December 16, 2019

Visual forensics corroborate reports of Iran’s lethal crackdown on protests

by DFRLab

Open-source evidence documented Iranian government’s use of military-grade weapons and communications blockade

December 16, 2019

Visual forensics corroborate reports of Iran’s lethal crackdown on protests

by DFRLab

Share this story
THE FOCUS
Government
Visual forensics corroborate reports of Iran’s lethal crackdown on protests

Open-source evidence documented Iranian government’s use of military-grade weapons and communications blockade

(Source: @KaranKanishk/DFRLab via Wikimedia/Fars News)

Open-source evidence documenting the ongoing protests in Iran has exposed the government’s particularly brutal, and at times lethal, crackdown on demonstrators.

In November, an increase in fuel prices in Iran sparked a series of demonstrations across the country. The protests grew out of anger at the gross economic disparity as well as corruption in — and lack of accountability for — the government. The government responded to the unrest with a brutal crackdown, resulting in the deadliest political unrest to sweep the country since the Islamic Revolution.

The DFRLab examined several videos taken on the ground and found that the Iranian security forces fired military-grade weapons at civilians, worked in tandem with paramilitary groups to identify, target, and arrest protesters, and throttled secure messaging traffic in an effort to impede mobilization efforts. Besides suppressing secure messaging apps, the Iranian government also shut down access to the Internet for approximately six days.

Map of Iran highlighting locations involved in this analysis. (Source: @KaranKanishk/DFRLab)

Use of automatic weapons

On November 26, a video surfaced online showing Iranian police officers using military-grade weapons shooting at protesters in the city of Shahriar.

The officer in the video appeared to have been prepared to fire with his hand on the trigger and ended up firing accidentally while he was running away from the protesters.

Police fired shots at one of the protesters. (Source: @BabakTaghvaee/archive)

The DFRLab used sound forensic techniques — in this case, slowing down the audio to isolate the timeframe in which the shots were fired — to determine the type of weapon used in the incident. The first bullet sound occurred at 17.070 seconds in the video, while the second bullet sound occurred at the 17.170-second mark. The 0.10-second difference between shots fired confirmed that the weapon used was likely an AK-47. The cyclic rate of fire of an AK-47 is around 10 rounds a cycle but can vary depending on the length of time the shooter keeps his hand on the trigger.

Time-snapshot of the gunfire. (Source: @KaranKanishk/DFRLab)

In November, Rouhani’s chief of staff, Mahmoud Vaezi, confirmed that a massacre took place in Mahshahr, saying it was a “strange turn of events,” as a group of individuals were shot down. Radio Farda reported that the Iranian forces had deployed tanks and used automatic weapons.

Located in the oil-producing Khuzestan province, Mahshahr is dotted with petrochemical plants and other oil-related facilities. Amir Hossein Ghazi Zadeh Hashemi, a member of parliament, stated that “Don’t they know what would happen if they decide to attack the main energy lines?,” implying that the protesters were shot because they tried to impair a key energy source.

Firing at civilians from the rooftops

Amnesty International reported that snipers shot at protesters from rooftops and helicopters on multiple occasions during the protests. On November 18, a video surfaced on Twitter showing one such case, in which several men opened fire on the street from the top of a courthouse building in Javanrud, a city in Kermanshah province.

The surfaced video was only 18 seconds long and did not provide many geolocation details. Three men could be clearly identified on the rooftop aiming their weapons down at the street. The men fired four gunshots throughout the course of the video but it was unclear whether they managed to hit anyone.

The tweet mentioned, in Persian, that the men were firing from the roof of the “Javanrud Justice building.” Google search helped to verify that a building in the video was indeed seen from the roof of Javanrud’s city courthouse.

Geolocation confirmed that the video was shot from the rooftop of Javanrud’s courthouse (green box), which sits next to a tree and a bus stop (blue box). (Source: @ShahedAlavi/archive, top; Google Maps, bottom)

The building’s architectural details, including the placement of the entrance to the rooftop, also matched those of the city courthouse. The men in question were highly likely to be working for the Iranian regime, as they had unrestricted access to a government building.

Comparison of the building seen in the video with the satellite imagery. Pink, yellow, and blue lines mark the matching corners of the building, while orange lines show the entrance on the rooftop. (Source: @ShahedAlavi/archive, left; Google Maps, right)

A day earlier, on November 17, a similar video surfaced online. The individual who posted the video claimed to have captured militia members shooting at protesters in the city of Karaj. Similar gunshots can be heard in this video, and protesters are shown with cartridge cases that they claim were dropped by the militia.

https://twitter.com/gussipp/status/1196193559273201665

The cartridge cases seen in the video resembled those of automatic or semi-automatic weapons, with one of the cases looking highly similar to an AK-47 7.62mm round. Since the militias were shooting from the roof, it is unclear how the protesters collected the cartridges.

In one of the videos, the DFRLab found what looks like an Iranian military officer standing on a rooftop with a military-grade weapon.

The long length of the weapon indicated it was shoulder-assisted, and therefore. (Source: @Eiman0072/Archive)

The weapon used in the video could be an AK-47 or Nakhjir 3 (without scope), a sniper weapon common in the region. The weapon’s length suggested it was a shoulder-assisted weapon.

Besieged by the Basij

In some of the videos, members of the Basij Resistance Force, a paramilitary volunteer militia, assisted the Iranian police and military in arresting protesters.

https://twitter.com/gussipp/status/1198701824179609600

Basij volunteer beating a protester with a stick while police shoot at the protester. (Source: @gussipp/archive)

The Basij are one of the five forces that comprise the Iranian Revolutionary Guard Corps (IRGC) — alongside the army, navy, air force, and the Quds Force (IRGC-QF) — and are tasked with, among other duties, upholding domestic security.

Marking the protesters

In one of the videos, Basij members are seen shooting protesters with paintball guns as a means of marking the protesters.

Basij member carrying a paintball gun to mark the protesters. (Source: YouTube)

According to previous reports, the Basij used paintball guns to mark protesters as a means of identifying them for police. Videos also surfaced on Twitter that showed a DES 516 B, a type of anti-riot truck with a 26-gallon paint drum, being deployed against the protesters.

A suspected DES 516B anti-riot truck. (Source: iranintltv)

Designaling Signal

As coverage of the protests began to emerge on social media platforms, the Iranian government started throttling encrypted traffic on popular secure messaging apps.

The DFRLab spoke with Amir Rashidi, an Iranian internet security researcher. Rashidi observed that the Iranian government was blocking encrypted messaging app Signal. He also observed that the Google Play Store and Apple App Store were blocked in the country, “mainly to block protesters from downloading apps and to promote their homegrown alternatives to Telegram and other communication apps.” Some Iranian Reddit users also reported that Signal was not working in the country.

During the internet shutdown, Iran’s Supreme Leader, Ayatollah Ali Khamenei, tweeted from his own account, demonstrating that the blackout was administered selectively.

According to Google’s Transparency Report, which includes information on traffic and disruptions to Google, there was a clear disruption in web search traffic from November 16 to November 23 in Iran.

Google’s product traffic data show a period of disruption from November 16–23. (Source: Google)

The internet shutdown during the protests both restricted communication between everyday Iranians and quashed the efforts of protesters to disseminate protest-related news and updates on social media platforms.

Conclusion

The open-source material documenting the current protests on social media shed light on the tactics employed by the Iranian military, allied paramilitary organizations, and law enforcement to suppress the demonstrations. The DFRLab managed to corroborate some of the reports from human rights organizations and citizen journalists documenting the regime’s brutal response to the unrest.

According to Amnesty International, the confirmed death toll from the government crackdown has risen to 208, and “the real figure is likely to be higher.”

As the protests continue throughout Iran, the DFRLab will continue to monitor open-source material. If you have any videos and images from the protests requiring verification and further investigation, you can send it to us via Twitter (@DFRLab) or via email (dfrlab@atlanticcouncil.org).

Follow along for more in-depth analysis from our #DigitalSherlocks.