the home of online investigations

What the OPCW-UN JIM’s Leaked Report on Khan Sheikhoun Tells Us About Russia’s Denials and Syria’s Sarin

October 27, 2017

By Eliot Higgins

Translations: Русский

The new report from the OPCW-UN’s Joint Investigative Mechanism (JIM) on chemical attacks in Syria, provided to the UN Security Council yesterday, and leaked earlier today, shows that, despite Russian and Syrian protests, there’s now clear evidence that Syria was responsible for the Khan Sheikhoun Sarin attack, and alternative versions of events presented by Russia and Syria are fabrications.

The leaked 39 page report examines two chemical attacks in detail, the April 4th Sarin attack on Khan Sheikhoun and a September 2016 sulphur mustard attack by ISIS on the town on Umm Hosh. Following reports by the OPCW Fact Finding Mission (FFM) confirming the use of chemical weapons in these incidents the JIM’s task is to establish who is responsible for the attacks. The report provides various details of the JIM’s investigation process:

Over the course of conducting its investigations into the incidents at Umm Hawsh and Khan Shaykhun, the Mechanism undertook the following key activities:
(a) obtained and reviewed information and material from the Fact-Finding Mission;
(b) collected information from open sources;
(c) submitted requests to Member States, including the Syrian Arab Republic, for information;
(d) interviewed witnesses, including during visits to the Syrian Arab Republic, and obtained photographs, videos, documents and other materials;
(e) obtained analysis and expert assessments from several forensic institutes;
(f) obtained satellite imagery and analysis thereof;
(g) obtained expert analysis in respect of medical effects, munitions and their delivery methods, aircraft configuration and capabilities, plume dispersion, and chemistry of toxic agents;
(h) obtained information about weather conditions; and
(i) attended expert briefings. Upon obtaining the above-mentioned information, the Mechanism conducted extensive analysis of the information and material it had obtained.

It also details what it sought to establish who was responsible for the attacks:

In order to identify those responsible, the investigation sought to establish to the greatest extent feasible the circumstances of the use of the chemical weapons, including in respect of the following:
(a) the precise date and time of the incident;
(b) the impact location;
(c) the munition used;
(d) the munition delivery method; and
(e) the medical effects and response.
In collecting and analysing the information in relation to the incidents, the Mechanism prepared a case file for each incident, documenting the information collected, as well as the analysis performed in respect of each scenario.

In the case of Khan Sheikhoun the JIM states that it “examined eight possible scenarios as to how the incident occurred”, and based on information received two scenarios were further investigated:

(a) sarin was released via an aerial bomb; or
(b) sarin was released via the explosion of an improvised explosive device (IED) placed on the ground.

A third scenario, with two alternative versions of the scenario, was also investigated, but neither versions of the scenario were found to be linked to the release of Sarin. This third scenario is the release of chemical agents following the bombing of buildings in Khan Sheikhoun. Variations of this scenario were proposed by Seymour Hersh in his article Trump’s Red Line in Welt, in Garth Porter’s article Have We Been Deceived Over Syrian Sarin Attack? Scrutinizing the Evidence in an Incident Trump Used to Justify Bombing Syria on Alternet, and Syria’s and Russia’s initial claims about the Khan Sheikhoun attack that a chemical weapons warehouse had been bombed. Regarding the Syrian and Russian chemical weapons warehouse claim the JIM report states the following:

The location, referred to in some public statements as a terrorist ammunition depot, appears to be a building used by the Syrian Civil Defence as a medical point in the eastern outskirts of Khan Shaykhun. Apart from the fact that victims of the sarin incident earlier that morning had been treated there, the Mechanism did not link that location to the release of sarin.

The JIM report is the first time the Russian and Syrian claims have been linked to this location, with the Russians and Syrians previously failing to provide any details about the specific location they claimed was bombed. This may be because the activities around the location, treating victims of the attack, were well documented, as well as the moment the medical point was attacked, with no signs of it being a chemical weapons warehouse.

The JIM spoke to witnesses who referred to reports of a house “taken over by a non-State armed group and thereafter used for storage of ammunition and barrels”, the location of which was identified on satellite imagery as being damaged between 21 February and 6 April 2017, and was one of the locations in line with a smoke plume visible in video footage published online claiming to show the attack, and verified by the JIM’s investigation. The JIM report states that images of the house examined by an independent expert showed damage that “was consistent with an explosion being caused by an air-delivered thermobaric bomb or fuel air explosives.” It goes on to state that samples taken by the Syrian Arab Republic from the site showed no traces of sarin or its degradation products. While both Seymour Hersh and Garth Porter both claimed Sarin was not actually the chemical agent dispersed in the attack, the JIM makes very specific claims about the Sarin used that would discount any scenarios where Sarin was not dispersed, or was dispersed by the accidental combination of precursors.

The JIM report contains details of where and when the attack occurred that are consistent with the OPCW Fact Finding Mission’s earlier report, and other reporting on the attack. At between 0630 and 0700 hours an aircraft dropped a munition on Khan Sheikhoun, Syrian Arab Republic aircraft were flying in the area, Sarin emanated from a crater created on the morning of April 4. It is the creation of this crater, shown below, that is central to Russia’s and Syria’s claims:

In this scenario, an explosive charge placed on the ground containing Sarin was detonated, as to stage an attack the Syrian Arab Republic would be wrongly blamed for. The Syrian Arab Republic provided the JIM with a report that set out this scenario in more detail:

In the report, the Government concluded that the shape of the crater, its characteristics and the lack of physical evidence did not indicate that it had been the result of an air strike. It was noted that the shape, depth and content of the crater had not been compatible with the effect of an aerial bomb, but that the crater and its contours indicated that it had been the result of a ground explosion using a device weighing not more than 10 kg. In support of its position, the Government referred to the incompleteness of the debris of the alleged explosion and the absence of any residues of the bomb or rocket, including a rocket motor, tail or fins. It was also stated that three pieces from an unknown source had been deliberately placed, including the remnants of an alleged shell. The Government stated that that confirmed that the scene had been fabricated to suggest the crater had been the result of the explosion of an aerial bomb. The report further noted that the crater and its surroundings had contained traces of live agent (sarin) and its degradation products, which had been found 10 days after the alleged attack, thus indicating that the explosion had not led to the dispersion of the full content of the sarin container, and that the explosion had not been well calculated.

A similar scenario was recently described by Ambassador Mikhail Ulyanov Head of the Russian delegation in UNGA First Committee, Director of the Department for Non-Proliferation and Arms Control of the MFA of Russia on the margins of the 72nd session of the UN General Assembly:

A question comes into mind – what has actually happened in Khan Shaykhun? Unlike some of our partners we do not intend to categorically impose our point of view. We believe that JIM must work out all versions including air strike. We expect at the same time that the version of staged incident would also be carefully studied since frankly speaking we tend more and more to opt for that version. It is supported in particular by the following circumstances. The analysis of the photographs of explosion crater leads us to doubt that it was a result of an air bomb strike. According to Russian military experts if the air bomb were used the crater would be five to six meters in diameter and up to two meters deep. The photo and video footage prove that the shape of the crater in Khan Shaykhun is much smaller – 1 to 1,5 meters in diameter and only half a meter in depth. Moreover the size and geometrical shape of the crater and the direction of the rims of asphalt pavement on its perimeter not outwards but inwards the hole in the ground formed after the explosion prove that the explosion of sarin container was set off directly on the ground. Most likely the improvised explosive device was placed on its surface and the container had less than 1,2 kg of chemical agent. The version of a bomb used in Khan Shaykhun so popular among some of our western partners is refuted by the fact that no fragments of the bomb were detected on numerous photo and video materials from the site of event. However a crushed metallic tube is clearly seen in the explosion hole, which has nothing to do with the air bomb. It is obvious that this was a key material evidence that could clarify the method of sarin use and help track down the perpetrators.

The Ambassador later refers to the work of Ted Postol on Khan Sheikhoun, whose work on the attack has been criticised for being filled with basic errors, and who has presented his own variation of the above scenario, claiming the White House version of the attack, which is consistent with the OPCW-UN JIM report, is “obviously false“.

The claim that an IED was used is examined in detail in the JIM report, who asked a “defence research institute”, a “specialist forensic institute”, and individual experts to review the evidence. They consistently agreed the ground had been hit at high velocity by a heavy object, which was inconsistent with scenarios where an IED was used:

The expert analysis found that the characteristics of the crater were consistent with having been hit by a heavy object travelling at a high velocity, probably with a liquid fill. Any explosion from the burster charge would be small and, furthermore, the liquid surrounding the burster charge would have absorbed most of the energy from the explosion. The Mechanism notes that, based on the foregoing, the characteristics of the crater are more likely to have been caused by an aerial bomb with a small explosive charge, and that it probably contained liquid.

With the the alternative scenarios presented by Russia, Syria, and others examined and deemed improbable, this leaves the scenario in which the Syrian Air Force bombed Khan Sheikhoun with Sarin. While the JIM presents a range of evidence that supports this scenario, much of which is consistent with earlier open source investigations, on the ground reporting, and the work of the OPCW Fact Finding Mission, the most significant evidence is the chemical analysis of samples from Khan Sheikhoun. The report states the production of Syria’s Sarin uses the binary route, in which methylphosphonic difluoride (DF) is combined with isopropanol (iPrOH) in the presence of hexamine to produce Sarin. Hexamine has been theorised as playing this role in the Syrian’s Sarin production process by Dan Kaszeta since 2013, as has its presence at Sarin attacks site as an indicator of the Syrian government’s involvement in Sarin attacks. The JIM’s analysis identifies a number of “marker chemicals” relating to the use of DF which further links the Syrian government to the Khan Sheikhoun attack.

The JIM report reveals that:

During the removal of the stockpile belonging to the Syrian Arab Republic in 2014, the OPCW collected samples from the sarin precursor methylphosphonic difluoride (DF) before the rest of the stockpile was destroyed. The Mechanism commissioned a laboratory to study and compare the impurities, and their formation, in samples of stockpiled DF. Five different samples from the Syrian Arab Republic DF stockpile were analysed for impurities.

These impurities act as the marker chemicals which the JIM uses to identify the presence of Syrian Arab Republic DF in the Sarin used in Khan Sheikhoun:

The samples from Khan Shaykhun contain the three types of marker chemicals described above: PF6, isopropyl phosphates and isopropyl phosphorofluoridates. Their presence is a strong indicator that the sarin disseminated in Khan Shaykhun was produced from DF from the Syrian Arab Republic stockpile.

In addition, the presence of certain chemicals indicates the level of technology and skill required to manufacture the Sarin used:

Based on the foregoing, the Mechanism concludes that the presence of the marker chemical PF6 is evidence that HF was used to produce the DF that was the precursor for the sarin released in Khan Shaykhun. HF is a very aggressive and dangerous gas and is, therefore, difficult to handle. The use of HF indicates a high degree of competence and sophistication in the production of DF and points towards a chemical plant type production.

Despite attempts by some to claim the Sarin used on April 4th was some sort of Jihadi bathtub Sarin used to falsely implicate the Syrian government, or Sarin was planted at the scene and its degradation products injected into victims to fool the OPCW, it is clear the above result exclude these scenarios. Most importantly of all, the OPCW-UN JIM report states the following:

An initial screening of the reports concerning previous incidents of the release of sarin in the Syrian Arab Republic showed that some marker chemicals appeared to be present in environmental samples. This would warrant further study.

This may go someway to explaining why Syria’s ally on the UN Security Council, Russia, seems keen to veto the extension of the OPCW-UN JIM’s mandate, preventing them from investigating further incidents.

Eliot Higgins

Eliot Higgins is the founder of Bellingcat and the Brown Moses Blog. Eliot focuses on the weapons used in the conflict in Syria, and open source investigation tools and techniques.

Join the Bellingcat Mailing List:

Enter your email address to receive a weekly digest of Bellingcat posts, links to open source research articles, and more.

Support Bellingcat

You can support the work of Bellingcat by donating through the below link:

100 Comments

  1. Peter Guillam

    DDTea – November 5, 2017
    It was filmed between april 3 and the time the video was uploaded on the morning of april 4.

    Proof?

    Reply
  2. DDTea

    One additional, interesting point:

    ” …well-known and respected organization Swedish Doctors for Human Rights (SWEDHR) concluded…”

    SWEDHR is neither well known nor respected. They were founded in 2015. Their conclusions are only cited by Russian state media, and they only advocate positions in accord with Russian statements. Nobody in international humanitarian circles has heard about them. They appear to be a sock puppet/shill organization.

    Reply
  3. Peter Guillam

    DDTea – November 5, 2017
    One additional, interesting point:
    ” …well-known and respected organization Swedish Doctors for Human Rights (SWEDHR) concluded…”
    SWEDHR is neither well known nor respected.

    But they are in fact qualified doctors, yes?

    As opposed to the non existent or murky qualifications of bellingcat fanboys/members.

    Reply
    • Mad Dog

      However, they appear to be a sham as seen by other organizations in Sweden: Amnesty International in Sweden, Human Rights Watch in Sweden, the Swedish Society of Medicine and the Swedish Medical Association all say they never heard of SWEDHR, which describes itself as an “alternative NGO.” They are the darlings of RT and other Russian mouthpieces however. And the video they criticized was not of this event, but one two years ago. And what, pray tell, are your qualifications?

      Reply
  4. Peter Guillam

    bellingcatadmin – November 5, 2017
    As the damage at the impact sites only appear after the April 3rd image the date of filming would be April 4th.

    Says who?

    Reply
  5. Richard Ong

    The language in the JIM report that “The location, referred to in some public statements as a terrorist ammunition depot” does not provide a basis for your statement that “The JIM report is the first time the Russian and Syrian claims have been linked to this location . . . .”

    The Syrians and Russians are properly criticized for NOT providing the location of the target they say they, or one of them, struck but the “public statements” referred to is not the equivalent of “public statement made by Russia and Syria.” The JIM report said nothing about who made those statements and those who made them are not otherwise identified. The report was studiously vague in fact.

    Reply

Leave a Reply

  • (will not be published)