the home of online investigations

The Khan Sheikhoun Chemical Attack — Who Bombed What and When?

April 10, 2017

By Christiaan Triebert

Translations: Русский

Last week, we published a survey of open source evidence concerning the alleged chemical attack at Khan Sheikhoun in Syria’s Idlib province. This article builds upon the information presented in that article by comparing the claims made by a variety of actors and sources, including the Pentagon, the Syrian Foreign Ministry, and aircraft spotters on the ground. All times mentioned in this article are in the Coordinated Universal Time (UTC) with Syrian local time (+3 UTC) also included for context. Readers are welcome to suggest information we may have missed in the article, though we only focus on the who, what, and when of the incident, and not on the alleged chemical used in the attack.

The Timing of the Attack

Syrian government

The first air raid conducted by the Syrian army was at 8:30 am (11:30 am local time) on April 4, 2017, according to Walid Muallem, Syria’s Foreign Minister. He made the statement during a press conference in Damascus two days after the attack. The army, he said, “attacked an arms depot belonging to al-Nusra Front chemical weapons.”.

Eyewitness accounts

Locals claim the attack took place around 3:30 am (6:30 am local time) in all available statements. Translations of such accounts can be found in our previously published article on the attack. The earliest reference we have discovered to it being a chemical attack is a tweet at 5:21 am (8:21 am local time), referring to a video published at 4:59 am (7:59 local time).

The Aircraft

There are three sources saying that a Sukhoi 22 (Su-22), a Soviet variable-sweep wing fighter-bomber, conducted the attack: witnesses on the ground, an organisation of aircraft spotters, and the Pentagon.

Aircraft spotters

At 3:26 am (6:26 am local time), ground observers working with an organisation of spotters reported that a Su-22 called Quds 1 — the Su-22 fleet’s squadron commander — took off from its airbase in Homs. The spotters say it is significant if the commander conducts the sortie, as they associate the pilot and his aircraft with other alleged chemical attacks in Syria. Not much later, they report that another aircraft, Quds 6, has also taken off from the base.

The spotter organisation, Syria Sentry, is an outlet employing a well-developed network of spotters taking note of take-offs and initials flight directions of aircraft departing from military air fields primarily located in northwestern and central Syria. Their goal is to issue timely warnings to civilians in opposition-controlled territories. The organisation says they have strong evidence that Russian-operated fixed wing aircraft conducted follow-up attacks in the same area around seven hours later.

The Pentagon

On April 7, as the US conducted a cruise missile strike against the Shayrat Syrian Arab Air Force airfield. It also released an image allegedly showing the flight path of radar blips of the aircraft that carried out the alleged chemical attack in Khan Sheikhoun. The time given in Khan Sheikhoun is 337 Zulu Time to 346 Zulu Time, which converts to UTC directly, thus fitting with the eyewitness and Syria Sentry claims: between 3:37 and 3:46 am (6:37 am and 6:46 am local time respectively), the aircraft was above the town.

The Pentagon map can be used an overlay in Google Earth to gain a better understanding where the radar blips are located with regards to Khan Sheikhoun. However, it is important to mention that it is difficult to connect two-dimensional dots to a three dimensional flight path. Besides, the data appears to be incomplete making a proper analysis of the map probably not accurate. 

Eyewitness accounts

In available videos, alleged eyewitnesses claimed that a Su-22 fired four missiles. The first tweets referring to a Su-22 were tweeted at 6:21 am (9:21 am local time) by @ShamiRebel. He links to a screenshot of the Facebook page “The Lens of Khan Sheikhoun and its Countryside”. That Facebook post was published at exactly 6:00 am (9:00 am local time).

Later that day, opposition media outlet Orient News claimed in an article that “a number of field, independent and even Syrian Civil Defense observatories in the countryside of Idlib and Hama” stated that “colonel pilot, Muhammad Yousef Hasouri […] the commander of the Sukhoi 22 Squadron at al-Sha’yrat airport” is responsible for the Khan Sheikhoun attack.

Orient News further writes that Col. Hasouri’s Su-22 carries the Quds 1 banner, and says he hails from Talkalakh town, but currently resides with his family in the “Al-Sakan Al-Shababy” neighbourhood in Homs city.

Two days after the attack, a rumour started spreading that Col. Hasouri was killed “by a bomb blast under his car”, as Asaad Hanna, political officer at the Free Syrian Army (FSA), tweeted. None of these claims can be confirmed, but Hasouri’s name has been associated with Shayrat airfield by both pro- and anti-Assad supporters on Twitter since 2013.

Gen. Ali  Ayoub, Syria’s Army Chief of Staff, visited the Shayrat air base days after the  attack, thereby honouring Hasouri as seen in a video report of the visit. On Facebook, Hasouri is referred to as “the hero who struck the depot” dozens of times. A screenshot of the video linked above is included. Some refer to Hasouri as a Brigadier General, and two members of the Syrian parliament appear to be among those praising Hasouri.

Firstly, there is Fares Shihabi who tweeted that Hasouri was honoured “for destroying Qaeda’s weapons facilities in Khan Sheikhoun, Edlib”. The tweet was linked via his Facebook profile, but has since been deleted. As it was not archived via archive.is or web.archive.org, it is difficult to confirm authenticity of the tweet.


Secondly, Syrian member of parliament Shareef Shehadeh also posted the same still from the video, in which Hasouri is being honoured by Gen. Atoub. It is not clear whether Mr. Shehadeh’s Facebook profile is authentic.

The Times ran a story on Hasouri today.

The Target: A Chemical Weapons Factory?

The Syrian and Russian governments

Neither Syria nor Russia denies that government forces bombed Khan Sheikhoun on April 4. Instead, the debate is over what kind of weapon they used and what the target was.

Russia and Syria insist no chemical weapons were used in the attack. Instead, some of their officials claim that a chemical weapon factory belonging to Tahrir al-Sham was hit, which caused the chemicals – the type of which have still not been publicly identified – to spread. Syria’s Foreign Minister Muallem claimed during a press conference in Damascus:

“The first air raid  conducted by the Syrian army was at 11:30 am [8:30 am UTC] on that day [Tuesday April 4, 2017] and it attacked an arms depot belonging to Al-Nusra Front [Al-Qaeda’s former Syria affiliate, now operating under the banner of Hayat Tahrir Al-Sham] chemical weapons. (…) I stress to you once again: the Syrian army has not, did not, and will not use this kind of weapons – not just against our own people, but even against the terrorists that are targeting our civilians indiscriminately.”

Sources on the ground

With regards to the target area, it is worth noting that a group of silos and a large warehouse are dozens of meters away from where locals said the chemical attack took place.

Post-attack drone footage from Hadi Al-Abdallah gives a good overview of that area. It is worth noting that the damage shown at the silos, the warehouse and other buildings in the area already existed before the April 4 attack, as shown by TerraServer imagery from February 2017.

Discrepancy with regards to time

Between the different accounts of what happened, there is a clear discrepancy with regards to time.

Eyewitness accounts claim the attack took place around 3:30 am (6:30 am local time), with the first reference to it being a chemical attack at 5:21 am (8:21 am local time). This time period is in line with the data of Syria Sentry and the Pentagon.

However, Syrian Foreign Minister Muallem claims the first airstrike – on an “ammunition depot” – was carried out at 8:30 am (11:30 am local time). This is in line with an earlier Russian Defence Ministry statement claiming the attack occurred “from 11.30 to 12.30 local time”, but neither Syria nor Russia have presented any evidence to support their claims, nor is their any available open source evidence to support their claims. 

All available evidence, including witness accounts from the scene and airfields, strongly suggests the chemical attack occurred hours before the attack claimed by Russia and Syria. It is difficult to reconcile the Russian and Syrian claims with the open source evidence available, including a three-hour time gap between the narratives, the previous damage to the silos and warehouse near the attacked site, and the available images showing location of the airstrike.

 


Thanks to @THE_47th for noting the link to the social media posts related to Mr. Hasouri, to @obretix with regards to the challenges regarding the Pentagon flight path, and Bellingcat’s Timmi Allen for the Google Earth overlay of that same flight path.

Christiaan Triebert

Christiaan Triebert is a senior investigator and lead trainer with Bellingcat. He graduated with an MA in Conflict, Security & Development from King's College London in 2015, and holds two BAs from the University of Groningen, one in International Relations and the other in Political Philosophy. Along his digital research work, Christiaan has worked in several conflict areas including Iraq and Syria. If you have any questions, or have a story idea, you can contact him at christiaantriebert@bellingcat.com or via Twitter (@trbrtc).

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

Support Bellingcat

You can support the work of Bellingcat by donating through the below link:

176 Comments

  1. Bubslug

    Anybody besides me notice the aircraft path doesn’t cross over the impact crater? It wouldn’t necessary have to but it would have to get closer and on the right vector than it ever appears to have.

    It appears to pass over the south central part of Khan Sheikhoun, east to west or west to east. The crater is near the north end of the city. Also the crater debris is mostly south or southwest of the crater, meaning the munitions path was from the northeast. The aircraft was to the northeast of Khan Sheikhoun but probably at least 5 km away and traversing on a northwest or southeast vector.

    Reply
    • Christiaan Triebert

      Hi Bubslug,

      Thank you for your comment. Yes, I agree with you; we noticed. It is indeed interesting, but be aware that the 3D flight path visualisation of the Pentagon consists of what I think are radar blips (and thus does not show the full trajectory), and is now projected on Google Earth, so there may be some distortion. For that reason I included a line that the reading the graph may be problematic.

      Kind regards,

      Reply
  2. Richard P

    B’cat said, “The earliest reference we have discovered ” was an [Apr 4] 8:21 local tweet referencing a video published at 7:59 a.m.

    But, it would seem, the actual “earliest reference” is the “spotter” who (at 6:26am) presupposes that the [SU-22] warplane, he identifies as it takes-off, is the pilot and aircraft implicated in a recent, earlier (March 30) incident. Based on that evidence, and quiet evening weather, the spotter determines then expressly warns, “Quds 1, guys he has chemicals, he has chemicals.” [I suspect the spotter was exclaiming more than just making a statement.]

    Maybe it’s semantics, but it seams significant [out of the ordinary, really].

    Here is the report from the supposed radio message: [1]

    In the recording of the radio chatter, a monitor, named only as Hussam, detects a Sukhoi 22 fighter jet taking off from the Shayrat air base at 6.26am. The pilot identifies himself as “Quds 1”.

    “The air is still, and this warplane doesn’t take off at this time unless it is loaded with something dangerous, poisonous materials,” notes Hussam as he is listening. “Quds 1, guys he has chemicals, he has chemicals. He is the same pilot who had dropped chemicals on Latamineh.”

    Twelve minutes later Quds 1 drops the missile on Khan Sheikhoun.

    Latamineh, 15 miles from Khan Sheikhoun, was hit by a missile filled with what appeared to be a chemical agent on March 30. Doctors described victims suffering spasms and foaming at the mouth. About 70 people were injured, although none was killed.

    [1] The Times (UK) originated the story, my copy from an AU pub. They both have subscriber limits. Here is the NY Post’s story copy… http://nypost.com/2017/04/10/pilot-was-no-stranger-to-dropping-a-chemical-bomb-in-syria/

    Reply
    • Andrea

      He said: “The earliest reference we have discovered to it being a chemical attack is a tweet at 5:21 am (8:21 am local time)”
      It’s the earliest reference that A CHEMICAL ATTACK TOOK PLACE…
      But fro sure Christiaan can explain better. By the way nice article!

      The story about the spotter is very interesting.. but actually it seems he “felt” the plane had chemicals due to the strange circumstances of the takeoff, not trough some kind of direct identification… pretty poor

      Reply
      • noname

        The story about spotter is definitive fake. Su-22 could carry unguided bombs or missiles (Kh-23, 28, 58). Unguided bombs looks the same. CW armed “air-to-surface” missiles do no exist in principle.

        Reply
        • DDTea

          ” CW armed “air-to-surface” missiles do no exist in principle.”

          This is patently false. Iraq used aircraft bombs to deliver the chemical weapons used in Halabja in 1988.

          Reply
      • Christiaan Triebert

        Hi Richard P and Andrea,

        Thank you for your comments. That sentence indeeds refers to the earliest online open source information we could find refering to a chemical attack, as Andrea wrote. I am sorry if that was unclear.

        Richard P, thanks also for sharing the NY Post story.

        Kind regards,

        CT

        Reply
  3. Rene

    @Andrea
    Just because there has been an Airattack does not mean there can not have been a artillery attack. Both could have happend.

    Reply
    • Noname

      And what is the distance to… frontline (no need to mention that artillery positions are few km away from the frontline)

      Reply
      • Rene

        artillery can shot ~15km. That would not be a problem. Look at the videos and google the map and locations given there where you see video with the artillery. its not far from the impact of the chemical weapons attack

        Reply
        • Noname

          Agreed on 13 km (when the howitzers D1 were new – now they should be … 50 years old, probably). Which is the distance from the town to the front line? What is the number of shells to bring the desired amount of CW to the 800 m circle, with no bringing major damage to other buildings. And what we need to do with all those witnesses, who saw a single time short missile strike.

          Reply
    • Andrea

      For what my very limited knowledge on the matter there is no way an artillery attack should have produced those effects and such a spread of gas…
      But as said VERY LIMITED…

      Reply
  4. Richard P

    Follow up to earlier post . . .
    The story — General Mohammed Hasouri, the pilot of the Su-22 that dropped Sarin gas on the town of Khan Sheikhoun — is being pushed (big time) here: http://www.atimes.com/syrias-air-force-didnt-act-alone-implications/
    . . . by Stephen Bryen, Senior Fellow in Defense Studies : http://www.afpc.org/expert_listings/view/52
    . . . “For his work at the Defense Department, Dr. Bryen was twice awarded the Distinguished Public Service Medal.”

    Reply
    • Woody

      Well, he should be awarded with a Nobel if is able to prove this case to be a CW missile attack. I will even throw some of my own on top of it if he makes it.

      Reply
    • DDTea

      Good story. It’s notable that in the wording of their denial, Russia denied having planes flying over the area at the time. Syria denied having chemical weapons. Interesting notion that a Syrian pilot dropped Russian nerve agent.

      Russia has mostly demilitarized and destroyed its chemical stockpile. But as the example of Kolokol-1 in the theater showed, they may not have declared everything.

      Reply
  5. plop

    Hi,
    Good analisys, but does it proof that Syria (or Russia) have used Chemical Weapon on the ground ?

    I just don’t understand what would be the advantages to made such type of attack since they have the advantages….

    What is your opinion ?

    Reply
  6. Tore F

    Just a question : How could the facebook group post at 6 am , (even w/ pics from the carnage ) when US and planespotters says plane took off at 6.37 ? Something odd here..
    Quote Bellingcat: “The first tweets referring to a Su-22 were tweeted at 6:21 am by @ShamiRebel. He links to a screenshot of the Facebook page “The Lens of Khan Sheikhoun and its Countryside”. The Facebook post was published at exactly 6:00 am.”

    Reply
      • Tore F

        Or the bombing at 6:45 untrue? If that FB post was posted at 6:00 and Shami tweeted at 6:21, it means the first victims already were dead before the plane arrived.

        Reply
    • stranger

      What time zone are you in? Could it be you are at UTC+1 zone, central-western Europe and Facebook shows you the post in your local time?

      Reply
      • Tore F

        6:00 AM is the time reffered to in Bellingcats article, and which I cited in my first post. So has nothing to do with my location. Bellingcat article refers to local Syria time .Unless there is an time error, it means ppl were killed before plane arrived 6:45 acc to Pentagon!

        Reply
        • stranger

          Sorry, the question to Bellingcat then. Please note, that the post seems to be written 2 hours after the poisoning as the translation from Arabic say.

          Reply
    • stranger

      Good idea, but need to dbl check the time zone difference. And the time of what time zone does Facebook show?

      Reply
    • Christiaan Triebert

      Hi Tore F,

      All times mentioned in this article are in the Coordinated Universal Time (UTC) with Syrian local time (+3 UTC) also included for context.

      The planespotters claim that Quds-1 took off at 6:26 am local time, which is 3:26 UTC. The Facebook post was uploaded at 6:00 UTC, so that Facebook post was published 2 hours and 34 minutes after the planespotters say the aircraft took off.

      Kind regards,

      CT

      Reply
      • Tore F

        Christiaan: This Means Facebook post was posted at 9:00 local Syria time. And Shamis tweet at 9:21 local Syrian time if I understand this correctly?
        I think you should add this to your article to avoid confusion.
        Timeline vital to understand what happened. Regards Tore

        Reply
        • Christiaan Triebert

          Hi Tore,

          That is correct. I agree with you that it is important to add the local times in brackets behind the times mentioned in UTC. I have adjusted the article accordingly, thank you.

          Kind regards,

          CT

          Reply
  7. Larry

    A British journalist (from The Guardian if I remember correctly) interviewed on NPR (US public radio) who was introduced as having been the first on the scene of the attack said that he visited the silos and warehouse and found them completely abandoned and empty except for a volleyball net. He said it appeared to have been a grain storage facility.

    Reply
  8. stranger

    Despite all my hatred to Bellingcat and their single sided propagandistic articles including this one, I must admit Christian is right on this Facebook timing. Which doesn’t make all the rest of accusations true of course…

    Reply
    • Mad Dog

      Your hatred shows, and so you are not a disinterested observer, but one with an agenda blinded by your hatred…IMHO. Even in this matter where we still have no evidence of a ‘warehouse’ as pushed by both the Soviets (uh, excuse me) and the Syrian Thugacracy. Just where is it?

      Reply
      • stranger

        I explained my interest many times. I’m upset by the the flow of lie and dirt against my country. Please be advices also, if you don’t know by chance, that the strong epithets may be used not literally exactly. I don’t see how my assessment of Bellingcat as an outlet for anti Russian propaganda, based on a couple of years of observations lead you to an idea I may be “blinded”. If you haven’t noticed already, I argument what I say.
        As for the warehouse, Russia requests an independend investigation. Since your president did not rely on any investigation nor any objective data before taking the decision to start another small war, to get rid of democrat’s accusations to be a Putin’s puppet, and to provide Tillerson with stronger arguments to press Russia, that is up to you to provide such the “top secret” evidences that SAA is behind the gas attack. Every time your intelligence is saying the evidences are classified, that may mean they are trying to fool everybody.

        Reply

Leave a Reply

  • (will not be published)