THAT DAY, JULY 17, 2014, THE SKY over Eastern Ukraine was filled with hazy clouds.
On top of the haze, a Malaysia Airlines passenger jet glided en route from Amsterdam to Kuala Lumpur, the capital of Malaysia. Flight MH17 carried 15 crew members and 283 passengers, 80 of them children. A majority of the travelers were tourists heading to beach vacations in Southeast Asia. Six AIDS researchers were on their way to a conference in Australia.1
In the airspace over Donetsk, air traffic control suddenly lost contact with the Boeing 777. The plane was last sighted thirty miles from the Ukraine–Russia border.
As soon as I saw the first breaking news report, I left early for my night shift at Yle.
Anyone familiar with Russia’s warfare in Ukraine had immediate misgivings. Flight MH17 had disappeared flying eastward in the airspace where the Russian military intelligence and Kremlin-directed warlords fought the Ukrainian defense forces with heavy weaponry. Three days before, gangs of Russian-speaking militants had shot down a Ukrainian military cargo plane in the region.
At the Yle news desk, the international wires started flashing with bright red URGENT notifications; according to US intelligence services, the Malaysian plane had been taken down with a missile. Fans of the militants bragged on VKontakte, the Russian counterpart to Facebook, that yet another Ukrainian cargo plane had been downed near Torez. The VKontakte communication was the first sign of the Kremlin-backed militants’ involvement in the death of nearly 300 civilians. It seemed that the rebels had downed the passenger jet by accident after confusing it with a Ukrainian military aircraft.
As soon as the international correspondents arrived at the remote Eastern Ukrainian field and started taking photos of the smoking mattress of wreckage, it became evident that none of the passengers on Flight MH17 had survived. Among the blackened, bent splinters of the Boeing, only a couple of undamaged objects stood out: a small, button-eyed teddy bear and a travel guidebook to Bali and Lombok. Holding back tears, I wrote about the crash on Yle’s website.
Over 1300 miles northwest of the rebel-held fields, in Leicester, England, the blogger and citizen journalist Eliot Higgins, then thirty-five, learned about the crash. He set out to investigate what exactly had happened to the plane.
Higgins had previously investigated the civil war in Syria and other conflicts in the aftermath of the Arab Spring. He is a self-taught weapons expert, and media profiles describe him as a one-man intelligence service.2 He conducts his research solely by harvesting publicly available material, i.e., open sources.
Three days before the plane crash, Higgins had launched Bellingcat, a crowd-financed publishing platform for war and conflict bloggers.3 He wanted to provide a hub for open-source investigators and an educational site for anyone who wanted to learn about open-source research techniques.
As soon as Higgins heard about the disaster, he started to comb through social media. Quickly, he found a video that had been filmed in Eastern Ukraine and published that same day. It showed a missile launcher being transferred via an unidentified country road in an unknown location. The uploader removed the video the same evening, but Higgins managed to save it. He first tried to identify the missile launch system. To locate the transport, he compared the video’s visible landmarks with satellite images. In order to verify the location, he asked for assistance from his social media followers. Many wanted to help in the investigation and sent him information. Higgins was able to figure out the direction of the launcher by analyzing the position and direction of the video camera. He verified his findings using Google Earth.
By the evening of July 17, 2014, Bellingcat had published the results of its open-source investigation. The launcher was a Soviet-manufactured Buk, designed to counter missiles and military aircraft, and had been transported southward in Eastern Ukraine from Snizhne, a rebel-held town near the Russian border. Higgins assessed that the launcher—which he located about six to ten miles from the crash site—was involved in the downing of the plane. This is how he started to uncover the first concrete evidence of flight MH17’s fate. And Higgins did this all from his own home, before the official international investigation team had managed to physically visit the site and investigate the plane’s black boxes.
Led by Higgins, the Bellingcat online community started to put together a puzzle that piece by piece proved the role of the Russian regime in this shocking mass killing. As a result, Eliot Higgins and Bellingcat became the target of systematic and still ongoing defamation by the Kremlin.
As a former passionate computer gamer and administrative clerk for a company housing asylum seekers, Higgins didn’t become an investigator into flight MH17 by chance. Well before he established Bellingcat, he had an unusual routine: every day he browsed videos on as many as 600 YouTube channels, analyzed the most important ones, and published his analyses on his blog, Brown Moses, which was popular among conflict experts and journalists.
Over the years, Higgins uncovered YouTube videos exposing atrocities and terrorism in Syria, Egypt, and Libya. He had been the first to reveal to the international community that the regime of Syrian dictator Bashar al-Assad had used chemical weapons against its own people in 2013, acquiring the information from videos uploaded to YouTube by local residents. He also used his skills to assist Human Rights Watch in investigating crimes against humanity.
Higgins originally became a blogger because he couldn’t find enough in-depth media coverage of security developments in Libya, Syria, and Egypt. “I was looking at the conflicts and saw all the stuff posted about them on social media. I saw that journalists didn’t make use of all the available material. So I thought, I want to start writing about these topics myself. They were interesting and no one else covered them,” Higgins told me.
During his time blogging at Brown Moses, journalists praised Higgins’s expertise and frequently backed up his findings. But hostile feedback also poured in. For example, as he provided proof of the crimes committed by the Syrian regime, the online community supportive of both Assad and Putin attacked him. “I’ve built myself an audience of people who really hate me. I’ve had trolls longer than I’ve had my own children,” he shares.
Higgins’s experience as a blogger and weapons expert, added to his habit of spending much of his time online, prepared him for the attacks that the Russian government and its propaganda machine had in store for him. RT had already targeted Higgins even before the MH17 investigations. In September 2013, after Higgins revealed Assad’s use of chemical weapons, the London-based RT claimed, contrary to the facts, that Higgins had attributed the chemical attacks to Syrian rebels and opposition forces.4
RT is regulated by the Office of Communications (Ofcom), the British communications industry watchdog.5 In the United Kingdom, Ofcom is the body that licenses commercial television and radio services and maintains the ethical rules of the broadcasters. According to Ofcom, licensed broadcasters must avoid unjust and unfair treatment of individuals or organizations. If a TV program alleges that a named individual has engaged in wrongdoing or incompetence or makes other similar allegations, the individual is entitled to comment and provide their own view.6
Higgins filed a complaint, asking the agency to investigate whether RT’s coverage of his Syria findings was fair and just. RT responded by filing a counterresponse written by its representative, a multimillion-pound law firm, which supported RT’s coverage. In addition, they combed through Higgins’s social media channels and used his findings to “prove” Higgins was a “Russophobe.”
RT’s aggressive response did its job: Ofcom concluded that the outlet’s reporting about Higgins had been fair and just.7 The decision spurred Higgins to dig further. He decided that if he ever became the target of RT’s fake news again, his next complaint to Ofcom would be even more detailed.
After Higgins began to expose information about the Russian military’s involvement in the crash of flight MH17, he became a regular target of smearing by RT, as well as other Kremlin fake news outlets.
For its flight MH17 investigation, Bellingcat published an ongoing series of articles that unearthed Russia’s illegitimate and hidden operations leading up to the crash. The community browsed videos, photos, and social media postings in order to further geolocate and expose the missile launcher’s path in detail. The materials revealed that the launcher was missing at least one missile.
To hamper the investigation, the Kremlin and its media apparatus pushed innumerable conspiracy theories placing the blame for the crash anywhere except on the warlords it backs and arms in Ukrainian territory. The cultivation of lies and blaming of Ukraine started immediately after the crash. According to the main Russian newspapers and TV stations, the downing of flight MH17 was a “Ukrainian provocation” or even a possible plot to assassinate Putin.8 The Russian Ministry of Defense presented satellite imagery that Bellingcat quickly debunked as heavily manipulated.9 The ministry also fed the media falsehoods about the flight path and radar data. On Russian state-owned Channel One, notorious fake news purveyor Mikhail Leontyev broadcast falsified satellite images depicting a photoshop-added Ukrainian fighter jet shooting at flight MH17 from the air.10 If it had been up to the Russian regime, their theories would have controlled world public opinion.
Official investigations of plane disasters can take years, and verified data usually isn’t available before the official investigation results are released. That was the information vacuum that the Kremlin wanted to fill. But Bellingcat’s research negated the Kremlin’s attempts at obfuscation. Instead, the community’s work anchored the debate about flight MH17 to proven evidence and facts, greatly contributing to the international public’s understanding of the reasons behind the crash.
A Dutch-led Joint Investigation Team was put in charge of the official criminal investigation into the MH17 disaster.11 The team was run by the Dutch public prosecution service and the police, and it cooperated with law enforcement in Australia, Belgium, Malaysia, and Ukraine. In September 2014, a few months after the crash, the Joint Investigation Team contacted Higgins and asked him to present Bellingcat’s findings to them. Higgins met the team members in London and provided them with the information.
At the same time, Bellingcat continued publishing major reports on the topic. It analyzed the disinformation spread by the Russian Ministry of Defense, as well as the variety of conspiracy theories spread about flight MH17.12 Bellingcat’s groundbreaking open-source research was covered by established media organizations around the world, which helped reshape the public image of the crash away from the Kremlin’s narrative.
About a year after Bellingcat was founded, I crossed paths with Eliot Higgins for the first time. In that encounter, I witnessed both his and Bellingcat’s impact on international journalism.
Around 900 journalists had gathered in Lillehammer, Norway, to learn best practices and the latest trends in investigative journalism. In the venue’s main auditorium, Higgins gave a detailed presentation describing Bellingcat’s investigation methods. Investigative journalists are a critical and demanding audience. But when Higgins ended his session, a wall of enthusiastic reporters circled him, filming him, snapping his photo, and recording interviews with him with such passion that Higgins was forced to give his comments with his back against the wall. Higgins’s know-how in the field of open-source investigations, a skill many journalists lack, had earned him superstar status within the international journalistic community.
But the Kremlin’s fake news architects viewed him in a very different way.
A new pro-Kremlin propaganda outlet geared to an international audience was launched in September 2014. The site, called Russia Insider, which publishes in English and Russian, claims, just like many other fake news sites, to be a crowdsourced citizen journalism project. It also promises to “expose the BS.”13 Russia Insider asks its readers for donations, sells space to advertisers, and also offers an ad-free membership. In 2018, the site recruited “volunteers” for different roles: writers, video and audio production journalists, manager of their YouTube channel, editors of different sections, and translators. I built a fake identity and offered myself as a volunteer citizen journalist, but never heard back from them.
Russia Insider pieces feature headlines such as “Top Russian Officials: Putin’s Superweapons [Which] Are Like Nothing the West Has Ever Seen”; offer praise for former US president Donald Trump; and ask questions such as, “Is There a British Assassination Campaign Targeting Russian Exiles?”14 15 The site depicts the United States as a “degeneracy” and runs a section called “The Jewish Question,” devoted to demonizing Jews. Several Russia Insider contributors publish using pseudonyms.
Russia Insider also publishes interviews with the Kremlin’s top officials, including Leonid Reshetnikov, the director of the Russian Institute of Strategic Studies.16 (In 2016, Reshetnikov co-authored a piece on the site about the CIA’s alleged plan to assassinate Putin.)17 Normally, citizen journalists or pseudonyms don’t have access to such high-level interview subjects. Based on that, and other content on the site, it it is not out of the question that some of Russia Insider’s pseudonymous writers either work inside the Russian intelligence services, or receive instructions on what to write from them.
Russia Insider had been in existence for only a couple of months when it started going after Eliot Higgins. The first filth story it published described Higgins as an “Englishman and a life-size dildo” and compared him to the South Park animated character Mr. Hankey, a talking piece of feces.18 Since then, Russia Insider has published nearly a hundred pieces mocking Higgins and Bellingcat. The site has labeled Higgins a NATO and US government lackey, an idiot, a YouTube sleuth, and someone who doesn’t understand anything about Russia’s Syrian campaign. His personality has been assessed in the online mag as tendentious, insincere, and obsessive. Russia Insider “knows” that Higgins regularly visits NATO headquarters, where he is briefed on “research.” Bellingcat’s investigations are “wet Buk fantasies” and reinforce US government propaganda. In one of its most disturbing pieces, Russia Insider encouraged its readers to geolocate Higgins’s computer and confiscate it.19 In none of the articles smearing Higgins are the defamatory claims backed by evidence. In regular journalism, the target of criticism is always given the chance to provide his or her views. Russia Insider has never contacted Higgins.
But Sputnik did try to contact him.
Sort of.
Sputnik’s UK branch has also published countless smear stories about Eliot Higgins. One of the most aggressive was triggered when the Guardian covered a Bellingcat report concerning artillery shelling from Russia across the border into Debaltseve, Ukraine. Mark Hirst, Sputnik’s editor in Edinburgh, emailed Higgins and demanded answers to his conspiratorial accusations masked as questions, asking, among other things, if Higgins had received money from the United States, and how Bellingcat’s “citizen journalists” were capable of finding evidence of direct Russian military attacks against the Ukrainian army when NATO and the Western powers were unable to do so.
Higgins was already familiar with Sputnik’s methods. “That’s what they do: put unconnected statements together and ask me about that. I answered the questions, because they were so stupid, wrong, and ridiculous,” he says.
The end result was a conspiracy theory article which “connected” Higgins to an American organization called National Endowment for Democracy, which Sputnik claimed was a front for the CIA.20 In fact, NED is a nonprofit organization that supports human rights work and democratic institutions worldwide. Sputnik also tied Higgins to the Ukrainian Maidan protests, which they defined as “a coup.”
The next day, Sputnik attacked again. An anonymous piece published in their opinion section claimed that Bellingcat’s sources were unreliable and biased, and that the group was advancing the American and NATO political agenda.
In reality, it’s Sputnik which uses fake experts as commentators and sources. For example, in an anonymously written, mocking piece, Sputnik quoted an “expert” who represented a bizarre political blog called “Stop Imperialism.”21
The editor of the blog told Sputnik that Bellingcat had been discredited and was known for propagating disinformation. He also accused Higgins of having a history of making false claims, including accusations about Russia. Sputnik has published many similar pieces depicting Higgins as an amateur, biased, working for the governments of Ukraine and the United States, and disseminating false information.
Higgins told me that he doesn’t have the time to read Sputnik’s content. “A lot of the Sputnik articles concerning me are published in English, but they do them in other languages as well. I’m not sure why. I’m not going to read them or respond to them.”
Sometimes, the Kremlin’s propaganda outlets combine resources in their attacks.
In the summer of 2015, a joint operation was organized by Sputnik and an RT show called In the Now. (In the Now was later separated from RT’s brand and organized into a seemingly independent viral propaganda service.) The campaign was launched from In the Now’s YouTube channel with a video that highlighted anti-Bellingcat accusations originating from an anonymous Russian blogger. In response, Bellingcat tweeted out the video and said that RT was engaging in attacks.
In The Now then contacted Higgins through Twitter and asked to interview him for a “documentary.” Higgins jokingly replied that he didn’t do interviews with Russian government propaganda channels, as he had plenty of requests from real media outlets. RT’s Russian-language Twitter account was then activated, claiming that the “journalist who accuses Moscow of falsifying data on MH17 is afraid to give an interview to RT.”22
Sputnik continued the operation by publishing an anonymous piece that depicted Bellingcat volunteers as incompetent wannabe investigators and accusing Higgins of writing rude tweets and insulting the In The Now host, the American journalist Anissa Naouai. Sputnik presented no evidence to support its claims.
RT launched its next big offensive a few months later. This was clear payback for Bellingcat’s latest reports, which were again widely quoted and covered worldwide.
The first report that so irritated RT was published by the US think tank the Atlantic Council, with Higgins as one of its authors.23 It exposed the full scope of Russia’s weapons arsenal in Ukraine. Bellingcat also published a report about Russian air-strikes in Syria, as well as a new, conclusive MH17 report, which compiled all its research on the disaster to date.24
RT started its weeklong campaign the same morning the Bellingcat MH17 paper went public. In its first piece, the outlet questioned the validity of Bellingcat’s information as well as its research methods. The RT video described Higgins as a “thirty-six-year-old laid-off office worker,” with no experience in the field nor any higher education.25 According to RT, Higgins was an amateur, and Bellingcat’s work was as reliable as interpreting the patterns of “tea leaves.”26
RT even sent someone to physically stalk Higgins because they “wanted to find the man behind Bellingcat.” In a television spot, a content producer named Nimrod Kamer, introduced as a satirist, traveled by train to Higgins’s hometown because he wanted to “experience [Higgins] face-to-face.”27 In a sped-up recording, Kamer is seen roaming the streets hunting for Higgins, and also calling him on the phone “Eliot isn’t responding to his phone. I’m going to tweet him again, because he already sent me a few Twitter messages, and he keeps wanting me to email questions,” Kamer narrated.
Kamer was then filmed in fast-motion entering an office building and talking with a receptionist. As the receptionist is making a call following Kamer’s request, the RT “satirist” takes the phone from her hand and says, “Eliot, sorry—” The person on the other end of the line then hangs up, and Kamer hands the phone back to the receptionist.
At the end of the report, Kamer is seen knocking on the door of an apartment. As the door opens, Kamer sys he is looking for Eliot. The person who opens the door is Higgins’s mother. The film then cuts to Kamer asking Higgins not to “hide” from RT. However, Higgins hadn’t lived at that address for eight years. “He went to my old house, where my mother lives, and basically asked her where I was,” Higgins says. “My mother was very upset by that. Basically he couldn’t figure out where I lived, but he made up a strange article claiming ‘Higgins is hiding from us.’”
As the report cuts back to the studio, the RT anchor refers to Higgins’s coauthored report with the Atlantic Council and claims that the think tank has ties to the US government.
Higgins’s account of the story behind Kamer’s piece opens a fascinating window into RT’s fabrications. Kamer had contacted Higgins, saying he wanted to interview him. But Kamer failed to mention that he was preparing the piece for RT. Instead, he claimed he was doing the story independently. But Higgins had seen Kamer’s material on RT before, so he prepped his answers carefully. Higgins told Kamer that he wasn’t available immediately, but promised an interview at a later time. Though they had agreed to an interview, Kamer still traveled to Leicester in order to film a dramatic chase so he could claim that Higgins was “hiding.”
Higgins says that he knows many RT staffers. In private, some of them have admitted to admiring his work, and have even attended his lectures in London. But they are afraid of losing their jobs if they’re seen speaking with him. “They say, ‘Please don’t tell anyone, or I’ll get in trouble,’” Higgins says. “In RT’s worldview, I’m seen as part of a conspiracy against Russia. RT management really believes in this, but cameramen, reporters, and producers are just doing their jobs. I feel bad for them, because they’re trapped inside an organization they can’t escape from.”
Many RT employees start working for the channel directly after their university days, without knowing the real nature of the job. When they want to move on in their careers, they are unable to got employment at regular news networks, due to their association with RT. “People working with RT have told me: ‘It’s really shitty, but it’s a living,’” shares Higgins.
In early 2015, fake security notices started piling up in Higgins’s Gmail inbox. According to the messages, an outsider had tried to access his email account, and it was advised he “change [his] password by clicking on the attached link.”
Higgins thought the emails were a common scam known as phishing, and assumed that hackers were trying to gain access to his credit card data. He ignored the emails.
Later, Higgins read an article about ThreatConnect,28 an IT security company that had analyzed the cyber intrusions targeted at the Democratic National Committee as well as at the emails of John Podesta, Hillary Clinton’s campaign chairman, right before the 2016 US presidential election.
During the campaign, the DNC’s computer network had been infiltrated, and Podesta’s personal Gmail account hacked. As Election Day approached, many of his emails were published through WikiLeaks, for the purpose of smearing the Clinton campaign. The hacks were attributed to people connected to Russian intelligence.
Studying the screenshots of the emails used in the DNC and Podesta hacks, Higgins noticed that one of them looked familiar. He searched through his inbox using the wording in the screen capture published in the article, and found seven messages with exactly the same content. A closer look revealed that the emails he had received included the same minor grammatical errors and spelling mistakes as the emails used to penetrate the DNC and Clinton campaign. The links in the emails appeared proper, but led to malware sites.
Higgins also discovered that suspicious emails had also been sent to Aric Toler, a Bellingcat investigator, and the Finnish researcher Veli-Pekka Kivimäki. Kivimäki, a trained coder, had been targeted in March 2015, when attackers tried to gain access to his Gmail account, as well as his computer. As a Bellingcat contributor, Kivimäki was also investigating flight MH17. He therefore considered it likely that hackers wanted to keep track of how much he knew about the crash. Before Kivimäki was targeted, similar malicious emails had been sent to Ukrainian activists, NATO officials, and the official MH17 investigators. The attackers’ suspected origin was Russia.
After Higgins realized that his community had been targeted, he and his team decided to send the suspicious emails to two independent cybersecurity companies. The companies verified that the IP addresses, email addresses, and links were the same ones used by the Russian hacker group Fancy Bear in its attacks against the DNC and Podesta—part of the Kremlin’s systematic campaign to help elect Donald Trump president of the United States.29
The first Fancy Bear spearphishes against Bellingcat had occurred seven months after they launched their MH17 investigation. By July 2016, twenty-seven malicious emails had been sent to members of the Bellingcat team. The majority of them, sixteen, were sent to Higgins. If any of the Bellingcat team members had clicked the links, and changed their passwords at the malicious sites, they could have ended up providing Russian hackers with access to their computers. But they didn’t. “We ignored the Fancy Bear emails. We’re not idiots who open all emails. It’s different if you’re a sixty-year-old company employee who opens everything, because you don’t know anything about this. But we’re aware of this stuff, so it wasn’t a problem for us,” Higgins says. (Three years after Bellingcat received its first suspicious email, Special Counsel Mueller’s investigation on Russia’s interference in the US election resulted in indictments stating that Fancy Bear was an operation conducted by GRU, Russia’s military intelligence.)30
However, the cyber intrusions against Bellingcat weren’t finished.
CyberBerkut is an organized alliance of pro-Kremlin hackers known for attacking Ukrainian government websites. The group’s name reveals its mission: Berkut was an infamous Ukrainian special police force that the pro-Kremlin president ordered to violently disperse the demonstrators in Maidan Square.
CyberBerkut does the same to pro-democratic, freedom-minded journalists and human rights promoters—in cyberspace. Experts suspect that the group has ties to Russian State security structures. Pro-Kremlin media outlets have eagerly used materials acquired and produced by CyberBerkut as sources. For example, the Russian state-controlled news channel Vesti quoted CyberBerkut’s website and published a fabricated organizational chart depicting Aric Toler as a tool of Ukrainian security services, connected to NATO.31
Another Bellingcat contributor, a Moscow-based blogger, also became a target of CyberBerkut. He had contributed to many Bellingcat investigations, and his name was on the byline of a detailed open-source investigation into members of the Russian military’s special forces unit in Ukraine. In a post, he provided the soldiers’ names, roles, and photos, and their connection to a Russian Spetsnaz Brigade.
On February 24, 2016, an outsider accessed the Bellingcat website and posted malicious content which had been intercepted from the contributor’s private devices. The attackers published photographs of the blogger hanging from a ceiling, attached to piercings in his back, and wrote that he was a “sex pervert,” despite the fact that the activity didn’t have anything to do with sex. In addition, his phone number and address, a scan of his passport, the name of his girlfriend, and information concerning his dating and sex life were published on the Bellingcat site.
At first, it was unclear how the criminals had managed to bypass the site’s two-step verification process. ThreatConnect analyzed the breach and found that the blogger’s old email account had been hacked into, as had his LiveJournal account. From the stolen email account, the attackers found the username and password for his Bellingcat account. They also took over his iCloud account, which hadn’t been double secured, and started downloading material. As soon as the blogger learned about the breach, he cut off the attackers’ access to his iCloud account.
ThreatConnect concluded that the attackers had either intercepted the blogger’s SMS-based two-step authentication or had direct access to the mail servers of the Russian internet services company. In Russia, breaching individuals’ privacy is easy if you happen to work for the state security services or are under their protection. According to ThreatConnect’s scenarios, Fancy Bear and CyberBerkut might have coordinated their attacks against Bellingcat. It was also possible that they hadn’t coordinated the attacks but happened to have the same enemy, i.e. Bellingcat.
The defacing of Bellingcat’s website served two purposes: first, through the targeted blogger’s accounts, the hackers tried to access information about the group. It was also an attempt to smear the blogger and disgrace him in the eyes of his volunteer colleagues, as well as publicly.
Both attempts failed. As soon as Higgins learned about the illicit content, he removed it. “They were probably looking for emails between [the blogger] and the CIA, and obviously couldn’t find anything—as such emails don’t exist. Obviously it’s not nice to have personal stuff out there, but it wasn’t really that bad. Literally, no one gives a shit,” Higgins says.
Next to participate in the campaign against Bellingcat and Higgins was a British citizen named Graham Phillips, a seemingly independent YouTube “journalist.” On his blog, Phillips accused Higgins of manipulating videos and photos, but didn’t provide any evidence. In a smear story about Higgins, he tried backing up his allegations by encouraging his readers to have a look at the Twitter hashtag #Bellingcrap. I did as Phillips encouraged, and found that the hashtag is used by fake profiles, conspiracy theorists, and the Kremlin’s useful idiots, who trash Bellingcat, the UK, democracy, and freedom of speech.
Since 2013, Phillips has traveled extensively in the Russian-occupied Donbas area. Eventually, he was exposed as an FSB asset: a British blogger researched Phillips’s activities and collected an impressive number of photos showing Phillips being armed and escorted by soldiers of the “Donetsk People’s Republic.”32 The photos showed Phillips saluting the soldiers and smiling happily after receiving a medal from the FSB for his commitment to spreading propaganda. Phillips has also produced content for both RT and the Russian Ministry of Defense publication Zvezda (Star).33 In addition, he is listed as one of the contributors to Russia Insider. Phillips has openly bragged about being an “information soldier” in Russia’s propaganda war against Ukraine.
In 2014, Ukraine banned Phillips from entering the country because of national security considerations. Two years later, the Ukrainian government issued a warning letter to the UK authorities about Phillips’s “disgraceful” activities.34 But that didn’t stop him. In 2018, Ukraine asked the UK police to investigate Phillips’ actions, which it described as “terrorist activity.”35
Phillips is active on social media. He regularly tweeted until November 2018, when Twitter closed down his account. But he really plays to his YouTube audience of over 160,000 subscribers.36 His viral impact is wide: according to counters, the total number of views of his videos is in the millions. In one video, published in June 2019, Phillips toured Salisbury, England, talking about Sergei Skripal, the Russian double agent who was poisoned in 2018 along with his daughter.37 In a video spiced up with dramatic music, he described the daughter’s appearances in the media as “bizarre and scripted.”
Phillips seeks financial support from his audience. Over the years, he has created several crowdfunding campaigns on platforms like JustGiving and Indiegogo. He claims to use the money to fund “objective, independent journalism, an alternative to the standard, mainstream media, and reports from the UK, Europe, Russia and Donbas.” Many of his crowdfunding attempts haven’t been very successful: for example, in 2017 he managed to raise only £1,800. Nevertheless, he had enough funding to travel extensively around Russia and Eastern Ukraine. While JustGiving deleted one of Phillips’s campaigns and refused to give him the money he had raised, he continues to harvest money through the US-based Indiegogo—without disclosing to potential funders his connections with Russia’s security services.38 Phillips also collects cash through PayPal. Unlike the crowdfunding money, transfers made through PayPal are private. Thus Phillips’s profit through the platform isn’t visible to outsiders. Anyone can wire him money and thereby unwittingly or intentionally enable his activities.
While investigating the disinformation campaigns targeted at Eliot Higgins, I met a British specialist in social media propaganda. This expert, who wished to remain anonymous, had informed both PayPal and YouTube about Phillips’s activities multiple times and encouraged the companies to close down his accounts, without success. “Fake crowdfunded independent journalists are a relatively new phenomenon,” the specialist said. “But ultimately they’re a scam, fooling people into giving them money.”
Bellingcat has also been the target of disinformation offensives that have come directly from the Kremlin.
In April 2016, Russian Foreign Ministry spokesperson Maria Zakharova labeled Bellingcat “an instrument to divert attention from investigating the tragedy of the Malaysian Boeing over Ukraine.”39 She stated that the purpose of Bellingcat was to “continue to use all possible ‘fakes,’ to create quasi-evidence to blame Russia.… The aim is once again to give the global community fabricated proof of Russia’s aggression.” Zakharova’s statement was posted on the website of several Russian embassies, including the one in Malaysia. Earlier, similar baseless allegations had been disseminated by the Russian Ministry of Defense.
Eliot Higgins decided to email both ministries, asking for proof of their allegations. “I thought they wouldn’t respond, but I decided I’d do it anyway, for a laugh,” he says.
They did reply.
On April 14, 2016, the Russian Ministry of Foreign Affairs sent an email which once again questioned Bellingcat’s credibility and referred to unspecified instances when its research had supposedly been “called into question even by the Western media.”40 “You can check it by yourself by googling in the ‘world wide web’, especially since you consider yourself an Internet search professional,” read the email, which lacked a signature.41 The email further accused Bellingcat of cooperating with the Ukrainian authorities. It also chastised Higgins: “You never use information provided by other sides in your research, which is what leads one to suspecting you of bias.” The anonymous email failed to provide any concrete examples of Bellingcat’s “fakes.”
Higgins replied, once more asking for evidence and suggesting that the Foreign Ministry had made libelous claims. He also commented on the accusation of “bias” by stating that Bellingcat had examined all the evidence presented by the Russian Ministry of Defense and had determined that the ministry had lied repeatedly.
Less than a week later, the emailer responded again. This time, he or she wrote representing the Information and Press Department of the Ministry of Foreign Affairs of the Russian Federation. The email’s tone was familiar, lecturing Higgins: “Your persistence would find a better use if you did put some effort to performing your self-proclaimed Internet sleuth role.”42 The email also argued that the Ministry of Defense had already provided examples of Bellingcat’s falsifications—even though it has never provided any—as well as repeating a lie made by President Putin since 2014: “No one has provided actual proof of Russian Armed Forces’ presence in Ukraine. This is simply impossible because there are no Russian troops there, and there never were.”
Finally, the email listed what it claimed were examples of Bellingcat “fakes.” Among these were photos of the vehicles that had participated in the transportation of the Buk missile launcher invloved in the downing of flight MH17, photos of the launcher itself, another photo of the missile launch’s smoke trail, analysis of the Russian Ministry of Defense’s satellite images, and photographs of Russian soldiers.
Bellingcat volunteers analyzed the email’s content and determined that the main accusations were plagiarized from old LiveJournal blogs. At least four of the claims were copied directly from a LiveJournal blogger using the pseudonym “albert-lex.” Whether “albert-lex” was a paid troll or just a random online writer, the fact is that the Russian Ministry of Foreign Affairs had resorted to stealing the content of an anonymous blogger in an attempt to discredit Bellingcat.
In July 2016, Bellingcat released a new report which summarized the results from its then two-year investigation into the MH17 crash. The report detailed the Russian brigade’s movements, as well as individual soldiers’ roles in the convoy that transported the Buk to the Russia-Ukraine border. The report also debunked evidence fabricated by the Kremlin such as flight paths, radar data, and satellite images, as well as public statements by the Kremlin’s top politicians and the Russian Ministry of Foreign Affairs.43
The forty-two-page report was widely quoted by professional news organizations around the world. In response, Bellingcat became the target of Kremlin-backed fake news sites. Rossiya Segodnya (Russia Today) published a forty-three-page paper titled “Anti-Bellingcat. The Falsification of Open Sources About MH17: Two Years Later.”44 The anonymously written rebuttal declared that it would “reveal opinions and assessments of the really independent experts of space and geospatial information, air defense specialists, journalists and ordinary internet users, united by the desire to expose Bellingcat’s falsifications.” While the “report” deserves credit for its thoroughness, it misrepresented Bellingcat’s findings, denying nearly all of the group’s hard evidence and ending with a defiant promise that “the debunking of falsifications provided by the Bellingcat sofa experts and other similar fake groups is not finished.”45
The international editions of both RT and Sputnik quoted the report, and a follow-up report, which was published several months later.46 To this day, both reports are cited in RT’s articles attacking Bellingcat.
Around the same time, approximately thirty Russian-language articles appeared online within a span of about thirty hours. Some of them were published as blog posts on LiveJournal, others on mainstream Russian media. But each conveyed the same talking points. “It was the usual crap. For example, that Spiegel Online had to apologize because they used a forensic expert from Bellingcat,” Higgins says.
Bellingcat investigated the bizarre cloud of writings and determined that someone had likely sent out a propaganda press release about Eliot Higgins, and that multiple journalists and bloggers had published pieces based on the release. Further research uncovered that the network of sites and bloggers that published the release were connected to the Internet Research Agency, the infamous Russian troll factory. “Some of the LiveJournal bloggers no one had taken notice of,” says Higgins. “But now we knew, they belonged to the troll factory network. So all they managed to do was to provide new information.” According to Higgins, this particular operation was ineffective because the stories were in Russian, which restricts their target audience. He receives all sorts of eccentric material from “a lot of nutters and crazy people,” so thirty troll articles didn’t impress him. “If there is pro-Russian commenting in the internet forums, everyone thinks it’s a Russian troll anyways. So all the pro-Russian trolls have done is to convince everyone that anyone who is pro-Russian is a paid Russian troll, so that’s a ‘brilliant’ campaign. It’s completely counterproductive,” Higgins says.
On September 28, 2016, the Dutch-led Joint Investigation Team into flight MH17 held a press conference in the Netherlands. Over the course of two years, the team had examined thousands of parts of the plane’s wreckage, tested twenty weapons systems, accessed five billion internet pages, and researched half a million videos and photographs. More than 200 witnesses had been heard, around 150,000 intercepted telephone calls listened in on, with 3,500 intercepted conversations processed in their entirety. Everything was documented in 6,000 official reports. The investigators had sent 60 requests for legal assistance to more than 20 countries and received assistance from many. The team had even detonated a warhead and a missile in a test environment.47
The team’s preliminary results confirmed Bellingcat’s earlier findings.
That same day, RT called Eliot Higgins an “armchair blogger” and put together an edited video which pushed a degrading representation of the Bellingcat leader as a “laid-off admin worker, who made a name for himself by analyzing weapons used in the Syrian conflict,” had no background or training in weapons, had “never been to Syria,” and “doesn’t speak a word of Arabic.” The video—which mixed content from Higgins’s own presentations with clips from among other things, Rambo movies—failed to mention that Higgins was an internationally recognized expert who worked with global human rights organizations.48 RT also knowingly left out Higgins’s work with many universities and think tanks, as well as the countless factual findings of Bellingcat. Basically, RT carefully edited the clip to make Higgins look stupid and unreliable. “So many things in the video are wrong, and it’s fake news,” Higgins says. “There is no way to watch the video without realizing that it’s really poorly and unfairly edited. Using an old quote, which is not about now, this moment, is a way to attack me. To RT it doesn’t matter if a hundred experts say you’re right: RT will use the one who says you’re wrong.”
Higgins decided to again complain about RT to Ofcom. He was hopeful that this time, his complaint would succeed.
In addition to being attacked in the media, Higgins’s work has also made him a physical target. For example, conference organizers have had to frequently hire armed guards when he speaks. This happened in Latvia, which borders Russia and where the awareness of Russian-originating threats is higher than in many other countries. “Certain governments are careful about the security and have decided, based on their assessments, that we need more than just a hotel room—we need protection,” Higgins shares. “So when we go to a restaurant, the guards sit at different tables, watching the room at different angles. Then the staff is looking at them, looking at us, wondering who we are and why we’re getting this kind of treatment. It’s good, it’s like having a taxi service with guns.”
There have also been instances when the police have had to intervene on his behalf. In September 2016, Higgins attended the Joint Investigation Team’s press conference in the Netherlands, and gave a lecture at a local university afterward. Before the lecture, a Twitter user publicly threatened Higgins, saying that, “I will meet you with a gun.” When Higgins arrived at the university, he discovered that two police officers had been sent to protect him. The police had monitored his Twitter feed and reacted to the threat.
Higgins has also had to contact the police himself on occasion. A Twitter activist once created a series of websites using Higgins’s name and published harassing material, including Higgins’ home address. “There’s a certain line, where they attack you and you slag people off, and you expect to get some shit online, that’s just life,” Higgins says. “But when people start posting your address and photos of your house online, that crosses the line.”
Higgins contacted the websites’ hosts and got the sites taken down. But when the stalker found a new web host, Higgins went to the police, and announced to his social media followers that the harasser was being investigated. Following this the stalker, as well as several aggressive Twitter troll accounts, disappeared. Higgins had to help the police investigate the case. “The thing is, the police didn’t have a clue,” he says. “They asked me how to conduct the investigation, and I gave them tons of information. The person was sloppy and his website was badly done, so you could see his IP address. Six months later, the police asked, had I heard anything else from him? I said no, they said okay, case closed. I was like, fucking hell!”
Higgins figures that someone would have to be incredibly stupid to do something truly threatening to him, as he is well connected with journalists and law enforcement, who follow his endeavors closely: “If someone starts giving me shit in a major way, it’s not just journalists making notes, it’s policy makers, government people, and military intelligence. Military intelligence and government intelligence are very interested in what I do, even though they won’t say it directly. People who know people tell me they’re big fans and they love Bellingcat. They’re very interested whenever I start getting shit.”
In February 2017, a fake news site named SouthFront joined in the smearing of Higgins. SouthFront produces multilingual stories and videos specifically about the Russian military’s actions in Syria. The stories are allegedly crowdsourced citizen journalism, but many of the details are so specific that they must originate with officials and soldiers working for the Russian Federation. In a 2016 article I wrote about cyber warfare,49 I observed that the site looks suspiciously like a Russian military intelligence information operation; after the article came out, I became a SouthFront target myself.50 One anonymous citizen activist, worried about Russian information warfare, told me he had infiltrated SouthFront as a content producer. He sent them professional and factual pieces for publication, but the editors revised his articles to feature a pro-Kremlin slant.
SouthFront ran an anonymous “opinion piece” in which it called Bellingcat “an instrument of a hybrid war against Russia” and a “manifestation of the Hydra-headed intelligence ‘deep state.’”51
According to the theory drummed up by Russian trolls, the deep state—a secret shadow government, possibly tied to the military-industrial complex—governs outside of democratic institutions in the United States. The theory became increasingly popular during the 2016 presidential election, especially among Trump supporters. After the election, the concept was pushed by Trump’s former chief strategist Steve Bannon and his fake news site Breitbart News, among others, as well as by President Trump himself. One of the most active deep state advocates has long been Alex Jones, of Infowars fame.
At the same time that SouthFront published its piece connecting Higgins with the deep state, Russia’s Foreign Ministry launched a new international operation: an official website on which it claimed to identify “fake news” published around the world.52 According to the ministry, the website was launched as a counterreaction to the European Union’s East StratCom Task Force’s site “EU vs. Disinformation,” which exposes Russian propaganda operating in the European Union.53 But the Russian site’s specialty is labeling articles by professional journalists as fake news; for example, articles from the British newspaper the Guardian. False articles from SouthFront, MV-Lehti, or RT are never included. The Twitter account of the Russian embassy in the UK pinged Higgins to inform him of the new Russian fake news site. “They copied me on the tweet, which I thought was very funny. And rubbish,” Higgins says.
In January 2018, Ofcom came to a decision concerning Higgins’s second complaint against RT. In what was a surprise to many experts, the UK broadcasting regulator again ruled that RT’s reporting was fair and just.
To Higgins, Ofcom’s decision was obviously disappointing, though the complaint did result in some positive developments. “I have noticed RT reaching out to me more frequently and asking my response to claims about my work,” he says. “And the complaint seems to have discouraged them from writing about me. So at least my complaint had some impact.”
Soon thereafter, Ofcom was finally forced to take RT disinformation more seriously. After Russian military intelligence agents, whom Bellingcat helped to identify, poisoned the former Russian military intelligence officer Sergei Skripal and his daughter in Salisbury, England in early 2018, RT’s “reporting” about the matter was such that Ofcom opened multiple investigations into the clear bias of their news and current affairs programs for possible breaches of the UK broadcasting code.
In December 2018, Ofcom concluded that seven RT programs had broken the impartiality regulation. In July 2019, Ofcome fined RT £200,000 ($270,000) for “serious failures to comply with our broadcasting rules.”54 RT appealed the fine, but the ruling was upheld by the British High Court in March 2020.55 RT appealed a second time, to the Court of Appeals, which again ruled against the network in October 2021.56
In May 2018, President Putin continued to try to muddy the waters about who the guilty party was in the downing of flight MH17. The Kremlin leader’s platform on this occasion was the St. Petersburg International Economic Forum, an annual Russian business event attended by high-profile politicians and CEOs of global companies. The influential forum provides a perfect opportunity to stage information operations.
Putin was onstage with French president Emmanuel Macron, the Japanese prime minister, the Chinese vice president, and the IMF Managing Director. The previous day, the Joint Investigation Team had released an update on its work, positively mentioning Bellingcat’s previous investigations.57 Putin attacked the international investigators. “If there is no comprehensive investigation, it will certainly be very difficult for us to accept the conclusions of the investigating commission which works without us,” he said.58 Apparently, in Putin’s view, the conclusions of the Joint Investigation Team would only be acceptable if it included participants from the Russian authorities who were responsible for the crash in the first place.
The panel’s moderator, Bloomberg News editor in chief John Micklethwait, asked Putin: “Are you saying that it was not a Russian army missile?”
Putin answered: “It was not, certainly. Certainly not.”59
A month later, in June 2018, Dmitry Polyanskiy, Russia’s ambassador to the UN, continued the familiar accusations, claiming on Twitter that Bellingcat used “fakes.”60 When Bellingcat asked for evidence of his charges, Polyanskiy tweeted a photo of the Buk launcher used in Bellingcat’s research and stated, contrary to the facts, that “the direction of sunshade of one car can’t be opposite from the direction of sunshade of another….It’s against the laws of physics. This photo is a FAKE. You lie even in such small details. How can anyone trust you?”61
Bellingcat investigator Aric Toler responded and showed the ambassabor how he was wrong. But the ambassador wouldn’t accept that. On July 17, 2018, the fourth anniversary of flight MH17 being shot down, Polyanskiy wrote a letter to the UN Security Council demanding a thorough and objective international investigation—even though one had been underway for four years. He called Bellingcat “pseudo investigators … known for their fake news.”62 The following month, The Washington Post published an article about Bellingcat’s work and the Russian harassment targeted at the group.63
Polyanskiy’s revenge was immediate. He wrote a letter to the editor in chief of the Post, which he also published on Russia’s UN mission site.64 In the letter, he stated that he was “very much disappointed by this publication which clearly does not meet the standards of an unbiased journalist report.” He also portrayed Russia as a victim and claimed that its government systematically supported the attempt to find the guilty parties behind the downing of the plane. He also took the opportunity to mock both Bellingcat and the Dutch investigators.
Simultaneously, it was revealed that WikiLeaks had leaked internal chats that showed that an account with the pseudonym “wikileaks” had claimed that the financing for Bellingcat was coming in part from Britain’s Ministry of Defense. The same false and unverified claim was quickly spread as fact on RT and Sputnik, from whence it was further wildly spun. The shadiest sites claimed that Bellingcat was financed by British foreign intelligence, as well as by Swedish researcher Martin Kragh—and by me!
In early 2019, the foreign affairs committees of the three Baltic states, Estonia, Latvia, and Lithuania, jointly nominated Bellingcat for the Pulitzer Prize.65 Actions like this make it obvious that Russia has not been able to cause the negative impact against Bellingcat it has hoped for. “Well, RT can show a bad video about me,” shares Higgins. “But to me, if you watch Russia Today, you’re totally lost. Their fancy videos don’t influence anyone who has influence in any interaction with me in any serious way. The people I meet don’t care about RT stuff or haven’t heard of it. If they have, they’re on my side.” Higgins actually considers every attack from the Kremlin a confirmation that Bellingcat’s work is accurate. It is also difficult for Russia to undermine Bellingcat’s credibility because the community only uses information that is publicly accessible and well-sourced.
People sometimes ask Higgins why he writes “so much” about Russia. It’s because the Kremlin keeps lying. “If they didn’t lie, we wouldn’t have anything to write about,” he says. “There’s this idea of Russia as a master propagandist—they’re not. They lie, and they don’t have media in the West that critically examine it. The media should have been doing this for years, but many journalists say, ‘It’s so complicated, we can’t really look into it, therefore the truth is in the middle, here’s two sides of the story.’ Two sides of the story only work if both sides are truthful.”
Instead of being distracted by what he calls “stupid stuff from Russia,” Higgins prefers to focus on his justice and accountability work with the International Criminal Court, which he assists in the use of social media evidence, a complex issue that is currently unregulated by international standards. Higgins wants to help create guidelines, so that war criminals and other criminals can be held accountable.
He also continues to teach law enforcement, citizen groups, and other organizations how to use social media investigations effectively. Newcomers to the field might be worried about becoming the target of Russian-organized smear campaigns. How would Higgins, as a superstar of open-source investigations, advise someone interested in investigating Russia? “Do it,” he says. “Just beware that if you become too well-known and too popular, they will try to undermine and attack your work. So, if you have skeletons in your closet—like if you murdered someone or were a drug dealer—you probably don’t want to come along.” Higgins promises to help anyone who becomes the target of state-sponsored operations. “Propagandists see this as an information war. I never want to be a part of a propaganda war, but if they want me to become a part of it, hell, I will make sure I fight it,” he says.
In 2021, Higgins published We Are Bellingcat: An Intelligence Agency for the People. The book discusses his personal story as the founder of Bellingcat, as well as going behind the scenes of many of the community’s high-profile investigations.
For its part, the Bellingcat community continues to publish high-profile investigations into Russian military secrets, which are often quoted by the international media.
In June 2019, the Joint Investigation Team held a press conference in which they announced that four individuals would be prosecuted for their participation in the downing of flight MH17.66 The four were Igor Girkin (Strelkov), Sergey Dubinsky, Oleg Pulatov, and Leonid Kharchenko.67 Girkin is a former FSB colonel, while Dubinsky was a military intelligence officer with the Donetsk People’s Republic. Pulatov is a former lieutenant colonel in the Russian Armed Forces. The Joint Investigative Team confirmed Bellingcat’s previous statement that all four had been following orders from Russia.
The indicted individuals were allegedly responsible for transporting the missile launch system from Russia to Ukraine. All four were charged with the murder of the 298 people onboard flight MH17. All four have denied their involvement in the crash. The trial began in June 2020 in the Netherlands. As of this writing, the defendants have yet to appear in court.68