This article was collaboratively researched and written by the Bellingcat Investigation Team.

Introduction

In August 2017, the International Criminal Court (ICC) issued its first ever arrest warrant solely based on social media evidence. The arrest warrant accuses Mahmoud Mustafa Busayf Al-Werfalli (hereafter referred to as ‘Werfalli’), an alleged commander of the Al-Saiqa Brigade of the Libyan National Army (LNA), of mass executions in or near Benghazi.

Bellingcat has highlighted the importance of this development, which aligns the ICC with the realities of many of today’s conflicts, in an earlier article. The article marked the start of a crowdsourcing campaign to geolocate the seven locations of the executions on which the arrest warrant is based. Four execution sites have been geolocated so far, and one of them – Incident Seven – is worth discussing in further depth as it is an excellent example of team work and using a wide variety of open source information such as satellite imagery, geotagged photos, conflict context, geolocations from other sources and news articles.

The Evidence: A Facebook Video

The video which prompted the ICC arrest warrant was uploaded on July 23, 2017, by a Facebook user named ‘Mohammed Al-Gali’. The video has been deleted since, though an archived version exists.

The video shows the execution of twenty individuals who are, according to the description, “terrorists found guilty of kidnapping, torture, killing, bombing, and slaughtering” and members of the so-called Islamic State (IS). Werfalli is visible in the video and gives the order to execute the group of twenty individuals. According to the arrest warrant, Werfalli reads from a white document in the video of Incident Seven, and refers to a ‘decree decision’, which ‘shall be executed today 17/07/2017’.

The first part of the video shows the execution of eighteen people and the second part the execution of another two people. The long shadows in the video indicate it was filmed in the early morning (from north to south) or late afternoon (from south to north).

The Geolocation: Bushes, Buildings, and Blood Stains

At first sight the video seems very difficult to geolocate, because of the apparent lack of identifiable landmarks. Aside from the twenty executed people, their executioners and a white car, mainly a desert landscape with two sand tracks, a few sand hills and some vegetation is visible. However, a stitched panorama of the video, published in Bellingcat’s previous article, shows buildings and a fence on a distance in the background.

The buildings are visible for less than a second, at 3m25s. A fence consisting of poles is visible in the second part of the video, from 4m19s onward. Besides the vegetation pattern, these are the only visual clues to go on for the geolocation.

Image 1. A panorama of the execution site of Incident Seven. The panorama is composed out of stills of the Facebook video.

Image 2. A still from the Incident Seven video at 3m25s, showing the structures in the background of the execution site.

Image 3. A fence is visible in the background of a still of the video at 4m25s.

The Bellingcat team was able to geolocate the video in Ghanfuda, which is situated in the western part of Benghazi.

The video was filmed from north to south, very likely on July 17, 2017, approximately at 6:37 am. The coordinates of the execution area are 32.023144, 20.029181.

Image 4. The location of the execution site as shown on Google Earth. The buildings and the fence shown in the Incident Seven video are highlighted in red rectangles, and the blue lines mark the area that was filmed in the video. Copyright DigitalGlobe ©​ 2017

Image 5. Screenschot of SunCalc at the execution location at 17 July 2017, 6:37 am.

Image 6. An overlay of a still of the Incident Seven video on satellite imagery with a 3D reconstruction of the buildings in that area.

On satellite imagery, vegetation patches and a hill are visible. These features directly correspond with the vegetation patches and hill which are visible in the Incident Seven video. Furthermore, the two sand tracks shown in the video are clearly visible on the satellite imagery.

Image 7. Top: Stitched panorama made out of stills from the execution video, vegetation marked in green rectangles, hill in brown rectangle. Bottom: The area on satellite imagery with the same vegetation marked in green rectangles, hill in brown rectangle, the red circle marks the position of the camera. Satellite imagery copyright DigitalGlobe ©​ 2017

Traces of the execution are also distinctly visible on July 17, 2017, satellite imagery of TerraServer. The satellite image’s resolution is 0.30m, the highest resolution available for consumers. Fifteen black spots are visible, which are very likely blood stains of the executed people. These spots are at the exact same location as where the twenty individuals were shot. Satellite imagery of the 11^th and 14^th of July 2017 clearly shows these spots were not visible yet on those dates.

Image 8. Left: satellite imagery of 11 July 2017, no spots visible inside the red circle. Right: satellite imagery of 17 July 2017, approximately 15 spots visible inside the red circle. Copyright DigitalGlobe ©​ 2017

Image 9. Comparison of the location of the bodies in the video and the spots in the satellite imagery makes clear the bodies in the video and the spots in the satellite imagery are on exactly the same location.

How Was the Location Found?

As mentioned in the previous article about the Werfalli executions, the buildings in the left upper side of the panorama gave a strong clue about the location of the video. The buildings visible in the video seem to be gray concrete buildings with “arches” without doors.

Twitter user @ROELart mentioned that the video possibly was filmed in a southwest area of Benghazi because the color of the sand is more grey than in other areas of Benghazi, where colors of the sand are more orange or yellow.

In that area we noticed many concrete buildings that were not finished yet, such as an area with new buildings that is named ‘Bingazi Meammar’, located to the southwest of Benghazi, as described on Wikimapia.

Another area with ‘Chinese Buildings 24’ is mentioned on Wikimapia as an area captured by the Libyan National Army (LNA) from the Benghazi Revolutionaries’ Shura Council (BRSC) in January 2017. These buildings are a part of a much bigger project of new real estate, developed by China, for 25.000 housing units in the Ghanfuda area. Construction of the ‘Chinese Buildings’ started in 2008 or 2009, but stopped in 2011 because of the civil war in Libya and thousands of Chinese construction workers left Libya. The same year there were plans to continue the construction, but that never happened and the construction never was completed. In January 2017 terrorists were hiding inside ‘Buildings 12’, likely an area with 12 buildings in Ghanfuda, Benghazi.

One photograph of the ‘Chinese Buildings’ strongly resembles to the buildings visible in the execution video, especially because of a structure where the front and side of the building are alternated. Satellite imagery of ‘Chinese Buildings’ confirmed the strong similarity. However, since the area consist of hundreds of these buildings, geolocating the right spot seemed a very difficult task.

Image 10. Buildings in the execution video (top) compared to the ‘Chinese Buildings’ (bottom).

Image 11. Similarities between the ‘Chinese Buildings’ on satellite imagery (top) and the buildings visible on a distance in the execution video (bottom).

Mohammed Al-Gali uploaded several videos where similar unfinished concrete buildings are visible. On 2 February 2017 he uploaded a video showing a panorama view around, filmed from the roof of one of the buildings. This video could be geolocated to  32° 1’31.29″N, 20° 1’48.84″E (32.025358, 20.030233) in a north western corner of the area with ‘Chinese Buildings’ in Ghanfuda. The description of the video likely refers to the ’12 buildings’ where terrorists were hiding and a battle against these terrorists.

Image 12. Screenshot of the 2 February 2017 video, showing an area with unfinished concrete buildings and several cranes. The description mentions ’12 buildings’ and a battle with terrorists, who were hiding there.

Two other videos, filmed on the 12^th (but uploaded at the 13^th) and 14^th of June 2017, show a group of people, including Werfalli and what appear to be soldiers of his unit, digging up a large number of munition and weapons, buried by the terrorists, with a bulldozer. These videos were geolocated at 32° 1’40.13″N, 20° 1’43.89″E (32.027814, 20.028858) and  32° 1’37.65″N, 20° 1’42.59″E (32.027125, 20.028497), just a few blocks of buildings away from the 2 February video location. Both videos mention that the ammunition and weapons were buried at sites inside ‘Chinese Buildings’.

Image 13. Screenshots from the 12 and 14 June 2017 videos, showing unfinished concrete buildings, according to the description weapons and munition were buried inside ‘Chinese Buildings’.

Image 14. Screenshots from the 12 and 14 June 2017 videos, showing unfinished concrete buildings, according to the description weapons and munition were buried inside ‘Chinese Buildings’.

The 12^th June 2017 video shows similar white cars as visible in the execution video, although a definitive match between these cars could not be made.

Because the 2^nd of February and the 12^th and 14^th June 2017 videos were filmed in the same area, Bellingcat expected the execution location to be in the same area as well. It was eventually a fence visible in the 12 June 2017 video that led to the execution location.

Image 15. A fence to the north of the buildings is visible in the 12 June 2017 video (marked in red rectangle).

On the northern side of the area with buildings and continuing to the western side of this area, a long fence consisting of poles leads from north to south. Following that fence to the south reveals an open area with several dirt tracks crossing each other. One of these crossings and the vegetation around turned out to be a perfect match with the landscape in the execution video.

Image 16. Google Earth satellite imagery showing the locations of the 2 February, 12 and 14 June 2017 videos. The 17 July 2017 execution video was filmed in the same area.

Conclusion

The geolocation of the execution video of Incident Seven of the Werfalli executions is a very strong match. The similarities between the vegetation, sand tracks, buildings, fence and spots on the exact location where the twenty individuals were executed, allows the conclusion that the exact location of the executions has been found. Changes to satellite imagery strongly indicates Mahmoud Al-Werfalli commanded the execution of twenty individuals on this location at some point between the 15th and 17th of July, 2017 during the early morning. Werfalli himself states in the video the execution took place on July 17th, which is consistent in the changes in the satellite imagery.

Update: In a previous version of this article, Mohammed Al-Gali was described as a potential person who filmed one or more videos described in this post along with the filmed individuals. Al-Gali has reached out to Bellingcat and refuted this, saying that he had nothing to do with the filming of the video, and that he reshared it from an earlier source. We have updated the article to remove any mention of  Al-Gali as a potential original source of the video.