Within the first two days after the downing of Malaysian airliner MH17 on 17July 2014, Russian Internet trolls had posted at least 65 thousand tweets trying to blame Ukraine for the disaster. This appears to have been a concentrated ‘false flag’ operation, but one that was already belated and, ultimately, pointless given the evidence of Russian involvement. The trolls had already, fleetingly, followed the militants in Donbas, and Russian television in boasting that the militants had shot down a Ukrainian military plane. Those reports make the record-breaking attempt by Internet trolls to shift the blame onto Ukraine even more incriminating.

Two Dutch researchers, Robert van der Noordaa and Coen van de Ven, have carried out a vital study into disinformation about MH17, with the first half focusing on the Twitter activities of the so-called Internet Research Agency, otherwise known as the Russian troll factory. This ‘agency’, with something like 400 employees, is reportedly funded by Yevgeny Prigozhin, a person with a serious criminal record who owes his present billionaire status to his close ties to Russian President Vladimir Putin.

Although Twitter made 9 million tweets available in 2018 in connection with concerns about interference in the US elections, this study, published by De Groene Amsterdammer, shows that the greatest surge in troll activity was, in fact, over MH17. There has been nothing since to match the activity on the day of the MH17 downing and the next two days.

It is telling, although no surprise, that the first tweets gave a quite different message. Within minutes of the plane’s downing, Russian television and other media reported that the militants in Donbas had downed a Ukrainian military airplane, and even showed the video footage. The footage began being removed, as well as some of the incriminating texts, swiftly as Moscow realized all that it had to conceal. No Ukrainian plane was shot down that day, and the footage that the Russian funded, armed and manned militants had shared, was demonstrably that of the shooting down of MH17.

There was similar confusion of narratives on Twitter. The first tweets did say that a Ukrainian plane had been shot down, and that the militants were behind this. Then at 17.40 Kyiv time (18 minutes after the plane was hit), a troll retweeted a Federal News Agency report indicating that the plane that had “crashed” was a Malaysian airliner. One rather sleepy troll at 18.14 reported that a Ukrainian AN26 (military plane) had been shot down, but used the hashtag #MH17!

Three minutes later, at 18.17, the trolls began both blaming Ukraine and trying to cast doubt as to who was behind the disaster. The first tweet with this new version asks in Russian “how long the junta will shed blood” and also has the MH17 hashtag. There were more and more of these anti-Ukrainian tweets, and by the morning of 18 July, the key claim touted was that Ukraine had itself shot down MH17 as ‘provocation’.

By around 11.00 (Kyiv time), three hashtags in Russian had been launched: #КиевСбилБоинг (“Kyiv downed the Boeing”); #ПровокацияКиева (“Kyiv’s provocation”) and #КиевСкажиПравду (“Kyiv, tell the truth”). 71% of all tweets from the troll factory (almost 41 thousand) went out with at least one of these hashtags on 18 July, and almost 25 thousand the following morning.

This ‘operation’ had thus lasted less than 24 hours before ending very abruptly. Although the trolls would continue to write about MH17, it was never again with such intensity, and never using those hashtags. The activities were also different from the norm in that the trolls actually wrote their own messages, rather than simply retweeting or copy-tasting the views they wanted to push. That is what they normally do on other subjects, such as the terrorist attack in Brussels or the debate regarding vaccination. Here the trolls either wrote their own tweets, or made up texts on LiveJournal (a platform actively used by the troll factory, and then shared the links to those on Twitter. The study found that 14% of all troll factory tweets on the day after the downing of MH17 gave links to LiveJournal. More than a third of those retweeted stories have since been removed.

The authors of the study illustrate the techniques used by the troll factory with the most popular story on 18 July. This was a blog from somebody called Katya Timofeeva who reported that a supposed Spanish air traffic controller, called Carlos, had tweeted shortly after the plane was downed that he had spotted two fighter jets near MH17. Within six minutes of the tweet from Timofeeva, who does not herself have many followers, it had been retweeted almost a hundred times. There are no grounds for believing this to have been mere chance. The Spanish RT (the Kremlin-funded Russia Today channel which broadcasts in many countries) was swift to interview ‘Carlos’, whom they claimed had worked for five years at Kyiv’s air traffic control. In March 2018 Radio Free Europe / Radio Liberty provided proof that the individual was not called ‘Carlos’ and was no air traffic controller. He had proved to be an ex-convict, prosecuted both in Romania where he was living, and in Spain, for fraud.

It is no accident that such effort has been expended on disinformation about MH17, as well as why Russia used its power of veto in the UN Security Council to block an international investigation into the disaster. On 24 May 2018, the Joint Investigation Team [JIT] published an absolutely damning report which concluded that “the Buk missile which downed Malaysian airliner MH17 on 17 July 2014 came from the 53rd Anti-Aircraft Missile brigade which is a unit of the Russian army from Kursk in the Russian Federation”. … “JIT presumes that within the 53rd brigade and within the circle around it, people have knowledge about the operation in which that particular BUK-TELAR was deployed and about the persons that were involved in it.”

JIT had already stated back in September 2016 that the Buk missile which downed Malaysian airliner MH17 over militant-controlled territory in Ukraine came from Russia. It now clearly identified its source as directly linked with the Russian Armed Forces and said that the combination of features it studied to reach its conclusion are “so special that that can be considered as a fingerprint”.

This is surely direct proof that Russia supplied weapons used to down a civilian airliner, in violation of both the 1971 Montreal Convention and the International Convention for the Suppression of the Financing of Terrorism . The latter is of particular importance given the case brought by Ukraine against Russia at the UN’s International Court of Justice [ICJ] at the Hague (details here). Russia is already also facing two collective claims before the European Court of Human Rights. Both groups of applicants complain under Article 2 (the right to life) that Russia is responsible for the downing of flight MH17 and the death of their relatives, either directly or through the acts of Russian separatists under their control. The applicants also accuse Russia of failing to conduct a proper investigation and to bring those responsible for the downing of MH17 to justice, as well as of refusing to cooperate with the investigations led by the Dutch Safety Board and the Joint investigation team in the Netherlands.