Buk SAMs and the Downing of MH17
Get Trending Threat Insights with Cyber Daily Subscribe Today

Buk SAMs and the Downing of MH17

July 23, 2014 • Matt Kodama

Analysis Summary

  • Recorded Future web intelligence highlights multiple June/July reports that Ukrainian separatists had acquired Buk anti-aircraft missiles. With hindsight, it’s surprising that these reports did not register as heightened risks to civilian flights.
  • A comparison on Buk missile system deployments in the Ukrainian and Syrian conflicts underscores the critical role of professional command and control, and a key incident: the 2013 Israeli airstrike on a claimed Syrian transport of Buk missiles to Hezbollah.

Multiple investigations have linked the shootdown of Malaysia Airlines Flight MH17 to the Buk surface-to-air missile (SAM) system. Reporting from bellingcat and Financial Times are compelling examples. At this time, there is ongoing dispute over which specific Buk SAM system was used to shoot down MH17.

Although most Buk-M1 and Buk-M2 SAMs remain under Ukrainian and Russian military control, reports as early as June 29 from both sides in the Ukraine conflict indicate that Donetsk separatist paramilitaries had captured a Buk-M2 SAM unit. This reporting did not foreshadow the tragic consequences for MH17 passengers and crew. Instead, early reports focused politically on disregard for the cease-fire or noted the lack of bloodshed in the SAM seizure.

The lack of urgent escalation of risks to civilian aviation over Ukraine seems less surprising when considering relevant events in the Syrian conflict, where multiple generations of the Buk SAM have been deployed and used close to many civilian flight paths. With better command and control over advanced SAM weapons – a status quo enforced by a 2013 Israeli Defense Force air strike – the Syrian conflict has fortunately not given rise to any disasters similar to MH17.


Click image for larger view

Western political leaders have called on Russia to restrain Donetsk separatists and bring those responsible for MH17 to justice. This demand raises both political questions and operational questions: is Russia able to “unbreak the glass” and exert strong influence or control over Donetsk militias? If Russian leaders had been able to exert robust command and control over separatist militias throughout the Ukraine crisis, it’s unlikely MH17 would ever have been shot down.

The View Through Recorded Future

Multiple investigators have linked the shootdown of MH17 to a specific weapon system, the Russian-built Buk (Бук) mobile surface-to-air missile. (Here’s some video footage of this weapon system.) In particular, Eliot Higgins, the investigator behind the bellingcat and Brown Moses blog, has assembled an impressive dossier of open source evidence linking the Buk SAM to the MH17 disaster.

Recorded Future is adding to this body of investigation by taking the Buk-M1 and Buk-M2, respectively identified in NATO reporting as the SA-11 “Gadfly” and SA-17 “Grizzly” weapon systems, as the starting point for investigation using our web intelligence analysis products and archive of events reported by public sources worldwide.

Ukraine Summer 2014: Disputed Control of Buk SAMs

June and July 2014 saw many claims and denials regarding possession and control of Buk weapon systems in Ukraine. There was no disagreement that both Ukrainian and Russian professional militaries possessed Buk SAMs. The contested question was whether separatist militia units had these weapons.

Militants reportedly captured Buk SAMs from Ukraine military bases – reports which were denied by Ukraine government spokespersons. Militants were alleged to have received Buk SAMs from the Russian military, and these claims were also denied. The timeline below illustrates notable events and statements in this fog of war.


Click image for larger view

Investigation after the MH17 downing has not yet brought clarity. Claims and counter-claims have become more specific, debating whether the reported captures, sightings, photos, and other evidence involve Buk-M1 or Buk-M2 systems, even down to the specific SAM units.

Leaving these important details to other investigators, we ask a different question. Were these many reports of advanced SAM weapons in the hands of Donetsk separatist militias seen as greatly increasing the danger to civilians and noncombatants?

A close examination of one particular incident tells a surprising story.

June 29, 2014: Separatist Seizure of Buk-M2 SAM System

On June 29, Donetsk separatists seized a Buk-M2 SAM from Ukraine military forces. The capture was immediately reported by sources on both sides of the conflict. ИА REX (iarex.ru) reported the capture of military unit A-1402, a Buk-M2 SAM, as a sub-headline. Their coverage leads with separatist plans to manufacture hand grenades with captured chemicals.

Immediate reports by 62.ua, a local Donetsk news source, immediately confirmed the capture, with commentary from Ukraine ATO (Anti-Terrorist Operations) spokesperson Alexei Dmitrashkovsky.

Dmitrashkovsky downplays the significance of the seizure, saying that this particular Buk-M2 unit is junk (“нерабочий”) which the separatists are unlikely to repair because they don’t need it (“Я не думаю, что это им нужно”) – presumably because separatists are already armed with other SAM weapons. We can only speculate whether Dmitrashkovsky alludes to militia having access to other less advanced SAMs, to other captured Buk SAMs, or to Buk SAMs provided from Russian military assets.

This timeline illustrates the many sources confirming the June 29 seizure of a Buk-M2 SAM.


Click image for larger view

Same day reports on social media corroborate the Buk-M2 seizure.

This last tweet echoes local news headlines that “Buk” anti-aircraft missiles will defend the sky over Donetsk.

Local Ukraine/Donetsk Assessment of Conflict Escalation

Additional coverage on June 29 included LiveLeak footage of fires caused by the attacks in Donetsk, but most sources focused on the relative lack of bloodshed: KyivPost headlined no one was hurt during the base takeover, and Kvedomosti reported in a similar tone. Translated:

The situation is relatively calm in Donetsk. According to the press service of the Donetsk City Council, citizens are walking on the streets with children, cafes and restaurants are open…

The emerging danger is the hardening defensive position of Donetsk militias, who now plan to manufacture hand grenades using captured chemicals and use the captured Buk SAM for aerial defense.

Reporting by Glob-News.com places the attack in a political context. The terrorist (“террористы”) attack proves the separatists’ lawlessness (“беззакония в перемирии”) because it occurred during a unilateral cease-fire declared by the Ukrainian prime minister. Reporting by Vesti positions the attack similarly as a rejection of the cease-fire.

Other sources add details. Novistim.ru reports Donetsk SWAT or special forces (“спецподразделения армии Донецкой”) conducted the operation. Svodka.net reports Ukraine air defense forces are drawing back to avoid the loss of more Buk SAM systems.

The Implied Assessment of Expertise and C&C of Donetsk Militia

None of these sources flagged an increase risk to civilian aviation and other non-combatants from the Buk-M2 SAM seizure.

Why not?

We hypothesize that crisis observers overestimated the degree of professional military command and control (C&C) over the Donetsk militia units – who by June 29 clearly possessed at least one advanced SAM system, and were targeting Ukraine military targets with other SAM weapons.

Hindsight is 20/20. But, was there evidence that supported an assessment that Buk SAMs, in separatist hands but under effective military C&C, did not pose a much greater risk to civilian aviation?

In fact, there’s recent evidence from the ongoing Syrian conflict.

Contrast: Deployment and Use of Buk SAMs in Syria

The earlier generation Buk-M1 and the Buk-M2 missile systems have been deployed in Syria for years, and sadly through many security crises. International Business Times has published this reference timeline of relevant arms deals and shipments to Syria. This timeline from Recorded Future places those arms deals in content of notable military actions.


Click image for larger view

Syrian SAM systems were not deployed just for show, as proven by the June 2012 shootdown of a Turkish F4 Phantom. As the conflict in Syria worsened, Buk-2ME SAMs specifically have been in play. As recently as September 2013, IHS Janes documented evidence the Syrian regime was deploying the upgraded Buk-2ME, perhaps as protection against US cruise missile attacks. In April 2014, IHS Janes further reported Syrian air defense units were harassing Turkish airplanes by painting them with SAM systems including the Buk-2ME. This conflict escalated further in March 2014 as Turkish fighters shot down a Syrian warplane.

This ongoing Syrian-Turkish air conflict occurred in close proximity to many civilian flight paths. Despite this episodic military conflict, no tragedies like the downing of MH17 have occurred around the Syrian conflict zone. An apparent difference is that professional military forces – not paramilitaries or terrorists – retained command and control of advanced SAM weapons. Israeli Defense Forces have taken severe actions to maintain this status quo, for example in a January 2013 air strike that destroyed a convoy of Buk-M2/SA-17 missiles reportedly in transit from Syria to Hezbollah.

In the wake of the downing of MH17, threat security assessments are undoubtedly being revisited and adjusted for greater perceived risk. Below is a case in point.

New call-to-action

Related Posts

How Agencies Can Refine Threat Intelligence Through Automation

How Agencies Can Refine Threat Intelligence Through Automation

September 16, 2021 • The Recorded Future Team

Editor’s Note: In this guest blog post, Federal News Network sits down with Stu Solomon,...

Stay Ahead of Global Uncertainty With Real-time Geopolitical Intelligence for Esri

Stay Ahead of Global Uncertainty With Real-time Geopolitical Intelligence for Esri

April 28, 2021 • Ellen Wilson

For a complete understanding of the threats to their organizations, all intelligence analysts must...

Security Intelligence Handbook Chapter 11: Geopolitical Intelligence Identifies IT Risks Across the Globe

Security Intelligence Handbook Chapter 11: Geopolitical Intelligence Identifies IT Risks Across the Globe

March 30, 2021 • The Recorded Future Team

Editor’s Note: We’re sharing excerpts from the third edition of our popular book, “The...