The Bellingcat report on MH17 and the media treatment of it

After the tragic downing of Malaysian airlines flight MH17 over Ukraine the Russian Defence Ministry released some satellite images at a conference. They said that these showed Ukrainian BUK missile systems which were within range to have shot down the Malaysian plane.

A UK based blogger called Eliot Ward Higgins appears to be the sole director of a Ltd company called Brown Moses Media Ltd. [1] Eliot Ward Higgins runs a web site called Bellingcat. He has released a report in which he claims to have shown that the Russian satellite images were manipulated in Photoshop. [2]

According to the Guardian Mr Higgins has “a background in finance and administration”. He was “made redundant” in October 2013. He has “taught himself” “how chemical weapons are made, how to use Google Earth so that he can pinpoint the exact place footage was filmed, and how to identify shells and find out where they come from”. [3]

The reality then appears to be that Mr Higgins is a solo operator, with no professional background in forensic image analysis. He uses social media and Google Earth for his stories. This has not stopped the Western press describing his operation variously as:

“investigative journalist organisation Bellingcat” and “Bellingcat investigators” (Daily Mail) [4]

“Bellingcat investigative group” (Daily Telegraph) [5]

“Investigative group” (Huffington Post) [6]

Mr Higgin’s report is available online. [7]. He analyses just two of the images provided by the Russians.

Mr Higgins”s main methods appear to be i) he looks at the meta information in a file, ii) he looks to see if the jpeg compression levels are evenly distributed across an image – a procedure known as Error Level analysis (ELA), and c) he compares them with Google Earth.

Mr Higgins first presents his “Forensic analysis” of Image 4. (Images 4 and 5 can be seen on the Russian Ministry of Defence web site and on RT and of course in Mr Higgins”s report). – In passing we can note that the images on the Russian Ministry of Defence web site – which Mr Higgins says he used in his report [7] – are at 900px x 600px and are unlikely to be originals. And as the tutorial on Error level analysis explains to get the best results you should use the originals. However there are more serious problems than that.

Based on his “Error level analysis” Mr Higgins claims to be able to show that parts of Image 4 were “added later”. He explains that “It is highly probable that clouds were digitally added on the left and right sides of the image, which obscured details that could have been used for additional comparisons with historical imagery.” We discuss Error Level analysis below and explain how it should be used correctly. (Even then it is an interpretative skill not a science).

Mr Higgins’s next step is to look at 5 images from Google Earth taken over a period of time and of the same area as Image 4. Based on an analysis of vegetable growth he claims to be able to date the Russian image to a date some weeks earlier than the date given for the image by the Russian Ministry of Defence. The Russians said that it was taken on 17 July.

His next step is to use a similar method to re-date the image focussing on another section. This time the comparator is what he explains is a pool of oil leaking from a vehicle. The pool is bigger on 19 June (from Google Earth) than it is in the Russian images. Therefore the Russian images were taken before 19 June (not on 14 and 17 July as the Russians claim) because; “It is common knowledge that a leaking liquid tends to pool, and that, over time, the pool grows as more liquid is added”.

Then he returns to his vegetable analysis. Again he uses Google Earth to show that a certain area in the image was covered with vegetation by June 19 whereas in the image produced by the Russians it was covered in soil. Therefore the image must date before 19 June. Indeed “It can therefore be stated unequivocally” that this is the case.

He then addresses himself to a second of the Russians” 5 images.

Here again he uses the technique of comparing what is on the ground; this time he compares “soil structures”. He compares Image 5 with another one the Russians said was taken a day later (Image 6) with two images from Google Earth. Based on a part of the image from the Russian images (Image 5 and 6) being darker than the Google Earth ones taken on 16 July and 13 September he explains that Image 6 must have been taken prior to 16 July and therefore (presumably because the Russians said it was taken a day previously) Image 5 must have been taken before 15 July. The Russians said that Image 5 was taken on 17 July. The logic of lighter and darker soil colours is not actually explained. That is it is not clear why darker soil means an image must have been taken before one which has lighter soil. Though we are told that “We can therefore conclude beyond a doubt that Picture 6 was not taken after 15 July 2014…”

So, for Image 5 the “Bellingcat team” explain: “We assess with a high degree of probability that a number of areas of the original satellite image were digitally altered.” And that it was taken before July 15 not on July 17th as the Russians said.

That’s it. Quite a disappointment really.

There is quite a lot of “probably”. There seem to be certain assumptions that dark patches are “oil”. There is a gaping hole in the vegetation method of analysis – and the “oil pool” analysis. He does not appear to allow for the possibility that oil pools (if that is what it really is) can be cleaned up and then re-occur. That fact alone collapses his analysis. I’m not sure what the darker/lighter soil is supposed to indicate but, again, compost can be dug into a field making it darker. Or it can rain. Poly tunnels can be put in place and removed. Whatever; it seems quite possible that a piece of ground can appear light on 16 July, darker on the 17th and then light again on 13 September. It is also worth pointing out that he is comparing images taken with different imaging systems and processed in different ways. Despite the word “forensic” being littered all over the place he does not appear to have considered issues of calibrating his devices.

Error level analysis is explained on this web site. And on this one. Mr Higgins may have used the free tools on the first of these sites – called Fotoforensics. The text in his report describes Error Level Analysis thus:

Error level analysis (ELA): Error level analysis (ELA) identifies areas within an image that are compressed at different levels. With JPEG images (the format of the photographs under consideration here), the entire picture should be at roughly the same level of compression. If a section of the image is at a significantly different error level, then it likely indicates a digital modification.

And this is the same text as on the Fotoforensics web site.

Error Level Analysis (ELA) identifies areas within an image that are at different compression levels. With JPEG images, the entire picture should be at roughly the same level. If a section of the image is at a significantly different error level, then it likely indicates a digital modification.

Though the same text does appear to have been copied quite widely across the web.

Error level analysis works like this: a image is compressed and then compared to the original. All compression introduces a degree of error. When the compressed image is compared to the original it is possible to work out how much the error level is for each part of the image. The error level is how far off it is when you try to re-constitute the original from the compressed version. In general areas of pure colour compress well. These have low error levels. This is represented as black in an Error Level image. Areas with more detail, such as areas where there are high contrast boundaries, will compress less well. These are represented in an Error Level image as white areas. For example the unmodified image of the bookshelves in the tutorial from the Fotoforensics site shows how the pure white book has a low error level represented by black whereas the other books have a higher error level represented by white. Note that this is an unmodified image and still has white and black areas in its Error Level image. Referring to the same tutorial we can see an example of how a modified image can be detected by Error Level analysis. The image with the dinosaur and the books shows how these elements have been added digitally. Note that the point is that the added in books differ from their surroundings. They have been added in after the image has already been saved. If they had not been added in we would expect them to have the same error level as the other books around them. This concept is explained in this tutorial as well (on the original Error Level analysis web site). Note that in this image the vertical line in the wall at the left shows as white in the Error Level analysis image. This is because it is an area of high contrast with its surroundings. It has not been digitally altered. The areas on the lips, eyes and shirt have been. These areas show as having a different error level than their surroundings.

We can note that Error Level analysis is not an exact science. It is an interpretative skill. You have to understand it conceptually to use it. Even then as the words of the Fotoforensics tutorial explain:

ELA is only one algorithm. The interpretation of results may be inconclusive. It is important to validate findings with other analysis techniques and algorithms.

Mr Higgins applies Error Level analysis to the two images he analyses. These are Images 4 and 5. (These images are available here. And of course Mr Higgin’s Error Level images are in his report).

Mr Higgins claims that Error Level analysis shows that Image 4 has been digitally modified and it is “highly likely” that clouds have been added. This is a mistake. The ELA image he prints shows a swathe of white speckled area across the centre of the image and black either side. This is exactly what we would expect. The area in the centre has more detail. The areas at either side are clouds. These areas are blockier. They compress better than the centre area with its detailed landscape. Thus the centre area has some white speckling and the sides are black. This is the same as the unmodified image in the tutorial. Mr Higgins includes an image from Google Earth as a “reference photo” and he shows the ELA image for this. This shows the same pattern: a white area in the middle where there is more detail – in the landscape – and darker areas either side where there is cloud. These patterns are just what we would expect with an unmodified image of this kind.

Mr Higgins makes the same mistake with Image 5. Here he shows an ELA image which shows vehicles in a field. The vehicles show as white in the ELA. And the surrounding field as black. Mr Higgins and his team believe that this makes it “highly probable” that the images have been altered. Again; this is what we would expect. The soil is a uniform colour and so compresses well. Hence the black in the ELA image. The vehicles have more detail (as well as contrast with the soil) so there is a higher error level in these areas. Again; the reader can look at the sample unmodified image in the tutorial and observe the same result. Blockier areas of pure colour come out black in the ELA and areas with more detail as white.

To determine that an image has been modified with Error Level analysis you have to look at similar features (similar in terms of texture and adjacent to each other) and compare them. This is how in the tutorial we can detect that the books have been added. They are of the same level of detail as their surroundings so they should have the same error level. They don’t. Hence we know (or may believe) that they have been digitally added. In the case of these satellite images what Mr Higgins would need to do is show how the error levels differed between two vehicles parked next to each other. (Even then we would be making certain assumptions such as they both had similar markings. Most Error Level analysis examples and tutorials do not envisage working with satellite images and this clearly creates its own set of problems).

Apparently RT invited Mr Higgins to be interviewed and he declined. That is hardly surprising. [8]

The point of this really is how such a bungled report by someone with no professional background in this subject has been picked up by several papers. The author’s (apparently) one man company is described as an “investigative journalist organisation” or “investigative group” and the shaky material is promoted as “”Clear and unequivocal” that Russia faked MH17 evidence”. It is alarming that the anti-Russia campaign has reached the level where even the mainstream press will print this sort of stuff from the “blog-sphere” and treat it as credible.

[On a technical note. Error Level analysis works because every time a jpeg image is saved some compression takes place. Artefacts which are added after one or more initial saves will be subject to less overall compression and will have a lower error factor. Anyone who wanted to manipulate an image and avoid detection by Error Level analysis would simply need to keep the image in (for example) Photoshop until all the editing was complete and then make a single save to a jpeg.]


1. Mr Higgin”s company number is on his web site and you can look up the Company directors at Companies House.









Author: justinwyllie

EFL Teacher and Photographer