28 May 2021 — Moon of Alabama
This is an update to yesterday’s post By The Book – What Really Happened With The Ryanair Flight In Belarus. That piece analyzed the timeline of the Ryanair bomb threat incident in Belarus and the response from Belorussian officials.
As part of that post I discussed the possible manipulation of a screenshot of the bomb threat email by the editor of the western financed opposition media Nexta:
Protonmail, from where the email was received, is a encrypted web-email service hosted in Switzerland which allows more or less anonymous traffic.
An alleged screenshot of the email currently gets peddled around by the Editor-in-Chief of NEXTA:
Tadeusz Giczan @TadeuszGiczan –11:59 PM · May 26, 2021
Not that anyone had any doubts but ‘Hamas email’ was sent to Minsk airport 24 minutes after Belarusian air controllers warned Ryanair pilots there’s a bomb onboard.
Giczan is right in that the time shown in the screenshot is inconsistent with the timing of the Ryanair flight in the Belorussian airspace.
That however proves nothing. Time stamps in emails are notoriously unreliable as they depend on various computer timezone settings and several other variables.
Clocks, computers and phones in Switzerland are currently set to UTC(GMT)+2 hours. Clocks, computers and phones in Belarus to UTC+3. A email sent at 10:57 Geneva time would likely show up as sent at 11:57 in Minsk time. However, if the timezone of the computer/phone that is used to look at the email is set to UTC+4 the email time would be shown as 12:57.
Nice trick Mr. Nexta but that screenshot is unconvincing.
It turns out that my timezone manipulation speculation, while technically correct, might not have been an issue.
Today the Investigative Committee of Belarus, the country’s proscecution service, published a note about the case (machine translation, emph. added):
Investigation of a criminal case on a deliberately false report about the “mining” of the Athens-Vilnius flight continues
At the moment, the criminal case initiated on the fact of the “mining” of the plane, which carried out the flight “Athens-Vilnius”, is being processed by the USC in the city of Minsk.
These days, through destructive and extremist channels, as well as various Internet resources and Western media, incomplete and unverified information is being disseminated aimed at manipulating public opinion in their own interests. For our part, we urge the public not to popularize innuendo and cynical speculation. We consider it unacceptable to assume that someone has a monopoly on the truth until the preliminary investigation is completed.
It has already been established, to which we draw special attention, that there were several messages about the “mining” of the aircraft received through the Swiss anonymous mail service ProtonMail – at 12:25 and at 12:56. At the moment, the records of conversations with the pilots of the aircraft are being studied and analyzed in detail, and numerous other investigative actions are being carried out. …
So there have been, if the officials are to be believed, two bomb threat emails. The first one at 12:25 local time (9:25 UTC) arrived five minutes before the Ryanair flight at 12:30 (9:30 UTC) entered Belorussian airspace. That would have left enough time to contact the air traffic controller who then warned the plane. The email in the screenshot received at would have been the second one.
The Ryanair pilot was warned of the bomb threat at 9:30 utc but declared Mayday only at 9:47 utc. It took him several more minutes to change the course. The sender of the emails might have watched the plane’s course on Flight Aware and prepared and sent the second email when the plane seemed not to react to the first one.
The Nexta’s editor-in-chief had presented the second email as the sole one and insinuated thereby that the plane was contacted and informed about a threat before the warning of that threat arrived.
The logo visible in the screenshot of the email above is of the Dossier Center. Its purpose is to find and create dirt that can be throw at Russia. It is financed by the exiled oligarch and former Yukos raider Mikhail Khodorkovsky in London. The center seems to have intense contacts with western secret services.
If there were indeed two threat emails, as the Belorussian officials say, this Reuters headline is off.
A bomb threat cited by Belarusian authorities as the reason for forcing a Ryanair jetliner carrying a dissident journalist to land in Minsk was sent after the plane was diverted, privacy-focused email provider Proton Technologies AG said on Thursday.
Proton declined to comment on specifics of the email, saying that its encryption made it impossible to “access or verify the contents of the message.”
“However, we are able to see when the message was sent, and we can confirm that the message in question was sent after the plane was redirected,” the Swiss company said in a statement.
It added that “we have not seen credible evidence that the Belarusian claims are true and we will support European authorities in their investigations upon receiving a legal request.”
Protonmail was only asked about the second email which had been distributed by the Dossier Center. It confirmed that it went out at the time the screenshot showed.
We can be sure that it will soon also be asked about the first one. The Investigative Committee note says: (machine translation)
To confirm the consistency of their aspirations, the investigation has already prepared and will soon send to the Swiss prosecutor’s office a request for legal assistance in obtaining information about the user of the mailbox from which the message about the “mining” of the flight was sent.
Yesterday the Belorussian Department of Aviation had also invited international organizations to look into the case:
For further consideration of the circumstances the Department of Aviation has invited representatives of ICAO, IATA, EASA, and EU and USA Civil Aviation Authorities.
The United Nations’ International Civil Aviation Organization (ICAO) has now agreed to investigate the incident.
When the Ryanair flight left from Minsk there were five passengers less on board than when it had landed. Roman Protasevich, the western government financed neo-nazi, and his Russian girlfriend were two of these. They were arrested. There had been speculation that the other three persons were KGB agents. However the people were found and interviewed. All three, one Greek and two Belorussian citizen, say that they had originally planned to fly from Greece via Vilnius to Minsk. They thus had no reason to reenter the plane.