The technical finding that a surface to air missile from a state operated system caused the loss of a civil aircraft is not the end of an investigation. It is the beginning of much harder work: establishing how the weapon was employed, why safeguards failed, who bore operational and criminal responsibility, and what changes are required to prevent recurrence.

Investigations into shootdowns have two, legally distinct tracks. A safety investigation governed by ICAO standards seeks to identify systemic and technical causal factors so that lessons are learned and safety is improved. A criminal or disciplinary inquiry seeks to identify and hold to account those whose negligence or unlawful acts caused loss of life. These two tracks can and should run in parallel but they must be managed so that evidence is preserved and due process is protected. The international framework for the safety side is Annex 13 to the Chicago Convention, which sets out which states participate, the rights of accredited representatives, and the primacy of prevention over assigning blame.

Past cases show how messy and politically charged this work becomes. The MH17 investigation established rigorous forensic pathways for linking missile fragments to a specific launcher and transport chain and made clear that meticulous evidence handling, independent technical analysis, and international cooperation are essential if results are to be credible. Those lessons still apply when the accused system is a short range air defence battery rather than a long range system.

The 2020 downing of Ukraine International Airlines Flight PS752 in Iran underscores the limits of a domestic inquiry when military actions are implicated. Independent expert participation, transparent chain of custody for flight recorders, and clear answers about command and control were critical sticking points in that case. Authorities and victims alike demanded transparency, and outside technical expertise proved essential to credible conclusions. The experience of PS752 demonstrates why states of registry and operator must be allowed meaningful technical participation under Annex 13.

Operational context matters for interpretation of cause. Where air defence units are actively engaging drones or other threats, risks to nearby civil traffic rise. The January 2024 losses of high value Russian command and early warning aircraft show how dynamic operational environments, mixed identification regimes, and degraded situational awareness can combine to produce catastrophic results. Any probe that points to a SAM fault must therefore examine the tactical picture at the time of engagement: what threat cues were present, how identification friend or foe procedures were implemented, and what command authorizations were recorded.

Technical forensic work for a SAM-related finding must include the following minimum elements:

  • Secure recovery and independent readout of flight data and cockpit voice recorders. These are primary timelines and must be treated under strict chain of custody. Independent experts should be given direct access or invited as accredited advisers under Annex 13.
  • Site and wreckage forensics to recover and catalog fragments. Warhead and fragmentation patterns, entry hole geometry and distribution, and metallurgical analysis can identify munition family and subvariant. MH17 remains a textbook example of how fragment forensics can link a weapon to a particular launcher type and transport history.
  • Radar, electro optical, and ADS-B/flight tracking data. Raw radar tapes from local air defence and regional air surveillance must be preserved and made available to independent analysts. Satellite imagery and third party ISR platforms may provide corroboration.
  • Weapons system telemetry and logs, if available. Modern SAM systems produce event logs, engagement geometry, and sometimes video or electro optical records. Those logs are often held by the military owning the system. A credible inquiry must seek access, or at minimum secure independent verification of those records. The absence of such data is not an adequate explanation.
  • Electronic warfare and jamming analysis. If the airliner reported control anomalies, GPS outages, or other avionics effects, the investigation needs to identify whether EW activity was present and whether any misidentification resulted from degraded avionics or corrupted sensor inputs. Previous conflicts show how EW, mistaken IFF returns, and rushed engagement decisions can combine.

On the question of platform reliability and known vulnerabilities, short range systems such as the Pantsir family have been subject to repeated operational scrutiny and criticism in recent years. Combat losses and documented cases in multiple theaters have highlighted scenarios in which jamming, saturation attacks, or tactical deployment errors reduced system effectiveness or produced unanticipated outcomes. Any probe that points to a Russian SAM must therefore include a vendor and independent technical assessment of the specific battery model, software and hardware configuration, and maintenance and crew training records.

Procedural safeguards matter as much as technical ones. Investigators should insist on:

  • Full, Annex 13 compliant participation by affected states and the operator. This includes the right to nominate accredited representatives and technical advisers.
  • Internationally observed preservation of evidence and transparent publication of factual records. The PS752 experience shows how lack of perceived independence erodes confidence even when technical conclusions are plausible.
  • Separate handling of safety recommendations and criminal accountability. Safety reports should focus on preventing recurrence and may recommend organizational and technical fixes. Criminal investigations will need to consider intent, negligence, and violations of law, and these require different legal standards and procedures. Both are necessary.

Policy implications go beyond the immediate investigation. Where military air defence activity overlaps with civil flight paths, states must address airspace risk proactively. That means clearer NOTAM practices, stricter temporary flight restrictions during kinetic air defence operations, improved civil military liaison, and international mechanisms to verify and audit air defence employment near commercial air routes. The international community should also revisit guidance on operating civil flights near active conflict zones when active local air defences are in use. Lessons from MH17 and PS752 argue for more conservative thresholds before an airspace is left open to commercial traffic.

Finally, credibility is everything. If a probe concludes that a state operated SAM was at fault, the finding will only reduce future risk if it is demonstrably based on sound, independently verifiable evidence and followed by meaningful remedies. Remedies include transparent criminal or administrative accountability where appropriate, compensation for victims, technical and procedural fixes for air defence employment, and binding changes to airspace risk management. Absent those outcomes, a technical finding will ring hollow and the same dangerous gaps will persist.

Investigators, operators, and states owe victims and the flying public nothing less than a robust, transparent and technically complete process. The bar for credibility is high, but the cost of failing to meet it is measured in lives.