Attack on Red Crescent convoy in Urm al-Kubra/An answer to Bellingcat by PavewayIV

This is my critique of the evidence, analysis and conclusions drawn by the Bellingcat article Analysis of Syrian Red Crescent Aid Convoy Attack authored by Nick Waters and Hady Al-Khatib and published on the Bellingcat site Sep. 21, 2016.

Bellingcat analysis: Introduction
The opening paragraphs provide the tone of the rest of the article: Some known details, a true but pointless emotive remark about the attack being a war crime followed by a mis-attributed but supposedly incriminating set of remarks by the Russian MoD addressing their role and social media imagery appearing the following day. This leads to the thesis of the article, offered as such:


 * This investigation will use open source techniques to demonstrate that the Russian MoD and Syrian Government knew the location of the convoy. It will also show that it was not a fire that destroyed the convoy, but a sustained attack by air assets.

Assertion: Knowledge of location means guilt and Russia knew!
The first point about the Russian MoD and Syrian Government knowing the location of the convoy is hardly incriminating. I agree they both knew all along and well before the convoy was even underway - despite any subsequent drone surveillance confirming that. The Syrians, Russians and rebels knew because the Syrian Arab Red Cross (SARC) and the United Nations relief people TOLD them all exactly where the convoy was headed beforehand and got the required approval from all parties for the route/destination. It was traveling to a specific existing SARC aid distribution warehouse and health clinic in the outskirts of Urum al-Kubra, not some secretive location that could only have been discovered by surveillance drones and spy satellites.


 * The United Nations Office for the Coordination of Humanitarian Affairs released this statement by Stephen O'Brien right after the attack, part of which clearly states: "...Notification of the convoy – which planned to reach some 78,000 people - had been provided to all parties to the conflict and the convoy was clearly marked as humanitarian..."


 * And this from the Amnesty International site: "The UN aid chief, Stephen O’Brien, earlier said that the convoy was travelling with all the necessary permits, and that all parties in the conflict had been notified of its route."


 * The Guardian reported "...After it entered opposition territory, it was monitored by Russian drones, a fact acknowledged by the Russian defence ministry, which had also been provided with precise GPS coordinates of the route to be taken and the destination, as per agreement with Syrian officials..."

There is no doubt Russia knew where the convoy was. Bellingcat seems to dwell on the availability of secretive drone-derived locations as some kind of proof of guilt when the route and destination where well-known by everyone beforehand, yet they curiously avoid mentioning this fact.

Suggestion that Russian statements regarding tracking/location were deceptive ignore context
There is also a secondary suggestion that the Russian Defense Ministry spokesman, Igor Konashenkov, was lying about 1) the Russian MoD knowing the convoy's location/destination, and 2) Konashenkov claiming only the rebels could have known where the convoy was. However, the quote is taken out of context without respect to the Russian Center for Reconciliation and their responsibility for monitoring the convoy. From Tass

"The Russian reconciliation center aims to assist armed groups in Syria in concluding ceasefire agreements, maintain the truce regime, control its observance and organize the delivery of humanitarian cargoes to civilians.


 * The center has existed since the beginning of the year and part of its mission is to monitor aid convoys, including this one. This responsibility with regard to the Urum al-Kubra convoy extended into neutral/rebel-controlled territory to a certain point, beyond which the rebel forces assumed responsibility to ensure safe passage of the convoy to the final destination. The Russian MoD was trying to express that they had fulfilled their part of the agreement for monitoring at 1:40 PM local time, and beyond that it was up to the rebel forces to monitor the convoy's further movement and protect it. The convoy (or part of it) was already at the warehouse by then, so it wasn't going anywhere - it was starting to unload.


 * The Russian MoD statement was widely mis-represented in the Western press as some feeble attempt by the Russian MoD to claim ignorance of the convoy's route and destination and additionally claim that only the rebels could have possibly known where the convoy was. Taking these statements completely out of context and failing to mention the Russian Center for Reconciliation and their assigned role, one would think the MoD's statements were indeed disingenuous. The MoD was, in fact, addressing their responsibility to monitor the convoy and the end of that responsibility at 1:40 PM - it was not an attempt to claim ignorance of where they clearly knew the convoy was located: at the warehouse.

Bellingcat is simply using evidence manufactured from poor journalism to suggest deception on Russia's part. This is used to reinforce their previously stated contention that Russia knew where the convoy was, therefore they must have bombed it.

Assertion: Russia lying about attack evidence
The remainder of the article's thesis regarding 'sustained attack by air assets' will be addressed in the sections below as they present their evidence.
 * I'll merely point out here that the Russian MoD had looked at the initial social-media (activist/White Helmet-provided) pictures when they made their comments about the appearance of the convoy. Those initial handful of pictures did appear to show nothing but burnt/damaged trucks and little of the surrounding area. The Russian MoD spokesman was speaking specifically to the accusations that Russian aircraft bombed the trucks. He (rightfully so) said the pictures they had seen at the time looked burnt, not bombed. He would not have made that exact same statement a day or two later when more and better-detailed pictures emerged.

Bellingcat is again presenting the Russian MoD's statements out of context and without regard to what pictures they had actually seen at the time - all this in an attempt to make them sound deceptive or defensive when they were (according to Bellingcat's analysis) already guilty.

Bellingcat analysis: Context

 * The information they present here regarding location/time is accurate and reasonable.

Bellingcat analysis: Who knew about the convoy
Bellingcat acknowledges that Russia knew where the convoy and warehouse was, then returns to the MoD statement of "...The Russian side did not monitor the convoy after this and its movements were only known by the militants who were in control of the area." Then offers this:
 * "...However, a comparison of pictures from the aftermath of the attack and the drone feed clearly show that the convoy did not move on: it was attacked at the location that the Russian MoD was monitoring..."

While presented as suspicious, the context is once again absent in their analysis:  Bellingcat has somehow interpreted Russia's subsequent monitoring of the warehouse area as suspicious and incriminating, rather than standard military stuff. This is used to bolster their argument that Russia knew = Russia guilty. I'm just completely missing their train of logic here.
 * There were two separate Russian drone 'missions' that day. One was the obligatory convoy monitoring by the Center for Reconciliation until it got to the destination warehouse. The Russian MoD says this occurred at 1:40 PM local. There was another 'mission' (or perhaps a second drone) that did a general reconnaissance of the area until around the local 6:30 PM sunset. While there is video of the warehouse/convoy at times, this (second) drone seems to wander about looking at the surrounding area for long periods of time. In other words, it's not intensely focused on the now-parked convoy and unloading process. It's doing what a recon drone does for any military and had an obviously different task than the dedicated convoy monitoring one. The Russian MoD reluctantly released that in their own defense after accusations that they were responsible for the bombing and the misinterpretation of the Center for Reconciliation statements. This is actually quite extraordinary - you would never see the U.S. military release their drone footage for anything other than self-promotion. Nonetheless, Russia offered it as "See - the aid convoy and warehouse were fine the entire time we were watching (even though we were not obligated to watch it). Whoever attacked it only did so after we stopped monitoring it" Bellingcat misses the entire Russian MoD motivation for even releasing the second set of drone footage and instead sees this as more 'evidence' that Russia did it.
 * Not sure why Bellingcat insists on hammering the MoD for the statement about only rebels knowing where the convoy was after it reached the warehouse. Russia did not expect it to go anywhere. The knew it didn't go anywhere. They were not literally suggesting it did go anywhere else - like to some secret rebel-only-known location. I'm curious if the translation itself was flawed. But even if it was perfect, I see nothing insidious in it given the context. This is far too much attention on a single confusing sentence considered out of context.

Bellingcat analysis: What happened during the attack?
The opening statement for this section is:
 * "The Russian MoD attempted to downplay the attack and link it to the rebels, with spokesman Igor Konashenkov claiming that it “strangely happened almost at exactly the same time as militants started a large-scale offensive on Aleppo”

I hardly find this to be 'downplaying the attack'. How about 'downplaying misplaced accusations of Russia's guilt' and suggesting the possibility that one of the other parties here might have been responsible. I'm getting the idea by now that even if Konashenkov would have just said "We have no idea who did it", then that would have immediately been proffered by Bellingcat as evidence of Russia's guilt as well. The rest of Konashenkov's statement is given as follows: ''“We have closely studied the video footage from where the incident took place and we did not find any signs of any ammunition having hit the convoy. There are no craters, while the vehicles have their chassis intact and they have not been severely damaged, which would have been the case from an airstrike… All of the video footage demonstrates that the convoy caught fire.”'' Bellingcat has no idea what video the Russian MoD has examined up to the time they made that statement. I'm assuming Russia does not yet have a time machine, so they were looking at some of the initial video/images on social media. My guess would be the night-time White Helmets video of the site, in which little of the actual damage could be seen. Bellingcat references a lot of media that came out after that, suggesting (once again) that Russia is lying about what Bellingcat can clearly see a day or two later. A series of images follow which proport to show "...Konashenkov’s statement is simply not true..."

Series of three nigh-time images showing a shallow roadside crater with debris

 * Labeled as Fig. 7,8,8a

Barrel bomb?
I guess these are suppose to prove the 'barrel bomb' reports. I'm no explosives expert, but I am just not seeing the crater that should have resulted from 200+ kilos of TNT impacting vertically at maybe 600 km/hr. If this was suppose to be a dud, then I'm not seeing any of the unexploded 200+ kilos of TNT nor remains of the giant welded-up pipe section they make these out of nor the large, crude fins they use. There's a very brief view of what looks like a piece of bent 6 cm or so pipe at the 1:25 mark in the source video. At the 1:29 mark, the narrator pulls out a circular dusty white piece of metal, which Bellingcat suggests is the front piece of a barrel bomb. This 'barrel bomb crater' is a few meters from the back of two heavily-damaged trailers, so something certainly exploded there. The last few seconds of this video pan across the street in front of the warehouse/aid station. The crater has been filled in (tan color) near the back end of the rightmost two trailers seen just before the video fades out. 200+ kilos of TNT? I think not. Whatever remained of the two trailers would be half-a-kilometer away.

Russian air-dropped munitions?
I don't know of any Russian air-dropped munition that would produce that meager of a crater (even if a dud). The debris isn't recognizable as anything Russian-bomb related, nor would I expect that big of anything that actually exploded to remain. If it was a dud, the White Helmets would have had video of the crumpled casing all over the internet by now. Standard Russian High Explosive/Fragmentation bombs are the OFAB-100/120 and OFAB-250/270. They are only fuzed for point detonation - they have to hit something first to explode. So without any proximity or air blast option, I would expect a distinctly cone-shaped crater of a meter or two in depth. And no miscellaneous metal chunks at the bottom.

Hell Cannon Propane Tank Bomb?
Of course Bellingcat would avoid examining this option because it would imply the rebels attacked the aid compound. Hell Cannon munitions are usually metal propane tanks filled with a crude explosive - usually prilled (little ball-shaped particle) ammonium nitrate, a common fertilizer in Syria, with other additives like fuel oil, aluminum powder or charcoal. They often contain nuts, bolts and nails as shrapnel. The tanks themselves are often constructed of two halves welded together. When they are used as a cannon-launched bomb, they hit on end with some kind of fuze (usually an old mortar fuze) in the center of the nose-end. The explosion rips the tank in half at the weld and flattens the front half against the ground or inside of it's shallow crater. It flattens like one-half of an orange peel would flatten: by splitting somewhere from the edge to the center. Kind of like the piece they dig out of the shallow crater in the video. The damage is pretty consistent with the blast from such a home-made bomb. In other scenes of the surrounding street, there appear to be a lot of what look like white ammonium nitrate prills but it's hard to tell for sure. Hardly proof it was one of these, but between a Barrel bomb, a Russian air-dropped munition and a Hell Cannon Propane Tank bomb - well, I'll go with the last one.

IED?
These are often made from prilled ammonium nitrate like the Hell Cannon bomb. I bring this up because the crater location is very close to where the front gate would have been. Maybe this was just a raid by rival jihadis and they didn't have a key for the front gate, so they used an IED 'opener'. The other damage to the trucks/compound could have been a battle for the booty.

Crater Conclusion
I don't know what it was, but I would have to at least think Barrel Bomb: No; Russian air-dropped munition: No.

Two images from inside compound showing heavy building damage

 * Labeled as Fig 9 and 10

What could have caused that damage?
Inconclusive. Something smaller than a barrel bomb but bigger than a mortar. Air dropped munition? Sure. Hell Cannon? Sure. IED? Sure.

Fragmentation-damaged truck

 * Labeled as Fig 11

Fragmentation damage?
It looks like. Which makes sense since this truck was facing the main gate crater/bomb. What I don't find credible is that if anyone in the Russian MoD saw this picture, they would claim otherwise. I have to conclude they never saw a detailed, daytime picture of all the obvious shrapnel damage when they made that statement. Another odd thing is that the particular sections that Bellingcat has circled in yellow on their analysis show obvious evidence of bullet holes. Shrapnel rarely makes nice, perfectly-uniform and round holes in patterns like that. An automatic weapon fired straight into the cab looks like that. The obvious question is: Who was shooting up the front of that truck either before or after it was burning? Another piece of evidence supporting the crazy jihadi looters theory and not conveniently explained by Russian aircraft or Syrian helicopters (helicopters shoot from above, not parallel to the ground like a human does).

Fragmentation-damaged car

 * Labeled as Fig 12

Fragmentation damage?
Obviously. Again, if the Russian MoD had seen this exact picture (with their time machine) then they wouldn't have made any remarks about no shrapnel damage. Shrapnel from any manner of bomb that exploded in the compound, so it's not conclusive as to type. This was the local SARC director's SUV and he was fatally injured in it during the attack. One additional thing I found odd is that the air bag is deployed. The compound blast was maybe fifteen meters away. I'm having a hard time picturing a bomb blast or shrapnel from the side of the car triggering the air bag. Not sure what that means, though.

Warehouse - Cardboard Boxes and Crater

 * Labeled as Fig 13 and 13a

Integrated into Critique of Second, Follow-on Bellingcat Analysis Article
A second Bellingcat article followed this one where they asked their 'media activist' pals in Urm al-Kubra to examine and provide photographs of the partially-covered tail piece of an OFAB-250/270. Little about this scene makes sense, and observations make more sense in light of the suspicious nature of the new 'evidence' provided.

What Happened During The Attack - Conclusion
I agree with the statements on obvious fragmentation damage.
 * "...Although something like a gas cylinder could cause some blast and fragmentation, the level of damage show here, and in a multitude of other photos and videos, indicates something much more powerful..."

I don't agree with the above. The propane cylinder bombs are a good 15 or 20 kilos of ANFO explosives. While not as powerful as TNT, they can still take down the brick wall of a two-story building and throw shrapnel 50 meters. If the explosion is less than ideal (often the case with home-brew munitions), then I would expect to find the un-burnt or partially-burnt explosive mixture like AN prills scattered about. These bombs also produce plenty of heat - enough to start plastic and textiles on fire. The White Helmet videos show almost everything burning before the big explosions, so that may not be significant. This alone is not proof that Hell Cannons or propane tank IEDs caused the damage, but it suggests that it was much more likely one of them than Russian air-dropped munitions.

Bellingcat Analysis: Video and Audio Analysis
This section opens with the inconsistent White Helmet observations/claims of the attack details:
 * "...A White Helmet at the scene of the attacks makes two different claims. In the Video 1 he claims: “The regime helicopter targeted this place with four barrels”. In Video 2 the same man claims: “Regime helicopters targeted… with eight barrel bombs” and then states that the “regime targeted this place with cluster bombs two times… with C-5 [presumably referring to S-5 air-to-ground missiles] and with bullets”..."

Followed by Bellingcat analyzing the veracity based on logic that escapes me:
 * "...Although he may be referring to information he has just received, there is no immediate evidence that the latter claim is correct. However, the claims of barrel bombs and helicopters is consistent, especially examining the crater and debris in Figures 7 & 8. Furthermore, the object–likely a bomb’s tail fin– identified in Fig 13a appears to be from an OFAB 250-270, a piece of ordnance delivered from the air by jets..."

The problem with the analysis here is obvious. Certain parts are discarded for lack of evidence, then other parts are 'accepted' based on the specious conclusion that barrel bombs must have been used. These two video segments are of the same White Helmet at the same location at slightly different times making two different claims. The only evidence provided during the video is a single, shallow crater with a round, flat plate buried inside. The analysis makes no mention of the 'missing' barrel bomb craters, the absence of any helicopter sounds or the fact that a few hundred kilos of TNT produces craters a meter or two deep and widespread destruction. Then there's the question of credibility for any claims of White Helmets who apparently moonlight as al Nusra soldiers (or perhaps the other way around). One of their videos has pretty distinctive jet aircraft-like sounds during the attack, so I find it odd that they would initially claim helicopter-dropped barrel bombs. Barrel bombs are not dropped from Syrian jet aircraft as far as anyone knows or has ever observed.

The second Aleppo24 (rebel media) video with the jet aircraft sounds is examined next, but no mention of the broad inconsistencies of the two is made. The second video's middle segment is of the White Helmet workers rescuing people at the site, but they seemed concerned a second (or third?) airstrike is possible without giving any reason for their concern. At one point, they are convinced it is coming and warn everyone away. It's nearly impossible to hear jet aircraft approaching you on the ground before an airstrike and know that they are - in fact - flying directly at you and/or will attack you. Possible, but you usually only hear them as they pass over the location. This was at night in a somewhat noisy location (fires, other vehicles, rescue efforts).

I don't know what to make of the machine gun/C5 rocket comments. It almost seems like that was from a different attack somewhere else and simply tossed in here for effect. The video with the machine gun noise and rounds hitting the ground is from a different location than the one with two big explosions and the White Helmet rescue effort. Either there were two completely different groups of White Helmets miraculously filming the attack simultaneously or these are two different attacks presented as the Urm al-Kubra attack.

Audio Analysis
An examination of the audio transcript provided in the Bellingcat article shows something that looks more like someone trying to convince you of the details of the attack rather than someone merely commenting on what they're observing. There are even more inconsistencies in the audio:
 * Announced that there had been 10(!) airstrikes on the city (and another large explosion followed)
 * Someone asking if the airstrike was 'within their airspace'. This is an extraordinarily bizarre comment. Who witnesses a nearby (supposedly) ground strike and then asks if it was 'within their airspace'. The person on the video is already claiming there were 10 airstrikes - who's 'airspace' did he think they were coming from? This is not something a foot-soldier asks or says.
 * Then this equally bizarre comment: "..Person 1: Tell them we are an ambulance, tell them we are an ambulance… wait a minute, wait a minute….. Allahu Akbar …. Tell him they have destroyed the aid trucks, they have hit the aid trucks..." What? Tell who? Were they in contact with the pilots? Or were they warning fellow al Nusra not to mortar/Hell Cannon them because they were arriving in their ambulance? This sounds like some kind of attack gone bad and they were not intentionally targeting the aid trucks, but unexpectedly did. It sounds like they were warning the people firing munitions at the compound not to hit them in the ambulance. That would explain this person's comments far better than some random White Helmet observer giving a play-by-play of a Russian air attack.
 * The last odd exchange: "...Person 5: Inform us, inform us …; Person 6: They are going to execute the airstrike, they are executing it….." Who talks like that? These people were supposedly at the site. First, how did they know anyone was going to 'execute' and airstrike on them? Secondly, you are worried about the bombs, not the operational description of the task. A normal person (provided they could even know this) would have said "Watch out - they're dropping the bombs" not "they are executing an airstrike!"
 * Granted, these were people in the vicinity of some very large explosions and they were excited, but this sounds too much like people trying too hard to convince the viewer what was happening rather than someone just explaining what was happening. If any more proof of that is needed, I'll offer the last curiously precise comment in the transcript from a person watching the attack at night: "...Person 1: Allahu Akbar …. Allahu akbar …. Allahu akbar….the Russian airplanes has executed an airstrike on the UN’s aid trucks in “Aurem”..." Who needs any evidence when you have an eye witness with night vision?

Conclusion: Wildly inconsistent and speculative without any discernible basis. This actually works against the White Helmet's credibility in many ways, but we have to give these guys some leeway - they're not professional news readers or military analysts sitting in an air-conditioned studio. Still, there's just too little here to go on and nothing that - by itself - is going to add credibility to other more compelling evidence.

Visual Analysis
The visual analysis seems directed at verifying that the explosions on the White Helmet 'Aleppo24' video are, in fact, at the location of the SARC warehouse compound. This is difficult to accept for a few different reasons. The only evidence provided seems to be an outline of the sloped, stepped warehouse roof similar to that seen on a warehouse directly to the north of the compound.



From the explosion's flash to the actual sound is roughly two seconds, so the observer is approximately 660m north-northeast of the compound. The warehouse seems out of proportion considering the distance from the observer. The distance from the front gate of the SARC compound to the corner of the warehouse is only around 80m, so the video camera is another 7x that distance to the NNE. This may just be the effect of a long zoom. Let's say it's possible, but it's fairly weak proof (by itself) of what we're looking at. The explosion is huge - this looks like an IED, not an air-dropped bomb. IF that was, in fact, an air-dropped bomb, then I would easily expect a crater in the order of a couple of meters deep. The flash ball is almost as big as the entire warehouse. It would have had to be something much larger than a Russian OFAB-250/270, which itself would produce a crater a couple of meters deep.



At the end of the Aleppo24 video is a second explosion, but there are no visual cues as to where that was taken. It appears to be in extremely hilly terrain or some odd shaped buildings which doesn't appear to be anywhere near the SARC compound and definitely not where they were standing before. There are other longer videos with this perspective/segment that include 'jet aircraft' sounds and also have tracer rounds of a machine gun/auto-cannon striking the ground nearly vertically in front of the camera operator. This issue will be discussed in detail elsewhere in the main ACLOS Wiki as it was not presented by Bellingcat in their analysis. With regards to Bellingcat and the veracity of the video, I'll just point out that it appears (hand motions, narrative, color balance) that this was taken by the same person that recorded the first explosions segment. The odd thing here is the general issue of how the White Helmets knew a second 'airstrike' (or whatever kind of attack it was) was coming again, and they were able to evacuate over a half-kilometer away and still have time to jump out of their car and tape the second segment of explosions.

I added a red arrow in the first picture (Bellingcat Fig. 14) to point out another odd element in this video. Following almost immediately after the first big explosion is a second one behind the sloped-roof warehouse (from the camera operator's perspective). There doesn't seem to be any part of the SARC compound that far to the west. And it's obvious from the long smoke plume that something behind there has been burning quite vigorously for a while. There are other buildings/warehouses to the west and northwest of the SARC compound that were burning and were hit again in the second strike. Why were those being attacked? The White Helmets and subsequent news services only photographed and filmed the aid trucks and warehouse, as if that was the only and the intended target. Do they know that for sure? The damage to the other buildings seems more extensive than the damage to the SARC compound. It's hard to believe that's just bad aim. Even so, no mention at all? Didn't the White Helmets dig through the rubble looking for survivors? They could see that the damage extended well outside the SARC compound. Below are TerraServer previews of the area about six weeks before the attack, and the day after. The red squares in the second image are areas that - in my estimation - have apparently suffered some kind of blast damage. Yet, no craters like you would expect from an aerial bombardment. It looks more like a mortar or rocket attack



The large white-roofed warehouse at the top of those images also has a substantial hole in the roof not visible in the current Google image. It appeared well before this fall, but someone bombed it for some reason. What kind of activity is going on around there that everyone wants to bomb everything? Have the rebels been fighting each other over something in those warehouses before? That wouldn't be proof of anything of course, but one has to consider that there may be a perfectly good reason for the rebels to attack the location, and it may have had nothing to do with SARC or the aid trucks - they were just in the wrong place at the wrong time.


 * Conclusion: Bellingcat has provided some evidence that there were explosions at/near the SARC compound based on a White Helmet video and narrative. The video adds nothing, however. We can clearly see from news video the next day that there were explosions in the SARC compound. What we can't see is any evidence of cratering which is absolutely expected with any conventional HE/frag air-dropped munition. And there were not just three 'big explosions'. There were many in that area big enough to take down buildings outside the SARC compound, yet no visible craters anywhere in the satellite imagery. So we have the White Helmet 'jet sounds' and narrative, yet nothing. [Except for the suspicious hole-in-the-roof/crater inside the warehouse. That will be examined more thoroughly in my critique of Bellingcat's follow-up analysis which focuses directly on that.] The White Helmet's credibility in these eye-witness reports is questionable. Based only on their claims and this video, I am not seeing anything close to solid proof that this was even an air attack, much less a Syrian/Russian one.