Eye Witness and Digital Evidence from a Chemical Weapons Attack in Syria’s Idlib Province
Introduction
On Tuesday, April 4, 2017 evidence started to emerge online of an alleged chemical weapons attack on the city of Khan Sheikhoun in the south of Syria’s Idlib Governorate. Online open source investigative platform Bellingcat analyzed the images and videos coming out of Syria to verify the credibility of the evidence for the attack.
Dozens of videos emerged from responders on the ground presenting consistent accounts of airstrikes that allegedly included the nerve agent Sarin. The videos show symptoms of victims that are compatible with the nerve agent, including pinpoint pupils, foaming at the mouth, and convulsions. While such symptoms are not exclusive to Sarin, usage of Sarin in past attacks in Syria resulting in similar symptoms led many responders to believe that it was again used in this latest strike. Initial reports estimated over fifty casualties and two to three hundred injured.
In the aftermath of the attack, a second airstrike caught on film reportedly damaged a civil defense center being utilized as a hospital to treat victims of the initial strike.
Attack Timeline
The very first evidence of the attack surfaced the morning of April 4 with a video allegedly showing the airstrike that was posted at 7:59am local time.
The first time chemical weapons were mentioned was in a tweet at 8:21am local time by Haq News Agency which linked to the earlier video describing it as “the moment of targeting Khan Sheikhun with chemical rocket 04/04/2017 by Russian airforce.”
At 9:22am local time the first video showing victims of the attacks was published by Edlib Media Center. Soon after numerous other videos and statements were released depicting victims of the attacks, including a tweet from Dr. Shajul Islam, stating that his hospital was full from the aftermath of the attack.
Later accounts were all consistent with this timeline, with residents claiming the attack took place around 6:30am local time. One such instance is a responder who reported that at 7:00am local time he was woken by “the alarm voice of the observatories offices that was saying all ambulances should go to Khan Sheikhoun.”
Aircraft Timeline
Additional evidence supporting this timeline comes from the tracking of the aircraft allegedly involved in the attack. Multiple sources report that a Sukhoi Su-22, a Soviet variable-sweep wing fighter-bomber, conducted the attack. At 6:26am local time aircraft spotters working with Syria Sentry reported that a Su-22 called Quds 1, the fleet’s squadron commander, had departed its airbase in Homs. This same plane has been linked to other alleged chemical attacks in Syria. Shortly thereafter another plane called Quds 6 left the same base the spotters reported.
Supporting this timeline is an image released by the Pentagon allegedly showing the radar blips of the aircraft that carried out the attack. The information puts the plane above Khan Sheikhoun between 6:37 am and 6:46 am local time.
Lastly, multiple eyewitness accounts confirm the timeline of the aircraft and its involvement in the attack. The first mention of the Su-22 was in a tweet by @ShamiRebel at 9:22am. Other videos show witnesses saying a Su-22 fired 4 missiles in the attack.
Later in the day Orient News, an opposition outlet, published an article linking the alleged pilot, Muhammad Yousef Hasouri, commander of the Sukhoi 22 Squadron at al-Sha’yrat airport, to the attack. Additionally, Gen. Ali Ayoub, Syria’s Army Chief of Staff, visited the Shayrat air base a few days after the attack and was recorded honoring Hasouri alongside members of the Syrian parliament.
Impact Site
Analysis of the emerging videos and images allowed Bellingcat to verify the crater at an alleged impact site of the attack. Evidence of the crater includes photos by the Warsheh group published on their Facebook page.
As well as photos published by Reuters and other news agencies.
Using these photos and a video posted by the Hadi Al Abdallah YouTube channel, Bellingcat was able to use geolocation to authenticate the impact site:
The above crater was successfully geolocated to a site within Khan Sheikhoun, however, the impact site does not correspond with the existing footage claiming to show the initial moment of the attack, as the crater site is in a location not visible in the initial video. Thus additional impact points would have to be uncovered for the existing footage to be verified:
An additional impact site was geolocated based off a video posted by the Syrian Journalism Center:
Images being shared online reportedly depicting the remains of the munition have not been able to be identified.
Hospitals
Victims were taken to hospitals and clinics to receive treatment in the aftermath of the attack. Through videos posted online, Bellingcat was able to confirm at least four separate locations that were utilized in the treatment of patients. Evidence for each of these locations was organized into individual playlists Hospital A, Hospital B, Hospital C, and Hospital D.
Hospital B, located in Khan Sheikhoun, is of particular note as it was bombed on the same day as the chemical attack as victims were being treated. The moment of the bombing of the civil defense center was recorded by activists on the ground:
An AFP journalist present during the attack verified the damage it caused through the comparison of photographs from earlier that morning with those taken after the strike:
In the below before and after images, we see the damage incurred by the opposite side of the above building (note the distinctive graffiti and entryway).
Conclusion
In the face of international condemnation, both the Syrian and Russian governments have disputed that the attack was chemical in nature. The Russian Ministry of Defense claimed that the symptoms seen in victims were a result of a strike on a rebel-controlled chemical weapons warehouse in the city:
“According to Konashenkov, on Tuesday “from 11.30 to 12.30, local time, [8.30 to 9.30 GMT] Syrian aircraft conducted an airstrike in the eastern outskirts of Khan Shaykhun on a large warehouse of ammunition of terrorists and the mass of military equipment”.
Konashenkov said that from this warehouse, chemical weapons’ ammunition was delivered to Iraq by militants.
Konashenkov added that there were workshops for manufacturing bombs, stuffed with poisonous substances, on the territory of this warehouse. He noted that these munitions with toxic substances were also used by militants in Syria’s Aleppo.”
This statement is telling in that the time given for the supposed attack on this chemical weapons warehouse (11:30 to 12:30 local time) is considerably later than the first reports of the attacks when images and videos surfaced online. This coupled with evidence of the Russian Ministry of Defense’s past lies and falsified evidence, as the DFRLab has previously reported, gives sufficient reason to doubt their version of the incident.
For more in-depth analysis from our regional experts follow the Atlantic Council’s Rafik Harir Center for the Middle East by subscribing to MENASource.
