Warning: This site contains images and graphic descriptions of extreme violence and/or its effects. It's not as bad as it could be, but is meant to be shocking. Readers should be 18+ or a mature 17 or so. There is also some foul language occasionally, and potential for general upsetting of comforting conventional wisdom. Please view with discretion.

Friday, April 10, 2020

The OPCW's IIT Issues its First Report

April 9, 2020
rough, incomplete
edits April 12, 14...

So after much delay and coronavirus, the first report of IIT is released, just after the 2-year anniversary of the Douma chemical massacre (which it does not consider, by the way).
8 April 2020
Original: ENGLISH
24, 25, AND 30 MARCH 2017


The IIT had promised last year to consider nine incidents including Douma, one attack blamed on ISIS, and 7 others blamed so far on Damascus, ranging from 2014 to 2017. I took a good look at most of those with work assembled here. Three of those cases are covered in this initial report, the three in al-Lataminah, Hama, spanning about one week in March, 2017.

The motive aspect has never been very clear. the Syrian government has negative motive to have committed any of these attacks; they deny all of them and logically the denials should be true. It'll take some actual facts - not just authority - to show otherwise.

Bashar Assad learned that US president Obama had a "Red Line" over CW use; after Ghouta alleged sarin attack was taken as killing over 1,000, threats of war led to Syria joining the OPCW and surrendering its CW program. Allegedly, Assad spent the following years mainly avoiding deadlier agents like sarin, attacking instead with relatively harmless chlorine. Then in late 2016, after using chlorine to random effect in his efforts to re-take all of Aleppo city, he seemingly wondered if Trump had a sarin "red line" too, and started sneaking the deadly nerve agent back in. As soon as Trump was elected, a string of December 2016 attacks near Uqayribat, Hama (ISIS-held) killed nearly 100, it seems with sarin. This was reported, but to little protest and no action - maybe Trump just didn't want to be seen as bailing out ISIS. So Assad tries in "moderate" turf, replicating a near-100-dead sarin attack in Khan Sheikhoun on 4 April, just after signals the US administration would take a more favorable stance on Syria. Then he finds Trump has "many, many lines" that crossed, Washington's softer line was withheld, and US missiles fell on Syria, damaging an airfield.

Prior to that gamble, these 3 Lataminah attacks (among a few others) allegedly tested the waters:
3-24 a bomb with deadly sarin used near militant cave base, affects at least 16, kills no one - doesn't even get mentioned publicly by anyone. I reviewed that one here.
3-25 a cylinder with caustic chlorine used at a cave hospital, affects 30+ and kills 3 - moderate protest. I reviewed that one here
3-30 a bomb with deadly sarin near militant cave base affects 170 mostly militants, kills no one - mild protest, followed by friendly US signals (I did a review of the 3-30 evidence, which I'll use to flesh out a main post on that fairly soon.)
So we can see how Assad might be emboldened to try the Khan Sheikhoun stunt - if that made sense, etc.

In blaming these three incidents more explicitly on Syrian military aviation, the report explains "the IIT gradually came to these conclusions as the  only ones that could reasonably be reached from the information obtained, taken as a whole." Huh.

Michael Kobs: After a first look at the IIT (OPCW) report, I have to say that it looks like a rebranding of old evidence to construct a somehow halfway credible narrative.
The opus revolves around the assertion that the SAA wanted to reclaim territories that it had lost to advancing HTS.

New details on 24-3:
- M-4000 identified from debris
- the one fragment shown might is the same exact one already used for the 30-3 incident ...
I wasted some time with this visual proof before reading the explanation that 04SDS does in fact = 04SDS. "7.29 Moreover, the IIT identified through videos and forensic analyses another fragment as originating from the area of the crater of 24 March 2017 (which the FFM marked as 04SDS when the object was handed over to it with samples related to the incident of  30 March 2017)."
Report S/1548/2017 gives 04SDS date of receipt 18-7 (meaning 17-8, after being recovered 30-7). That report being about the 30 March incident, it had seemed related to that, but nothing in there really specifies - it's not seen at the sarin impact point, and not given as being there either.

- Video of crater said to filmed 26-3 per metadata - can be faked, but logically 24-3 would be a bette date - likely filmed on 26-3, possibly because it didn't exist yet on 24-3, or not...
- soil collection said to be done then, possibly explaining how active sarin could be detected in it 10 months later.

Unseen Debris 
Remnants and possible origin "7.18 On 19 February 2018,74 the FFM received metal fragments retrieved from the crater as remnants of munition parts related to the incident of 24 March 2017 in the southern outskirts of Ltamenah. These were later analysed by OPCW designated laboratories. The IIT assessed all six metal pieces retrieved from the crater and listed by the FFM. After consulting with munition specialists, the IIT reached the conclusion that, out of the six fragments, two can be linked to potential chemical weapons use. "

The other four were either inconclusive or perhaps even contradictory. Let's presume the former and move on to the two that seemed clearer on the point.

"The first of these two fragments, which the FFM identified as SDS28, consists of a very heavy thick metal cone-shaped part, with an attached metal sheet/liner.76 Forensic analysis of this fragment also shows traces of paint. According to munition specialists, the form and shapes of the fragment are consistent with the design of the nose part of Syrian chemical air-delivered bombs, namely the MYM6000 and the M4000 models."

This is not shown, but described as similar to 04SDS (see above): "both SDS28 and 04SDS originate from the same aerial bomb, “based on the similar steel layer assembly, thickness, curvature, and specific linear indentation in the steel liner”.

"7.25 The second fragment received by the FFM, SDS29,77 consists of a large corroded fragment of sheet metal of approximately 38 cm by 50 cm, with traces of dark green paint. According to munition specialists, the form and shape of this fragment are consistent with a fragment resulting from the explosion of an ordnance with limited explosive quantity, and fragments from the explosion of conventional explosives filled munitions would be smaller and have sharper edges. Some of its measurements lower the possibility that this is part of a chemical aerial bomb from the stockpile of the Syrian Arab Republic, and further analyses would be required to reach solid conclusions on the origin of this fragment. "

As described, this might be paneling similar to these partly-connected plates logged for 30-3, but one huge piece bigger than all these combined. The size was apparently an issue, and a big enough one they had to drop one of two rather vague pieces of evidence.

"7.26 The IIT, aware of the importance of the chain of custody in this type of investigation, pursued several lines of inquiry in order to establish it. However, in light of the uncertainty on the origin of this fragment, and as the IIT was unable to fully confirm its chain of custody, it did not pursue this second fragment in this area of inquiry. "
So - two fragments considered, then one discarded as a possible non-fit and unverified provenance, and neither is shown. But somehow there's more; it seems the other 4 recovered items are not described, and it's a coincidence that four other items are then discussed as also relevant, three of them seemingly not recovered. If so, that's 6 recovered plus the other 4 for 10 items. Otherwise, these are the other four:

"7.28 The IIT further considered three fragments that are visible in a video of a crater taken on 26 March 2017, which the IIT confirmed through witnesses and assessment by a specialised forensic institute as being the crater of the incident of 24 March 2017. Two of these remnants were partly buried. Although these large metal fragments are consistent with those created by an ordnance with limited explosive quantity, not enough details are available to confirm their origin. The third fragment, however, is more visible: it consists of what appears as a flat metal part with holes, some containing bolts, and a folded end. The specialists consulted by the IIT found that the visible characteristics of the fragment in the crater are consistent with a ring-shaped component used to attach the membrane of the M4000."

So 3 items seen in the video but not handed over, and the video frames aren't shared, so that's 5/6 all unseen. We've seen a partial support ring … I don't suppose this is the same item.

"7.29 Moreover, the IIT identified through videos and forensic analyses another fragment as originating from the area of the crater of 24 March 2017 (which the FFM marked as 04SDS when the object was handed over to it with samples related to the incident of 30 March 2017)."

And there's an item seen in the video, and handed over - but as recorded that was in August, 2017, as samples related to the 30 March incident were received. It was listed with them, seemed to be one of them. The two fragments they considered SDS28 and 29 were handed over (apparently with four others) on 19 February 2018, AS debris from the 24-3 crater, months after they had 04SDS. So this item was double-booked.

Report S/1548/2017 listed 04SDS(B) date: 18/7 (apparently with 18-7 swapped in for 17-8, as the report gives, noting some fragments were collected on 30 July). It had Sarin, DIMP, IMPA, MPA, MPFA, HFP, TPP, DIPF, hexamine.

04SDS was never seen at the sarin impact site for the 30-3 incident, and wasn't labeled or specified as being found there. Its appearance in situ at what's said to be another crater that could be geolocated clearly trumps any basis for inclusion in the other set. That is this item belongs with 24-3, not 30-3.

The only one they show is the one of six we've already seen, linked to two incidents now. The other was vague paneling that may not fit, and one piece seen on video SOUNDS interesting. No more filler caps, unique tail assembly, parts for a mixing arm, etc. In summary:

Soil returns and sarin samples

Previously it seems the soil sample that tested for sarin was only handed to the FFM on 19 February, 2018, perhaps after being collected recently, but possibly back to April, 2017. That could mean active sarin was found on samples that had weathered for nearly ten months, plus an unclear delay to actual analysis.  But according to the new report, munition fragments were delivered in 2018, while the soil came in earlier, after being collected and sealed just days after the alleged attack. If true, that should make the later finding entirely plausible (which is not to say it was dropped there by a Syrian jet)

Paragraph 7.31 relates the two key areas the IIT verified sarin in relation to this incident:
"In relation to this incident, the IIT specifically–though not exclusively–focused on the analysis performed for the FFM by two OPCW designated laboratories of the fragment SDS28, for which the chain of custody was described above...."
(not clear why they didn't also cite the similar 04SDS seen in the same crater and tested to show sarin as well)
"... Moreover, the IIT requested two OPCW designated laboratories to carry out analyses for a subsample (denominated SLS35) of a sample which had been identified (but not analysed) by the FFM as 01SLS. ..."

Okay, the FFM had this soil sample (SLS) dubbed 01SLS, but didn't have it analyzed for some reason. The FFM or IIT sets out a subsample and gives it a name SLS35 - where the SLS switches order (as it does between uses, for reasons I'm not sure of).

".. This environmental sample from the crater was collected on 26 March 2017 and provided to the FFM on 12 August 2017."

S/1548/2017 (2 Nov. 2017) has SLS02, 03, 04, 05 - any SLS01 is missing from that, which makes sense, except … this shouldn't be included in that list of samples for 30-3 - its missing 01 should be a coincidence. But then again, debris from this incident (04SDS) shouldn't have been included there and it was. Maybe this is the same 01?  It shouldn't be - the Next in line: 02SLS to 06SLS, came on 17 July - nearly a month before the IIT now say investigators were handed that 01SLS.

So presumably - or most innocently - that was 01 in its own system relating to the 24-3 incident. Report S/1636/2018 relates the acquisition of samples for the that incident, giving only the Feb. 2018 date. There's no SLS sample #01 OR #35 listed here. Instead it's SLS18 to SLS23, all with evidence numbers including the date 20180219. No sign of anything dating back to August. So where has this 01 and its subset 35 been since the FFM got it?

To risk adding to the confusion ... they say this 01SLS had a portion set aside called 35SLS. But was it the other way around? There is a 35SLS Soil, ostensibly from the sain impact point for the 30 March incident. Date of Receipt: 12/4/17. It was analyzed, found to have DIMP IMPA, MPA - no active sarin.
It might go like this:
- There were some 30 soil samples (SLS) that didn't matter, or they start counting at 30 instead of 0
- then 31-35 are logged in April
- the last has a portion set out and given the number 01SLS - because now they start at zero again?
- That sits in some limbo, later has its subest develop sarin and becomes the 24-3 soil described with a backwards origin story and an August date
- Later in July they get more from the 30-3 crater, under metal, and dub these SLS02 and so on.

Likely it didn't go like that - the same numbers might be used and passed in different systems, besides for each incident, allowing for confusing coincidences. But in this case, the lines between one incident and the other are so blurry, it seems likely they share the same numbered samples that came in whenever, described as whatever suited the day's purpose.

"Staging" considered 
The IIT addresses the possibility of a false-flag incident or staged chemical attack for each of the three incidents. Previously when this was aired, it was rejected, said too close to attributing blame; we know who's hands those would be. To decide an object is falling from the air with a velocity is just as specific; we know who operates aircraft in Syria. But that line of investigation was not just allowed, but actively pursued even when the evidence didn't support it. https://libyancivilwar.blogspot.com/2019/06/the-ffms-mysterious-mandate-to-blame.html

In light of last year's troubles and growing awareness of the OPCW's gross institutional bias, they bring it up - always in quotes as "staging" - and find that it would count as a "use" of weapons worthy of calling out: "“staging” of chemical attacks (or organising “false flag” chemical attacks, as this is at times described), if done through the use of chemical weapons as defined in this section of the report, would constitute “use” of chemical weapons under the Convention."

In contrast, the FFM had put manual placement (staging) as outside its mandate for being too blamey AND not being a "use" of CW, which is all they were tasked with finding. Now they explicitly consider it and talk about that, to clarify that's not off-the table. As we'll see, it's just set precariously at the table's edge and then knocked off - "gradually."

5.4 lists four scenarios "developed for this investigation" and "bearing in mind the specific circumstances of each specific incident"
(a) chemical weapons were prepared elsewhere, brought to–or around–the sites of the incidents identified by the FFM, and used; or
(b) chemical weapons were air-delivered on–or around–the sites of the incidents identified by the FFM; or
(c) chemical weapons were launched, spread, or deployed otherwise to–or-around–the sites of the incidents identified by the FFM; or
(d) no chemical weapons attack occurred, but conventional weapon(s) were deployed or brought to–or around–the sites of the incidents identified by the FFM, while chemicals were used at the sites later to “stage” a chemical attack and blame one side of the conflict.

I don't see this list as very helpful. It's not clear what a and c actually mean (CWs were "brought", or deployed by whom?), with ony two being clear on perpetrator. The choice is mainly between b (government airstrike) and d - the CWs were brought in order to blame someone else, perhaps planted via deployment (d via c). In other cases, I find the an option like that generally explains the evidence best.

The report helpfully gives some detail on how they presumed an option d might play out. 11.4 "... the aerial munitions used on both 24 and 30 March 2017 are very likely M4000 aerial bombs, developed and built only by the Syrian Arab Republic." 11.5-11.7 sarin made using the same formula of DF as Syria's (or one that yielded the same markers they were looking for). 11.9 ... the IIT could not find any information supporting the hypothesis that the Syrian Arab Republic lost control of its chemical weapons stockpile, whether aerial bombs or sarin and its precursors."

But it's still not clear the sarin they keep finding is made by Syria or even uses the same formula as them. The DF similaities seem to be genuine and might even be fairly specific, but even exact forumlas can be reverse-engineered and replicated by states or non-state actors who could get their counterfeit agent into the right hands in Syria to have the govenment framed. The main thing anyone has poven is the same kind of sarin keeps being used - they think by the authoities, but maybe it's the terrorists behind all these incidents. (see here).

As for the bomb, the IIT notes the Syrians claiming to have repurposed all their remaining M4000s in 2013 to carry conventional explosives and help in the fight against the foreign-backed militants. The IIT pointedly didn't agree to this, but didn't dispute that at least some M400s were so converted. Bellingcat noting two examples found totally or mostly intact were probably of this kind and had failed to detonate. Presumably others had been dropped, some of them would have worked, and they'd have scraps from these. There's no need to raid stockpiles when the things are falling into rebel hands, as I had noted here, sometimes from petty low altitudes (low enough it hadn't even settle on a nose-down position?).

Or maybe the one shows there HAD BEEN some raiding? It's also quite possible the militants used their skills and tools to fabricate their own copies of the M4000, as soon as the design was known to them. In fact the noted differences between the schematics and field examples always suggested this (but far from poved it - the authoritativeness of the schematic is unclear).

The IIT and its experts doubted the fragments were small and twisted enough to be from a TNT bomb that detonated, suggesting ather a limited-size CW bursting (or opening) charge but I think they were wrong. The small number, small size, and extreme distortion of some fragments might prove that to a true expert (the distortion might require partial melting like in a very high energy blast, and some of it seems to include black scorching as well). The back end didn't fare too poorly, but the rest of it seems to have nearly vaporized. Only the most solid and central bit(s) of the front survived, joined by almost nothing from the middle, or the bulk of its exterior. Be it a full load of TNT or just the opening charge, if it was so powerful to rip the bomb into such small pieces, how would it fail to vaporize the sarin blamed for sickening some 170 people? That's with what IIT calls the "overabundance of elements" from the most intact of three uses alleged, arguing this pointed to a limited-power opening charge. But that point doesn't hold up well with the other two alleged uses.

It's most likely these things were planted manually at each of the sites. With three filler caps seen between the 3 incidents, we're looking at parts of 2 bombs. But aside from the caps, the remnants might all be from one unit they just gathered the biggest pieces from and divvied them up unevenly between their two and then thee incidents.

The IIT seems to have considered just one method for getting M4000 scraps that could wind up testing positive for sarin:
11.10 The IIT further explored the possibility that armed groups could have retrieved used (fragments of) chemical weapons from sites where the authorities of the Syrian Arab Republic had tested chemical weapons prior to accession to the Convention in order to “stage” chemical attacks. Such an act could in theory have enabled them to place contaminated fragments at the locations of the incidents of 24 and 30 March 2017, for example, in order to “stage” a chemical attack there.
In pursuing this line of inquiry, the IIT identified through its investigations only one such testing range where some warheads and aerial bombs were tested with sarin prior to and in 2009. The IIT obtained information that armed groups close to ISIL/Daesh reached the vicinity of this testing range in 2016 and early 2017, but was unable to confirm that they ever took over the facility. Moreover, the IIT considered the low likelihood of an armed group deciding to retrieve contaminated fragments from before 2009 or before, keeping them in the appropriate conditions, and then using them in March 2017 to “stage” an attack at the exact time when military airplanes of the Syrian Arab Republic were overflying the area of the incidents. However, such an armed group, even if it had succeeded in achieving all this through careful planning and execution, would not have been organised enough to ensure that the area was sufficiently secured to protect the fragments in question carefully collected and stored, or at least to ensure that an independent third party could sample the fragments shortly after the alleged incident. In other words, the planning and execution would have to have been carried out impeccably for the first part of this complex staging operation, while the group would have missed, or would not have been able to properly plan and carry out, the second–critical–aspect of the same operation (i.e., ensuring the proper chain of custody of the staged fragments and samples so as to promote their propaganda aims)."
This is not the only scenario to consider, but it's one that fails, and the one they chose. It assumes sarin can only be deposited on fragments by the Syrian government, and remnants tested in or before to 2009 should have active sarin after planting in 2017? 8+ years? That's an absurd plan no one would have, and the IIT seem proud of themselves for showing it wrong. In fact, they identified a further defect of this straw-man argument:

"11.13 Finally, the IIT obtained information that, in any event, none of the aerial munitions tested at the testing range mentioned above contained sarin, and that the M4000 model (which experts assessed as being most likely the model from which the fragments found for both the 24 and 30 March 2017 incidents derived) was not tested by the Syrian Arab Republic with sarin, but rather with sulfur mustard. In light of various factors, including these considerations, the IIT considered this “staging” scenario as implausible."

So there wouldn't be sarin on the ten-year-old scraps anyway! The IIT didn't want to consider that the foreign-backed terrorists might have their own sarin to contaminate things with, having filled weapons with the stuff and fired them on soldiers several times (at Khan Al-Assal anyway, the UN-OPCW saus it's the same stuff used in Ghouta, Khan Sheikhoun, these Lataminah attacks, and others). And as I've said, a more plausible way to get fragments of an M4000 is to have a repurposed one blow up after it's been dropped on you. They could also seize intact copies as they overrun a military installation, or even make their own, then possibly re-fill it themselves with sarin, and then modify it to be launched from a mortar. Maybe a catapult would work. The likelihoods vary, but there are countless possible ways this could be done. The IIT picked a lame one and then discounted it, leaving the remaining options as open as they ever were.

The IIT calls on a few specifics for each of the thee incidents, so I'll consider each in chronological order.

"Staging" dismissed: 24-3
They didn't have much to say against fakery here: 7.9 explains how the crater, "between 1 to 2 metres deep and approximately 2.5 metres in diameter, with a circular shape" was probably from a jet-dropped bomb; "The estimated size of the crater fits the scenario of an aerial bomb with a burster-type explosive charge, impacting the ground." But they note it "might also be consistent with an event “staged” on the ground, as long as the person(s) “staging” the attack were applying the correct amount of explosive to create similar crater characteristics, and had knowledge of the type of soil in the area." I suppose those points are both true; it could be explained by either option. The remaining evidence will help narrow down which it is.

As seen above, only two pieces of nosecone material and a possible large segment of outer skin, and no other fragments of the bomb were recovered - not a very good set-up to claim small-charge blast of an M4000. And as the scene doesn't support a larger blast, a problem appears.

"7.10 Flight data, including information from an early warning network, show that between 5:30 and 5:45 a Syrian Su-22 military airplane took off from Shayrat airbase and attacked Ltamenah. ..."
(I don't believe this Sentry Syria is radar-reliable or verifiable. They issue specific notices that don't seem entirely made-up, may be all true or partly untrue)

"... The attack was further confirmed by persons who either saw or heard a military airplane–with its distinctive sound–around the location of the site of the incident between 5:30 and 6:00 that morning, with one specifically recognising it as a warplane engaged in a diving manoeuvre described as typical of Syrian military aircraft."
(so they say, with an excess of condemnatory information )

"7.11 In assessing the information from witnesses to the event, the IIT sought and obtained additional information corroborating the accounts by the victims."
The witnesses - including sentry Syria - were supported by: "Su-22s were based at Shayrat, "flight data from 24, 25, and 30 March 2017 reveal that Su-22s departed from Shayrat airbase at least 19 times" and "the Su-22 is used in that theatre of operations only by the Syrian Arab Air Force." (7.12, 7.13)

11.4 In addition,... The IIT was provided with expert advice that the aerial munitions used on both 24 and 30 March 2017 are very likely M4000 aerial bombs, developed and built only by the Syrian Arab Republic."
and as noted above - falling into rebel hands, sometimes from not so high.

But it seems their favorite agument for this case simply inverts its biggest problem. This same move was made earlier by Eliot Higgins: "I've been unable to find any social media posts or open source reporting on the attack, so it doesn't really stand up that it's a false flag, because if it was why did no-one talk about it?" It doesn't "stand up" that it was real, at the time. Why else would no one talk about it? The IIT also seems to miss that point:

"11.11 With specific reference to the incident of 24 March 2017, such an intricate staging exercise is also at odds with an almost complete lack of publicity, not consistent with the complex and lengthy efforts which would have been necessary to retrieve from elsewhere, store, and prepare contaminated fragments for use and collection as samples. ..."

As Michael Kobs noted "After the OPCW report, however, Higgins hastily rowed back. How could it have been a 'false flag' operation if nobody talks or writes about it? Interestingly, the IIT report coughs up Eliot Higgins' argument. Coincidence? Certainly not."

Well it's hard to say if they did or would have come up with that thought on their own, but either way, it's a lame point. If the militants had faked it correctly at the time, it is almost certain they would have mentioned it. Therefore we conclude they staged it later, either because they did it wrong the first time didn't do it at all. Lacking a time machine, they had to stick with the existing lack of mention. I've suspected that they simply didn't think of the allegation at the time, and would therefore have done none of those "intricate" things. The IIT report adds reference to a video, which was never shown publicly. To the extent they may have filmed a video on the 26th (as the metadata says), maybe there was such a plan by then. But if so, their failure to follow up with mention is a problem, not a strength; it suggests the plan didn't work out right, perhaps leading them to delete the event and try it again a week later.

"... Even assuming that this was a case of “staging” an incident that did not fully work out as originally intended (because, for instance, the contaminated sarin was released in the wrong place or at the wrong time), had an armed group gone through the trouble of retrieving, storing safely, and preparing sarin-contaminated fragments of a weapon, it remains unclear why it would have then failed to properly publicise the intended message."

Uh ... IF the video proof or other aspect of their allegation didn't support the intended claims, the IIT wonders why they didn't just publicize the claims anyway. Probably because they wanted the video and a correct story for an important claim on the re-emergence of sarin. If the relevant story was mucked-up badly enough to ignore it, then it WAS mucked-up that badly, and that's why you didn't hear about it.
Perhaps the problem was with the 25-3 incident - maybe their use of sarin there was deemed problematic (I couldn't say just why), so they reported just the chlorine. But then they had sarin in the samples sent in, and at about that same time, had the 24-3 incident to explain it - patients had washed off there prior to treatment. It could be that anomaly was the central reason FOR the 24-3 incident to materialize.

To be clear, that "almost complete lack of publicity" is a TOTAL LACK, AFAIK, until the FFM got to break the story. The better question stemming from that was always why no one mentioned it then - except to say it DIDN'T HAPPEN - if it did happen? Because the "elaborate staging" was done long after the window for at-time reports had closed. This video from well-connected parties followed the 30 March incident and they still didn't know to mention this had also happened last week - they still say it's never happened before. From this, we can deduce the idea to claim a 24-3 incident still hadn't gelled even at this point. It was thought up by the time they mentioned it first to the FFM sometime afte 10 April, but not long before that.

Furthermore, if there were messed-up plan they didn't want talked about, people might conspicuously deny any such prior event But I don't see that as suggested; the few denials feel sporadic and natural, not the work of people told to deny it - the newness of a jet sarin attack is just another feature of it some mention but most don't. It seems as if the prior event just hadn't been thought up yet.

"Staging" dismissed: 25-3

"Staging" dismissed: 30-3

More to come ...


  1. 12 August 2017 appears to refer to #9-12 "Handed over by 1396" so they haven't unexpectedly delivered these in the initial interviews. FFM 4.11 doesn't mention this 01SLS environmental sample at all.

    All via "one of the persons present at the location on that day" who looked at the site "just a few hours" later but then didn't film it for 2 days (if that metadata is even accurate of course- recalling FFM on Douma: "incorrect timestamp on the metadata is likely to be due to incorrect date/time settings on the device that generated the files"). The black bubbling crater that burns skin and injured 2 families that was too dull to document.

    1. yeah, video + audio files and a drawing from 1396 are the only things listed for that date, or that whole month (at least where that evidence no. is given - several items also said received on the 17th). So they're saying 01SDS was handed over probably by 1396 they met that day.

      Two 4.11s might have mentioned 01SLS but didn't:
      S/1548 4.11 Information related to the samples is detailed both in Section 5 and Annex 4 of this report. At the time of handover, an NGO informed the team that the samples, received on 12 April, 17 July, and 17 August 2017, were taken by them.
      Representatives of the NGO were also interviewed and provided photographs and videos from the scene of the alleged incident, including the sampling process.

      S/1636 4.11 During the first interview on 10 April 2017, the FFM received environmental samples relating to the alleged incident of 25 March 2017 from the interviewee. Further environmental samples were provided on 12 April 2017 and 19 February 2018 by an NGO.

  2. There seems to be a bit of a disconnect between FFM 5.22, 5.23 etc. and IIT 7.14, 7.15.

    IIT: "16 persons" "most cases were considered mild"
    FFM: "16 civilians" "all cases are described as being mild"

    IIT have tried to increase the severity and shuffle other evidence to try and add weight to the garbage for March 24 ('look at this early sample we had all along but never mentioned or tested'). They still haven't revealed when the soil samples in the FFM report were actually taken.

  3. Also interesting that the late Hasna provided take off and landing times for the Quds-1or6-stealth-Sentry-Syria-avoiding-Su-22 on March 30 (9.12) but not March 24 (7.10-7.13). Spotters day off during their own offensive, really? For 7.6, it can be seen from the SNHR report that even Hasna the aircraft monitor knew about the need for "an early time when the weather is calm and suitable for bombing poison gases".

  4. Maybe of interest re. sample codes - Khan Sheikhoun was in the 'wrong' order. 28 and 29 delivered by the White Helmets April 13 (see table 2) in table 1 become 17SLS and 18SLS in table 7. Samples from SAR are not received until June 18 but start at 01SLS in table 8.

    So for Latamneh, the question is did they really receive 01SLS or just reserve the code as they had for Khan Sheikhoun (hence no mention of it being handed over) and so IIT report is wrong.

  5. This comment has been removed by the author.

  6. 9.11 The video "authenticated by the IIT as being from the attack of 30 March 2017" - from *the* attack. How could they do this? Unless a different video (doubtful), it shows no falling bombs, the visible 'chemical cloud' at Khan Sheikhoun was described as many things but never a "grey smoke plume". When experts analysed videos for the JIM they could only narrow down to a 10 minute window "between 0642 and 0652 hours" and what qualifies as "almost no sound" here?

    11.10 as you quote, "at the exact time when military airplanes of the Syrian Arab Republic were overflying the area".. but the IIT show the "exact time" is never necessary. They give vague times in 7.10 and more exact times in 9.12 from some 'other source' not available for March 24. Are we meant to pretend that the countries that can bomb Syria with impunity aren't monitoring the airspace daily and wouldn't have exact times/radar data for both? And believe that "Quds 1" Su-22 doesn't trigger the Sentry Syria messages that other Su-22s at the same airbase do (or anywhere else in Syria on either day).

    IIT describe staging that would need to be "impeccable" and "complex" but then cannot confirm the FFM's new 'relaxed' chain of custody, accept allegations with no verified victims, no biological samples, no medical records etc. Giving oxygen, spraying everyone with water and then handing over a list of unverifiable victims and symptoms is what Higgins describes as "elaborate". 11.12 suggests lubricant inside part of a mixing system would need to be a 'concoction' but then what did the repurposed bombs dropped all over Syria include? Also, to have planted it in the first place, someone would have to have known what the part was intended to be (or genuinely is).

    11.9: this argument comes up over and over but then never goes on to ask why Syria *wouldn't* claim that someone had stolen precursors or sarin from the stockpile. If done successfully, the Syrian gov. wouldn't be aware they had lost control of their stockpile and the perpetrators would not advertise they had the sarin or precursors.

    The IIT's logic slides in 11.11: "Even assuming that this was a case of “staging” an incident that did not fully work out as originally intended ... it remains unclear why it would have then failed to properly publicise the intended message". In the IIT's *own scenario* here, the staging has just gone wrong so wouldn't publicise it. Plus they tried again 6 days later.

    1. been slow to add my similar thoughts. Good thoughts, similar to my own. :) I may borrow some.

  7. Bellingcat have helpfully identified a command post just east of Qomhane, labelled "Mt Zayn al-Abdeen" here:


    The video location is just over 10 miles from Latamneh and so "overlooking" it (imagine buying an apartment from Bellingcat that they say 'overlooks' the beach. As bad as their definition of "elaborate"):


    As nothing else was happening in Hama and Latamneh only had a hospital and local services such as Jaish al Izza's headquarters (IIT 6.13), when SAA generals got together to point at something east of Morek on a map, they were obviously there to take time off from 'breaking the will' of the fields south of Latamneh and instead watch an elderly transport helicopter use up fuel and risk pilot and crew to 'target' an underground hospital cave complex with just a small gas cylinder.

    BC are keen to point out that GPPi connected Tiger Forces to every chlorine attack (Tobias Schneider seems to have uploaded the missing SANA video for them) and would like everyone to ignore IIT's 8.10 where even they find GPPi's 'evidence' provides "insufficient confirmation or corroboration".

    As an aside, when looking at Khan Sheikhoun the hospital in Ma'arat al Numan was easy to find because it was simply on Google Maps and there was no instant mission to destroy it.

    Anyway, more interesting here: IIT 8.14 - they have to estimate the size of the hole so if the data had never been collected there cannot have been much modelling or studies conducted on the plausibility of the a bunker-busting gas cylinder event.

    In 6.25 the IIT's "specialists" identify "probably munition storage facilities" at Shayrat but there can't be anything setting these storage facilities apart because as we know in JIM's S/2017/904 when they finally visit Shayrat (52) "collecting samples at the airbase was not an objective of the visit" and "there was little chance of finding any trace of sarin or its degradation products at an airbase of that size". So there are munition storage facilities... at an airbase.

    1. Although the explosions are filmed at the same time - https://imgur.com/Qe6Ma7D - they really don't match (IIT 8.19) "yellow smoke rising [?!] from the location of the hospital" or anything gas cylinder related. Bellingcat cannot use a ruler on a scale diagram, work out that 7:30 to before "between 8:30 and 9:15pm" is less than their expert's '2 hours needed to develop pulmonary edema' and their backers could probably get someone else to do a better job without the tourette's, but it does highlight how something like adding in conventional explosions would be needed to e.g. witness a 'sarin attack' from a distance. Which Quds 1 conveniently then does (twice), making clouds to film with nothing specific to a chemical attack needed. Just as 'Assad' conveniently alters gas cylinders to show they have been weaponized. Or uses 'gas' because what better way for someone to show they are a tyrant than gas attacks. And maybe, as ex-British military keen on their military history, thoughts turn to the trenches and so to chlorine.. can see how the idea might form. Just as someone might try and erroneously connect Tiger Forces in the hope they are destroyed as punishment, removing the SAA's best troops etc.

  8. A nice spot by Mr Watson, Halab Today video on twitter is slightly different and shows someone next to the crater minus hazmat suit ~13 seconds in


  9. IIT 8.25 "The IIT considered carrying out analyses of the cylinder identified as the one hitting the hospital in Ltamenah on 25 March 2017, and made attempts to retrieve it, but the circumstances on the ground did not allow the IIT to organise its transfer."

    8.26 "Cylinders [plural? - but back to singular in 8.27] related to this attack displayed visible markings consistent with having been fitted with a steel strap-in structure–i.e., a steel frame with a weighted nose part, wheels, three tail fins, and two lifting loops–or were actually observed with remnants of this cradle."

    Observed.. so where is it?

    8.27 "The markings on the cylinder of 25 March 2017 which hit and entered the hospital are consistent with a structure fitted around it."


    Gas cylinders are secured in similar places with chains and straps on wall mounts or for transport, but the IIT declares the marks on this cylinder (that they couldn't recover to examine) are due to a harness that wasn't ever mentioned by the FFM and that is not shown in IIT Annex 4.

  10. Maybe relevant for 'square' parts:


    Sarin and plants in Japan:

    "The next day" ... "Trees and grass on the scene were observed withering, and the colour of the leaves had changed".

    Unable to find any pictures of how this looked to compare but in Khan Sheikhoun the only leaves shown (that I'm aware of) were by the gate to the yard with the goat, not by the crater interestingly. Below that: the vegetation around the Shayeb cave. Nothing like Latamneh's more uniform 'poured water' vegetation damage.



Comments welcome. Stay civil and on or near-topic. If you're at all stumped about how to comment, please see this post.