Fresh Evidence of Sarin Use by Syrian Government Forces from the OPCW

A new report from the OPCW Fact Finding Mission (FFM) has established that Sarin was more than likely used as a chemical weapon in the town of Al-Lataminah on March 30th 2017, less than a week before the April 4th Khan Sheikhoun Sarin attack the OPCW-UN JIM recently reported was executed by Syrian government forces. Details in the OPCW FFM report show a number of similarities between the April 4th and March 30th Sarin attacks, including the type of munition used. These details strongly indicate that, as with the Khan Sheikhoun attack, an airdropped bomb was used, with many more remains of the munition recovered from the Al-Lataminah attack site, some of which match with remains recovered from the Khan Sheikhoun attack site, and clearly originate from an airdropped munition.

The attack has previously been covered in the UN’s Independent International Commission of Inquiry on the Syrian Arab Republic’s most recent report on the conflict, which concluded Syrian government forces were responsible, but did not state the exact type of chemical agent used:

“At around 6.30 a.m. on 30 March — five days after the chlorine attack on Al-Latamneh hospital by Syrian forces [Bellngcat’s report] — an unidentified warplane dropped two bombs in an agricultural field south of Al-Latamneh village. Interviewees recalled how the first bomb made almost no sound but released a “toxic material” absent any particular smell, while the second bomb caused a loud explosion. As a result of the former, at least 85 people suffered from respiratory difficulties, loss of consciousness, red eyes and impaired vision. Among the injured were 12 male farmers located 300 metres away from the impact point, 2 of them minors. Nine medical personnel who treated patients without protection also fell ill.”

“While the Commission is unable to identify the exact agent to which the victims of the 30 March incident were exposed, interviewees described certain symptoms, including a very low pulse in one case, and contracted pupils, suffocation, nausea and spasms in another, that indicate poisoning by a phosphor-organic chemical, such as a pesticide or a nerve agent. The absence of a characteristic chlorine odour, coupled with secondary intoxications among medical personnel treating victims, supports the conclusion that a toxic chemical other than chlorine was employed. Given that Syrian and Russian forces were conducting an aerial campaign in the area, the absence of indications that Russian forces have ever used chemical weapons in the Syrian Arab Republic, and the repeated use of chemical weapons by the Syrian air force, there are reasonable grounds to conclude that the Syrian air force used chemical weapons in Al-Latamneh on 30 March.”

The newly released OPCW-FFM report states the following about the attack:

1.4 Given limitations in some of the evidence, the FFM has not been able to determine with absolute certainty the use of a chemical weapon.  Nevertheless, sufficient facts were collected to allow the FFM to determine:

(a) the presence of sarin on samples which came from the alleged site of the incident;

(b) that casualties from that site and time period displayed symptoms and received treatment consistent with exposure to sarin; and

(c) that munition parts from the alleged site of the incident were consistent with application in a chemical weapon.

1.5 Therefore, the FFM is able to conclude that sarin was more than likely used as a chemical weapon on 30 March 2017 in the south of Ltamenah.

The OPCW-FFM report also states that they were unable to visit the site, and their conclusions “were derived from the analysis of interviews, supporting material submitted during the interview process, analysis of environmental samples, and subsequent cross-reference and corroboration of the evidence.” It also states:

“The FFM looked at the combination, consistency, and corroboration of the evidence gathered as a whole, rather than the individual items of evidence taken in isolation, in order to reach its conclusions.”

The report also lists open sources in the annexes, many of which were examined in an October 2017 Bellingcat article, along with witness statements and evidence provided by witnesses to Bellingcat. The OPCW-FFM reports that after an incident was reported in Al-Lataminah on March 25th 2017 (a chlorine attack on a hospital documented here by Bellingcat) the FFM investigated open source information, and identified additional allegations in the Al-Lataminah area, including the March 30th attack. Witnesses were contacted through liaison with representatives of several NGOs, including Same Justice/Chemical Violations Documentation Centre Syria (CVDCS), the Syrian Civil Defence (also known as White Helmets (SCD)), the Syrian American Medical Society (SAMS), and the Syrian Institute for Justice (SIJ).

Physical samples were also received by the OPCW-FFM, with soil samples provided on April 12th. Based on witness statements further samples were gathered, including potentially relevant munition parts, which were received by the OPCW-FFM on July 17th and August 17th. Annex 3 of the report indicates environmental samples and remains of the munition were provided by Syrian Civil Defence (SCD), who documented the collection process. Collection of samples on March 30th featured in videos published on YouTube after the attack:

As noted in the earlier Bellingcat report on the March 30th attack, the SCD members collecting samples in the March 30th videos are using the same equipment as the SCD members filmed collecting samples from the site of the April 4th Sarin attack in Khan Sheikhoun. Other videos provided to Bellingcat by the SCD also shows the collection process in July, and screenshots from those videos feature in the OPCW-FFM report.

As well as the witness statements and samples from the site, the OPCW-FFM collected biomedical samples from two victims on July 29th. The report acknowledges that samples taken so long after the attack were “very unlikely to test positive for exposure to organophosphorus chemicals, even if a person had been exposed.” As a result, no biomarkers relating to exposure to an organophosphorus based nerve agent were detected in blood or hair samples from the two victims.

The OPCW-FFM narrative begins with the attack occurring at approximately 6:00am, with the sound of a jet followed by the sounds from four air delivered munitions, consistent with other reporting on the attack. The report states that:

“The third detonation had a different, quieter, characteristic than the other three, with no odour and associated smoke being unlike other attacks.”

A video filmed by a local cameraman and posted online at 7:17am on the day of the attack shows airstrikes on the town, with the noise of aircraft clearly audible. In the video, the cameraman states the air force is bombing the town, and the date is March 30th. The video has been geolocated, and the direction of the visible smoke is in line with the impact site, but it is unclear if this relates to the chemical munition used, or one of the other 3 munitions used. Due to the short period of time between the time of the attack and the video being published, as well as the statement of the date in the video, it is very likely this shows aerial activity on the morning of March 30th between dawn at around 6am and the video upload time at 7:17am:

The impact site was located in the OPCW-FFM report as an area 500m south of the town, at a location that matches Bellingcat’s earlier geolocation of the impact site:

The OPCW-FFM report refers to witnesses being in nearby caves at the time of the attack, which may refer to the tunnels about 200m north of the impact site that have been used by rebel forces, and featured in multiple bombing videos published by the Russian Ministry of Defence since September 2015. It has not been possible to establish through open sources if there are other caves or tunnels in the area. The OPCW-FFM report goes on to describe the area as “a military area co-located with arable farming”, and that it was “predominantly occupied by combatants of an armed opposition group (AOG)” with a “small number of agricultural workers [were] also present in the area at the time”. This is consistent with some of the witness statements made to Bellingcat, such as Dr. Mahmoud Abbas, who stated there were civilians and fighters among the victims. One witness interviewed by Bellingcat stated he believed the farmers had been targeted, but it is reasonable to conclude the actual target were the caves used by armed groups in the area.

A table of witnesses can be found in the report:

The OPCW-FFM describes the scene as witnesses exited the caves:

“people were shouting and “falling down”.  Casualties were shaking, shivering, foaming and becoming increasingly unresponsive.  Attempts were made to rescue and evacuate casualties by witnesses and by others.  Witnesses describe how rescuers also started falling down, before they also lost consciousness.  The witnesses estimate the time between exposure and loss of consciousness as ranging from approximately 5 minutes in one case to around 30 minutes in another.”

The victims of the attack were taken to multiple hospitals in the area, described as MF-A, B, C, D and E in the OPCW-FFM report. The report includes a breakdown of symptoms in 16 victims as reported by MF-A:

Miosis (constricted pupils) is one of the signs of exposure to Sarin, and is visible in some of the videos and photographs taken at hospitals treating victims on March 30th:

One of the inconsistencies in earlier reporting on the attack may be explained by victims being sent to different medical facilities. The OPCW-FFM report states the numbers of individuals sent to these facilities, with “approximately 65 being transferred to MF-C, approximately 40 to MF-D and 40-50 to MF-E.  Sixteen casualties (all male) remained at MF-A for treatment, prior to transfer to other medical facilities within one hour.” Different sources had stated different numbers for individuals treated, from 30 to 169, and this wide range in figures may be explained by confusion over the exact number because they had been sent to different medical facilities.

The OPCW-FFM report also notes that at MF-B 3 victims were recorded as being diagnosed with chlorine intoxication. Some initial open source reports shortly after the attack had occurred had stated chlorine had been used, which may have been an assumption based on multiple chlorine attacks being reported in the previous week in the same town, and the OPCW-FFM states the following about the chlorine intoxication diagnoses recorded at MF-B:

“The FFM noted the diagnosis of “chlorine intoxication” and was informed, in several interviews, that when a significant number of patients present at hospital with apparent chemical intoxication, there is an assumption that the chemical intoxication is related to chlorine. Although after further assessment a more detailed prognosis may specifically rule out chlorine intoxication, the initial prognosis still remains on the records.”

The OPCW-FFM includes details of where items and samples around the impact site were filmed and photographed during the recovery process:

5 images are from video footage filmed of the collection process in July, viewed by Bellingcat, and the bottom right image shows the collection of samples on March 30th. It should be noted that while one location is described as a crater, this is unlikely the crater from the Sarin bomb impact, which is in the area marked as the “debris collection area”. The impact location is described in the OPCW-FFM report as follows:

“The impact point, relating to the third detonation was estimated by witnesses to be 1 1.5 m in diameter and approximately 25 cm in depth. Vegetation appeared burnt and faded for about 20-30 metres and was noted as different to the vegetative damage typically associated with chlorine. “

This area showing burnt and faded vegetation is visible in videos from March 30th, and has been geolocated to the “debris collection area” marked in the above map:

Unusually, the OPCW-FFM report includes photographs of each item tested by the OPCW-FFM, and these items are visible in some of the open source videos, as well as the July footage filmed during the collection of munition debris. Multiple chemicals were detected in these tests, including Sarin, DIMP, IMPA, MPA, HFP, DIPF, DIPP, and hexamine, which were also detected in samples from the Khan Sheikhoun chemical attack. Hexamine is of particular interest as it has been previously detected in samples from the 2013 Saraqib Sarin attack, August 21st 2013 Sarin attacks in Damascus, and the Khan Sheikhoun attack, were the OPCW-UN JIM report stated the following:

“The analysis results of OPCW designated laboratories confirm the presence of sarin and some of its known degradation products (see OPCW document S/1521/2017, as well as United Nations documents S/2017/567 and S/2017/440). Moreover, the results confirm that sarin was produced by the binary route, in which DF is combined with isopropanol (iPrOH) in the presence of hexamine.”

Another significant chemical detected in the Al-Lataminah samples is Isopropyl phosphorofluoridate (iPPF), detected multiple times in tests of munition debris. This chemical is one of three “marker chemicals” described in the OPCW-UN JIM report that indicate the Sarin originated from the Syrian governments manufacturing process:

“The samples from Khan Shaykhun contain the three types of marker chemicals described above: PF6, isopropyl phosphates and isopropyl phosphorofluoridates. Their presence is a strong indicator that the sarin disseminated in Khan Shaykhun was produced from DF from the Syrian Arab Republic stockpile.”

HFP aka PF6, another chemical detected and described in the OPCW-UN JIM report as a marker chemical, and an indication the Sarin was produced as part of a sophisticated manufacturing process, is also present in samples.

Another connection between the Khan Sheikhoun attack and Al-Lataminah attack is the remains of an item that is identical in design to a filling cap recovered from the crater in Khan Sheikhoun.

The OPCW-FFM report describes the item:

“07SDS consists of a circular object (labelled 1) attached to a metal plate (labelled 2). It is heavily corroded and the metal plate is bent and deformed. On what appears to be an outer side, dark green colour is partially visible. The circular object on the topside has a metal lid (labelled 3) with two holes (labelled 4), probably for a mount using a fork key. The distance between the two holes is approximately 35 mm.

On the other side, which appears to be the internal side of the system, three circles are visible (the innermost circle is not visible in the photograph). On this internal side (the side without visible colour markings), the respective diameters of the circles are approximately 105 mm, 60 mm and 50 mm.

The thickness of the circular object is approximately 35 mm. The metal plate to which it is attached is roughly 5 mm thick and is ruptured on all sides. One side has a very straight cut.”

The OPCW-UN JIM report describes the item recovered from the Khan Sheikhoun crater:

“According to information obtained by the Mechanism, the filler cap, with two closure plugs, is uniquely consistent with Syrian chemical aerial bombs. The Mechanism was provided with an assessment of the filler cap and with chemical analysis showing sarin and a reaction product of sarin with hexamine that can only be formed under very high heat. Information was also received that additional metal fragments collected from the crater may possibly correspond to parts of Syrian aerial chemical munitions.”

The Khan Sheikhoun cap was measured and found to be approximately 105mm wide, with diameters of the other visible circles being approximately 60mm and 50mm, identical to the measurements of the item recovered from the Al-Lataminah attack site:

The other side of the cap from Khan Sheikhoun was photographed, and while only one hole is visible because of the presence of an unidentified substance on the cap, the hole is in the same position in relation to the outer edge as the holes on Al-Lataminah item:

It’s also notable that the position of the metal plate the items are attached to are in both examples closer to the side with two holes in it. It is highly probable that these two items come from the same type of munition, and based on the OPCW-UN JIM report, we can assume this is part of the airdropped munition used in both attacks.

A second cap was recovered from the impact site, this one attached to a lug:

“03SDS(B) consists of circular part attached to the other, hook-shaped piece of metal. It is heavily corroded however, on the lid of the circular part, and on the welding of the hook-shaped part it is possible to see traces of dark green paint. The circular part looks very similar to the circular part of sample 07SDS (see previously) and has very similar dimensions. The dimensions are therefore not repeated here.

The upper part has a circular lid still attached to the assembly. On the lid there are two symmetrical holes, most likely for a fork key or similar such tool used to tighten it. The other part is welded on the base material, to which is also attached a lug shaped piece of metal. The deformations are consistent with the item being torn off the main system.”

This is identical to the other cap, and is connected to what is likely a suspension lug, which indicates this is an airdropped munition. As it is identical to the cap recovered from Khan Sheikhoun this lends further weight to the claim the Khan Sheikhoun munition was airdropped.

Based on this the other items recovered from the Al-Lataminah attack site become far more interesting, potentially allow the munition to be identified by OPCW-UN JIM inspectors, allowing them establish the exact munition used in both attacks. The first item is a large sheet of metal:

“01SDS (Large metal piece, see figure A4.1 above) is a large semi-circular metal piece. It is heavily deformed and corroded, particularly on what appears to be the inner side. On the item surface, traces of grey and dark green paint are still visible. The item is approximately 900 mm in length and 300 mm in width. The longer edge of the item has been reinforced (labelled 1). The thickness of the metal plate is approximately 5 mm.

A triangular metal part is attached to the main body of the item. This part resembles a tail attached side fin (labelled 2). The remains of three other welds (labelled 3) of similar length and approximately equidistant from each other can be seen. This may indicate the original presence of additional three equivalent objects. “

Based on above description this appears to be part of the tail section of the munition. The area marked 1 would meet the main body of the munition, while the tail fin would extend past the end of the tail section. If the 900mm includes the entire measurement of the circumference of the munition, then the diameter would be around 285mm. The OPCW-UN JIM cited experts as stating the following about the Khan Sheikhoun munition, for which this same type of debris was not available for measurement:

“Examining the munition remnants observed inside the crater, the forensic institutes and individual experts concluded that the remnants were pieces of a thin-walled munition of 300 to 500 mm in diameter and were likely from an aerial bomb.”

Update – It in fact appears the 900mm measurement is a straight line measurement, meaning the munition would actually be far larger than 285mm in diameter:

The 3 other welds equidistant from each other and the remaining tail fin would suggest the munition would have a similar tail section and tail fin arrangement as an OFAB-100-120 high explosive fragmentation bomb:

Another piece of debris recovered shows the end of the tail fins:

“01SDS(B) is a large corroded and deformed metal object. Despite the corrosion, it is still possible to see layers of dark green and grey colour. It is also possible to see a smaller inner ring in the middle, linked by seven metal parts to a larger, outer ring. Four of the parts that are linking rings are rectangular. The other three are much larger and triangular. The spacing between the three parts, in addition to indications on the rings, point to one missing larger triangular part.

This is consistent with an aerial bomb tail fin assembly.

The FFM took numerous measurements of this item. Given the level of deformation, these measurements are only approximate dimensions. These approximate dimensions have not been included.”

As with the OFAB-100-120, there appears to be 8 piece of metal connecting an inner ring to an outer ring. 4 are triangular tail fins, 4 are connecting rectangular pieces. One significant difference between the OFAB-100-120 tail fins and the tail fins recovered from Al-Lataminah is the triangular sections do not extend beyond the edge of the outer ring. It also appears the inner ring is smaller, although it is too badly damaged to be certain. Based on this it is possible to establish the bomb used in Al-Lataminah is not an OFAB-100-120. As yet, a matching type of bomb, approximately 285mm wide with this tail fin configuration, has yet been found.

Other items recovered include a Russian АВУ-ЭТ impact fuze:

“09SDS is a heavily deformed and damaged metal object. On the both sides threads are visible. This part also bears visible markings which point to a universal bomb fuse. The fuse has been activated and does not contain explosive material. This device is normally electrically armed, heat resistant, and can function as point detonating or with delayed action. It is used on a large number of aerial bomb types by numerous nations.”

It appears that the fuze is attached to a fuze housing, and tests on the object revealed Sarin, DIMP, IMPA, MPA, HFP, and Hexamine. If this is the fuze used on the bomb, then the bomb would be detonated on impact, rather than airburst, as some people have proposed it must be.

Another item appears similar to another item in the Khan Sheikhoun crater:

“12SDS is similar to a metal rail, approximately 550 mm long, with a square shaped cross section. It is heavily corroded with eight equally distributed holes visible on one side and traces of grey colour. Some of the holes still contain broken bolts inside. The width of the side with holes is approximately 30 mm, thickness is approximately 20 mm and the distance between two holes is approximately 65 mm. On one side there is an attached layer of metal, which is approximately 5 mm thick.”

This item appears to be similar to an item photographed in the Khan Sheikhoun crater, although there are no measurements of that item, or detailed photographs:

Based on the OPCW-FFM report and open source information it is possible to state that it is highly probable the same type of airdropped munition was used in both attacks, with the same type of Sarin used in both attacks, previously linked to the Syrian government in the recent OPCW-UN JIM report. The additional debris recovered from the Al-Lataminah impact site will hopefully provide enough information to investigators to identify the munition used in both attacks.