Analysis of Syrian Red Crescent Aid Convoy Attack

This article was written collaboratively with Bellingcat contributor Hady Al-Khatib

At 1930 Syrian time on 19 September, a Syrian Arab Red Crescent convoy was attacked. Around 20 civilians were killed, including Omar Barakat, the Syrian Arab Red Crescent’s director in Urum al-Kubra. Eighteen trucks containing aid were destroyed. The Syrian Red Crescent called it a “flagrant violation of International Humanitarian Law.” The Russian Ministry of Defense (MoD) stated that it did not know the location of the convoy, claiming:

“Around 13:40 Moscow time (10:40 GMT) the aid convoy successfully reached the destination. The Russian side did not monitor the convoy after this and its movements were only known by the militants who were in control of the area… We have closely studied the video footage from where the incident took place and we did not find any signs of any ammunition having hit the convoy. There are no craters, while the vehicles have their chassis intact and they have not been severely damaged, which would have been the case from an airstrike. All of the video footage demonstrates that the convoy caught fire”.

This investigation will use open source techniques to demonstrate that the Russian MoD and Syrian Government knew the location of the convoy. It will also show that it was not a fire that destroyed the convoy, but a sustained attack by air assets.

Context

Location

The location of this attack is at a warehouse along Highway 60, approximately 15 km west of Aleppo and 1 km to the east of Urem al-Kubrah (36°09′05.7″N 36°58′03.9″E):

Fig 1 – General Location, including Urem al-Kubrah on the left of the image

Fig 2 – Close up of warehouse complex – Highway 60 runs from bottom left to top right

Fig 3. East side of Compound. Source.

Fig 4. North side of compound. Source.

Time

The incident took place on the evening of the 19th September, as confirmed by multiple sources including the Syrian Red Crescent. In Video 1, we see a member of the White Helmets, a Syrian Civil Defence organisation, state the time and date of the attack as “19th September 2016… in the evening, 7:30 o’clock”. The White Helmets officially mark it as 1912 Syrian Time in the Youtube video description. Neither the Syrian nor Russian governments have disputed the timeframe for when the attack took place, thus the 7-7:30pm time for this attack seems most reasonable.

Who knew about the convoy?

According to the UN Deputy Spokesperson for the Office of Coordination of Humanitarian Affairs, Jens Laerke, the UN had received permission for delivering aid from the Syrian Government, and the Under-Secretary-General Emergency Relief Coordinator, Stephen O’Brien, states that the convoy’s location was “marked & coordinates known”.

We also know that the convoy was tracked by a Russian drone earlier in the day, which was confirmed by Ministry of Defense spokesperson Igor Konashenkov. He stated:

“Around 13:40 Moscow time (10:40 GMT) the aid convoy successfully reached the destination. The Russian side did not monitor the convoy after this and its movements were only known by the militants who were in control of the area”

This statement makes it clear that the Russian MoD knew the location of the convoy and the warehouse. However, a comparison of pictures from the aftermath of the attack and the drone feed clearly show that the convoy did not move on: it was attacked at the location that the Russian MoD was monitoring. The drone feed ends before the darkness falls and the attack takes place. In the figure below, the blue arrows mark the aid trucks, and the remaining boxes and lines are the same reference markers as seen in Figure 2 (which appears again below), showing that the Russian drone was monitoring the same location that was later attacked.

Fig 6 – Top left: Satellite imagery of location captured by Russian drone Top right: Shot from Russian drone of same location, with aid trucks present. Bottom: Shot from Russian drone of same location, with aid trucks highlighted with blue arrows. Other markings consistent with Fig 2 (see below). Source, at 1:00:09.

Fig 2 – Close up of warehouse complex – Highway 60 runs from bottom left to top right

What happened during the attack?

The Russian MoD attempted to downplay the attack and link it to the rebels, with spokesman Igor Konashenkov claiming that it “strangely happened almost at exactly the same time as militants started a large-scale offensive on Aleppo” He goes on to say:

“We have closely studied the video footage from where the incident took place and we did not find any signs of any ammunition having hit the convoy. There are no craters, while the vehicles have their chassis intact and they have not been severely damaged, which would have been the case from an airstrike… All of the video footage demonstrates that the convoy caught fire.”

The evidence shown in the multiple videos and photographs of the aftermath demonstrate that Konashenkov’s statement is simply not true:

Fig 7 – Crater seen in road immediately outside compound. Source

Fig 8 – Debris found in crater shown in Fig 7. Source

Fig 8a – Conflict Intelligence Team Comparison of debris shown in Fig. 7 and unexploded barrel bomb from Hama province. Source

Fig 9 – Heavy damage to building. Yellow circle shows destroyed wall. Source

Fig 10 – View from same damaged building. Yellow circle shows destroyed wall. From the AFP (source)

Fig 11 – Example of fragmentation outside compound. Image from Aleppo Media Center.

Fig 11a: Note the road in Fig. 11 and here. This image was taken in the same location, except almost exactly 180 degrees in the other direction. It clearly shows a repaired crater in the road, the same crater as shown in Fig. 7. Image from Aleppo Media Center.

Fig 12 -Example of fragmentation on car inside compound. Source

Fig 13 – Example of crater with fragmentation visible in cardboard boxes to rear. Image from Aleppo Media Center.

Fig 13a – Conflict Intelligence Team comparison of debris found in crater shown in Fig 13 and an OFAB 250-270. Source

These pictures show a large amount of fragmentation for a fire, and Figures 9 & 10 show a level of destruction that is much more consistent with a powerful explosion. Although something like a gas cylinder could cause some blast and fragmentation, the level of damage show here, and in a multitude of other photos and videos, indicates something much more powerful.

Video and audio analysis

A White Helmet at the scene of the attacks makes two different claims. In the Video 1 he claims: “The regime helicopter targeted this place with four barrels”. In Video 2 the same man claims: “Regime helicopters targeted… with eight barrel bombs” and then states that the “regime targeted this place with cluster bombs two times… with C-5 [presumably referring to S-5 air-to-ground missiles] and with bullets”. Although he may be  referring to information he has just received, there is no immediate evidence that the latter claim is correct. However, the claims of barrel bombs and helicopters is consistent, especially examining the crater and debris in Figures 7 & 8. Furthermore, the object–likely a bomb’s tail fin– identified in Fig 13a appears to be from an OFAB 250-270, a piece of ordnance delivered from the air by jets.

There is also a video which claims to show the strike itself, posted by “Shattering News” and bearing the watermark of Aleppo24, a pro-rebel news outlet. It is titled “Russian and Regime Airstrike destroys UN aid trucks sending supplies into “Aurem”-near Aleppo”. Although the provenance of the source is difficult to confirm, the contents of the video are consistent with the description of the strike given by the White Helmet. We can understand incident better with the included audio and visual evidence.

Audio evidence [See Appendix A below for complete transcript.]

• The cameraman states that Regime forces have “targeted UN aid trucks in Aurem, on 19th of September 2016”, referring to Urem Al-Kubra, close to the location of the incident.
• Those involved in the chaotic scenes in the middle of the video, apparently treating or evacuating casualties, are clearly terrified at the prospect of an airstrike and keep mentioning it as a possibility. Indeed, towards the end of this section, someone calls for everybody to evacuate as “there is an airstrike coming”.
• The sound of jet engines is clear at both the very beginning of the video and at 02:45. In both incidents large explosions follow immediately after.

Visual evidence

• Location: The video, taken from some distance away, appears to show a distinctive warehouse, with a roof including a step, as well as gaps at the base, allowing the light from the explosions to shine through (see Fig. 14). In Fig. 15 this warehouse is identifiable to the north of the area where the trucks are parked.

Fig. 14: The location of the aid convoy is within purple box. The large warehouse is shown to the right, its distinctive roof marked in green and the gaps in the structure marked by the red box.

Fig. 15: Birds-eye view of the location of the incident. It uses the same markings as Fig. 14

The weapons used lead to big explosions that can clearly be heard and seen. In Figure 14, the scale of the attack is made clear by a flash from an explosion happening to the right, just off-screen to the north of the compound. In Figure 16, you can compare the scale of the first explosion to the warehouse on the right hand side, which is also seen in Figure 15. The video shows 3 explosions in total, as well as destruction that happened before the video started-indicating a sustained attack.

Fig 16 -Clear example of large explosion. Note the large warehouse to the right.

Other claims

Free Syrian Army (FSA)

The Free Syrian Army (FSA) rebel group released a joint statement condemning the attack and strongly denying any involvement by their forces. Although the time given by them for the attack is not consistent with other accounts by approximately two hours, their description of the events is consistent with the evidence shown previously:

“Russian Surveillance drones circled heavily overhead… warplanes carried out over 18 airstrikes that were closely followed by barrel bombing from military helicopters. The warplanes then circled back and targeted the group with heavy artillery”.

The statement notes that the rebels do not posses an air force, and that rather than attack this convoy, they facilitated their entrance into the western Aleppo suburbs.

#FSA issue detailed statement outlining the timeline of events leading to #Russia targeting of aid convoy & warehouse in #Aleppo, #Syria: pic.twitter.com/n3nhpV28hO

— Charles Lister (@Charles_Lister) September 21, 2016

Anonymous U.S. Officials

Further to the evidence presented above, anonymous US officials told Reuters that “two Russian Sukhoi SU-24 warplanes were in the skies above the aid convoy at the exact time it was struck late on Monday”. Due to the nature of this claim it is impossible to verify using open source investigation, but it does not contradict information uncovered during this investigation.

Additional Russian statement

Though the Russian Ministry of Defense earlier refuted claims that the attack on the convoy was an airstrike, it changed its tune on Wednesday, suggesting that a U.S. Predator drone was responsible for the attack. This claim is not consistent with the photographs and videos at the scene of the bombing and in its aftermath, including the roar of jets, the remains of barrel bombs, witness accounts, and an OFAB tail fin.

URGENT: #Pentagon denies Russia's accusation of US-led coalition #drone flying over area where @UN convoy's attacked https://t.co/v9sjbiE4jM pic.twitter.com/lr8LuusImM

— Sputnik (@SputnikInt) September 21, 2016

Conclusion

This investigation has explored the questions of who was aware of the SARC aid convoy, where it was attacked, the type of damage at the site, and the competing claims regarding the attack:

• UN and SARC claim the Russian MoD and Syrian Regime were made aware of the aid convoy.
• The Russian MoD knew the precise location of the aid convoy after tracking it using a drone.
• The damage at the site of the attack is consistent with an airstrike and barrel bomb attack.
• Witness testimonies from the site of the attack indicate that an airstrike and barrel bomb attack took place.

Therefore, both the Russian MoD and Syrian Regime were aware of the exact location of this convoy, both from reporting from the organisation and their own ISTAR assets.

Additionally, the Russian MoD claims are easily dismissible with even a cursory look at the available open source evidence. Specifically, Spokesperson Konashenkov said on Tuesday:

“We did not find any signs of any ammunition having hit the convoy. There are no craters, while the vehicles have their chassis intact and they have not been severely damaged, which would have been the case from an airstrike… All of the video footage demonstrates that the convoy caught fire”

An examination of the open source evidence shows that these claims are demonstrably false. The aftermath pictures, as well as the footage of the attack, clearly indicate large, explosive weapons were used. There are at least two craters (Fig 7, 8 & 11a and Fig 13), a multitude of fragmentation, and serious damage to at least one building.  

In examining the witness accounts from the White Helmets, along with the evidence in the footage of the attack itself, there are strong indications it was an air attack. Even if one does not trust the immediate witness testimonies of the White Helmets–as witness testimonies are notoriously unreliable after a traumatic event-the additional photographs and video footage of the attack and its traces leave no doubt that the attack on the convoy came from the air, probably from both jets and helicopters. Jet engines are clearly audible, and the size of the explosions suggest an air bombardment. Images from the Conflict Intelligence Team show what appears to be the base of a barrel bomb, and the tail ring of an OFAB 250-270. The rescuers are clearly terrified of an air attack, and the White Helmet testimony backs this up, although possibly exaggerating the attack–not a difficult mistake to make in the midst of such chaos.

In short, the most likely perpetrators of this attack are those who knew of the location of the convoy and have the means and motivation to carry out an air strike and helicopter barrel bomb attack. Considering the presence of a tailfin of a Russian-made bomb, the presence of a Russian drone monitoring the location, and the barrel bomb attack, it is almost certain that Syria–and possibly Russia–carried out the attack. There are no indications in the open source evidence that corroborate Russian claims that the damage took place from a “fire” on the ground (not initiated by an airstrike) or that a U.S. Predator drone could have been responsible.

This incident was a deliberate, sustained attack on aid workers using information provided for their protection.

Appendix A

Transcript of video entitled “Russian and Regime Airstrike destroys UN aid trucks sending supplies into ‘Aurem’ near Aleppo”

Person 1:   Allahu Akbar ,”God is great” ( Repetitively said)

Person 1: Regime forces have committed a massacre in the city of “Aurem” in Syria by hitting aid trucks.

Person 1: Regime forces have targeted UN aid trucks in “Aurem”… 19th of September 2016 …… Allahu Akbar ,”God is great”….

Person 1: 10 airstrikes on the city of “Aurem”…… Allahu Akbar ,”God is great”…….

“sound of ambulance sirens”

Person 2: Is the airstrike within our airspace? Is the airstrike within our airspace?!

Person 2: Allahu Akbar (God is great); they have destroyed the warehouses…

Person 1: Tell them we are an ambulance, tell them we are an ambulance… wait a minute, wait a minute….. Allahu Akbar …. Tell him they have destroyed the aid trucks, they have hit the aid trucks.

Person 2: They have hit the aid trucks…. They have hit the aid trucks, Allahu Akbar… the aid is on the ground [meaning ruined]…

“Noise in the background”

Person 1: Does anyone need help?

Person 2: Does anyone need aid?

Person from the back: Yes, someone needs medical help.

Person 1: Where?

Person from the back: Here here….

Person 1: Come here, they need medical help , come come…open, open  open!… put him here, put him here.

People together: Okay lift it off, lift it off…

Person 1: Take it back, take it back… pull it back, pull it! Pull it to the side… no pull it to the back.

Person from behind: There are still people injured back inside.

People: Now it’s okay (referring to the position of the injured person)…

Person from the back: Airplane!!

Another person: Come on guys the airplane is above us…

Person 1: The airplane is above us! Hurry, hurry up guys. Evaculate the area there is another airstrike coming.

Person 4: Hurry up guys hurry up… should I drive, should I?

Person 1: No no, I am going to….push him, push him inside.

Person from behind: There are still people injured back inside.

Person 4: Come with us…. No, no, go with him, Abu Steif [suggesting a nickname given to a person called Mustafa] come with us…let’s go…

Another person: No, no, stay stay….

Person 1: There is not enough space to drive.

Person 1: Allahu Akbar, guys! Allahu Akbar… they have destroyed the aid trucks….

Person 2 again: shouting Evacuate there is an airstrike coming, airplane is coming, evacuate, an airplane is coming….run away, there is an airplane.

Person talking to the person on the radio transceiver

Person 5: Inform us, inform us …

Person 6: They are going to execute the airstrike, they are executing it…..

Person 1: Allahu Akbar …. Allahu akbar …. Allahu akbar….the Russian airplanes has executed an airstrike on the UN’s aid trucks in “Aurem”……