Investigation: How could a mistake have led to shooting down an Ukrainian airliner?

Samuel Cardillo Lespes
7 min readJan 11, 2020

--

This investigation is based on speculations and assumptions and was made using open source intelligence collected through journalistic reports and simulation data run on CMANO, a publicly available war simulator used by few branches of the US Army & US Department of Defence. All weaponries data, including sensors capabilities, are based on openly accessible intelligence and doesn’t include the classified parts.

The 8th January was full of unexpected events. It first started with the ballistic missiles attack on American targets and finished with reports of a commercial airliner crashing down near Tehran leading to theories circulating about the cause of the crash, between technical fault and targeted by Iranian air defence systems. The reluctance from Iran to deliver the black boxes, as well as its cleaning operation of the crash site, intensively increased suspicions about the second possibility. This article is investigating this specific possibility and try to determine how a human mistake could have led to this incident.

(added during redaction of the article) The Iranians have finally come forward and admitted shooting down the Ukrainian airliner — by mistake — as it was coming close to a sensitive base. This announcement is important as it confirms, in a way, the article below.

Situational breakdown

The first “official” report of the ballistic missiles came at around 23:00 UTC followed by reports of American aircraft taking from the UAE, at around 01:00 UTC, it was later determined that they heading toward Iraq, and triggered the Iranian Air Force to patrol in their airspace.

At around the same moment, 01:34 UTC, the Turkish Airline aircraft with the callsign TK873 takes off from Imam Khomeini Airport near Tehran and leaves the Iranian airspace without incident. The next airplane, Ukrainian airlines callsign PS752, takes off at 2:38 UTC, following approximatively the same flight path and, few minutes later is seen plummeting to earth as a fire ball and crash.

Additionally, the Pentagon revealed on the 10 January that a spy satellite was able to detect two launches and missile contact via its surveillance systems.

Where did the missiles came from ?

To this day, the exact position of the SAM launcher is unknown, hypothecations about its location however have been made to the Sajjad missile base.

Image showing the location of Sajjad Missile Base, the flight path of PS752, the possible impact point and the crash site.

The Sajjad Missile Airbase is part of the IRGC missile forces and, according to open source data, hosts the Fifth Raad Missile Brigade, responsible for launching Shahab 3. Definitely a site of strategic importance, located only a few miles away from the Imam Khomeini Airport.

Possible location for SAM unit deployment.

The base itself is divided into five parts which host diverse military equipment, numerous trenches and secure warehouses. It also has an interesting position, shown on the image above, to cater to the mobilization an air-defence system. Therefore, this following simulation will be based on the belief that the SAM site was located at this spot.

Setting up the last parameters

Additionally to the SAM location, for the context, we will assume that Iran was not initially expecting an American retaliation before the reports of US jets being launched out of UAE — which could explain the reasons no NOTAMs were issued before and after the ballistic missiles launch.

Re-enactment

At around 1:00 UTC the IRGC receive reports of suspicious US Air Force movements, roughly two hours after the Ballistic Missiles attack. The IRGC swings in to a state of high alert and bolsters its air defence capabilities by scrambling its mobile units.

At 1:34 UTC, TK873 takes off, direction Istanbul, and start climbing, using an almost identical flight path as the PS752, flying extremely near the sensitive Sajjad Missile Base, without being targeted by any missiles. We can assume that, at that moment, either the SAM is not yet deployed properly or the crew is still being prepared, sparing the life of this airliner and its passengers.

Picture showing the flight path of the TK873 which goes near the Sajjad Missile Base

Around an hour later, at 2:38 UTC, the PS752 takes off from the same airport, the Imam Khomeini Airport, and start climbing while taking the same flight path as the previous plane, TK873.

(Simulation) Views indicate that neither the plane or the SAM are aware of each other existence

At that specific moment, the SAM site has no visibility on the Ukrainian airliner. Many parameters can play but one of the most probable cause is the elevations between the SAM site and the airport which limit considerably the Line of Sight of the ground crew and the sensors on which they rely on.

(Simulation) The blue area on the left represent the Radar/ESM Line Of Sight, very limited by the environment. The right view shows the first detection.

At around 6.6 nautical miles (12km), the SAM site pick up an initial signal through the Dog Ear sensor (NATO name) which fail, in every simulations, to identify the type of aircraft as well as its altitude. At that moment, the ground crew is aware that an aircraft is coming their way but they don’t know precisely what is nor exactly where.

At 6.4 nautical miles (11km), the generic TV cameras which are mounted on the mobile unit pick up a visual signal of the aircraft. It is important to note that CMANO doesn’t take in consideration possible software glitches and human errors. In reality, the visual identification of an unknown airplane by a nervous crew at night, during a tension peak, is highly affected.

(Simulation) Left side shows the Tor-M1 being launched before proper identification. Right side shows a 3D representation of the scene.

Both Tor-M1 are launched toward the unknown aircraft at around 5.8 nautical miles (10km). It is only after the launches that the crew will be able to identify the airplane with the Scram Half (Tor) sensors.

Missiles hit the PS752 from the right. Different simulations were made with last moment trajectory change: going north ; south ; or continuing on the planned one. In every paths, the Tor-M1 hit the right side of the plane which then caused its deviation to the right until crashing 16km from the original collision point.

List of sensors embarked in the possible SAM unit mobilised at the Sajjad Ballistic Base.

Assessments and conclusions

Based on the data gathered by the simulation as well as the reports given by journalists and US officials but also some assumptions, we can draw the following conclusions. The first one is pointing out that, yes, the threshold for mistake was very low but it also shows that the Iranian Aviation Authority, the IRGC commanders and the ground crew have all failed considerably and made this mistake, which costed the lives of 180 people, possible.

(Simulation) The moment one of the Tor-M1 hit the right side of the PS752. Despite the possible last moments flight path changes, the right side is always hit.

No NOTAM/No-Fly Zone was established after the ballistic missiles attack on the United States assets in the Iraqi region. None of those were also established when the Iranian Air Force was scrambled in its own airspace to protect it, meaning that a possible threat was identified by the army, an important reason to ground civilian aircrafts and put on hold the commercial air traffic, which was not done, even after the missiles hit and the plane crashed, portraying a horrible, low safety standard being practiced by the Iranian Civil Aviation Authority

The IRGC commanders have decided to deploy and activate a SAM unit near an airport which had almost little to no visibility while probably knowing that no NOTAMs were given. Those factors highly played in the outcome we all know about.

The air defence crew, probably afraid of being targeted by American aircrafts (the sensors in modern fighter planes are powerful enough to identify the SAM from extremely far away), pressured by the heighten tensions (their government just launched ballistic missiles on a superpower), protecting a missile base (high target after a ballistic missile attack) and relying on limited sensors capabilities were unable to identify the aircraft on time, only seeing an unidentified target coming towards them and failing to take in consideration that an international airport was present which leads us to question, was the crew even notified of the airspace still being open to civilian traffic, or was there an internal memo that superseded such facts ? Chances are that, the ground crew, pushed the fire button before properly identifying the aircraft, closing on them, driven by fear, pressure, internal communication failure and most definitely lack of training

IMPORTANT: I am not a professional writer nor a journalist therefore I would like to apologies in case of spelling or grammar mistakes. I try to review my drafts as much as possible but there is always some mistakes that slip through.

--

--

Samuel Cardillo Lespes

Intelligence & Cybersecurity Analyst | Founder of @sbreakintl | Find me on Twitter : @ElDomaine