6.1. Information Collection Framework
In order to discuss the airspace closure decisions made
by authorities in Ukraine and the Russian Federation, the
Foundation looked for information about the relevant
authorities’ threat awareness for the referenced airspace
that was not restricted.
The threat information is of different types. In respect
to capability to attack, the threat information can be about
what authorities said they knew about the weapons that
could pose a potential threat to civil aviation above
FL 320. Or it can consist of information about the weapons that appeared in the public space (such as on social
media) without indications of whether relevant authorities
knew about it. The source of information can be traditional and/or social media or it can be private information
from intelligence services. These different types of
information imply different degrees of confidence about
authority awareness or the veracity of the information. For
these reasons, the threat information is categorised
conceptually in Figure 18 as follows:
• Foresight knowledge of threat information: quadrant 1. This is
information that was known prior to the downing of
Flight MH17 about the presence of weapons.
• Hindsight knowledge of threat information: quadrant 2. This is
information that was made known after the downing
of Flight MH17 about the presence of weapons. In
general, this type of information gives less confidence about potential threat awareness of relevant
authorities because it is information about what has

been seen, heard or otherwise discovered, but, in this
case, it was made known only after the downing of
Flight MH17.
• Foresight knowledge of authorities’ awareness: quadrant 3.
This is information that was known prior to the
downing of Flight MH17 about what the relevant
authorities knew about the presence of weapons.
In general, this type of information gives the most
confidence about potential threat awareness because it is mainly self-reporting by relevant authorities about their knowledge prior to the downing
of Flight MH17 — and therefore clear of any
hindsight bias.
• Hindsight public knowledge of authorities’ awareness: quadrant 4.
This is information that was made known after the
downing of Flight MH17 about what the relevant
authorities knew before the downing of Flight MH17
about the presence of weapons.
With the above-described four types of information, the
Foundation looked at two main sources of information:
• Publicly available information from primarily online
media, including Ukrainian and Russian news services
and other news aggregation sites, internationally
available aviation trade media, government announcements and news releases; and information available on
social media, including Twitter and Facebook.
• The responses from Ukraine and the Russian Federation to the standard procedure and threat knowledge

Information published
(made available) prior to
Flight MH17 downing

Information published
(made available) after
Flight MH17 downing

What did the responsible State
(authorities) know before
Flight MH17 downing about the
presence of air defense equipment

3
Foresight knowledge of
authorities awareness

4
Hindsight knowledge of
authorities awareness

Information about presence of
air defense equipement prior
to Flight MH17 downing

1
Foresight knowledge of
threat information

2
Hindsight knowledge of
threat information

until situation stabilizes.”²² Interfax-Ukraine, a subsidiary
of the Moscow-based Interfax News Agency, reported that
the authority said the airports, which it did not identify,
were closed by relevant NOTAM.
The brief article also reported the following: “At the
same time, the airspace above Donbas is open. The service
said that UkSATSE [Ukraine State Air Traffic Services
Enterprise] fully ensures the safety of air traffic over the
territory. There are restrictions on movement of aircraft in
the border area of 100 km– flights at altitudes below 7,900
meters are banned.”
At the beginning of July, a reported 10-day truce in the
region was ended, likely increasing tensions and military
action in the area. In an editor’s note on 2 July 2014, the
Kyiv Post said that Ukrainian President Petro Poroshenko had resumed, on 1 July, a military offensive against
the armed non-state forces in eastern Ukraine, ending a
10-day declared truce that Ukrainian authorities said was
violated more than 100 times by the irregular forces, who
killed 27 Ukrainian troops.
Separately, Voice of America (VOA) reported on 7 July
that Poroshenko had refused to extend what it described
as a “unilateral cease-fire” and ordered troops to advance.²³
The Kyiv Post, VOA and other media outlets reported
that Ukrainian forces were making progress in attempts to
regain control of the region.
Airstrikes were a significant element of Ukraine’s
military effort against the armed non-state forces. For
example, on 13 July, the National Security and Defence
Council of Ukraine (RNBO) said in a briefing that the
“active phase” of the anti-terrorist operation (ATO) in
eastern Ukraine was in process and that the day before the
air force had made five airstrikes against the opposition.
According to RNBO spokesman Andriy Lysenko, “The
first airstrike was directed at a terrorist stronghold near Lysychansk. Several dozens of militants were struck, as well as
their equipment. The second airstrike was fired at a militant
base near Holmovskyi, Horlivskyiraion. Up to 30 terrorists,
2 ‘Grad’ systems, 2 anti-aircraft installations and 6 military
machines were destroyed. The third airstrike was fired at a
concentration of militants near Rovenky; up to 10 terrorists were killed, a ‘Grad’ system was destroyed and several
military machines taken out of order. The fourth strike was
aimed at a militant base near Torez. Data on the amount
of casualties is being ascertained. The fifth airstrike was

performed near the barrow of Savur-mohyla, near Donetsk.
A stronghold with a group of terrorists, armored vehicles,
munitions and weapons was struck. Data on the amount of
their casualties is being ascertained.”²⁴
At the same time, the armed non-state forces made
clear through their statements and actions the intent to
target Ukrainian military aircraft. Multiple Ukrainian
military aircraft flying in eastern Ukraine were shot down
by armed non-state forces and these events were widely
reported. Aviation Week & Space Technology magazine
reported in its 23 June 2014 issue that the Ukraine military
had lost a mix of 10 fixed-wing and rotary-wing aircraft
since early May 2014.²⁵
The weapons used against the Ukrainian aircraft were
variously reported to be rockets, rocket-propelled grenades, anti-aircraft weapons, a large calibre machine gun,
shoulder-fired missiles, and surface-to-air missiles. It is
unclear to the Foundation researchers whether references
to surface-to-air missiles refer to SAM systems, to the
smaller MANPADS, or a combination of the two. Reported events reviewed included the following:
• On 29 May 2014, CNN.com reported that acting
Ukrainian President Oleksandr Turchynov told
the country’s parliament that a Ukrainian military
helicopter had been shot down near Slovyansk with
a rocket-propelled grenade, that at least 14 people
were killed and that armed non-state forces claimed
responsibility.²⁶
• In a mid-June article that referenced the reported
downing of Ukrainian military helicopters, the New
York Times said that the armed non-state forces first
said they used rocket-propelled grenades “but later
admitting to possessing guided missiles.”²⁷
• On 3 June 2014, the Kyiv Post published a report
from Russia’s Interfax News Agency that the self-proclaimed “people’s mayor” of Sloviansk said that armed
non-state forces there had shot down a Ukrainian
military Su-25, which is a single seat, twin engine jet
aircraft used for close air support, and a helicopter.²⁸
• On 14 June 2014, the Ukrainian Ministry of Defence
released a statement that on the night of 13‒14 June,
armed non-state forces fired an anti-aircraft weapon
and large calibre machine gun at an Air Force IL-76

made frequent statements, often blaming each other for
the ongoing conflict.
The Ukraine government regularly released information
about the conflict, such as which units were involved in
combat and where, what progress was made against the
armed non-state forces, the number of combat casualties
among Ukraine’s military and police forces, and sometimes names and photos of the dead and wounded. It also
alleged that Russian weapons and other equipment was
moving from the Russian Federation into eastern Ukraine.
On 9 July, Interfax-Ukraine reported (as published in
the Kyiv Post) RNBO spokesman Andriy Lysenko saying
Ukraine had “unquestionable evidence” that Russia was
supporting illegal armed formations.⁴⁰ “In particular, yesterday during a press conference in Donetsk, the leaders of
the militants confirmed that they receive armoured vehicles,
artillery systems, antitank, anti-aircraft and small arms
from Russia. We have reported this many times. Now the
militants themselves have openly admitted it,” he said at a
briefing in Kyiv. On the same day, the Ukrainian Ministry
of Defence said that armed non-state forces tried to deploy
two BM-21 Grad multiple rocket launchers to attack ATO
force positions.
On 11 July, six days before the downing of Flight MH17,
the RNBO released a map on its website that showed “the
situation in the Eastern regions of Ukraine.”⁴¹ The map
purported to represent the situation on the ground in
the Luhansk and Donetsk oblasts, with areas controlled
by the government and areas under the control of armed
non-state forces delineated. Also marked were airports,
sites of battles and the general location of armed non-state
forces. (An updated map released on 21 July 2014 showed
the Flight MH17 crash site located within a section of the
Donetsk Oblast that was under the control of armed nonstate forces.⁴²)
Ukraine also made a number of public statements about
capturing weapons and munitions used by, or intended
for use by, armed non-state forces operating in the region.
On 11 July, the Ukrainian Defence Ministry said the ATO
forces seized four armoured vehicles, three tanks, three
Grad multiple rocket launchers and mortars, an IMR combat engineering vehicle, 31 MANPADS, 26 anti-tank guided missiles (ATGMs), 101 small arms and nearly 300,000

rounds of ammunition for them, as well as 27 anti-tank
and anti-personnel mines.⁴³ While the report mentioned
MANPADS it did not mention SAMs.
The UNIAN news agency reported on 13 July that a
convoy of 100 units of equipment tried to enter Ukraine
from Russia near the village of Izvarine in the Luhansk
region.⁴⁴ The information was attributed to an RNBO
spokesman at a press briefing.
Ukraine also passed information to observers. In a 15
July article in the Kyiv Post, it was reported that “a senior
military Ukrainian officer speaking to the [Organization for
Security and Co-operation in Europe (OSCE) Special Monitoring Mission (SMM)] on 13 July, stated that a column
of tanks and other military hardware had entered Ukraine
from the Russian Federation at the Zelenopillia border
crossing point on that day.”⁴⁵
In a 15 July article about dozens of tanks, self-propelled
artillery and two armoured personnel carriers moving
from Luhansk to Donetsk, Zik reported that Ukraine’s
presidential administration deputy head Valery Chaly said
the conflict looks increasingly like a Russian invasion of
Ukraine.⁴⁶ On the same day, Interfax-Ukraine reported
that an RNBO spokesman said that Russia continues to
“concentrate its troops on the state border of Ukraine.”
“The battle for control over the state border of Ukraine
continues,” the RNBO said on 17 July. “The situation has
been deteriorating as the Russian Federation continues to
build up its Armed Forces near the Ukrainian border. More
and more attacks on the positions of Ukraine’s border units
and ATO forces are coming from within Russian territory.”⁴⁷
For its part, the Russian Federation issued a number of
complaints about Ukrainian forces attacking customs and
border checkpoints along the Ukraine-Russia border and
Ukrainian artillery shells landing in the Russian Federation. Statements issued by the Federation’s Ministry of
Foreign Affairs (MFA) often included details on casualties
among Ukraine and Russian civilians, as well as descriptions of damage to buildings and infrastructure.
On 28 June, the Russian Federation “expressed a decisive
protest with regard to such provocations of Ukraine, which
grossly violate the fundamental principles of international
law” after a Russia border checkpoint purportedly was attacked by Ukrainian forces.⁴⁸ “We are especially concerned

Department released photographs of three Russian tanks
it said were sent from southwest Russia to Ukraine. In
response to the call, Russia’s MFA released a summary of
the call, but it did not specifically the address subject of
weapons crossing the border from Russia into Ukraine.
Around the same time, Al Jazeera America quoted a
U.S. State Department spokesperson as saying, “Ukraine’s
interior minister said three tanks crossed the border from
Russia yesterday. … Internet videos showed this same type
of tank that departed southwest Russia moving through
multiple cities in eastern Ukraine.”⁵⁹
In late June 2014, U.S. Air Force Gen. Philip M. Breedlove, at the time the supreme allied commander Europe
of the North Atlantic Treaty Organization (NATO), said
that the armed non-state forces in eastern Ukraine were
being supplied with heavy anti-aircraft weapons.⁶⁰ He also
said that training missions being carried out by forces
from the Russian Federation along the eastern Ukraine
border included the use of vehicle-borne anti-air missiles.
The U.S. Naval Institute News, which reported Breedlove’s
comments on its website on 30 June 2014, also said, “But
despite the confirmed deliveries of the anti-aircraft weapons and training by Russian forces, Breedlove was wary
of making the connection between the separatists’ weapon
stockpiles and the recent shootdown of Ukrainian military
aircraft.”
In response to Breedlove’s comments, the Russian
Federation MFA said, “We believe that it is absolutely
inadmissible, when such a highly ranked military representative becomes drawn into the information and propaganda
campaign, distributing false data about the situation on the
Russian-Ukrainian border.”⁶¹
The then-U.S. Ambassador to Ukraine Geoffrey Pyatt
described the Russian frontier as “a sieve for tanks and
missile systems, and MANPADS and money and mercenaries and all kinds of instability.”⁶²
The Ukrainian military possessed SAM systems, including Buk M-1 missile launchers, and while the armed nonstates forces did not operate aircraft, there was concern
that Ukrainian anti-aircraft defence systems had been
seized by the armed non-sate forces. In late June, there was
a report that a Ukrainian SAM system had been captured
by armed non-state forces. The Kyiv Post reported on
30 June that armed non-state forces had seized control

of “military unit No. A-1402” in Donetsk.⁶³ The report
described the unit as a surface-to-air missile regiment
equipped with Buk self-propelled missile systems.
An ATO spokesman confirmed a “partial capture” of
the military unit. The spokesman confirmed the Buk unit
was located in the A-1402 unit, but said it was not working. When asked if the attackers could fix the unit, he said,
“I don’t think they need it.”⁶⁴
On 13 July, the Kyiv Post reported, “Columns of dozens
of armoured personnel vehicles, artillery and Grad rocket
systems were observed moving north from the seaside city
of Mariupol and west from the direction of Krasnoarmiysk
towards Donetsk this week.”⁶⁵
Between 13 July and 15 July, both the UNIAN News
Agency (translated using Google Translate) and ZIK
reported dozens of pieces of heavy equipment, including
tanks, self-propelled artillery, and armoured personnel
carriers in the Luhansk region.⁶⁶, ⁶⁷
After the An-26 was shot down on 14 July, a Kyiv Post
journalist tweeted a link from the “presidential website”
that the transport was shot down by an advanced missile
system “likely from Russia.” On 15 July, Pyatt tweeted that
Russia had transferred ex-USSR military equipment to
fighters around Donetsk. Also on 15 July, Pyatt tweeted
there was no evidence that Russian support for the armed
non-state forces had ceased.
Information on weapons system in or near eastern
Ukraine also could be found on Twitter. In late June, a
journalist tweeting under the Twitter handle @JulianRoepcke said, “#Breaking #Russia moving the “9K37M1
Buk”(?!?!) system through #Stary_Oskol towards #Ukraine.”
The tweet included a link to a YouTube video that no
longer is available. The next day, @JulianRoepcke tweeted “#BREAKINGNEWS THE “9K37M1 BUK CONVOY
MADE IT TO THE #UKRAINIAN_BORDER IN #BELGOROD OBLAST.” On 16 July, he tweeted that the Russian
army had moved “high end #SAM systems to the Ukr.
NORTHERN border.”
Another Twitter source, @ostro_v, as reported and
translated into English during the Flight MH17 criminal
prosecution in the court sessions of the District court of
The Hague said, “In Donetsk, at the Intersection of Ilyich
Avenue at 9.15, there was a “Buk” on a tractor, surrounded

a system anywhere near the vicinity at that point of time,”
Kerry was quoted as saying.⁷⁵
On 19 July 2014, at a news conference in Kiev, Vitaly
Nayda, the head of counterintelligence for the Ukrainian
State Security Service, showed a photograph of Buk system on a street in Torez, Ukraine. He also showed photos
of a Buk system and other military vehicles heading to
the Ukraine border with the Russian Federation. In response to a question, he said the armed non-state forces
operating in eastern Ukraine possessed at “least three
Buk M-1” missile systems because three systems crossed
back across the border into the Russian Federation
early on the morning of 18 July. In response to another
question, Nayda said the first information “hinting” at a
Buk launcher in the possession of the armed non-state
forces was received on 14 July and came from counterintelligence units who got the information from the field.
“But we could not confirm directly that it was Buk missile
launcher that trespassed illegally [in] Ukrainian territory,”
he said.⁷⁶, ⁷⁷
On 22 July, The Guardian reported: “[A]s several witnesses told the Guardian, they had seen what appeared to
be a Buk missile launcher in the vicinity of the crash site last
Thursday (17 July). … The sightings back up a number of
photographs and videos posted online that put the Buk system
close to the crash site on the day of the disaster. Just before
lunchtime last Thursday, prior to the Malaysia Airlines plane’s
takeoff, a Buk was driven through Gagarin Street, one of the
central thoroughfares of Torez, witnesses said.”⁷⁸
The Financial Times said the background to the downing included “a concerted anti-aircraft campaign waged
by rebel militias in eastern Ukraine.” The article also said
that on 29 June, an official account of the Donetsk armed
non-state group tweeted a picture of Buk missile launcher accompanied by text that said the launch was in their
possession.⁷⁹ The website Vesti.ru published an article on
29 June under the headline “The sky over Donetsk will be
protected by Buk anti-missile systems” about the capture of
the A-1402 air defence unit previously referenced.⁸⁰ At his
19 July news briefing, Nayda said the captured Buk system
was not operational, having been disabled in March 2014.
Bellingcat Investigation
Before the official accident investigation was completed by
the Dutch Safety Board, the most compelling investigative

report was published by Bellingcat, which describes itself
as an “independent international collective of researchers,
investigators and citizen journalists using open source and
social media investigation to probe a variety of subjects.”
Bellingcat’s 35-page investigative report, which was released on 8 November 2014, concluded:
“It is the opinion of the Bellingcat MH17 investigation
team that there is undeniable evidence that separatists in
Ukraine were in control of a Buk missile launcher on July
17th and transported it from Donetsk to Snizhne on a transporter. The Buk missile launcher was unloaded in Snizhne
approximately three hours before the downing of MH17 and
was later filmed minus one missile driving through separatist-controlled Luhansk.”⁸¹
“The Bellingcat MH17 investigation team also believes
the same Buk was part of a convoy travelling from the 53rd
Anti-Aircraft Missile Brigade in Kursk to near the Ukrainian border as part of a training exercise between June 22nd
and July 25th, with elements of the convoy separating from
the main convoy at some point during that period, including
the Buk missile launcher filmed in Ukraine on July 17th.
There is strong evidence indicating that the Russian military
provided separatists in eastern Ukraine with the Buk missile
launcher filmed and photographed in eastern Ukraine on
July 17th.”⁸²
The Bellingcat report, “Origin of the Separatists’ Buk, A
Bellingcat Investigation,” traces the Buk system’s movements in Donetsk on 17 July using photographs and
videos posted on social media sites. Bellingcat said its
investigators used a variety of tools to establish where the
images were recorded and the approximate time.
“Along with these eyewitness reports [social media
postings], journalists have since visited the city and received
confirmation of the convoy sightings on July 17. Journalists
from the Guardian and Buzzfeed visited Torez on July 22nd
and interviewed locals who confirmed both the time and
route the Buk missile launcher took through Torez on the way
to Snizhne along the H21 motorway,” the report said.⁸³
Much of the Bellingcat report was dedicated to tracking
the Buk launcher, then part of a larger convoy, as it moved
from Kursk, Russia, to the Ukrainian border as part of
a training exercise in the latter half of June 2014. “Using
a wide variety of open sources, it has been possible for the
Bellingcat MH17 investigation team to collect evidence of
the movements of the convoy, the purpose of the convoy,

D. Decision-making — roles, responsibilities, procedures and processes for airspace management in
relation to security threats to civil aviation, including deciding airspace restrictions and closure of
airspace.
E. Promulgation — roles, responsibilities, procedures
and processes for communicating airspace management decision-making, including decisions on
the communication tools (e.g., NOTAMs) used,
composition of the communication message and
verification of adherence to international standards
and procedures for aeronautical information.
The Foundation standard defines a statewide process
for airspace security risk management that is distributed
around different authorities and organisations yet functional from end to end. In this way, the organisational
scope of the process is not restricted to the more traditional perspective of civil-military aviation coordination (e.g.,
some state intelligence functions may not be attributed to
military authorities).
Each of the five functions of the integrated standard for
airspace security risk assessment targets a particular step
from the risk assessment process and contains three or
four specific sub-functions that are formulated as questions in the Foundation questionnaires.
The questions used in the inquiry are:
A. Threat watch:
• Q1 — Social media: Is information in social media
including information about capability of attack and/

or intent to attack civil aircraft, used as a trigger for
security threat analysis for civil aviation?
• Q2 — Public and private sources: What are the sources of
public and private threat information and what are
the processes for gathering information relative to
civil aviation security (including in a conflict zone)?
• Q3 — Other actors’ information: What is the level of
involvement of airlines, air navigation service providers (ANSPs), the military, adjacent states and/
or other states publishing advisories in gathering
information about aviation security (including information for conflict zones)?
B. Threat analysis:
• Q4 — Adjacent airspace: What are the procedures for
routine review and analysis of NOTAMs, security
warnings and airspace restrictions for adjacent FIRs
to ensure civil aircraft security?
• Q5 — Verifying the information: What is the process
for deciding on source credibility and for verifying
information, including information on capability of
attack and intent to attack, relative to an active armed
conflict that could impact civil aviation?
• Q6 —Unintentional attack factors: What are the determining risk factors for unintentional attack that may
result in civil aviation not being allowed to fly over
a conflict zone? For example, scale of the conflict,
military air transport or air combat activities, previous attacks against aircraft, level of training and

• Describe specifically what airlines, ANSPs, the
military, adjacent states, or other states publishing
advisories were used as a source for what information about security risk for civil aircraft.
• Describe what civil aviation security threat information was identified by which authority based on the
NOTAMs, security warnings and airspace restrictions for adjacent FIRs.
• How was the security threat information verified,
how was the source judged for credibility, and by
what authority/organisation? What were the results
of the credibility decision and the verification?
• Describe what risk factors for unintentional attack
were identified by what authority/organisation.
• Describe what organisations determined the acceptable security risk levels for civil aircraft. How
this was determined and what were the determined
acceptable security levels?
• Describe the impact analysis results, if any — how
civil aviation can be affected based on threat information — for airspace, altitudes or type of aircraft.
• Describe if and how risk was assessed and what levels
of security risk were determined for what airspace,
what altitudes or what type of aircraft.
• Describe if and what security mitigations were determined that would permit civil aviation to overfly the
conflict zone.
• Describe who made what decisions for security of
airspace, including establishing restriction or segregation of airspace.
• Describe what coordination took place between the
ANSP and the military regarding the security threats.
• Describe if and how the airspace restrictions were
coordinated with the adjacent FIRs and what organisations were involved in the coordination.
• Describe how it was decided if there was a need for
aeronautical information publication and how the
communication tool (e.g., NOTAMs, aeronautical
information circular) was chosen.
• Describe what organisations were involved in the
aeronautical information preparation, verification
of whether ICAO AIS procedures and terminology
were used, and validation for correctness and transmission of aeronautical information to users.
• Describe if and how civil aviation security threat
information, apart from the AIS, was disseminated to
operators within and outside the conflict zone FIR.

6.5. Inquiry Into Ukraine Standard Procedures and
Threat Knowledge
For the purpose of information collection, the Ukrainian
government identified a focal point within its Ministry
of Foreign Affairs. An information collection template
was sent to the identified focal point. The information
collection template integrated in one table both the standard procedures questionnaire and the threat knowledge
questionnaire.
Ukraine responded to the questionnaire, and the responses as received are included in Appendix D. Hereafter,
we provide a question-by-question discussion about the
responses received.
Q1 — Social media threat watch
The response confirms that information from “open
sources, including social media” is used in the assessment
of threats to civil aviation “in accordance with relevant
regulatory documents.”
The document provided by Ukraine as Annex 3 to the
responses says that the input information for the State Aviation Administration and Integrated Civil-Military System
“for detection of possible threats for civil aircraft operation
is the information provided by the Military Force Operation
HQ [headquarters] and/or appropriate command/control
military units.” The document further says that information received from open sources is “verified by intelligence.”
The response does not explicitly answer the question
about whether the information in social media is used as a
trigger for analysis of threats to civil aviation.
Many organisations are identified as responsible for
the process. Apart from the Security Service, Ministry of
Defence and Ministry of Internal Affairs, the response also
identifies as responsible the State Aviation Administration, airport operators, aircraft operators and ANSPs. The
response does not explain how all these organisations are
responsible for social media monitoring and identification
of potential threat information.
According to the response, the State Aviation Administration of Ukraine “constantly conducts a general assessment of threats to civil aviation security on the basis of
information received from the Security Service of Ukraine;
Ministry of Ukraine; Ministry of Internal Affairs of Ukraine;
Foreign Intelligence Service of Ukraine; airport operators;
aircraft operators; air navigation service providers; and
other sources, social media included.”
In respect to the situation prior to the downing of
Flight MH17, the response notes that the State Aviation
Administration of Ukraine “used information on threats
to civil aviation security from the Ministry of Defence
of Ukraine, law enforcement and intelligence agencies of
Ukraine, and other sources.” The response says that the
“information is the one marked ‘For official use (restricted)”

warnings and airspace restrictions for adjacent flight information regions.”
In respect to the situation prior to the downing of
Flight MH17, the response notes again that the information “is specified in the final report on the investigation of
the air crash of Malaysia Airlines’ Boeing-777-200.”
Q5 — Threat analysis: Verifying the information
The response states that “information on threats to civil
aviation security is analyzed, verified and assessed in accordance with relevant regulatory documents.”
The document provided by Ukraine as Annex 3 to the
responses says that the information obtained by the Military Force Operation HQ and/or appropriate command/
control military units is verified “by intelligence.” As the responses identify more actors that can be potential sources
of threat information, including airport operators, ANSPs
and aircraft operators, it is not clear if all the information
is verified “by intelligence” before the State Aviation Administration of Ukraine performs threat and risk analysis.
The response notes that the information on possible
threats “to aircraft flights in areas of military conflicts is
intelligence one” and that the procedure for determining
the reliability of the source of information depends on
the method of obtaining such information and the type of
information source. It is further noted that this information is classified.
In respect to the situation prior to the downing of
Flight MH17, the response notes that the information was
analysed, verified and assessed by the “Security Service of
Ukraine, the ministry of Defence of Ukraine, and the Foreign Intelligence Service of Ukraine.” It is further noted that
this information is classified.
For this report, and without prejudice to the classified
information, it is of specific interest what information
was transmitted to the State Aviation Administration of
Ukraine for threat analysis and when.
Based on the analysis of the response, it was decided
to ask a clarifying question seeking to understand what
verified and unverified threat information became
known by the State Aviation Administration of Ukraine.
Q6 — Threat analysis: Risk factors for unintentional
attack
The response says, “According to relevant regulatory
documents, all factors that pose a potential threat to civil
aviation security are taken into account when establishing
restrictions, prohibitions and terms on the use of airspace
over or near areas of military conflicts.”
Many organisations are identified as responsible for
the process. Apart from the Security Services, Ministry
of Defence, Foreign Intelligence Service of Ukraine and
Ministry of Internal Affairs, the response also identifies as
responsible the State Aviation Administration and ANSPs.

The response does not provide information on what
risk factors for unintentional attack were identified by
what authority/organisation prior to the downing of
Flight MH17. The response only notes, “According to the
established procedures, on the basis of available information, appropriate restrictions and prohibitions on the use of
airspace were established.”
For this report, it is of specific interest if the State
Aviation Administration of Ukraine, within the process of
“constantly conducting a general assessment of threats,” also
assesses the risk factors of unintentional attack and what
specifically this assessment was prior to the downing of
Flight MH17.
Based on the analysis of the response, it was decided
to ask a clarifying question seeking information on what
risk factors for unintentional attack became known by
the State Aviation Administration of Ukraine and how
the associated security risk was assessed?
Q7 — Risk analysis: Coordination and analysis of acceptable security risk levels
Much like previous questions, the response notes that
“the State Aviation Administration of Ukraine constantly
conducts a general assessment of threats to civil aviation security in coordination with the Security Service of Ukraine;
Foreign Intelligence Service of Ukraine; Ministry of Defense
of Ukraine; Ministry of Internal Affairs of Ukraine [and] air
navigation service providers” and that the detailed information is specified in the final report of the investigation
of the Flight MH17 crash.
In respect to the situation prior to the downing of
Flight MH17, the response notes again that the information “is specified in the final report on the investigation of
the air crash of Malaysia Airlines’ Boeing-777-200.” The
same statement is provided by Ukraine as an answer to
the detailed question about how the process actually
worked prior to the downing of Flight MH17 in all the
next question groups and is not repeated in the following
discussion.
Q8 — Risk analysis: Potential consequences
The response states that “the State Aviation Administration of Ukraine constantly conducts a general assessment of
threats to civil aviation security on the basis of information
received from the Security Service of Ukraine, Foreign Intelligence Service of Ukraine; Ministry of Defence of Ukraine;
Ministry of Internal Affairs of Ukraine [and] air navigation
service providers, and makes a decision on establishing
restrictions, prohibitions and terms on the use of airspace.”
The document provided by Ukraine as Annex 3 to the
responses notes, while referring to the threat information provided from military units, that “the nature of the
threat, the volume of the airspace which is hazardous to civil
aircraft, and the expected period of the threat existence are

Q16 — Promulgation: Special advisories and threat
information
The response notes, “The procedure for conveying information on threats to civil aviation security to airspace users is
determined and carried out by the State Aviation Administration of Ukraine [and] the Ministry of Defense of Ukraine,
including via air navigation service providers.”
Following the analysis of the information received from
Ukraine, we concluded that a number of questions remain
open. However, to respect the timeline of our inquiry,
we decided to concentrate only on specific clarifying
questions.
All questions refer to:
• Information, knowledge or decisions immediately
prior to the downing of Flight MH17.
• The airspace of eastern Ukraine in the Dnipropetrovsk FIR (UKDV).
• The following clarifying questions (CQs) were
formulated and subsequently communicated to
Ukraine. By the time this report was finalised, a response to the clarifying questions from Ukraine had
not been received.
The answers from Ukraine to the clarifying questions
were received after the requested time for providing a
response and when the content of this report had been
already finalised. Therefore, the responses to the clarifying
questions were only cross-checked against the findings of
the report but no discussion or other content in respect
of the clarifying questions to Ukraine were provided in
this report. The responses from Ukraine as received are
included in Appendix E.
CQ1 — On 17 July 2014, before the downing of
Flight MH17, a post from @ostro_v (as reported and
translated into English during the Flight MH17 criminal prosecution court sessions at The Hague) said, “In
Donetsk, at the Intersection of Ilyich Avenue at 9.15, there
was a “Buk” on a tractor, surrounded by militiamen.” Was
that Twitter post known about prior to the downing of
Flight MH17 and by which state authorities?
CQ2 — Apart from what is referred to in CQ1, what
other social media threat information about the presence
in eastern Ukraine of air defence equipment that was not
controlled by government forces and which could have
reached the respective airspace in UKDV FIR above Flight
Level 250 was identified, when and by which authority?
This includes social media posts about a BUK missile
system being seen.
CQ3 — What weapon was used in the attack on a
Ukraine An-26 military transport aircraft that occurred
on 14 July? What knowledge of this weapon did the authorities responsible for security risk analysis have prior to
the downing of the Flight MH17?

CQ4 — What authority or authorities knew prior to the
downing of Flight MH17 about the threat information
contained in the 150,000 intercepted telephone conversations mentioned on 28 September 2016, during the Joint
Investigative Team (JIT) presentation of the first results
of the Flight MH17 criminal investigation, namely the exchange in the morning of 17 July 2014 between Dubinskiy,
Semenov, Kharchenko and Pulatov about [the] presence in
eastern Ukraine of Buk-M?
CQ5 — What authority or authorities knew prior to the
downing of Flight MH17 about the threat information
described by Vitaly Nayda, the head of counterintelligence
for the Ukrainian State Security Service, on 19 July 2014 at
a news conference in Kiev, that the first information “hinting” at a Buk launcher in the possession of the armed nonstate forces was received on 14 July? Did State Aviation
Administration of Ukraine know prior to the downing of
Flight MH17 about this information?
CQ6 — Apart from what is referred to in CQ1, CQ3,
CQ4 and CQ5, what other threat information about the
presence in eastern Ukraine of air defence equipment
that was not controlled by government forces and which
could have reached the respective airspace in UKDV FIR
above Flight Level 250 was identified, when and by which
authority prior to the downing of Flight MH17?
CQ7 — What intent to attack aircraft in eastern Ukraine
with air defence equipment that was not controlled by
government forces and which could have reached the
respective airspace in UKDV FIR above Flight Level 250
was identified, when and by which authority prior to the
downing of Flight MH17?
CQ8 — What threat information about the presence
of air defence equipment in eastern Ukraine that was not
controlled by government forces and which could have
reached the respective airspace in UKDV FIR above Flight
Level 250 was known and how did it become known by
the State Aviation Administration of Ukraine prior to the
downing of Flight MH17? How was the associated security
risk assessed and what airspace management decision
was taken?
CQ9 — What risk factors for unintentional attack
became known by the State Aviation Administration of
Ukraine prior to the downing of Flight MH17 and how
did this information affect their security risk assessment?
CQ10 — The Netherland DSB investigation report
notes that, “After an emergency beacon was activated at
around 1320, indicating that flight MH17 had crashed,
UkSATSE made the decision at 1500, at the tactical level,
to also restrict the airspace above FL 320.” It could be
deduced that UkSATSE was responsible for threat and risk
analysis, but the responses received notes that “the State
Aviation Administration of Ukraine constantly conducts a
general assessment of threats to civil aviation security.” In
that respect, which authority was responsible prior to the

There is also no information provided in the answer
about which authority is responsible for the public and
private sources threat watch and how the process works.
In terms of responsible authority, the answer only provides
that these are “[c]ompetent authorities that exchange information related to aviation security.”
Q3 — Other actors’ information threat watch
The information provided yields little about the actual
process, but states clearly that airlines, ANSPs, and adjacent States have no role in the production of information.
It was reported that Rosaviatsiya produces information
based on receiving information on military activity hazardous to flight safety.
It was stated that Rosaviatsiya promulgated restriction
while “Airlines, military or other organizations were not involved in the issuance of NOTAMs V6158/14 and A2681/14.”
This does not correspond to provisions in the referenced
ICAO Doc 9554, which says, “If the necessary information
is not forthcoming from the States whose military authorities
are engaged in the armed conflict, the State responsible for
providing air traffic services should ascertain the nature and
scope of the hazards or potential hazards from other sources,
such as aircraft operators, the International Air Transport
Association (IATA) and the International Federation of Air
Line Pilots’ Associations (IFALPA), adjacent States or in
some cases the relevant ICAO regional office.”
Q4 — Adjacent airspace threat analysis
The Federal State Unitary Enterprise “State Air Traffic
Management Corporation of the Russian Federation”
manages the process, and there are several documents
driving the process for routine review and analysis of
NOTAMs. The rules are reported to be contained in the
document “Organization of Planning the Use of Airspace
of the Russian Federation.” The answer highlighted again
that the only threats identified “to air traffic safety in the
Rostov-on-Don FIR originated from hazardous activities
in the area of responsibility of the adjacent FIR of Dnepropetrovsk.” The reason for restricting the Russian airspace
with NOTAMs V6158/14 and A2681/14 was “[b]ased on
the available reliable information.” There are no further
explanations about what this “reliable information” was,
but there is a reference to the statements from Russian
Federation Ministry of Foreign Affairs that were quoted
above in the answer to Q2.
Q5 — Threat analysis: Verifying the information
The response notes that there is no reason to doubt the
information coming from the Russian Ministry of Foreign Affairs.
Rosaviatsiya was identified in the response as the responsible authority for threat information verification and
for deciding on the source credibility.

There is an important addition to the already quoted
statements of the Ministry of Foreign Affairs. The addition
points to the actual decision-making process to restrict
the airspace, namely, “The initiative to issue NOTAMs
V6158/14 and A2681/14 concerning the Rostov-on-Don
FIR came on July 12, 2014 from the Rosaviatsiya Southern
Interregional Territorial Administration (responsible for
the Rostov-on-Don FIR) due to the aggravated situation in
the areas bordering on Ukraine, the use of various types of
weapons by the Ukrainian armed forces.”
Q6 — Threat analysis: Risk factors for unintentional
attack
The response highlights that “[a]ll possible risk factors
for an unintended attack should be considered” and that
“[s]uch preparations should include an assessment of the
risk to civil aircraft operations due to a military conflict or
incidents of unlawful interference with civil aviation.”
The response does not provide information about which
authority in the Russian Federation is responsible for
determining the risk factors for unintentional attack for
the (adjacent to the conflict zone) airspace that is affected
by the conflict. Instead, the response states that this should
be “[t]he state responsible for compliance with the rules for
the introduction of restrictions on the use of airspace over
an armed conflict zone (Ukraine, in relation to the MH17
crash).”
The response notes that adherence by Ukraine to ICAO
rules in force at the time of the crash “would have allowed
the aviation authorities of Ukraine to come to a decision on
the need to stop civil aviation flights over the conflict zone
and avoid the crash of flight MH17.”
Further, the response notes that “[i]nformation, including the official one, about the presence of a certain type of
weapons in the conflict zone, as well as incidents with the
use of these weapons, should have been considered sufficient
by Ukraine to make decisions.” This implies that there was
available and “sufficient” threat information for Ukraine
to make a decision “on the need to stop civil aviation flights
over the conflict zone and avoid the crash of flight MH17.”
A question arises about whether such information was
known by the Russian Federation. This was raised in the
set of clarifying questions submitted after the analysis of
the questionnaire responses and described later in this
report. Clarifying questions were asked about knowledge
of both capability and intent to attack.
Q7 — Risk analysis: Coordination and analysis of acceptable security risk levels
Much like the answer to Q6, the response notes that the
“responsibility for initiating the coordination process lies
with the State on whose territory an armed conflict is taking
place.” Further, information is provided again about the
reasons for airspace restriction: “NOTAMs V6158/14 and

aeronautical data and raw aeronautical information, the
aeronautical information authority shall verify, register and
process them” and that “[i]f the raw aeronautical data and
raw aeronautical information do not meet the requirements,
the aeronautical information authority shall send them back
to the providers (compilators) of raw aeronautical data and
raw aeronautical information for refinement.”
Q16 — Promulgation: Special advisories and threat
information
The response references ICAO guidance and other documentation and notes the process for producing NOTAMs.
It mentions that the Russian aircraft operators are responsible for collecting and disseminating information.
Following the analysis of the information received
from the Russian Federation, we concluded that there
are a number of questions that remain open. However, to
respect the timeline of our inquiry, we decided to concentrate only on some CQs. The CQs were formulated and
subsequently communicated to the Russian Federation.
The Russian Federation replied with a letter containing responses to the clarifying questions. The responses
from the Russian Federation as received are included in
Appendix C. Hereafter, we provide a question-by-question discussion of the received responses. The discussion
is based on analysis of the responses provided in Russian
and on the unofficial translation in English.
CQ1 — What threat information about the presence
of air defence equipment in eastern Ukraine that was
not controlled by government forces and which could
have reached the respective airspace in URVV FIR
above Flight Level 250 was identified, when and by
which authority?
The response clearly answers that “Russian authorities
did not have any information regarding the presence of air
defence equipment on the territory of Ukraine that was not
controlled by the armed forces of the Ministry of Defence of
Ukraine and which could hit targets in the Rostov-on-Don
FIR above FL 250.”
The response also notes that “Rosaviatsiya identified a
threat to flight safety itself due to Ukraine’s regular shooting
of the Russian border areas.”
Additionally, the response provides that “it is incorrect
to focus only on threats posed exclusively by air defence systems capable of hitting targets at high altitudes.” However,
security risk for civil aviation at low altitude is outside the
scope of this inquiry.
The response also provides discussion, in the same
manner as the answers to the questionnaire mentioned
earlier, that the way the buffer zone for protecting the
military operations has been defined by Ukraine would,
in accordance with the relevant Ukrainian provisions
for RVSM airspace, require 600 m (2,000 ft) separation

between the upper limit of the reserved airspace and
aircraft above it. However, this issue is outside the scope of
the present inquiry. Moreover, air defence equipment that
can reach FL 330 would be reasonably expected to be able
to reach FL 340 as well.
CQ2 — What intent to attack with air defence equipment in eastern Ukraine that was not controlled by
government forces and which could have reached the
respective airspace in URVV FIR above Flight Level 250
was identified, when and by which authority?
The response says, “When taking a decision to issue NOTAM V6158/14, the Russian airspace authorities did not
have information that governmental or non-governmental
entities on the territory of Ukraine deployed air defence
equipment capable of downing aircraft at high altitudes in
the conflict zone and could use it in the armed conflict by
mistake or negligence.”
The answer does not respond to the question about
known intent but provides an answer to another question
— about knowledge of air defence equipment deployment.
What can also be seen in the answer is that it is not
referring to the defined time period in the request to the
Russian Federation, namely “for the period of 1 March
2014 and up to and including the moment of complete
closure of the airspace subsequent to the downing of MH17.”
Instead, the answer restricts the referenced time to “[w]
hen taking a decision to issue NOTAM V6158/14.” That
NOTAM was issued on 16 July 2014 and it is not known
when exactly the decision to issue it was taken.
Additionally, the question asks about knowledge of
any authority and the answer refers only to “the Russian
airspace authorities.”
In summary, it can be concluded that the question about
Russian authorities’ knowledge of intent to attack was not
answered.
CQ3 — What were the specific reasons for restricting
the airspace with NOTAM V6158/14, why were there
several restrictions in one NOTAM, and to which of the
restrictions in the NOTAM apply the items F) and G),
specifying surface as lower height limit and FL 530 as
upper height limit?
As a reason for airspace closure, the response references the Russian Ministry of Foreign Affairs “information
concerning the risks to people and objects on the territory
of the Russian Federation.” This information as provided
in the answers to the other questions is on the basis of
some statements from the Russian Ministry of Foreign
Affairs, where the threat is identified as low-level artillery
shootings. For the specific reason to close the airspace, the
answer refers again to the reasons provided in NOTAM
V6158/14: “Due to combat actions on the territory of the
Ukraine near the state border with the Russian Federation

7.1. Discussion Framework
This section discusses the Foundation’s observations
regarding Ukraine and Russian Federation threat awareness prior to the downing of Flight MH17. The threat was
associated with the presence of air defence equipment in
eastern Ukraine that could reach civil aircraft operating
above the airspace that was closed to them. Discussion of
the publicly available information about the capability to
attack which could have contributed to threat awareness
for the relevant authorities is related mainly to quadrants
1 and 2 from Figure 18 and discussion regarding what relevant Ukrainian and Russian Federation authorities knew
about the threat is related to quadrants 3 and 4.
One important part of our inquiry was identifying
when information about the threat reached:
• Those responsible for analysing security risk levels in
civil aviation airspace over a conflict zone, and
• Those establishing restrictions of airspace in a conflict zone.
This is illustrated in Figure 20, where the respective stages
from the Foundation’s Integrated Standard for Airspace
Security Risk Assessment are outlined.

Threat information reaching the Risk Analysis and Decision-Making steps (C and D) in the process is the Foundation’s criterion for threat awareness at the level of the
statewide process. Using this criterion, unverified social
media posts, other media reports or the potential presence
of information in intercepted but unprocessed communications do not represent sufficient facts for realistic
threat awareness. This is because verified threat awareness
is not available to those responsible for risk analysis and
decision-making.
7.2. Risk Analysis and Decision-Making Responsibilities
To use the criterion for threat awareness at the level of
the statewide process in a reliable manner, it is necessary
to identify which authorities are responsible for assessing
security risk levels in civil aviation airspace and which are
responsible for establishing restrictions or segregations of
airspace in a conflict zone.
With respect to Ukraine, UkSATSE and SASU, as stated
in the DSB Investigation report section 6.1, are responsible for airspace management at the tactical, pre-tactical
and strategic levels. As noted in 6.2 of the DSB report
— the process for threat analysis and coordination for

Lack of suitable control would be a significant aggravating factor and, similarly, poor operator training would
arguably increase the risk of a possibility of unintentional
attack. The question then arises as to how a controlling
authority could come to a valid conclusion on risk without
access to sophisticated and timely intelligence.
To understand the risk, Table 6 (p. 83) provides an
overview of the indicators of likelihood of attack for the
airspace of Ukraine and the Russian Federation in the
same format the other conflict zones were investigated.
This presentation can also allow those interested to compare the different assessments.
There are some important caveats to be introduced here.
Two assessments were made — one with hindsight
knowledge and one with foresight knowledge.
The assessment made with hindsight knowledge is a
reflection after the fact, in which the results of how the
situation evolved are known and many of the associated
factors have surfaced over time. This is not the same as
the situation seen in foresight from the perspective of a
reasonable person that:
• Detects many weak signals that are shaping countless
possibilities on how the situation may evolve in the
future, and
• Needs to make a decision under pressure of time and
with limited information.
Another caveat relates to the Foundation’s use of a
contemporary risk assessment methodology and algorithms that were not available at the time. The hindsight
caveat is the most crucial. Because the hindsight analysis
was performed after the event, it relies on the view of a
knowledgeable person who possessed all the information.
However, much of the most relevant information only
became available after the downing of Flight MH17, and
that knowledge would at the time have been distributed
amongst several authorities. For example, because it is
now known that Flight MH17 was downed by a missile,
the capability to attack clearly existed at the time whether
this was known to the authorities or not.
The hindsight assessment describes the risk that would
have been assessed had all the information detection,
processing and coordination functioned perfectly. This
understanding will allow the reader to assess the now
exposed gaps against an ideally functioning process.
With this hindsight in mind, the situation in each airspace (Ukrainian and Russian Federation) was reviewed
relative to the set of 10 pre-determined “indicators of
likelihood of attack.”
In the specific case of the Russian Federation assessment, apart from the risk factors in the adjacent Ukrainian
airspace, the physical proximity and the range of the threat
indicates that the conflict zone was close enough to affect
Russian Federation airspace.

In the Foundation algorithm, the capability to attack
by at least one party is used as the primary indicator of
likelihood of attack, because the presence of an air defence
system that can target aircraft above FL 250 is the key enabling risk factor. As mentioned above, it is considered that
long-range SAMs capable of hitting an aircraft at cruising
level were present
The next indicator of likelihood of attack relates to civil
aircraft operations over or close to a conflict zone at high
altitude; based on the information provided in the DSB investigation report, it is accepted that there was substantial
traffic volume, including international overflights.
Another key indicator of likelihood of attack in the
algorithm sequence involves known intent to attack. It is
clear from reviewing publicly available information that
armed non-state forces operating in eastern Ukraine had
the motivation and intent to target Ukrainian military
aircraft operating in the region. Those forces also repeatedly demonstrated their capability to successfully attack
helicopters and low-flying fixed-wing military aircraft
with an assortment of weapons, including MANPADS and
other anti-aircraft defence systems. There were no known
attacks on civilian aircraft in the region and no publicly
available information about intent to attack civil aviation.
The next indicator of likelihood of attack involves
military aviation activities, and more specifically, the fact
that military aviation was being operated by Ukrainian
government forces and there was more than occasional
use of military aircraft to transport ground troops or military equipment.
There was a widely reported conflict between a state
(Ukraine) and armed non-state forces. The armed conflict
involved medium to large scale military activities and
heightened political tension.
The risk assessment algorithm subsequently examines the
risk factors for unintentional attack. The studied situation
shown in Table 6, apart from the already mentioned indicators, assesses SAM operators’ experience and the chain
of command and capability to differentiate between civil
and military aircraft. When in the algorithm we assess the
scenario of an unintentional attack, and considering that
the attack actually took place, these factors with hindsight
are assessed to be to be low level of control and marginal
capability to differentiate between civil and military aircraft.
Finally, it seems unlikely that there were large or medium scale military air combat activities above FL 250 in the
airspace above eastern Ukraine.
In the hindsight assessment, the analysed set of risk
factors for unintentional attack, in their aggregation, point
to a very high likelihood for unintentional attack and high
risk at high altitudes without airspace restriction. This
resultant risk is illustrated in the Table 6 column “Overall
indication of likelihood of attack above FL 320” in the
sub-column “Without airspace restrictions.”

In the assessment scenario that includes the actual airspace restrictions, the aggregated likelihood for unintentional attack is still very high and the overall likelihood of
attack is high because the actual airspace restrictions are
up to FL 320 and the overflying aircraft are still exposed
to the threat. This resultant risk is illustrated in the Table
6 column “Overall indication of likelihood of attack
above FL 320” in the sub-column “With actual airspace
restrictions.”
Knowing that Flight MH17 was downed, in hindsight, it
is no surprise that the risk assessment algorithms concluded that the likelihood of attack was high and there was a
need for Ukrainian and Russian Federation authorities to
close the airspace.
Therefore, the Foundation performed a second assessment — a foresight assessment — from the perspective of
the reasonably available information prior to the downing
of Flight MH17. The indicators about SAM operators’
experience and the chain of command and capability
to differentiate between civil and military aircraft are
assessed to be to be low level of control and marginal capability to differentiate between civil and military aircraft.
As described in the analysis of conflict zones during the
1990–2014 period, even without the hindsight knowledge
of the attack, and to be conservative in the risk assessment, we could consider the indicator to be associated
with irregular forces that do not have an organised specific
reporting channel, a protocol for authorising SAM attack
or a capability to differentiate between civil and military
aircraft as regular military forces would have.
The main difference from the already described assessment with hindsight knowledge using the set of 10
pre-determined “indicators of likelihood of attack” is the
information available about the capability to attack civil
aviation above FL 320.
As shown in Table 6, the aggregated risk factors for an
unintentional attack and command and control factors
(that are the same for the hindsight and for the foresight
assessments) are almost at the maximum possible level. In
such a situation, the assessed risk is therefore extremely
sensitive to any information about capability to attack.
In such a situation, following the Foundation’s methodology, the indicator of capability to attack should not be
considered as a binary choice of “present” or “not present.”
Instead, the indicator of capability to attack should be
considered as a likelihood range. If the capability to attack
indicator is assessed as low, then the overall risk would
be also low. But if the indicator of capability to attack is
assessed as medium or high, then (considering that almost
all the other factors are high) the resultant overall likelihood of attack will also be high — see Table 6. This makes

the discussion about threat awareness very crucial for
understanding the risk management.
In summary, the Foundation finds that in a situation in
which risk is highly dependent on an uncertain factor such
as capability to attack, the risk assessment should take the
side of caution when there is information about capability
to attack that is not necessarily certain and validated but
that is characterised to be above a pre-defined threshold
level of certainty — e.g. unverified intelligence reports.
7.4. Ukraine Awareness of Threat to Civil Aircraft
The discussion on the threat awareness is twofold — a
discussion on reported threat awareness (concerning
Quadrants 3 and 4 in Figure 18) and a discussion on the
potential threat awareness (concerning Quadrants 1 and 2
in Figure 18).
The discussion on the reported threat awareness is
about what authorities said they knew about the threat
at an altitude above FL 320. We studied what authorities said in public (both before and after the downing of
Flight MH17) and their responses to our questionnaires.
This discussion is different from what information was
available in the public and private space about a threat (social media, other publications and intelligence).
The Foundation’s research did not find any instances before (quadrant 3 in Figure 18) the downing of Flight MH17
in which Ukrainian authorities publicly acknowledged the
presence in eastern Ukraine of air defence systems capable
of reaching an altitude greater than FL 320.
The Foundation identified from information made
publicly known after (quadrant 4 in Figure 18) the
downing of Flight MH17 that some Ukrainian authorities
(counterintelligence services) suspected the presence of air
defence equipment that could reach high altitudes — “first
information ‘hinting’ at a Buk launcher in the possession of
the non-state forces was received on 14 July and came from
counterintelligence units.”⁹² This information corresponds
to Group A from the Foundation Standard, namely threat
watch as shown in Figure 20.
However, no facts were found that this information
had been verified per the functions in Group B from the
Foundation Standard — “But we could not confirm directly
that it was Buk missile launcher that trespassed illegally
[in] Ukrainian territory.”⁹³ Similarly, no facts were found
by the Foundation that the information was disseminated
through the statewide process to reach the authorities
responsible for risk assessment and decision-making
regarding airspace closure.
Finding 6: This inquiry did not find sufficient facts
that Ukrainian authorities responsible for analysing
security risk levels in civil aviation airspace and those