the home of online investigations

Analysis of Syrian Red Crescent Aid Convoy Attack

September 21, 2016

By Nick Waters

Translations: Русский

This article was written collaboratively with Bellingcat contributor Hady Al-Khatib

At 1930 Syrian time on 19 September, a Syrian Arab Red Crescent convoy was attacked. Around 20 civilians were killed, including Omar Barakat, the Syrian Arab Red Crescent’s director in Urum al-Kubra. Eighteen trucks containing aid were destroyed. The Syrian Red Crescent called it a “flagrant violation of International Humanitarian Law.” The Russian Ministry of Defense (MoD) stated that it did not know the location of the convoy, claiming:

Around 13:40 Moscow time (10:40 GMT) the aid convoy successfully reached the destination. The Russian side did not monitor the convoy after this and its movements were only known by the militants who were in control of the areaWe have closely studied the video footage from where the incident took place and we did not find any signs of any ammunition having hit the convoy. There are no craters, while the vehicles have their chassis intact and they have not been severely damaged, which would have been the case from an airstrike. All of the video footage demonstrates that the convoy caught fire.

This investigation will use open source techniques to demonstrate that the Russian MoD and Syrian Government knew the location of the convoy. It will also show that it was not a fire that destroyed the convoy, but a sustained attack by air assets.

Context

Location

The location of this attack is at a warehouse along Highway 60, approximately 15 km west of Aleppo and 1 km to the east of Urem al-Kubrah (36°09′05.7″N 36°58′03.9″E):

fig1

Fig 1 – General Location, including Urem al-Kubrah on the left of the image

Fig 2 - Close up of warehouse complex - Highway 60 runs from bottom left to top right

Fig 2 – Close up of warehouse complex – Highway 60 runs from bottom left to top right

Fig 3. East side of Compound

Fig 3. East side of Compound. Source.

Fig 4. North side of compound

Fig 4. North side of compound. Source.

Time

The incident took place on the evening of the 19th September, as confirmed by multiple sources including the Syrian Red Crescent. In Video 1, we see a member of the White Helmets, a Syrian Civil Defence organisation, state the time and date of the attack as “19th September 2016… in the evening, 7:30 o’clock”. The White Helmets officially mark it as 1912 Syrian Time in the Youtube video description. Neither the Syrian nor Russian governments have disputed the timeframe for when the attack took place, thus the 7-7:30pm time for this attack seems most reasonable.

Who knew about the convoy?

According to the UN Deputy Spokesperson for the Office of Coordination of Humanitarian Affairs, Jens Laerke, the UN had received permission for delivering aid from the Syrian Government, and the Under-Secretary-General Emergency Relief Coordinator, Stephen O’Brien, states that the convoy’s location was “marked & coordinates known”.

2016-09-21_13-07-15

We also know that the convoy was tracked by a Russian drone earlier in the day, which was confirmed by Ministry of Defense spokesperson Igor Konashenkov. He stated:

Around 13:40 Moscow time (10:40 GMT) the aid convoy successfully reached the destination. The Russian side did not monitor the convoy after this and its movements were only known by the militants who were in control of the area

This statement makes it clear that the Russian MoD knew the location of the convoy and the warehouse. However, a comparison of pictures from the aftermath of the attack and the drone feed clearly show that the convoy did not move on: it was attacked at the location that the Russian MoD was monitoring. The drone feed ends before the darkness falls and the attack takes place. In the figure below, the blue arrows mark the aid trucks, and the remaining boxes and lines are the same reference markers as seen in Figure 2 (which appears again below), showing that the Russian drone was monitoring the same location that was later attacked.

fig6new

Fig 6 – Top left: Satellite imagery of location captured by Russian drone Top right: Shot from Russian drone of same location, with aid trucks present. Bottom: Shot from Russian drone of same location, with aid trucks highlighted with blue arrows. Other markings consistent with Fig 2 (see below). Source, at 1:00:09.

Fig 2 - Close up of warehouse complex - Highway 60 runs from bottom left to top right

Fig 2 – Close up of warehouse complex – Highway 60 runs from bottom left to top right

What happened during the attack?

The Russian MoD attempted to downplay the attack and link it to the rebels, with spokesman Igor Konashenkov claiming that it “strangely happened almost at exactly the same time as militants started a large-scale offensive on Aleppo” He goes on to say:

We have closely studied the video footage from where the incident took place and we did not find any signs of any ammunition having hit the convoy. There are no craters, while the vehicles have their chassis intact and they have not been severely damaged, which would have been the case from an airstrike… All of the video footage demonstrates that the convoy caught fire.”

The evidence shown in the multiple videos and photographs of the aftermath demonstrate that Konashenkov’s statement is simply not true:

Fig 7 - Crater seen in road immediately outside compound

Fig 7 – Crater seen in road immediately outside compound. Source

Fig 8 - Debris found in crater shown in Fig 7

Fig 8 – Debris found in crater shown in Fig 7. Source

Fig 8a - Conflict Intelligence Team Comparison of debris shown in Fig. 7 and unexploded barrel bomb from Hama province.

Fig 8a – Conflict Intelligence Team Comparison of debris shown in Fig. 7 and unexploded barrel bomb from Hama province. Source

Fig 9 - Heavy damage to building. Yellow circle shows destroyed wall

Fig 9 – Heavy damage to building. Yellow circle shows destroyed wall. Source

Fig 10 - View from same damaged building. Yellow circle shows destroyed wall

Fig 10 – View from same damaged building. Yellow circle shows destroyed wall. From the AFP (source)

Fig 11 - Example of fragmentation outside compound

Fig 11 – Example of fragmentation outside compound. Image from Aleppo Media Center.

Fig 11a: Note the road in Fig. 11 and here. This image was taken in the same location, except almost exactly 180 degrees in the other direction. It clearly shows a repaired crater in the road, the same crater as shown in Fig. 7.

Fig 11a: Note the road in Fig. 11 and here. This image was taken in the same location, except almost exactly 180 degrees in the other direction. It clearly shows a repaired crater in the road, the same crater as shown in Fig. 7. Image from Aleppo Media Center.

Fig 12 -Example of fragmentation on car inside compound

Fig 12 -Example of fragmentation on car inside compound. Source

Fig 13 - Example of crater with fragmentation visible in cardboard boxes to rear

Fig 13 – Example of crater with fragmentation visible in cardboard boxes to rear. Image from Aleppo Media Center.

Fig 13a - Conflict Intelligence Team comparison of debris found in crater shown in Fig 13 and an OFAB 250-270

Fig 13a – Conflict Intelligence Team comparison of debris found in crater shown in Fig 13 and an OFAB 250-270. Source

These pictures show a large amount of fragmentation for a fire, and Figures 9 & 10 show a level of destruction that is much more consistent with a powerful explosion. Although something like a gas cylinder could cause some blast and fragmentation, the level of damage show here, and in a multitude of other photos and videos, indicates something much more powerful.

Video and audio analysis

A White Helmet at the scene of the attacks makes two different claims. In the Video 1 he claims: “The regime helicopter targeted this place with four barrels”. In Video 2 the same man claims: “Regime helicopters targeted… with eight barrel bombs” and then states that the “regime targeted this place with cluster bombs two times… with C-5 [presumably referring to S-5 air-to-ground missiles] and with bullets”. Although he may be  referring to information he has just received, there is no immediate evidence that the latter claim is correct. However, the claims of barrel bombs and helicopters is consistent, especially examining the crater and debris in Figures 7 & 8. Furthermore, the object–likely a bomb’s tail fin– identified in Fig 13a appears to be from an OFAB 250-270, a piece of ordnance delivered from the air by jets.

There is also a video which claims to show the strike itself, posted by “Shattering News” and bearing the watermark of Aleppo24, a pro-rebel news outlet. It is titled “Russian and Regime Airstrike destroys UN aid trucks sending supplies into “Aurem”-near Aleppo”. Although the provenance of the source is difficult to confirm, the contents of the video are consistent with the description of the strike given by the White Helmet. We can understand incident better with the included audio and visual evidence.

Audio evidence [See Appendix A below for complete transcript.]

  • The cameraman states that Regime forces have “targeted UN aid trucks in Aurem, on 19th of September 2016”, referring to Urem Al-Kubra, close to the location of the incident.
  • Those involved in the chaotic scenes in the middle of the video, apparently treating or evacuating casualties, are clearly terrified at the prospect of an airstrike and keep mentioning it as a possibility. Indeed, towards the end of this section, someone calls for everybody to evacuate as “there is an airstrike coming”.
  • The sound of jet engines is clear at both the very beginning of the video and at 02:45. In both incidents large explosions follow immediately after.

Visual evidence

  • Location: The video, taken from some distance away, appears to show a distinctive warehouse, with a roof including a step, as well as gaps at the base, allowing the light from the explosions to shine through (see Fig. 14). In Fig. 15 this warehouse is identifiable to the north of the area where the trucks are parked.
Fig. 14: The location of the aid convoy is within purple box. The large warehouse is shown to the right, its distinctive roof marked in green and the gaps in the structure marked by the red box.

Fig. 14: The location of the aid convoy is within purple box. The large warehouse is shown to the right, its distinctive roof marked in green and the gaps in the structure marked by the red box.

Fig. 15: Birds-eye view of the location of the incident. It uses the same markings as Fig. 14

Fig. 15: Birds-eye view of the location of the incident. It uses the same markings as Fig. 14

The weapons used lead to big explosions that can clearly be heard and seen. In Figure 14, the scale of the attack is made clear by a flash from an explosion happening to the right, just off-screen to the north of the compound. In Figure 16, you can compare the scale of the first explosion to the warehouse on the right hand side, which is also seen in Figure 15. The video shows 3 explosions in total, as well as destruction that happened before the video started-indicating a sustained attack.

Fig 16 -Clear example of large explosion. Note the large warehouse to the right.

Fig 16 -Clear example of large explosion. Note the large warehouse to the right.

Other claims

Free Syrian Army (FSA)

The Free Syrian Army (FSA) rebel group released a joint statement condemning the attack and strongly denying any involvement by their forces. Although the time given by them for the attack is not consistent with other accounts by approximately two hours, their description of the events is consistent with the evidence shown previously:

Russian Surveillance drones circled heavily overheadwarplanes carried out over 18 airstrikes that were closely followed by barrel bombing from military helicopters. The warplanes then circled back and targeted the group with heavy artillery”.

The statement notes that the rebels do not posses an air force, and that rather than attack this convoy, they facilitated their entrance into the western Aleppo suburbs.

Anonymous U.S. Officials

Further to the evidence presented above, anonymous US officials told Reuters that “two Russian Sukhoi SU-24 warplanes were in the skies above the aid convoy at the exact time it was struck late on Monday”. Due to the nature of this claim it is impossible to verify using open source investigation, but it does not contradict information uncovered during this investigation.

Additional Russian statement

Though the Russian Ministry of Defense earlier refuted claims that the attack on the convoy was an airstrike, it changed its tune on Wednesday, suggesting that a U.S. Predator drone was responsible for the attack. This claim is not consistent with the photographs and videos at the scene of the bombing and in its aftermath, including the roar of jets, the remains of barrel bombs, witness accounts, and an OFAB tail fin.

Conclusion

This investigation has explored the questions of who was aware of the SARC aid convoy, where it was attacked, the type of damage at the site, and the competing claims regarding the attack:

  • UN and SARC claim the Russian MoD and Syrian Regime were made aware of the aid convoy.
  • The Russian MoD knew the precise location of the aid convoy after tracking it using a drone.
  • The damage at the site of the attack is consistent with an airstrike and barrel bomb attack.
  • Witness testimonies from the site of the attack indicate that an airstrike and barrel bomb attack took place.

Therefore, both the Russian MoD and Syrian Regime were aware of the exact location of this convoy, both from reporting from the organisation and their own ISTAR assets.

Additionally, the Russian MoD claims are easily dismissible with even a cursory look at the available open source evidence. Specifically, Spokesperson Konashenkov said on Tuesday:

“We did not find any signs of any ammunition having hit the convoy. There are no craters, while the vehicles have their chassis intact and they have not been severely damaged, which would have been the case from an airstrike… All of the video footage demonstrates that the convoy caught fire

An examination of the open source evidence shows that these claims are demonstrably false. The aftermath pictures, as well as the footage of the attack, clearly indicate large, explosive weapons were used. There are at least two craters (Fig 7, 8 & 11a and Fig 13), a multitude of fragmentation, and serious damage to at least one building.  

In examining the witness accounts from the White Helmets, along with the evidence in the footage of the attack itself, there are strong indications it was an air attack. Even if one does not trust the immediate witness testimonies of the White Helmets–as witness testimonies are notoriously unreliable after a traumatic event-the additional photographs and video footage of the attack and its traces leave no doubt that the attack on the convoy came from the air, probably from both jets and helicopters. Jet engines are clearly audible, and the size of the explosions suggest an air bombardment. Images from the Conflict Intelligence Team show what appears to be the base of a barrel bomb, and the tail ring of an OFAB 250-270. The rescuers are clearly terrified of an air attack, and the White Helmet testimony backs this up, although possibly exaggerating the attack–not a difficult mistake to make in the midst of such chaos.

In short, the most likely perpetrators of this attack are those who knew of the location of the convoy and have the means and motivation to carry out an air strike and helicopter barrel bomb attack. Considering the presence of a tailfin of a Russian-made bomb, the presence of a Russian drone monitoring the location, and the barrel bomb attack, it is almost certain that Syria–and possibly Russia–carried out the attack. There are no indications in the open source evidence that corroborate Russian claims that the damage took place from a “fire” on the ground (not initiated by an airstrike) or that a U.S. Predator drone could have been responsible.

This incident was a deliberate, sustained attack on aid workers using information provided for their protection.

Appendix A

Transcript of video entitled “Russian and Regime Airstrike destroys UN aid trucks sending supplies into ‘Aurem’ near Aleppo”

Person 1:   Allahu Akbar ,”God is great” ( Repetitively said)

Person 1: Regime forces have committed a massacre in the city of “Aurem” in Syria by hitting aid trucks.

Person 1: Regime forces have targeted UN aid trucks in “Aurem”… 19th of September 2016 …… Allahu Akbar ,”God is great”….

Person 1: 10 airstrikes on the city of “Aurem”…… Allahu Akbar ,”God is great”…….

“sound of ambulance sirens”

Person 2: Is the airstrike within our airspace? Is the airstrike within our airspace?!

Person 2: Allahu Akbar (God is great); they have destroyed the warehouses…

Person 1: Tell them we are an ambulance, tell them we are an ambulance… wait a minute, wait a minute….. Allahu Akbar …. Tell him they have destroyed the aid trucks, they have hit the aid trucks.

Person 2: They have hit the aid trucks…. They have hit the aid trucks, Allahu Akbar… the aid is on the ground [meaning ruined]…

“Noise in the background”

Person 1: Does anyone need help?

Person 2: Does anyone need aid?

Person from the back: Yes, someone needs medical help.

Person 1: Where?

Person from the back: Here here….

Person 1: Come here, they need medical help , come come…open, open  open!… put him here, put him here.

People together: Okay lift it off, lift it off…

Person 1: Take it back, take it back… pull it back, pull it! Pull it to the side… no pull it to the back.

Person from behind: There are still people injured back inside.

People: Now it’s okay (referring to the position of the injured person)

Person from the back: Airplane!!

Another person: Come on guys the airplane is above us…

Person 1: The airplane is above us! Hurry, hurry up guys. Evaculate the area there is another airstrike coming.

Person 4: Hurry up guys hurry up… should I drive, should I?

Person 1: No no, I am going to….push him, push him inside.

Person from behind: There are still people injured back inside.

Person 4: Come with us…. No, no, go with him, Abu Steif [suggesting a nickname given to a person called Mustafa] come with us…let’s go…

Another person: No, no, stay stay….

Person 1: There is not enough space to drive.

Person 1: Allahu Akbar, guys! Allahu Akbar… they have destroyed the aid trucks….

Person 2 again: shouting Evacuate there is an airstrike coming, airplane is coming, evacuate, an airplane is coming….run away, there is an airplane.

Person talking to the person on the radio transceiver

Person 5: Inform us, inform us …

Person 6: They are going to execute the airstrike, they are executing it…..

Person 1: Allahu Akbar …. Allahu akbar …. Allahu akbar….the Russian airplanes has executed an airstrike on the UN’s aid trucks in “Aurem”……

Nick Waters

Nick is an ex-British Army officer and open source analyst. He has a special interest in the conflicts in Syria, as well as social media, civil society, intelligence and security. Contact via Twitter: @N_Waters89

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

Support Bellingcat

You can support the work of Bellingcat by donating through the below link:

97 Comments

  1. Arya Stark

    Where is the US evidence? They’ve had time to produce it by now.

    Dare we say it doesn’t exist.

    Reply
    • stranger

      That is the point that US didn’t officially blamed Russia. They said like ‘who could it be other than Assad and Russia’ and then ‘Russia is anyway responsible for everything Asad is doing’. It is only Bellingcat, and Ukrainian CIT they refer who knows all the answers. That’s why they should urgently call Kerry and tell him about these sensational evidences nobody else knows.

      Reply
      • John Zenwirt

        “…should urgently call Kerry” Kerry is a nutjob who will see nothing come of his naivete and foolishness; if he’s sure he can personally stop ALL wars right now…

        Reply
        • stranger

          US supported the overthrow in Lybia, helped it by own cruise missile bombings. Is it better now in Lybia than it was before? Is it the way to go for Syria as well?
          After the invasion to Iraq, that ISIS rose, with whom everybody makes impression to fight, but actually nobody does.
          After that all you are trying to paint Russia as a scarecrow, due to pure political reasons. Just waging the informational war, nothing else. No any research, just stupid propaganda.

          Reply
    • Horst

      The 2 “Su-24” the US claims overflew the convoy at the time of attack would be on NATO radar given the proximity to sea and Turkey.

      Where is the proof, US?

      Were the US officials lying to Reuters?

      Reply
  2. Chto Gde Kogda

    Chto Gde Kogda team captain here. Come on, team, I need more versions. We only have a minute. The convoy caught on fire? Nobody will buy that. Al-Nusra attacked it with rockets? It wasn’t an airstrike? It was? A US drone? That’s good. More versions, more versions. Our drone saw a truck towing a mortar next to the convoy? Ok, ok, we could say we were bombing the mortar, or it was a terrorist convoy. Let’s go with the U.S. drone version for now. If that doesn’t stick, we’ll blame Ukraine.

    Reply
    • Rodrigo

      Great!! That´s exactly how they (Russia and Syrian regime) try to make confussion out of everything. They give plenty of different and contradictory versions, based on nothing.

      Reply
  3. Ghostship

    Where are the bodies? Every incident I’ve seen on White Helmet videos, the first thing they do ir run around filming all the bodies. For this event, nothing, not even videos of the wounded being load into ambulances or the wounded in hospital. Could that be because no one was wounded or killed. As for Omar Barakat, the head of SARC in Urem al-Kubra, not Aleppo, the only photographs I can find of him are very recent. So, is there any real evidence that anybody died except for the entrails “found” by the SUV shown above that could have come from a sheep?
    I think the problem with Bellingcat’s analyses is they decide what their conclusion is and then look for the evidence to support it. Instead they might be more respected if they looked at all the evidence before coming to a conclusion.

    Reply
  4. Ghostship

    “Pentagon denies Russia’s accusation of US-led coalition #drone flying over area where @UN convoy’s attacked”
    You do realise that the US military is often very literal in their responses so in this case, you have to establish what the Pentagon means by the US-led coalition. It would be difficult to argue that the US military operating in Syria, Iraq and neighbouring countries supporting them is not included in the US-led coalition but what about the CIA or private military contractors? Equally, it could be part of the US military that is not allocated to the US-led coalition. So, there could have been US military drones flying over Syria that were nothing to do with the US-led coalition.

    Reply
  5. Alex

    Fig 11a Could you please point out where the clearly shown repaired crater is in the road ? I find it amazing they could do such a good job because I don’t see it also their fantastic dedication to the infrastructure that they repaired the road with a fire still burning in the trailer rather than extinguish the flames to try and rescue any remnants of the cargo.

    Reply
  6. Hans

    So they were repairing that bomb crater (eliminating precious evidence) while they didn’t even put out these fires? Come on.

    For me this sounds like believing in a solution of a puzzle and looking for evidence supporting that alleged solution. Pretty weak 😉

    Reply
  7. liam

    Why did the Bellingcat ‘investigation’ neglect to include the mortar towed behind a jeep as shown by the Russian drone video? Is it possible this aid convoy was a ruse to distract from the US bombing of the Syrian army that led to the terrorists capturing a hill top then this staged event was used to cover up and blame Russia with the terrorists using that towed mortar. Those trucks are too attached to their chassis to have been airstrikes, by the way. Big bombs remove chassis. Link to Russia video of the towed mortar with the convoy. https://www.youtube.com/watch?v=ZUMJ2vm4vgU

    Reply
  8. Mads

    I see the infamous Putinbots have been quick to descend on this evidence in droves.

    Since, everyone knows they act on orders and promote talking points coming from the FSB and delivered to them, this actually becomes counterproductive to their cause: To raise doubts about who perpetrated this war crime. The fact that so many Putinbots are all over this indicates quite clearly the eagerness of the Kremlin and their propaganda arm within the FSB that Russia is in fact to blame for this unforgivable atrocity. It’s so bleeding’ obvious.

    Come on, have a think, guys. This is beyond transparent.

    Reply
    • stranger

      Unfortunately the propaganda comes not only from Kremlin. When it becomes too annoying, people start to object. Why don’t you think it is a normal people’s reaction? You necesserily need to figure out a paid troll in everybody who disagree with your narrow point of view. Exactly – think by your own brains and don’t lose the critical thinking.

      Reply

Leave a Reply

  • (will not be published)