By Christiaan Triebert, for Bellingcat

Last week, we published a survey of open source evidence concerning the alleged chemical attack at Khan Sheikhoun in Syria’s Idlib province. This article builds upon the information presented in that article by comparing the claims made by a variety of actors and sources, including the Pentagon, the Syrian Foreign Ministry, and aircraft spotters on the ground. All times mentioned in this article are in the Coordinated Universal Time (UTC) with Syrian local time (+3 UTC) also included for context. Readers are welcome to suggest information we may have missed in the article, though we only focus on the who, what, and when of the incident, and not on the alleged chemical used in the attack.

The Timing of the Attack

Syrian government

The first air raid conducted by the Syrian army was at 8:30 am (11:30 am local time) on April 4, 2017, according to Walid Muallem, Syria’s Foreign Minister. He made the statement during a press conference in Damascus two days after the attack. The army, he said, “attacked an arms depot belonging to al-Nusra Front chemical weapons.”.

Eyewitness accounts

Locals claim the attack took place around 3:30 am (6:30 am local time) in all available statements. Translations of such accounts can be found in our previously published article on the attack. The earliest reference we have discovered to it being a chemical attack is a tweet at 5:21 am (8:21 am local time), referring to a video published at 4:59 am (7:59 local time).

The Aircraft

There are three sources saying that a Sukhoi 22 (Su-22), a Soviet variable-sweep wing fighter-bomber, conducted the attack: witnesses on the ground, an organisation of aircraft spotters, and the Pentagon.

Aircraft spotters

At 3:26 am (6:26 am local time), ground observers working with an organisation of spotters reported that a Su-22 called Quds 1 — the Su-22 fleet’s squadron commander — took off from its airbase in Homs. The spotters say it is significant if the commander conducts the sortie, as they associate the pilot and his aircraft with other alleged chemical attacks in Syria. Not much later, they report that another aircraft, Quds 6, has also taken off from the base.

The spotter organisation, Syria Sentry, is an outlet employing a well-developed network of spotters taking note of take-offs and initials flight directions of aircraft departing from military air fields primarily located in northwestern and central Syria. Their goal is to issue timely warnings to civilians in opposition-controlled territories. The organisation says they have strong evidence that Russian-operated fixed wing aircraft conducted follow-up attacks in the same area around seven hours later.

The Pentagon

On April 7, as the US conducted a cruise missile strike against the Shayrat Syrian Arab Air Force airfield. It also released an image allegedly showing the flight path of radar blips of the aircraft that carried out the alleged chemical attack in Khan Sheikhoun. The time given in Khan Sheikhoun is 337 Zulu Time to 346 Zulu Time, which converts to UTC directly, thus fitting with the eyewitness and Syria Sentry claims: between 3:37 and 3:46 am (6:37 am and 6:46 am local time respectively), the aircraft was above the town.

The Pentagon map can be used an overlay in Google Earth to gain a better understanding where the radar blips are located with regards to Khan Sheikhoun. However, it is important to mention that it is difficult to connect two-dimensional dots to a three dimensional flight path. Besides, the data appears to be incomplete making a proper analysis of the map probably not accurate.

Eyewitness accounts

In available videos, alleged eyewitnesses claimed that a Su-22 fired four missiles. The first tweets referring to a Su-22 were tweeted at 6:21 am (9:21 am local time) by @ShamiRebel. He links to a screenshot of the Facebook page “The Lens of Khan Sheikhoun and its Countryside”. That Facebook post was published at exactly 6:00 am (9:00 am local time).

Later that day, opposition media outlet Orient News claimed in an article that “a number of field, independent and even Syrian Civil Defense observatories in the countryside of Idlib and Hama” stated that “colonel pilot, Muhammad Yousef Hasouri […] the commander of the Sukhoi 22 Squadron at al-Sha’yrat airport” is responsible for the Khan Sheikhoun attack.

Orient News further writes that Col. Hasouri’s Su-22 carries the Quds 1 banner, and says he hails from Talkalakh town, but currently resides with his family in the “Al-Sakan Al-Shababy” neighbourhood in Homs city.

Two days after the attack, a rumour started spreading that Col. Hasouri was killed “by a bomb blast under his car”, as Asaad Hanna, political officer at the Free Syrian Army (FSA), tweeted. None of these claims can be confirmed, but Hasouri’s name has been associated with Shayrat airfield by both pro- and anti-Assad supporters on Twitter since 2013.

Gen. Ali  Ayoub, Syria’s Army Chief of Staff, visited the Shayrat air base days after the  attack, thereby honouring Hasouri as seen in a video report of the visit. On Facebook, Hasouri is referred to as “the hero who struck the depot” dozens of times. A screenshot of the video linked above is included. Some refer to Hasouri as a Brigadier General, and two members of the Syrian parliament appear to be among those praising Hasouri.

Firstly, there is Fares Shihabi who tweeted that Hasouri was honoured “for destroying Qaeda’s weapons facilities in Khan Sheikhoun, Edlib”. The tweet was linked via his Facebook profile, but has since been deleted. As it was not archived via archive.is or web.archive.org, it is difficult to confirm authenticity of the tweet.


Secondly, Syrian member of parliament Shareef Shehadeh also posted the same still from the video, in which Hasouri is being honoured by Gen. Atoub. It is not clear whether Mr. Shehadeh’s Facebook profile is authentic.

The Times ran a story on Hasouri today.

The Target: A Chemical Weapons Factory?

The Syrian and Russian governments

Neither Syria nor Russia denies that government forces bombed Khan Sheikhoun on April 4. Instead, the debate is over what kind of weapon they used and what the target was.

Russia and Syria insist no chemical weapons were used in the attack. Instead, some of their officials claim that a chemical weapon factory belonging to Tahrir al-Sham was hit, which caused the chemicals – the type of which have still not been publicly identified – to spread. Syria’s Foreign Minister Muallem claimed during a press conference in Damascus:

“The first air raid  conducted by the Syrian army was at 11:30 am [8:30 am UTC] on that day [Tuesday April 4, 2017] and it attacked an arms depot belonging to Al-Nusra Front [Al-Qaeda’s former Syria affiliate, now operating under the banner of Hayat Tahrir Al-Sham] chemical weapons. (…) I stress to you once again: the Syrian army has not, did not, and will not use this kind of weapons – not just against our own people, but even against the terrorists that are targeting our civilians indiscriminately.”

Sources on the ground

With regards to the target area, it is worth noting that a group of silos and a large warehouse are dozens of meters away from where locals said the chemical attack took place.

Post-attack drone footage from Hadi Al-Abdallah gives a good overview of that area. It is worth noting that the damage shown at the silos, the warehouse and other buildings in the area already existed before the April 4 attack, as shown by TerraServer imagery from February 2017.

Discrepancy with regards to time

Between the different accounts of what happened, there is a clear discrepancy with regards to time.

Eyewitness accounts claim the attack took place around 3:30 am (6:30 am local time), with the first reference to it being a chemical attack at 5:21 am (8:21 am local time). This time period is in line with the data of Syria Sentry and the Pentagon.

However, Syrian Foreign Minister Muallem claims the first airstrike – on an “ammunition depot” – was carried out at 8:30 am (11:30 am local time). This is in line with an earlier Russian Defence Ministry statement claiming the attack occurred “from 11.30 to 12.30 local time”, but neither Syria nor Russia have presented any evidence to support their claims, nor is their any available open source evidence to support their claims.

All available evidence, including witness accounts from the scene and airfields, strongly suggests the chemical attack occurred hours before the attack claimed by Russia and Syria. It is difficult to reconcile the Russian and Syrian claims with the open source evidence available, including a three-hour time gap between the narratives, the previous damage to the silos and warehouse near the attacked site, and the available images showing location of the airstrike.

By Christiaan Triebert, Bellingcat

Christiaan Triebert is an all-source conflict analyst with an interest in conflict and development. He has conducted fieldwork in Syria, Iraq, and Ukraine, among other countries. King’s College London and University of Groningen graduate. Contact via Twitter: @trbrtc

Thanks to @THE_47th for noting the link to the social media posts related to Mr. Hasouri, to @obretix with regards to the challenges regarding the Pentagon flight path, and Bellingcat’s Timmi Allen for the Google Earth overlay of that same flight path.


RELATED ARTICLESMORE FROM AUTHOR