Kerch bridge attack – possible more evidence

The attack on the Kerch bridge has been an interesting source of discussion as to what the true cause of the explosion was.

Experts in the field of explosives, forensics and analysis have come to different conclusions on the subject. Many have said it could be any of the options and they just can’t say which it is.

And, of course, it has brought out the amateur “experts”.

I place myself somewhere between the two. I’m certainly not an expert in explosives or forensics when it comes to finding the source of an explosion/IED, but I like to think I’m pretty good at analysis – though not infallible. No one is!

This report is a discussion of ideas and thoughts. It isn’t a “It was truck” or “it was a boat” – it is a showing of evidence that I have found. Others have done the same. I will say now – I am ruling out a SOF planted devices or missile strike, and I won’t even cover these here.

However, I have found through watching the videos of the explosion some possible evidence that doesn’t seem to have been picked up elsewhere. The challenge was to find further evidence – this shows some.


The most popular conclusion for the explosion is the truck bomb. Quite handily, the Russian government also stated this was the source. They came up with the driver’s name, a company involved, cargo – even the route he took for the days preceding the explosion, and the strange action of taking 6 hours to drive along a road that should have taken less than an hour.

We all believe everything Russia says don’t we? In this case, it seems we do!

The Russians failed to say that the 6 hour extension of the journey was probably because the driver was asleep in a rest area somewhere. Russian “investigators” came up with Makhir Yusubov from Kazan in Tatarstan – but living in Krasnodar, south Russia – as the driver, and a story of fake companies. The family are being investigated.

An x-ray of the truck has been produced that shows the “explosive cargo” in the trailer – a trailer that doesn’t match that of the type that was used! There’s an axle missing and the underside safety rails are different! Clearly a fake.

This x-ray imagery was then said to be of another truck and the “cargo” was exchanged between the trailers – interesting as really all that needed to be carried out here was an exchange of the trucks themselves, and a change of number plates on the trailer. Why take the risk of moving the cargo from one trailer to another?

Parts of the destroyed truck are available in photos taken at the bridge, whilst eight men have now been arrested – five Russians and three others (Armenian and Ukrainian) – connected with the bombing.

The FSB have carried out a very swift investigation that’s for sure. Too swift maybe?


Why a truck bomb?

This is the first question I asked myself when I heard about it. The truck bomb certainly looks to be the cause of the explosion from the current evidence. Here’s my list of oddities I noted in my hypothetical blog on the day:

1 – There is quite good security for vehicles to get through to pass across the bridge. The lorry in question doesn’t appear to have been that well searched but it was stopped.

2 – If it was the lorry, why didn’t it drive slower, or even stop?

3 – If it had stopped, there is no security in that area. The driver could have bailed out of the vehicle and set it off remotely, or by a short timer – therefore surviving the attack.

4 – Why was it in the “slow” lane? For best results it would have been on the outer lane, nearer the southbound side; and the rail bridge. Stopping would’ve been even more effective.

These still stand. Point 1 was risky. It could have failed before the truck even got to the bridge.

Moreover, there’s now more to add to that list.

5 – Why detonate the bomb at that location? Surely the arch area was a better target than at the beginning of the up slope to it.

6 – How did the bomb detonate?

If it was by the driver who had instructions, then point 5 surely counts here. As does points 2, 3 and 4.

Maybe it was a timed detonation? See point 9.

If it was by remote GPS triggering then – as the Lat/Long of the bridge can be obtained from Google Earth very easily – either the accuracy of the GPS was very poor, or the position was entered incorrectly! Most GPS devices available are accurate to a couple of metres so this does look to be either an incorrect entry or – more likely – not the trigger source.

7 – Leading from point 6 then, was there a following vehicle that remote controlled the detonation from afar and the driver didn’t know what he was carrying?

Again, this needs Point 1 to be bypassed. And by two vehicles. There was no way of telling how long it would take the two vehicles to get through security – and whether it would all happen in time for the following vehicle to be in the right place. It is extremely risky.

One caveat here though – if the Russians were involved and knew the following vehicle would get through security – or they used the bridge CCTV to see where the truck was.

8 – Was the train a planned part of the attack?

This could have been a lucky break. Why? Because the driver took a 6 hour break. According to the paperwork Russia provided, he should have crossed the bridge earlier than this. If it was part of the plan then timing needed to be perfect. It was certainly another risk that may not have worked out – it still might not have.

9 – This leads to – was the bridge the actual target?

Going back to point 6 and the timed trigger along with the fact that the driver rested for 6 hours – if it was a timer then the truck should have been elsewhere at the time of the explosion and not on the bridge. A new can of worms.

10 – The truck and driver originated their journey in Russia. This needed to be a very well planned and executed job to carry out to success. With the arrest of the eight men, five of them being identified as Russian could have made this easier.

It will be interesting to hear what their backgrounds are. It’s certainly a mixed bunch, with in theory, only the Ukrainians being the “enemy of Russia”. If all this is a fake story to try and conceal something else, then I wonder whether the Russians are prisoners and refused to fight or whatever. There’s plenty of poor fodder the Russians could use for this.

So, the truck bomb theory certainly throws up a lot of problems with the actual mission, a lot of uncertainties – and a lot of luck.

Analysis time

One amateur analyst, Oliver Alexander, has carried out near continual watch on this and insists that it was a truck bomb and has provided “conclusive evidence” for this.

All current evidence points to the most likely and obvious cause, with nothing currently pointing against it. For some reason everyone has to make up a million more complicated theories with a large amount of holes solely because they want something else to have happened – he said to me in a Tweet.

To be a true analyst in this game you need to look at all theories – no matter how complicated they may appear. Every theory needs to be eliminated.

He has carried out some great work, but most of it has been on the truck theory.

He asked for other evidence to point otherwise. So here’s some to look at.

This has taken a couple of days to go through. You see, despite being an “old man” – as he called me (51 btw) – my experience in working in this field has taught me to take my time and go through things systematically. This is the benefit of being “old” and having had years of experience – unlike those with the absolute desperate need to get thousands of followers and likes on Twitter, some kofi cash and their name in a newspaper!

Whilst much evidence does point to it being a truck bomb there are still things that don’t quite add up. It’s not just me saying this – there’s plenty of far more qualified people than me that can’t decide.

So let’s talk about the “boat under the bridge” theory. After the early video footage came out I created my previous blog based on this. It was a hypothetical “story” based on the very early comments of a boat being visible.

However, it was reasonably clear that it wasn’t a boat that was visible under the bridge, but a wave. What causes the wave is the question.

All we really have to use is the footage from this CCTV video to see the water flow of the strait. I couldn’t find any others. The image above highlights “the wave”. As you can see, under the rail bridge there is another wave passing through.

Satellite imagery doesn’t really show that much either as the bridge is new and there’s not much historical imagery to analyse. Mainly though, it looks not that rough in the historic satellite imagery that is available. However, this can’t be used in evidence to show normal water conditions. Living in an area that is much the same, I can tell you it differs every day.

There is likely to be turbulent waters as the two sea areas meet, along with the addition of those caused by the bridge support pillars. An image later in this report shows the choppiness of the area a few days after the attack.

This surge wave could have been caused by a number of things.

1 – A boat. Yep, it could have been. Either ramming into the bridge off screen, or manoeuvring/stopping adjacent to the bridge – especially so if it was coming in at speed.

2 – Just a random, choppy, wave.

3 – Caused by the extra circular bridge extension that is located in this gap that comes off the side of the bridge.

None of these can be proven without seeing more everyday footage – especially for point 3 which is the only permanent item there.

Therefore, the boat could be a possibility, but less so than the truck – according to evidence so far shown.

Let’s check the other CCTV footage to see what we can spot.

Taken from the CCTV camera behind the explosion you can see plenty of debris raining down. I’ve circled a few to highlight specific points.

To the left, this is debris hitting the rail support pillar. This pillar is nearer to the camera than the truck just visible going away from us, which was approximately 170 metres in trail of the truck that “exploded”. The rail support pillar is about another five metres further away.

What’s interesting here is the way the glowing debris travels. The bottom left circled is a large piece hitting the base and behind the pillar. This means the debris has travelled 175 metres in a straight line to get to this point. Plus the vertical movement.

The wind looks to be at about 60 to 80 degrees, speed unknown. In the image above you can clearly see that the wind is blowing in this direction – right to left.

The image below shows the rough direction the debris has travelled to ignite the train with the red arrows, whilst the blue arrow shows the approximate direction of the wind later on in the day. There is damage to the rail bridge to the south of the train but this is very little in comparison to that caused by the burning fuel cars.

Weather information from Kerch airfield approximately 11 kilometres away has been provided as an example of the wind at the time of the explosion at the bridge. Whether any time zone conversions was put in to this is unknown as for example if I look at the same data for Kerch airfield right now I get a 1200 time when it is 1400 at Kerch. Regardless of this, it was pretty much the same at the airfield for the time periods before.

However, as the day progresses the wind shifts around, as the wind does. At one stage it is 080 degrees – a twenty degree difference to a couple of hours earlier. And this is an interesting aspect that needs to be looked at.

The wind at the bridge could have been completely different to the airfield despite the relatively closeness of the two points. This can be proven at airports where two that are close to each other with nearly the same runway direction configurations can be on completely different ends for arrivals and departures because the wind is completely different at the two locations.

However, from the under rail bridge CCTV, the steam and smoke is clearly at right angles to the bridge so it looks like it was roughly the same here.

Image courtesy of Maxar

Back to the explosion image, the highlighted area to the right of the breaking truck is in front of the circular extension to the side of the bridge. Debris is coming down around the car and truck in that area too. All of this debris is coming from quite a distance to the right. We know that the truck and car didn’t go past the circular area or they’d have fallen down at the split in the road 15 metres before.

For this debris to arrive at this point, from the right, from the approximate position of the truck, it needed to have travelled at least 220 metres. Not only that, it needed to have gone vertical and fought against the wind to get to the point to start coming back down again.

This takes quite some effort, even for this size of explosion, for what has been stated to be AN/FO (ammonium nitrate/fuel oil) with powdered aluminium added as the used explosives. All of this is very lightweight. Bits of the truck would have gone that way for sure and I expected larger pieces to have been seen coming from the truck area rather than all this “glitter”. Despite the wind I would have expected to see debris coming towards the CCTV camera, directly over the vehicles and down the road. This doesn’t appear to happen.

I would also have expected the greater amount of debris and “glitter” to be directly behind the truck and more concentrated to the left. It is denser to the right of the truck.

From what I can ascertain, the CCTV camera is on the overhead gantry at Tuzla Island, about 1.2 km away and heavily zoomed in. It is possibly over the southbound lane, but could equally be over the central reservation.

Playing the video in slow motion, frame by frame shows much of the smoke and debris coming from right to left. This is more obvious if you play it backwards. In fact, a lot of it comes from off screen!

Explosions tend to go up, unless they’re directed, and around in a circular direction. Yet this doesn’t appear to happen if the position of the truck is taken into account at the time of the explosion. As the initial flare clears there is no residual debris above the trucks position, hardly any to the left – but most is to the right, travelling left. This would imply that the explosion happened to the right of the bridge.

We’ve all seen enough “tank turrets into space” videos to see that things go up from an explosion.

In the footage from the CCTV from under the rail bridge a lot of the debris comes from high right and reasonably close to the camera itself.

Below is just over one second after the explosion. Even taking into account some zooming and the debris is falling halfway between the camera and the next pillar, this is 120 metres behind the position of the truck. The majority should be coming straight at the camera, not right to left – or there’d at least be a mix of debris – at the camera first and then right to left as the debris thrown south then starts travelling west. Nothing ever appears to come at the camera as would be expected.

About four seconds later and it is dying off, but debris is still falling right to left between the next two pillars. Note the amount of debris falling onto the road from far off to the right. These embers will be hot enough to melt the tarmac creating little pits.

A few seconds later, the southbound road catches fire for a brief period. This is one of the biggest causes for the blackened area that is left here. The white smoke under the bridge is in fact steam from the hot road section that has collapsed suddenly being super-cooled by the water.

Shortly after, the water gets extremely turbulent as shown below. Many people have highlighted this but it has been dismissed as just the normal conditions. It isn’t, it is caused by the blast and collapsing bridge – it is much rougher than before the blast.

Moreover, commentary says that this can be dismissed as the rough water is “is also under the wrong part of the bridge.” It’s under the wrong part of the bridge why? Because it isn’t only under the arch that took the blast from above?

This is confirmation bias because the belief is that the truck was the source of the explosion – and nothing else.

The end of the clip gives us a good close up of the damage. This in itself hopefully clears the myth that everything will get bent away from a blast. This doesn’t happen, as the nearest upright light pole shows – it would be bent towards the camera.

The retaliatory attacks on Kiev highlighted that things above an explosion can be damaged on the top.

The glass bridge example has shrapnel and burnt areas caused from debris landing from an explosion below and blackening the path. There was no real fireball here however, so it wasn’t as bad as at the Kerch bridge.

One can see the weirdness of explosions though. Below is the glass bridge taken from a video. The explosion took place about 30 metres directly below this point. The glass panel to the right is damaged by debris but didn’t shatter – the one in the middle has been destroyed – but the one to the left is intact but has been warped by the heat and twisting of the metal frame to bend towards the explosion.

Despite all this, up until below, going through the evidence I was still of the mind that it was likely to be the truck – despite what some people may think because I questioned the way they said things on Twitter.

More evidence?

Back to the gantry CCTV at Kerch and we see some evidence that I think has been missed elsewhere.

For the next sequence of images I’ve marked the position of the truck (red dot) and circular extension (blue dot) just before the explosion. I’ve also created a pseudo crash barrier that extends past the circular extension point. There is slight movement in the positions due to camera shake, but for the examples below it is marginal and makes no difference to the analysis.

This video is good because it hasn’t been cropped in close, therefore more of the area above and around the truck is visible.

Because many reTweeters etc. have zoomed into the truck they’ve missed things happening elsewhere. Below I have highlighted an area that has solid debris going vertical, right to left. Had it come from the truck area it would be going left to right or straight up from the red dot.

By moving the video frame by frame I was able to plot a couple of them. The first is below. The debris travels up and right to left. If you imagine this line extended down it has come from a long way right of the circular extension – in other words from the river.

Here’s another. Again, the imaginary line would take it down to the river. There’s several of these that all show the same trajectory. One thing is for sure – these bits of large debris have not come from the truck! That is unless it has miraculously gone sideways and down, before propelling itself back up and in the opposite direction!

Play the video yourself and look in this area. Stop it and control the playback yourself. Play it backwards and forwards. You’ll see this debris.

So where has it come from?

The boat theory has always been that it was positioned under the bridge.

This created the “It can’t be a boat, there’s no damage under the bridge” and “it is definitely damage caused from an explosion above the surface” comments.

Confirmation bias has kicked in. The belief that a boat was under the bridge made people look for the damage under the bridge rather than looking wider – and at the full picture. They have seen what they wanted to see to confirm their beliefs.

Now, their beliefs may still be correct, but there’s evidence in those pictures above – taken from the very same video they say PROVES it was an explosion from the truck – that could show otherwise.

What if the boat was actually to the side of the bridge rather than under it? What if it went off early? What if it was GPS triggered and something went wrong with that? What if the person controlling the boat activated it early to get the train too?

Sound familiar?? All possibilities that have been given to the truck theory, but completely overlooked for others.

A boat gives a further option the truck doesn’t. What if the boat was being controlled remotely and something failed with that, or the steering went – anything that could go wrong with it that meant it was detonated early or in the wrong position.

Yes, there’s bits of truck being found, but if the explosion was close enough it would have probably been practically destroyed in the process anyway. It certainly would have been pushed to the side, into crash barriers making them collapse and break up – a theory used to prove the bomb went off next to the barrier – before disappearing into the water. Bits of it would have turned up in more places than one location – regardless.

One final set of pictures.

This first one is supposed to prove a 2000 kg bomb in a truck detonated at this position due to the slight dip in the southbound road. If that had happened I’m pretty sure it would have been in a substantially worse condition than this (ignore the the barriers – they’re new). It is bending down, granted, but superheated metal will warp a little possibly? – not an expert so don’t know.

The same goes for the image below. I would expect there to be far more damage than this. There’s only a minimum amount of shrapnel pits – tiny at that, they’d be bigger if a bomb this size had gone off a few feet above this area and that close the hole that is there. And the missing tarmac is likely due to it being superheated and then supercooled by the water and sliding off. It is clearly only about an inch or two thick and wouldn’t have taken much.

Also note the twisted crash barrier and the fact that the uprights are going 90 degrees to the road, not away from the blast as has been used as evidence for an above the road explosion.

And one also has to think about the length of the truck – probably 20 to 22 metres, or about a third of the distance between spans. The hole caused is small in comparison, especially when you remember the truck was supposedly near full of explosives and the explosion itself was able to throw debris hundreds of metres away!

Below is the damage a 1500 kg truck bomb causes.

Whilst the environments are different – hard road vs soft bridge – enclosed area vs open area – the blast damage is huge. I’d expect a greater amount of damage at the bridge than there is.

Conclusion

I still can’t say 100% it was a truck bomb – I also can’t say it wasn’t either. However, the evidence provided until now has always been towards a pro truck bomb theory rather than any other and I can’t argue with that – in fact I never have. I have always agued with the “conclusive proof” theories when it appears not everything has been looked at.

The large amounts of debris in the CCTV video coming from the side and below the bridge needs to be analysed by experts – not by amateurs such as myself.

It may have already been spotted by those very people – and not brought to light. Why should they if there’s something to protect – such as a method of attack that can be used again.

In fact, it has been a dilemma of mine whether I should have come out with this report but I felt that due to the “challenge of finding further evidence” it was something that needed to be highlighted.

Finally, the fact that the majority of the people involved appear to be Russian (the driver and those arrested), throws in another question. Who carried out the attack? If it were a “terrorist group” then surely they would have come clean about it by now – someone always says it was them.

Unless you are scapegoats, made up by the Russian FSB, to cover a complete mess in the defensive network around the bridge.

At the end of the day, this isn’t a “I’m right, you’re wrong” report – which is most definitely being thrown around elsewhere. I hope it is an open report that people can look at and go “shit, I hadn’t spotted that” – and start looking at the event with a wider view.

Kerch bridge attack – initial analysis


  • Kerch bridge attack severely damaged by bomb
  • Attack could be from boat or lorry bomb
  • Boat bomb looking more likely at this time

This is a very quick first analysis on the attack on the Kerch bridge on 8 October 2022.

Northbound carriageway of the bridge is destroyed, with southbound looking damaged but possibly not out of use.

Rail bridge is likely damaged due to fuel train caught at exactly the right moment. This burned for many hours.

Initial suspicions pointed towards a lorry bomb from CCTV footage but there are a few things to highlight.

1 – There is quite good security for vehicles to get through to pass across the bridge. The lorry in question doesn’t appear to have been that well searched but it was stopped.

2 – If it was the lorry, why didn’t it drive slower, or even stop?

3 – If it had stopped, there is no security in that area. The driver could have bailed out of the vehicle and set it off remotely, or by a short timer – therefore surviving the attack.

4 – Why was it in the “slow” lane? For best results it would have been on the outer lane, nearer the southbound side; and the rail bridge. Stopping would’ve been even more affective.

5 – The explosion appears to have come from under the bridge – and there was possibly a boat there at the time.

6- Other CCTV footage shows a possible wave from a boat under the bridge at the time of the explosion.

Still to be confirmed, but analysis of FleetMon AIS data shows a fishing boat – Delfin – drop its AIS at 1503 UTC whilst heading towards the bridge. It could then drift towards the bridge in darkness waiting for the right moment.

Delfin’s AIS is pretty good. It has been on at all times as shown below – this is the last 30 days activity. What a better disguise than to be a fishing boat operating in the area – fishing.

This is all hypothetical, but it could have been waiting for the train to pass and then been steered towards the bridge and detonated as it passes under. A means of escape could’ve been a dinghy. If it had a good GPS system then it could’ve been pretty accurately steered for a gap, but just as simple is jumping off near to the time.

As I say – hypothetical at the moment. But I feel the boat is the better method than the lorry.

The final potential possibility are charges set on the bridge. However, I’d have though that the rail bridge would also have been targeted with this method. Particularly if the train was the real target.

It will be interesting to see if Delfin appears on AIS again later.

UPDATE

Just to confirm that Delfin has reappeared on AIS off the Crimean coast and was in a T-AIS -receiver “black hole” – though it has been picked up on S-AIS before too.

As I said above, just an idea about how this could have played out. I’m still happy with the analysis that it wasn’t a lorry bomb that caused the damage and destruction at the Kerch bridge.

Analysing the analysis – a closer look at the Saki air base attack satellite imagery


Yesterday – or rather, in the early hours of today – I posted my last blog, Novofedorivka – Saki Air base attack satellite imagery – The aftermath.

In that blog I made a typo. For every word where I meant to say Su-24, I said Su-23. This included in the satellite imagery labelling. So how could this possibly happen as I knew fully that they were Su-24s? I’d called them this correctly in the blog before that and regardless – I know what a Su-24 is.

To add salt to the wound of the error, on my desk next to me at the time of doing the analysis, I had the excellent books by Yefim Gordon & D Komissarov Sukhoi Su-24 and Sukhoi Su-27 & 30/33/34/35. They were still on my desk in the morning when I got up. I’d had the idea on going into a little detail about the aircraft themselves, but changed my mind.

The books still on my desk in the morning.

Looking back at the creation of the blog, I’m pretty sure I know what happened. When I started working on the imagery, when I typed in the first Su-24 label, I inadvertently typed Su-23. This could have been in error by hitting the 3 key instead of the 4, or by just stupidly typing it incorrectly.

From there, the rest is history. I copy/pasted the label for the others in the imagery, and this is where the brain takes over. I subconsciously took in Su-23 as being correct – regardless of knowing what they were, and having pointers near me to correct the mistake (including checking back on the other imagery and blog looking for changes).

Moreover, when it came to proof reading the whole thing, it still slipped through the net again. I even found other mistakes that I rectified.

In other words I totally believed what I was typing and had typed was correct, even though subconsciously I knew it was wrong. And I let it pass – I was seeing what I wanted to see

In my daytime Air Traffic Control world we use the well known term confirmation bias for this.

What is interesting about the whole thing is that just two hours before, in a busy radar session, I was calling a couple of aircraft by the wrong callsign. This is extremely common for us, and for pilots too.

To explain. We have radar screens with data-blocks that show the aircraft callsign, altitude/level, selected level in the flight management system on the aircraft (via ADS-B) and the exit code from UK airspace or last two letters of the destination airfield. We have plenty of other things available to us via Mode-S, but these are selectable.

We also have electronic flight progress strips (eFPS) which has plenty more info on, but the callsign is the obvious one and what I want to look at here.

I can’t remember the exact callsigns, but take an example of EZY12QC – “Easy one two quebec charlie“. I called this one “Easy one two quebec golf” on its first contact, and despite having a eFPS and radar that i was fully interacting with, I continued to do so. It didn’t matter what was in front of me, it was “quebec golf”, not “quebec charlie”. There was at least another flight like that. All was safe as it was checked by the aircrew that the instructions were for them, but it adds extra workload and time to radio transmissions and getting the traffic moving.

An example of aircrew error is taking the wrong calls for other flights with similar callsigns – normally with the same airline, though inter-airline errors do occur. On one occasion, a flight I was working kept taking the call of another that was with the same airline. Eventually, after the fourth or fifth time, he apologised and said he’d been doing that flight the day before and couldn’t get it out of his head – despite coming from Spain and using the correct callsign up until then.

In ATC we use a combination of long term memory, and short term memory. The long term stuff is for things like procedures, sector frequencies etc. Airline callsigns come into this too – their actual airline callsign such as “Easy” for EasyJet, “Speedbird” for British Airways.

The short term stuff is things like co-ordinated agreements with other sectors, the actual traffic picture, flights on frequency etc.

Short term stuff we remove from our brains, once we have no use for it, but we keep the other stuff forever. I still remember things from RAF Lyneham when I was there in 1989!

And, of course, this isn’t an aviation thing. It is present in everything humans do in their lives.

So, how does this affect analysing imagery etc.?

With the last blog, it was probably a combination of being up since 7am, doing an afternoon shift finishing at 2200 UK time that included confirmation bias in the last hour – and then an hours drive home. In other words, a long, tiring day with a fuddled up brain already in place.

Going back to saying that we see what we want to see – analysing imagery has plenty of this.

Not everything of course, but occasionally it creeps in. And it happens to everyone.

I’ll take the Saki attack “aftermath” as a prime example of this as I think there’s several places this has happened. And I’m just going to say this now – this is not a direct dig at anyone in particular.

In fact, I’ll start with one of mine – or a possible one. I’ve been watching Saki since 2014 so know it pretty well I think. I also have access to some fantastic data on the base.

The two buildings destroyed at the revetments are known “workshops” used by the Russians for quick repairs to aircraft. Often this has entailed taking parts from one aircraft to put onto another to keep the fleet “airworthy”. This is likely why there was a Su-24 at the eastern building. Parts are stored in one of the revetments west of the building.

The two concrete parking areas also targeted were for vehicles, equipment and spare parts – often kept in boxes or crates. One has been referenced as a building in some analysis and on social media. This is completely wrong. You only have to look back through Google Earth history to see that often there are Su-24s parked there. But people are seeing what they want to see – and to be honest, being a little lazy and not checking themselves. It doesn’t take much to go back through GE history.

I have all this information stored in my head as long term memory and that is what I believe these areas are used for. At some stage over the last few months, and in particular over the last few days, these buildings and parking areas have become weapons storage areas according to reports and social media. Where this came from I have no idea, but certainly, since the attack they have been known as “ammo storage buildings”.

Likely, the main reason for this is because the number of boxes and crates has increased since the beginning of the war – and they’re green. My confirmation bias says these are all sorts of equipment, whereas others say they are ammo boxes because this is what they’ve read/been told; and their confirmation bias won’t say otherwise. Ammo boxes are being seen because they are green – and well, so are ammo boxes.

One of the concrete areas has white torpedo like objects. These are Su-24 3,000 litre external fuel tanks that they carry on the inner pylons, under the wings. In the aftermath imagery you can see they have been shifted by the power of the nearby explosion. These have been referenced to missiles in storage. They’re not.

In reality, we don’t actually know what was in these green boxes and crates. Logic tells me it isn’t all munitions as they have hardened areas specifically for this. But, the Russian forces do have open munitions storage areas located at bases all over the country so who is to say? More than likely, it will be a mix of things.

The real confirmation bias from this incident comes it at the main apron. The Planet imagery I provided for the morning before the attack showed three Su-24’s and three Su-30’s parked on the main flight line.

There are a number of things to note – referencing the first image below. Firstly, the aircraft follow white taxiway lines to a white square to stop and shut down. These squares are clearly visible where aircraft aren’t parked.

Secondly, next to each parking spot there is equipment used with the aircraft. Starter generators, wheel chocks, ladders and other things needed for the aircraft. These can be seen in between the parked aircraft in the imagery.

The last thing to note is that there isn’t an aircraft parked on the far west spot – this is the spot that in the post attack imagery there is supposedly a destroyed Su-24. As there’s no wreckage present, this can’t be confirmed 100%, but photos and video have been produced that do show a destroyed Su-24. Actually, in the post attack imagery the burnt area centres on the equipment between the parking spots.

Looking at the second image below you can clearly see all the equipment still in place. But many saw these as destroyed aircraft – and Hey, Presto! six more aircraft that are actually over to the east of the base have been destroyed!

Total confirmation bias – you are seeing what you want to see. Because we all want to see Russia fail (well not everyone, obviously).

And yet all the clues are there. At the probable destroyed Su-24 area, there’s a completely burnt out patch covering the parking squares – yet for the “other six” there isn’t. The obvious equipment – seen in imagery just 24 hours before – is ignored and declared as wrecks.

Whilst the aircraft that were on the flightline probably didn’t escape some damage, from confirmation bias we have claims that the whole fleet of aircraft were totally destroyed – and whilst it was a very successful attack – it wasn’t as successful as is claimed.

This leads to misinformation – and what I call ” Bad OSINT”.

Novofedorivka – Saki Air base attack satellite imagery – The aftermath


It took a long time in coming, but imagery is available of the destruction caused at Saki (Saky) air base in Crimea.

Unfortunately, being at real work has delayed this analysis, but it’s worth putting out there anyway. Plus the imagery shows the majority of the airfield rather than just the main parking area. This alone provides some interesting information.

Primarily, the 43rd Independent Naval Attack Aviation Regiment of the Black Sea fleet has taken a bit of a hit. Definitely, three Su-30SM’s have been destroyed with one probably damaged. Moreover, four Su-24’s are destroyed in the revetment area – with the possibility of another on the main apron.

The Su-24 on the apron is inconclusive. There’s definitely an area that has been cleared – there’s vehicles around it etc. – but the imagery from earlier in the day doesn’t show an aircraft in that actual spot.

Most certainly, no other aircraft were destroyed where they parked on the main flightline. This is obvious from the ability to see all the “parking squares” and lack of burnt areas. If a Su-24 (or other aircraft) was destroyed at the scorched area then they have removed the wreckage pretty quickly – possibly to hide what happened, but the rest of the airfield gives it all away.

Most of the aircraft destruction is in the revetments – ironically used to protect aircraft from events like this. If only the Russian’s used HAS’s (Hardened Air Shelters) – they may not be feeling the pain. The good news is, they are.

The revetments have given up three Su-24’s and three Su-30’s. A further Su-24 is destroyed at the eastern maintenance minor workshop shed.

And this is where it all gets interesting.

The actual targets.

Two minor workshop sheds have been totally targeted and destroyed. Moreover, two other areas that were targeted – or appeared to have been – were general parking areas used for vehicles and equipment.

It is strange that the two large munitions areas and the fuel depots were also not targeted. And to be honest, if an aircraft has been destroyed on the main flightline, I suspect this is from secondary explosions and fire rather than a direct strike as there is no crater present. Why wasn’t this area targeted?

The area around the parking revetments is dotted with small craters, possibly from debris. But they do look more like explosive craters rather than that caused by falling debris.

A vast majority of the airfield grass areas has been burnt. This could have potentially spread to the burnt out cars that have been seen in videos – though one has certainly been destroyed by debris from explosions. @wammezz on Twitter produced a false-colour image of the whole base which clearly shows the extent of the burnt ground.

There’s been a number of aircraft movements since the event. A Su-30SM is now in the main maintenance area – possibly the one from the revetment nearby that is now missing. And whilst the number of Su-24’s in this area remain the same, either one has been removed/moved, or there’s been a change around.

Obviously, the main flightline has been emptied, as has the eastern secondary line, except for a single Su-30SM. A Su-23 has been relocated to just south of this area.

Three helicopters have departed, whilst the three remaining have been rotated to point east.

Due to costs I couldn’t get a full airfield view from Planet so it is possible some of the aircraft have been moved to the eastern airfield revetments.

There is still no conclusive evidence as to what was used in this attack.

I’ve always thought a Ukrainian SF mission – which I didn’t want to say in the other blog as it was still a recent event and there was a slight OPSEC concern with me to be honest. The Ukrainian armed forces have stated it was a SF mission also.

However, the craters visible do point to a missile strike, with a good friend betting a ATACMS strike.

I’m still torn.

Maybe the maintenance sheds held more than scrap parts of aircraft to keep the main line going from day to day. I’d like to say the Russians aren’t that stupid – but since March, they’ve clearly shown they are.

Whilst it is good to see the evidence of destruction in Crimea – finally – the event has almost created more questions than answers.

Novofedorivka – Saki Air base attack satellite imagery


Videos and photographs of an attack on the Novofedorivka – Saky air base in Crimea on 9 August 2022 starting appearing on social media just around lunchtime, UK time.

Early indications point to multiple areas being attacked on the air base. It is yet to be ascertained as to what has been targeted – and how exactly the attacks have taken place. Or if it was yet another accident that the Russian forces seem to be very good at having.

The explosions shown – possibly up to 12 of them – look to come from the area of munition storage facilities, and/or the fuel depot on the base.

The number of explosions does point more to an attack than an accident, but weapons “cooking off” and hitting other areas causing further explosions can’t be counted out – regardless of the initial cause of the explosions.

Saky is home to the 43rd Independent Naval Attack Aviation Regiment of the Black Sea fleet, operating Su-30SM, Su-24M and Su-24MR fighter aircraft.

The base also has an area for training for operations on Project 1143.5 CVGM Admiral Kuznetsov and has replica flight deck & ski ramp used to practice taking off from, and landing on, the carrier.

Satellite imagery captured by Planet at 0810z on 9 August 2022 – approximately 4 hours before the attack – shows based aircraft on the main apron and parking areas, as well as helicopters parked at the Southwestern part of the base at the replica Kuznetsov deck/landing area.

The size of explosions shown in videos does point to there likely being heavy damage and a large number of casualties.

The next question is – what was used in the attack? If, indeed, it was one.

As far as is known, the Ukrainian forces do not have a missile strike capability of the range needed from the frontline to the base location.

I’m sure more news will be coming forthwith.

Murmansk-BN HF EW Complex

Murmansk-BN of the 475th Independent EW Centre near Sevastopol

Brief Murmansk-BN overview

Murmansk-BN has been operationally active from at least 2014 when the 475th Independent EW Centre of the Russian navy set up a complex in the Crimea south of Sevastopol. The system has a primary role of eliminating, or trying to eliminate, High Frequency (HF) broadcasts from NATO forces – in particular the HF Global Communications System of the United States (HFGCS).

HFGCS operates on well known HF frequencies with regular broadcasts of Emergency Action Messages (EAM’s) and other operational messages, phone patches etc. as required. To this date though, I am unaware of any reports that HFGCS has been interfered with by jamming. This in itself isn’t surprising. HF is a difficult thing to jam due to the very nature of using the ionosphere to carry the broadcasts. Throw in multiple frequencies in use at the same time, the same message being broadcast on numerous occasions, propagation and all other things related to HF reception means the message is likely to get through regardless of the attempts made to jam.

The Murmansk-BN complex is a fully mobile system and comprises of groups of up to four extendable antenna masts – two of which each on a dedicated Kamaz or Ural truck, which then tows a further antenna on a trailer. The masts extend to 32 metres in height. Each full Murmansk-BN complex normally has four of these antenna groups, making 16 antennas in total.

Further to that there are numerous support vehicles including a Kamaz 6350 Command vehicle and a Kamaz 6350 generator vehicle per four antenna group. Other vehicles include fuel bowsers and troop transport. Not always four antennas are used per group.

Murmansk-BN is in operation with units of both the Russian army and the navy – for the army with the 15th EW brigade in Tambov, 16th EW Brigade in Kursk, 18th EW Brigade in Yekaterinburg and 19th EW Brigade in Rassvet – for the navy with 186th Independent EW Centre of the Northern Fleet in Severomorsk, the 471st and 474th Independent EW Centres of the Pacific Fleet in Petropavlovsk-Kamchatsky and Shtykovo respectively, the previously mentioned 475th Independent EW Centre of the Black Sea Fleet in Sevastopol and the 841st Independent EW Centre of the Baltic Fleet in Yantarnyy.

It is highly likely that the 17th EW Brigade at Khabarovsk also has Murmansk-BN in operation but a this time I haven’t been able to locate any of the systems.

Screen grab from one of the Murmansk-BN videos showing an Icom IC- R8500 in use as the main receiver in each command vehicle
AOR 500 in a R330ZH Zhitel – image credited to
twower.livejournal.com

One aspect about the system is its use of analogue receivers rather than Software Defined Radio (SDR) technology – Icom IC-R8500 receivers have been noted in all the video footage available so far. This isn’t unusual for Russian EW systems – the AOR 5000 receiver is used in R330ZH Zhitel which is a mobile system primarily used in the jamming of satellite and cellular phone communication systems operated in the 100 to 2,000 MHz range. The AOR 5000 has multiple versions available, one of which has the cellular bands (824 to 849 MHz and 869 to 894 MHz) unblocked. Zhitel was used in the Crimean conflict with the high likelihood that the AOR 5000 was used to jam or intercept mobile phone communications. Recent reports have shown that Zhitel is still in use in the occupied Luhansk region.

I use an R8500 myself and it is an excellent receiver. I normally use it in conjunction with my SDR’s that provide me with a wider view of the HF bands so that I can search out signals. From the videos available online, the Russian military don’t do this but instead slow scan manually through the bands or scroll through frequencies saved to the receivers memory bank.

The receiver is linked to a PC using software that shows a visual spectrum taken from the audio output from the R8500, but this is limited to the mode in use. Video footage shows the likely use of AM mode to give as wide a visual spectrum as possible but this would be limited to the R8500’s 12 kHz maximum bandwidth. More on the software later.

The slow scan/memory scan method is not the best and would likely mean that any interception would be caught mid-way through a message. It is also time consuming. I am highly surprised there isn’t some sort of auto-scan software included. For instance I personally use df8ry’s CSVUserListBrowser to control not only my R8500 but most of my SDR’s. This can scan through stored frequencies on the Icom at a slow 1 second pace, but its better than sitting there turning a knob continuously for hours.

As the Icom is a receiver only, it needs to be linked to a transceiver using its CI-V remote jack point that then sends out the jamming signal – whether this then means another Icom transceiver is located within the command vehicle is unknown as, whilst confirmed from commentary and interviews with Russian personnel in the videos I found, there is no visual confirmation of what is used as the transmitter.

Each antenna group can operate individually or as multiples. Reports also state that the complexes can be integrated into the Russian EW command and control system.

The software

The software in use cannot be identified. It appears to operate like an automatic signals classifier, such as go2MONITOR by Procitec, but it is hard to assess whether it has this capability. It would be unusual not to have a classification capability, even if it meant manual selection of a signal.

There are a number of different screens, some tabulated, that control different functions, or provide different data.

One screen shows spectrum information split into four panels. The top panel shows the selected frequency, and what looks like audio taken from the Icom in AM-Wide mode – this differs from cuts to the Icom itself which shows it is in AM mode. If in AM-Wide it would mean the maximum audio spectrum available would be 12 kHz as this is all that the Icom can manage in this mode below 30 MHz, whilst AM would only produce a 5.5 kHz wide spectrum. However, using either of these modes would make it possible to visually obtain a signal from this.

What is interesting here though is that in the video, the top panel appears to show a bandwidth spread of 30 kHz with an area of 6 kHz in a lighter colour, possibly depicting the true area that a signal can be classified or monitored. 30 kHz is not a selectable bandwidth for the R8500 in any mode, with the maximum possible being 15 kHz above 30 MHz in WFM mode. Also of note is the noise floor indication which appears to be between -40dB and -50dB.

It could well be that this panel does not actually show a signal from the Icom, but could be the panel that shows the transmitter that produces the jamming signal.

The next two panels appear to show the signal with sensitivity information from the incoming audio. The final panel is unknown as it is not shown in any video close-up.

Another screen shows interface information to the bottom left. This has a number of tabs that control some the external elements that assist in the suppression of a signal. Connection status is shown by a green or red button.

Firstly, one tab shows the connection to a Protek KS-100M navigation device which is a GPS unit. This is connected to an antenna mounted to the top of the command vehicle and provides an accurate position for probable signal reception direction finding/triangulation purposes when connected to the other command vehicles KS-100M’s.

The KS-100M is also found in the Zhitel system as shown here in the far right panel. It is used for Direction Finding purposes in both systems – image credited to
twower.livejournal.com

To the left of the KS-100 tab are two unknown connections marked as ГТ-11and ГТ-11.1 (GT-11 and GT-11.1). ГТ in the Russian military is normally an abbreviation for rehepatop which translate to generator. In another part of one of the videos it shows the ГТ-11.1 title again, this time with four green boxes, each with what appears to be a tick box. Two of these appear to be connected as there is a joining line between them.

The final tab is unknown but marked as ГТ-205-ОПМ (GT-205-OPM) which if using the standard abbreviation format would also be related to a generator. However, the generator shown in the video appears to be named as an AD-100-T400-1R. Alternatively, you could break down the OPM part into two which would give supply (OP)/ engine (M).

What doesn’t quite tie up is that each four antenna group only has one generator, so does this section actually have something to do with the four antennas themselves and whether they have power going to them?

Above the four tabs is a box that is titled Information about current IRI. Below this is information on the signal being suppressed: Frequency – 9 961 02 kHz Type of target – unclassified Bandwidth – 3.36 kHz Duration – 16 msec Strength – 16 dB Bearing – 179 7 (1) – 0

This box is likely associated with the KS-100M tab.

The large window to the right shows what I thought at first was historic signal information in the selected bandwidth. However, looking closer I wonder if this is the case as the “signals” are too regular – they are evenly spaced. In other shots there are up to 20 signals shown. My thoughts are that these are connected to the KS-100M and are signal strengths of GLONASS GPS satellites. But again, without clearer screenshots or a confirmed ID on the software in use, this can only be guessed at.

There are numerous other tabs and screens available, but these are unreadable in the videos found.

Locations

The various units I have listed above. The sites used so far, despite Murmansk-BN being fully mobile, have been very close to the units home base. Despite the area required for a full complex deployment being large, they can be difficult to spot, but once you know the locations used – or the area – then it makes checking on them relatively easy.

The 15th EW Brigade at Tambov has not been observed on Google Earth (GE) as deployed as yet but the vehicles can be seen at their HQ at 52.666385N 41.537552E

Latest 15th EW Brigade site imagery near Tambov. Dated 13/11/18 and is the first time the Murmansk-BN was observed here.

The 15th EW HQ is situated in a large area of military ranges with plenty of surrounding free land available. It is presumed that this area will be used when setting up the complex. There is also an area to the NW that previously contained numerous antennas, but is now disused.

The 16th EW Brigade at Kursk uses a military training group for its deployment site. Only two antenna groups have been observed since first deployment in April 2015.

Latest 16th EW Brigade site imagery near Kursk at 51.713194N,
36.290736E. Dated 3/9/19

The 18th EW Brigade at Yekaterinburg is a very active unit with just two Murmansk-BN antenna groups in use at any one time according to GE imagery. Moreover, it seems to be a unit that likes to train in setting up the complex as it is quite often observed in different states. The Murmansk-Bn is spread over two sites – a permanent one (site one below) and a secondary site located in a field about 1.6km away (site two). In some imagery of site two only one antenna is up in two “groups” and quite often the site is empty.

The continuous erecting and disassembling of the complex’s could hint at the unit being involved in training. As shown in the image below it also tends to use truck mounted antennas at site two. There are no trailer mounted antennas visible, whilst they are in use at site one. However, the fact that there are six truck mounted here points to the 18th EW having a full compliment of Murmansk-BN equipment, despite only using two groups at the same time.

Murmansk-BN equipment of 18 EW Brigade at site two in a stored state

The 18th EW was also used in one of the videos. Comparing the video to GE imagery I was able to identify various features that confirmed that site two was used for the filming.

Site two confirmed as used in the Pravda.ru video

The 19th EW Brigade at Rassvet, near Rostov-on-Don, has had Murmansk-BN since at least 19/6/2016 when equipment first appeared in GE imagery at the HQ. Since then it would appear that it has not been deployed as the vehicles have stayed in a parked up state in all imagery from that date. The number of vehicles indicates only two groups have been allocated to the Brigade so far.

19th EW Brigade HQ in latest imagery dated 15/2/19

On the Russian navy side of things, the 186th Independent EW centre is based near Taybola at 68.515306N 33.290056E on the old airfield for the town. Taybola used to be a Soviet R-14 (SS-5 ‘Skean’) intermediate-range ballistic missile (IRBM) base with at least two silo complexes, a rail head, and the airfield.

The latest imagery on GE has just two Murmansk-BN groups set up at the northern end of the runway and old dispersal, but older imagery has a further group half way down the runway to the south.

GE imagery dated 18/8/17 showing the three locations of Murmansk-BN groups. the 186th has had the Murmansk-BN capability since at least 20/8/15 according to GE

The 471st Independent EW centre at Petropavlovsk-Kamchatsky, has a full complement of four Murmansk-BN antenna groups though it has had differing numbers in use since the system first arrived from at least 15/8/15. The latest imagery on GE below, dated from 3/11/18, shows just about a full complex in use. The NW group has one antenna missing.

471st Independent EW centre situated at 53.053583N 158.828178E

The 474th Independent EW Centre at Shtykovo, is also sited at a disused airfield. It has had three antenna groups in place at least once, but the latest GE imagery has just two in use.

The actual location of the 474th HQ is unknown and there no immediately close active military bases. There are numerous bases at a distance away, with a potential SIGINT site 12km to the SW. Analysis of these don’t provide any other Murmansk-BN vehicles.

The 475th Independent EW Centre is probably the most well known of the Murmansk-BN deployments. It is located to the south of Sevastopol in the Crimea at a coastal base and has been widely exposed on social media and articles since it became active. First shown in GE imagery dated 15/11/14 with one group, it has expanded to a full four group complex.

The 475th complex shown here, dated 26/8/18, with just the NW group active

It was news about the deployment of Murmansk-BN to the 841st Independent EW Centre at Yantarnyy in the Kaliningrad Oblast that drew my attention to the system. It is known that the 841st has a full compliment of four antenna groups but it is unusual to see all deployed. The image below, dated 11/9/17 is one of those times that it is fully active.

It is usually the northern site that is active when the 841st deploy. This is situated at 54.832506N 19.958467E. The “town” of Okunevo is actually a comms site.

The news I mention was reference the “new” deployment of Murmansk-BN to the Kaliningrad region, yet what is strange is that from GE analysis it is obvious the system has been in use there since at least 11/4/16 – so why this sudden hype? My only thought is that there was a major NATO exercise on in the region at the time which included USAF B-52’s carrying out Global Power missions from the US to Europe.

Was this news a counter to the US stating that Russian forces could interfere with their operations?

From all accounts, and from reported loggings of HFGCS messages since the Murmansk-BN system has been available for use, there has been zero suppression of any HFGCS frequencies that I’m aware of.

This then, with the fact that most units have not fully deployed their systems, makes me wonder whether Murmansk-BN is not quite so good as expected and claimed.

Here are the videos used for analysis:

This is the longer of the two videos and actually contains the second one.

https://www.yacoline.com/video/168091/

Second, shorter video showing the 186th Independent EW centre