Web evidence points to pro-Russia rebels in downing of MH17

Igor Girkin, a Ukrainian separatist leader also known as Strelkov, claimed responsibility on a popular Russian social-networking site for the downing of what he thought was a Ukrainian military transport plane shortly before reports that Malaysian Airlines Flight MH17 had crashed near the rebel held Ukrainian city of Donetsk.

After news emerged that a commercial airliner had been taken down and its 295 passengers and crew likely killed Mr. Girkin reportedly erased his claims from his page on VKontakte, a Russian social media site that's similar to Facebook. [Editor's note: The original version misstated the number of people aboard MH17.]

The records of internet archive site The Wayback Machine (WM) appear to confirm that Girkin made such a claim and erased it soon thereafter.

The Wayback Machine (WM) is run by Internet Archive, a US-based non-profit corporation, and is dedicated to recording and preserving the state of websites as they've evolved over time. It does this by periodically crawling websites as they are changed and saving an exact copy to its archives.

Girkin's VKontakte page is one of those sites recorded by The Wayback Machine. The site uploaded a version on July 17 at 15:22:22 GMT that included the following statement (All quotes from the page are translated from the original Russian).

"In the vicinity of Torez, we just downed a plane, an AN-26. It is lying somewhere in the Progress Mine. We have issued warnings not to fly in our airspace. We have video confirming. The bird fell on a waste heap. Residential areas were not hit. Civilians were not injured."

The Antonov 26 is a Soviet-era military cargo plane The post also links to two videos of plane wreckage on the ground that appear identical to the footage since shown on television of the wreckage of Flight MH17.

WM shows another, largely identical archive of Girkin's page from about 27 minutes later at 15:49:39. But at 16:10:58, WM shows a new version of the page, which features a newer post that appears to be copied and pasted from an Interfax article. The new archive contains both the older claim of responsibility and this new statement:

The leadership of the Donetsk People's Republic [DNR] deny any connection to the falling of the Malaysian Boeing 777 near Donetsk. Interfax was informed about it by a member of the Security Council of the [Donetsk] Republic, Sergei Kavtanadze. According to him, self-defense formations do not have at their disposal armaments capable of hitting a plane the the altitude of 10,000 meters. The mobile Zenit rocket complexes that DNR forces possess have a maximum effective range of 3,000 meters.

Girkin's VKontakte page was updated a third time, at 16:56:38. In the third update the claim about the AN-26 has been deleted and a new post appears that claims that flight MH17 could not have been shot down by the rebels:

The Prime Minister of the DNR Alexander Borodai has officially confirmed the fact of the falling of the passenger plane near Toreza. At the crash site and investigative team of the general prosecutor's office of the DNR is working. The DNR is interested in an objective investigation of this incident and is prepared to give foreign investigators access to the crash site. 

   Alexander Borodai believes this is a provocation by Ukrainian siloviki [hawks]. The DNR doesn't have anti-aircraft weapons capable of hitting a passenger plane flying at the cruising altitude of air routes. The ceiling of our own anti-aircraft weapons is 2.5 km. The cruising altitude of passenger planes is considerably greater. The Ukrainian side, as early as July 14, announced that it was putting its air defenses into combat readiness.

In fact, the Donetsk rebels have claimed to have in their possession a number of mobile "Buk" anti-aircraft systems in the past, though they appear to be trying to scrub such claims from the internet today.

All this creates the impression that Girkin claimed responsibility for the downing of MH17, thinking it was a Ukrainian military transport, and then panicked and tried to hide the evidence after the truth came out.

It is possible that the WM website could have been spoofed somehow to create these records, but it would not be easily done. To do so would either require hacking WM and creating the new records within its system, or spoofing the records by tricking WM into thinking it was accessing Girkin's page when it was actually accessing a third-party site. Both possibilities would be difficult to carry out.