Here, I will discuss one of the conspiracy theories regarding the attack on Malaysia Airline flight MH17. This will not be about formulating yet another theory - or blaming anyone for what happened. I will focus purely on independently verifyable technical matters.
If you want to follow along, you will need these tools:
Start by watching the following video (Evidence to Frame Russia For MH17 Shoot Down Fabricated): http://www.youtube.com/watch?v=RMgIpC-bCfQ
Watch the video now, and come back when you are done.
From this video we will focus on the claims regarding timestamp of the video released by Security Service of Ukraine (SSU). The conspiracy theorists say, that video released by the SSU has the timestamp 2014-07-16. This timestamp has been used as an evidence that the talk between the rebels has been fabricated before the actual attack.
In this screenshot from the conspiracy theorist video we can see the MD5 checksum of the file: 60becafeb82244e6a01d994fca8569c1. You can download this file from the following link: https://mega.co.nz/#!t54xzS4Q!-o9KptLgfs09ASR6ulsNdKCJfS1Srr5bBEe2euCHYwY
After downloading it and calling
mediainfo 60becafeb82244e6a01d994fca8569c1.mp4
we get the following output.
General
Complete name : 60becafeb82244e6a01d994fca8569c1.mp4
Format : MPEG-4
Format profile : Base Media / Version 2
Codec ID : mp42
File size : 1.87 MiB
Duration : 1mn 50s
Overall bit rate mode : Variable
Overall bit rate : 143 Kbps
Encoded date : UTC 2014-07-16 19:10:24
Tagged date : UTC 2014-07-16 19:10:24
gsst : 0
gstd : 110131
gssd : BADC21589HH1405627699593402
gshh : r9---sn-3c27ln7z.googlevideo.com
Video
ID : 1
Format : AVC
Format/Info : Advanced Video Codec
Format profile : [email protected]
Format settings, CABAC : No
Format settings, ReFrames : 1 frame
Codec ID : avc1
Codec ID/Info : Advanced Video Coding
Duration : 1mn 50s
Bit rate : 43.9 Kbps
Maximum bit rate : 321 Kbps
Width : 480 pixels
Height : 360 pixels
Display aspect ratio : 4:3
Frame rate mode : Constant
Frame rate : 25.000 fps
Color space : YUV
Chroma subsampling : 4:2:0
Bit depth : 8 bits
Scan type : Progressive
Bits/(Pixel*Frame) : 0.010
Stream size : 591 KiB (31%)
Tagged date : UTC 2014-07-16 19:10:25
Audio
ID : 2
Format : AAC
Format/Info : Advanced Audio Codec
Format profile : LC
Codec ID : 40
Duration : 1mn 50s
Bit rate mode : Variable
Bit rate : 96.0 Kbps
Maximum bit rate : 102 Kbps
Channel(s) : 2 channels
Channel positions : Front: L R
Sampling rate : 44.1 KHz
Compression mode : Lossy
Stream size : 1.26 MiB (67%)
Title : IsoMedia File Produced by Google, 5-11-2011
Encoded date : UTC 2014-07-16 19:10:24
Tagged date : UTC 2014-07-16 19:10:25
Here is the timestamp used as an evidence
Encoded date : UTC 2014-07-16 19:10:24
Also, from seeing the following tags we can conclude that the file comes from youtube.
gsst : 0
gstd : 110131
gssd : BADC21589HH1405627699593402
gshh : r9---sn-3c27ln7z.googlevideo.com
The source of the video above is the youtube channel of the Security Service of Ukraine (Служба безпеки України): http://www.youtube.com/watch?v=V5E8kDo2n6g
Now we will download this file using youtube-dl.
youtube-dl.py http://www.youtube.com/watch?v=V5E8kDo2n6g
And again check it using mediainfo
mediainfo Щодо збитого літака (оновлено)-V5E8kDo2n6g.mp4
Output:
General
Complete name : Щодо збитого літака (оновлено)-V5E8kDo2n6g.mp4
Format : MPEG-4
Format profile : Base Media / Version 2
Codec ID : mp42
File size : 2.89 MiB
Duration : 2mn 23s
Overall bit rate mode : Variable
Overall bit rate : 168 Kbps
Encoded date : UTC 2014-07-16 19:11:19
Tagged date : UTC 2014-07-16 19:11:19
gsst : 0
gstd : 143776
gssd : B58844104HH1405766464574251
gshh : r1---sn-2guxaxjvh-c0qe.googlevideo.com
Video
ID : 1
Format : AVC
Format/Info : Advanced Video Codec
Format profile : [email protected]
Format settings, CABAC : No
Format settings, ReFrames : 1 frame
Codec ID : avc1
Codec ID/Info : Advanced Video Coding
Duration : 2mn 23s
Bit rate : 69.9 Kbps
Maximum bit rate : 304 Kbps
Width : 480 pixels
Height : 360 pixels
Display aspect ratio : 4:3
Frame rate mode : Constant
Frame rate : 25.000 fps
Color space : YUV
Chroma subsampling : 4:2:0
Bit depth : 8 bits
Scan type : Progressive
Bits/(Pixel*Frame) : 0.016
Stream size : 1.20 MiB (42%)
Tagged date : UTC 2014-07-16 19:11:19
Audio
ID : 2
Format : AAC
Format/Info : Advanced Audio Codec
Format profile : LC
Codec ID : 40
Duration : 2mn 23s
Bit rate mode : Variable
Bit rate : 96.0 Kbps
Maximum bit rate : 103 Kbps
Channel(s) : 2 channels
Channel positions : Front: L R
Sampling rate : 44.1 KHz
Compression mode : Lossy
Stream size : 1.64 MiB (57%)
Title : IsoMedia File Produced by Google, 5-11-2011
Encoded date : UTC 2014-07-16 19:11:19
Tagged date : UTC 2014-07-16 19:11:19
Here we see a slightly different date, but still one day before the attacks.
Encoded date : UTC 2014-07-16 19:11:19
Now we will check the exact upload date of the video using youtube's api: http://gdata.youtube.com/feeds/api/videos/V5E8kDo2n6g?v=2
After pretty printing, the output looks like this:
<?xml version='1.0' encoding='UTF-8'?>
<entry xmlns='http://www.w3.org/2005/Atom' xmlns:media='http://search.yahoo.com/mrss/' xmlns:gd='http://schemas.google.com/g/2005' xmlns:yt='http://gdata.youtube.com/schemas/2007' gd:etag='W/"DEAHRX47eCp7I2A9XRZWF0s."'>
<id>tag:youtube.com,2008:video:V5E8kDo2n6g</id>
<published>2014-07-17T19:11:54.000Z</published>
<updated>2014-07-19T10:45:34.000Z</updated>
<category scheme='http://schemas.google.com/g/2005#kind' term='http://gdata.youtube.com/schemas/2007#video'/>
<category scheme='http://gdata.youtube.com/schemas/2007/categories.cat' term='People' label='People & Blogs'/>
<title>Щодо збитого літака (оновлено)</title>
<content type='application/x-shockwave-flash' src='http://www.youtube.com/v/V5E8kDo2n6g?version=3&f=videos&app=youtube_gdata'/>
<link rel='alternate' type='text/html' href='http://www.youtube.com/watch?v=V5E8kDo2n6g&feature=youtube_gdata'/>
<link rel='http://gdata.youtube.com/schemas/2007#video.related' type='application/atom+xml' href='http://gdata.youtube.com/feeds/api/videos/V5E8kDo2n6g/related?v=2'/>
<link rel='http://gdata.youtube.com/schemas/2007#mobile' type='text/html' href='http://m.youtube.com/details?v=V5E8kDo2n6g'/>
<link rel='http://gdata.youtube.com/schemas/2007#uploader' type='application/atom+xml' href='http://gdata.youtube.com/feeds/api/users/RxyjhmvBewJIRb2yku5EuQ?v=2'/>
<link rel='self' type='application/atom+xml' href='http://gdata.youtube.com/feeds/api/videos/V5E8kDo2n6g?v=2'/>
<author>
<name>Служба безпеки України</name>
<uri>http://gdata.youtube.com/feeds/api/users/RxyjhmvBewJIRb2yku5EuQ</uri>
<yt:userId>RxyjhmvBewJIRb2yku5EuQ</yt:userId>
</author>
<yt:accessControl action='comment' permission='denied'/>
<yt:accessControl action='commentVote' permission='allowed'/>
<yt:accessControl action='videoRespond' permission='moderated'/>
<yt:accessControl action='rate' permission='allowed'/>
<yt:accessControl action='embed' permission='allowed'/>
<yt:accessControl action='list' permission='allowed'/>
<yt:accessControl action='autoPlay' permission='allowed'/>
<yt:accessControl action='syndicate' permission='allowed'/>
<media:group>
<media:category label='People & Blogs' scheme='http://gdata.youtube.com/schemas/2007/categories.cat'>People</media:category>
<media:content url='http://www.youtube.com/v/V5E8kDo2n6g?version=3&f=videos&app=youtube_gdata' type='application/x-shockwave-flash' medium='video' isDefault='true' expression='full' duration='144' yt:format='5'/>
<media:content url='rtsp://r7---sn-4g57kuer.c.youtube.com/CiILENy73wIaGQmonzY6kDyRVxMYDSANFEgGUgZ2aWRlb3MM/0/0/0/video.3gp' type='video/3gpp' medium='video' expression='full' duration='144' yt:format='1'/>
<media:content url='rtsp://r7---sn-4g57kuer.c.youtube.com/CiILENy73wIaGQmonzY6kDyRVxMYESARFEgGUgZ2aWRlb3MM/0/0/0/video.3gp' type='video/3gpp' medium='video' expression='full' duration='144' yt:format='6'/>
<media:credit role='uploader' scheme='urn:youtube' yt:display='Служба безпеки України'>RxyjhmvBewJIRb2yku5EuQ</media:credit>
<media:description type='plain'>СБУ перехопила переговори терористів: І.Бєзлєр («Бєс») доповідає своєму куратору полковнику ГРУ ГШ ЗС РФ В.Германіну про щойно збитий бойовиками цивільний літак.</media:description>
<media:keywords/>
<media:license type='text/html' href='http://www.youtube.com/t/terms'>youtube</media:license>
<media:player url='http://www.youtube.com/watch?v=V5E8kDo2n6g&feature=youtube_gdata_player'/>
<media:thumbnail url='http://i1.ytimg.com/vi/V5E8kDo2n6g/default.jpg' height='90' width='120' time='00:01:12' yt:name='default'/>
<media:thumbnail url='http://i1.ytimg.com/vi/V5E8kDo2n6g/mqdefault.jpg' height='180' width='320' yt:name='mqdefault'/>
<media:thumbnail url='http://i1.ytimg.com/vi/V5E8kDo2n6g/hqdefault.jpg' height='360' width='480' yt:name='hqdefault'/>
<media:thumbnail url='http://i1.ytimg.com/vi/V5E8kDo2n6g/sddefault.jpg' height='480' width='640' yt:name='sddefault'/>
<media:thumbnail url='http://i1.ytimg.com/vi/V5E8kDo2n6g/1.jpg' height='90' width='120' time='00:00:36' yt:name='start'/>
<media:thumbnail url='http://i1.ytimg.com/vi/V5E8kDo2n6g/2.jpg' height='90' width='120' time='00:01:12' yt:name='middle'/>
<media:thumbnail url='http://i1.ytimg.com/vi/V5E8kDo2n6g/3.jpg' height='90' width='120' time='00:01:48' yt:name='end'/>
<media:title type='plain'>Щодо збитого літака (оновлено)</media:title>
<yt:duration seconds='144'/>
<yt:uploaded>2014-07-17T19:11:54.000Z</yt:uploaded>
<yt:uploaderId>UCRxyjhmvBewJIRb2yku5EuQ</yt:uploaderId>
<yt:videoid>V5E8kDo2n6g</yt:videoid>
</media:group>
<gd:rating average='3.3895385' max='5' min='1' numRaters='10859' rel='http://schemas.google.com/g/2005#overall'/>
<yt:statistics favoriteCount='0' viewCount='2087880'/>
<yt:rating numDislikes='4372' numLikes='6487'/>
</entry>From this output, the exact upload date looks like this:
<yt:uploaded>2014-07-17T19:11:54.000Z</yt:uploaded>
We have the following pieces of information
- A Youtube video used by conspiracy theorists with the "Encoded date" timestamp
2014-07-16 19:10:24 - The original Youtube video, downloaded from the Security Service with the "Encoded date" timestamp
2014-07-16 19:11:19 - The upload time of the original video
2014-07-17T19:11:54.000Z
Now, there is a small difference in the "Encoded date" timestamps. The video referred by the cospiracy theorists (60becafeb82244e6a01d994fca8569c1) and the version we downloaded from youtube are different: they are not exactly the same quality. Youtube stores different encodings of the same file at different quality levels.
One possible reason these timestamps:
- Youtube itself sets the encoded date when it reencodes the file for every quality level
- There is a bug in the code that sets the encoded date, an off-by-one error, which sets encoded date timestamp always 24 hours before the actual upload date.
To test this theory take any youtube video and see if there is a 24 hours difference between the encoded date in the metadata and the upload date returned from the API.
Lets say we take conspiracy theorist's video we watched at the beginning and see if this 24 hours difference in the encoded date and the upload date still holds.
http://www.youtube.com/watch?v=RMgIpC-bCfQ
Check out the upload date using google's api: http://gdata.youtube.com/feeds/api/videos/RMgIpC-bCfQ?v=2
<?xml version='1.0' encoding='UTF-8'?>
<entry xmlns='http://www.w3.org/2005/Atom' xmlns:media='http://search.yahoo.com/mrss/' xmlns:gd='http://schemas.google.com/g/2005' xmlns:yt='http://gdata.youtube.com/schemas/2007' gd:etag='W/"AkQNQX47eCp7I2A9XRZWF0s."'>
<id>tag:youtube.com,2008:video:RMgIpC-bCfQ</id>
<published>2014-07-18T10:43:10.000Z</published>
<updated>2014-07-19T11:13:10.000Z</updated>
<category scheme='http://schemas.google.com/g/2005#kind' term='http://gdata.youtube.com/schemas/2007#video'/>
<category scheme='http://gdata.youtube.com/schemas/2007/categories.cat' term='News' label='News & Politics'/>
<title>Evidence to Frame Russia For MH17 Shoot Down Fabricated?</title>
<content type='application/x-shockwave-flash' src='http://www.youtube.com/v/RMgIpC-bCfQ?version=3&f=videos&app=youtube_gdata'/>
<link rel='alternate' type='text/html' href='http://www.youtube.com/watch?v=RMgIpC-bCfQ&feature=youtube_gdata'/>
<link rel='http://gdata.youtube.com/schemas/2007#video.related' type='application/atom+xml' href='http://gdata.youtube.com/feeds/api/videos/RMgIpC-bCfQ/related?v=2'/>
<link rel='http://gdata.youtube.com/schemas/2007#mobile' type='text/html' href='http://m.youtube.com/details?v=RMgIpC-bCfQ'/>
<link rel='http://gdata.youtube.com/schemas/2007#uploader' type='application/atom+xml' href='http://gdata.youtube.com/feeds/api/users/ittVh8imKanO_5KohzDbpg?v=2'/>
<link rel='self' type='application/atom+xml' href='http://gdata.youtube.com/feeds/api/videos/RMgIpC-bCfQ?v=2'/>
<author>
<name>PrisonPlanetLive</name>
<uri>http://gdata.youtube.com/feeds/api/users/PrisonPlanetLive</uri>
<yt:userId>ittVh8imKanO_5KohzDbpg</yt:userId>
</author>
<yt:accessControl action='comment' permission='allowed'/>
<yt:accessControl action='commentVote' permission='allowed'/>
<yt:accessControl action='videoRespond' permission='moderated'/>
<yt:accessControl action='rate' permission='allowed'/>
<yt:accessControl action='embed' permission='allowed'/>
<yt:accessControl action='list' permission='allowed'/>
<yt:accessControl action='autoPlay' permission='allowed'/>
<yt:accessControl action='syndicate' permission='allowed'/>
<gd:comments>
<gd:feedLink rel='http://gdata.youtube.com/schemas/2007#comments' href='http://gdata.youtube.com/feeds/api/videos/RMgIpC-bCfQ/comments?v=2' countHint='271'/>
</gd:comments>
<yt:hd/>
<media:group>
<media:category label='News & Politics' scheme='http://gdata.youtube.com/schemas/2007/categories.cat'>News</media:category>
<media:content url='http://www.youtube.com/v/RMgIpC-bCfQ?version=3&f=videos&app=youtube_gdata' type='application/x-shockwave-flash' medium='video' isDefault='true' expression='full' duration='478' yt:format='5'/>
<media:content url='rtsp://r5---sn-4g57kues.c.youtube.com/CiILENy73wIaGQn0CZsvpAjIRBMYDSANFEgGUgZ2aWRlb3MM/0/0/0/video.3gp' type='video/3gpp' medium='video' expression='full' duration='478' yt:format='1'/>
<media:content url='rtsp://r5---sn-4g57kues.c.youtube.com/CiILENy73wIaGQn0CZsvpAjIRBMYESARFEgGUgZ2aWRlb3MM/0/0/0/video.3gp' type='video/3gpp' medium='video' expression='full' duration='478' yt:format='6'/>
<media:credit role='uploader' scheme='urn:youtube' yt:display='PrisonPlanetLive'>prisonplanetlive</media:credit>
<media:description type='plain'>Evidence presented by Ukraine to implicate Russia in the shoot down of the Malaysian Airlines plane appears to have been fabricated.
http://infowars.com
Facebook @ https://www.facebook.com/paul.j.watson.71
FOLLOW Paul Joseph Watson @ https://twitter.com/PrisonPlanet</media:description>
<media:keywords/>
<media:license type='text/html' href='http://www.youtube.com/t/terms'>youtube</media:license>
<media:player url='http://www.youtube.com/watch?v=RMgIpC-bCfQ&feature=youtube_gdata_player'/>
<media:thumbnail url='http://i1.ytimg.com/vi/RMgIpC-bCfQ/default.jpg' height='90' width='120' time='00:03:59' yt:name='default'/>
<media:thumbnail url='http://i1.ytimg.com/vi/RMgIpC-bCfQ/mqdefault.jpg' height='180' width='320' yt:name='mqdefault'/>
<media:thumbnail url='http://i1.ytimg.com/vi/RMgIpC-bCfQ/hqdefault.jpg' height='360' width='480' yt:name='hqdefault'/>
<media:thumbnail url='http://i1.ytimg.com/vi/RMgIpC-bCfQ/1.jpg' height='90' width='120' time='00:01:59.500' yt:name='start'/>
<media:thumbnail url='http://i1.ytimg.com/vi/RMgIpC-bCfQ/2.jpg' height='90' width='120' time='00:03:59' yt:name='middle'/>
<media:thumbnail url='http://i1.ytimg.com/vi/RMgIpC-bCfQ/3.jpg' height='90' width='120' time='00:05:58.500' yt:name='end'/>
<media:title type='plain'>Evidence to Frame Russia For MH17 Shoot Down Fabricated?</media:title>
<yt:aspectRatio>widescreen</yt:aspectRatio>
<yt:duration seconds='478'/>
<yt:uploaded>2014-07-18T10:43:10.000Z</yt:uploaded>
<yt:uploaderId>UCittVh8imKanO_5KohzDbpg</yt:uploaderId>
<yt:videoid>RMgIpC-bCfQ</yt:videoid>
</media:group>
<gd:rating average='4.628483' max='5' min='1' numRaters='646' rel='http://schemas.google.com/g/2005#overall'/>
<yt:statistics favoriteCount='0' viewCount='58347'/>
<yt:rating numDislikes='60' numLikes='586'/>
</entry>Interesting information:
<yt:uploaded>2014-07-18T10:43:10.000Z</yt:uploaded>
Now download this file
youtube-dl.py http://www.youtube.com/watch?v=RMgIpC-bCfQ
And then call mediainfo on it:
mediainfo "Evidence to Frame Russia For MH17 Shoot Down Fabricated-RMgIpC-bCfQ.mp4"
Output:
General
Complete name : Evidence to Frame Russia For MH17 Shoot Down Fabricated-RMgIpC-bCfQ.mp4
Format : MPEG-4
Format profile : Base Media / Version 2
Codec ID : mp42
File size : 28.7 MiB
Duration : 7mn 57s
Overall bit rate mode : Variable
Overall bit rate : 505 Kbps
Encoded date : UTC 2014-07-17 10:44:19
Tagged date : UTC 2014-07-17 10:44:19
gsst : 0
gstd : 477053
gssd : B58844105MH1405768514291833
gshh : r2---sn-2guxaxjvh-c0qe.googlevideo.com
Video
ID : 1
Format : AVC
Format/Info : Advanced Video Codec
Format profile : [email protected]
Format settings, CABAC : Yes
Format settings, ReFrames : 1 frame
Format settings, GOP : M=1, N=60
Codec ID : avc1
Codec ID/Info : Advanced Video Coding
Duration : 7mn 57s
Bit rate : 359 Kbps
Maximum bit rate : 3 158 Kbps
Width : 1 280 pixels
Height : 720 pixels
Display aspect ratio : 16:9
Frame rate mode : Constant
Frame rate : 30.000 fps
Color space : YUV
Chroma subsampling : 4:2:0
Bit depth : 8 bits
Scan type : Progressive
Bits/(Pixel*Frame) : 0.013
Stream size : 20.4 MiB (71%)
Tagged date : UTC 2014-07-17 10:44:23
Audio
ID : 2
Format : AAC
Format/Info : Advanced Audio Codec
Format profile : LC
Codec ID : 40
Duration : 7mn 57s
Bit rate mode : Variable
Bit rate : 144 Kbps
Maximum bit rate : 151 Kbps
Channel(s) : 1 channel
Channel positions : Front: C
Sampling rate : 44.1 KHz
Compression mode : Lossy
Stream size : 8.19 MiB (29%)
Title : IsoMedia File Produced by Google, 5-11-2011
Encoded date : UTC 2014-07-17 10:44:21
Tagged date : UTC 2014-07-17 10:44:23
Summary:
Ecoded date from the downloaded youtube file:
Encoded date : UTC 2014-07-17 10:44:19
Exact upload date using the API:
<yt:uploaded>2014-07-18T10:43:10.000Z</yt:uploaded>
Again, almost exactly 24 hours of difference.
In fact, take any youtube file, you will find that the encoded date timestamp is 24 hours behind the upload date, therefore the "timestamp evidence" doesn't prove anything. Reasons? Possiblly some date/time API where the day of the month is in the ranges of (0,30) and an off-by-one error in the code at youtube that sets the encoded date.