Eliot Higgins is the founder of the Bellingcat and Brown Moses blog. Eliot focuses on weapons used in the Syrian conflict, as well as open source investigation tools and techniques.

In the long conflict in Syria, Bellingcat has been committed to investigating a large number of chemical attacks using open source evidence, including the nature of the weapons deployed in these attacks. From modified chlorine cylinders to locally made surface rockets filled with sarin, Bellingcat revealed the nature and origin of these chemical weapons, confirming the Syrian government’s involvement in a series of chemical attacks.

After a series of sarin attacks in Al Lataminah and Khan Sheikhoun in March 2017 and April 2017, Bellingcat worked with open source evidence to slowly piece together the nature of the bombs used in the attacks. Bellingcat first released its conclusions in November 2017 and continues to build on the massive evidence it found. After the OPCW’s Investigation and Identification Team (IIT) issued a report this week that confirmed the types of bombs used in the sarin gas attacks in Latamina on March 24 and March 30, 2017, we are now They got confirmation of the type of bomb used, the Syrian M4000 chemical bomb.

In this article, we studied the evidence and process Bellingcat used to identify the same ammunition, and what it told us about the use of sarin as a chemical weapon in Syria, many years after Syria intends to destroy its chemical weapons inventory in Syria in 2013 The consequences of the sarin gas attack on August 21, 2005.

Some time after the sarin gas attack in the spring of 2017, the Bellingcat investigation team began to piece together the identities of the bombs used in these attacks. In some respects, they were simply pieced together.

After the Khan Xiehong Sarin attack on April 4, 2017, an attempt was made to determine the type of ammunition used, but the evidence was insufficient. Locals described that a bomb was dropped by an airplane during the release of the case, but only a few pieces of metal were recorded at the scene of the attack, including a metal-filled cap. This is consistent with the loading method of the sarin bomb, filling the liquid payload through such a lid, but at that time it was not possible to find items matching the lid through public sources.

Although Bellingcat started its investigation almost immediately after the attack on Khan Sheikon on April 4, 2017, our investigation into the Latamina attack on March 30, 2017 was much late. At that time, most of our time and resources were spent on the ongoing investigation of the MH17 crash. Chemical attacks in Syria have become almost commonplace, with new claims of chemical attacks occurring somewhere in Syria almost every week. Only the Khan Sheikh attack and the large number of casualties and shocking footage shared online after the attack have allowed us to renew our attention to the use of chemical weapons in Syria.

What drew our attention to the attack in Latamina on March 30 was the head of the Organization for the Prohibition of Chemical Weapons (OPCW), Ahmed Uzumku, which issued a statement to Agence France-Presse on October 4. The statement pointed out that during the OPCW’s FFM investigation of the chemical attack in Syria, sarin was found in samples collected at the attack site on March 30.

Our first article on the Al-Latamiah attack, published on October 26, 2017, examined the open source evidence and information about the attack. Some organizations, including the United Nations Independent International Commission of Inquiry for the Syrian Arab Republic and Human Rights Watch, have mentioned the March 30 attack and abnormal symptoms, but have not clearly linked the attack to Sarin. Groups that support local hospitals and clinics to receive patients after the attack, such as the Hama Health Department and the Union of Medical and Relief Organizations (UOSSM) also issued statements immediately after the attack, stating that the symptoms suffered by the victims are consistent with those exposed to sarin. But there is no clear link between it and Sarin.

However, none of these organizations have inspected the impact site or the relevant debris recorded on the scene, which is critical to identifying the ammunition used. Some videos of the March 30 attack were posted online, documenting the victims of the attack receiving treatment and the Syrian Civil Defense Department collecting evidence at the scene. One of the projects SMART TV filmed in a now-deleted video near the impact site provides a key link to the sarin gas attack in Khan Sheikon on April 4, 2017:

What attracted our attention to this fragment was the round metal object on the right side of the fragment. At first glance, this appears to be the same as the stuffed cap recorded at the site of the sarin gas attack in Khan Sheikon on April 4, which occurred a few days after the attack. Although it is impossible to measure the size of the object from the video clips posted online, we want to check whether the two hats match. We compared the distance between the two holes in the center of the bottle cap and the outer edge of the bottle cap to see if they match:

The top cover shows that the two caps overlap each other, showing that the visible holes are in the same position. This indicates that the two caps may have the same design, and the ammunition used in Khan Sheikh and Latamina is the same. This is important because the report of the OPCW-UN Joint Investigation Mechanism on Khan Sheikh pointed out that the Syrian Arab Republic was responsible for the attack, stating that the stuffing cap recovered from Khan Sheikh "is exactly the same as the Syrian chemical aviation bomb." But the question remains, what are the bombs used in these sarin attacks?

November 2017 led to some significant progress in the investigation into the nature of the Syrian sarin bomb. Ironically, the Russian Federation tried to protect its Syrian allies from allegations of using sarin.

In early November 2017, the OPCW fact-finding mission released a report on their investigation into multiple chemical attacks, including the attack in Latamina on March 30, 2017. This report includes photos of debris recovered from the Al-Lataminah attack site, including measurements of various debris. One of the fragments measured and photographed includes not one but two filling caps recovered from the attack site on March 30:

This proved to be important because the filling cap recovered from Khan Sheikh was also measured:

It can also be seen that the two sides of the bottle cap are exactly the same in design, and through measurement, the size is exactly the same:

We can now assert that the design and size of the filler cap recovered from the attack in Latamina on March 30 perfectly matched the filler cap recorded at the Khan Sheikhn impact site, OPCW-UN joint monitoring The cap is mentioned in the group report. Described as "uniquely consistent with the Syrian chemical aviation bomb."

The next major clue in our investigation is provided by the Russian Federation. In a press conference on November 2, 2017, the Russian Ministry of Foreign Affairs, Ministry of Defense, and Ministry of Industry and Trade provided various information in response to the OPCW-UN JIM report on Khan Sheikon, which they used to claim The Khan Sheikh attack is not the responsibility of the Syrian Arab Republic. In that speech, they showed a slide with schematic diagrams of two Syrian chemical bombs M4000 and MYM6000:

It is worth noting that the Russian Federation has just provided the first public details on the nature of these two types of bombs, including details of the bomb’s internal mechanism, as well as the measurement of the bomb’s width and length, which will prove to be vital to the identification of Syria The type of bomb used in the sarin gas attack in 2017. The two pictures at the top of the chart show the MYM6000 chemical bomb before and after the filling process is complete. A June 2017 Mediapart article by former members of the Scientific Research and Research Center (SSRC) described the filling process:

"This also means that SSRC engineers must also design bombs specifically for sarin, which are very different from ordinary ammunition. "On the outside, they are similar to traditional 250 and 500 kg TNT bombs," one of them explained. "But Inside they are completely different, divided into two compartments. The first one, at the front, carries DF. The second one, at the back, [contains] isopropyl and hexaamine. This mixture is stirred together by a stirring rod, which can be activated by the crank on the back of the bomb. When the two compartments are full, the technician will turn the crank to advance the stirring rod to the point where it breaks the mica wall. The sarin synthesis reaction is initiated in the bomb, placed under a cold water bath, and kept within a very precise temperature range controlled by a laser thermometer," the former SSRC source continued. "After that, all that is left is the distribution at the bomb point. Introduce explosives and detonators—altitude, timing, or other—in the cabin and place the bombs under the wing of the aircraft. The load must be measured very accurately. If it is too large, the heat released can cause the product to decompose or form a cloud of gas too far from the ground, making it ineffective. In principle, a 250 kg bomb contains 133 liters of sarin, several kilograms of TNT and a ballast to maintain the aerodynamic characteristics of the weapon. A 500 kg bomb contains 266 liters of sarin. The ideal height of the bomb explosion is about 60 meters. "

The two filling caps visible in the picture, as well as the mixing arm (green) and the barrier separating the two parts of the bomb, are the same bomb as the process described in the Mediapart article published a few months ago by the Russian Federation. This description is also consistent with the description of the filling process detailed in the recent OPCW-IIT report on the sarin gas attacks on March 24 and March 30:

"[T] The M4000 designed and manufactured by the Syrian Arab Republic is used to transport chemical agents including sarin. It is an unguided chemical air-dropped ammunition weighing 350 kg. Its internal design consists of two compartments, each Each compartment has its own filling plug, separated by a membrane composed of two discs connected to the ring. The filling plug of the front compartment is used to fill the ammunition with methylphosphonyl difluoride (DF) , And the rear plug is used to fill the ammunition with hexaamine and isopropanol. The nose part of the bomb consists of a heavy cone, which forces the bomb to lower the nose first. The fuze adapter is located in the nose part and is used to connect the fuze. There is a blast tube in the cabin containing about 3 kilograms of trinitrotoluene (TNT) explosives. A rear wing is installed on the rear compartment to stabilize the ammunition when the ammunition falls. The rear compartment is equipped with a mixing paddle, which pierces Pierce the film and mix the precursors (DF, hexaamine, and isopropanol) to prepare the ammunition for use before being loaded on the aircraft. The bomb has two lugs welded to the projectile body to fix the ammunition on the aircraft ."

With the publication of the report of the OPCW fact-finding mission on the Al-Lataminah attack, we now have more debris to inspect. This includes a second filler cap, which has the same design and dimensions as the other filler cap recovered from Al-Lataminah, and has ears attached. This is consistent with the diagram of the M4000 bomb, which shows the presence of two filling caps, one near the suspension lug:

The report also includes two large pieces of metal; a semicircular piece of metal with a small piece of metal attached to it, and the remains of what appears to be a finned tail ring:

The rear wing and ring assembly are essential for identifying bomb residues. The bombs used in the Syrian conflict rarely have the same tail ring and tail configuration. For example, the image below shows two bombs that are sometimes mistaken for the OFAB 250-270 high-explosive fragment bomb (left) and the RBK-500 cluster bomb (right):

Both bombs have 8 tail wings, with alternating tail wings extending beyond the width of the tail ring. However, on OFAB 250-270 there is a second inner tail ring where the tail ends, but on RBK-500, the tail ring ends at the bottom of the bomb. We can also see smaller details, such as the notch on the inside of the RBK-500 tail where the rear wing meets the bottom of the bomb, and the notch on the outer tip of the OFAB 250-270 tail.

For the wreckage of the attack in Al-Lataminah on March 30, we first wanted to determine the configuration of the tail fin and tail ring from the wreckage. Timmi Allen of Bellingcat created a simple fragment 3D model to establish the basic configuration of the tail fin and tail ring:

This confirms that there is a smaller tail ring inside the big tail ring, and 8 pieces of metal are used to connect the two together. However, it seems that a piece of metal fragment is missing, so only 7 pieces can be seen on this part of the fragment. It is worth noting that 4 of these metal sheets are not tail fins, but rectangular metal sheets that do not exceed the width of the tail ring. You can see the other three longer pieces of metal, alternating with the other 4 pieces, and there is a gap in the fourth piece of longer metal. These are obviously tail fins and do not significantly exceed the width of the outer tail ring.

So where is the fourth caudal fin of this missing long metal piece? The OPCW fact-finding report provides an explanation in its description of the semi-circular metal sheet:

"A triangular metal part is attached to the main body of the article. This part is similar to the side fins attached to the tail (marked 2). You can see the other three welds (marked 3) of similar length and approximately equidistant from each other. Residues. This may indicate the existence of three other equivalent objects initially."

This indicates that the two pieces of metal, the tail assembly and the semi-circular metal sheet, are the wreckage of the aircraft's tail. Not only that, the design of the tail wing is also consistent with the Russian M4000 chemical bomb map, and the tail wing does not extend beyond the outer tail ring.

There is more-using the tail fragment measurements provided by the OPCW’s FFM report, you can get an approximate measurement value for each segment, which is close to the 460 mm measurement value of the Russian M4000 chemical bomb map. According to the chart published by the Russian Federation, after reviewing a wide range of known ammunition, it can be determined that the only bomb with a publicly documented tail design and measurement is the M4000 chemical bomb.

By comparing the fragment image with the chart of the M4000, you can point out where the fragment may come from, as shown in the following figure:

Later, we were able to cooperate with Forensic Architecture to make bomb models based on the diagrams, as well as the fragment models in the OPCW Fact Investigation Report, and then modify and fit the models to show that they fully match the model based on the M4000 bomb map. :

Although by then we had many maps that matched the M4000 bomb map, and there was a link between the types of debris found in two separate chemical attacks, we still did not have any complete M4000 bomb images. Nearly two years after our initial investigation into the identity of Syria’s favorite chemical bomb, we found the last clue.

In September 2019, a Bellingcat reader contacted us and he saw the following video, which was first published on April 13, 2013:

This video shows a complete M4000 chemical bomb. However, we want to be completely certain, so we first compared the characteristics of the bomb with the M4000 map published by Russia. Obviously, the tail matches the debris recovered from Al-Lataminah, and there are two filling caps, as well as the two suspension lugs detailed in the picture, but we also need to measure the bomb. We created a 3D model of the bomb in the video and used the measured value of the filling cover we investigated to measure the width of the bomb. According to these ratios, the width of the bomb is 460 mm, which is consistent with the measurement results. The M4000 announced in Russia In the chart:

A second opinion is needed. We also asked Forensic Architecture to conduct its own measurement of the bomb. Using photogrammetry, they created a 3D model, and then based on the early measurement results of the previous attack, assuming that the width of the filling cap is 107 mm, and then measured it. Again, this shows that the width of the bomb is 460 mm:

In addition to the larger features that are clearly matched, such as the fuel filler cap, suspension lugs and the design of the tail section, the new smaller matching details become apparent. In the picture below, we can see that at the thinnest end of the tail, it does not end at a point flush with the main body of the bomb, but at a right angle. This is a relatively small feature, but it shows consistency with the fragments recovered from Al-Lataminah and the full M4000 bomb recorded in the April 2013 video:

This and many other characteristics confirm the identity of the bomb as M4000, and the fragments of Al-Lataminah perfectly match the bomb, and the latter itself matches the M4000 chart published by Russia.

There is also an interesting connection with the Khan Sheikhoun Sarin attack on April 4, 2017. There were very few fragments recorded at the scene of the Khan Sheehong attack, one of which was a filling cap that perfectly matched the M4000 filling cap. Another fragment, a folded metal (shown below) caused a lot of controversy. Some people claim that this is actually a metal tube, either part of a rocket, or a tube filled with sarin with explosives to release the sarin.

It is difficult to explain how exploded ammunition produces a piece of folded metal, especially when it appears to be folded inward instead of outward, as you would expect from an explosion. The April 2013 bomb provided a possible explanation. In the video, there is a very clear, sharp bulge around the part where the bomb begins to bend forward. According to the schematic diagram of the M4000 bomb, this part contains explosives and heavy ballast, and the fold seems to be behind this heavy part:

When we investigated, we found that this was not the only example of the M4000 bomb wreck recorded before the 2017 attack. The second video released in 2014 shows the remains of the M4000, with the same fold behind the heavy part of the bomb:

This will support the theory that the fragments recovered from Khan Xiehong are not metal pipes or pipes, as some people insist, but formed during bomb impact, because the thin metal of the bomb shell is folded behind the heavy ballast at the front of the warhead.

The video above is also interesting because it also seems to confirm at least one statement made by the Syrian government regarding the M4000 bomb. The OPCW’s IIT report contains the Syrian government’s claim that some of its chemical bombs have been reused as conventional bombs. The video above shows the lack of a rectangular part on the side of the bomb and some kind of solid filler. This may be one of these repurposed bombs. The solid filler is the new explosive added to the bomb. Although it was opened, no chemical attacks were reported at the location around the day the video was filmed, so it seems unlikely that the person who recorded the bomb would associate it with a chemical attack.

These earlier videos led some to claim that this actually proved that the Syrian rebels could use these earlier bomb remnants to fake the attacks of Khan Shekhon and Latamina. The OPCW IIT specifically mentioned this statement in their report on the Al-Lataminah attack:

“In order to determine the possible source of the sarin released during the Ltamenah incident in March 2017, IIT took some steps. At the request of the IIT, a part of the chemical ammunition mixing paddle system used on March 30, 2017, The internal components and residues of the plug were sampled and analyzed. Experts described the "intact (unopened) nature" of the two filling plugs, and the outer body of the stirring paddle system was split. The three wrecks were difficult to open. The possibility that sarin gas (and/or other compounds that indicate the presence of sarin gas) consistent with the type of sarin gas developed in the Syrian Arab Republic is added to all three ammunition residues to "perform" a chemical attack is Therefore, it is extremely low. In addition, when a part of the agitator system is turned on, IIT can observe grease. According to experts consulted by IIT, what binary sarin compound is needed to lubricate the shaft of the agitator during the mixing process."

In view of the evidence gathered from the sarin gas attacks in Al-Lataminah on March 24 and March 30, it is believed that these attacks were staged—especially when no opposition groups were reported in March. The attack on the 24th, and the March 30th attack is rarely reported, mentioning the meticulous and extremely complicated preparations required for a forgery attack-so it is completely absurd.

The open source evidence and the current OPCW IIT report tell us that although the Syrian Arab Republic has acceded to the Chemical Weapons Convention and claimed to have declared all stocks to the OPCW, Syria continues to use chemical weapons, including regular weapons. It was the bomb it declared to destroy, poisoning its own people.

Your donation to Bellingcat is a direct contribution to our research. With your support, we will continue to publish groundbreaking investigations and expose illegal activities around the world.

In addition to the content we have published, we will also introduce readers to the activities our employees and contributors participate in, such as noteworthy interviews and training seminars.