the home of online investigations

You can support the work of Bellingcat by donating through the following link:

The Khan Sheikhoun Chemical Attack — Who Bombed What and When?

April 10, 2017

By Christiaan Triebert

Translations: Русский

Last week, we published a survey of open source evidence concerning the alleged chemical attack at Khan Sheikhoun in Syria’s Idlib province. This article builds upon the information presented in that article by comparing the claims made by a variety of actors and sources, including the Pentagon, the Syrian Foreign Ministry, and aircraft spotters on the ground. All times mentioned in this article are in the Coordinated Universal Time (UTC) with Syrian local time (+3 UTC) also included for context. Readers are welcome to suggest information we may have missed in the article, though we only focus on the who, what, and when of the incident, and not on the alleged chemical used in the attack.

The Timing of the Attack

Syrian government

The first air raid conducted by the Syrian army was at 8:30 am (11:30 am local time) on April 4, 2017, according to Walid Muallem, Syria’s Foreign Minister. He made the statement during a press conference in Damascus two days after the attack. The army, he said, “attacked an arms depot belonging to al-Nusra Front chemical weapons.”.

Eyewitness accounts

Locals claim the attack took place around 3:30 am (6:30 am local time) in all available statements. Translations of such accounts can be found in our previously published article on the attack. The earliest reference we have discovered to it being a chemical attack is a tweet at 5:21 am (8:21 am local time), referring to a video published at 4:59 am (7:59 local time).

The Aircraft

There are three sources saying that a Sukhoi 22 (Su-22), a Soviet variable-sweep wing fighter-bomber, conducted the attack: witnesses on the ground, an organisation of aircraft spotters, and the Pentagon.

Aircraft spotters

At 3:26 am (6:26 am local time), ground observers working with an organisation of spotters reported that a Su-22 called Quds 1 — the Su-22 fleet’s squadron commander — took off from its airbase in Homs. The spotters say it is significant if the commander conducts the sortie, as they associate the pilot and his aircraft with other alleged chemical attacks in Syria. Not much later, they report that another aircraft, Quds 6, has also taken off from the base.

The spotter organisation, Syria Sentry, is an outlet employing a well-developed network of spotters taking note of take-offs and initials flight directions of aircraft departing from military air fields primarily located in northwestern and central Syria. Their goal is to issue timely warnings to civilians in opposition-controlled territories. The organisation says they have strong evidence that Russian-operated fixed wing aircraft conducted follow-up attacks in the same area around seven hours later.

The Pentagon

On April 7, as the US conducted a cruise missile strike against the Shayrat Syrian Arab Air Force airfield. It also released an image allegedly showing the flight path of radar blips of the aircraft that carried out the alleged chemical attack in Khan Sheikhoun. The time given in Khan Sheikhoun is 337 Zulu Time to 346 Zulu Time, which converts to UTC directly, thus fitting with the eyewitness and Syria Sentry claims: between 3:37 and 3:46 am (6:37 am and 6:46 am local time respectively), the aircraft was above the town.

The Pentagon map can be used an overlay in Google Earth to gain a better understanding where the radar blips are located with regards to Khan Sheikhoun. However, it is important to mention that it is difficult to connect two-dimensional dots to a three dimensional flight path. Besides, the data appears to be incomplete making a proper analysis of the map probably not accurate. 

Eyewitness accounts

In available videos, alleged eyewitnesses claimed that a Su-22 fired four missiles. The first tweets referring to a Su-22 were tweeted at 6:21 am (9:21 am local time) by @ShamiRebel. He links to a screenshot of the Facebook page “The Lens of Khan Sheikhoun and its Countryside”. That Facebook post was published at exactly 6:00 am (9:00 am local time).

Later that day, opposition media outlet Orient News claimed in an article that “a number of field, independent and even Syrian Civil Defense observatories in the countryside of Idlib and Hama” stated that “colonel pilot, Muhammad Yousef Hasouri […] the commander of the Sukhoi 22 Squadron at al-Sha’yrat airport” is responsible for the Khan Sheikhoun attack.

Orient News further writes that Col. Hasouri’s Su-22 carries the Quds 1 banner, and says he hails from Talkalakh town, but currently resides with his family in the “Al-Sakan Al-Shababy” neighbourhood in Homs city.

Two days after the attack, a rumour started spreading that Col. Hasouri was killed “by a bomb blast under his car”, as Asaad Hanna, political officer at the Free Syrian Army (FSA), tweeted. None of these claims can be confirmed, but Hasouri’s name has been associated with Shayrat airfield by both pro- and anti-Assad supporters on Twitter since 2013.

Gen. Ali  Ayoub, Syria’s Army Chief of Staff, visited the Shayrat air base days after the  attack, thereby honouring Hasouri as seen in a video report of the visit. On Facebook, Hasouri is referred to as “the hero who struck the depot” dozens of times. A screenshot of the video linked above is included. Some refer to Hasouri as a Brigadier General, and two members of the Syrian parliament appear to be among those praising Hasouri.

Firstly, there is Fares Shihabi who tweeted that Hasouri was honoured “for destroying Qaeda’s weapons facilities in Khan Sheikhoun, Edlib”. The tweet was linked via his Facebook profile, but has since been deleted. As it was not archived via or, it is difficult to confirm authenticity of the tweet.

Secondly, Syrian member of parliament Shareef Shehadeh also posted the same still from the video, in which Hasouri is being honoured by Gen. Atoub. It is not clear whether Mr. Shehadeh’s Facebook profile is authentic.

The Times ran a story on Hasouri today.

The Target: A Chemical Weapons Factory?

The Syrian and Russian governments

Neither Syria nor Russia denies that government forces bombed Khan Sheikhoun on April 4. Instead, the debate is over what kind of weapon they used and what the target was.

Russia and Syria insist no chemical weapons were used in the attack. Instead, some of their officials claim that a chemical weapon factory belonging to Tahrir al-Sham was hit, which caused the chemicals – the type of which have still not been publicly identified – to spread. Syria’s Foreign Minister Muallem claimed during a press conference in Damascus:

“The first air raid  conducted by the Syrian army was at 11:30 am [8:30 am UTC] on that day [Tuesday April 4, 2017] and it attacked an arms depot belonging to Al-Nusra Front [Al-Qaeda’s former Syria affiliate, now operating under the banner of Hayat Tahrir Al-Sham] chemical weapons. (…) I stress to you once again: the Syrian army has not, did not, and will not use this kind of weapons – not just against our own people, but even against the terrorists that are targeting our civilians indiscriminately.”

Sources on the ground

With regards to the target area, it is worth noting that a group of silos and a large warehouse are dozens of meters away from where locals said the chemical attack took place.

Post-attack drone footage from Hadi Al-Abdallah gives a good overview of that area. It is worth noting that the damage shown at the silos, the warehouse and other buildings in the area already existed before the April 4 attack, as shown by TerraServer imagery from February 2017.

Discrepancy with regards to time

Between the different accounts of what happened, there is a clear discrepancy with regards to time.

Eyewitness accounts claim the attack took place around 3:30 am (6:30 am local time), with the first reference to it being a chemical attack at 5:21 am (8:21 am local time). This time period is in line with the data of Syria Sentry and the Pentagon.

However, Syrian Foreign Minister Muallem claims the first airstrike – on an “ammunition depot” – was carried out at 8:30 am (11:30 am local time). This is in line with an earlier Russian Defence Ministry statement claiming the attack occurred “from 11.30 to 12.30 local time”, but neither Syria nor Russia have presented any evidence to support their claims, nor is their any available open source evidence to support their claims. 

All available evidence, including witness accounts from the scene and airfields, strongly suggests the chemical attack occurred hours before the attack claimed by Russia and Syria. It is difficult to reconcile the Russian and Syrian claims with the open source evidence available, including a three-hour time gap between the narratives, the previous damage to the silos and warehouse near the attacked site, and the available images showing location of the airstrike.


Thanks to @THE_47th for noting the link to the social media posts related to Mr. Hasouri, to @obretix with regards to the challenges regarding the Pentagon flight path, and Bellingcat’s Timmi Allen for the Google Earth overlay of that same flight path.

Christiaan Triebert

Christiaan Triebert has investigated for Bellingcat since 2015 and runs several of Bellingcat's workshops for journalists and researchers across the world. Contact via email ( or Twitter (@trbrtc).

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.


  1. Questions

    1. So first witness report about Chemicals was only 2 hours after rocket Airstrike?
    2. Four hits – 3 HE explosions and one “CW” on the road that is laughable looking at distance to inhabited areas and amount of CW needed to be used to reach that level of victims inside the town, should be half size of railway tank, have you Mapped where main area of victims was?
    3. Sarin is odorless, colorless, witness report colours and smell, but only pone hole, how you explain that?
    4. CW delivery bombs are not HE bombs, they are basically containers that dispares vapour into area, they do not explode into peaces, anything found on the ground? No?

    • DDTea

      Q: Sarin is odorless, colorless, witness report colours and smell, but only pone hole, how you explain that?

      A: This has been answered multiple times in the 3 threads related to this incident. Pure sarin is colorless and odorless. But Sarin combined from its binary precursors–the manner the Syrian regime is known to stockpile and deploy it–will smell like rotting fish and be irritating from hydrogen fluoride vapors.

      Q: CW delivery bombs are not HE bombs, they are basically containers that dispares vapour into area, they do not explode into peaces, anything found on the ground? No?

      False. CW bombs contain high explosive burster charges to disperse the CW payload on impact. Otherwise a puddle forms rather than an instant, giant, cloud of toxic vapors. The charge is strong enough to scatter fragments of the bomb 200-300 yards away. Not much of the container will remain at the impact site. This only requires a few kg’s of high explosive, so the CW payload will not all be destroyed.

      • Noname

        Bombs, which was specially designed for CW, has detonators. Bombs, converted from usual HE: no idea.
        What is expected volume of the 100 kg of CW? Which ammunition it could be fit in (keeping in mind that su-22 must remain operational with that one)

        • DDTea

          Yet other eyewitnesses reported a myriad of smells:

          “”The smell was like cooking gas. My friends told me to wear a mask on my nose and mouth but I began to feel nausea and vomiting. My eyes turned very red and started to itch.”

          “Not far away in Zemalka, Abu Omar, a militant with the Free Syrian Army, was on call when he heard the first rocket land. “I ran to my house immediately to check if my wife and kids were OK. When I reached home, I began to smell something like vinegar and rotten eggs. ”

          Based on that rotten egg/cooking gas smell, I remember speculating to Dan that the agent used in Ghouta may not have been Sarin, but perhaps Thiosarin. But the OPCW report disagreed. *shrugs*

  2. Anonymouse

    Any plans to cover the Shayrat airbase attack? There’s some serious dispute over the scale of the damage – how many missiles hit (57 or 26?), how many planes were destroyed (6, 9, or 20? Multiple types or just MiG-23s?) and what other hardware (fuel tanks, ammunition, antiaircraft systems, support vehicles, etc), etc. There’s two competing narratives right now – the “everything of value was removed in advance” narrative and the “the capabilities of the base were severely degraded” narrative.

    There have been more than enough videos and stills released, including satellite images, to do the analysis. I’d do it myself but I’m no good at identifying aircraft or weapons.

  3. Th Fontenay

    I am quite surprised by the fact that if the attack occurred at 6:30 am LT, the information about its chemical nature (first victims) was only displayed near two hours later (8:21 am LT). How is it possible since 1) we can observe the usual spraying fastness of any information coming from the so-called “rebel/liberation army area”, and 2) we know how fast gas can disseminate after such an attack. In case of a chemical attack, gas damages should have been noticed and publicized more quickly, in my opinion. Did we know precisely when first responders came and start to collect and examine the first victims ?

  4. Ghostship

    “The spotter organisation, Syria Sentry, is an outlet employing a well-developed network of spotters taking note of take-offs and initials flight directions of aircraft departing from military air fields primarily located in northwestern and central Syria.”
    This is quite an old concept certainly used as far back as WW2, but the availability of mobile phones has made it far more useful, so Syrian intelligence must suspect that such an organisation exists. So why have we seen no articles extolling the virtues and skills of Syrian Sentry in the mainstream media as we have of the brave and noble White Helmets? The first and only reference I can find on the internet prior to the Khan Shaykhun incident is a December 2016 article about them on the War is boring website written by Tom Cooper, an author who seems to be a firm supporter of the jihadists from the articles of his I’ve read and who appears to stick solidly to the anti-Assad narrative coming out of Washington, London, Doha, Riyadh, Ankara, etc.
    The other question I have is are there any recordings how ever bad of any of these communications. Even if it was simple as holding a smartphone to the speaker of the radio scanner being used, it should have been possible to record the alleged conversation. That there are no recordings suggests to me that the these conversations were made up to “fit” the incident.
    Furthermore, sat around Mount Troodos on Cyprus is one of the more sophisticated listening stations in the world that can monitor radio traffic over most of Syria. This is no great secret so I suspect that if the Syrians were really responsable for the Khan Shaykhun they would have maintained radio silence throughout the mission because they knew that the Americans and British would be listening in. Since Anglo-American intelligence gathering abilities from Cyprus are widely known, releasing any recording they obtained would not compromise much of a secret, so why have we heard nothing from either the Americans and British? Could it be that there are no recordings because there were no radio communications. And an organisation such as Syria Sentry would very much appeal to a British ex-military officer brought up on tales of daring do by SOE and the Coastwatchers.

  5. Rene

    “Postol has also criticized the unclassified intelligence assessment released by the Trump White House blaming the air forces of Syrian President Bashar al-Assad for the April 2017 Khan Shaykhun chemical attack. Postol concluded that the assessment “contains absolutely no evidence that this attack was the result of a munition being dropped from an aircraft” and that photographic evidence used in the assessment pointed to an attack by people on the ground using a 122mm artillery rocket tube filled with a chemical agent and detonated by an explosive charge laid on top of it.[”

    This is a interesting read.


Leave a Reply

  • (will not be published)

You can support the work of Bellingcat by donating through the following link: