On Sept. 28, 2016, the Dutch-led Joint Investigation Team (JIT) conducting the criminal investigation into the downing of Malaysian Airlines Flight 17 (MH17), published a call for witnesses regarding two key individuals in the downing of the airliner: “Delfin” and “Orion,” with the first name and patronymics of (respectively) Nikolai Fedorovich and Andrei Ivanovich. In their call for witnesses, the JIT also published a number of intercepted telephone calls between these two individuals, where they address each other by their first names and patronymic (a transcript of the calls can be found in English and Russian).
There are a number of details surrounding Delfin and Orion that are unclear, including their exact role in the downing of MH17, but the fact that the JIT has specifically requested information on them implies how they are key persons of interest in the criminal investigation of the tragedy. Now, over a year after the JIT’s call for witnesses, a long-running investigation that combines open source research, investigative journalism, and two independent forensic analyses has determined Delfin’s identity: Colonel General Nikolai Fedorovich Tkachev, currently serving as the Chief Inspector of the Central Military District of the Russian Federation.
Delfin’s Role in Ukraine: The JIT’s Intercepted Calls
On the third anniversary of the downing of MH17, Bellingcat called for a deeper, crowdsourced investigation into establishing the identities of Delfin and Orion. Bellingcat and The Insider, followed a number of iterative steps in order to narrow down the potential candidates for the identity of Delfin before zeroing in on Colonel General Tkachev.
The starting point of this investigation was the JIT’s call for witnesses from 28 September 2016, where a man, addressed by the first name and patronymic Nikolai Fedorovich, was identified as using the call-sign “Delfin.” Notably, names used in communications between military commanders in the Donbass are often noms de guerre , and cannot be assumed to be authentic. For example, while he served a the military intelligence commander in Donetsk, Sergei Nikolaevich Dubinsky used interchangeably the call sign “Khmury” and the nom de guerre “Petrovsky,” despite “Petrovsky” not being part of his real name.
However, in the first of five intercepted calls published by the JIT, an atypical miscommunication occurs: Delfin’s interlocutor misaddresses him as “Fedor Nikolaevich,” reversing his name and patronymic. Seemingly instinctively and tersely, Delfin corrects him, suggesting it is likely his real first name and patronymic. Additionally, throughout each of the calls with Delfin, there is a consistent context of Delfin being the superior commanding officer, as each interlocutor refers to Delfin in the courteous Russian plural (vy), while Delfin refers to them in the singular (ty) form. Below, the Russian transcript (provided by the JIT) shows this exchange between Delfin and Orion, along with an English translation [note: The JIT’s English translation lacks some key nuances, such as a mistranslation the Fedor Nikloaevich – Nikolai Fedorovich mix-up].
C (Nikolai Fedorovich, Delfin): Hello?
B (Andrei Ivanovich, Orion): Yes, good day!
C: Andrei Ivanovich?
B: Hello, Fedor Nikolaevich!
C: It’s Nikolai Fedorovich. Greetings [using ty].
B: Nikolai Fedorovich, yes… good to hear you [vy].
C: Well, so? How are things there? Are you [ty] ready to meet [inaudible]?
B: And you [vy], are you getting ready to come here?
Throughout the other calls with Delfin, his outranking of his interlocutors can be heard in his tone and manner of speaking, along with the grammatical markers. Furthermore, we know that he was not familiar with the geographic circumstances around the current battles. At one point in a conversation, Orion has to correct a geographic assumption that Delfin made related to an airfield (likely the Luhansk Airport, which saw heavy fighting in mid-July 2014).
C (Andrei Ivanovich, Orion): Yes, Nikolai Fedorovich.
B (Nikolai Fedorovich, Delfin): So, the convoy has been confirmed. Where can the convoy come from?
C: I don’t know where it’s coming from. Maybe from the west?
B: Yes somehow from the west. From the west. A fucking kilometer and a half from the airport.
C: From the airport?
C: It can’t be a kilometer and a half from the airport because there’s a village there, there are positions there. Probably… I don’t know. We’ll try something now. We didn’t have a signal until now, unfortunately. Hello.
B: Aha. Yes, yes yes.
Delfin’s Role in Ukraine: Separatist Digital Sources
A separate channel for gathering information about Delfin’s involvement in the war in the Donbas was through a number of pro-Russian/separatist sources, most notably the blogger “Colonel Cassad,” or Boris Rozhin, and an interview with Igor “Strelkov” Girkin, published in 2014-2015. These sources indicate that Delfin was a high-ranking Russian commander who was stationed, at least part-time, in Krasnodon for a brief period in the summer of 2014. Delfin was described as having been tasked with the re-organization and consolidation of the decentralized military units in the self-declared Luhansk People’s Republic (LNR).
The city of Krasnodon is notable in the context of MH17 due to the fact that the Buk that downed the passenger plane reportedly crossed the Russian border near Krasnodon both on its way into and out of Ukraine, making the logistical and organization role in Krasnodon potentially key in the procurement and transport of the weapon.
In a 5 November 2014 interview (archive) between infamous separatist commander Igor “Strelkov” Girkin and controversial Swedish-Russian commentator Israel Shamir, Girkin describes meeting Delfin and details his background and duties. At the end of the interview, Rozhin/Cassad added further notes about Delfin and his colleague “Elbrus.”
Interviewer: But there was a military leader known under the call sign ‘Delfin.’
Girkin: I met him in Krasnodon a month before my departure. He, of course, is a good military specialist, but all of his military experience is in commanding regular troops, where there’s discipline, unconditional submission. And here, there is partisan warfare, scattered units. He did all that he could, but he was not able to take full command. He was only able to coordinate between separate units.
[from Colonel Cassad] P.S. I can clarify that ‘Delfin’ and ‘Elbrus’ were involved in the coordination of separatist units in the LNR and partly in the DNR [self-proclaimed Donetsk People’s Republic]. One was in Krasnodon, the other in Luhansk. This coordinating headquarters was opened after a Bezler [note: separatist commander Igor ‘Bes’ Bezler] visit to Moscow. As far as I know, ‘Delfin’ himself came with the rank of kombrig later ‘on vacation.’
The Insider contacted Igor Girkin in order to obtain more information on the situation in Krasnodon in summer 2014 and, in particular, Delfin and his role in eastern Ukraine in the summer of 2014.
When asked about the situation in Krasnodon, Girkin confirmed that there was a base in the city that was established in early July. This base was comprised of “senior, retired ‘General staff’ experienced generals,” including Delfin, who Girkin believes were likely independent from the directives of Vladislav Surkov, Russia’s envoy to the Minsk agreements who is widely regarded as a lead Kremlin overseer of the so-called “republics” of eastern Ukraine. When asked about Delfin in particular, Girkin said that he believes that he was “some kind of a general” who is no longer involved in the conflict in eastern Ukraine.
In a 3 January 2015 blog post (archive), Colonel Cassad described the chaotic situation in the LNR during summer 2014, describing Delfin as a figure sent by Moscow to bring order to the situation in Luhansk.
“The shooting and murders in the LNR are an entirely logical reflection of the more anarchic nature of the local republic (in comparison with the DNR), where in the summer there were more than twenty different military formations in Luhansk that were not subordinate to anyone. Neither Bolotov [note: now-deceased leader of the LNR from May to August 2014] nor those who were sent from Moscow (this was in fact the reason why ‘Elbrus’ and ‘Delfin’ failed) were able to handle this. “
In a 24 May 2015 blog post (archive), Colonel Cassad described Delfin as a “vacationer-curator” who came from Russia and whose task was to “mold out, from the amorphous separatist units, a more-or-less functioning army structure” in the LNR [self-declared Luhansk People’s Republic]. In a 14 September 2015 blog post (archive), Colonel Cassad mentions that Delfin and Elbrus failed in their attempts to coordinate the disparate LNR military units through Krasnodon.
“Of course, there were failures along the way. An attempt to coordinate the actions of the separatist militias through Krasnodon failed when Delfin and Elbrus couldn’t handle the huge conglomeration of ragtag militias.”
Note that vacationer is a term used for Russian “volunteers” in the Donbas, often active Russian servicemen; curator is a term for Russian military and intelligence officials involved in shaping and providing guidance to the self-declared separatist republics in eastern Ukraine. Speaking with The Insider about Delfin, Rozhin gave further details about the functions of these “vacationers”:
“These high-ranking ‘vacationers’, that is to say officers who were officially on vacation, came in order to improve the organization [of the separatists]. ‘Delfin’ and ‘Elbrus’ were among them. ‘Delfin,’ as far as I remember, was of the rank of general and was involved in the operational management of separatist units from Krasnodon. At the time, it turned out badly there due to the fact that the army was at the time still not in its full form.
When they tried to break down the units into one grouping, they came up against opposition from the commanders themselves. Based on this experience, which weren’t the best, conclusions were drawn and when the separatists were reorganized to a brigade level, they began a very severe selection of staff structures. The most sensible ones were made the heads of the staff brigades and gradually the vertical [leadership structure] was set. It took a year, and another year.
But all of this was already after ‘Delfin,’ who actively led in the period of August-September, when the ‘Northern Wind’ was actively blowing [note: the ‘Northern Wind’ refers to the period of massive Russian military intervention in the war in the Donbas]. Somewhere around October-November, ‘Tambov’ had already appeared — the very same general who led the encirclement of Debaltseve. If you wish, you can now find this person. He now leads the Combined Arms Army in Russia.”
Here, Rozhin is speaking about Lieutenant General Sergey Kuzovlev, born in the Tambov Oblast, giving rise to his eponymous call sign. In the beginning of 2014, he was awarded the rank of Major General. At the end of August 2015, the Ukrainian SBU [state security service] stated that Kuzovlev led the 1st Army Corps of Russian troops in the armed conflict in eastern Ukraine from the autumn of 2014 until the winter of 2015. In March 2017, he was appointed as commander of the newly formed 8th Guard Combined Arms Army of the Southern Military District. The fact that Lieutenant General Kuzovlev was publicly named as a commander of armed forces in eastern Ukraine and then continued to rise in the ranks of the Russian military was instrumental in Bellingcat and The Insider’s search for the identity of Delfin, as it implied it was not only reasonable, but likely that a high-ranking general of the Russian Armed Forces would have had a direct role in the management of the so-called DNR and LNR in the summer of 2014.
The Most Likely Candidate Emerges
Combined with the open source references to Delfin from the Colonel Cassad and Igor “Strelkov” Girkin materials, we were able to make further conclusions about who Delfin was: a fairly high-ranking Russian military commander and likely a general, thus likely over 40-50 years old. Furthermore, he served a short stint with at least an occasional physical presence in Krasnodon, but was unsuccessful due to his experience being incompatible with the task. Though Girkin clearly had respect for Delfin’s expertise and experience, he found it lacking for the specific circumstances of the Donbas.
Our working hypothesis in the search for Delfin led us to a number of likely details that would narrow down the search:
- A Russian officer with the first name and patronymic Nikolai Fedorovich, who may be active, retired, or in reserve.
- Most likely holding a rank of general due to the seniority expressed to him in the telephone conversations and from Igor Girkin, who is otherwise generally derogatory towards other military commanders. With the reference that Delfin was a “kombrig” (brigade commander), reflecting Cassad’s specific recollection of Delfin as a general. There are a number of Russian generals (including Lieutenant and Colonel Generals) who served roles very similar to that of Delfin in the Donbas, including Colonel General Istrakov and Lieutenant General Kuzovlev.
- A commander with significant high-level military experience that may have appeared to be applicable to the Donbas, but did not suit the circumstances of the disorganized state of Luhansk-based units in the summer of 2014.
- A man who clearly had the trust of high Russian military and/or political command, suitable for receiving a role of such a military restructuring mission in the notoriously disorganized self-declared Luhansk People’s Republic.
Among the open source information accessible online, there is only one living Russian army general with the first name Nikolai and the patronymic Fedorovich: Colonel General Nikolai Fedorovich Tkachev.
Tkachev’s Timeline: 2010-2013
The Kremlin press service announced in 2010 (archive) that Colonel General Nikolai Fedorovich Tkachev was officially dismissed from military service, accompanied by decree №1532 (archive) signed by then-president Dmitry Medvedev on 10 December 2010. However, Tkachev did not truly retire, as he continued to fulfill military duties elsewhere. In 2011, Colonel General Tkachev became Russia’s Head Military Advisor in Syria until the advising apparatus was dissolved in 2012. The Russian Wikipedia page on Russian military advisers to Syria lists Tkachev’s service starting in 2010, but Tkachev clarified in a call with The Insider that he actually served from March 2011 to August 2012, consequently also confirming his role in Syria.
The well-known Russian military blogger el-murid (Anatoly Nesmeyan) wrote on Tkachev in a 2015 post (archive), saying that “The last leader [of the Russian military advising apparatus in Syria] was Colonel General Tkachev.” In a 7 August 2012 video from the anti-Assad group “Damascus area military command,” a photograph appears at 1:19 of Colonel General Tkachev alongside Russian Major General Vladimir Kuzheev and assassinated Syrian Minister of Defense Dawoud Rajha. In the video, anti-Assad rebels claim to have killed Major General Kuzheev, showing his identification card, but with Kuzheev giving an interview shortly after his “death,” it became clear that this claim was false. Like Tkachev, Kuzheev was dismissed from military service in 2010 before working in Syria.
Colonel General Tkachev (left), Syrian Minister of Defense Dawoud Rajha (center), Major General Vladimir Kuzheev (right)
Colonel General Tkachev’s service in Syria ended soon after the assassination of the Syrian Defense Minister in August 2012. In a conversation with The Insider, Tkachev said that he became the Chief Inspector of the Central Military District after arriving back in Russia from Syria in 2012. There is no open source information regarding Tkachev’s activities throughout 2013.
Tkachev’s Timeline: 2014
Afterward, there are no sightings of Tkachev in Russia until 23 August 2014 (archive), where the Colonel General was photographed at a meeting for the Ataman of the Orenburg Cossack Host Society. In the description of the meeting, Tkachev is named as the “Chief Military Inspector of the Central Military District.” This marks the first time that Tkachev has been publicly mentioned in this role, though he assumed the position in 2012 after his return from Syria.
There are no public appearances by Tkachev from Victory Day in 2014 until his reappearance in August and September 2014, where he was fairly frequently noted at gatherings in the Central Military District. During this gap, Tkachev, using the call sign Delfin, attempted to organize and command military formations in the LNR, working at least part-time in Krasnodon.
Forensic Voice Analysis
After concluding that Colonel General Tkachev was by far the most likely candidate to be Delfin (see the subsequent sections of this investigation for a detailed breakdown of this determination), Bellingcat and The Insider sought samples of Tkachev’s voice among open source materials. The only publicly available voice sample was a brief utterance during a 2017 ceremony at the Yekaterinburg Suvorov Military School, accessible via twovideos.
However, a far longer sample of Tkachev’s voice was needed to cross-reference it against Delfin’s voice in the JIT’s call for witnesses. In order to obtain this audio, The Insider conducted two telephone conversations with Colonel General Tkachev under the cover of writing a story on the Yekaterinburg Suvorov Military School, where Tkachev serves as chairman of the newly established Board of Trustees for the school (archive). Below, you can listen to three audio tracks that have been cropped to isolate only the voice of Tkachev/Delfin: the JIT’s call for witnesses, and the two calls between Tkachev and The Insider. Additionally, a video below comparing the two voices is embedded below. These files can also be accessed here.
Bellingcat and The Insider reached out to two organizations to perform forensic voice analysis: the National Center for Media Forensics at the University of Colorado at Denver (UC Denver) and the Forensic Science Centre of Lithuania (FSCL). The two organizations acted and reached their conclusions independently of one another.
UC Denver Analysis
The National Center for Media Forensics at the University of Colorado at Denver conducted a forensic speaker comparison based on the industry-standard Likelihood Ratio (LR) analysis. In their test, they used the software package BATVOX from AGNITIO/NUANCE. The analysis compared voice and phoneme characteristics of two sets of samples: Sample A included five conversation segments published by the JIT in September 2016, and Sample B included two conversations conducted by The Insider in the course of interviews with Colonel General Tkachev in October and November 2017.
The speaker comparison generated a Likelihood Ratio (LR) of 428.
The conclusion of the University of Colorado Denver speaker-comparison test was summarized as follows:
“It is 428 [times] more likely that the speaker Delfin is the same as the speaker in ‘call_13-11-46_OUT_8912256****.aac’ [note: filename of the first call between The Insider and Nikolai Tkachev. The final digits have been censored, as they are the telephone number of Col. General Tkachev], than the speaker Delfin is any other speaker. The analysis supports the hypothesis that the speaker Delfin is the same as the speaker in ‘call_13-11-46_OUT_8912256****.aac’.”
The value of 428 is a reference to the likelihood ratio of the two voices matching, providing what the European Network of Forensic Science Institutes would call “moderately strong support” for the hypothesis that Delfin and Tkachev are the same person behind the calls.
In real-life terms, it means that it is 428 times more likely that voice from Sample A (Delfin) matches the voice from Sample B (Tkachev), than that it matches any randomly selected person from the reference universe. In this case, the reference population is defined as “Russian-male speakers”, and is based on a representative group of 42 different speakers (against a minimum recommended sample of 30 different speakers per group).
Prior to conducting the comparison, the UC-Denver system was calibrated using samples from 100 different Russian speakers recorded in normal conversational style under different quality and noise conditions, all of them with a Signal to Noise Ratio (SNR) greater than 15 dB, and between 30 seconds and 2 minutes net speech. During such calibration, two measures were obtained: first, an inter-variability LR (i.e., the likelihood ratio that any two random voices among this reference group of 100 belong to the same speaker), and second, the intra-variability LR (i.e. the computed likelihood ratio that any two voices in fact belonging to the same speaker, are the same). The inter-variability LR score was 78, while the intra-variability LR score was 181.
It is against the backdrop of this latter LR score (181), says Dr. Catalin Grigoras, director at National Center for Media Forensics, that the score of 428 should be assessed.
For reference, the voice segments from Sample B (Tkachev) were also tested against all male speakers in all other intercepted telephone conversations published by the Ukrainian Security Service (SBU) in the period of 2014 to 2016. In these reference tests, Tkachev’s voice did not score a LR higher than 1 (i.e., no statistical relevance) with any sample except that of Delfin. As a reference test of what a definitive negative result would be in UC-Denver’s analysis with BATVOX, a test was run comparing Tkachev’s voice and the voice of The Insider’s interviewer, producing a LR of 0.2043.
Dr. Grigoras stated that the LR from the BATVOX test must be evaluated in correlation with other evidence collected in the case, which may further increase its significance. Based on a LR of 428, Dr. Grigoras exemplified this with the concept that if there were 428 potential randomly picked up suspects, a similar match would occur only once. If, however, the suspect population is restricted further, say to only Russian males aged over 50, holding a high military rank, and having the name and patronymic “Nikolai Fedorovich,” the effective overall LR assessed by the investigators should rise sharply.
Dr. Grigoras added that it is always highly recommended to correlate one evidence (in this case, the automatic speaker recognition results) with some other forensic analysis (e.g. phonetics, fingerprint, DNA, etc.) or evidence (e.g. voice line ups, witnesses, GPS, etc.).
A write-up of the UC Denver analysis provided by the National Center for Media Forensics can be accessed here. The full forensic report will be sent to the Dutch-led JIT.
The Forensic Science Centre of Lithuania conducted analysis on each call individually to match them with the two calls conducted by The Insider. The analysis was conducted by, as described by the FSCL:
“The head [Dr. Bernardas Šalna] of the phonoscopic forensic examination department, with an expert qualification in ‘speech, voice and sound and their recording tools criminal investigation’ as well as 25 years of experience in forensic examination; as well as Žavinta Pikutienė and Elena Šalnaitė – department’s senior experts with higher education in physics, expertise in ‘speech, voice and sound and their recording tools criminal investigation’ with respectively 23 and 20 years of experience.”
The team “compared the speech and voice peculiarities of persons X [note: Delfin in the intercepted phone conversations] and Y [note: Col. General Tkachev in his two conversations with The Insider].” The voice of Delfin was judged to be a highly probable match in the second and fourth calls, and a probable match in the first and fifth calls. In the third call between Orion and an unidentified interlocutor, analysts at the FSCL determined it was highly probable that Tkachev was not the unidentified interlocutor, who was known to not be Delfin.
For the first call, from the beginning of the call for witnesses video until 0:48, the FSCL determined the following:
It is probable that in the recording MH17 – Call for witnesses (v2).aac from 0s to 48s, the participant of the recorded phone conversation (in the transcript Аудиофайл [audiofile] 1 marked as C) is the same person Y, whose voice and speech examples were provided in the recordings call_11-25-36_OUT_8912256****.aac[note: first call conducted between Tkachev and The Insider] and call_13-11-46_OUT_8912256****.aac [note: second call conducted between Tkachev and The Insider].
The following graphic was included in the FSCL’s report to demonstrate the spectrum of amplitude in the voices of Delfin (blue) in the first call and Tkachev (green).
For the second call, in the call for witnesses video from 0:48 to 2:04, the FSCL determined the following:
It is highly probable that in the recording MH17 – Call for witnesses (v2).aac between 48s and 2min 4s, the participant of the recorded phone conversation (in the transcript Аудиофайл [audiofile] 2 marked as B) is the same person Y, whose voice and speech examples were provided in the recordings call_11-25-36_OUT_8912256****.aac [note: first call conducted between Tkachev and The Insider] and call_13-11-46_OUT_8912256****.aac [note: second call conducted between Tkachev and The Insider].
The following graphic was included in the FSCL’s report to demonstrate the spectrum of amplitude in the voices of Delfin (blue) in the second call and Tkachev (green).
Colonel General Nikolai Fedorovich Tkachev, “Delfin”, is the senior-most Russian officer who has been linked to the downing of MH17. Unlike Sergey Dubinsky and Igor Girkin, Tkachev was, and still is, an active functionary in the Russian military through his ongoing role as Chief Inspector of the Central Military District. His exact role and importance for the MH17 case has not been made public so far by the JIT.
Available open source information suggests that person behind the pseudonym “Delfin” is a former or current Russian army officer of higher rank, likely a general. Furthermore, his words indicate that his name is Nikolai Fedorovich. Only Colonel General Nikolai Fedorovich Tkachev matched these characteristics; however, before conducting forensic audio analysis, there was no direct evidence showing Tkachev’s direct link to the LNR and the war in the Donbas. The voice sample collected by The Insider was analyzed to firmly establish the link between Delfin and Tkachev. As shown by multiple reports, his collaboration with the Luhansk People’s Republic took place during the period when MH17 was downed.
Per his own words in the recent telephone conversation with the Insider, Tkachev served the Russian Armed Forces on 17 July 2014 as the Chief Inspector of Russia’s Central Military District, and continued these duties immediately after the downing and his permanent return to Russia.