The death of Muhammad Gulzal-bellingcat

2021-11-24 03:06:32 By : Ms. Claude Hu

Nick is a former British Army officer and open source analyst. He has a special interest in the conflict in Syria, social media, civil society, intelligence and security. Contact via Twitter: @N_Waters89

Today, in collaboration with Lighthouse Reports and Forensic Architecture, based on reports by Der Spiegel and research by Pointer and Sky News, we released a survey that indicated that the Greek security forces may have attacked refugees and immigrants trying to break in on March 4, 2020. There was a live fire. Go through the Turkish-Greece border fence. We determined that 7 people were injured in approximately 40 minutes, and one of them died later. His name is Mohamed Gulzal.

On February 27, 2020, the Turkish government opened its border with Greece in an attempt to exert political pressure on the EU on the Syrian issue. Thousands of immigrants and refugees have been concentrated on a single point on the land border between the two countries and are expected to open up an open route to Europe. 

In response, the Greek government deployed police and troops to the area. Immigrants were warned not to try to cross the border, and the country suspended the asylum system.

On March 4, after several days of tension, violence at the Kastanies-Pazarkule border escalated. There have been reports of shooting incidents and casualties. Turkish authorities stated that the Greeks “used live ammunition and wounded five asylum seekers”. The Greek authorities condemned these claims as fake news. There is no universally accepted statement about what happened that day. This investigation is thorough, long-term and multifaceted, watching, analyzing, checking and rechecking hundreds of images and videos to determine what happened that day as accurately as possible. This article will explain our methodology in detail and explore the techniques we used in the investigation process. Unless otherwise stated, all times are in Turkish. Note: This survey contains graphic images. 

One of the most challenging aspects of this case was to ensure that we collected as many videos as possible during the initial phase of the investigation. Anyone who has used social media will be familiar with important content that has disappeared for various reasons. Knowing this, we make sure to discover, record and download all potentially relevant videos. This includes videos taken before, during, and after March 4.

We use date restricted searches across multiple platforms (including Facebook, Twitter, Youtube, TikTok, Instagram, and Whatsapp) to search for keywords. The search is conducted in Arabic, Turkish, Greek, English, Persian and Urdu. We contacted people who were there that day, including those traveling with Gulzar, and asked them to provide more videos. We use Hunchley to save these open source evidence in case they are deleted later.

The end result was a collection of hundreds of images and videos related to the investigation. Despite this, we know that we did not capture all the videos taken that day. In many of the videos we have obtained, we can see other people with mobile phones, who have recorded scenes that are useful for our investigation. Unless more people come forward, these videos and images are likely to remain on personal mobile phones or private messaging groups.

The act of discovery itself provides the first level of contextual knowledge needed to determine what happened that day. Watching these videos allows us to identify similar scenes shot from different angles, or to see the same number of casualties as they were taken to the area. We started to piece together the puzzle.

In this content, we begin to identify the same casualties seen in multiple videos and images. Not only by identifying their clothes, but also by evacuating their unique injuries and blankets used as temporary stretchers, these casualties can be tracked throughout the scene.

Casualties: clockwise from the upper left corner: casualties 1 (source), casualties 2: Muhammad Hantu (source request), casualties 3: Zishar Omar (source), casualties 4 (source request), casualties 5 (source), number of casualties 6 (source on request)

Although we quickly identified six casualties, Gulzar was the most difficult to find and identify. We finally found a video where he can be clearly identified by his clothes. This clip also allows us to discover that he was actually caught in three other videos.  

Thanks to the images, videos and testimonies shared by Gulzal’s widow Shaba Khan with us, we can see Gulzal wearing very unique clothes when he was at the border: black leather boots with zippers on the sides, blue with patches on the knees. Color jeans, gray striped top, gray sweater and black jacket. In video 43, the black jacket, ripped jeans and black boots are clearly visible.

Left: A photo of Gulzar at the border on February 29 (Source: Sabah Khan) Right: A still from Video 43 

It is further confirmed that this video describing Gulzal was provided by photos of him after he was shot dead. These photos were released by the Chairman of the Human Rights Investigation Committee of the Turkish Parliament and members of the AKP. These two photos clearly show Gulzal's face, his gray sweater, shorts under his pants, and the wound on his side.

Left: Video 43, Right: After Gulzar was shot (source)

These matching images were provided by Sabah Khan to Gulzar's clothes after being removed in the hospital.

Left: After Gulzar was shot (source), right: Picture of Gulzar's striped top (source: Sabah Khan)

Left: Video 43, Right: Picture of Gulzar's boots (Source: Sabah Khan)

These videos prove that Gulzal was at the border that morning and was indeed injured shortly before 1030 in the morning. The live witness testimony collected by Der Spiegel, photos of Gulzal after his injury, and Gulzal's death certificate all show that Gulzal was shot and killed.

Once we have collected the videos that we think show the events of March 4th, we need to place them in time and space. This method is called geolocation. 

Initially, it was difficult. The area around the Greek-Turkish border is flat farmland, and there are almost no reference points except for the Greek-Turkish border post.

However, by carefully examining these limited reference points, including more obscure details such as the color of the field and the direction of the furrow, a comprehensive model of each video shooting location can be built. This is due to satellite images of the region provided by Planet Labs in March.

For example, this is video 33.

In order to geo-locate the scene in the 01:22 video, we made a panorama of the stills to allow us to better understand the surrounding environment of the camera. We can clearly see a long slender green field surrounded by brown fields on three sides. We can see that there is a bush on the left side of the green space, which seems to extend along part of its length, while on the right side, in the camera's field of view, there is a low circular concrete structure. These features are consistent with the fields seen in the satellite image taken on March 13, 2020.

Top: Video 76, Bottom: Satellite image taken on March 13, 2020, provided by Planet Labs

This allows us to place the camera at coordinates 41.649408, 26.496010.

This process is carried out on each video we collect, placing them in the space. In doing so, we conducted a comprehensive observation of a piece of land around the fence from the border gate to the south one kilometer. Then put these videos into a 3D model built by Forensic Architecture.

A large number of videos depicting the chaos of the scene initially posed a challenge.

After the discovery, we identified a total of 7 hours and 48 minutes of videos that are directly related to the time period we are interested in, which is the morning of March 4th. We placed 39 of them in space and time, and carefully analyzed 24 of them to construct an accurate timeline. Many other videos are related to the investigation, but they were all shot outside of this time.

Among these videos, we posted multiple live broadcasts on Facebook. Although Facebook won’t tell you when the live broadcast starts, it’s easy to find. All Facebook videos contain a Unix timestamp, which can be easily accessed by inspecting elements in the web page. Just convert this unix timestamp to UTC, and we can determine the shooting time of the live broadcast to the nearest second.

Many of these live streams did not show anything significant, but they did capture details that act as time stamps, allowing us to place other videos related to them. 

The most prominent of these marks are the different patterns of gunfire. The same different patterns can be used as time stamps across multiple videos, allowing us to correlate them with each other.

Other details can be used as time stamps, including notifications through speakers, vehicle horns, and the time when certain casualties have passed through specific geographic points. Using these tags, we can place the videos we collect in a timely manner. Facts have proved that this combination of real-time streaming and time stamping is very effective and can generate timelines with an accuracy of up to one second.

Example of the timeline part. The horizontal block is the video, and the blue line is the time stamp

This level of accuracy even allows us to recognize that the photographer's EXIF ​​data is incorrectly set on his camera. We obtained two photos taken from the Greek side of the border, showing Greek soldiers in a row behind the fence. EXIF ​​data indicates that these photos were taken at 11:32 am Turkish time.

In other videos collected around 10:40 am Turkish time, the positions of several people that can be identified in these photos are exactly the same. For example, two men appear in the photo, one of them holding a light brown bag. The same two people can be seen in the two videos, which depict them in exactly the same position. 

Above: Two men appearing in the photo (Image source: Socrates Baltagiannis), Below: Video 16 and Video 32 (source available on request)

We asked the photographer to double check his EXIF ​​data, and then he confirmed that the data was about 50 minutes later than it should be.

Once these videos are placed in time and space, it is obvious that in about 40 minutes, from 10:20 am to 10:57 am Turkish time, 7 people were injured. These people were initially injured in four discrete incidents in different locations:

Casualty 6: Location unknown before 10:27 AM 

Muhammad Gulzar: Approximately 10:30 am, at 41.651439, 26.492400

Casualty 2 (Mohammad Hantou), Casualty 3 (Zishan Omar), Casualty 1 and Casualty 5: 10:39 am – 10:42 am, near 41.648675, 26.495926

We created a Google My Map where you can view the route of these people when they evacuated.

Was live ammunition used that day?

Although the Greek government dismissed reports of casualties caused by fires in the Greek army on its borders as "fake news," we also clearly pointed out that 6 people were injured and 1 died that day. "Der Spiegel" interviewed several witnesses and heard in the video claiming that the Greek army is using live ammunition. We also obtained Gulzar's death certificate, which stated that his injuries were caused by 5.56mm bullets.

When a supersonic bullet is fired, it produces two distinct sounds: the sound of the muzzle explosion and the shock wave of the bullet. Since supersonic bullets, such as 5.56mm, travel faster than the speed of sound, people in the line of fire first hear the "cracks" caused by the bullet shock wave, and then a "bang" muzzle explosion. Some of the videos we collected seem to contain audio features of live ammunition. We sent several videos that appeared to contain this signature to audio forensics expert Steven Beck. In most of these videos, the sound quality is too poor to clearly identify the characteristics of live ammunition. However, the analysis concluded that one video contains the unique acoustic characteristics of the live round: Video 25.

Video 25 captures the moment wounded 4 was filmed at 10:57 AM. At least four different videos captured the event from different angles, two on the Turkish side and two on the Greek side-however, Video 25 is the closest video to the event to date. These videos show that a fire broke out on the fence line at about 10:52 in the morning, most likely caused by immigrants trying to break through the fence. When Greek police and soldiers went to the location to ensure safety, a fire truck arrived at the scene. When the fire truck arrives, video 25 begins. The migrants on the Turkish side threw stones at the fire truck. A series of gunshots sounded, and the photographer exclaimed, "Gunshots from the Greek army...I saw someone shot!". Through audio forensic analysis, it was this continuous shooting that was determined to be live ammunition.

The spectrogram of the lens in video 25. Each red dotted line highlights a lens (Source: Beck Audio Forensics)

These shots contain the unique characteristics of the "crack" of the supersonic bullet, followed by the "pop" of the muzzle explosion.

The spectrogram of the lens in video 25. The red frame highlights the "cracks" of the supersonic bullet, while the yellow frame highlights the "pop" of the muzzle (Image source: Beck Audio Forensics)

Since the time between the sound of the muzzle explosion and the sound of the bullet passing through the microphone is short, the shooter must have been close to the camera, about 40-60 meters. The energy of the bullet shock wave indicates that the bullet was fired from a rifle. The only people we have identified in this range with rifles or machine guns capable of firing such bullets are the Greek security forces.

Video 25 The position compared to the fence and the Greek soldiers

In fact, in the video taken that morning, we could not find any Turkish security forces on the fence line near the border post. However, that morning, Greek soldiers and police clearly appeared in the extension of the border fence. Many of them were equipped with M4 and M16 rifles and Minimi light machine guns, all of which fired 5.56mm bullet types that allegedly caused fatal damage to Gulzar.

A weapon capable of firing 5.56 mm bullets carried by the Greek army that day

Although we used shots before and after March 4th to understand our own context, we did not include shots where we were unable to verify or show events on different dates. 

For example, the video appears to show a Greek soldier firing his miniature light machine gun in the direction of immigrants behind the border. This video can be geolocated, indicating that it was indeed shot at the Pazarkule-Kastanies border crossing, but the date or time of shooting could not be determined. Similarly, the video of this man with a pistol apparently evading shooting was used by multiple accounts to make various claims about the actions in Turkey. Although we were unable to geo-locate or time-locate it, we were able to exclude it near the Pazarkule-Kastanies border crossing. The weather also indicated that the video was shot at a different time: unlike the gray and cloudy days on the morning of March 4, the video was shot in bright sunlight.

It is always necessary for open source investigators to make ethical decisions about what information to release and what information to keep. Bellingcat had previously chosen to edit the names of some Russian crew members related to the Buk that shot down MH17, even though we provided JIT with their full names. 

Similarly, we chose not to publish the complete list of 305 names that we found related to GRU.

From the very beginning of the investigation, it was clear that we must make careful ethical choices about how to deal with certain information. A group of fragile people have been involved in the conflict between the two countries, and neither country seems to have their best interests in mind. However, we also believe that it is in the public interest to show what happened as accurately as possible, and open source is one of the best materials to do this.

As many others have pointed out, although one person may post content online, the act of sharing content to a personal Facebook page is different from posting content on multiple platforms with an international audience. Although in theory both are publicly accessible, the latter represents an exponentially higher level of exposure. 

This difference in expected exposure creates a duty of care for the platform that publishes it. At the same time, we recognize that open source materials have captured serious unfair evidence, which is actually evidence that may lead to legal proceedings.

Therefore, we made certain decisions about the material we used for this film. We currently do not intend to disclose our complete source list. When it comes to the sources we use, we choose to hide some identities, including social media handles and faces, which may put the person at risk. This includes the Greek soldiers photographed at the border that day: we hope to be very clear that we do not accuse any particular Greek soldier of shooting. We have included photos of these soldiers to demonstrate their weapons capabilities. For any legal cases or inquiries that may result from this investigation, all information will be provided in full.  

The large amount of open source evidence we have collected, combined with witness testimony and expert assessment, clearly shows that on March 4, many people were shot and killed at the Greek-Turkish border. One of them named Muhammad Gulzar (Muhammad Gulzar) later died. In an incident at 1057 in the morning, we can determine that a young man named Wounded No. 4 was injured; the live rifle was fired from a distance of 40-60 meters, and the Greek soldiers were within that range. Despite the large number of videos from the Turkish border, during the 40-minute period when people were injured, we were unable to identify anyone holding a rifle near the Turkish border post.

Several witnesses reported that the Greek army fired live ammunition along the fence line that day. This echoes the testimony of a witness who claimed to have seen Gulzal shot by the Greek army. His death certificate stated that he was killed by a 5.56mm bullet.

We call on the Greek authorities to conduct a full investigation into this incident to determine who was responsible for the killing of Mohamed Gulzal.

Your donation to Bellingcat is a direct contribution to our research. With your support, we will continue to publish groundbreaking investigations and expose illegal activities around the world.

In addition to the content we have published, we will also introduce readers to the activities our employees and contributors participate in, such as noteworthy interviews and training seminars.