Dutch MH17 activist appears to be chess piece for Russian intelligence

A Dutch citizen journalist who spread ‘disinformation’ about the MH17 disaster for years worked closely with a Russian intelligence agency. It underlines once again how far Russia is prepared to go in the information wars it is conducting.

Max van der Werff is certainly no stranger. Anyone who follows the MH17 trial – as a lawyer, researcher, next of kin, journalist or interested – knows the man who has been spreading alternative theories about the plane crash for years with his own blog. That he is one of the most dominant voices in the Twitter debate on MH17. It also showed how Van der Werff works closely with pro-Russian rebels in eastern Ukraine.

Now it turns out that this Dutchman, who divides his time between the Netherlands and the Philippines, has been acting on behalf of Russian Military Intelligence Group for the past year. Not only did he become the Gateway of a Moscow colonel, he became, together with a colleague, the bridge between Moscow and pro-Russian activists in the Netherlands. That’s what a research report from British intelligence-sponsored Bellingcat shows up today. The collective relies on leaked e-mailboxes from two high-level officers, and their phone history.

The fact that the GRU has lost his eye on the Dutchman is not surprising. The former designer of board games and dealer in electric bicycles lost his faith in mainstream media and Western politics in the 1990s. He travelled several times in search of the truth, and after the crash of Flight MH17 in 2014, he also travelled to Ukraine. With his own website (formerly called ‘Kremlintrol’), via Twitter and in performances at the online canal Café Weltschmerz, he built a small but loyal audience. He published a stream of stories and liked to take the measure of classical media because he believed they were hiding the truth. While it soon appeared that it was Van der Werff himself who, during his travels through the Donbas region itself, rummaged by creating and publishing fake stories.

Also, leaked e-mailboxes of pro-Russian rebels quickly betrayed Van der Werff’s e-mails to the Ministry of information in eastern Ukraine, to advise them on how to communicate better. Something that was welcomed with enthusiasm.

But the Bellingcat report isn’t just about Van der Werff. At the end of 2018, the Dutchman, together with the Russian Yana Yerlashova, founded a media company: Bonanza Media. This company is now at the centre of a disinformation campaign run by the GRU. Yerlashova is officially the owner and at that time at least as well known as Van der Werff at MH17-watchers. Yerlashova quit her permanent job in the Russian state radio station Russia Today (RT), which has been important in spreading propaganda since the crash of Flight MH17. Meanwhile, she is accused of having moved wreckage around the crash site in her time as a reporter at RT, trying to show how sloppy the official investigators had been.

To finance a Bonanza documentary, The two set up a short-term crowdfunding that will prove remarkably successful. In 18 days, they collect $ 23,000. Remarkable, as the Green one wrote a year and a half ago, is that there is a donation of 8400 euros. In addition, six people pour together shortly after each other EUR 9 000, bringing in 87% of the target amount by only seven people.

With that limited piggy bank they manage to set up seemingly expensive projects. They produce several short documentaries and travel around Malaysia, Russia, eastern Ukraine and the Netherlands.

Bellingcat writes in today’s report that it is still unclear whether Russia financed the project. What does make the research collective hard is that military intelligence officers GROe make contact with the founders and build a lasting relationship shortly after the launch of Bonanza Media.

Since at least August 2019, Russian GRU Colonel Sergey Chebanov has been kept informed DAILY of the new plans of Bonanza Media. During hundreds of conversations, the colonel, according to radio records checked by Bellingcat, sits at the GRU headquarters in Moscow. Chebanov gives Chebanov a temporary phone that is officially registered to a non-existent Georgian woman. Since, despite all security measures, the Colonel sometimes calls Yerslashova’s new phone with his own phone, Bellingcat finds out how Bonanza and the GRU are in contact.

In addition to bubbles, on average two a day, there is also a lot of texting and sometimes e-mailing. Stories that will appear on Bonanza Media or announcements of new events will first be submitted to the Colonel. This line gives the Russians access to the small but loud group of Dutch conspiracy thinkers around MH17. It appears, for example, that the pro-Kremlin activist, who lives in the Netherlands, Elena Plotnikova, had a text checked by Chebanov via Bonanza Media. From the ex-Elsevier journalist Eric van de Beek, now a writer at Bonanza and conspiracy magazine the other newspaper, several pieces were presented in Moscow via this route. In some cases it seems that whole sentences have been added. The fact that Russian spies have such a profound influence on what activists and citizen journalists write is a unique example of interference in the Netherlands.

The intensive cooperation between Colonel Chebanov and the bonanza duo is not limited to the exchange of information and the provision of telephones. Early this year, January 6th, Bellingcat, sms’s and Yerslashova and the Colonel saw intensively. She sends photos of herself and her cameraman’s passport, who, in addition to his work for Bonanza, also works at Russia Today. A few days later, a copy of Van der Werff’s passport appears to have been made in Russia on the basis of meta-data.

On the basis of phone data, Bellingcat sees Chebanov calling another GROe officer after receiving the photos, who in turn contacts Anna Soroka, Deputy Minister of Foreign Affairs of the rebel State of eastern Ukraine. The leaked e-mail contact between Soroka and this Russian spy shows that the passports are needed to give the Bonanza team access to the difficult Donbas region. Deputy Minister Soroka only wants to allow that to happen with the permission of the Kremlin and the Russian intelligence agency FSB, she writes. It illustrates how many highly-positioned Russians and pro-Russian rebels in Ukraine are involved in facilitating Yerlashova, van der Werff and their cameraman.

But more importantly, it makes sense of what the days looked like before Bonanza came out with his most important achievement. On January 12, Van der Werff and Yerlashova took place for a webcam in Moscow to tell their followers that big news is coming. They have received ‘important information ‘ which they will verify themselves, shortly afterwards they will travel to the border with eastern Ukraine. On the way to the border, Yerlashova and a GROe officer call each other all the time. Once in the region for their fieldwork more than a hundred times is communicated in three days, writes Bellingcat.

Back in the Netherlands, telephone traffic between GRU officers and Bonanza is still high. On January 31, the day before the ‘great unveiling’, the number of calls and messages between Yerlashova and the second GROe officers reached a peak. On 1 February it is finally time for Van der Werff and Yerlashova to leak an internal JIT document and announce the ‘BonanzaLeaks’, a month-long period in which documents are released. Although the leaked documents are anything but scandalous, they feed conspiracy thinkers and Russian state media, Bonanza gets a lot of attention. The defense attorneys will later refer to the work of Bonanza and have summoned Van Der Werff as witnesses in court.

The leaked documents may have been stolen during a hack from the Malaysian Public Prosecutor’s Office, which is part of the joint JIT investigation led by the Netherlands. Behind that hack attempt was the Grue.

“It also illustrates just how important the information is, in modern warfare, particularly in Russia and Ukraine,” says Marieke de Hoon, assistant professor of international law at the Free University, and is closely following the MH17 lawsuits. “Information is part of the struggle and as it spreads more easily today, it is now also subtly penetrating into parts of our society.”As on Twitter, in alternative newspapers, or in this case in court.

However, De Hoon does not believe that Van der Werff, as a Dutch citizen, working with a Russian intelligence agency, will be prosecuted under criminal law. ‘He is not in foreign military service and does not engage in combat, this is information and that falls outside the scope of the penalization of entering into a hostile military service or committing acts of violence.’

But what if the battle is mainly about information? ‘You then find yourself in a very complicated area of tension in which you come to freedom of speech and other liberal values. It is about spreading disinformation, and if it is not a direct victim and does not call for violence, criminal law does not really have an appropriate provision for this.”The Hoon therefore sees above all a task for journalism. ‘As propaganda spreads more easily, especially online, there is a great need for people who control and weigh information. In the end, that is the job of journalists.’

In this light, Mr. Van der Werff calls himself a proud journalist. He is encouraged by the fact that in May 2019 he received a press card from the Dutch Association of journalists (NVJ). In doing so, Van der Werff likes to protect when people accuse him online of spreading propaganda.

‘I think journalism should ask itself the question of how it protects itself as a profession and as a guardian and controlling power of information’, says the Hoon. “You must also check each other out. Perhaps even consider whether you should not go to a protected title, which you may lose if the rest of the profession believes you are not applying the right methods. Just like other guilds, like the law.’

That question seems more relevant than ever now as the self-appointed journalists of Bonanza Media shift their focus to other themes such as corona, Syria and the whistleblower Julian Assange. The lines they follow fit perfectly again in the Russian narrative.

“I am greatly shocked by these findings,” says Thomas Bruning, secretary-general of the NVJ. ‘He did indeed receive a press card from us, although we did not extend it when Van Der Werff requested it. The reason for this was that he could not clearly demonstrate that he was making his money independently.”Van der Werff is still a member. ‘We are very reluctant to disbar us. It is and remains an open profession. Although there are certain exceptions, collusion with a foreign power can certainly be a reason to think about this. We have to look into this carefully and we will also have a re-examination of it with the member concerned.’


About the author: Sarah Thompson

Sarah Thompson is a seasoned cybersecurity analyst with over a decade of experience in deciphering digital threats and vulnerabilities.

Related assays

The last Jew in Afghanistan has left the country

Sarah Thompson

UK policeman nearly missed the George Floyd moment

James Ramirez

French minister of Defence considers religious (i.e. Islamic) extremism is not an issue in France

Sarah Thompson

Leave a Comment