Summary

• On April 15, 2017, an explosion rocked a convoy of buses carrying evacuees near Syria’s opposition-held Al-Rashideen leading to more than 100 deaths. The coaches were carrying evacuees from the besieged government-held towns of Fuaa and Kefraya in the Idlib governorate;
• Initial reports said that the explosion was caused by a suicide bomber. A widespread narrative in international media was that an aid vehicle distributing crisps was carrying the bomb. However, a video showing the moments before the explosion indicate that instead of the aid vehicle a blue Hyundai Porter carried the bomb;
• The Hyundai Porter has some distinctive characteristics, including what appears to be a ‘signature’ of the workshop where it was likely upgraded with a cage, and a sloppy painted yellow-green-red colour scheme on the side;
• In an attempt to find the possible responsible actor(s) of the bombing, Bellingcat launched a digital hunt for similar Porters in Syria. Many similar trucks have been found, though no exact match has been found up to date. Bellingcat has not found any evidence to indicate that the type of vehicle, the vehicle’s colour scheme or the markings had any particular meaning, such as indicating that it belonged to a particular group;
• This is an investigation with open ends, remaining questions are listed at the end of this article. You are welcome to join the digital pursuit of the vehicle by commenting under this article, contacting me via christiaantriebert@bellingcat.com or @trbrtc on Twitter.

Overview Map of Locations

Background Information

On April 15, 2017, at around 15:30 local time (UTC+3), a massive explosion rocked a convoy of buses which had been standing for hours at a checkpoint in Syria’s opposition-held Al-Rashideen, close to the city of Aleppo. The coaches were carrying evacuees from the besieged government-held towns of Fuaa and Kefraya in the Idlib governorate and were on their way to Aleppo city.

Most of the victims came from Fuaa and Kefraya, including 68 children, according to the Syrian Observatory for Human Rights (SOHR). Around 30 opposition fighters guarding the convoy were also killed in the attack, a local journalist present at the site said.

The evacuation was part of a highly controversial deal called the “Four Towns” agreement and negotiated by the Islamic Republic of Iran and the State of Qatar. This agreement was meant to alleviate the suffering in four besieged towns: Fuaa and Kefraya besieged by opposition groups, and Madaya and Zabadani near Damascus besieged by pro-government forces.

The population swap, sectarian in its nature, would mean that the around 20,000 residents of Shiite-majority Fuaa and Kefraya and the around 40,000 inhabitants of Madaya and Zabadani would be evacuated, Syria Direct reported. Iran took responsibility for Fuaa and Kefraya via the Lebanese pro-government militia Hezbollah, and Qatar for Madaya and Zabadani via Ahrar Al-Sham.

Initial reports said that the explosion was reportedly caused by a suicide bomber, or one or more individuals driving a car bomb into a crowd of people near the convoy — a so-called suicide vehicle-borne improvised explosive device (SVBIED).

Identifying the Bomb Vehicle: A Hyundai Porter?

A video showing the moments before and during the explosion seems to dispose of the widespread narrative in international media that an aid vehicle distributing crisps was the vehicle carrying the bomb —  along with the conspiracy theories linked to that notion.

Why? Let’s have a closer look at the video posted on April 16 at 10:06 am by Ahmad Makiya, who claims to be a photojournalist from Aleppo.

لحظه التفجير مبارح بالراشدين
ويظهر بالتسجل انو السياره الزرقا اتفجرت عند مواقع الثوار
اللي موجودين لحمايه قوافل كفريا والفوعه pic.twitter.com/P4FIk9FAoD

— ahmad makiya (@ahmad_makiya1) April 16, 2017

Makiya’s video suggests there were two separate events: a Syrian Arab Red Crescent (SARC) vehicle which appears to dispense crisps to children and adults, and a blue flatbed truck speeding towards that scene.

Image 1. People are gathering around a white van, which can be identified as a vehicle from the Syrian Arab Red Cross, handing out crisps. This is a still from the Makiya video, and shows the location only a few seconds before the explosion.

Image 2. A composite image made out of stills from the Makiya video, showing a blue Hyundai flatbed truck, likely the vehicle which exploded, driving towards the white van handing out crisps.

It is unlikely that one of the white vehicles, one of which was a SARC vehicle, exploded. Both of these vehicles were likely to be white Hyundai Starex. Both vehicles can be spotted on post-blast footage — unlike the blue Hyundai Porter. The look of the remains appears to indicate that these vehicles were not the cause of the explosion. The lack of remains of the Porter instead suggests that it was the Porter which caused the explosion.

Image 3. A comparison of pre- and post-blast footage shows the remains of the white vehicles, and no identifiable parts of the Hyundai Porter. The lack of remains of the Porter suggests that it was that very vehicle which caused the explosion.

Image 4. Blue shrapnel can be seen at the bomb blast side in post-blast footage, as first spotted by Twitter-user Alex Ocana.

Other vehicles can also be identified when comparing pre- and post-blast imagery. Aleppo’s “Cat Man”, a man who takes care of cats in the city, was also present at the very same point. The Facebook page of the Cat Man, wrote that he “was there to accommodate the displaced and our cat- ambulance was blown up in the air. It has been totally destroyed.” The page published photos as well of distributing sweets next to the evacuation convoy.

The blue vehicle can be identified as a third generation Hyundai Porter Super Cab, which was produced between 1996 and 2004, according to online information on a Korean used-car platform found by Sašo Miklič.

Image 5. A screenshot of the Korean used-car website which lists and sells vehicles. Using the website reference photos of the third generation Hyundai Porter Super Cab, produced between 1996 and 2004, the blue vehicle in the Makiya video can be identified.

It is evident that the Hyundai Porter comes with the paint scheme on both sides of the cabin. This pattern has different colour schemes, as shown on the reference photos of Porters below. The Porter of interest appears to have a yellow or greenish rectangular decoration.

Image 6. Reference photos of blue Hyundai Porters appear to shown that it comes with a rectangular paint scheme on both sides of the driver cabin.

There are at least four differences between the reference photos of blue Hyundai Porters being sold worldwide, and the Rashideen Porter:

1. The window decorations on the driver’s cabin;
2. The cage on the Rashedeen Porter, which may have been built by a local workshop in Syria;
3. The sloppy yellow-green-red paint on the side of the cage;
4. The W77 sign on the side of the truck, which may refer to the workshop that makes steel cages for pick-up trucks like the Porter, a local source told Beellingcat.

These characteristics of the Rashideen Porter need to be taken into account when looking for blue Hyundai Porters in Syria, as the following section will do. (Similar blue Hyundai Porters can be found in Iraq too, as this video showing humanitarian aid being distributed in the Al-Baaj area west of Mosul published in June 2017.)

Tracking Similar Hyundai Porters in Syria

Can we trace the Hyundai Porter in Syria? Well, after some research it becomes evident that there are a lot of blue Hyundai Porters in Syria. As shown in the images below, they have been spotted in footage coming from the Syrian governorates of Aleppo, Hama (Khattab), Idlib (Idlib, Khan Sheikhoun, Maarat al-Numan) and Raqqa (Tabaqa and near Ain Issa). There is even a “Grad”-equipped variant of the Porter (though it comes without the fancy window stickers).

Image 7. A blue Hyundai Porter without cage and window decorations, in the background of a Thiqa Agency video published in February 2017.

Image 8. A blue Hyundai Porter without cage but with window decoration, driving reportedly near the town of Khattab in the Hama governorate, as shown in Qasioun News Agency video published in March 2017.

Image 9. A blue Hyundai Porter without cage and window decoration, but with triangular markings on the side, photographed in the city of Tabaqa in the Raqqa governorate by Dutch journalist Harald Doornbos in July 2017.

Image 10. A blue Hyundai Porter without cage and window decorations, on a market in the Idlib governorate, as shown in a video published by Qasioun News Agency in February 2017.

Image 11. A blue Hyundai Porter with cage shown in security camera footage which captured another suicide explosion in Ad-Dana in the western Aleppo governorate in June 2017.

Image 12. A blue Hyundai Porter without cage in Khan Sheikhoun in the Idlib governorate. Published by TRT World. The Khan Sheikhoun Porter was spotted by Jesse Sandberg.

Image 13. A blue Hyundai Porter without cage but with the W77 sign in Khan Sheikhoun in the Idlib governorate. The video was uploaded by Ùmaya Press in April 2017 and is about the chemical attack in the city.

Image 14. A blue Hyundai Porter seen during a Kurdish rally in the city of Afrin, which is part of the Aleppo governorate controlled by Kurdish groups. The undated photo was taken by Hussain Jummo.

Image 15. A blue, Grad-equipped Hyundai Porter used by opposition forces, reportedly filmed in the Hama governorate and published by SMART News Agency in April 2017.

There is thus plenty of footage of blue Hyundai Porters — especially in Idlib city, so it seems. On several videos published by Ibaa News, the media wing from Hayat Tahrir Al-Sham (HTS), several Hyundai Porters can be seen. No less than five in this June 2017 video, for example.

Image 16. Two Hyundai Porters can be seen driving right after each other in this Ibaa News Agency video. Both Porters are without a cage but have the W77 marking on the side of the back loader.

With so many blue Hyundai Porters driving around in Syria, is it a hopeless job to look for that specific Rashideen Porter? After all, any of these blue Porters may have been upgraded to the bomb vehicle. For that reason, it is worth looking in two distinct characteristics of the Rashideen Porter: yellow-green-red colour scheme and the ‘W77’ signature on the side of the truck.

The Porter’s Side: W77 and the Colour Scheme

‘W77′ and ’77W’: A Workshop’s Signature?

The W77 signature, and a similar signature can be spotted on several (blue) Hyundai Porters in Syria’s Aleppo and Raqqa governorates. The first Hyundai Porter was produced in 1977, so the number may be referring to the Porter’s ‘birth year’.

Image 17. Photo of a white Hyundai Porter without cage and window decorations, but with the ‘W77’ signature. Photo was was published by HTS-linked Ibaa News Agency.

Image 18. A W77 sign seen on a white Hyundai Porter with cage, at a refugee camp in the northern Raqqa governorate. Footage published by RT in June 2017.

Identical W77 signs have also been spotted on other trucks, like the following truck, reportedly photographed near Ain Issa in the northern Raqqa governorate by a photographer working for UNICEF. The W77 sign can also be spotted on a Kia truck shown in footage from Al-Bab in the Aleppo governorate.

Image 19. A truck with a W77 sign photographed reportedly near Ain Issa in the northern Raqqa governorate. The photo was published by the UN News Centre.

Besides, a W77 sign has also been spotted on a vehicle used as a ‘technical’ by Jabhat al-Nusra militants. The photo was reportedly taken during an offensive on Syrian government allied forces near Handarat in the Aleppo governorate in April 2017, and allegedly disseminated through Nusra social media channels at the time. However, it is worth noting that there was no known Nusra presence near Handarat in April 2017, suggesting the photo is older if indeed taken in the that area.

Image 20. The W77 sign on the side of a vehicle, reportedly used by Jabhat al-Nusra militants near Handarat in the Aleppo governorate. The photo was allegedly disseminated through Nusra’s social media channels in April 2017, Rusvesna reported, though it is worth mentioning that there was no known Nusra presence there during that month.

The W77 sign and a similar 77W sign can be spotted on standing next to the Omar Ibn Al-Khattab mosque south of Al-Jinah in the Aleppo governorate in a video filmed in early 2017. One of those Porters is a strikingly similar blue Hyundai Porter with similar cage, markings, and colour scheme, as first spotted by Twitter-user @ArtWendeley.

Image 21. A comparison of the Rashideen Porter and the Jinah Porter. A green box indicates a match, an orange box a likely match, and a red box a difference.

However, it must be noted that there are differences as well, such the window decorations as shown in the image below (red indicates a difference and green a similarity), and seemingly the height of the cage which would be difficult to modify.

A few seconds further into that same video, another blue Hyundai Porter is seen. This time without the cage, but with a ‘77W’ signature – not ‘W77’. It also has different window and cabin decorations, while the decoration on the driver window appears to be the same.

Image 22. A blue Hyundai Porter without cage but with a 77W signature and window decorations in a video filmed next to the Omar Ibn Al-Khattab mosque south of Al-Jinah in the Aleppo governorate.

It is clear that there are at least three blue Hyundai Porters driving around in northern Syria with a W77 signature on the side. A question that arises is why the Porter without the cage still has a signature of the workshop. It may be that the cage parts are not welded to the bridge but easily removable, as we also saw earlier in Idlib city, thus complicating the pursuit of the Rashideen Porter.

The video came to light when forces of the United States (US) bombed the al-Jinah mosque on March 16, 2017, and Human Rights Watch, Forensic Architecture, and Bellingcat began investigating the case individually. A day after the strike on the mosque, the US Department of Defence (the Pentagon) released an image of the building along with several visible trucks.

The first truck looks like a Porter, but the loading bridge seems too high to match the Rashideen Porter. A reference image shows that it is more likely a different, smaller Hyundai Porter.

Image 23. A truck seen in the aerial image published by the Pentagon.

There is a second truck visible on the Pentagon image resembling a Hyundai Porter. Omar Ferwati of Forensic Architecture made a proportion analysis (as a percentage) to analyse the Porter shown in the image. It appears that it could be the same as in the video shot earlier at the mosque.

Image 24.  A proportion analysis (as a percentage) of the Porter shown in the Pentagon image, to analyse whether it could be the same as in the video shot earlier at the mosque. The proportion analysis was made by Omar Ferwati of Forensic Architecture.

In summary, the W77 marking has been seen on other Hyundai Porters in the Aleppo, Idlib and Raqqa governorates. However, it was also seen on other types of vehicles, indicating that it is no Porter-specific mark.

However, the sloppy colour yellow-red-green colour scheme on the side of the cage has been spotted on on two other vehicles: the Jinah Porter and the Jisr al-Shugur Porter. What do the colours indicate?

The Yellow-Green-Red Colour Scheme: What Does It Mean?

While appearing quite randomly painted, the colours on the side of the cage can only be spotted on the side of the Jinah Porter and the Rashideen Porter. One more video was discovered showing a blue Hyundai Porter with the same colour scheme on the side of its cage: a video publised in June 2017, showing several kids holding (toy) guns in the back of the Porter. The description of the video (Arabic: شاهد اشتباكات في محور الجسر وقطع الطريق من جماعة الدولة ولاك) claims that there are clashes near the location of the bridge and that the road is cut by the so-called Islamic State. It appears that this is a joke, perhaps facetious, about the kids playing. The location name ‘the bridge’ (Arabic: الجسر) may refer to Jisr Al-Shugur, a city in opposition-held Idlib governorate.

Video 1. Video footage of a blue Hyundai Porter with a cage, including the colour scheme. The video was published on Twitter in June 2017.

The Jisr Porter has a red-green-yellow colour scheme on the side of its cage, while the Rashideen and Jinah Porters have the reversed scheme: yellow-green-red, as the image below shows.

Image 25. The Jisr Porter has a red-green-yellow colour scheme on the side of its cage, while the Rashideen and Jinah Porters have the reversed scheme: yellow-green-red.

It is unclear to what, if anything, the horizontal tricolor of yellow, green and red (Rashideen, Jinah) and red, green and yellow (Jisr) on the side of the Porter’s cage refer to. If it were flags, many pan-African flags bare those colours but in a different order, just like the flag of Myanmar. The Lithuanian flag has its colours ordered exactly the same as the Rashideen and Jinah Porters, while the flag of the Syrian autonomous region of Rojava from yellow to red to green.

Image 26. The flag of Lithuania consists of a triband of yellow, green and red.

Image 27. The Flag of Rojava (Kurdish: Ala Tevgera Civaka Demokratîk a Rojavayê Kurdistanê‎‎) is the current flag of the autonomous region of Rojava in northern Syria. It is a horizontal tricolor of yellow (the Sun), red (the blood of martyrs), and green (the natural landscape).

The horizontal tricolor thus only seem to resemble the Lithuanian flag, which does not make a lot of sense. The ordering of the colours clearly does not match the Rojava flag.

In a nutshell, blue Hyundai Porters with similar features as the Rashideen Porter can be found in several Syrian governorates. Nevertheless, no Porter showing all features as the Rashideen Porter could be identified so far. Many questions remain which may be answered through crowdsourcing, as Bellingcat thinks the colour scheme as well as the W77/77W signature may be unresolved clues in this investigation.

Open Ends to an Open Source Investigation

You, our reader, have often helped us with finding a missing puzzle piece in our open source investigations. It has shown the power of online collaboration, the digital crowd. Today, we would like to ask our readers to join again to digital hunt, this time with regards to a car bomb that left over 100 people killed. Question that currently remain unanswered are:

• What, if any, is the significance of the green-yellow-red colour scheme on the side of the Hyundai? This is important because someone appears to have spray painted this bomb vehicle. A similar colour scheme is seen on the Jinah Porter and the Jisr Porter.

Image 28. The Jisr Porter has a red-green-yellow colour scheme on the side of its cage, while the Rashideen and Jinah Porters have the reversed scheme: yellow-green-red.

• What does ‘W77’/’7WW’ refer to? If it is a workshop, where is that workshop located?

Image 29. A variety of ‘W77′ and one ’77W’ signs on different vehicles spotted in Syria.

• Who owns the Rashideen Porter, or who borrowed it?

You are welcome to join the digital pursuit of the vehicle by commenting under this article, contacting me via christiaantriebert@bellingcat.com or @trbrtc on Twitter.

Special thanks to Ole Solvang of Human Rights Watch and Omar Ferwati of Forensic Architecture for providing feedback on a draft version of this article. Also, many thanks to Twitter-users @ArtWendeley, @obretix, @SyrianLense and @THE_47th for flagging open source content which includes Hyundai Porters.