The horror of the MH17 atrocity was peculiarly intimate: in the debris fields, stuffed toys spilled from children’s suitcases. It briefly brought Ukraine’s war into focus in a way that Russia’s misdirection over the annexation of Crimea, or their murky fight in the farthest corner of Europe, had failed to do. However, a deeper and wider war remained concealed.

Andrei Illarionov was Putin’s senior economic advisor, and personal representative to the G8 for five years, until he resigned in protest at growing corruption. Two months before the downing of MH17, he called Ukraine “an introductory chapter” in “the Fourth World War.” (Stalin’s dismal term for the Cold War was “World War Three.”) Illarionov dislikes the phrase, but he says it’s being used “by the Kremlin propaganda machine” for a war “being waged now by Russia against the rest of the world.”

“You may not be interested in war, but war is interested in you.”

It took the weaponization of information in the 2016 U.S. presidential election for the Western world to start to notice. We now know of e-mails stolen from the Democratic National Committee by Russian hackers, of sophisticated botnets, of similar attacks across Europe; but the full extent of Russia’s activities is still being uncovered. Realizing that we are at war, and understanding how we can fight back, is now urgent business. The story of MH17, and Russia’s exposure, offers a grim but useful case study.

The biggest crime scene in the world

Members of the Ukrainian State Emergency Service search for bodies in a field at the crash site of Malaysia Airlines Flight MH17, near the village of Hrabove (Grabove) in the Donetsk region, on July 26, 2014.

The Bloodlands are wetted again

Smoke rises from a building damaged during fighting between Russian-backed separatists and Ukrainian government troops on July 21, 2014, in Donetsk, Ukraine.

Devices of disinformation

As with the Soviets’ shooting down of Korean Air Lines Flight 007 in 1983, when 269 died, Russia’s reaction to the international outrage over MH17 was to contrive and deliver counternarratives. A buzzing and growing cloud of ever-changing claims emerged—placing the blame on a Ukrainian fighter jet, Ukrainians on the ground, or the CIA, or claiming that Putin’s private plane was the real target. Russia’s tactics, says Ben Nimmo, senior fellow in information defense at the Atlantic Council’s Digital Forensic Research Lab, rely on what he calls “the 4D approach”: “Dismiss, distort, distract, dismay. Never confess, never admit—just keep on attacking.”

Irregular forces

During the 2014 Crimean crisis, soldiers at Ukraine’s Perevalne military base displayed no insignia or badges of rank, but they included Russian troops.

“The single most prevalent Russian response is to attack the critic,” he says. “They use a ‘vilify and amplify’ technique.” Critics are besmirched, sometimes in an official announcement, sometimes through proxies, sometimes through anonymous sources quoted in state media; then paid trolls and highly automated networks of bots add scale. In response, an ad hoc blend of civilians, private companies, and NGOs has evolved to cast a bright, shining light on MH17 and Russian aggression in Ukraine, Syria, and the Atlantic partnership. Exemplifying the values Italo Calvino outlined in Six Memos for the Next Millennium—lightness, quickness, exactitude, visibility, multiplicity, and consistency—their methods are in sharp contrast to the West’s generally sclerotic response to a revanchist Russia.

Nowhere is this weakness more brutally apparent than in Russia’s use of digital technology to reinforce its greatest tool of statecraft: maskirovka. The literal translation—“little masquerade”—disguises the density and importance of this elusive concept. “Military deception” misses its deep cultural roots: maskirovka involves camouflage, denial, and a deep finesse. As James Jesus Angleton, the founding counterintelligence chief of the CIA, put it, “The myriad stratagems, deceptions, artifices, and all the other devices of disinformation … confuse and split the West [with] an ever-fluid landscape, where fact and illusion merge, a kind of wilderness of mirrors.”

Disinformation confuses and splits the West with “an ever-fluid landscape ... a kind of wilderness of mirrors.”

The most powerful weapon in the maskirovka armory is disinformation, a word acquired in the 1950s from the Russian dezinformatsiya. A generation after the Cold War, the acknowledged masters of “deza” are deploying disinformation technology against the compromised immune system of liberal democracy. “And at this point,” says Andrew Andersen, a Russian-born security analyst at the University of Calgary’s Centre for Military and Strategic Studies, “the West is losing.”

“The first thing you need to understand is that this is a war,” says Andersen. “This is not a joke and not a game of any kind. It’s not ‘socializing with your friends on social networks’—it’s a real war. Even those who don’t want to take part have to behave in accordance with the laws of war,” he says, alluding to Trotsky’s notorious epigram, recalled by several of the interviewees for this story, that translates loosely as: “You may not be interested in war, but war is interested in you.”

Recovered wreckage

The Dutch Safety Board was able to reconstruct a significant amount of the downed Malaysian Airlines jet.

Even the name of this new style of war is contested territory. “Ambiguous,” “hybrid,” “irregular,” and “nonlinear” warfare have all been suggested. Mark Galeotti, senior research fellow at Prague’s Institute of International Relations, unpicks the issue in his new book, Hybrid War or Gibridnaya Voina? Getting Russia’s Non-Linear Military Challenge Right. He admits to still worrying at it. “The more I think about what we should be calling hybrid war,” he says, “the more I think the answer is: war.”

“The Russians have, fortuitously for them, simply stumbled on a truth of the century.”

“The Russians have stumbled on how the nature of international contestation is changing and will be fought out in the 21st century. It’s an age when direct kinetic warfare [the military’s term of art for ‘things that go bang’] is ridiculously expensive, in political but also economic terms,” he says. “Instead, war will be fought out through a variety of other means, many which are covert, ambiguous, and so on. The Russians have, fortuitously for them, simply stumbled on a truth of the century.”

Foul deeds will rise

Exactly an hour before MH17 took off, Necro Mancer tweeted a tentative identification: “It visually resembles a BUK a lot.” (Buks are a family of Russian-made mobile medium-range surface-to-air missile systems.) A Donetsk man of around 50, he spends “almost all” his free time scanning popular Russian-language social-media sites like Vkontakte (“In Contact”), known as “Russia’s Facebook,” and Odnoklassniki (“Classmates”); listening to pro-Russian channels on the walkie-talkie app Zello; and sharing civilian reports of military activities. As an additional hobby, he uses open sources to curate a list, linked in his Twitter profile, of several thousand Russian and pro-Russian dead, “because they hide them.”

The Great Khan

Vladimir Putin strides down St. George’s Hall in the Kremlin’s Grand Palace during his inauguration ceremony on May 7, 2004.

“I cannot fight as a soldier, so I try to do my best,” he says of a conflict that has led to more than 30,000 casualties and millions displaced. He’s just one of many keyboard partisans in the war dominating Europe’s largest country. After the annexation of Crimea, the subsequent invasion of eastern Ukraine, and the MH17 shoot-down, the world’s scrutiny of Russian behavior in the region dwindled. Yet Ukraine—site of the continent’s first military incursion by a neighbor since Stalin subjugated Eastern Europe behind the Iron Curtain—is, as U.S. Deputy Secretary of Defense Bob Work said in a speech in 2015, “an emerging laboratory for future 21st-century warfare.”

The 34-ton Buk-M1 TELAR (“transporter erector launcher and radar”), and its bodyguard of irregular troops, rolled through the southeast corner of what the Yale historian Timothy Snyder has christened the Bloodlands. Here, in living memory—between 1933 and 1945—a hellish amalgam of Nazis and Soviets (sometimes collaborating, more often at war) were responsible for 14 million civilian deaths. “During the years that both Hitler and Stalin were in power,” Snyder writes, “more people were killed in Ukraine than anywhere else in the Bloodlands, or in Europe, or in the world.”

Half an hour after MH17 took off, another Ukrainian curator, @WowihaY, tweeted that the convoy had passed through his hometown of Torez, 45 miles east of Donetsk, headed to the city of Snizhne. There, the Buk was unloaded from a white Volvo low-loader truck before continuing south under its own power. Passing through checkpoints held by Russian--backed insurgents, it set up in a field and, at 4:20 p.m. local time, fired a 1,500-pound missile 33,000 feet into the air. Carrying a high-explosive fragmentation warhead weighing 154 pounds, it nearly reached Mach 3. On board MH17 were 15 crew and 283 passengers, including 80 children in 20 family groups and a party, led by the virologist and former International AIDS Society president Joep Lange, heading for the 20th International AIDS Conference in Melbourne.

Fighting back

Eliot Higgins, a British investigative journalist, founded Bellingcat so that citizen journalists could investigate current events like the shoot-down of MH17 using open-source information.

The warhead exploded around four meters to the upper left of the airplane’s nose. Dying bodies fell “like confetti” for around 90 seconds. One female victim crashed through the corrugated roof of a house into a kitchen. Autopsies found hundreds of metal fragments in the captain’s corpse, another 120 in the first officer, and a bow-tie-shaped fragment—unique to the Buk-M1’s 9N314M warhead—embedded in one of the flight crew.

For long days, governments scrambled to negotiate access with hostile irregular forces, probably composed of what Galeotti calls “a mix of regular Russian units, ad hoc collections of nationalists and adventurers, and everything in between.” These auxiliaries, largely organized by the GRU (the Russian army’s foreign military intelligence agency), now controlled what a spokesman for investigators with the Organization for Security and Cooperation in Europe (OSCE) called “the biggest crime scene in the world.” The hot sun glittered. It was summer. It was very warm.

Penetrating the smog of war

Three days earlier Eliot Higgins, a highly regarded citizen journalist, had launched his crowdfunded project Bellingcat in beta. Bellingcat would use open-source information, he promised, “to investigate, collaborate, and report on worldwide issues that are being underreported and ignored … Syria, Iraq, Turkey, Kurdistan, Nigeria, Jihadists, Shia armed groups, the U.K. phone hacking scandal, police corruption, and more.” That “and more” swiftly became the downing of MH17. Bellingcat could have been designed for the challenge. Less than six hours after the shoot-down, Higgins had found, identified, archived, uploaded, and shared a 35-second video—titled in Russian “The Murder Weapon Malaysians Snizhne”—in which the Buk, now led by a single vehicle, rumbled ominously through Snizhne. Two years later, the Dutch-led international Joint Investigation Team (JIT) would use the video in its findings.

The official investigation by the Dutch Safety Board, conducted in parallel with the JIT’s, embodied a century of hard-won knowledge about air accidents. Over 15 months, the $4.8 million investigation reconstructed substantial parts of the Boeing 777. A wealth of expertise fortifies every part of the 279-page report and its 26 appendices, showing precisely how flight MH17 was destroyed. In their effort to find out what happened—and who was responsible—the JIT’s hundreds of investigators have, among other tasks, processed 1,448 pieces of wreckage, heard over 200 witnesses, analyzed 150,000 intercepted calls as well as half a million photos and videos, and produced over 6,000 reports. Although determined to keep their powder exceptionally dry for future criminal prosecutions, last September they presented preliminary results. After noting the efforts of “research collectives like Bellingcat,” they reached an unequivocal conclusion: a Buk-M1 TELAR, armed with 9M38M1 missiles carrying 9N314M warheads, traveled from the Russian Federation into Ukraine, fired from a launch site roughly halfway between the villages of Pervomais’kyi (May Day) and Chervonyi Zhovten (Red October), and then returned to Russia.

Side skirt fingerprint

Bellingcat researchers developed an innovative way to “fingerprint” vehicles as part of their successful effort to identify Buk 332, which shot down Flight MH17.

On a shoestring budget, using social media and satellite photography, and tapping into a network of obsessives, Bellingcat’s detective work has produced impressive results. In a series of reports, participants identified the actual Buk—unit designation number 332—and its battalion in Russia’s 53rd Anti-Aircraft Missile Brigade. Comparing dozens of Buks, and analyzing photos shared on Vkontakte between 2009 and 2013, they homed in on seven characteristic markers. These included exhaust deposit patterns, dents, the arrangements of cable connections to the missile erector, fonts (and spacing) on the digits, and the vehicles’ mix of hollow and spoked wheels on each side. A Bellingcat with an intelligence background developed an innovative type of “fingerprinting”: using 3-D software “to solve the problem of comparing two vehicles with perspective-distorted photos,” he noticed there were unique patterns of deformation in the protective rubber side skirts above the wheels.

Bellingcat was also the first to publicly describe the route the Buk took through Russia in late June and into and out of Ukraine before, during, and after July 17. The project has since identified several dozen soldiers associated with Unit 32406—the 53rd Brigade—by piecing together content and friend lists on Vkontakte, cross-referenced with posts on a forum for the often anxious mothers and wives of soldiers. (The murdered Russian journalist Anna Politkovskaya wrote movingly on this subject in her essay “My Country’s Army, and Its Mothers.”)

The culprit

Sergey Dubinsky, a veteran of Russia’s wars in Afghanistan and Chechnya, was found to have played a key role in the missile launch.

The penumbra of uncertainty

None of this cuts much ice in Russia. The Kremlin’s fog machine went into overdrive. The full panoply of Russian state media, troll farms, semi-automated botnets, and what Russian novelist Nikolai Leskov called “useful fools and silly enthusiasts” began their murky work. The Russian government’s response to the shooting down of MH17 was a charade, wrapped in a travesty, inside a miasma: a relentless campaign of abuse and deceit, trying to entangle every fact of the matter in a net of disinformation. Numerous attempts were made to hack the Dutch Safety Board. Several Bellingcats experienced spear-phishing attacks. Other targets included French and U.K. TV channels, NATO, OSCE, and the Polish, Dutch, Finnish, and Norwegian governments, as well as German political parties.

The primary “threat actor” was a cyber-espionage group called Fancy Bear (which has several names, including Tsar Team, APT28, Strontium, and Iron Twilight): Russia-based, and in all probability controlled by the GRU. As during the operations against the U.S. election last year, Fancy Bear seemed careless about disguising its activities. (FBI director James Comey, testifying to the House Committee on Intelligence in March, called the group “very noisy.”)