BANNER: Geolocation analysis of the alleged crater site by Bellingcat

On Tuesday, April 4, 2017 evidence started to emerge online of an alleged chemical weapons attack on the city of Khan Sheikhoun in the south of Syria’s Idlib Governorate. Online open source investigative platform Bellingcat analyzed the images and videos coming out of Syria to verify the credibility of the evidence for the attack.

Dozens of videos emerged from responders on the ground presenting consistent accounts of airstrikes that allegedly included the nerve agent Sarin. The videos show symptoms of victims that are compatible with the nerve agent, including pinpoint pupils, foaming at the mouth, and convulsions. While such symptoms are not exclusive to Sarin, usage of Sarin in past attacks in Syria resulting in similar symptoms led many responders to believe that it was again used in this latest strike. Initial reports estimated over fifty casualties and two to three hundred injured.

In the aftermath of the attack, a second airstrike caught on film reportedly damaged a civil defense center being utilized as a hospital to treat victims of the initial strike.

The very first evidence of the attack surfaced the morning of April 4 with a video allegedly showing the airstrike that was posted at 7:59am local time.

The first time chemical weapons were mentioned was in a tweet at 8:21am local time by Haq News Agency which linked to the earlier video describing it as “the moment of targeting Khan Sheikhun with chemical rocket 04/04/2017 by Russian airforce.”

At 9:22am local time the first video showing victims of the attacks was published by Edlib Media Center. Soon after numerous other videos and statements were released depicting victims of the attacks, including a tweet from Dr. Shajul Islam, stating that his hospital was full from the aftermath of the attack.

Later accounts were all consistent with this timeline, with residents claiming the attack took place around 6:30am local time. One such instance is a responder who reported that at 7:00am local time he was woken by “the alarm voice of the observatories offices that was saying all ambulances should go to Khan Sheikhoun.”

Additional evidence supporting this timeline comes from the tracking of the aircraft allegedly involved in the attack. Multiple sources report that a Sukhoi Su-22, a Soviet variable-sweep wing fighter-bomber, conducted the attack. At 6:26am local time aircraft spotters working with Syria Sentry reported that a Su-22 called Quds 1, the fleet’s squadron commander, had departed its airbase in Homs. This same plane has been linked to other alleged chemical attacks in Syria. Shortly thereafter another plane called Quds 6 left the same base the spotters reported.

Supporting this timeline is an image released by the Pentagon allegedly showing the radar blips of the aircraft that carried out the attack. The information puts the plane above Khan Sheikhoun between 6:37 am and 6:46 am local time.

Lastly, multiple eyewitness accounts confirm the timeline of the aircraft and its involvement in the attack. The first mention of the Su-22 was in a tweet by @ShamiRebel at 9:22am. Other videos show witnesses saying a Su-22 fired 4 missiles in the attack.

Later in the day Orient News, an opposition outlet, published an article linking the alleged pilot, Muhammad Yousef Hasouri, commander of the Sukhoi 22 Squadron at al-Sha’yrat airport, to the attack. Additionally, Gen. Ali Ayoub, Syria’s Army Chief of Staff, visited the Shayrat air base a few days after the attack and was recorded honoring Hasouri alongside members of the Syrian parliament.

Analysis of the emerging videos and images allowed Bellingcat to verify the crater at an alleged impact site of the attack. Evidence of the crater includes photos by the Warsheh group published on their Facebook page.

As well as photos published by Reuters and other news agencies.

Using these photos and a video posted by the Hadi Al Abdallah YouTube channel, Bellingcat was able to use geolocation to authenticate the impact site:

The above crater was successfully geolocated to a site within Khan Sheikhoun, however, the impact site does not correspond with the existing footage claiming to show the initial moment of the attack, as the crater site is in a location not visible in the initial video. Thus additional impact points would have to be uncovered for the existing footage to be verified:

An additional impact site was geolocated based off a video posted by the Syrian Journalism Center:

Images being shared online reportedly depicting the remains of the munition have not been able to be identified.

Victims were taken to hospitals and clinics to receive treatment in the aftermath of the attack. Through videos posted online, Bellingcat was able to confirm at least four separate locations that were utilized in the treatment of patients. Evidence for each of these locations was organized into individual playlists Hospital A, Hospital B, Hospital C, and Hospital D.

Hospital B, located in Khan Sheikhoun, is of particular note as it was bombed on the same day as the chemical attack as victims were being treated. The moment of the bombing of the civil defense center was recorded by activists on the ground:

An AFP journalist present during the attack verified the damage it caused through the comparison of photographs from earlier that morning with those taken after the strike:

In the below before and after images, we see the damage incurred by the opposite side of the above building (note the distinctive graffiti and entryway).

In the face of international condemnation, both the Syrian and Russian governments have disputed that the attack was chemical in nature. The Russian Ministry of Defense claimed that the symptoms seen in victims were a result of a strike on a rebel-controlled chemical weapons warehouse in the city:

This statement is telling in that the time given for the supposed attack on this chemical weapons warehouse (11:30 to 12:30 local time) is considerably later than the first reports of the attacks when images and videos surfaced online. This coupled with evidence of the Russian Ministry of Defense’s past lies and falsified evidence, as the DFRLab has previously reported, gives sufficient reason to doubt their version of the incident.