The First Images of the Type of Chemical Bomb Used in Syria's Sarin Attacks

On the morning of April 4, 2017, the town of Khan Sheikhoun in Idlib, Syria, was hit by a chemical bomb filled with the deadly nerve agent Sarin, dropped from a Syrian aircraft. It killed dozens, and injured many more. 

Following the attack, the OPCW Fact Finding Mission (FFM) investigated the incident, confirming the suspected use of Sarin and triggering the OPCW-UN Joint Investigative Mission (JIM) investigation that established the events of the day. 

While very little debris was left from the bomb at the Khan Sheikhoun site beyond a few fragments of metal, one of those fragments was identified by the OPCW-UN JIM as a filler cap from a Syrian chemical bomb. 

While the April 4, 2017 attack in Khan Sheikhoun had global media coverage — and resulted in both international condemnation of the Syrian government and military action by the U.S. against targets in Syria — this was not the first time Syria had used Sarin. 

In fact, it was not the first time in that very week that Syria had used Sarin, as further OPCW FFM reports established the use of Sarin in two other incidents in the town of Al-Lataminah, less than 20 km to the south of Khan Sheikhoun, on March 24 and March 30, 2017.

Aside from establishing the use of Sarin in the days before the April 4th attack in Khan Sheikhoun, it was also possible to establish links between the March attacks and Khan Sheikhoun. In the OPCW-FFM report investigating the March 24th incident, the OPCW FFM included a table where they noted “similarities between the analytes in these samples and those from previous allegations.”

Table from the OPCW FFM report on the March 24th 2017 Sarin attack in Al-Lataminah comparing samples taken from other Sarin attacks

What is notable is the presence of hexamine at all three sites, which, as Bellingcat has previously noted, is a key ingredient to Syria’s Sarin production process. The significance of its presence has been explained in the OPCW-UN Joint Investigative Mission (JIM) report on Khan Sheikhoun, published in October 2017: 

“According to information obtained by the Mechanism, the filler cap, with two closure plugs, is uniquely consistent with Syrian chemical aerial bombs. The Mechanism was provided with an assessment of the filler cap and with chemical analysis showing sarin and a reaction product of sarin with hexamine that can be formed only under very high heat. Information was also received that additional metal fragments collected from the crater might correspond to parts of Syrian aerial chemical munitions.”

The filler cap, described above, was also extremely significant. Not only was it “uniquely consistent with Syrian chemical aerial bombs,” a filler cap that was identical in design and dimensions as the cap documented at Khan Sheikhoun was also recovered from the impact site of the March 30, 2017 attack in Al-Lataminah. Now, there were two connections between those attacks — the same Sarin linked to the Syrian Sarin production process, and the same type of filler cap “uniquely consistent with Syrian chemical aerial bombs”.

The filler cap described by the OPCW-UN JIM as “uniquely consistent with Syrian chemical aerial bombs.”  Left – A cap from Al-Lataminah; Right – The cap from Khan Sheikhoun

While there might be some passing resemblance to this filler cap and similar caps used on the other munitions, a close examination of these caps show that they only match with each other, not other types of filler caps used in other munitions that have been publicly documented.

This connection between the attacks is particularly significant as while there was little debris left in the Khan Sheikhoun crater, the Al-Lataminah crater has much more debris surrounding it, including pieces of the tail section of the munition, and two filler caps, one of which was attached to a piece of metal with a suspension lug welded to it — not to mention other objects.

Establishing the exact type of bomb used in Al-Lataminah on March 30 was aided by representatives of the Russian federation, who decided to publish a diagram of two types of Syrian chemical bombs, the M4000 and the MYM6000, during their attempts to defend the Syrian government against allegations of their involvement in the Khan Sheikhoun attack.

The diagram of two types of Syrian chemical bomb, the MYM6000 and M4000. Note the top two images show the MYM6000 before and after the Sarin mixing process, and the bottom images shows the M4000 after the Sarin mixing process

By comparing the diagram of the M4000 and the debris recovered from the Al-Lataminah attack site, it was possible to demonstrate a number of matches between the diagram and the debris, and to confirm the width of the bomb was the same, strongly indicating that the bomb used in Al-Lataminah was a Syrian M4000 chemical bomb. The match between the type of filler caps documented at Al-Lataminah and the filler cap from Khan Sheikhoun supports the OPCW-UN JIM claim that the cap is “uniquely consistent with Syrian chemical aerial bombs”.

A diagram demonstrating how debris recovered from Al-Lataminah matches the diagram of the Syrian M4000 chemical bomb

In addition, we asked Forensic Architecture to create accurate models of the debris and a model based on the bomb diagram. It was possible to create models using the correct dimensions by utilising measurements taken and later published by the OPCW-FFM. The pieces of the debris were then placed on the 3D model of the bomb (which was based on the measurements and details in the Russian published diagram), which showed that they were a strong match with what was visible in the diagram:

However, during the original investigation there was no known publicly available imagery of a M4000 chemical bomb. To fully confirm the type of bomb used and to confirm that the cap was “uniquely consistent with Syrian chemical aerial bombs” it was necessary to find clear imagery of an M4000 chemical bomb.

After two years, we have now discovered imagery of an M4000 chemical bomb, allowing us to make this final comparison. In April 2013, the following video was published:

Identifying The Munition

When it comes to identifying bombs, we look at each bomb’s distinctive features, such as the position of tail fins, whether or not there are tail rings, if so, how many are there, and so on. 

The below image shows a range of Russian bombs. Notice the range of different tail section configurations, then start looking at other unique details like suspension lugs, their number, and their positions: 

A variety of Russian made bombs

These distinctive features allow us to not only match features to reference material about the bombs to confirm their identity, but to also exclude specific types based on mis-matching features. 

The video describes the bomb as an unexploded munition, but provides little information to what the munition actually is. However, by comparing it carefully to the diagram of the M4000 chemical bomb, it is possible to confirm it has multiple distinctive features identical to the M4000 chemical bomb.

The first matches between the diagram are the two filler caps, and the position of suspension lugs around them:

Top – A still from the April 2013 video (flipped for comparison purposes; Bottom – The Russian published diagram of the M4000 chemical bomb. Matching filler caps marked in green, matching suspension lugs marked in red

We can clearly see the position of the caps and lugs in the diagram are very similar to what’s visible in the video. A pair of filler caps is highly unusual for any bomb, but the purpose of having two filler caps was explained in a Mediapart article by a former member of the Scientific Studies and Research Center (SSRC):

“It also meant that engineers from the SSRC also had to design bombs that were specific for sarin, and which were quite different to ordinary munitions. “On the outside, they resemble conventional bombs of 250 and 500 kilos of TNT,” explained one of them. “But inside they were totally different, divided into two compartments. The first, at the front, carried the DF. The second, at the rear, [contained] the isopropyl and hexamine. This mixture is stirred together by a stirring rod that can be activated by sort of crank at the rear of the bomb. When the two compartments are filled up, a technician winds the crank which advances the stirring rod to the point it breaks the wall of mica. The sarin synthesis reaction is set off inside the bomb, placed under a cold shower and maintained within a very precise temperature range which is controlled by a laser thermometer,” continued the former SSRC source. “After which, all that’s left is to introduce, in the allocated hold at the point of the bomb, the explosive charge and detonator – altimetric, chronometric or other – and to place the bomb under the wing of the plane. The load must be very precisely measured. If it is too big, the heat given off can cause the decomposition of the product, or the formation of a cloud of gas too far from the ground, which would render it ineffective. In principle, a 250-kilo bomb contains 133 litres of sarin, a few kilos of TNT and a ballast to preserve the aerodynamic characteristics of the weapon. A 500-kilo bomb contains 266 litres of sarin. The ideal altitude for the explosion of the bomb is about 60 metres.””

As per the above description, the diagram of the MYM6000 bomb shows a wall separating the two chambers filled from the two filler caps, and the crank arm at the rear of the bomb. This same crank arm is seen in the diagram of the M4000 bomb. This crank arm, and the housing it sits inside, can be seen below, marked blue and yellow respectively:

Top – A still from the April 2013 video (flipped for comparison purposes; Bottom – The Russian published diagram of the M4000 chemical bomb. The stirring arm is marked in blue, the housing for the stirring arm is marked in yellow

It should also be noted that the filler caps, suspension lugs, and stirring arm are all named in Arabic on the diagram, further confirming their function.

The pair of filler caps, in addition to the stirring arm, are very unusual features for a bomb, and are consistent with the description of the process of filler of Syria’s chemical bombs published by Mediapart. The shape of the front of the bomb and the shape of the tail fins are also consistent with what’s shown in the diagram. 

Furthermore, it is possible to establish the approximate size of the bomb in the April 2013 video, and this is how: By creating a 3D model of the bomb in the video is it then possible to use the previously established measurements of the filler caps to calculate the width of the bomb.

Top – A composite image of the bomb in the April 2013 video; Bottom – A 3D model based on the bomb in the April 2013 video

This shows that the dimensions of the bomb are consistent with those measurements on the diagram of the M4000 chemical bomb, as published by the representatives of the Russian Federation.

To confirm the proportional measurements are within the correct range, Forensic Architecture used photogrammetry to recreate a model of the bomb in the April 2013 video. This process allows a correctly proportioned 3D model of the bomb to be created from the video footage. The width of the bomb was measured at 460 mm, as per the Russian published diagram. This allowed approximate proportional measurements of the rest of the bomb to be made to see if they were consistent with the measurements taken of debris recovered from Khan Sheikhoun and Al-Lataminah Sarin attacks:

Based on the unique characteristics featured in this Russian-supplied diagram of the M4000 chemical bomb and the features visible on the bomb in the April 2013 video, as well as the measurements of the bomb, it is possible to conclude that the bomb featured in the April 2013 video is a near perfect match to what Russia describes as an M4000 bomb.

Comparing The Munition To The Debris

Two sets of debris have been documented from the Sarin attacks in Al Lataminah on March 30, 2017 and Khan Sheikhoun on April 4th 2017. As previously mentioned, a smaller amount of debris was documented at Khan Sheikhoun, but this included the filler cap linked to Syrian chemical bombs by the OCPW-UN JIM that also matched two filler caps recovered from the Al Lataminah site. By comparing the debris to the diagram of the M4000 published by Russia, it was possible to show multiple matches to the type of debris recovered and the features of the M4000 in the diagram.

Based on these fragments it is possible to confirm that the debris matches the features of the bomb visible in the April 2013 video, confirming the debris recovered from Al Lataminah has multiple strong matches to a M4000 chemical bomb.

It has been previously established that the filler caps recovered from Khan Sheikhoun and Al-Lataminah are identical in every way, including exact measurements. One feature of the filler caps are two holes on the outside of the cap, which fit the tool used to unscrew the cap. Even without the precise measurements of the filler cap from the April 2013 video, it is still possible to compare the proportional distance between the edge of the filler cap and the holes on the Khan Sheikhoun and Al-Lataminah filler caps with those from the April 2013 video — thus ultimately demonstrating that they are the same:

Top – The filler cap from the April 2013 video, Bottom – A filler cap from the March 30th Al-Lataminah attack

The position of the filler and the ridge around it should also be noted as a matching feature between the filler caps recovered from the two 2017 Sarin attacks and the April 2013 video:

Comparison of filler caps, Left – Al-Lataminah March 30th 2017, Middle – Khan Sheikhon April 4th 2017, Right – The April 2013 video

As we can see from other examples of filler caps on bombs shown below, the position of the cap in relation to the casing of the munition can vary, further highlighting the significance of the exact match between the filler caps examined above:

Left – ODAB-500 with filler caps visible, Right – KhAB-250 with filler cap visible

On the complete bomb from the April 2013 video we can see that next to the filler caps there are suspension lugs. One of the two filler caps recovered from the March 30, 2017 Al-Lataminah attack site is connected by a piece of metal to a suspension lug that matches the type seen in the April 2013 video, down to the shape of the weld attaching it to the bombing casing:

Left – Filler cap and suspension lug in the April 2013 video, Right – The filler cap and suspension lug recovered at the site of the March 30th 2017 Al-Lataminah attack

The tail section is also a strong match to those recovered from Al-Lataminah. In the below image we can see the configuration of the tail section of the bomb:

A composite image of the April 2013 video showing the complete bomb

Four tail fins are attached to the tail section of the bomb, with an outer tail ring at the end. The tail fins do not extend beyond with width of the bomb or the outer tail ring. As the tail tapers towards the rear there is a section of metal, and from within that a metal rod extends towards the rear of the bomb: 

The tail rings of the bomb in the April 2013 video

Another angle of the tail rings shows us that the four tail fins are connected to a smaller inner tail ring, and between each of the tail fins connecting the outer and inner tail rings there is an additional piece of metal, making eight connections in total.

Photograph of the tail rings from the OPCW FFM report on Al-Lataminah

The above object was recovered from the site of the Al-Lataminah attack, and described in the OPCW FFM report as follows:

“01SDS(B) is a large corroded and deformed metal object. Despite the corrosion, it is still possible to see layers of dark green and grey colour. It is also possible to see a smaller inner ring in the middle, linked by seven metal parts to a larger, outer ring. Four of the parts that are linking rings are rectangular. The other three are much larger and triangular. The spacing between the three parts, in addition to indications on the rings, point to one missing larger triangular part. This is consistent with an aerial bomb tail fin assembly. The FFM took numerous measurements of this item. Given the level of deformation, these measurements are only approximate dimensions. These approximate dimensions have not been included.”

This description is consistent with what is visible on the bomb from the April 2013 video. In addition, the OPCW FFM published the following photograph showing a large sheet of metal with a triangular piece of metal attached to it: 

Photograph from the OPCW FFM report on the March 30th 2017 Al-Lataminah incident

Together with Forensic Architecture we were able to reconstruct the shapes of both pieces of debris, demonstrating they are the tail section of the bomb, consistent with the features of the tail section of the bomb featured in the April 2013 video:

Even minor details are consistent between the tail fins in the April 2013 video and the debris recovered from Al-Lataminah. In the below image we can see that at the thinnest end of the tail fin it ends not at a point, flush with the body of the bomb, but at a right angle. This is a relatively tiny feature, but one that shows consistency with the debris recovered from Al-Lataminah and the complete M4000 bomb documented in the April 2013 video:

Left – The tail debris recovered from Al-Lataminah, Right – The tail section of the bomb in the April 2013 video

More difficult to see in the April 2013 video is the fuze assembly at the front of the bomb, but it is still possible to seem the similarities between the fuze assembly recovered from Al-Lataminah and the fuze assembly on the M4000 published in April 2013:

Left – The fuze assembly featured in the OPCW FFM report on Al-Lataminah, Right – The fuze assembly on the M4000 bomb in the April 2013 video

Based on the above matches, it is clear the debris from Al-Lataminah matches that of a Syrian M4000 chemical bomb, and therefore the filler cap recovered from the Khan Sheikhoun crater matches that of a Syrian M4000 chemical bomb.

Other Features Of Interest

One piece of debris from the Khan Sheikhoun attack has been the subject of a great deal of debate. Aside from the filler cap recovered from the Khan Sheikhoun crater, a large piece of folded metal was also filmed and photographed embedded in the crater:

The metal fragment in the crater at Khan Sheikhoun

Some commenters have claimed it would be impossible for a piece of metal from a bomb to form such a folded shape, suggesting it was some other object unrelated to a bomb, such as a 122 mm pipe. However, we can see from the April 2013 video that the section of the bomb casing near the front of the bomb has collapsed, almost certainly from a high energy impact:

The front of the M4000 featured in the April 2013 video

Another feature of the folded metal piece at Khan Sheikhoun suggests that it may have been formed in a similar way. A thick metal bar runs the length of the piece of metal, parallel to the fold. In the M4000 diagram we can see that metal supports run the circumference of the bomb casing, and one of these metal supports was recovered at Al-Lataminah:

Metal fragment recovered from Al-Lataminah and featured in the OPCW FFM report

Considering the position of the metal bar on the piece of debris recovered from Khan Sheikhoun, and what we know about the construction of the M4000 chemical bomb, the folded metal in Khan Sheikhoun is consistent with the type of damage observed on the bomb in the April 2013 video, which itself is almost certainly caused by a high velocity impact on the front of the bomb. 

Is The April 2013 Video Proof Of A Sarin Attack?

While it is now clear the bomb in the April 2013 video is a M4000 chemical bomb, the same type used in Sarin attacks in 2017, this does not necessarily mean the April 2013 video is proof of an attempted Sarin attack. 

The Syrian Arab Republic has previously claimed that some of its stockpiles of chemical bombs were repurposed as conventional bombs. In 2018, the OPCW’s Ahmet Üzümcü wrote the following about the OPCW’s progress in disarming Syria’s chemical weapon programme:

“The third outstanding cluster relates to verifying the precise quantity of chemical weapons that were destroyed or consumed prior to the Syrian Arab Republic’s accession to the Convention. This includes the fate of 2,000 aerial bombs designed for chemical weapons purposes. These were reportedly repurposed for conventional use. In the absence of relevant documents and physical evidence, the Secretariat has not been able to verify that that these munitions were in fact repurposed and consumed.”

During Bellingcat’s research into M4000 chemical bombs, a second example of a M4000 chemical bomb was found, this time from 2014:

The bomb is in significantly worse shape than the one in the other video, but shows a large square hole cut into the side of the bomb, and, inside, a solid fill. While the munition is heavily damaged, the large square hole has clearly been cut into the munition, and had it contained Sarin that Sarin certainly would have been dispersed. At no point in the video is it described as a chemical bomb, again suggesting this could be one of the M4000 bombs that have been modified to contain conventional explosives. 

While there are no obvious signs of alterations to the bomb casing in the April 2013 video, it should be noted the entire munition isn’t visible in the video, so it is not possible to establish if it has been modified in a similar fashion. Therefore, it is not possible to confirm the fill of the bomb in the April 2013 video as Sarin or any other chemical agent.

Conclusion

Based on the diagram on of an M4000 chemical bomb, as published by representatives of the Russian Federation, as well as the many similarities it has with bomb in the April 2013 video, it is clear that bomb featured in the April 2013 video is an M4000 chemical bomb. 

The debris recovered from the Al-Lataminah March 30, 2017 Sarin attack matches perfectly to the features of the bomb in the April 2013 video, and the diagram published by the Russian Federation of an M4000 chemical bomb. Therefore, it is certain the M4000 chemical bomb was used in the March 30, 2017 attack in Al-Lataminah.

The filler cap documented in the crater at Khan Sheikhoun is consistent with a M4000 chemical bomb, and the damage seen on the large piece of metal is consistent with damage seen on unexploded examples of M4000 chemical bombs shown above. Therefore, it is possible to state it is likely the bomb used in Khan Sheikhoun was an M4000 chemical bomb, although there remains the possibility that it could be the remains of another type of Syrian chemical bomb.