in March 2015.

Problems

As was mentioned in the History section, the account that uploaded the Zuhres video doesn’t have much activity and currently has no videos. Why did he or she remove the video in March 2015? Why on July 19, 2014, Ukrainian spokesman showed a screenshot from the Zuhres video of the truck and the Buk, but didn’t show the video itself nor say that the area is Zuhres? Why Kiev showed an image of a truck packed with “terrorists” and a tank that look like they are a part of the same Zuhres video and the same military column, but the Zuhres video doesn’t show these vehicles and there are no other such videos showing these vehicles? Why the Zuhres video was not publicized until July 22 (there are no earlier Zuhres copies on YouTube), and how did Kiev find this video? Why the video had a strange title and no description, and why the original uploader of the Zuhres video added the description to the video on July 23, which said, “coordinates of this and other videos: [link]?” To me it looks like Kiev wanted to link separatists with this truck and Buk by showing those three screenshots of the vehicles and making it look like these three vehicles are a part of the same military column. One reason they showed these screenshots of vehicles and not the Zuhres video itself is because the video doesn’t show the truck with separatists and tank, as it is much easier to just create a fake, low quality photo with the needed background and a specific truck loaded with people than to add it to the video.

In the video, based on trees’ movement and the bird being “blown off at takeoff,” you can tell that the wind is blowing from the south (Video 2).

But a weather website suggests that on July 17, 2014, in Zuhres, the wind was either blowing from the east or northeast the whole day. And at the time the video was allegedly taken at (08:00–09:00 UTC (11:00–12:00 EEST), July 17), the wind was blowing from the east and had a strength of about 3–5 m/s (Picture 9).

This was noted by a user named Ole in the comments section of Hector Reban’s article. For other weather sources of that day and other details concerning the Zuhres video, read the “Zuhres” section of Arnold Greidanus’ article.

The wind inconsistency suggests that the video or a part of the video was not filmed on July 17, 2014. But according to the @3Andryu’s tweet sent to Ukraine@War and retweeted to Bellingcat, and most importantly, according to the “western narrative” (the official Joint Investigation Team’s “Call for witness” video, Bellingcat’s articles and the media that quotes him), the Zuhres video was filmed on July 17, 2014. They close their eyes on this wind inconsistency.

Let’s look at the video.

We can only see the truck with the Buk for about four seconds. These vehicles are at a far distance, the angle of the truck and the Buk doesn’t change much, and, just like the video itself, the vehicles are blurry. These facts make it easier to fake such videos.

If you look at the moving truck with the Buk a couple of times in full screen mode in this stabilized version (Video 3) or in Video 2, it looks as if the truck with the Buk is just a photo moving from one location to another.

How to fake

This section will show how the truck with the Buk (and other vehicles) could have been added to the Zuhres video with the help of Photoshop and a video editing software. First, it will show the Zuhres video, where a new military vehicle was added (Video 4). Then it will explain the process.

The military vehicle is called Kornet-D. It was taken from a YouTube video and inserted into the stabilized version of the Zuhres video. Only the following screenshot was used (Picture 10):

First, the background was erased with Photoshop. The back of the vehicle was also made brighter, so that it would look more realistic once it is inside the Zuhres video (Picture 11).

Then transformation, color correction, blur, and other effects both in Photoshop and in the video editing software called Adobe After Effects were applied, turning this big picture of Kornet-D into what you see in the modified Zuhres video (Picture 12).

All the mentioned effects are applied automatically: you can still edit the big version of the vehicle (Picture 11) in Photoshop, but in the video editing software, you see it as this small version with all chosen effects automatically re-applied to it. This feature will be useful to create a certain animation using one technique later on.

With Adobe After Effects, it is easy to make a video animation, where an object, such as this Kornet-D vehicle, is moving from one place to another over a period of time. You pick a start location, the end, and the software calculates all the movement in-between these positions and creates a smooth animation. The software is not limited to just moving objects. You can use the same method to animate many things. For example, the added Kornet-D gets slightly smaller the further it moves. Again, you just set the starting size, then how big or small you want the object to be at specific time of the video, and the software calculates the correct size in-between, so that the object’s size would change gradually. It is like having your own animator.

Now we can make our vehicle move from one place to another, but how to make it appear as if it is moving behind the poles, bushes, and the building? There are at least a couple of ways. But in this case, a technique called layers was used, which After Effects software supports. The first layer will be the original video (Picture 13, b). The second layer will be the image of the added vehicle (Picture 13, c). And the third layer will be on top of the other two and will have all those specific poles, bushes, and buildings extracted from the original video that need to partially or completely hide the added vehicle (Picture 13, d). We stack these layers on top of each other to get the needed result (Picture 13, a, e).

In the original Zuhres video, in the stabilized version (Video 3), or in Video 2, you may have noticed that the truck and the Buk is not just a static photo that is moving. Compare how they look in the beginning of the video (Picture 14, a) with how they look when the truck is about to move behind the building (Picture 14, b).

You can see, for example, that the red trailer's holder at the back moved closer to the Buk, and there are some other subtle animations.

If you look at the version of the Zuhres video with the added Kornet-D vehicle, you will notice that it is also not just one static photo moving. Compare how the vehicle looks at the start of the video (Picture 15, a) with how it looks later (Picture 15, b).

You can see that the wheels at the back have a gap now, as does the missile compartment on the roof. The vehicle itself is at a slightly different angle. And all this transformation happens somewhat smoothly.

How to create such animation? How it was done in this case is, seven more versions of Kornet-D were made in Photoshop (Picture 16) based on Picture 11.

The Kornet-D’s image in the video just gets replaced with these slightly different versions (with increasing gaps between the wheels, etc.) at certain points of time. The video editing software was also configured to smoothly shrink the image of Kornet-D the further it moves.

Notice how imperfect, for example, the seventh version looks in Photoshop at its original size (Picture 17).

And how after downsizing this image, blurring, and applying other effects (which were set just for the first photo and which are automatically applied to other versions of the vehicle), you don’t see most of these flaws in the video (Picture 15, b).

There is another way how to create certain animations from just a photo. It will be shown in the section dedicated to Luhansk video.

To simulate distortions made by a window (you can see similar effects in the original video, too), “glass,” or “lens,” effect was added, for example, at the following spot (Picture 18):

In the original Zuhres video, you can see that the camera is shaking. This effect can be added, too (Video 5).

As for how to simulate this camera movement, you just make the video software’s “virtual camera” smaller and then move the camera in various directions as needed (Picture 19).

Some parts of the video that are close to the border will be cut out, but they are usually not critical.

How hard was it to insert Kornet-D vehicle into the Zuhres video, and how long did it take? In this case, it was easy. I already had some of the skills that are required to accomplish this: Photoshop basics and some experience in creating fake photos. But I knew practically nothing about the video editing software such as Adobe After Effects. I watched a 10-hour video course to learn After Effects basics. Then it took me a couple of days to insert the vehicle as seen in Video 4.

Snizhne video

The video shows a Buk launcher in Snizhne, Ukraine (Video 6).

Since the video has a high vertical resolution, you will not be able to view it at a normal size without special display or software. But the following video is its cropped version and will fit into a standard display (Video 7):

Where to download

The highest resolution of this video is available at 1088 x 1920, at 15 frames per second.

The original YouTube video was deleted. Most of the re-uploaded versions only have 360p or 720p resolution. Luckily, a blogger named Ukraine@War has downloaded the highest resolution version with the right software and parameters during the period when the video was still available. He uploaded it to his YouTube channel on July 14, 2015 after Arnold Greidanus asked him where he got a still from a video, which was of a much higher quality than one could find in any Snizhne video copy available at that time on the internet.

“Free YouTube Download” software was used to download this video at 1088 x 1920 resolution (not to be confused with 1920 x 1080) from Ukraine@War’s channel (Picture 20).

Location

Snizhne, Ukraine (Picture 21).

History

The original video was uploaded to YouTube on July 17, 2014. The video at that link no longer exists. The Internet Archive made a snapshot of that page on July 18, 2014, which says that the video has been removed by the user. This means that the video was removed by the uploader within a day.

In order to determine the title of this deleted video, you can either search the internet for pages that mention the same video ID or use youtubeinmp3.com website and enter the video ID there. That site tells us that the video had the following title, thumbnail, and length (Picture 22):

Translated from Russian, it means: “The murder weapon of Malaysians. Snizhne 17 07 2014.”

The mentioned deleted YouTube video has to be the primary source, because: (a) its title matches the one Ukraine@War used in his re-uploaded version of the same video (in the description of the video, Ukraine@War mentions that he used the original title, and he is one of the few who properly downloaded the video when it was available and who had this video at the best quality); (b) the same link is in the description of a low quality version of Snizhne video uploaded on July 17, 2014 by “Brown Moses” (now known as Bellingcat); (c) Arnold Greidanus came to conclusion that this is the first source through his research; (d) the Internet Archive confirms that the video at that link was removed by July 18, 2014.

Since the video’s title said that this is the “murder weapon of Malaysians,” we can assume that the video was uploaded after MH17 was shot down (but on the same day — July 17, 2014).

In his article, Arnold Greidanus has found that one of the earliest posts on the internet that links to the Snizhne video was made at 17:33 UTC (20:33 EEST) on July 17 (Picture 23).

He also found a tweet made at 18:37 UTC (21:37 EEST) on July 17 that refers to the same video link and says that the video was removed. Therefore, the original Snizhne video stayed online only for about a few hours before the uploader removed it.

Arnold found the account that uploaded the Snizhne video by contacting the owner of a certain video site, who had downloaded the Snizhne video when it was online and who had saved both the original link and the link to the uploader’s account. The Snizhne video’s uploader is someone under a pseudonym of Balodya Familyev (Балодя Фамильев; Balodya is not a real name, but it is close to Valodya, and Familyev means something along the lines of “of last name”). The account is still active, but has no content. It was created on July 17, 2014, on the same day when he or she uploaded the Snizhne video (Picture 24).

The following Brown Moses’ (now known as Bellingcat) post also suggests that the account that uploaded the Snizhne video was new (Picture 25):

For more details, such as possible first post on the internet linking to the Snizhne video, as well as information on what person might have had something to do with this video, read “The BUK Convoy – Snizhne” section of Arnold Greidanus’ article.

On July 18, 2014, Valentyn Nalyvaichenko, who was the Head of the Security Service of Ukraine at that time, showed the cropped Snizhne video during his briefing (Picture 26).

Problems

As was written in the History section, Snizhne video was uploaded by an anonymous account that was created on the day of the incident. The account has no other videos and no other activities. The uploader removed the video within hours. Why would a new anonymous account remove this video or remove it so fast? To me it looks as if someone wanted to either hide the fact that it was uploaded by a new account (to minimize the amount of people noticing this fact) or the video is fake, and the author(s) noticed that the video at the highest resolution clearly shows that it is fake or didn’t expect YouTube to allow to download videos at such high resolution (1088 x 1920).

Based on the video’s title (“The murder weapon of Malaysians. Snizhne 17 07 2014”), the uploader already tells us — just about three hours after MH17 crashed — that it was not an accident or a bomb, not Ukrainian jets, which were actively used in those days, not one of the 60 or so operational Buk launchers, S-300 systems, inherited by Ukraine from the USSR, some of which were ready to shoot down any Russian military airplanes violating Ukrainian air space, but that this specific Buk launcher, allegedly recorded earlier that day in Snizhne, shot down MH17. Why did the uploader use such title? He or she could not have known what has happened to MH17. At minimum, this means that the uploader is neither neutral nor on separatists’ side, as Snizhne was allegedly controlled by separatists at that time. It means that he or she took part in the information war and already blamed separatists for downing MH17 within hours after it crashed.

Let’s inspect the best available version of the Snizhne video, the one at 1088 x 1920 resolution uploaded by Ukraine@War.

Just like the Zuhres video's, Snizhne video's characteristics make it easy to insert vehicles: the Buk is at a far distance, it has low picture quality and is blurry, as is the video itself, and the Buk is shown at a limited angle.

If you zoom in and look at the Buk as it moves behind the tree, you will notice that in the video frame #72, it looks as if part of a tree is missing, as if someone cut it out with scissors (Picture 27).

Compare how the area marked by the orange line in Picture 27 looks in video frames before and after video frame #72 (Video 8).

This area in frame #72 suggests that the video is fake, because it looks like a mistake was made during the video-making process.

In order to understand how such a mistake is possible, you need to roughly understand how a vehicle can be inserted into such videos. The “How to fake” subsection in the Zuhres section explained how approximately it is done when it mentioned the use of layers. The mistake is in the third layer: part of a tree was not properly extracted from the original video in this video frame (the third layer are the trees, poles, and other objects extracted from the original video through which the added image of the vehicle passes that have to partially or completely hide the vehicle as it moves).

In the next subsection, you will see the Snizhne video with an added TOS-1 military vehicle. But as an example of how such mistakes are possible in the video editing software, here is a picture of TOS-1 behind a decently extracted tree (Picture 28, a) and an example where part of a tree (layer 3) was not properly extracted (Picture 28, b):

Someone with experience in inserting vehicles into this type of videos might notice the use of a few video editing tricks.

At the start of the video, the Buk launcher looks as shown in Picture 29, a, b, c until it moves behind a tree (all images in Picture 29 were made at 200% video zoom level). When it moves out of a tree, it looks as shown in Picture 29, d, e.

It not only got smaller, but its angle has changed.

Did we see the smooth transition of this Buk turning from how it looked before the tree to how it looks after? Everything happened under the cover. The trick here is to use one version of Buk’s image in the first phase (before it moves behind a tree; Picture 29, b, c) and then to simply replace the Buk’s image with a new, relatively much different one (Picture 29, d) while it is covered by the tree. This way we don’t need to create the smooth transition, which would be difficult to make in this case.

Snizhne video stops abruptly the moment the Buk launcher is about to move up the hill and to significantly change the angle. This is a good place to stop the video, because it would be difficult to create an animation of such movement with just having a photo of a Buk.

How to fake

Snizhne video with an added TOS-1 military vehicle (Video 9):

Typically, when making such fake videos, the main background video should not have any camera movements. Effects such as this severe camera shakiness and distortions are added (for example, for realism and to make it less obvious that the vehicle is just a slightly animated photo) after adding the vehicles. This makes the job easier and the end result better. But as you see in this example, it is still possible to add vehicles into such videos with severe shakiness and even without stabilizing it first.

The vehicle was added using similar methods as explained in the Zuhres section. A photo showing TOS-1 vehicle at a suitable angle was found on the internet and then it was used as a base to make the following two versions in Photoshop (Picture 30):

And in the video, with the help of additional effects, they end up looking like this (Picture 31):

The image of TOS-1 was just replaced with another one when it was hidden behind the tree.

Of course, in the original Snizhne video, it is not just two static Buk photos that are moving. The Buk has minor animations and its angle changes slightly at certain points. In order to achieve this, you can not only use the techniques explained in the Zuhres example and later in the Luhansk example (where you can cut the vehicle into parts and animate them), but you can use things like poles in the Snizhne video to glue two slightly different images of the Buk together or you can switch certain parts of the Buk (e.g., the right-bottom half) while it is covered by the leafs.

Luhansk video

The video shows a truck carrying a Buk launcher with a missing rocket in Luhansk, Ukraine (Video 10).

Where to download

The highest resolution of this video is 1280 x 720, at 50 frames per second.

The original source of the video is still online.

All of the YouTube copies of this video that I’ve seen have 25 frames per second. But you can download the 50 FPS version from the original source with the following software and parameter (Picture 32):

Location

Luhansk, Ukraine (Picture 33).

History

On July 17, 2014, at 14:00 UTC (17:00 EEST), minutes after MH17 crashed, Kiev held a press conference (video). At 21:03 into the video, a journalist tells the spokesman Andriy Lysenko that there is information in social media that a Buk system was spotted near Snizhne and asks him to comment on this. Lysenko says that it is a serious system and that they have this information. Then at 21:55, a journalist asks the spokesman, “I want you to clarify, do you confirm that the Buk is there somewhere?” The spokesman says, “We have information that systems that can hit airplanes at high altitudes came into Ukraine. Buk system is among them. There was such information. And even on the video [it] was shown there when a column was moving through Luhansk. We all know.”

On July 18, 2014, Ukrainian Ministry of Internal Affairs published an article on the government’s site. They showed screenshots from the Luhansk video, the video itself, and mostly cited what the Ukrainian Minister of Internal Affairs Arsen Avakov wrote that day in his Facebook post. Here is the full translation of the short article:

Both the mentioned article and Avakov’s post link to a YouTube video. It is the Luhansk video uploaded by Ukrainian MIA’s YouTube account. Video’s title translates to: “Militants are moving “Buk” missile system towards border with RF.” According to “YouTube DataViewer,” the video was uploaded on July 18, 2014, at 10:21:11 UTC (13:21:11 EEST).

On the same day, “Ukrainian multimedia platform for broadcasting” has released an article, which looks like the translation of the one that was just translated. In it, they clearly write that in the video, the truck with the Buk is moving via Krasnodon.

Avakov’s advisor Anton Gerashchenko has made a post on FB in German, in which he showed the same video and said that it was filmed near Krasnodon.

On July 18, at 22:37:40 UTC (July 19, 01:37:40 EEST), a copy of the Luhansk video was uploaded to YouTube with a lengthy description and a title in Russian, which translates to: “Junta is moving Buk, which it used to shoot down Boeing, through the city of Krasnoarmeysk” (Picture 34).

The description states that this is a repost from VK social media site and says: “A video is being distributed in Ukrainian social media, which allegedly shows that rebels are moving Buk, which launched [a missile], towards RF. But on the video is the city of Krasnoarmeysk, billboard is visible with advertisement of auto saloon on Dnepropetrovskaya 34. Since May 11 and until this day the city is under control of junta’s troops, conducting ATO!”

Then the description says that on the photo and video with the truck there is a shop Stroydom with address Krasnoarmeysk, Gorkogo 49, that this Buk was on the territory belonging to junta, that everything is clear as day, that Ukrainian army shot down Boeing with this exact Buk, that in order for this video not to become a compromising evidence, Ukrainians say that it is rebels that are moving it, they are liars, and provides some sarcastic examples: Odessans burned themselves [referring to Odessa massacre on May 2], people of Luhansk have exploded an air-conditioner [referring to June 2 air strike in Luhansk city, when Kiev officials said that the area wasn’t bombed by Su-25, but that “the rebel’s anti-aircraft missile reacted to the air-conditioner and exploded”], DNR is shelling their own cities, etc.

If you search the internet for certain words taken from this video’s description, you will find many posts dated July 18–20, 2014 with the exact or similar text (mentioning billboard, Krasnoarmeysk, Dnepropetrovskaya 34, etc.) on Russian social media sites, blogs, and even on some news sites. For example, this VK page has almost the same description, the same video title, but also more other pro-Russian, anti-Kiev sentences.

On July 19, Ukrainian spokesman showed a picture during a briefing that had both a screenshot from the Luhansk video and a screenshot of another truck and Buk (Picture 35).

The spokesman said that these were Russian Buks in Ukraine and that Russia ordered the “terrorists” to move them back to Russia after shooting down MH17. The picture of the bottom-left Buk was quickly debunked by Russian bloggers. Even I remember seeing that video of Ukrainian Buk “312” in March 2014.

According to the Internet Archive, Picture 35 was also on Ukrainian Secret Service (SBU) site on July 21, 2014, but a snapshot of the same page from July 23, 2014 no longer shows it.

On July 19, Ukrainian Minister of Internal Affairs Arsen Avakov added a comment to his Facebook post, which translates to: “Taras, footage was made in Luhansk. With GPS coordinates. There is the name of the street and specific place – I’m just not providing” (Picture 36).

Even though Avakov said in this comment (hidden among dozens or hundreds of other comments to his main post) that the place is Luhansk, there is Luhansk province and Luhansk city. Krasnodon is in Luhansk province. So, “Luhansk” could have been interpreted as either Luhansk city or Luhansk province, because his main post and all other Ukrainian sources said Krasnodon and didn’t say anything about Luhansk.

On July 21, at the end of Russia’s Ministry of Defense briefing, the spokesman repeated what was being said on July 19–20 in the Russian blogosphere, Russian social media sites, and in some news by saying that the place is Krasnoarmeysk (not Krasnodon, as Ukrainian officials were claiming) because of the billboard. The address that the MoD mentioned (Krasnoarmeysk, Dnepropetrovskaya 34) and that was spread on the Russian internet before the briefing, does or did have the same or similar company as shown on the billboard, and there was probably no such company in Krasnodon. The MoD knew this wasn’t Krasnodon, but didn’t know the location, and repeated the popular version regarding Krasnoarmeysk either due to a mistake after doing basic checks (there was a lot of other data to analyze over that weekend) or most likely, this was their way of saying that Ukrainian officials, the source of the video, are bluffing regarding Krasnodon.

On July 22, Avakov added another comment to his Facebook post, which translates to: “To stop empty talk – coordinates of the footage: Coordinates of the place where the military vehicles were recorded: 48.545760°, 39.264622°” (Picture 37).

This is when and how some bloggers have found out where exactly the video was recorded at. The coordinates show a place in the city of Luhansk. Based on other photos of this area that I’ve seen, it does look like the area matches the one in the video (at least the intersection, the cables, and the billboard), and I haven’t seen any alternatives. However, this is not Krasnodon, as the authors of the video were claiming until this point.

There are Western articles that are still saying that this video is showing Buk in Krasnodon. For example, Daily Mail (Picture 38, a) and Paris Match (Picture 38, b).

Paris Match even said that they have on record Ukrainian source saying Krasnodon is the picture’s [screenshot from Luhansk video] location (Picture 39).

In this section, many links were taken from Arnold Greidanus’ article “Re-examining the Luhansk video,” which also has other details.

Problems

According to Ukrainian Ministry of Internal Affairs, they recorded the Luhansk video themselves on July 18. As was mentioned in the History section, why did Lysenko say during a press conference on July 17 and minutes after MH17 disaster that they know that separatists have Buk and that the video showed [it] when a column was moving through Luhansk? If there is some other video with Buk in Luhansk, where is it? Was this video showing Buk and a missing missile actually made before July 18, Lysenko knew about the video, and he made a Freudian slip?

The distance between the city of Luhansk and Krasnodon is about 50 km (Picture 40). Krasnodon is closer to the Russian border.

Why didn’t Ukrainian officials say right from the start that the Buk shown in the video was filmed in Luhansk city? Why did they say that it was Krasnodon? Why the true location, the coordinates pointing to Luhansk city were published by Avakov in a comment on Facebook, hidden among hundreds of other ones, just a day after Russia’s Ministry of Defense briefing? Since it were Ukrainian “secret agents” who recorded the video, they knew the exact location. This looks like a deliberate deception. They probably did not want Russia to know the true location until after Russia’s major briefing aimed at international and domestic audiences. And there are good reasons why. One of which could be because the day before the video was allegedly made, Ukrainian spokesman made a blunder by saying that Ukraine has a video showing [Buk] in a military column filmed in Luhansk.

As was mentioned in the History section, during a press conference, Kiev’s spokesman showed a photo of their own Buk filmed in March 2014 and said that this is separatists’ Buk filmed after MH17 was shot down. If they showed this photo as a mistake, how can such a mistake be possible? If they did it knowingly, I don’t think they are that stupid to show a photo from not only a relatively well-known event (of Ukrainian Buk stuck in March; there were multiple videos), but also a photo that shows Buk’s number — “312,” and where one of the missiles has a red tip (meaning, most likely, that the missile is used for training). The only logical explanation I have is, Kiev wanted to be “caught,” they wanted Russians on the internet and Russia’s intelligence to think — at least before Russia’s July 21 briefing — that since Kiev is showing their own Buk in one case, it is more likely that the Luhansk video is also showing Ukrainian Buk filmed in Kiev-controlled territory. They even put a screenshot from Luhansk video and a photo of Buk “312” on the same picture (Picture 35). Since they showed the photo of this Buk “312” and lied about the location of the Buk in the Luhansk video, it is logical to assume that on July 18–19, it was Kiev who also planted disinformation on the Russian internet regarding Krasnoarmeysk. The point of all of this is probably to make Russia not focus much on the Luhansk video, to make them think until the main briefing that Kiev is bluffing regarding Krasnodon (which was the case) and that in the Luhansk video, just like in the case with Buk “312,” it is another Ukrainian Buk filmed somewhere in Kiev-controlled territory.

In the video, the truck is moving from northwest to southeast (Picture 41, a). If you look at the map of the area (Picture 41, b, c), the most logical and closest road that the vehicle used to enter the city (when taking into account that the same Buk was allegedly in Snizhne, southwest of Luhansk city the day before) is road M04 — west of Luhansk.

However, even according to Kiev’s own map, which they showed on July 18, 2014 in a press conference (Picture 42), territories painted blue and yellow of Donetsk and Luhansk regions were already under Kiev’s control at that time, and Ukrainian forces were right by Luhansk city, to the north and to the west of it.

According to the authors of the Luhansk video, Moscow ordered the Buk to be sent to Russia and that this same Buk with a missing missile shot down MH17 the previous day. It would have to be moved from Snizhne, near which it allegedly launched a missile at MH17, to the Russian border in the east, because all other border crossings were under Kiev’s control (again, according to Kiev’s own map). However, the movement through Luhansk city makes no sense, as the following map with one of the possible escape routes from Snizhne to Russia shows (Picture 43):

The truck with the Buk would have to travel from Snizhne to Luhansk city, from Luhansk to Russia. This would be around 160 km (Picture 44). But there are no other photos or videos from either dash cams or city cameras allegedly made after MH17 was shot down showing the Buk launcher except this Luhansk video.

Let’s look at the video.

The video shows the Buk launcher with a missing missile, but the Buk’s back is covered. Since the video was allegedly made about twelve hours after MH17 crashed, the driver is aware of what happened. Let’s pretend that you are one of the separatists and you shot down MH17 by accident. Would you then take this strange and dangerous route, cover the Buk’s back, but not the missiles, and parade the Buk with a missing missile in a major city, such as Luhansk? I don’t think so.

The video and the vehicles are of low picture quality and are blurry (Picture 45). You can’t see neither the numbers on the number plates (Picture 45, a), nor the big telephone number on the yellow plate of the truck, which should be there according to the Paris Match photos (Picture 45, b). You can’t even see the wheels of the truck spinning when the truck is moving.

One explanation regarding the numbers is motion blur, but the truck is not a racing car to be moving too fast, and this video is running at 50 frames per second, meaning the camera was making 50 pictures per second. I think the numbers in this case should be visible, especially when taking into account that it was allegedly recorded by Ukrainian "surveillance team."

You can only see the truck with the Buk for about four seconds (not hidden behind the trees and bushes) and only at the following area (Picture 46):

Other parts of the road are hidden behind the trees, and the vehicles in the video are at a certain limited angle. This is convenient in case we want to add a truck with the Buk to the video using similar methods that were shown in Zuhres and Snizhne sections, where the added vehicles are actually just photoshopped photos.

How to fake

The following example is far from perfect for a number of reasons, but I think it is good enough to make a point (Video 11):

The truck that was added is actually a screenshot of a (not so great, but free) 3D model found on the internet, further modified with Photoshop. I wanted to use a screenshot from a 3D model in this example, because it is my opinion that the truck with the blue line exists only as a 3D model, and that the model was used to make all the known photo and video materials that show it, including the "joker" video and two other known photos, where the truck is without Buk (one of which has a very high resolution). One advantage of using a 3D model instead of a real photo of a unique truck in fake materials is that there are less certain risks. For example, what if we are making a story about some separatists' Buk and creating a fake video with it at one location, but then some camera films this unique truck at that time being elsewhere? Another advantage is that you can easily get a screenshot of the truck at any needed angle at any time to make more materials if needed.

Of course, in the Luhansk video, even though you can’t see the wheels spinning, it is not just a static photo of the truck and the Buk moving. The vehicles’ angle changes slightly over time and there are other small animations of the areas, for example, marked in Picture 47.

In the Zuhres example, in order to create a small animation, seven other versions of Kornet-D vehicle were made that are at a slightly different angle, but it would be difficult to use that method in this case. However, there is another way. The following video shows what animation you can create in After Effects and Photoshop when you only have one photo as a source material (Video 12):

Video 12 mimics some of the animation of the truck and the Buk as seen in the Luhansk video. You can see that the angle of the vehicle slightly changes over time. And the only material that was used to create this animation is one photo — the first video frame of Video 12.

How it was done: First, the whole image was cut into separate pieces: the truck, the Buk, the missile, parts of cover, etc. Then they were combined in the video software to form the whole image. This gave extra control over certain parts of the vehicles (for example, this allows to create an animation, where part of the truck's cabin is moving behind the Buk). Then on top of the standard video software effects, such as movement and rotation, an effect called “Mesh Warp” was used, which allows you to shrink or stretch parts of images over time.