The Open Source Hunt for Syria's Favourite Sarin Bomb

Throughout Syria’s lengthy conflict, Bellingcat has worked to investigate a large number of chemical attacks, including the nature of the weapons deployed in those attacks, using open source evidence. From modified chlorine cylinders to locally made surface to surface rockets filled with Sarin, Bellingcat has revealed the nature, and origin, of these chemical weapons, confirming the Syrian government’s involvement in a range of chemical attacks.

Following a series of Sarin attacks in Al Lataminah and Khan Sheikhoun in March and April 2017, Bellingcat worked with open source evidence to slowly piece together the nature of the bomb used in the attacks. Bellingcat first published its conclusions in November 2017, and continued to build on the body of evidence it had uncovered. After the OPCW Investigation and Identification Team (IIT) report was published this week, confirming the type of bomb used in the March 24 and March 30, 2017 Sarin attacks in Al Lataminah, we now have their confirmation of the type of bomb used, the Syrian M4000 chemical bomb.

In this article, we examine the evidence and processes used by Bellingcat to identify this same munition, and what it tells us about the use of Sarin as a chemical weapons in Syria, years after Syria was meant to have destroyed its chemical weapons stockpiles in the aftermath of the August 21, 2013 Sarin attacks.

The Hunt Begins

It was some time after the Spring 2017 Sarin attacks that the Bellingcat investigation team began to piece together the identity of the bomb used in those attacks, in some respects, quite literally piecing it together.

Following the April 4, 2017 Khan Sheikhoun Sarin attack, attempts had been made to identify the type of munition used, but there was scant evidence. Locals had described a bomb dropped by aircraft releasing the case, but only a few pieces of metal had been documented at the site of the attack, including a metal filling cap. This was consistent with how a Sarin bomb would be loaded, filled with a liquid payload through such a cap, but no match to the cap could be found through open sources at that time.

While Bellingcat had begun to investigate the April 4, 2017 attack in Khan Sheikhoun almost immediately after it had occurred, our investigation into the Al-Lataminah attack on March 30, 2017 came much later. At that time, most of our time and resources were spent on our continued investigations into the downing of MH17, and chemical attacks in Syria had become almost common place, with nearly every week bringing a fresh claim of a chemical attack somewhere in Syria. It was only the Khan Sheikhoun attack, and the mass casualties and shocking footage shared online in the aftermath of the attack, that brought our attention back to the use of chemical weapons in Syria.

What drew our attention to the March 30 attack in Al-Lataminah was a statement made on October 4 by Ahmet Uzumcu, the head of the Organisation for the Prohibition of Chemical Weapons (OPCW) to AFP, indicating that during an OPCW Fact Finding Mission (FFM) investigation into chemical attacks in Syria, Sarin had been identified in samples taken from the site of the March 30 attack.

Our first article on the Al-Latamiah attack, published on October 26, 2017, examined open source evidence and information about the attack. A few organisations, including the UN’s Independent International Commission of Inquiry on the Syrian Arab Republic and Human Rights Watch, had already made reference to the March 30 attack, and the unusual symptoms, without explicitly linking the attacks to Sarin. Groups supporting local hospitals and clinics that received patients in the aftermath of the attack, such as the Hama Health Directorate and Union of Medical Care and Relief Organizations (UOSSM) also published statements in the immediate aftermath of the attack about the symptoms victims suffered, consistent with Sarin exposure, but without explicitly linking it to Sarin.

However, none of these organisations examined the impact site or related debris documented at the site, which would prove essential for identifying the munition used. A handful of videos were published online about the March 30 attack, documenting victims of the attacks receiving treatment and Syrian Civil Defence collecting evidence at the scene. One of the items filmed by SMART TV in a now deleted video near the impact site provided a crucial link to the April 4 2017 Sarin attack in Khan Sheikhoun:

What drew our attention to this piece of debris was the circular metal object on the right side of the debris. At first glance, this appeared identical to the filling cap documented at the scene of the April 4 Sarin attack in Khan Sheikhoun that took place just a few days after this attack. Although it was impossible to take measurements of the objects from the video footage published online, we wanted to check if two caps matched in anyway. We compared the distance of the two holes in the centre of the cap from the outer edge of the cap to see if there was a match:

The top cap shows both caps overlaid with each other, showing the visible hole was in the same position. This indicated it was possible both caps were of the same design, and that the munition used in Khan Sheikhoun and Al-Lataminah were the same. This was significant, as the OPCW-UN Joint Investigative Mechanism report on Khan Sheikhoun, which identified the Syrian Arab Republic as being responsible for the attack, stated the filling cap recovered from Khan Sheikhoun was “uniquely consistent with a Syrian chemical aerial bomb”. But the question remained, what was the bomb used in these Sarin attacks?

Thanks, Russia

November 2017 led to a number of significant developments in the investigation into the nature of Syria’s Sarin bombs, ironically due to the Russian Federation’s attempts to defend its Syrian allies against allegations of Sarin use.

In early November 2017, the OPCW FFM had released a report on their investigation into a number of chemical attacks, including the March 30, 2017 attack in Al-Lataminah. This report included photographs of debris recovered from the site of the Al-Lataminah attack, including measurements of various debris. One of the pieces of debris measured and photographed included not one, but two filling caps recovered from the site of the March 30 attack:

This proved significant, as the filling cap recovered from Khan Sheikhoun had also been measured:

It was also possible to see that both sides of the caps were identical in design, and with the measurements, exactly the same dimensions:

It was now possible for us to state categorically that the design and dimensions of the filling caps recovered from the March 30 attack in Al-Lataminah matched perfectly with the filling cap documented at the Khan Sheikhoun impact site, which the OPCW-UN JIM report had described as “uniquely consistent with a Syrian chemical aerial bomb.”

The next major clue in our investigation was provided by the Russian Federation. In a November 2, 2017 press conference responding to the OPCW-UN JIM report on Khan Sheikhoun, the Russian Foreign Ministry, Ministry of Defence, and the Ministry for Industry and Trade presented various information that they used to claim the Khan Sheikhoun attack was not the responsibility of the Syrian Arab Republic. During that presentation, they displayed a slide with a diagram of two Syrian chemical bombs, the M4000 and MYM6000:

Remarkably, the Russian Federation had just provided the first public details on the nature of these two types of bombs, including details of the internal mechanisms of the bombs, and measures of the width and length of the bombs that would prove to be crucial in identifying the type of bomb used in Syria’s 2017 Sarin attacks. The top two images of the diagram showed an MYM6000 chemical bomb before and after the filling process was completed. The filling process was described in a June 2017 Mediapart article by a former member of the Scientific Studies and Research Center (SSRC):

“It also meant that engineers from the SSRC also had to design bombs that were specific for sarin, and which were quite different to ordinary munitions. “On the outside, they resemble conventional bombs of 250 and 500 kilos of TNT,” explained one of them. “But inside they were totally different, divided into two compartments. The first, at the front, carried the DF. The second, at the rear, [contained] the isopropyl and hexamine. This mixture is stirred together by a stirring rod that can be activated by sort of crank at the rear of the bomb. When the two compartments are filled up, a technician winds the crank which advances the stirring rod to the point it breaks the wall of mica. The sarin synthesis reaction is set off inside the bomb, placed under a cold shower and maintained within a very precise temperature range which is controlled by a laser thermometer,” continued the former SSRC source. “After which, all that’s left is to introduce, in the allocated hold at the point of the bomb, the explosive charge and detonator – altimetric, chronometric or other – and to place the bomb under the wing of the plane. The load must be very precisely measured. If it is too big, the heat given off can cause the decomposition of the product, or the formation of a cloud of gas too far from the ground, which would render it ineffective. In principle, a 250-kilo bomb contains 133 litres of sarin, a few kilos of TNT and a ballast to preserve the aerodynamic characteristics of the weapon. A 500-kilo bomb contains 266 litres of sarin. The ideal altitude for the explosion of the bomb is about 60 metres.”

The two filling caps visible in the diagram, along with the mixing arm (in green), and barrier separating the two sections of the bomb were consistent with the process described in the Mediapart article published a few months before the Russian Federation published the detailed diagram of the bombs. This description was also consistent with the description of the filling process detailed in the recent OPCW-IIT report on the March 24 and March 30 Sarin attacks:

“[T]he M4000 designed by, and manufactured in, the Syrian Arab Republic to deliver chemical agents, including sarin, is an unguided chemical air-delivered munition, weighing 350 kilograms. Its internal design consists of two compartments, each with its own filling plug, separated by a membrane composed of two disks attached to a ring. The filling plug in the front compartment is used to load methylphosphonyl difluoride (DF) into the munition, while the rear plug is used to fill the munition with hexamine and isopropanol. The nose part of the bomb consists of a heavy cone that forces the bomb to drop nose first. A fuze adaptor is present on the nose part to attach the fuze. Inside the front compartment is a burster tube with an explosive charge of about 3 kilograms of trinitrotoluene (TNT). On the rear compartment a tail fin, designed to stabilise the munition during its fall, is attached. The rear compartment houses a mixing paddle that pierces the membrane and mixes the precursors (DF, hexamine, and isopropanol) in preparation for the use of the munition before it is loaded on the aircraft. The bomb has two suspension lugs welded to the bomb body, which are used to attach the munition to aircraft.”

With the publication of the OPCW FFM report on the Al-Lataminah attacks, we also now had many more pieces of debris to examine. These included a second filling cap, with an identical design and measurements to the other filling cap recovered from Al-Lataminah, with a suspension lug attached to it. This was consistent with the diagram of the M4000 bomb, which showed two filling caps present, one close to a suspension lug:

Also included in the report were two large pieces of metal; one a semi-circular sheet of metal with a small metal piece attached to it, and the remains of what appeared to be a tail ring with fins:

Tail fin and ring assemblies can prove crucial for identifying bomb remnants. Very few bombs, if any, used in the conflict in Syria share the same configuration of tail rings and fins. For example, the below image shows two types of bombs that are sometimes mistaken for each other, the OFAB 250-270 high explosive fragmentation bomb (left), and the RBK-500 cluster bomb (right):

Both bombs have 8 tail fins, with alternating tail fins extending beyond the width of the tail rings. However, on the OFAB 250-270 there is a second inner tail ring whre the tail fins terminate, but on the RBK-500 the tail rings terminate at the base of the bomb. We can also see smaller details, like notches around the inside part of the RBK-500’s tail fins where they meet the base of the bomb, and notches on the outer tips of the OFAB 250-270 tail fins.

In the case of the debris from the March 30 attack in Al-Lataminah, we first wanted to establish the configuration of tail fins and tail rings from the remnants. Bellingcat’s Timmi Allen created a simple 3D model of the debris to establish the basic configuration of the tails fin and rings:

This established that there was a smaller tail ring inside the large tail ring, with 8 pieces of metal attaching the two together. However, it appeared one of the pieces of metal was missing, so only 7 were visible on this part of debris. Notably 4 of those pieces of metal were not tail fins, but rectangular pieces of metal that didn’t extend beyond the width of the tail ring. Three more longer pieces of metal, alternating with the other 4 pieces, were visible, with one gap where a forth piece of the longer metal would have been. These were clearly tail fins, and significantly did not extend beyond the width of the outer tail ring.

So where was this missing long piece of metal, the fourth tail fin? The OPCW FFM report provided its explanation in its description in the semi-circular piece of metal:

“A triangular metal part is attached to the main body of the item. This part resembles a tail attached side fin (labelled 2). The remains of three other welds (labelled 3) of similar length and approximately equidistant from each other can be seen. This may indicate the original presence of additional three equivalent objects.”

This indicated that the two pieces of metal, the tail fin assembly and semi-circular piece of metal, were the remains of the tail section of the aircraft. Not only that, but the design of the tail section, with the tail fins that didn’t extend beyond the outer tail ring, was consistent with the diagram Russia had published of the M4000 chemical bomb.

There was more — using the measurements provided by the OPCW FFM report of the tail section debris it was possible to get approximate measurements for each section, which was close to the 460mm measurement from the Russian M4000 chemical bomb diagram. Having reviewed a wide range of known munitions, it was possible to establish that the only bomb with that tail section design and measurements that was publicly documented was the M4000 chemical bomb, per the diagram published by the Russian Federation.

By comparing the images of the debris to the diagram of the M4000, it was possible to indicate the likely locations that debris would have originated from, as demonstrated in the following diagram:

Later, we were also able to work with Forensic Architecture to produce a model of the bomb based on the diagram, and models of the debris from the OPCW FFM report, that were then reformed and fitted over the model, showing they matched exactly to the model based on the diagram of the M4000 bomb:

While we by then had many matches to the M4000 bomb diagram, and a connection between the type of debris found at two separate chemical attacks, we still didn’t possess any image of a complete M4000 bomb. Nearly two years after our initial investigations into the identity of Syria’s favourite chemical bomb, we found our final clue.

The Final Proof

In September 2019, we were contacted by a Bellingcat reader who had come across the following video, first published on April 13, 2013:

This video showed what appeared to be a complete M4000 chemical bomb. However, we wanted to be completely certain, so we began by comparing features of the bomb to the M4000 diagram published by Russia. It was clear that the tail section matched the debris recovered from Al-Lataminah, and that two filling caps were present, along with the two suspension lugs detailed in the diagram, but we also needed to measure the bomb. We created a 3D model of the bomb in the video, and used the measurement of the filling cap from our previous investigation to measure the width of the bomb, showing that based on those proportional measurements the bomb would be 460mm wide, consistent with the measurements in the M4000 diagram published by Russia:

Needing a second opinion, we also asked Forensic Architecture to make their own measurements of the bomb. Using photogrammetry, they created a 3D model that they then measured using the assumption  that the filling caps were 107mm wide, as per the earlier measurements from previous attacks. Again, this showed the bomb would be 460mm wide:

Apart from larger features that obviously matched, such as the design of the filler caps, suspension lugs, and tail fin section, new, smaller matching details became apparent. In the below image we can see that at the thinnest end of the tail fin, it ends not at a point, flush with the body of the bomb, but at a right angle. This is a relatively tiny feature, but one that shows consistency with the debris recovered from Al-Lataminah and the complete M4000 bomb documented in the April 2013 video:

This, and many other features, confirmed the identity of the bomb as an M4000, and the debris from Al-Lataminah as a perfect match to this same bomb, which itself was a match to the M4000 diagram published by Russia.

There was also an interesting connection to the Khan Sheikhoun April 4, 2017 Sarin attack. There was very little debris documented at the site of the Khan Sheikhoun attack, one being the filling cap that matched exactly to the M4000 filling cap. Another piece of debris, a folded piece of metal (shown below), had caused much debate. Some had claimed that this was in fact metal tube, either part of a rocket or a Sarin filled tube that had an explosive charge placed on it to release the Sarin.

It was difficult to explain how an exploding munition would create a folded piece of metal, especially when it appears to have been folded inwards, not outwards, as you’d expect from the explosion. The April 2013 bomb provided a possible explanation. In the video, there is a very clear, and sharp, bulge around the part of the bomb where it begins to curve forward. As per the diagram of the M4000 bomb, this section contains the explosive charge and heavy ballast, and the fold appears to be just behind this heavy section:

As we investigated, we discovered this was not the only example of the remains of an M4000 bomb documented before the 2017 attacks. A second video, published in 2014, showed the remains of an M4000, with the same folding apparent behind the heavy section of the bomb:

This would support the theory that the debris recovered from Khan Sheikhoun was not a metal tube or pipe as some have insisted, but formed during the impact of the bomb, as the thin metal of the bomb’s shell folds behind the heavy ballast in the front end of the warhead.

The above video is also interesting, as it also appears to confirm at least one claim made by the Syrian government about the M4000 bombs. The OPCW IIT report contains the claim from the Syrian government that some of its chemical bombs were repurposed as conventional bombs, and the above video shows a rectangle section missing from the side of the bomb, and some sort of solid fill. It is possible that this is one of these repurposed bombs, with the solid fill being the new explosives added to the bomb. Despite being cracked open, there’s no chemical attack incident reported at this location around the date the video was filmed, so it seems very unlikely the people documenting this bomb associated it with a chemical attack.

These earlier videos have led some to claim that this is in fact proof the Syrian rebels could have used these earlier bomb remnants to fake the Khan Sheikhoun and Al-Lataminah attacks. This claim is specifically addressed by the OPCW IIT in their report into the Al-Lataminah attacks: