All bellingcat articles

all-bellingcat-articles.csv

year,month,url,path,articles_text,publish_date,title
2014,7,https://www.bellingcat.com/news/uk-and-europe/2014/07/31/did-coulsons-news-of-the-world-incite-others-to-commit-crimes-and-cause-unsafe-convictions/,/news/uk-and-europe/2014/07/31/did-coulsons-news-of-the-world-incite-others-to-commit-crimes-and-cause-unsafe-convictions/,"

More on the Fake Sheikh, the Police, and News of the World by occasional blogger @jpublik.

Andy Coulson‘s News of the World sent a man to jail after luring him to sell them drugs he was terrified of carrying by promising him a job. He was sentenced to four years in prison before his conviction was quashed – after he’d already served his time.

In a case which has hardly received any publicity, according to high court documents, Albanian Besnik Qema was asked to supply News of the World cocaine and a passport on a promise of job as security for a wealthy Arab family.

The High Court documents detail how in January 2005, Mazher Mahmood had asked Florim Gashi, a contact of his who he had used in previous “set-up” stings to find someone who could be implicated in a story he or the News of the World wanted to run about false passports, drugs and guns. Gashi then adopted the identity of a female called Aurora and through an internet chat room used by expatriate Albanians established contact with Qema.

Over the course of lengthy 4 or 5 telephone calls, Gashi then “honey trapped” him. Using his false female identity, he held out the prospect of romance/sex between them and also the prospect Qema might be able to get employment as a security guard with a rich Arab family at the rate of £8,000 a month.

Gashi told Qema ‘she’ had facilitated a meeting between him and a member of this family called Mohammed, and Qema’s chances of employment chances of employment would be enhanced if he could supply the family with cocaine. And a false British passport. Mohammed was in fact Mazher Mahmood.

Qema obtained 3 grams of cocaine from a man called Mehmet who was an associate of his. On February 4th, at a pre-arranged meeting meeting at a McDonalds in Liverpool Street supplied the three individual wraps to Mohammed (Mahmood) in return for £210 and a further supply was discussed. Mahmood was accompanied by Kishan Athulathmudali, an employee of News of the World who was posing as a member of Mohammed’s family.

Gashi, again under the guise of Aurora, then asked Qema to obtain a false British passport for Mohammed, so it was said, Mohammed wanted one for his cousin who was in the country illegally. At a further meeting with Kishan, Qema was given a passport photograph to use for the fake passport and £200 deposit for it which he then handed to Mehmet.

On 11th February, arrangements are made between Qema and Aurora for more cocaine and the passport to be handed over to Mahmood the next day at the Hilton Hotel in Park Lane, London.

Mahmood then tipped off the police that an undercover operation had led the newspaper to discover via a confidential source [Gashi] that Qema was actively involved in crime and dealing with drugs and false passports and he had access to firearms. Mahmood did not tell the police the source was Gashi. The reason for this is because a case involving Gashi had already collapsed 18 months earlier when the Crown Prosecution Service had found Mahmood had paid Gashi £10,000 who then become main prosecution witness. It’s clear from then on, Mahmood had to hide Gashi from prosecutors.

Mahmood supplied the police with with a photograph of Qema and told them analysis had showed the powder already supplied by Qema on 4th February was cocaine. He also told them Qema would be in possession of more cocaine and a passport at a meeting arranged at the Hilton Hotel on 12th February.

Mahmood didn’t tell police of the circumstances in which Qema came to be in possession of cocaine and a fake passport, in particular, the inducement offered of a job as a security guard or that the drugs had been a suggested sweetener to enhance Qema’s chances of getting the job.

On 12th February, Qema met Mahmood as agreed at the Hilton Hotel. He was so terrified of carrying the drugs in his pockets, Mehmet delivered it to the hotel and gave it to Qema outside the hotel. Qema went back into the Hikton and was arrested by police in the coffee shop minutes later, in possession of both the cocaine and false passport.

The next day on 13th February News of the World ran the story under a Mazher Mahood byline story;

‘Cops swoop after we expose a scandal; he [Qema] met us in McDonald’s at London’s Liverpool Street Station. After claiming he supplied drugs to celebs, Qema gave us three wraps of cocaine “it’s good stuff, around £70 a gram.”‘

‘In another meeting, Qema turned into an immigrant smuggler. He said; “it’s £1,200 for a travel document and I can get you a passport for £1,700.”‘

‘But evil Qema has another sideline. He told our reporter; “if you like, I can get you a gun. They start from £300″‘

There is also a quote given from ‘Aurora’ claiming Qema is a pimp.

The next day, Febuary the 14th Qema pleads guilty at Bow Street Magistrates Court to 3 charges: one supply of a class A drug (the 3 grams of cocaine supplied in McDonald’s), one of possession with intent to supply a class A drug, and one of possession of a false instrument (respectively the drugs and false French passport he had in his possession when arrested at the Hilton). He was remanded in custody and committed to Southwark Crown Court for sentencing.

On 14th March Qema appeared at the the Southwark Crown Court for sentence before HH Judge Dodgson. In his witness statement Mahmood did not reveal the name of Gashi, but said he was told of Qema activities by a confidential source and he exhibited one of the telephone calls between Qema and his confidential source [Gashi].

During Qema’s plea in mitigation, an account was given to the Judge of his entrapment by Mahmood and his colleagues from the News of the World involving a female called Aurora. Counsel accepted on Qema’s behalf that; “It is one of those cases…where entrapment can be used as full mitigation, not a defence” and said “it is accepted that this defendant was a willing participant in the matter. It was also said Qema had been “momentarily blinded by an offer, as fake as it was, of a glamorous well paid job…”, that “he fully accepts by his plea of guilty that (the supply of drugs) was an entirely a stupid thing to do” and that entrapment “does not afford a full defence. He went in with his eyes open as it were.”

The Judge sentenced Qema to 4 ½ years imprisonment: 3 years for the supply of cocaine; 12 months concurrent for possession of cocaine with intent to supply and 18 months consecutive for possession of a false instrument.

On June 24 2005 Qema sentenced was reduced by 9 months on appeal.

On September 6th, three Scotland Yard detectives flew out to Dubrovnik, Croatia to interview Florim Gashi. Gashi claimed Mahmood had told him he needed a story about someone who could get a British passport, a gun and drugs, so Gashi had gone on the internet posing as a female under the name of Aurora and found Qema. He told police Qema was a nice man and that he had induced him to obtain drugs and a false passport. He said; “Qema said I can’t do this but for your sake I’ll do it but i won’t carry drugs in my pocket. I said please do it. Qema says he’ll ask his friend to bring the drugs up to the hotel.” Gashi tells detectives Mehmet brought the drugs to the meeting – not Qema.

Two more Scotland Yard detectives flew out to Vienna this time to Gashi again where he told the; “I feel particularly guilty about 2 cases. One has resulted in a totally innocent man being sentenced to 4 years [Qema]. Another is the girl whose child was taken into care.”

The very next month, in October, Guardian columnist Roy Greenslade revealed Scotland Yard were investigating Mazher Mahmood and News of the World – whilst collaborating at the same time – because of Gashi’s explosive new claims. However, Qema remains in prison.

He would remain there for almost another year.

Qema was released on license on 17th August 2006 but tagged, and made the subject of a curfew. The next day Qema sought leave to appeal against his conviction out of tint on the basis that material had come to light as a result of other trials which had taken place following “sting” operations by Mazher Mahmood and his associates, but the Court of Appeal declined jurisdiction: given his plea of guilty.

The previous month, Gashi told the jury at the red mercury trial he told that he set up the Victoria Beckham plot with Mahmood. He said; “Maz said I would get £10,000 and another £5,000 if they got prosecuted,” he added “I would get it if I could convince them to talk about the kidnap of Victoria Beckham and her children.” The case is thrown out – three men walk free.

On September 9th 2010 at Southwark Crown Court with the consent if the CPS, Qema was permitted to vacate his guilty plea. His conviction was the quashed.

Mr Bowen QC for Qema told the hearing Mr Mahmood knew there was little or no prospect Mr Qema being brough to or convicted after a “fair and impartial trial ” because he was aware that the crucial evidence on which the prosecution would be based, was that of Gashi, who’s evidence could not be relied on by the prosecution; and because he know Mr Qema had been entrapped and that if the circumstances of the entrapment had been known, it was unlikely that prosecution would be brought.

This case has never reported by the media – apart from Roy Greenslade four months later. New allegations of phone hacking is reported by New York Times the first week of September so that remains the agenda before it explodes in the Summer of 2011.

Related articles",2014-07-31,Did Coulson’s News of the World Incite Others to Commit Crimes and Cause Unsafe Convictions?
2014,7,https://www.bellingcat.com/news/uk-and-europe/2014/07/30/the-context-of-caryatid-part-1/,/news/uk-and-europe/2014/07/30/the-context-of-caryatid-part-1/," - Part 1

Over the past two years my “regular contributor” has written on all things Leveson, phone hacking, and police corruption, with much of their work gathered on the Brown Moses Blog – Hackgate Files. Now they’ve come to Bellingcat to continue their work, beginning with a look at Mazher Mahmood (aka the Fake Sheikh) and the Metropolitan Police.

Miskiw, Mahmood and the MET

In January 2004, a journalist from the News of the World (NOTW) was interviewed by MET police on suspected criminality resulting from Operation Motorman. It was GREG MISKIW.

Yet just a few weeks later, MET police were enthusiastically commiting to a £1million+ collaboration with the NOTW on a newspaper ‘sting’. This time the journalist was MISKIW’S investigations desk close colleague – MAZHER MAHMOOD.

This contradictory dynamic between NOTW and MET deserves more scrutiny and was first addressed by the Brown Moses blog two years ago. (here)

GREG MISKIW was one of seven journalists interviewed under caution in Jan 2004 – one each from News of the World, News of the World Scotland, Daily Mirror, Sunday Mirror, Mail on Sunday and two freelancers according to Det Chief Inspector Brendan Gilmour. (p13 here)

MISKIW attended Colindale police station in North London, accompanied by a legal representative of News International. He was questioned on the c.90 occasions he had commissioned private investigator Steve Whittamore, on related allegations he had paid another Whittamore associate – John Boyall – to procure data from the Police National Computer (PNC), and that he had bribed mobile phone company employees for information. (here)

No further action was taken by the police against MISKIW on PNC allegations, bribery via Boyall, nor that he had obtained illegal vehicle registration checks and criminal record checks from Whittamore. Little wonder that at the trial of Whittamore, Boyall and their two MET police accomplices the judge wondered where the journalists were.

Operation Motorman in 2004 marks the first known occasion that NotW’s MISKIW was interviewed by the MET.

Throughout the time these police investigations were being carried out the MET was simultaneously joining forces with NOTW – formally colluding with MAHZER MAHMOOD and his team in a vainglorious operation which became known as the ‘Red Mercury sting’.

During the summer of 2004, MAHMOOD posed as a dodgy dealer willing to sell ‘red mercury’, described by NOTW as “a deadly substance developed by cold war Russian scientists for making briefcase nuclear bombs”. In fact it was invented by Soviet intelligence for cold war sting operations. MAHMOOD arranged a series of meetings with a businessman, a City banker and a security guard who were alleged to want to buy a kilogram of the ‘deadly substance’ with a view to terrorist plots. MAHMOOD secretly taped the meetings and, after a charcteristic unexplained delay, took his sting exclusive plan to the MET anti-terrorism branch. He secured a collaboration which involved him becoming a registered police covert source working with and for anti-terrorism officers. (here)

Of the Red Mercury sting, MAHMOOD observed,

the police even read my story, and made minor amendments, before it was published on the front page in September 2004… My evidence had clearly been of a sufficient standard to satisfy highly experienced anti-terror officers, the Crown Prosecution Service who decided on the charges, and the Attorney General who had to personally sign off the prosecution. (Confessions of a Fake Sheik)

The ‘sting’ is the preferred modus operandi of MAHMOOD. Over the preceding years, he had gathered a team around him such that he could call on particular specialisms in surveillance, covert recording and other forms of subterfuge – including former police officers. One of his regular freelancers specialised in acting as His Majesty the Fake Sheik’s faux ‘English secretary’ wearing blazer and bow tie – an ex-MET detective called Sid FILLERY. Fillery co-owned a private detective agency, Southern Investigations, with Jonathan REES. Rees also had a sustained history of lucrative commissions from NOTW for surveillance and information acquired from questionable sources. (The Untouchables chapter 13). Both FILLERY and REES had previously been suspected of the notorious unsolved murder of Daniel Morgan in 1987. (see here)

MAHMOOD was very proud of ‘his’ conviction rate, although not all NOTW-MET collaborations were that successful. The high-profile ‘Beckham kidnap plot’ was one that did not result in convictions but the apparently cosy relationship between NOTW and MET didn’t appear to suffer. Intriguingly, on one sting the police seemed to be wistfully envious of MAHMOOD’S use of shortcuts by private eyes and colouful helpmates: “one of the officers on the case told me that I’d done a better job than they could have because they have to follow strict legal guidelines to gain proof”

MAHMOOD also explained

a few months later the then Commissioner of the Metropolitan Police, Sir John Stevens, invited me for a private drink together with Andy Coulson. We sat in his plush offices at the Yard and Sir John praised my work, singling out the Newcastle United bosses as one of his all-time favourites. He also told me that he also felt that my work on the Beckham kidnap case had been excellent and that in his view the evidence was overwhelming. He shared my disappointment at the COS decision. Coming from the most decorated police officer in the land, I considered it a huge honour.

The New York Times later (Sept 1 2010) characterised the cooperation differently, saying that Scotland Yard “had a symbiotic relationship with News of the World. The police sometimes built high-profile cases out of the paper’s exclusives, and News of the World reciprocated with fawning stories of arrests.”

Heading MET anti-terrorism throughout this period 2002-08) – and presumably authorising the substantial resources for NOTW collaboration – was PETER CLARKE. From the date of the Red Mercury arrests it took two years of MET & CPS public funding under Clarke’s watch to prepare for trial. Part way through that time, in 2005, ANDY HAYMAN returned to the MET from Norfolk Constabulary as Assistant Commissioner Specialist Operations (ACSO) which included Clarke’s anti-terrorism branch. CLARKE therefore had the responsibility for ensuring HAYMAN was thoroughly briefed on priority investigations into terrorist plots, ‘dirty bombs’ and Red Mercury.

One other investigation threatening national security became the responsibility of HAYMAN and CLARKE in December 2005 when the head of Royal Protection contacted CLARKE to report grave fears that the security of the Royal Household had been compromised through voicemail interception by NOTW. Operation CARYATID was thus instigated and that is how Specialist Operations (Counter Terrorism) came to be running two contradictory investigations at the same time – one collaborating with NOTW over Red Mercury and the other investigating NOTW phone hacking of members of the Royal family.

On 26th July 2006 the Red Mercury trial jury delivered ‘not guilty’ verdicts and the methods of MAHMOOD and MET were publicly castigated. Three innocent defendants had each spent two years in prison on remand, plus the 3 month trial alone had been estimated to cost more than £1 million (not including the investigation costs). By contrast CLARKE had directed the under-resourced Operation CARYATID have its parameters very strictly drawn solely around the Royal household; the phone hacking investigation was not widened and evidence leads not pursued. The CARYATID raids and the arrests of Goodman and Mulcaire took place just two weeks after the Red Mercury trial debacle, on 8th August 2006.

Greg MISKIW was never interviewed by Operation CARYATID, despite the arrest raids recovering a written contract MISKIW had given Mulcaire (a.k.a. Paul Williams) for £7,000 commissioning information for a story on Gordon Taylor. The infamous ‘for Neville’ email also remained in the wealth of unused evidence. But the cat was out of the bin bag when, in July 2009, the Guardian presented the Culture, Media and Sport Select Committee with copies of both. Yet these evidential leads were still not re-examined by the MET.

MISKIW was however interviewed a year later. On 1st September 2010, the New York Times published a long-form article on the UK phone hacking scandal (here)

This time the MET started Operation Varec, a low profile re-examination of new information contained in the NYT piece. (here)

MISKIW was interviewed under caution but produced a pre-prepared statement denying any knowledge of illicit information gathering and voicemail interception. He refused to cooperate any further and gave a ‘no comment’ interview. In addition, 19 other members of staff still employed by NOTW were contacted to establish if any could assist or provide any information relating to voicemail interception. No response was received from any of them; Operation Varec came to nothing.

Within months – perhaps realising that finally the penny was beginning to drop for the MET – MISKIW had left the UK. After more than a decade of him being on the MET radar but consistently ‘no further action’ taken, when the phone hacking scandal erupted in July 2011, MISKIW was missing. Earlier that year he had relocated to Delray Beach in Florida and was working for the local newspaper, the Delray Globe. (here)

His solicitor negotiated with police that he would return to the UK voluntarily for questioning. MISKIW was finally arrested on 10th August 2011 “on suspicion of unlawful interception of communications, contrary to Section 1(1) Criminal Law Act 1977 and on suspicion of conspiring to intercept communications, contrary to Section 1(1) Criminal Law Act 1977.” After a further two years on bail, MISKIW was convicted and sentenced to 6 months imprisonment in Trial 1.

But this still leaves questions over MET action and inaction in relation to NOTW. Is it possible that CARYATID was deliberately constrained in an attempt to evade embarassment to the MET resulting from the costly and simultaneous MAZHER MAHMOOD Red Mercury fiasco?

And did this intersect with another – and even more compelling – reason why the fear of reputational damage may have constrained Scotland Yard?

‘",2014-07-30,The Context of Caryatid
2014,7,https://www.bellingcat.com/news/uk-and-europe/2014/07/30/other-dark-arts-at-the-news-of-the-world-fake-sheikh-investigated-by-police-just-before-phone-hacking-operation/,/news/uk-and-europe/2014/07/30/other-dark-arts-at-the-news-of-the-world-fake-sheikh-investigated-by-police-just-before-phone-hacking-operation/,"

A timeline on the Fake Sheikh, News of the World and police investigations by my occasional contributor, Joe Public. Crossposted at Fothom

Scotland Yard investigated Fake Sheikh Mazher Mahmood 9 YEARS AGO – in 2005 just four months before they initiated a phone hacking case into his newspaper. Like operation Caryatid, there isn’t a trace of a follow up or outcome despite the evidence that triggered the investigation being accepted in TWO courts. Instead, just 8 months after opening the investigation, the Yard publicly declared; “it would not rule out working with the paper again” after the collapse of a trial both Met and NotW brought to court together.

These events started when in 2004 when the Met Police [SO13] joined forces with News of the World on a fake sheikh sting “Red Mercury -Dirty Bomb”. Both the Met and Mahmood have confirmed working together since, as Mahmood told the Press Gazette; “the entire job I was basically working for Scotland Yard’s anti-terrorism squad”.

A year earlier, another fake sheikh story: a Victoria Beckham kidnap plot case was thrown out by the Crown Prosecution Service before the trial started because the main prosecution witness had been paid £10,000 by Mahmood.

One of the 5 men cleared of the Beckham plot – Alin Turcu real name Bogdan Maris – won a libel case against News of the World using the evidence of Florim Gashi who admitted setting up the plot. Gashi who worked on a number of stories with Mahmood who hired him as an agent provocateur for stories that imprisoned innocent people, wasted police times/resources and cost huge amounts of public money.

The timeline was as follows:

Oct 2002: Mahmmod/NotW mets Scotland Yard’s DI Horrocks and DC Hulme to inform them about a kidnap plot but doesn’t disclose to name the target telling them “the editor [Brooks] would like to keep that matter a secret for as long as possible and thus not spoil the story she was planning to publish.”

Nov 2002: Mahmood has a 08:15am meeting with police to discuss how to lure the “gang” and finally disclose the target is Victoria Beckham. Arrests made at 12:40pm in the car park of Ibis Docklands Hotel. News of the Workd publish ‘Posh Kidnap’ story. Turcu, Jay Sorin, Luli Krifsha, Joe Rivas and Adrian Pasareanu are held on conspiracy to kidnap charges.

June 2003: After 7 months on remand, The CPS confirm the case has collapsed after police find the £10,000 News of the World payment to the main prosecution witness [Gashi], saying: “We have decided to offer no evidence on the conspiracy to kidnap Victoria Beckham. They declare”Our picture of the News of the World informant, Florim Gashi, 27, was reappraised. We are now of the opinion that he is an unreliable witness after receiving financial gain from the News of the World.”

After formally clearing the five man “gang” at a hearing in Middlesex Guildhall Crown Court, judge Simon Smith said; “I am minded to refer the whole of this matter to the Attorney General to consider the temptations to which money being offered in return for stories, in particular about celebrities, gives rise to – and the way in which newspaper investigations may have a detrimental effect on – the ultimate court proceedings.”

News of the World hit back. An angry Andy Coulson told Press Gazette;

“We are bewildered by what is an apparent ambush on Maz and the New of the World in court.”

Then, in a Leader Column the newspaper told its readers;

“The accusations and cynical innuendo – made with the self-interest of others at heart – must be nailed. It is your view of us that counts” continuing “The CPS had their day in court. But it didn’t stop there. They went on to brief journalists to ensure everyone knew who was ‘to blame’. “But the News of the World does not make the decision to continue with a police investigation, or to lay charges and trigger a court case… the police and CPS do. And on the dramatic day of the arrests, police took the threat to the Beckhams seriously, warning them to step up security. “This newspaper is proud of its long-standing crusade for law and order. Mahmood himself has frequently attracted the praise of police and judges after exposing immigrant smugglers, child abusers and gun runners.”

September 2004: Scotland Yard’s SO13 collaborate with News of the World’s Mazher Mahmood “Red Mercury – Dirty Bomb” story. Three men, Roque Fernandes, Abdurahman Kanyare, both of Edgware, and Dominic Martins, of Stanmore, are held in custody for allegedly conspiring to fund terrorism and conspiring to possess an article for terrorist purposes, by trying to buy a kilogram of “red mercury”. All three deny all the charges.

May 2005: Alin Turcu aka Bogdan Marin brings libel case against News Group Newspapers [News of the World] who featured in the paper as a “international terror gang” member intent on kidnapping ex-Spice Girl Victoria Beckham. He was later cleared of all charges related to kidnap (after police found £10,000 payment to a key witness) but libel thrown out by high court judge Mr Justice Eady, who ruled Turcu had taken part in “apparently genuine discussions about kidnapping Victoria Beckham.”

At this hearing, Mazher Mahmood, in his evidence reveals two important points:

1) Rebekah Brooks withheld the identity of Victoria Beckham as the target of a kidnap plot.

2) Criminals were hired by NotW for the fake sheikh “since they were less likely to arouse suspicions among those being investigated or infiltrated”

Sept 2005: Florim Gashi decides to speak to the police about the work he’d done for Mazher Mahmood after reading Justice Eady’s libel ruling and encouraged by Guardian’s Roy Greenslade who he told;

“I am responsible for innocent people going to jail. I tricked them, I’m ashamed. It’s time to tell the truth.”

The same month Scotland Yard send three detectives to Dubrovnik in Croatia to interview Florim Gashi. Despite his past conviction for dishonesty, the Yard took him seriously enough to send two more detectives to Vienna to speak to him again. While in Vienna Gashi gave formal interviews to lawyers from two firms representing men featured in NotW stories.

A statement [Dated 21/09/05] is taken from Gashi for the high court appeal of Alin Turcu for libel against NGN [NotW] that alleges News of the World’s Victoria Beckham kidnap plot was a “set-up” (he was the main source turned main prosecution witness) and “most of Maz’s stories involve setting-up people to talk on tape. Sometimes the whole tape show the whole thing is a set-up. Those tapes never see the light of day. In the Beckham case (2002), I remember two or three recording were destroyed by him.”

Oct 2005: Scotland Yard open an investigation into Mazher Mahmood and the bases of many of his stories as a direct result of Florim Gashi’s new claims.

However, Roy Greensdale quotes a senior Scotland Yard detective as saying; He [Gashi] appears to be telling a third version of his part in the kidnap,” he says. “It’s impossible to rely on his evidence.”

A News of the World spokesman said: “No story based on information supplied by Gashi has been published without first being stringently tested and verified with convincing independent evidence. The allegations in respect of the Beckham kidnap plot have been raised before, independently investigated, tested under oath in the high court and been rejected.”

March 2006: Metropolitan police open Operation Caraytid to investigate phone hacking at News of the World by SO13 [anti-terror] overseen by Andy Hayman.

Meanwhile, at the very same time, Scotland Yard’s CO13 and News of the World are are working together with CPS on the Red Mercury case being brought before the courts.

May 2006: After two years on remand, the Old Bailey trial of Fernandes, Kanyare and Martins finally begins.

The prosecutor, Mark Ellison, admitted the police had no idea if there even was such a thing as red mercury – supposedly the main ingredient for a “dirty bomb”.

But he told the jury at the outset: “The Crown’s position is that whether red mercury does or does not exist is irrelevant.”

He warned the jury not to get “hung up” on whether red mercury actually existed at all.

On May 26, court of appeal judges Lord Justice Rix and Lord Justice Moses grant Alin Turcu, leave to appeal his libel action against the Sunday tabloid after hearing evidence from Gashi. Justice Rix begins his judgment with the summary “This is a murky case” – notes that Gashi appears to have “changed sides”: “[Gashi] says that he has had a conversion and realises with guilt the error of his ways.” Noting the doubts over Gashi’s credibility, the judge nevertheless rules that his account is plausible enough “to raise some realistic prospect that his evidence might be received and accepted by this court on appeal”.

However, this cannot be reported until after the red mercury trial.

July 2006: After a three month trial costing £1m, defendants Fernandes, Kanyare and Martins are cleared of all charges related to red mercury dirty bomb plot and walk free after two years on remand.

Stephen Solley, QC, defending Mr Martins, accused Mazher Mahmood of misleading the police, the Crown Prosecution Service, and the courts. He said there was a “huge danger of accepting Mr Mahmood’s word in respect of any matter.” Before the trial began, in a pre-trial hearing for the case, Mr Solley had argued; “Mr B (key prosecution witness) created, through his activities with Mr Mahmood – who himself knew it was entirely a sham – a pincer movement so both their respective motives could be satisfied. These motives were money on the one hand and selling newspapers on the other. We submit that justice went out of the window.”

Florim Gashi is a key defence witness at the trial and tells the jury that he and Mahmood cooked up the Victoria Beckham kidnap plot. “Maz said I would get £10,000 and another £5,000 if they got prosecuted,” he told the court

In a statement, News of the World said: “The News of the World involvement in this investigation and subsequent trial was conducted under the direction of senior anti-terrorist police officers. We are entirely satisfied that the methods used in the investigation were not only wholly proper, but were both authorised and, from an early stage, continued in close liaison with the police.”

Scotland Yard said “it would not rule out working with the paper again”

August 2006: Operation Caryatid make their first and only arrests, Clive Goodman and Glenn Mulcaire

Sept 2006: Operation Caryatid’s DCI Martin Sutrees meets Rebekah Brooks at RAC club London. Updates her that there are 100 to 110 “potential victims” phone hacking victims as well as informing her that she herself had been hacked.

January 2007: Clive Goodman and Glenn Mulcaire found guilty of phone hacking of three members of the royal household. Mulcaire pleas guilty of hacking further five victims, supermodel Elle Macpherson, publicist Max Clifford, football agent Sky Andrew, and Gordon Taylor, the chief executive of the Professional Footballers Association. Both sentenced to 4 months and 6 months respectively.

Feb 2007: Turcu wins appeal for libel against against News Group Newspapers [News of the World] with the help of Gashi’s evidence claiming it was a set up.

Related articles",2014-07-30,"The ""Fake Sheikh"" Investigated by Police Just Before the Phone Hacking Operation"
2014,7,https://www.bellingcat.com/news/uk-and-europe/2014/07/28/how-rebekah-brooks-withheld-beckham-kidnap-info-hired-criminals-for-the-fake-sheikh-scotland-yard-and-cps-did-nothing/,/news/uk-and-europe/2014/07/28/how-rebekah-brooks-withheld-beckham-kidnap-info-hired-criminals-for-the-fake-sheikh-scotland-yard-and-cps-did-nothing/,"

A follow up piece on the Fake Sheikh by occasional contributor, Joe Public. Crossposted at Fothom.

In what echoes the 24 hour delay it took for News of the World to inform police of their Milly Dowler hacked messages, Rebekah Brooks withheld information from the police in regards to an alleged Victoria Beckham kidnap plot in 2002. She “wanted to keep the matter a secret for as long as possible and thus not spoil the story she was planning to publish” according to Mazher Mahmood’s evidence in court papers from a libel case against News Group Newspaper in 2005.

In evidence given by Mazher Mahmood for a libel hearing against News Group Newspapers, he admitted hiring criminals as part of his team “since they were less likely to arouse suspicions” under the editorship of Rebekah Brooks. The libel brought by Alin Turcu – real name Bogdan Stefan Maris – who was cleared of a kidnap plot of Victoria Beckham and her children when the Crown Prosecution Service dropped the case. Though Turcu lost the libel case he won on appeal two years later in 2007.The News of the World apologised and accepted he was not part of the plot. The paper said “Mr Justice Eady ruled that there was indeed a plot to kidnap Victoria Beckham, but the newspaper now accepts that Alin Turcu was not part of it.” It was settled with a donation to charity “The newspaper has agreed to make a modest donation to a charity on Mr Turcu’s behalf.”

The News of the World‘s fake sheikh Beckhams kidnap plot was published on 3rd November 2002. Stuart Kuttner, managing editor of the News of the World, boldly told Sky News afterwards: “About six weeks ago we were alerted that a gang of Romanians and Albanian criminals, or people of that persuasion, had a plan to try and kidnap Victoria Beckham and hoped to collect a ransom of £5 million.” He explained “our reporters, led by the man who’s rather well known as the fake sheikh, Mazher Mahmood, infiltrated the gang and in fact found themselves playing a central role with this group of people, most of whom were armed and extremely dangerous and potentially very violent. So much so that one of our people was recruited as the potential getaway driver for the abduction.”

Of the alleged ransom plan, Kuttner said: “There was discussion among members of the gang in the presence of our reporters about this and at one point it was suggested it might be £1 million and another member of the gang said it’s – I’ll paraphrase – hardly worth getting out of bed for that, why don’t we go for £5 million?” As well as Sky, the News of the World alerted BBC and ITN about their scoop – even making available video footage. The paper ran a 7 page “prominent and sensational” story that was followed up by the Sun the next day with another sensational headline ‘Becks calls in an army’. After arrests were made, 5 members of the “gang” spent seven months on remand but the Crown Prosecution Service dropped all charges related to the kidnap plot after learning the News of the World had paid £10,000 to a key witness.

The Set Up

Initially, Florim Gashi had contacted Mazher Mahmood about a story of a jeweled turban stolen from Sotheby’s by someone within his circle of petty criminals friends who wanted to sell it. After a meeting with with Gashi’s friends posing as a buyer, Mahmood turned the story down but offered to assist police after calling Sotheby’s press office to inquire if they’d had a turban stolen. Sometime later Gashi called Mahmood back to tell him the same “gang”, Turcu, Jay Sorin, Luli Krifsha, Joe Rivas and Adrian Pasareanu were now planning to kidnap Victoria Beckham and her children.

This call was to turn into the 7 page story in New of the World – involving the recruitment of Mahmood’s cousin Mahmood Quereshi aka Jaws (because of his gold teeth) as the get-away driver of what the Sunday tabloid would call an “international terror gang”.

According to Gashi, who later gave evidence on behalf Turcu at his appeal against NGN, Mahmood requested a gun as part of the plot – supplied to Gashi by Robin Halsworth who worked for APCOA – “because it would make a dramatic photograph and make the gang look dangerous.” As Mahmood had already been seen by the “gang” posing as a buyer for the turban, he gave recording equipment to Gashi to instigate the “planning” of the kidnap over drinks in bars and restaurants in south London.

At these meetings, Gashi introduced Mahmood’s cousin to the “gang” and began asking hypothetical questions: “If you kidnapped Victoria Beckham, how much ransom would you ask for?”; “Can you transfer that sort of money through a bank?”; “How could you snatch her?”; “When is the best time?”; “Where would she be kept? Unknown to the drinking party who responding to Gashi trying to impress each other and to show off who was more knowledgeable, he was recording the conversations with the equipment supplied to him by Mahmood. Whenever the conversation strayed elsewhere, Gashi would try to steer it back to the topic of a Beckhams kidnap plot.

The Sting

Media columnist Roy Greenslade, who has written over many years about the methods of the fake sheikh, wrote in the Guardian in 2003; “Of the thousands of words of inconsequential chat recorded by Gashi, very few relate directly to the Beckhams. In a conversation recorded on October 27 – just six days before the men were arrested – one of the supposed “international terror gang” members is recorded saying to another one: “[Gashi] wants us to kidnap Victoria Beckham.” By the time police called round Mahmood’s News of the World office [DI Ian Horrocks of the kidnap and specialists investigations of the Met Police based in New Scotland Yard and two collegues] in regards to the turban, he told them he was also investigating new information of criminal activity by the same “gang.”

Gashi claimed “Maz was continually pushing me to get at least one of the five to go to Beckham’s home”. Once at the home in Sawbridgeworth Herts, Mahmood was there waiting in a surveillance van with a colleague ready to record them walking outside the gated property.

Armed with his “evidence” from Gashi, on October 30th 2002 – 3 days before the arrests – Mahmood along with Qureshi met DI Horrocks and DC Hulme to provide the information he had gathered – including one of the members having a firearm and that they were planning a kidnap. It is at this meeting Mahmood told the police that he did not want to disclose the identity of the target at that stage because “the editor [Brooks] would like to keep that matter a secret for as long as possible and thus not spoil the story she was planning to publish.”

The Publicity

Among the seven pages, on page 6 the News of the World, had an interview with Victoria Beckham under the headline ‘Posh Thanks Us’, as well as a leader headed ‘Maz the amazing’ in tribute to Mahmood. On page 7; ‘Courage Of Our Hero Maz’.

Greenslade called it “one of the great fake stories of our time”. Turcu, a party loving teenager (but a petty criminal) was named as a “surveillance expert” by the paper which resulted in charges of conspiracy to kidnap by the five men. Arrangements were made between News of the World and Met Police for the arrests to be made on Saturday 2nd November 2002 – so ths the Sunday tabloid could publish their seven page exclusive the next day.

On Saturday morning, Mahmood met with police at 8:15 am to discuss tactics.He was going to lure the “gang” on the basis they would bring the stolen turban still posing as an intermediary for a buyer (as he had done at the earlier meeting on 12th October) to Ibis Docklands Hotel. It was only then Mahmood disclosed to the policethe target was in fact ex Spice Girl Victoria Beckham.

Krifsha, Sorin and Rivas arrived in the hotel car park at just after midday. After an introduction to Rivas, Krifsha took Mahmood to the boot of the car boot to show him three plastics bags with turban and other contents from Sotheby’s – a painting and and antique books.

Armed police arrived at the car park in a white van and leapt out pointing their guns and ordered the suspects to lie on the floor spreadeagled – including Mahmood. As the three alleged gang members were arrested a News of the World photographer took shots from a hotel room overlooking the car park.These would make the front page of the next day’s paper.

The remaining two members of the gang were later arrested.They would all spend seven months on remand before the case being thrown out by the CPS.

Gashi claimed he went along along with the prosecution because Mahmood had offered him a further £5,000 if the men were convicted. Turcu’s solicitor David Price said “This was a stage managed and nauseatingly self-congratulatory article, designed to boost the circulation of the News of the World” at the end of the 2007 libel hearing. Price also managed to track down Richard Halsworth and take a statement under oath that corroborated with Gashi’s claim that he sold the air rifle gun to Gashi. Gashi gave an interview to Roy Greenslade about all his dealings with Mahmood. News of the World found out about the interview . Gashi says he received a phone call from Mahmood’s cousin, threatening him for speaking to the Guardian.

The Hangover

All this leaves some fundamental questions:

Firstly, if the plot was genuine, as no doubt News of the World would say it is, why would Rebekah Brooks withhold vital information (Maz’s claims) – and why would the police agree to such a grave risk?

Secondly, with the knowledge of the this, what did CPS do upon learning of this alarming practice? Mazher Mahmood’s evidence at the 2005 libel hearing confidently states the following “much of his investigative work involves infiltrating criminal activity, sometimes doing so personally, sometimes with other plausible characters. Almost inevitably, such persons will themselves have had criminal backgrounds, since they would less likely arouse suspicions among those being investigated or infiltrated.”

The obvious question here for not just the police or CPS but this courts too: how can a conviction be safe if subjects are entrapped for financial gain by criminals?

In other words, not only was Rebekah Brooks happy with criminals on the payroll: Scotland Yard and CPS were quite happy with this set up too. They also seemed happy to bring Fake Sheikh cases to court regardless if previous ones had collapsed.

A year after Mahmood’s evidence to the hearing, when another Fake Sheikh case (“Red Mercury”) which Scotland Yard were collaborating on was thrown out, the Yard was quoted as saying “it would not rule out working with the paper again”. The CPS soon came out in full support of the Mahmood sting despite it being thrown out, and Gashi’s evidence against Mahmood.

The nexus of News UK and Metropolitan Police escaped close scrutiny by Leveson. Whether it ever happens is another question. That’s why in light of recent events, the fate of Mazher Mahmood aka the Fake Sheikh makes compelling viewing.

Related articles",2014-07-28,"How Rebekah Brooks Withheld Beckham Kidnap Info, Hired Criminals for the Fake Sheikh, and Scotland Yard and the CPS Did Nothing"
2014,7,https://www.bellingcat.com/news/uk-and-europe/2014/07/28/the-buk-that-could-an-open-source-odyssey/,/news/uk-and-europe/2014/07/28/the-buk-that-could-an-open-source-odyssey/,"

Over the last two weeks I’ve documented the various open source information that has revealed key pieces of information about the Buk Missile Launcher linked to the downing of flight MH17. Now, using that information, I believe it’s possible to construct a timeline of events on the ground in Ukraine on July 17th that can be evidenced using a variety of open source information.

To begin with, lets review the photographs and videos of the Buk Missile Launcher which appear to have been taken on the day of the attack, in chronological order. All times are approximate

Donetsk – 9am

This photograph came from Paris Match, which they originally incorrectly reported as being taken in the town of Snizhne, an error they later corrected. The photograph was in fact taken in the town of Donetsk, and based off the shadows visible in the photograph, it was taken some time in the morning, roughly 9am.

We also learnt from this image that the truck belonged to a rental company in the city of Donetsk, with the owner of the truck, contacted by Paris Match, claiming the truck had been stolen by pro-Russian rebels.

Zuhres – 11:40am

The original video, embedded above, is no longer available. A copy of it is embedded below it.

This video was exactly located to the town of Zuhres, approximately 35km east of the last sighting on Donetsk with the footage reportedly filmed at 11:40am. This shows the Buk still on the trailer, heading east.

Torez – 12:30pm

This photograph from Torez, approximately 25km east of Zuhres, was taken about 12:30pm, and shows the Buk on the same truck, heading east. Note in this picture it appears to be cover in netting.

Snizhne – 1:30pm

This photograph is the first to show the Buk dismounted from the trailer seen in previous photographs, and was taken around 1:30pm in the town of Snizhne. Again, in this image, the Buk is heading east.

Snizhne – Post 1:30pm

This appears to have been filmed shortly after the above photograph was taken, showing the Buk heading south out of Snizhne, around 1km away from the location of the previous photograph. Assuming the Buk didn’t stop for a break, it would have taken a few minutes for the Buk to have reached the position in the video from the point it was sighted in the earlier photograph.

Luhansk – Unknown, likely post attack

Filmed in rebel held Luhansk, around 70km north of Snizhne, and 25km west of the Russian border, this shows the Buk Missile Launcher back on the same trailer as seen in previous videos, with one missile clearly missing, and the netting seen in the Torez video removed.

Based on those locations, we have a map that looks like this, showing the Buk travelling east from Donetsk, eventually ending up in Luhansk

It’s worth noting that the roads the Buk was sighted on would have been the most direct route from Donetsk to Snizhne. Now we have the route of the Buk Missile Launcher, we can also look at other information related where it was on the day.

Donetsk

The Ukraine@War blog picked up on some additional information about the Buk in Donetsk. First it identified the locations described in Tweets posted before the downing of MH17 describing a missile launcher in Donetsk, waiting on the corner of an intersection around 9am. He also highlights this video, purporting to be phone intercepts, where the Buk is discussed

Some of the calls, recorded after 9am, appear to be the driver of the transporter with the Buk asking for directions to rebel group he’s trying to meet up with. Using various details in the phone call, and the earlier identification of a likely rebel base in a mine in Donetsk, Ukraine@War put together this map, showing the route the driver was taken, from where the transporter was spotted in the west, to the final destination in the east

The position the Donetsk photograph published in Paris Match was taken is just before the red arrow in the centre of the map. It seems based on the time and location of that photograph, and the work done by Ukraine@War, the calls appear to be authentic.

AP reported claims made by the Ukrainian counterterrorism chief, Vitaly Nayda

According to Nayda, at 1 a.m. on July 17 the launcher rolled into Ukraine across the Russian border aboard a flatbed truck. He cited communications intercepts that he would not share with the AP. By 9 a.m., he said, the launcher had reached Donetsk, the main rebel stronghold 125 miles (200 kilometers) from the border. In Donetsk it is presumed to have been off-loaded from the flatbed and started to move in a convoy on its own. Nayda said the Buk turned back east toward Snizhne. Townspeople who spoke to the AP said it rolled into Snizhne around lunchtime.

Torez

Following the locating of the Torez photograph, a number of journalists visited the area, speaking to locals who had seen the launcher. Buzzfeed spoke to locals who “said that the launcher had driven down Gagarina Street, one of the town’s main thoroughfares, toward the town of Snizhne, near where Ukraine and the U.S. say the missile was fired. ”

The Guardian also reported on sightings inside Torez

Just before lunchtime last Thursday, prior to the Malaysia Airlines plane’s takeoff, a Buk was driven through Gagarin Street, one of the central thoroughfares of Torez, witnesses said. Torez would later be the town where bodies of the victims were loaded on to refrigerated train cars. The tarmac on Gagarin Street is strewn with ruts made by tank treads, and locals say armoured vehicles controlled by separatists driving through the town have become a regular occurrence in recent weeks. The convoy last Thursday was different, however. “We were inside and heard a noise much louder than usual,” said one shopkeeper, who did not want to be identified. “We came running out and saw a jeep disappearing into the distance with something much larger in front of it. Later, customers said it had been a missile carrier.” In another shop further down the street, there was talk of a convoy of two jeeps and a missile launcher covered in a net driving past in the direction of the town of Snizhne. “I’ve never seen anything like it,” said a middle-aged woman. She said her husband showed her a photograph of a Buk launcher afterwards and she realised that was indeed what she had seen. A group of men also said they had seen a Buk.

Snizhne

AP reported on sightings of the Buk in Snizhne

It was lunchtime when a tracked launcher with four SA-11 surface-to-air missiles rolled into town and parked on Karapetyan Street.

Karapetyan Street is visible on Yandex Maps, with the position the Buk shown in the photograph from Snizhne shown below, on Karapetyan Street

The Ukraine@War blog also highlighted satellite map imagery shared by Storyful which showed track marks in the fields south of the location the Buk was seen driving south out of the town. Ukraine@War also claims to have located the possible point of origin of a smoke trail reportedly photographed on July 17th as originating from the same area. The Daily Telegraph followed up this information, and found scorch marks in the same fields, although it should be noted this was not definite proof of launch sites.

Conclusion

Based on the above information alone it seems impossible to deny that the rebels were transporting a Buk Missile Launcher through the region on the same day as the downing of flight MH17. It also demonstrates the Buk was transported from Donestsk, through Torez, while still on the transporter. As yet there’s no images showing the Buk on the transporter in Snizhne, but based on the apparent destination of the Buk spotted in Torez is seems reasonable to believe it was the same missile launcher.

Finally, we know a Buk missile launcher, minus at least one missile, and the netting seen in other locations pre-launch, was spotted in the rebel held town of Luhansk, and it seems reasonable to assume this was after the downing of MH17.

Of course, there’s additional claims that have been made by various groups, something documented by The Interpreter in their timeline of events, but based videos and photographs there’s an extremely strong case for the Buk travelling through the region on the day of the attack, and I believe these should be considered facts that can act as a foundation for our understanding of the other claims and evidences pertaining to the down of the flight MH17.",2014-07-28,An Open Source Odyssey
2014,7,https://www.bellingcat.com/news/uk-and-europe/2014/07/28/two-more-key-sightings-of-the-mh17-buk-missile-launcher/,/news/uk-and-europe/2014/07/28/two-more-key-sightings-of-the-mh17-buk-missile-launcher/,"

Since the downing of flight MH17, several photographs and videos of the Buk Missile Launcher linked to the attack have been collaboratively investigated and located by many different people, in the rebel held towns of Torez, Snizhne, and Luhansk. Now, another video and another photograph have appeared that gives us even more of an understanding of where the Buk Missile Launcher was on July 17th.

This first video was rather unique as the apparent poster gave the exact location and time it was posted, so it was a case of verifying that information. The co-ordinates given were 48°01’01.1″N 38°18’06.6″E, in the town of Zuhres, at 11:40am on July 17th.

Based on the position of the buildings in the video, if this was the correct position then the camera position would be northwest of the road, in the apartment building. This seemed to match, as the position of several objects in the video matched what was visible in satellite map imagery

The arrangement of pathways in the area also matched

Based on the above matches, it seems highly probable the location is correction. Using SunCalc, a website that allows you to see the direction of shadows at different times of days, it appears the shadows cast by the trees fits to around 11:40am (note the time shown below is -2 hours local time)

The next image is a photograph from Paris Match, showing the Buk loaded on what appears to be the same trailer seen in images from Zuhres, Torez, and Luhansk. The below image shows the truck from the Paris Match photograph in the top left, the top right shows the Zuhres truck, bottom left the Torez truck, and the bottom right the Luhansk truck

They all appear show the same truck, with the same strip on the cabin, the same black exhaust on the left side of the truck, and the yellow sign is clearly visible in three of the images. While not readable, in the Torez and Luhansk pictures it appears text is also present. Paris Match called the number, and the person who answered claimed the truck had been stolen from them in Donetsk. In fact, it has been possible to track down the company it was “stolen” from, which is located here, in Donetsk.

But can we confirm the claim of the witness it was in the town of Snizhne, near the possible launch site? In fact we can’t, because it has been possible to locate it in a different town altogether, Donetsk. The Ukraine@War blog highlighted the work of Chris Postal, who managed to find the precise location by creating a route between Donetsk and Snizhne using a route planning website, and checking the the road along the automatically created route.

It’s possible to match many elements in the Paris Match photograph with that in the Google Street View image

Considering the time difference between the two images, that’s a good match, but there’s one more thing that makes this an excellent match

The tree tops visible in the Street View images and photograph appear to be very similar, in not nearly identical, which combined with the rest of the matches in the picture makes it certain this is the same location. Using SunCalc the shadows point to the Paris Match image being from early morning, roughly around 9am. In my next post, I’ll take a look at all the evidence that has been gathered so far, and how it all fits together.",2014-07-28,Two More Key Sightings of the MH17 Buk Missile Launcher
2014,7,https://www.bellingcat.com/news/uk-and-europe/2014/07/25/comments-on-mazher-mahmood-in-front-of-lord-leveson/,/news/uk-and-europe/2014/07/25/comments-on-mazher-mahmood-in-front-of-lord-leveson/,"

Several places have commented on things that Mazher Mahmood said in front of the Leveson Inquiry, but he was mentioned quite a bit more than that. In light of the collapse of the Tulisa Contostavlos trial it’s time we ran across all the other mentions in the evidence, some positive, some not so positive. Most of these are slightly large, and have to be to provide a level of context. The numbers at the beginning of paragraphs are the line numbers where individual questions or responses start, other line numbers have been deleted for space and readability reasons. I haven’t included his own evidence, as that is easy enough to find on the website. Here and here

First up lets look at what Alistair Campbell had to say. (starting on p69 of his evidence)

14 Q. You then comment on the use of subterfuge and the activities of the News of the World’s then investigations editor, Mr Mazher Mahmood, who has now moved across to the Sunday Times, has he not?

18 A. Mm-hm.

19 Q. You are concerned about certain aspects of what he does, and we have collected for you some materials under tab 7.

22 A. Yes.

23 Q. These all come from pieces in the Guardian —

24 A. The problem with a lot of these stories is that they’ve been removed from the News of the World website.

1 Q. Yes.

2 A. So in researching some of this, the only place I could find anything reliable on it was actually to use material published in other newspapers about it. Q. The first example you give is directly under tab 7.

6 It’s the Earl of Hardwicke case.

7 A. Yes.

8 Q. To be clear about this, it did result in a conviction, given concerns about the way in which the evidence was obtained, the judge imposed a suspended sentence; is that right?

12 A. Yes.

13 Q. And the judge said — this is his Honour Judge Timothy Pontius: “Were it not for that elaborate sting, you would not, I accept, have committed these particular offences.”

18 A. Yes.

19 Q. You draw attention to that. My understanding of the criminal law is that the agent provocateur defence is not a defence, however it’s a factor which can be taken into account –

23 LORD JUSTICE LEVESON: It depends who is doing it, Mr Jay. The decision of the House of Lords in a case called Loosely. I’m pleased to demonstrate some knowledge.

1 MR JAY: Not generally a defence.

2 A. The other thing you might want to look at though is the PCC code: “Clandestine devices and subterfuge. The press must not seek to obtain or publish material acquired by using hidden cameras or clandestine listening devices or by intercepting private or mobile calls, messages or emails…” et cetera, et cetera. And of course it goes on to say: “… unless there’s a clear public interest.” Now in some of these he might be able to argue that. The reason I put all of these in is I think some you could argue the public interest but the vast majority you couldn’t. But they did it routinely. And proudly. That was what made this guy’s name.

16 Q. Which of the ones do you feel would clearly not be in the public interest, the ones you’ve drawn attention to? Rather than my going perhaps invidiously through all of.

20 A. I can’t see much in the first one. In the second one, the one about the snooker player, if you read the — the World Snooker Body did its own investigation. If you read the conclusions of that, you’d be hard-pressed not to realise that actually this was — this guy was sort of only doing it because he was pushed into it because71 of the circumstances there and he was trying to get out of the room, and I think that’s what the Snooker Body accepted.

Next we have Peter Burden, author of a book “News of the World? ? Fake Sheikhs and Royal Trappings. Who was questioned on the contents of his book and the associated interviews and investigations. (p13 here)

12 Q. I’ll come back to that issue, if I may. May I ask you about the chapters in your book which address Mr Mazher Mahmood, who we’re hearing from next week. Your view, I think, is that virtually all of his stories are unethical. Have I correctly understood it? A. I’m not saying that all of them are, no. I think especially in the early days he was a fairly genuine reporter, but as times went on, it seems to me, having looked at a lot of his stories over a long period of time, that it slowly became easier for him to take the bare bones of a story, or the mere scintilla of a story, and find circumstances in which he could turn it into a much bigger story. The most obvious case was — there were two obvious cases, specifically the Beckhams again.13 He claimed that they had foiled an attempt to kidnap Victoria Beckham. When it came to court, which it eventually did — and I might say that quite a lot of people were in jail for quite a long time awaiting trial — it turned out that there were no such case at all. These were a group of people who had discussed it and they had recorded — Mazher Mahmood’s agent provocateur, who was a chap called Florim Gashi, an Albanian who used to bring stories to him, to whom he gave 10,000 quid for this particular one, recorded them in a club where they used to go and play snooker, saying, “Oh yes, I know what we could do for a bit of money, we could kidnap the Beckhams”, in the same way that you might say you might win the lottery. I mean, there was no serious intent there at all. It was on the basis of that recording alone, which was entirely speculative and not at all serious and actually had no basis in anybody’s real plans whatsoever, that the arrests were made and the case was brought. mean, there was ultimately no evidence whatsoever of any kind of conspiracy to kidnap these people, which must have been frightening for the Beckhams themselves, because I think their children were involved, and frightening for other people, thinking — every time there’s a story like this comes out, they think, “Oh, this could happen to me”, but it was based on nothing at all other than Mazher Mahmood’s inventiveness.

3 Q. You were going to mention one other story. That was the first of the two. A. There was another story about a material called red mercury, which nobody seems to know what it is, that was allegedly being imported by a wheeler dealer in London and was going to be used for bomb-making purposes. Well, the stuff was never found. There was no end-user. The Mr Big that Mr Mahmood was constantly writing — all his stories seemed to feature a man called Mr Big, in this case a man from Saudi Arabia, which he quoted as being “a hotbed of Al-Qaeda”, in order, you know, to suggest that it was a terrorist thing, and he explains that Mr Big from Saudi Arabia was also sympathetic to Muslim causes. Well, presumably, Mr Big, if he came from Saudi Arabia — it is a Muslim area, so it’s not unreasonable. But it’s all these little weasel words that get inserted into the stories to give a suggestion of fear and possible danger, based in this case on absolutely nothing at all, and once again people were locked up, awaiting trial, on remand and the cases almost instantly. And yet no redress was put on the paper or Mazher Mahmood himself for this tremendous waste of public time and money. And what is more, if I may add, at the same time, talking of that kind of thing, on many instances he’s used people buying cocaine or being prepared to procure cocaine for him and he has produced funds, presumably from petty cash — he’s been asked about this in court — to buy cocaine in order to propagate a sting so that he can then go back and write a stories about how Johnny Walker, for instance, or the Earl of Hardwicke, or several other individuals were prepared to buy him cocaine, usually under quite a lot of duress from the fake character that he was playing at the time. And curiously, he’s never been charged with the illegal purchase of cocaine, although there are no legal grounds on which he can do this to perpetrate a sting.

15 LORD JUSTICE LEVESON: What’s the most recent of these stories, Mr Burden?

17 A. Jodie Kidd, I think probably about three or four years ago, he persuaded to go and buy cocaine for him and that was put up as a video online. I think it might have happened since this book was last published. But you will find that there is a case where Jodie Kidd was set up to go and provide him with some cocaine.

23 MR JAY: It’s page 210 of your book.

24 A. Oh, it is there? It must have happened just before I published this edition then. I apologise. So that was in 2009, I think. I can’t recall if there have been more since then.

3 Q. I think it’s right to say, Mr Burden, that you remain sceptical about the Pakistani cricketers issue, which of course led to a conviction recently?

6 A. Yes, it did. I’m puzzled by that. I took the view almost the minute I saw that video on their website that there was something odd about it, because I knew that the John Higgins story, the story of the snooker player apparently taking a bribe, had fallen down because the video evidence had been changed by Mazher Mahmood and his operatives, and that was acknowledged What was odd about the video that was put up on theNews of the World website was there were instances where you simply couldn’t see the mouth of the man who was supposed to be doing the speaking. It was a fellow called Mazher Majeed, who was the agent between Mazher Mahmood and the cricketers, allegedly, and I opined that this video could easily have been made, and that’s what it seemed to me.Having said that, Mohammad Amir, the youngest of the bowlers, has — did plead guilty and I find that puzzling, but I dare say there’s reasons for that. Nevertheless, the point is there was no actual crime there. There was nobody going to go and have a bet on17 those no-balls. There was nobody going to benefit from it. It was simply Mazher Mahmood setting these people up, putting pressure on them, through Mazher Majeed, to do these no-balls, if they did indeed do them — I suppose I must accept that they’ve been found guilty and perhaps they did, but there was nevertheless no clear evidence that anybody was going to benefit from that particular activity, from that particular crime, so it was, in a sense, a non-crime. It was a non-story. The whole event was set up by Mzher Mahmood to get these people, or to show that these people were prepared bowl a no ball when asked and they seem to have satisfied the jury that that was the case. I have to say that that didn’t satisfy me.

15 LORD JUSTICE LEVESON: Do you have any expertise in the area beyond having looked at the material?

17 A. I wasn’t able to look at the raw material because obviously they weren’t going to let me have it and indeed I did put up this opinion online and was asked by Messrs Farrer to take it down, which I did, because I couldn’t get my hands on the original material. But I would say that after the first time I made reference to it, some of the material did come down, the more doubtful-looking material. Whether that was a coincidence or not, I can’t say.

Next a short positive comment from Matthew Bell, chairman of National Association of Press Agencies (p36 here)

23 MR BELL: Yeah, I mean, I — not so much a specific point. I think I would add a general appeal that — I heard a lot of talk about tabloid journalism. I mean, I strongly feel that there are some very, very good journalists who you would classify as being tabloid journalists and I just hope that whatever measures are decided don’t drive away or drive underground or prevent the type of investigative journalism of people like Mazher Mahmood, for instance, out of the business, because I think it would make the media a poorer place.

And a positive comment from John Witherow (p31 here)

19 Q. Right. Maybe we should wait until others tell us more about that, if it’s relevant, but the circumstances in which he was, as it were, taken back following the demise of the News of the World, 10 July 2011 — we know that Mr Mahmood is now writing for the Sunday Times. Why?

25 A. Because I think Mr Mahmood is an exceptional journalist. He’s proved himself over many years in exposing criminality and the stories already he’s done for us have been excellent.

Dick Fedorcio (p 111 here) a nothing statement really, mentioned in passing, but included as it’s with the Mets press officer

22 Q. Were you dealing with particular individuals at the News of the World, such as the crime reporters?

24 A. Sometimes the crime reporter, sometimes Neil Wallis as deputy editor. Sometimes the news desk, News editor. On one occasion, I think I dealt with Mazher Mahmood.

Neil Wallis (p48 here) praises Mahmood quite extensively

19 A. It depended. There were a variety of different occasions — there was the so-called dirty bombs story, that as soon as we got this allegation, we had no idea whether this stuff — it was called red mercury, butthere was a suggestion that a terrorist was interested in purchasing this sort of stuff. We had no idea whether it existed or not, so it was something we felt we couldn’t take a chance with and so we went to the Met and we went to the anti-terrorist branch and our reporter, Mazher Mahmood, as it was on this occasion, effectively became — they worked for the Met throughout it.

6 Q. When you were carrying out undercover investigations, did you inform the police about them?

8 A. When it came to the point — if we felt it was relevant and that there was a criminal aspect to it, we would generally inform them as we were about to publish.

11 Q. Right. Of course, in one sense you were duplicating work the police should perhaps better be doing; is that not right?

14 A. Well, you know, we’re journalists.

15 Q. I’ve been asked to put this to you: how did you ensure that the victims were protected, both in terms of the crime being committed upon them and in any exclusive by your newspaper?

19 A. The victims of our investigation, do you mean? people we were investigating?

21 Q. No, the victims of the crimes, I think.

22 A. Well, the crimes would usually be — well, for the two examples we have there, we protect the victims, as you put it, by involving the police and by involving Social Services.

20 A. Two things come into that, really. One, when you’re at the level of the News of the World, we’re generally pretty experienced in this, so we knew what we needed to be looking for. But secondly, we would, as often as possible, liaise with the police and, as I said — the great example being the dirty bomb plot, the woman selling the virginity, the woman selling the baby, et cetera, et cetera — the police would make it very clear to us what they needed as evidence and how that evidence would need to be collected. So we would take that advice, together with our own experience — and I think you’ve had Mazher Mahmood in here, whose proud record I think is that he has put away over 200 criminals, often in very dangerous circumstances. You know, you do that by making sure that (a) you know what you’re doing and (b) that you liaise properly with the police.

He is mentioned to Andrew Grice in passing as an example of a type of journalism (p70 here)

18 Q. You then go on to set out quite a large section on how important the press is and the very good things that the press have done over the years, which we don’t need to read out. You go on to say: “However, new techniques which have been used by the press do not always see the end justify the means.” You touch on one particular technique, which is the technique of, you say, stings or agent provocateur. Can I just clarify: here you are talking about political players being the subject of such stings, rather than the sort of Mazher Mahmood-type investigations; is that right?

Colin Myler (p29 here) mentions him in a discussion of the papers financial control systems.

12 Q. Yes. There are also payments for quite expensive sting operations people such as Mazher Mahmood were carrying out; is that right?

15 A. Yes, but that would be a different budget. It would — you know, Mazher’s operation was sort of almost — not necessarily ring-fenced, because you didn’t know from one year to the next what kind of operations he would be on, but in my view it didn’t cater for that. I think you heard from his testimony a lot of the time sources for his information were longstanding sources that he’d known for a long time. With the exception, for example, of the spot fixing cricket scandal, where we had an outlay of a significant sum to the fixer, his operation was again agreed with whoever he was working to and with for the source of the information and what it made.

And finally A discussion of the Surveillance of committee members in the evidence of Tom Watson (p39 here)

2 Q. Apart from what the Inquiry knows already, can you enlighten us about what the purpose was underlying the surveillance?

5 A. Well, Neville Thurlbeck, on a number of occasions, alleged that there was an attempt to gather information on committee members in order to — he uses the word “smear”. Effectively, he’s alleging a conspiracy to blackmail members of the committee. During our inquiry, the final inquiry we recently published, we tried to get to who was commissioning the surveillance of MPs and the research done on MPs and couldn’t quite get to that point with the company. We were told that their own internal investigations were continuing. But as part of that process, there was a disclosure of an email trail that is mentioned in this submission.

17 Q. Can I ask you, please, about — level with the lower hole punch on 05560, just expand on this, where you say: Recent disclosure from the company shows that the covert surveillance was commissioned by Mazher Mahmood with someone called Conrad acting as an accomplice.” you summarise that for us?

23 A. Yes, there’s an email trail between Mazher Mahmood where he actually alleges I was having an affair. It’s not true, obviously. And he has an email conversation with a number of colleagues — James Mellor and Ian Edmondson — where they are putting together a team conduct covert surveillance, and so they commission Derek Webb and take him off the job that he was on before he followed me and then he, Mahmood, says he goes down to the party conference and that he was taking Conrad. I don’t know who Conrad is, but he’s mentioned in the emails as being part of this.

It remains to be seen if those who praised his skill and technique in investigating members of the public distance themselves. If it turns out that there is actually a proveable pattern of invention, will he become a journalistic pariah in the way that those journalists who have been caught in acts of plagiarism, and driven from the profession? Or will it all be excused as he was only preying on the little people? Time will tell.",2014-07-25,Comments on Mazher Mahmood in Front of Lord Leveson
2014,7,https://www.bellingcat.com/news/uk-and-europe/2014/07/24/caught-in-a-lie-compelling-evidence-russia-lied-about-the-buk-linked-to-mh17/,/news/uk-and-europe/2014/07/24/caught-in-a-lie-compelling-evidence-russia-lied-about-the-buk-linked-to-mh17/,"

Earlier this week I wrote about the claims made by the Russian Defence Ministry about the following video, posted by the Ukrainian Ministry of Interior, which they claimed to show the Buk linked to the down of flight MH17 leaving Ukraine for Russia

The Russian Defence Ministry claimed in their recent press conference

For example, media circulated a video supposedly showing a Buk system being moved from Ukraine to Russia. This is clearly a fabrication. This video was made in the town of Krasnoarmeisk, as evidenced by the billboard you see in the background, advertising a car dealership at 34 Dnepropetrovsk Street. Krasnoarmeysk has been controlled by the Ukrainian military since May 11

As I posted, images from a variety of sources strongly suggested this was a clear case of deception by the Russian Defence Ministry, showing the video was in fact filmed in rebel held Luhansk near the Russia border, and more photographs have now emerged that seem to confirm this is the case.

A Luhansk local visited the place the video was reportedly filmed in Luhansk, and photographed the area, including objects that appeared in the video. It’s clear that objects in the video match perfectly to the video. It’s worth keeping in mind when looking at these comparisons that the video was filmed from a high angle, not from ground level, so an exact match was not possible due to the difference in angles

The above compares the two poles featured in the photographs and video, which appear to be indentical.

The path and grassy verge at the base of the same pole is also indentical.

Above the pole, the same arrangement of cabling can be seen.

The bill board is identical, with the same green border. It’s also clear the text the Russian’s claimed was on the billboard is absent in the photographs

This, combined with the information in my earlier post, is strong evidence that the Russian Defence Ministry lied when it claimed the billboard was in the town of Krasnoarmeisk. Unless the Russian’s can come up with compelling evidence that the billboard was in Krasnoarmeisk, it’s clear the Russian Defence Ministry lied at it’s press conference on the downing of MH17.",2014-07-24,Compelling Evidence Russia Lied About the Buk Linked to MH17
2014,7,https://www.bellingcat.com/news/uk-and-europe/2014/07/22/evidence-that-russian-claims-about-the-mh17-buk-missile-launcher-are-false/,/news/uk-and-europe/2014/07/22/evidence-that-russian-claims-about-the-mh17-buk-missile-launcher-are-false/,"

Over the last few days, videos and photographs relating to the downing of MH17 have been poured over by people across the world, trying to piece together clues about what really happened. One video in particular, shared by the Ukrainian Ministry of Interior, has been the focus of particular attention

This video claims to show the Buk linked to the downing of MH17 being transported to Russia, with the transporter the Buk is loaded onto matching that seen in previous photographs and videos reportedly taken on the same day.

These claims were countered by the Russians in their recent press conference about the downing of flight MH17 (see 26 minutes on)

The claim, quoted on Russia Today, was as follows

For example, media circulated a video supposedly showing a Buk system being moved from Ukraine to Russia. This is clearly a fabrication. This video was made in the town of Krasnoarmeisk, as evidenced by the billboard you see in the background, advertising a car dealership at 34 Dnepropetrovsk Street. Krasnoarmeysk has been controlled by the Ukrainian military since May 11

But is this a fabrication as the Russian government claims? It appears not, the following images were posted on the Euromaidan Twitter account, claiming to show the real location

This position was inside the rebel controlled city of Luhansk, around 50km away from the areas the launcher was reportedly sighted in earlier in the day, and around 30km away from the Russian border. But can we be sure this is correct?

A number of people have searched for matches between images in that area, and in the video. For example, KoreanDefense.com highlighted a website with a collection of cameras in the area being shared on the internet. All the cameras have now been shut down “by order of the government”, but the preview images are still visible from before they were cut off, and the camera in the above location shows this

Note the billboard in the middle of the picture, which appears to match the one in the video. This also suggests the camera was point straight on to the billboard, and it appears the photograph of the area provided on the Euromaidan Twitter account is just in front of the billboard with the car advert on it visible in the above picture

It appears the Buk video was filmed on the right hand side of the road, and we can tell the transporter is heading straight on, not taking a right. It appears the pole and path on the corner between the two road matches in both the photo and video

Others believe they’ve found some of the buildings visible in the background of the video. This image was shared by Viktor Chernov

Who then shared the following image comparing another view of the structures to what’s visible in the video

The buildings are visible in this position in the photograph from the camera

Another detail that matches are the cables suspended above the road, as these images from the video and EuromaidanPR account show

Based on the position and height of the camera, as well as the brief flash of curtain or window frame at the start of the video, is seems the video was almost certainly filmed from these apartment buildings west of the junction

It seems that based on studying the information available about this site the Russians lied when they claimed the billboard was located in government controlled territory. It’s unclear if this is yet another example of the Russian government parroting internet rumours and theories as part of their official statements, but either way, it’s increasingly clear the claims are false.",2014-07-22,Evidence That Russian Claims About The MH17 Buk Missile Launcher Are False
2014,7,https://www.bellingcat.com/news/uk-and-europe/2014/07/22/the-latest-open-source-theories-speculation-and-debunks-on-flight-mh17/,/news/uk-and-europe/2014/07/22/the-latest-open-source-theories-speculation-and-debunks-on-flight-mh17/,"

Over the past few days various theories and speculation about the downing of Flight MH17 have been shared online, from the identify of the Buk Missile Launchers (that may or may not have been used depending on who you ask), to examinations of the damage visible on the remains of the aircraft. Here’s a look at some of the more interesting theories, speculation, and debunks being discussed at the moment.

Shrapnel Damage on MH17

As more and more images of the remains of flight MH17 were posted online, people began to notice what appeared to be shrapnel damage to the aircraft. Several parts of the aircraft were shown with what many agreed to be shrapnel damage, and the following image mapping part of the damaged aircraft to it’s apparent position on flight MH17 was shared on social media sites

The same piece of the plane, along with other pieces of debris, were discussed on the PPRuNE forum, with one user creating the following image showing where the pieces of debris would be positioned on the complete aircraft

It appears the front port side of the aircraft took much of the shrapnel damage, with the following video from Al Jazeera showing part of the inside of the cabin 53 seconds in

The part shown on the right is the floor of the cabin (reference image here), with damage from what is likely to be shrapnel on the port side, in line with the above image

An image of the same section of the plane shared on Twitter shows a different angle of the same part of the aircraft, again showing what is likely damage from shrapnel

Justin Bronk, a Royal United Services Institute (RUSI) Military Sciences research analyst also shared the following image

Based on the above, it appears there’s a growing consensus of where the aircraft was hit, the front port side, not the rear of the aircraft as some have claimed.

Buk 312

One theory that’s been doing the rounds involves “Buk 312”, a missile launcher some have connected to the attack. This appears to be a case of confusion, maybe the result of the use of a library image, or just a straight forward attempt to deceive. The following image was shared by the Ukranian SBU in a press release linking the Buk used to down MH17 to the Ukranian rebels

The top left image is from the video released from the Ukranian Ministry of Interior, claiming to show the Buk used to down MH17 on a transporter, leaving the country. The bottom right hand image shows a Buk which the press release appears to link to the other image, with the main claim being this is a Russian Buk, not Ukranian.

This claim was apparently contradicted by this video from March 2014, showing a Buk with the same numbering in government controlled territory. The following image then became widely spread on social media sites, claiming to be proof the Buk used to down MH17 belonged to the Ukranian military

Thanks to The Interpreter and StopFake.org, we now know the situation is slightly different. A photo of the same Buk, on what appears to be the same transporter, and the same road, was posted on Facebook in March 2014, the same time as the video showing Buk 312, and shows it in Ukranian possession.

It’s unclear why the SBU used an old image from March to link it to the transporter and Buk in the Ministry of Interior video, maybe their own failed attempt at propaganda, but all it achieved was confusing the situation. If they were trying to link the two transporters then they should have maybe asked why the transporters had a different paint scheme, different number of wheels, and different loading ramps.

The Launch Site Found?

A couple of days ago Storyful shared high resolution satellite map imagery of the areas around the crash site and locations identified in images of the Buk Missile Launcher (shared here, open with Google Earth). While many people focused on the crash site itself, others were looking for signs of the launchers. In a post on the Ukraine@WAr blog the author identified tracks in a field in images from July 20th, just south of the location the suspected Buk Missile Launcher was filmed, south of Snizhne

In his next post on the subject, the author also believes he’s identified the direction of smoke seen on the day, which some have claimed to be from the launch of the Buk’s missile, as being the same direction as the field. Personally I believe there’s two things that would be useful here, having satellite map imagery from the day before the attack to confirm the tracks are fresh, and having someone on the ground examine the tracks, ideally measuring the distance between the two sides of the tracks to see if it matches the specifications of the Buk. While I don’t feel the posts are conclusive, it’s something that warrants further investigation.",2014-07-22,"The Latest Open Source Theories, Speculation and Debunks on Flight MH17"
2014,8,https://www.bellingcat.com/news/mena/2014/08/28/russias-version-of-the-navy-seals-may-be-fighting-in-ukraine/,/news/mena/2014/08/28/russias-version-of-the-navy-seals-may-be-fighting-in-ukraine/,"

The Instagram account of a Russian special forces operative reveals that members of the elite Alpha Group took part in military operations in Ukraine. Ilya Gorelyh, who has been highly decorated for his service in special operations, has suggested that he and his colleagues took part in the fighting against Ukrainian forces.

On the 21st of July, Gorelyh posted a photograph of his car driving through the border crossing at Nehoteevka with the comment “ we are already close , fucking Banderas”. The reference is to Stepan Bandera , who led a nationalist movement in Ukraine during the Stalinist era and who remains notorious in Russia for his collaboration with the Nazis.

When one of his followers asks “holidays or work”, Gorelyh replies with “work, of course! Its to do with our profession” followed by gun emoji.

Two days later he posted a photograph of himself and another man brandishing a knife and a standard issue Russian Makarov pistol in their car. He commented: “#polite#people#spetsnaz#GRU#16OBrSpN#370ooSpN… we are coming”.

Some of the names preceded by hashtags are of the elite units that Gorelyh has served in, including the Alpha group which is Russia’s equivalent of the Navy SEALs or the British SAS. “Polite People” are the Russian equivalent of the “little green men”, the well-equipped forces who occupied the Crimea back in March.

The Apha Group , a small unit of Russia’s Special Forces, has been used in rescue operations in the Moscow theater and Beslan school hostage crises, and to carry out special operations including assassinations.

Gorelyh has been highly decorated for his years of service, and appears to be currently active with the special forces in Kaliningrad; an enclave between Poland and Lithuania that belongs to the Russian Federation.

He later writes “ I went to bed early yesterday … Didn’t sleep for two days, while we were riding around “free Ukraine, and the training was very good we let them know about us”. Gorelyh seems cautious about discussing the details of his work, instead he jokes that he is going to Ukraine to “ visit his grandmother ”.

Despite his caution, he has the DNR, the Russian acronym for the “Donetsk People’s Republic” set as his location. Moreover, when one of his followers urges him to “tear them [the Ukrainians] all apart” he replies with “we’re already tearing them”.

On the 29th of July, Gorelyh announced that he is was crossing the border at Goptovka. An anonymous user who seems to side with the Ukrainian forces posted “this time you’ll return from “grandmother” in zinc”. This is a reference to zinc coffins are used to return the bodies of dead soldiers from overseas. Gorelykh replied with “fucking Banderovite offspring, I have been there a hundred times, and will go again just as many times”.

This evidence of Russian military involvement comes at the same time as the revelation that around 40 Russian troops been killed in Ukraine, and the news that Angela Merkel has demanded an explanation from Putin regarding the presence of his troops in the conflict. As the evidence suggests that members of the Alpha Group have also been employed, it could mean that the Russian government has used force in a number of covert and illegal operations in Ukraine.",2014-08-28,Russia's Version of the Navy SEALs May Be Fighting in Ukraine
2014,8,https://www.bellingcat.com/news/mena/2014/08/27/revealed-around-40-russian-troops-from-pskov-died-in-the-ukraine-reinforcement-sent-in/,/news/mena/2014/08/27/revealed-around-40-russian-troops-from-pskov-died-in-the-ukraine-reinforcement-sent-in/,"

The instagram account of a Russian soldier who has recently returned to base from fighting in the Ukraine reveals the rough number of casualties in 76th Airbourne regiment from Pskov and proves Russian activity on Ukrainian territory.

There has recently been confirmation that members of the 76th Airbourne (VDV) regiment from Pskov were killed in the Ukraine , and a further number of troops have been captured by the Ukrainian forces. Vladimir Putin has claimed that his forces were not fighting in the Ukraine “I haven’t yet received a report from the Ministry of Defense. As far as I know, they were patrolling the border and may have ended up in Ukrainian territory”.

Looking at the social media accounts of paratroopers from Pskov who have survived the fighting, I have been able to find more details about the casualties and the involvement of the regiment in the war.

Egor Lesnikov, a contract soldier who has just returned from the Ukraine suggests the number of casualties has been much higher than initially thought; “I’m not arguing about duty… But 40 200s [Russian military term for dead bodies] from one regiment – its too much, don’t you think?”

He also says that conscripts as well as fully trained fighters are being sent to the Ukraine, “Our conscripts are going too, I went for two weeks, just flown back”. He sums up the situation; “its best not to rush there… its shit”. Yet, more troops have already been sent in to fight; “we were replaced by the 2nd BTGR”.

Lesnikov’s posts contradict the claims of the Russian Ministry of Defense, which continues to insist that Russian troops have not taken part in any military action, and which keeps denying the casualties among Russian servicemen killed in the war. His past also challenges the narrative of the Russian media, which continues to frame the war as a battle of Russian speakers against “fascism”.

For example, Lesnikov’s display picture on instagram is of the skull and crossbones symbol of the Waffen-SS, he also posted numerous drawings of white power symbols and slogans and even uploaded a picture of himself performing the Nazi salute to an image of Putin on television.

At least one other VDV soldier from the same regiment has an affiliation with Russia’s neonazi movement. The Russian authorities, keen to focus on Ukranian nationalists and organisations like the Pravy Sektor appear to be ignoring the nationalists among their own armed forces.

Yesterday, journalists from independent Russian media outlet Dozhd were attacked as their car pulled into a Pskov cemetary. The journalists wanted to check the names on the graves against a list of names that was published in Ukrainian media a few days ago. A man wearing a hooded top and shorts jumped on their car as another attacked their windows with a corkscrew and slashed their tires.

The attack bore a resemblance to what happened to a group of a peaceful protesters a few weeks back. The protesters were part of a movement to demonstrate against vastly expensive mansions that are being built for ministers from Putin’ United Russia party, in gated villages on the outskirts of Moscow. Back then, hooded men who appeared to be working with the police assaulted protesters, smashed their cameras, broke the windows of their cars and placed strips of spikes behind their tires.

Today, Dozhd have reported that the names have been removed from the graves of the killed Servicemen in Pskov. It is clear that Putin’s government will continue to deny the growing evidence of Russia’s military involvement in the Ukraine, and may enforce strong measures to stop the population from finding out the truth about what happened.",2014-08-27,"Revealed: Around 40 Russian Troops from Pskov Died in the Ukraine, Reinforcement Sent In"
2014,8,https://www.bellingcat.com/news/uk-and-europe/2014/08/27/who-exactly-are-the-terek-wolf-sotnia/,/news/uk-and-europe/2014/08/27/who-exactly-are-the-terek-wolf-sotnia/,"

Back in April Ukrainian Intelligence passed photographs to the Organization for Security and Co-operation in Europe (OSCE) which, they claimed proved that Russian Special Forces were operating in Ukraine to destabilize the country.

The photographs depict the gunman operating in the east of the country, where they had been seizing government buildings. The photos appear to show that the same group has been part of the take-overs in Slovyansk, Kramatorsk and Crimea. The documents also claim that one bearded gunman photographed in eastern Ukraine is a Russian Special Forces soldier who was also photographed in Georgia in 2008. Thus proving a connection with the Russian Government.

The link to Russia rests on the photographs of the bearded gunman. However other photos of the man cast doubt on whether he and the Russian soldier in Georgia are in fact the same person at all. In Georgia the man’s beard is reddish-brown, yet the man in eastern Ukraine has a grey beard of a different shape and different facial features.

Russian social media however has been considerably more successful at establishing the identity of the pro-Russian gunman. Using the Russian social media website Vkontakte the public profiles of many of the gunman photographed in eastern Ukraine can be found. The profiles raise many questions about the allegiance and ideology of the men.

The most prominent members of the militia appear to be part of a mysterious and ideologically questionable unit known as the Terek Wolf Sotnia. The profiles of the men show a recognisable V shaped insignia of a black, green and red tricolour, with the head of a wolf in front. The emblem and name of the unit are based on a WW2 Russian Cossack military unit which fought alongside the Nazi’s led by a man named Andrei Shkuro.

The profiles are the most revealing about the identity of the men. Many of the men do appear to be Russian citizens, but others too claim to be natives of Crimea or Eastern Ukraine. What’s most worrying is that a significant number of the men appear to harbour Fascist and ultra-nationalist sympathies. The pro-Russian rebels often claim to be defending Eastern Ukraine from Fascists operating in the Ukrainian Army. If it were the case that fascists were also operating in the pro-Russian forces this would undermine this claim.

One of the men photographed in Ukraine appears to be Evgeny Ponomarev who, according to his Vkontakte profile is from Belorechensk, Russia. Ponomarev is an active member of the Cossack Community there and appears in this photograph to be a member of the local Cossack police force. His profile also contains a picture of the emblem of the Terek Wolf Sotnia.

Another man, seen in Crimea and in pictures taken alongside gunman seen in Eastern Ukraine appears to be Igor Georgievsky. Georgievsky’s profile claims his home town is Simferopol. A photo on his profile shows him wearing the insignia of the Terek Wolf Sotnia standing outside the Crimean Naval base depicted in this Vice report. Other photos appear to show him posing with the bearded gunman and Ponomarev.

Another man photographed in Ukraine, heavily armed and in military uniform was originally identified by Ukranian Policy, a Ukrainian website and magazine, as Edvard Pitersky. However the Pitersky name and profile appears to be a fake to disguise his political beliefs. Instead Pitersky appears to also go by the name Edvard Matishin. Matishin appears, according to his Vkontakte profile, as a fascist and Nazi sympathiser. His profile is littered with racist and violent images, Nazi symbols, and images of him performing Nazi salutes.

His current city is listed as Kharkiv. Yet a majority of his pictures are taken in Belgorod, a Russian city near the border of Ukraine and in Kamchatka Russia, suggesting he was at one point a resident there. In one image he is pictured in military fatigues with Vladimir Ilyukhin, the Russian Governor of Kamchatka Krai.

Another of the gunman identified by Ukranian Policy is Dima Kharkovsky. In his now deleted profile he is pictured armed with an assault rifle and RPG in front of the flag of the “Donbass People’s Militia”. Kharkovsky also appears to be a pseudonym. His real name according to another profile is Dima Shelest who is pictured performing a Nazi salute in one instance.

Also identified by Ukrainian Policy is Evgen Zloy. Pictured here outside the council officers in Slovyansk. Apparently a resident of Simferopol, Crimea, Zloy is also pictured wearing a medal of the pro-Russian government of Crimea. Zloy’s Vkontakte page also contains a picture of a Nazi pendant as well as pictures that appear to show him with Ponomarev, the unidentified bearded gunman and wearing the insignia of the Terek Wolf Sotnia.

Another member of the militia could be Alexander Ganichev. On his Vkontakte profile it states he went to school in Donetsk, suggesting he’s Ukrainian rather than Russian. He is pictured with other gunmen in what are presumed to be occupied buildings in Eastern Ukraine.

The willingness of the pro-Russian militia to pose for photographs and to publish photos of their actions on social media also raises questions about their professionalism as soldiers. Whereas the Russian troops in Crimea wore balaclava at all times, these men have been regularly photographed showing their faces and have uploaded these imagines on to social media sites. This does suggest that the men are not professional soldiers who would be cautious about revealing information of their movements.

However, the truth could be even more worrying. The prospect of an armed, militant and emboldened group of men with neo-Nazi sympathies running riot in Eastern Ukraine is very worrying, especially considering reports of attacks on the Romani population of Slovyansk and of men handing out anti-Semitic leaflets in Donetsk. It would also raise questions for the Russian government considering their stance towards the Ukrainian fascists in Euromaidan and would make a mockery of claims that the rebellion in Eastern Ukraine is about defending people against Nazis.",2014-08-27,Who Exactly Are The Terek Wolf Sotnia?
2014,8,https://www.bellingcat.com/news/mena/2014/08/26/belgian-jihadis-in-syria-and-iraq-august-2014/,/news/mena/2014/08/26/belgian-jihadis-in-syria-and-iraq-august-2014/,"

Introduction:

The total number of Belgian fighters who are or were in Syria and Iraq is stable at a total of 385. Two of them are known to be fighting in Iraq in the ranks of The Islamic State (IS / ISIS)

The number of killed Belgians has risen to 32 in total. The number of those returned in our count would be about 27 (official numbers however of the Belgian government speak of at least 70 who have returned).

Although it is most likely that we are dealing with double mentions in our data, by these figures we might conclude that a maximum of about 325 Belgium originated Jihadist fighters are still active in Syria and Iraq

Group affiliation & current Location:

At least 59 of the Belgians who are or have been in Syria are in some way affiliated to Sharia4Belgium. Of these at least 28 have proven ties with the Islamic State (formerly known as ISIS). One still fights in the ranks of Jabhat an-Nusra and one, who has arrived on May 2nd 2014, claims to be affiliated with Jaysh al-Muhajireen wa’l-Ansar. It must be pointed out however still more of the unidentified are most likely fighting in the ranks of these last two groups. This could be explained by the mere fact that outside IS the use of social media seems to be in some way regulated.

In total at least 50 Belgians are affiliated with the Islamic State, 10 are linked to Jabhat an-Nusra, one with Kata’ib Al Muhajireen Fi Ard Sham, the previously mentioned one with Jaysh al-Muhajireen wa’l-Ansar, one is linked to Liwa Shuhada Idlib, one is affiliated with Faylaq as-Sham and 10 are linked to Suqur as-Sham.

For the first time we also found a Belgian fighting on the side of the regime. One guy from Mazée (Namur) is openly proud about fighting in the ranks of Bashar al-Assad’s army. Atleast two Belgian fighters are now in Iraq.

Origins & Identities:

Of the 385 Belgians fighting in Syria, 20 of them females, 113 have been identified fully and an additional 38 are known by one or more kunya’s (nom de guerre). Hereby the total of (semi-) identified Belgians fighting in Syria and Iraq

As for their origins; the previous trend continuously builds up:

Brussels : 54 Antwerp : 46 Vilvoorde : 25 Mechelen stable at a maximum of 14; only one female identified by kunya 10 people originate from smaller towns or cities.

It still remains remarkable most of the known Belgian fighters stem from Flanders and especially the axis Antwerp – Mechelen – Vilvoorde – Brussels. As noted in the previous update the amount of Walloon fighters stays remarkably low (updated to three, including the pro-regime fighter)

We know the ages of about 100 of them, varying between 13 (Younes Abaaoud) and 65 (Shaykh Bassam al-Ayashi). The average age of the Belgian fighters is about 24,5 years old.

Locations:

As far as our open source intelligence gathering allowed us, we were able to locate 73 Belgians in Syria. Some of them over the course of due time moved to ar-Raqqa as they became affiliated with the Islamic State.

Original count:

Aleppo : 35 Idlib : 12 ar-Raqqa : 9 (most of them recently arrived) Homs : 7 Damascus : 5 Latakkia : 3 Deir ez-Zor: 1 Saraqib : 1

Updated count:

Aleppo : 2 (but most likely more based on recent field-research by Montasser AlDe’meh. Idlib : 4 ar-Raqqa : 20 Homs : 0 Damascus : 4 Latakkia : 0 (killed in action) Deir ez-Zor : 0 (killed in action) Saraqib : 0 (killed in action)

The Belgian “Convoy of Martyrs”:

(in random order)",2014-08-26,Belgian Jihadi's in Syria and Iraq ~ August 2014
2014,8,https://www.bellingcat.com/news/mena/2014/08/25/920/,/news/mena/2014/08/25/920/,"

With the recent fall of Tabqa airbase in Northern Syria, the Islamic State has again gotten its hands on a massive amount of military equipment, which will certainly be used to further strengthen the Islamic State’s advance in the Middle East.

Although all operational assets of the Syrian Arab Air Force (SyAAF) were evacuated before the base was captured by the Islamic State, one MiG-21MFs serialed 1543, one MiG-21bis serialed 2217 and two MiG-21UMs serialed 2360 and 2357 undergoing maintenance and numerous inoperational MiG-21MFs and MiG-21UMs were left at the base and subsequently captured as spoils of war. Up to twenty-three MiG-21s are believed to have been captured in total.

Also captured were four anti-aircraft positions with a total of twenty-four 57mm AZP S-60 anti-aircraft guns, a couple of T-62s, large stockpiles of ammunition and various 9M113 missiles with associated launchers.

R-3S air-to-air missiles once destined to be used by the two squadrons of MiG-21s once based at Tabqa were also captured. While these missiles are useless in their intentional role without a suitable launch platform, R-3S missiles were used as unguided rockets after scores of them were captured at Dhab’ah airbase. However, due to the light warhead, this adaption is anything but useful.

Another invaluable asset to the Assad regime present at the base was a large array of radars responsible for detecting aircraft in Northern Syria. Without these, any aircraft is able to venture into Syrian airspace undetected. Given the Islamic State did not target the radars, it is likely they wanted to capture them in intact in an attempt to get a radar network up and running. However, it’s plausible that all were sabotaged by the remaining personnel on the base.

The most modern radar available at Tabqa is the Chinese made JY-27, seen in footage of the base before the capture below. Although this radar could be of great use for the Islamic State when aided by former operators of the system, the JY-27 lacks a height finding capability and needs to be supported by the two PRV-13s also present on the base. Other radars captured included a P-14 and P-35/37.

Despite the fact that many of the forty-year-old aircraft captured were derelict to begin with and possibly even deliberately sabotaged by the remaining personnel, it is not unthinkable that the Islamic State will work on making the two MiG-21s previously undergoing maintenance operational again. Similar to how the Taliban used pilots and technicians to enable them to operate MiG-21s, Su-20s, L-39s and Mi-8/17s in Afghanistan, mechanics trained to operate this equipment might be forced to aid the Islamic State in keeping them operational. Alternatively, given the amount of states operating MiG-21s in the past, it is plausible that Islamic State sympathisers with flight or aircraft maintenance experience will be brought in from abroad.

The Islamic State showed no interested in making any of the L-39s captured from Jaish al-Islam at Kshesh operational again however, instead using the airbase as a training base for its fighters. It is also possible the retreating fighters of Jaish al-Islam destroyed the L-39s, preventing possible use by the Islamic State.

The Islamic State is mostly defenceless against aerial attacks both in Syria and Iraq, a lack in capabilities thankfully exploited by the USAF and SyAAF in the past few weeks. Numerous anti-aircraft guns were also captured at Tabqa and during earlier battles, but due to their low mobility and limited use against modern, high-flying aircraft they don’t present the same risks to enemy aircraft as surface-to-air missiles (SAMs) do.

The most important facts remain that the fall of Tabqa ends the SyAAF’s dominance over the Raqqa Governorate and provides a free card for the Islamic State to expand their base of operations deeper into Syria. Although a renewed offensive on Aleppo might seem a more obvious move for the Islamic State, there now lies nothing between the Islamic State and Tadmor airbase near Palmyra and T.4 airbase, housing the SyAAF’s Su-24 fleet.

Wether or not the captured aircraft will be brought into active service, it is evident that the latest in a string of victories for the Islamic State will have great impact on the balance between the forces currently battling for control of Syria and Iraq.

Special thanks to ACIG.",2014-08-25,The Islamic State Resets Balance with Spoils of Tabqa Airbase
2014,8,https://www.bellingcat.com/news/mena/2014/08/24/tabqa-airbase-captured-by-the-islamic-state/,/news/mena/2014/08/24/tabqa-airbase-captured-by-the-islamic-state/,"

After encountering some setbacks earlier on, Tabqa airbase finally fell to fighters of the Islamic State today. With only one Pro-Assadist obstacle remaining in Northern Syria, the Islamic State’s territorial continuity in Northern Syria is closer than ever.

Tabqa is now the third airbase to have been captured by the Islamic State and is the second currently in the hands of the Islamic State along with Kshesh. Tabqa provides the Islamic State with numerous anti-aircraft guns and radars. Although several MiG-21s were captured intact, it is deemed unlikely that the Islamic State will be able to use them.

While the initial three assaults were slowed down and then repelled by a combination of minefields and the involvement of the Syrian Arab Air Force (SyAAF), which brought in fighter-bombers, attack helicopters and resupplied the base with transport planes, the ground forces on the base remained limited in numbers. The renewed, fourth offensive broke through Tabqa’s main defence line, after which the SyAAF was powerless to stop them.

The losses at Tabqa reveal the main weakness of the Islamic State: A lack of surface-to-air missiles (SAMs) to destroy or prevent enemy aircraft from flying over its territory. While there aren’t any SAMs to capture in Iraq, such weaponry is available in Syria. Although MANPADS are scarce in Northern Syria, Deir ez-Zor still houses two SAM sites with 2K12 Kub mobile SAM systems. While the 2K12s are too complicated to use for an inexperienced crew, former operators can be forced to man these systems for the Islamic State.

The continued efforts by the SyAAF to save Tabqa from capture by the Islamic State were significant. Yet now it seems this expensive operation was all in vain. It did not only cost precious amounts of fuel, but also tonnes of ammunition used by the SyAAF’s fighter-bombers and attack helicopters on positions of the Islamic State.

The assault on Tabqa airbase largely came as unexpected as it was thought Kweres airbase would be next on the list. The reason for focussing on Tabqa instead might have something to do with the status of this base.

Strategically located, the fall of the base provides a free card for the Islamic State to expand their base of operations deeper into Syria. Although a renewed offensive on Aleppo might seem a more obvious move for the Islamic State, there is now nothing in between the Islamic State and Tadmor airbase near Palmyra and T.4 airbase, housing the SyAAF’s Su-24 fleet.

Also, while Tabqa still houses operational fighter-aircraft, Kweres is nothing more than a runway littered with plane wrecks and troops only capable of defending the base, already being under siege and preparing for the imminent assault since December 2012.

While most of the planes at Kweres are either incapable of performing interdiction sorties, damaged or destroyed by the Islamic State’s mortar fire pounding the airbase in the last months, Tabqa is home to 12 squadron and another unknown squadron flying MiG-21bis, MiG-21MFs and MiG-21UMs.

The airbase was also home to various Mi-8/17, Mi-25 and SA-342 ‘Gazelle’ detachments, mostly being used for barrel-bomb attacks and resupplying the besieged bases of Division 17, Regiment 121, Brigade 93 and Kweres airbase.

Lastly, Tabqa houses eight munition bunkers, four anti-aircraft positions with a total of twenty-four anti-aircraft guns and five radars. Two PRV-13s, one P-14, one P-35/37 and the modern JY-27 radar system remained undamaged after the the initial three assaults, probably because the Islamic State wants them intact.

These radar systems are responsible for detecting aircraft in Northern Syria. If that capability is lost, the Pro-Assadists will lose any grip of what plane enters Syrian airspace via the North. A gap that can’t be filled.",2014-08-24,Tabqa Airbase Captured by the Islamic State
2014,8,https://www.bellingcat.com/news/mena/2014/08/20/attempts-to-blame-the-syrian-opposition-for-the-august-21st-sarin-attacks-continue-one-year-on/,/news/mena/2014/08/20/attempts-to-blame-the-syrian-opposition-for-the-august-21st-sarin-attacks-continue-one-year-on/,"

Over the last year numerous attempts have been made to place the blame for the August 21st Sarin attacks in Damascus on opposition groups, in an attempt to deflect criticism away from the Syrian government. These attempts have come from various sources, but thanks to open source information it’s been possible to debunk these claims as they’ve been made. One early example, repeated by the Russian government, was the videos were uploaded the day before the attack, proving the attacks were propaganda. A simple investigation revealed this was in fact due to videos uploaded to YouTube have a displayed upload date from the US based servers, with the actual upload date being part of the YouTube metadata. This was one of many now discredited attempts to blame the opposition for the attacks.

What has become clear over the past year, as various theories have fallen to the wayside, is the use of “Volcano rockets” to deliver the Sarin on August 21st, and the composition of the Sarin, have become key points in discerning who was responsible for the attack. Volcano rockets are unusual as they have a unique design not seen outside of Syria, coming in both explosive and chemical versions, and in different sizes. Videos posted by forces loyal to the Syrian government have shown them using the explosive rockets, and the chemical type were linked to previous attacks on opposition forces going back to late 2012.

Work by Dan Kaszeta, a chemical weapons specialist, has linked hexamine detected in samples taken from and around Volcano rockets used on August 21st to hexamine declared in the Syrian government’s chemical weapon programme inventory to the OPCW. Dan Kaszeta believes hexamine would have been used as an additive, an “acid scavenger”, to the two chemicals mixed together to produce Sarin to neutralise the destructive effects of acid produced as a by-product of that reaction.

This theory seemed to have been supported by a question answered by Dr Åke Sellström, head of the UN Inspection Team to Syria, during an interview with CBRNe World magazine

Winfield – Why was hexamine on the list of chemical scheduled to be destroyed – it has many other battlefield uses as well as Sarin? Did you request to put it on the list or had the Syrian’s claimed that they were using it? Sellstrom – It is in their formula, it is their acid scavenger.

The question was left out of the final published interview due to space considerations according to the editor of CBRNe World, but the interviewer, Gwyn Winfield, has confirmed the exact wording of the question and answer, and that the interview was recorded.

Any theory blaming the opposition for the attack would need to explain the use of Volcano rockets, a munition firmly linked to the Syrian government. In the CBRNe World interview Dr Åke Sellström explains the Syrian governments own claims about the attacks

Several times I asked the government: can you explain – if this was the opposition – how did they get hold of the chemical weapons? They have quite poor theories: they talk about smuggling through Turkey, labs in Iraq and I asked them, pointedly, what about your own stores, have your own stores being stripped of anything, have you dropped a bomb that has been claimed, bombs that can be recovered by the opposition? They denied that. To me it is strange. If they really want to blame the opposition they should have a good story as to how they got hold of the munitions, and they didn’t take the chance to deliver that story.

Keep in mind the Syrian government is claiming their stores were not stripped and no bomb that they used has been reclaimed by the opposition, so based on that it would seem the only way for one of their Volcano rockets to end up in Eastern Ghouta is if they fired it.

The lack of a coherent theory from the Syrian government hasn’t stopped others from trying to piece together their own. The most recent and notable efforts came from Pultizer Prize winning journalist Seymour Hersh, who published a pair of articles in the London Review of Books, Whose Sarin? and The Red Line and the Rat Line. In his most recent piece he constructs a narrative where Turkey provided Jabhat al-Nusra with chemicals to make Sarin, which was then used by Jabhat al-Nusra in a false flag attack in an attempt to draw the US into the conflict.

In an article by myself and Dan Kaszeta for the Guardian, It’s clear that Turkey was not involved in the chemical attack on Syria, we detailed the reasons Seymour Hersh had got it wrong, focusing on the Volcano rockets used in the attacks and the complexities of manufacturing Sarin. Seymour Hersh had previously stated “It’s not hard to make Sarin. You could mix it in the backyard. Two chemicals melded together”, which in one sense is true, Sarin is produced by mixing two precursors, except without the proper equipment you’re going to get yourself and your neighbours killed pretty quickly. When asked about the points raised by myself and Dan Kaszeta in an interview for Diken Hersh’s response was to resort to ad hominem arguments, failing to address the points we raised, or doing so in such a way that revealed his own ignorance of the facts gathered so far. Diken interviewed both myself and Dan Kaszeta asking for our response to Hersh’s reaction, and as yet Hersh has been unable to answer the points we raised in our article in the Guardian or our subsequent interviews.

One point Hersh does raise is the range of the Volcano rockets, claiming that the short range would mean they couldn’t be launched from government held territory. He mentions the work of Richard Lloyd and Ted Postol, who have come up with an approximate range of 2-2.5km, but based on open source information from both sides in the conflict it’s been possible to identify government positions around August 21st, which shows 2-2.5km would still put the impact sites within range of those government held areas.

Seemingly impressed by Seymour Hersh’s work, Russia Today recently stated before an interview with Ted Postol that he now believed the opposition were responsible for the Sarin attacks. More recently, Ted Postol published a document claiming to debunk claims made by Dan Kaszeta over the use of hexamine as part of the Sarin manufacturing process. As part of this document he includes private communications between himself and Dan Kaszeta (published without Dan Kaszeta’s permission), copying in “syr sis”, an email address that belongs to Maram Susli, aka Mimi al-Lamah, or more commonly known as her Twitter handle @PartisanGirl and her SyrianGirl Youtube channel.

Maram is a popular figure on the conspiracy circuit, appearing on various broadcasts by individuals including the conspiracy theorist Alex Jones and the former Grand Wizard of the Knights of the Ku Klux Klan David Duke (described as “perhaps America’s most well-known racist and anti-Semite” by the ADL), among other outlets.

Maram has expressed the view that the Syrian government was not responsible for the August 21st Sarin attacks, and claimed she had helped Ted Postol with his report, so it begs the question why an MIT professor had to go all the way to an Australian chemistry student known for her outspoken views on the August 21st attacks and involvement with conspiracy theorists for help with his report, rather than asking at MIT’s Department of Chemical Engineering?

.@uwanews not to mention it appears she – Maram Susli @Partisangirl is a supporter of Hezbollah as seen here… pic.twitter.com/4VteM5VARB — S (@dopsdingers) July 5, 2014

It has also been noted by Steve Johnson, visiting fellow at Cranfield University that in the email exchanges between Dan Kaszeta and Ted Postol published in the document “Postol’s demands of Dan encourage him to proliferate a method of chemical weapon production. Were he to do so it could technically breach US and UK law on export control”. It appears Postol is unaware of this, and takes Dan Kaszeta’s unwillingness to provide details about certain processes as evidence of some sort of purposeful deception on the part of Dan Kaszeta, rather than Dan Kaszeta staying within the boundaries of the law.

This seems especially important when Ted Postol begins sharing emails with Maram Susli without Dan Kaszeta’s permission, and when Dan Kaszeta asks they stop copying Maram into the conversation due to potential legal issues Postol yet again copies Maram into the email chain, and states

She has provided us with technical information that we have needed to advance our analyses, alerted us to technical issues in chemistry that we were not aware of, and has responsibly contributed very useful information to the various technical matters we were investigating.

Much of the Postol document focuses on two areas, statements made by Dr Åke Sellström, head of the UN Inspection Team to Syria, and the solubility of hexamine in isopropyl alcohol (a Sarin precursor). Much of this is already addressed in Dan Kaszeta’s earlier piece, The Chemical Fingerprint of Assad’s War Crimes. In this article Dan Kaszeta explains the solubility of hexamine in isopropyl alcohol is only an issue when used in a “mix in flight” rocket, and “not any impediment to a process in a production facility”. He adds

With assistance of others, I have worked out at least one process that would produce Sarin using this method, but it would be dangerous, unethical, and possibly illegal to publish such a process. Hexamine is not previously noted in the open literature for use in Sarin production, although it should be stated that the large majority of knowledge of the manufacture of chemical warfare agents is not freely available and much of this information is classified.

It is broadly agreed by anyone who has been researching the August 21st attacks, myself and Dan Kaszeta included, that the rockets used were not “mix in flight”, and that the Sarin would have been mixed before being put inside the warhead, so it’s unclear why Professor Postol spends so much time debunking a claim no-one is making. Dr Åke Sellström’s reticence to confirm Dan Kaszeta’s theories is likely due to his work with the OPCW in Syria, whose mandate prevented it from assigning responsibility for the attacks to either side, and it seems unlikely Dr Sellström would choose to do so in an unsolicited email. Gwyn Winfield, the interviewer who spoke to Dr Sellström about the hexamine claims has also confirmed Ted Postol has not contacted him about those claims.

But, as with all theories, without being able to explain the use of Volcano rockets in the attacks it leaves the same hole so many other theories have failed to fill. It should also be considered that a few hours later M14 140mm artillery rockets were used to attack Western Ghouta with Sarin, and based on their impact sites it seems impossible they could have been launched from the same location as the Volcano rockets. The attack on Western Ghouta is frequently ignored by people putting together these theories, for example Seymour Hersh doesn’t mention it in any of this work, claiming the rockets used in the attacks were “homemade”, clearly not the case with the M14 rockets. It seems that the Western Ghouta attack just doesn’t fit well with any of these theories, so it’s easier just to pretend it didn’t happen.

So one year on, where does that leave us? Despite the best attempts of many people, from the Russian government to a Pulitzer prize winning journalist, from conspiracy theorists to an MIT professor, it seems clear all attempts to blame the opposition for the August 21st attacks fall apart once you look at the most basic information established about the attacks.",2014-08-20,Attempts to Blame the Syrian Opposition for the August 21st Sarin Attacks Continue One Year On
2014,8,https://www.bellingcat.com/news/uk-and-europe/2014/08/16/live-tweeting-the-phone-hacking-trial-interview-with-adam-page-2/,/news/uk-and-europe/2014/08/16/live-tweeting-the-phone-hacking-trial-interview-with-adam-page-2/,"

Just to update after a number of inquiries: the paperback is now nearly proofed and about to be sent to the printers. Depending on their (summer) time scales, the book should be delivered by the end of the month with a launch party in Central London in mid September.

Meanwhile, even if you buy the paperback, you get the three ebook formats immediately – for kindle, iPad and a PDF. These are nearly completely proofed, but updates will be send around the print run Have a fantastic summer. If you’re in Norfolk this weekend, come and see me speak about live tweeting the hacking trial this Sunday Lunchtime at the Voewood Festival.",2014-08-16,Live Tweeting the Phone Hacking Trial: Interview with Adam Page
2014,8,https://www.bellingcat.com/news/mena/2014/08/15/accusations-of-cluster-munition-use-by-the-islamic-state-in-kurdish-syria/,/news/mena/2014/08/15/accusations-of-cluster-munition-use-by-the-islamic-state-in-kurdish-syria/,"

In an article published yesterday on the Arabic language news website ANHA, claims were made by local Kurdish groups in the town of Ayn al-Arab (also know as Kobanê) that during attacks by the Islamic State cluster munitions had been used. They warned against touching the unexploded submunitions, claiming an 11 year old child had been killed while handling one of the unexploded submunitions, in an incident that also injured an 8 year old child.

Along with the article were images of the cluster submunition used, seen below

This type of cluster submunition has been seen before in Syria, with the following video showing an example from June 2014 in Homs

The red ribbon visible in these images are part of the arming mechanism. As they are deployed, the ribbon causes the submunition to spin as it falls, causing the arming pin the ribbon is attached to to be pulled out, arming the submunition. In the example in the video, the arming pin can be seen sticking out the side of the neck of the submunition, showing this is a live submunition. In the below image from the set posted by ANHA we can see the arming pin is still in place, and that the submunition is unarmed. A tug at the red ribbon would likely arm the submunition, causing it to explode, demonstrating why these are an extremely deadly persistent threat to civilians long after they’ve been used

While the type of cluster submunition has been seen in Syria before,it’s still unclear what the country of origin is for it. Currently it’s know as ZP-39, and appears to be similar to the design of submunitions used with the Egpytian Sakr 122mm cluster rockets that have been used in Syria over the past year. This may suggest this is delivered by an as yet unidentified type of 122mm cluster rocket, something the Islamic State would be capable of launching.

Cluster munitions are seen as indiscriminate weapons, leaving a legacy of unexploded ordnance that can take years, even decades to eliminate. Their use is covered by the Convention on Cluster Munitions, which effectively bans their use and production by countries who have ratified the treaty. As yet, countries including Syria and the United States have yet to ratify the treaty.",2014-08-15,Accusations of Cluster Munition Use by the Islamic State in Kurdish Syria
2014,8,https://www.bellingcat.com/news/mena/2014/08/13/on-uk-arms-exports-to-israel-and-the-likelihood-of-a-suspension/,/news/mena/2014/08/13/on-uk-arms-exports-to-israel-and-the-likelihood-of-a-suspension/,"

Since the most recent conflict in Gaza began, domestic pressure has been growing on the British Government to take a stronger stance towards Israel. In particular, the focus has been on demands to establish an arms embargo, or to a lesser extent to suspend a number of export licences for arms and components which Israel could potentially be using in its military bombardment of Gaza. The Business Secretary Vince Cable, whose department is officially responsible for export licencing, yesterday announced a suspension of 12 export licences if “significant hostilities” resume.

In Vince Cable’s and Nick Clegg’s public tug of war with Number 10 and the Foreign Office over arms exports to Israel, the latter have won the first round, ensuring a suspension is conditional, and that the final say on what constitutes a resumption of “significant hostilities” will be one for the PM or Foreign Secretary to decide.

A limited suspension:

In an official statement, the Government only provided details for 3 of the 12 export licences which they would be willing to suspend; namely components for military radar systems, combat aircrafts, and tanks. Based on evidence given by Vince Cable to the Arms Exports Controls Committee in May this year, the UK has approximately 177 extant export licences to Israel which fall under the ‘Mil’ category(those exports explicitly military in purpose). The justification given for the selection of the 12 highlighted licences is that the Government itself has been unable to determine whether they meet the criteria for issuing export licences. However a brief look at the 177 extant arms export licences clearly suggests that far more than 12 current licences would be equally questionable under the Government’s own criteria; namely whether an export would:

contravene the UK’s international commitments (ie breach arms embargoes or sanctions)

be used for internal repression or the abuse of human rights

provoke or prolong armed conflicts or aggravate existing tensions in the destination country

be used aggressively against another country

adversely affect the national security of the UK or allies

be to a destination where the behaviour of the buyer country raises concerns with regard to its attitude to terrorism or respect of international law

be diverted or re-exported under undesirable conditions

in the case of developing countries, seriously hamper the sustainable development of the recipient country

The disclosure of only 3 of the targeted licences is problematic, since of the 177 export licences under the ‘Mil’ category, there are at least 20 separate licences for “components for military radars”. How many, or which specific ones make up the 12 highlighted licences remain unclear, or indeed if more than 1 of the 12 licences relate to parts for military radars. Similarly there are 2 separate licences for “components for combat aircraft”, and 5 separate licences for “general military vehicle components”.

As well as those noted above, some of the other military class export licences to Israel include:

20 licences – components for targeting equipment

11 licences – components for electronic warfare equipment

5 licences – components for combat naval vessels

5 licences – components for military support aircraft

4 licences – military communications equipment

3 licences – aircraft military communications equipment

2 licences – small arms ammunition

2 licences – anti-riot/ballistic shields

2 licences – technology for unmanned air vehicles

1 licence – components for surface-to-surface missiles

1 licence – components for military helicopters

1 licences – components for sniper rifles

1 licence – components for military infrared/thermal imaging equipment

1 licence – body armour, components for body armour, military helmets

1 licence – components for military aero-engines

1 licence – components for military combat vehicles

1 licence – components for air-to-surface missiles

1 licence – anti-armour ammunition

1 licence – Water cannon

1 licence – Weapons sights

The Government’s lack of transparency over this matter is a clear concern. On the 7th August, the Chairman of the Arms Exports Controls Committee wrote to the Foreign Secretary requesting a list of “all the controlled goods…that have received the British Government approval for export to Israel which the Government has reason to believe may been used by the Israelis in the course of Operation Protective Edge either from within Israel or in Gaza itself.”. This request is separate to the published details of the Government’s recent review, and the deadline for a response is the 29th August, at which point the resumption of hostilities may have long since begun.

A policy shift?

In a recent article for Haaretz, Anshel Pfeffer made the case that historically arms suspensions have had little effect on Israel, and that the proposed suspension would be equally ineffectual. Pfeffer also goes one to cite unnamed Israeli officials, in relation to the proposed suspension, as saying that “an actual suspension was highly unlikely”.

Both statements are problematic for separate reasons. Firstly the point of a suspension, at least for campaigners and politicians calling for it, is not to have an impact on the effectiveness or capacity of the Israeli military. The reality is far simpler, namely to ensure the UK is not complicit in Israel’s disproportionate use of force and alleged war crimes, and that the British Government is consistent in its application of its own criteria for the approval of export licences. For comparison on the latter point, almost immediately after the Rabaa massacre in August last year, the British Government suspended 49 export licences to Egypt, and revoked entirely a further 5.

As for questions regarding the likelihood of a suspension to be actually enforced, Pfeffer’s article neglects to mention any suspensions, revocations, or denial of export licences beyond the period of Margaret Thatcher’s tenure as Prime Minister, giving the misleading impression that there have been no action over export licences to Israel since. However soon after Operation Cast lead, then Foreign Secretary David Miliband suspended 5 export licences to Israel specifically relating to arms used by Israel during the military campaign. Equally, 10 export licence applications were refused in 2009, 5 of which were for military equipment and 2 of which were 1C350 class chemicals; a set of dual-use chemicals recognised for their use in chemical weapons programmes, and which include 4 forms of phosphorus. 1 licence was also revoked altogether in 2009, relating to ‘components for naval radars’.

Again in 2012, during the last quarter of the year in which Israel launched ‘Operation Pillar of Defense’, the UK refused 4 export licence applications including ‘components for artillery ammunition’, and ‘components for military patrol/assault craft’. These various actions do not indicate a policy shift; rather a bowing to domestic pressure from not just campaigners and Human Rights organisations, but significant pressure from within parliament itself; including the Arms Exports Controls Committee. The likelihood of the UK arms suspension for exports to Israel is not necessarily a reflection of its Israel policy; although the scale and limits of the proposed suspension are. The administration and approval of arms export licences are handled by the Department for Business, Innovation, and Skills, although tellingly the FCO has its own section dedicated to arms export controls. The limited nature of the decision announced by Vince Cable is a perfect reflection of this division.

Note: The figures provided on extant export licences are based on evidence provided by Business Secretary, Vince Cable, on May 12th 2014, and represent the most up to date data provided by the Government. The Government have confirmed that there has been no further action taken on exports during Operation Protective Edge, and according to the Government’s Strategic Export Controls databased, no export licences were issued in the intervening period. The data pertaining to previous years is based on the Department for Business, Skills and Innovation Strategic Export Controls report and statistics site.",2014-08-13,On UK Arms Exports to Israel and the Likelihood of a Suspension
2014,9,https://www.bellingcat.com/news/rest-of-world/2014/09/29/occupycentral-mesh/,/news/rest-of-world/2014/09/29/occupycentral-mesh/,"

Since Saturday, Hong Kongers have been occupying the center of the city. As with many of these grassroots movements before, pictures showing massive protests flooded social media.

Defying police, thousands of demonstrating block main highway connecting Central and Wanchai to protest China. pic.twitter.com/Gw20Ic4rbf — Alan Wong (@alanwongw) September 28, 2014

On Sunday, an increasing number of reports appeared on Twitter about mobile networks being blocked in central Hong Kong areas.

As a network researcher, I turned to my usuals tools of trade (about which I will write more soon) to find out what was going on. Unlike Syria or Iran, I don’t have any local contacts so I turned to widely available open-source information. Google’s Transparency data for Hong Kong highlighted two significant drops in connections on Sunday. In addition to having blocked mobile network connections in central areas, the network disruption did apparently affect some of the upstreams resulting in significant disruptions affecting most of Hong Kong. The granularity of the data doesn’t let us understand what neighbourhoods were the most affected.

Two major network disruptions recorded in the last 24 hours in Hong Kong. Source: Google Transparency pic.twitter.com/ahllBCZdN5 — The OSINT (@theosint) September 28, 2014

Network disruptions during protests is nothing new. Egypt, Syria, Tunisia … have all blocked access to the Internet at some point or another during the protests. Whether or not these measures were beneficial for law enforcement is questionable.

In most cases, the lack of available signal results in delayed coverage, misinformation starting to spread way quicker than usual and prevents the protesters from coordinating their efforts and movements.

It turns out however that Hong Kongers had a back up plan. As the network was going down in most central neighbourhoods, protesters were urged to download FireChat, an application that uses a form of mesh-networking to create a local chatroom without requiring Internet access. Unlike regular networking, mesh-networking enables devices to talk to each other, creating a digital grid in the city to which any neighbouring device can connect. If enough users are participating to this grid, it becomes considerably more resilient and resistant to censorship/surveillance than a centralized network infrastructure.

According to FireChat app founders, 0.1% of Hong Kongers were using the application on Sunday evening. (It’s important to note that FireChat app tracks the app usage with Google Analytics, which is a questionable practise given the use cases of the application)

Right this moment, more than 1 person in 1000 in #HongKong has their phone unlocked and looking at a #FireChat… http://t.co/TJjlK8ffYQ — Stanislav Shalunov (@shalunov) September 28, 2014

So, why this sudden success and use of mesh networking while many tried and failed to deploy mesh-networks during similar events?

As I summed it up in a tweet, density and need were the two factors I think. The fact that there is such a high density of smartphones running the app in a bounded area because there is no other way to communicate contributed to the success of this experiment.

This picture illustrates why Hong Kong is the new playground for mesh networking. Driven by need, enabled by density pic.twitter.com/3Us5gxnDFI — Frederic Jacobs (@FredericJacobs) September 29, 2014

It is important however to realize that FireChat app has some limitations:

– Because of how Multipeer Connectivity works, you need to be close to a member of the mesh to be able to connect to it (30 to 100 feet).

– The application has no encryption meaning that no discussion is really private.

– Messages are not checked for integrity, meaning that impersonation can happen.

This is only the beginning. Mesh-networks are not ready yet for prime-time. FireChat app would be pretty useless in a setting like rural Syria or Iran when you have way fewer powerful smartphones and a way lower density of connected devices. But eventually, our devices might be able to replace the top-down telecom infrastructure that enabled communications until now. Interesting projects by Open Garden or the Serval Project are aiming at building wider-scale mesh networks and with what we’ve seen, we can only be optimistic for the future.",2014-09-29,Occupy Central: Is the Mesh Ready for Prime-time?
2014,9,https://www.bellingcat.com/news/uk-and-europe/2014/09/24/video-comparison-confirms-the-buk-linked-to-the-downing-of-mh17-came-from-russia/,/news/uk-and-europe/2014/09/24/video-comparison-confirms-the-buk-linked-to-the-downing-of-mh17-came-from-russia/,"

Earlier this week we examined photographs and videos of a Buk missile launcher recorded in Russia in June 2014 that appeared to match the Buk photographed and filmed on July 17th in Ukraine travelling through rebel held territory that has been linked to the down of MH17. One photograph from Paris Match showed markings and damage on the side of the Buk missile launcher in Ukraine that appeared to match the markings on damage to the Buk missile launcher recorded in Russia.

So a huge thanks to Timmi Allen who has created the following video that compares the Paris Match photograph to images of the Buk missile launcher filmed in Russia, that shows that damage and the markings (those that haven’t been painted over) are a perfect match.

Based on this it would seem undeniable the two missile launchers are the same vehicle, confirming Russia supplied the the Buk linked to the downing of MH17, and as our previous work has shown, that it was likely supplied by the the 53rd Zrbr “Buk” brigade which is based in Kursk.",2014-09-24,Video Comparison Confirms the Buk Linked to the Downing of MH17 Came From Russia
2014,9,https://www.bellingcat.com/news/mena/2014/09/24/us-allies-begin-air-strikes-in-syria/,/news/mena/2014/09/24/us-allies-begin-air-strikes-in-syria/,"

U.S. and Arab allies launched air-strikes across Syrian territory targeting Islamic State and the al-Qaeda-linked Khorasan group.

On 23SEPT14, Pentagon officials briefing the press described the successful air-strikes as part “of a credible and sustainable persistent campaign to degrade and ultimately destroy” the Islamic State. US forces hit targets focusing on the organization’s command and control infrastructure but stressed that they had not targeted the group’s leadership at this time.

US Forces conducted 14 strikes along with those from partner states which included Jordan, the UAE, Bahrain, and Saudi Arabia. Qatar acknowledged playing a supporting role. (US F-18s deployed to Qatar earlier this year and a couple of EP-3s have been observed on imagery).

Three waves of attacks were carried out with the opening salvo accomplished by two US guided missile destroyers, the USS Arleigh Burke (DDG-51) in the Red Sea and the USS Philippine Sea (CG-58) in the Arabian Gulf. Around midnight (local time), the two vessels launched more than 40 Tomahawk cruise missiles at targets in eastern and northern Syria near the cities of Aleppo and Raqaa. The majority of those strikes targeted Khorasan Group compounds, manufacturing workshops and training camps, officials said.

Thirty minutes later, a second wave consisting of F-22 Raptors, F-15 Strike Eagles, F-16s, B-1 bombers and drones launched from regional bases against targets in northern Syria, including ISIS headquarters, training-camp barracks and combat vehicles. After three hours, a final wave consisting of F-18s from the USS George H.W. Bush aircraft carrier (CVN-77) in the northern Arabian Gulf and regionally based U.S. F-16s jets, inter alia, attacked ISIS training camps and combat vehicles in eastern Syria. Coalition partners participated in the second and third waves.

Geolocated Strikes

During Tuesday morning’s press briefing the DoD provided imagery of just three of the fourteen targets. Those targets have been identified. The first one, called out by the DoD as an ISIL Finance Center, is located in the heart of Raqqah city between the Governorate Building (“City Town Office”) and the Circassians Mosque on Faysal Street. The Governorate Building is considered Islamic State’s main HQ in the province since militants took the city in March 2013. In the press statement, the Pentagon claimed it targeted this building’s communications array with a tomahawk cruise missile detonating as air bursts. Earlier in the month, activists spotted what appeared to be a Predator drone orbiting the skies of the city.

The second structure shown in images was called out by the DoD as a command and control center. Islamic rebels initially captured this area back in November 2012. Its location, approximately 50 miles northwest of Raqqa city, is also less than one mile from the 630MW producing Tishrin Dam (literally October Dam). The building was reportedly struck during the second wave of strikes by USAF F-22s flying from the UAE’s Al Dhafra airbase. The F-22s delivered precision guided munitions (or PGMs) targeting only the right (eastern) side of the building. Video released by CENTCOM suggests the US monitored the strike with drone aircraft.

The last target discussed by Pentagon reps was the ISIL residence located near Syria’s Abu Kamal. Described as a training and logistics site, the location was reportedly engaged with multiple PGMs from F/A-18s launched from the USS George H.W. Bush. Based upon additional imagery released by the DoD, this site was probably a vehicle staging area as there appear to be destroyed tanks in the Battle Damage Assessment shown to the press. This is at least one of two sites struck in the area.

The second site, also identified, is located less than two miles from the ISIL residence and was probably the logistics site mentioned during the briefing. (The additional imagery is a screen capture from a video released by US Central Command). Importantly, this location is less than 6 miles from one of the main ground lines of communication leading into Iraq, the Al Qaim border crossing. This was probably a major supply location supporting fighters in Iraq’s Haditha and Ramadi, especially since late June when the crossing was captured.

And last but not least, activists on the ground also reported that the Brigade 93 base was targeted in strikes. This location is approximately 30 miles north and 36 miles east of the ISIL Finance Building and the Command & Control Center, respectively. In August, the Islamic State captured the Syrian Army base from government forces, then one of two final positions held by the Assad regime in the governorate. Interestingly, this location does not appear in the map graphic released to the press.

Concluding Remarks

Although initial airstrikes in Syria were successful, it is difficult to determine how long they will continue. Pentagon spokesman Army Lt. Gen. Bill Mayville told reporters, he would be thinking “in terms of years.” Meanwhile in Iraq, US forces have carried out at least 194 airstrikes against Islamic State as of 23SEPT14. With the additional strikes now in Syria, the USG has considerably expanded its participation in a conflict that it has been apprehensive to fight.",2014-09-24,US & Allies Begin Air-strikes In Syria
2014,9,https://www.bellingcat.com/news/mena/2014/09/23/videos-and-photographs-claim-to-show-civilians-killed-by-us-led-air-strikes-in-syria/,/news/mena/2014/09/23/videos-and-photographs-claim-to-show-civilians-killed-by-us-led-air-strikes-in-syria/,"

Following last night’s air strikes on targets inside Syria by US led forces, a number of claims were made about civilian victims of the air strikes. After 3 years of conflict Syrian opposition groups have already established social media networks that have allowed them to quickly share and disseminate images and reports from the conflict, and this has meant it’s been possible to find evidence to support the claims of US led air strikes killing and injuring civilians.

The main allegations come from the small town of Kafar Deryan, in Idlib, and west of Aleppo, where videos and images posted to social media channels have shown rescue efforts after the attacks, victims, and the debris of the munition used.

Reports on the local Facebook page posted around midday details 4 dead and 8 wounded, and includes images of the victims

1 Child Zainab Muhanna Barakat

2 Child Safaa’ Muhanna Barakat

3 Child Mahmoud Juma’a Muaz

4 Mother of Mahmoud Juma’a Muaz

The names of the wounded

1 Khansa Juma’a al-Doush

2 Child Ahmad Muhanna Barakat

3 Child Malak Muhanna Barakat

4 Sabha Shaker Taher, Wife of Muhanna Barakat

5 Child girl Wafaa’ Muhanna Barakat

6 Child Mahmoud Mohammed Muaz

7 Safwan Yahya Skaff

8 Juma’a Mahmoud Muaz

It also reported 3 women and 3 children were killed who they had not yet identified.

A post a few hours later lists four more dead

1 Abdul Hamid Muhammad Jahjah.

2 His wife Reem Al-Hajji.

3 His daughter Basmalah Jahjah.

4 His son Mohammed Jahjah.

In both reports the deaths and injures are linked to US led air strikes.

Videos of the rescue efforts were posted on the local YouTube channel, as well as on their Facebook page

A video was also posted on their YouTube channel claiming to show the air strikes as they happened, including multiple strikes

Video from the next day shows the destruction done to buildings in the area

Several videos and photographs also show the remains of the munitions used (captions from the original image shared here)

The remains do not match any munition seen in the conflict so far, and a number of specialists have told me these may by the remains of a Tomahawk missile, although due to the heavy damage to the munitions it’s currently not possible to be certain. The strike location would also be in the areas defined by today’s Pentagon press conference on the air strikes

It seems, based on this information, that there’s strong evidence that US led air strikes led to the deaths of 11-14 civilians, if local reports are accurate, along with a further 8 being injured in last nights air strikes.

Updates Recent posts by Jabhat al-Nusra linked Twitter implies a presence in the town, with this tweet claiming their HQ in the town was empty and only civilians were kiled. However, the administrator of the Facebook page has denied any JaN or ISIS HQs in the town after we contacted them. Another contact in the town claimed that all of the Jabhat al-Nusra HQs are located on the edge of the town, not inside it, and they had already been emptied of fighters and equipment before the attack. He also claimed all the missiles hit civilian homes and nearly all the victims were civilians. He went on to add",2014-09-23,Videos and Photographs Claim to Show Civilians Killed by US Led Air Strikes in Syria
2014,9,https://www.bellingcat.com/news/americas/2014/09/22/backdoors/,/news/americas/2014/09/22/backdoors/,"

Last week, Apple announced that the company will no more able to decrypt your personal data, making the extraction of this data impossible when requested by law enforcement.

On devices running iOS 8, your personal data such as photos, messages (including attachments), email, contacts, call history, iTunes content, notes, and reminders is placed under the protection of your passcode. Unlike our competitors, Apple cannot bypass your passcode and therefore cannot access this data. So it’s not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8. (Source: Apple)

I am really impressed with the great privacy enhancements that Apple put in place over the years and specifically in this latest release. It’s important to note that a lot of user’s content (including pictures, videos, 3rd party application data …) can still be extracted of a locked iPhone without his consent if you can get access to the his laptop on which he has iTunes sync enabled as forensics expert Jonathan Zdziarski notes.

Reactions

The reactions were widely positive. This comes only weeks after the “iCloud leak” and, over the past year, we have learned the extent of the overreaching mass surveillance programs thanks to Edward Snowden. But not everyone welcomed the decision. Orin Kerr wrote an article in the Washinghton Post, claiming that it’s a “dangerous game” that Apple is playing and that Apple shouldn’t obstruct “justice” for cases where law enforcement has a lawful search warrant.

So what is Orin Kerr advocating for?

Orin Kerr’s fantasy seems to be a computer system that is encrypted in such a way that someone with a warrant would be able to decrypt the device. Let’s see how this technically can be implemented.

Key escrowing and backdoors

For Apple to be able to hand over data to law enforcement, they would require a backdoor. Backdoors in encrypted systems are better known as key escrows. Key escrowing allows Apple to derive the decryption key of the device based on non-user entered parameters. In such a setting, Apple would be able to generate the decryption keys of any phone, not just the warranted devices.

This has considerable privacy and security implications.

Here’s what breaking government mandated backdoors look like in a non-digital world, it makes us all safer, right?

Systems security vs Encryption

As we’ve seen many times in the past, all web services are breached at some point. iCloud, Gmail, Facebook … have all had data breaches. What we learned is that no matter how good your engineers are, attackers will always win. Although, the attackers have the upper hand in breaching systems, the defenders appear to have the upper hand when it comes to encryption. Breaking into a system is not all, you still need to be able to read the information that is stored on a server if it’s encrypted. And we know that correctly implemented cryptography works. So encryption is your last line of defence when it comes to protecting your information.

Take aways

What does this mean for the Apple iOS 8 device encryption? It does mean that, whoever your attacker is, whether it’s the Chinese government, the NSA or simply a group performing illegal hacking of mobile data to ask for ransoms, they will eventually figure out how Apple generates those key escrow decryption keys and be able to decrypt any iOS device.

Recent Snowden revelations showed how the NSA hacked into Google’s datacenter to gather information that they couldn’t get through legal channels. I have no doubt that they, their partners and their adversaries would do anything to compromise Apple’s master key system (or already have).

The security tradeoff that Orin wants us to make here is definitely not worth it. Are we ready to trade in the security of millions of iPhones to be able to decrypt a few iPhones a year that had the required search warrant? I don’t think so.",2014-09-22,On Key Escrows and Backdoors
2014,9,https://www.bellingcat.com/news/uk-and-europe/2014/09/22/more-evidence-of-russia-supplying-the-buk-linked-to-the-downing-of-mh17/,/news/uk-and-europe/2014/09/22/more-evidence-of-russia-supplying-the-buk-linked-to-the-downing-of-mh17/,"

Earlier this month, Bellingcat looked at new evidence that the Buk used to down MH17 belonged to the Russian military. The Buk photographed by Paris Match in rebel controlled Donetsk on the morning of July 17th and tracked travelling though rebel territory throughout the day by Bellingcat and others also appeared to be part of a convoy filmed in Russia in late June heading toward the Ukrainian border. Using markings visible on the side of the Buk photographed by Paris Match and stills from the convoy in Russia it was possible to find elements that matched despite attempts to paint over some of the markings on the vehicle

Other elements matched, including the lack of rails present on many other Buks in the same convoy in Russia, also missing from the Buk in Ukraine

As part of our investigation we examined footage of other Buk missiles launchers to find any with similar markings, and also invited Bellingcat readers to contribute to our Checkdesk investigation into the launchers by sending us any images of Buk missile launchers they might have come across. As of yet, we’ve not found any with similar markings, but one eagle-eyed reader found a detail that we had previously overlooked.

Mark Brown noted the following on Twitter

@Brown_Moses have just sent some more info of the BUK that iv worked on 3*2.2 pics here damage2 sideskirt identical pic.twitter.com/nhX6Fm9xdk — mark brown (@mark24823687) September 22, 2014

As he notes in his tweets, the side skirt of the Buk in both photographs has been damaged in exactly the same position. The damage is visible under the markings, highlighted in the below image.



We can see here that the side skirt has a dent in it that matches in both images. The likelihood of two different Buks having the same markings and also the same damage seems incredibly unlikely, so this shows that the Buk photographed in Ukraine, travelling through rebel held territory on July 17th, was the same one identified inside Russia in a convoy containing vehicles from the Russian’s 53rd Zrbr “Buk” Brigade based in Kursk.",2014-09-22,More Evidence of Russia Supplying the Buk Linked to the Downing of MH17
2014,9,https://www.bellingcat.com/news/uk-and-europe/2014/09/20/crowdsourced-investigation-was-the-mh17-linked-buk-sighted-in-ukraine-and-russia-unique/,/news/uk-and-europe/2014/09/20/crowdsourced-investigation-was-the-mh17-linked-buk-sighted-in-ukraine-and-russia-unique/,"

On September 8th Bellingcat revealed images and videos posted on social media sites that showed a Buk missile launcher inside Russia with markings that matched those markings seen on the Buk missile launcher linked to the downing of flight MH17 on July 17th.

Part of the investigation involved reviewing footage and photographs of Buk missile launchers sighted in both Ukraine and Russia looking for any other Buk missile launchers that may have had similar markings. During this research we were unable to find markings that matched the Buk seen in both Ukraine and Russia that was linked to the downing of MH17. It also showed that the inconsistent nature of markings on Russian Buks would suggest that the markings were likely to be unique to that Buk.

However, in the interest of thoroughness and openness, we are now creating a crowdsourced investigation of Russian and Ukrainian Buks using Meedan’s Checkdesk. Bellingcat readers are invited to help find images of Buks in Ukraine and Russia so we can have the best idea of what markings are visible on Buk missiles launchers used by both countries, and find other potential matches to the Buk linked to the downing of MH17.

Here’s a couple of examples of what we’re looking at



We invite Bellingcat readers to contribute to the investigation by visiting Bellingcat’s Checkdesk, and contributing links to images of Buk missile launchers in Ukraine and Russia, or to comment below.

This is a great opportunity to use crowdsourced investigation to verify claims made by Bellingcat that the Buk missile launcher that was used to down MH17 came from Russia, so we hope you all join us on this investigation.",2014-09-20,Was the MH17 Linked Buk Sighted in Ukraine and Russia Unique?
2014,9,https://www.bellingcat.com/news/africa/2014/09/11/first-of-chads-mig-29-arrives-in-ndjamena/,/news/africa/2014/09/11/first-of-chads-mig-29-arrives-in-ndjamena/,"

Satellite imagery acquired by DigitalGlobe on 03JUL14 shows the arrival of Chad’s first MIG-29 at N’Djamena airbase.

Over the last decade, Chad and Sudan have been engaged in a serious proxy war to support armed opposition groups in their respective countries. This support intensified near the end of 2005. Since then, both countries have attempted to bring the various warring parties back under control—though with little success.

Despite cooler heads prevailing, Chad continued with the acquisition of more advanced aircraft like the MIG-29 multirole fighter, especially since neighboring Sudan had already acquired the platform from Belarus in mid-2008. (Sudan’s MIG-29 can be observed on imagery at the Wadi Sayedna air base where they were recently joined by three Su-24 ground attack aircraft, also delivered by Belarus.)

News of Chad’s pending MIG-29 acquisition surfaced in April 2009 when President Idriss Deby was quoted by the Chadian website Tchadactuel:

“No African country except Egypt, Nigeria, and South Africa has the weapons that Chad has today. In addition to what I have today, I am trying to acquire others. As I speak, my little brother Umar Deby, accompanied by the chief-of-staff of the air force, is in Ukraine, negotiating the acquisition of three MiG-29s, pilots, mechanics, and ammunition.”

Afterward, little else was heard regarding Chad’s plans – that was until recently.

Oleg Volkov, posting on the plane-spotting website airliners.net in May, showed African watchers their first glimpse of an airborne MIG-29 painted in Chad’s camouflage scheme. Volkov tagged his photo’s location in Lviv, Ukraine suggesting that the Lviv State Aircraft Repair Plant (or LDARZ) overhauled the MIG-29 for export.

Located in western Ukraine, LDARZ is one of country’s oldest aircraft repair plants with services for fourth generation aircraft like the MIG-29 going back to the early 1990s. While it is currently unknown what variant Chad ordered, LDARZ is capable of upgrading the platform to the MU1 (FULCRUM C) standard, a capability it reportedly acquired in 2005.

The MU1 upgrade includes the SN-3307 GPS/GLONASS satellite navigation system, overhauled Klimov RD-33 engines, and an increased aerial targeting range. If the aircraft is the MU1 standard, a small blister should be visible on the aircraft’s spine where technicians would have installed additions to the navigation system. Future handhelds may provide more insight.

In the meantime, satellite imagery indicates the initial aircraft was overhauled by the LDARZ with aircraft in existing inventory. A review of historical imagery over the past couple of years has consistently shown 15 MIG-29 in open storage at the plant. The latest imagery from 06APR14 shows one aircraft missing, suggesting it was in a maintenance hangar or out conducting test flights.

Not surprising, the Stockholm International Peace Research Institute (SIPRI) has consistently ranked Ukraine as one of the 10 largest exporters of major conventional weapons for most of its years since independence.

According to SIPRIs trade registry, Chad’s air force had already received six Su-25 (Frogfoot) ground attack aircraft from Ukraine between 2008 and 2010. Imagery from 03JUL14 confirms that they are based at N’Djamena.

Interestingly, imagery from 03JUL14 (image 1) also shows two more Su-25 on the parking apron at N’Djamena. With the platform often deployed out to Abeche (image 3), it is unclear who delivered the additional aircraft and when they arrived—though Ukraine may be a possible candidate. [1] Luckily for us, the new Su-25 have a different color camouflage scheme than those previously sent, making them easy to track.

Imagery first captured these aircraft on Google Earth back in September 2013. [2] A further dig into historical imagery has shown up to four Su-25 with this different camo pattern, suggesting that Chad now has up to 10 of the aircraft. At least two are known to be the UB trainer variant delivered from Ukraine in 2008.

While some things are still fuzzy regarding Chad’s arms acquisitions, one thing is becoming increasingly clear: Chad is one of those growing African countries always looking to acquire more advanced military equipment. While the utility to which that equipment can be employed is questionable, Chad appears to be reacting to a regional arms race dynamic that shows no signs of slowing.

Notes:

[1] The Evpatoria Aircraft Repair Plant located in the Crimea had not been taken over by Russia at the time of initially delivery.

[2] Historical imagery from June 2013 did not show any additional Su-25.",2014-09-11,First of Chad’s MIG-29 Arrives In N’Djamena
2014,9,https://www.bellingcat.com/news/uk-and-europe/2014/09/08/images-show-the-buk-that-downed-flight-mh17-inside-russia-controlled-by-russian-troops/,/news/uk-and-europe/2014/09/08/images-show-the-buk-that-downed-flight-mh17-inside-russia-controlled-by-russian-troops/,"

New evidence has been found that shows the Buk missile system that was used to shoot down MH17 on the 17th of July came from Russia, and was most likely operated by Russian soldiers. Using videos posted by locals in Russia’s Belgorod region back in June it has been possible to identify the Buk missile launcher seen in Ukraine on July 17th as part of a convoy of Buk missile launchers. It has also been possible to identify the Russian brigade the Buk is likely to have belonged to, and who may have operated the Buk missile launcher when it was in Ukraine.

The Buk launcher can be identified because of a number of features, including white markings on the left side side of its chassis, and what looks like the traces of a number that has been painted over. Here is a comparison of the Buk seen in previously unpublicised video taken in Russia on the 23rd of June with a well known image from Paris Match, which shows a Buk in Donetsk at 9am on July the 17th.

Numerous earlier studies of vehicles inside Ukraine has shown it has been standard practice for Russian forces to paint over the numbers on their vehicles before sending them into the Ukraine. In the Paris Match image, much of the remaining number has now been painted over. However, it is still possible to see the top curve of what was a “2” and the other two white marks. It’s important to note that these markings are in exactly the same positions on the Buk in both images.

Here is a comparison of the Paris Match picture with an image of the same Buk in a convoy of Russian military vehicles in Alexeyevka, a town around 70 miles from Staryy Oskol, on the 24th of June.

The above image also shows the matching marks on the left side of the Buk. It’s also possible to confirm that this is the same Buk by looking at the other side of the vehicle. The Buk seen moving back to the Russian border on the 17th has a white patch on the armoured skirt of its right side. This patch is also visible in a video filmed around Staryy Oskol in Russia, which was uploaded on the 23rd of June.

The videos of the convoy of Russian vehicles in June shows a number of Buks are part of the convoy. However, keeping track of the one with with the markings that match those seen in Ukraine in July is simple, as only three Buks in the column do not have railings on the back of their turrets.

Here is an image to illustrate what these railing look like, and what the Buk looks like without them; the top image is one of the systems seen in the Alexeyevka video, on the bottom is an image of the Buk that is suspected of being used to shoot down MH17, filmed in Staryy Oskol.

Out of the Buk launchers in the column filmed in Russia in late June, three are without railings on back of the turret. Two out of these three have identification numbers on the side; number 231 and 232. Buk number 231 can be ruled out as the Buk in the July videos and photos has completely different markings on its right side and does not have a patch of white on its right skirt.

The below images show that the Buk that was filmed in Luhansk after the attack does not have the railings on the back of its turret.

The Buk that had been seen in the Staryy Oskol area in June has marks on both sides that match those seen on the Buk before and after the attack on July 17th. Just like the Buk linked to the attack on MH17, it does not have railings on the back of its turret, and the back section of its turret is also a dark colour that matches what we can see in the photograph in Torez. The vehicle is also distinctive, for instance, it is the only one to have that distinct set of markings out of the entire column of vehicles that was seen in late June.

Furthermore, the fact that it was heading towards the Ukranian border in the weeks prior to the attack on the airliner means that it is possible to conclude that the Buk seen in Russia was the Buk that was smuggled into Ukraine and used to shoot down MH17.

It’s also possible to determine which Russian unit the Buk is likely to belong to by examining the vehicles in the column. The videos of the convoy travelling to Ukraine show that the vehicles have area code “50” on their registration plates, which indicates that they belong to the Moscovskiy Voenniy Okrug (MVO) or the Moscow Military District.

The area code “50” is visible on the registration plates of the vehicles in a video taken in the Krasneyskiy area on the morning of the 24th of June.

The dashcam recording appears to have a time/date stamp error and reads “2011.01.01”. This is clearly wrong for numerous reasons, including the summer weather in the video is radically different from the Staryy Oskol area in wintertime and the exact same vehicles are visible in multiple videos; see the white minibus here here and here at 0:54.

A resident of Staryy Oskol also confirmed that the registration numbers on the vehicles in the convoy had the “50” code. The user rokerrson posted on instagram on the 23rd of June:

This evening, a column of military hardware passed through our city, which included, mobile RLS [radar], ZRK [air defense missile system] Buk (if correctly identified), a bunch of tented Urals and other vehicles, generally around 80-100 units in total, including a field kitchen and refueling trucks. Presumably, these are troops of the CVO [Central Military District] on exercises and they moved in the direction of the Ukrainian border with the Belgorod region.

Later, the poster added the following: “correction with the CVO… vehicles with Moscow numbers (50 rus)”.

The Moscow Military District has two anti-aircraft missile brigades that are specially outfitted with Buk systems. These are the 5th Zrbr “Buk”, which is based in Shuya and the 53rd Zrbr “Buk” which is based in Kursk. The 5th brigade can be ruled out because according to multiple sources it has been moved out of the Moscow Military District and into the Western Military District, and is now head-quartered in St Petersburg, where it uses the “43” area code on its vehicles.

As Kursk is relatively close to Staryy Oskol it makes sense that the convoy was comprised of the 53rd brigade and departed from its base at V/Ch (Military Unit) 32406. This is also confirmed by the earliest video of the convoy, taken during in the morning or afternoon of the 23rd June, which shows the vehicles driving away from Kursk and in the direction of Kharkiv. It is therefore likely that the Buk belongs to the 53rd brigade from Kursk.

Moreover, it also appears the 53rd “Buk” brigade not only uses the “50” area code on their registration plates, but their troops have uploaded pictures of some of the same vehicles that can been seen in the videos taken around Staryy Oskol. Here are two photos of a the same truck, the first image is from the video in the Krasneyskiy area and the second was uploaded by Ivan Krasnoproshin who serves in the 53rd brigade.

Here are pictures of a Buk Snow Drift Radar unit. The first was uploaded by Kranoproshin in 2013 and the second is from the video of the convoy in Alexeyevka.

The following picture shows Krasnoproshin at the headquarters of military unit 32406, note the missiles in background which are displayed for show on the parade ground.

The following image shows the parade ground of the 53rd brigade from above, the same missiles are visible on the south side of the parade ground.

The following is a satellite view of the 53rd brigade’s vehicle park

This image suggests that the large number of vehicles seen in the column in June probably came from the 53rd brigade. The brigade itself is part of the Russian Protivo Vozdushnaya Oborona (PVO), or Anti-Aircraft Defense troops. As a unit specially supplied and trained to use the Buk, the 53rd brigade had both the ability and the means to shoot down MH17 on July the 17th.

The Buk that was seen leaving the suspected area of the missile launch on the 17th of July most likely belonged to and was manned by Russian troops from the 53rd Kursk Brigade. The new information presented in this article adds to the existing evidence that the Russian government bears responsibility for the tragedy.",2014-09-08,"Images Show the Buk that Downed Flight MH17, Inside Russia, Controlled by Russian Troops"
2014,9,https://www.bellingcat.com/news/mena/2014/09/05/predator-drone-reportedly-sighted-circling-raqqa-syria/,/news/mena/2014/09/05/predator-drone-reportedly-sighted-circling-raqqa-syria/,"

The United States appears to now be flying unarmed surveillance drones over the IS stronghold of Raqqa, Syria. The pictures thus far suggest that the drone being used is the Predator. The two photos show the distinct downward facing V-shaped tail used on Predator drones, and the aircraft does not appear to be carrying any missiles. As such, the available evidence indicates that the drone is being used for surveillance purposes, rather than in a hunter-killer type mission.

According to local activists, the drone has been circling over the city for three hours. If the reports are true, this would suggest that the air environment over Raqqa is permissive. Drones are visible on radar and easy to shoot down with air defense systems. The evidence thus far suggests that the drone is acquiring imagery – and possibly signals intelligence (SIGINT) – of Islamic State positions in the group’s most important stronghold. There is little doubt that this mission is intended to give US policymakers more information about IS positions in Raqqa. However, it does not necessarily signal the imminent use of force against IS positions in Syria.

As of now, there is no information about where the drones are based. However, open-source information allows for some informed guesses. The United States currently bases Predator drones in Turkey at Incirlik Air Force Base. The three drones are routinely flown over Northern Iraq and data is shared in real time with the Turkish military.

A second option could be that the drones are being flown from Kuwait. Satellite imagery captured the deployment of US drones at Ali Salem Air Base.

A third option is that the United States is now flying drones from an airbase in Iraqi Kurdistan.

Update A regional security expert reports Predator drones were seen operating in the civilian airport near Erbil.",2014-09-05,"Predator Drone Reportedly Sighted Circling Raqqa, Syria"
2015,1,https://www.bellingcat.com/news/uk-and-europe/2015/01/28/a-reconstruction-of-clashes-in-mariupol-ukraine-9-may-2014/,/news/uk-and-europe/2015/01/28/a-reconstruction-of-clashes-in-mariupol-ukraine-9-may-2014/,"

On 9 May 2014, the center of the Ukrainian city Mariupol was the site of violent clashes between anti-government activists and the Ukrainian army. More than 200 recordings of the events were uploaded onto YouTube by anonymous protestors, often in an attempt to prove that soldiers used excessive force. In this article, I’ll use these videos to reconstruct the course of events that day. In doing so, I will show why it’s important to scrutinize video content with a critical eye.

This report is split into four sections. The first section examines the outbreak of the clashes, the arrival of Ukrainian forces, and shootings near theater square. The second section discusses some of the clashes’ key figures. The third section examines renewed clashes at the city’s police headquarters and the subsequent retreat of Ukrainian forces. The final section lists and discusses the known casualties.

Background

The city of Mariupol had already seen outbreaks of violence before the events in Mariupol on 9 May. Pro-Russian activists of the Donetsk People’s Republic (DPR) had occupied the city council building since 18 March. In the evening of 13 April a large crowd, many of them dressed in camouflage and wearing masks, stormed military unit 3057 using Molotov cocktails. The military responded with warning shots and then by shooting at the legs of the attackers. The confrontation ended with three activists killed and 16 injured. In one of their reports, the Memorial Human Rights Center held the attackers responsible for the deaths and injuries during the confrontation. Nonetheless, pro-Russian activists used the incident to spread rumors of a “massacre” by Ukrainian forces. On 7 May, two days before the Mariupol clashes, small confrontations between protestors and Ukrainian forces occurred throughout the city. Ukrainian forces were able to retake the city council building with the help of tear gas, but the next day it was overrun once more by the DPR activists. According to Memorial, no one was seriously injured, but rumors again began to spread alleging that Ukrainian forces had shot civilians.

In the former Soviet republics, 9 May is known as Victory Day – a holiday commemorating the capitulation of Nazi Germany. This day coincided with Vladimir Putin’s first-time visit to the recently annexed Crimea. Since the Donbass region had a significant amount of pro-Russian sentiment, it was expected that the Donbass region would have pro-Russian rallies. Indeed, just two days later, a separatist referendum on the status of Donbass was planned.

Section One: The separatist attack (10:00–11:00 AM)

At 10:00 AM local time hundreds of residents began marching through the center of Mariupol in honor of Victory Day. Pro-Russian slogans and calls for the referendum made it clear that it was more than just a Victory Day celebration. Several policemen could be seen marching along, showing Kiev was beginning to lose its grip.

Initially there were no signs of unrest, but soon a video was uploaded showing a small confrontation in front of military unit 3057. The video captures a small group of men unsuccessfully attempting to block National Guard forces from leaving their base:

Another video of the same event shows warning shots being fired. One person was wounded during the confrontation but was able to walk away with the help of others:

The confrontation may have been related to the outbreak of clashes at the police headquarters. Here, a meeting of the heads of law enforcement agencies was interrupted when the building was attacked by a group of armed men. Official estimates of their strength range from 15 to 60. According to Memorial, these militants attacked shortly after 10:00 AM without wearing visible insignia. Intensive shooting was heard from inside the building, and the armed men managed to occupy the first two floors of the building. The meeting members barricaded themselves on the third floor and called for reinforcement. In response, units of the National Guard headed toward the scene. The first troops to arrive were members of the infamous Azov Battalion. The battalion’s deputy commander stated that his unit consisted of 10 fighters. They were dressed in plainclothes. Considering that Azov fighters normally wear uniforms, they were most likely unprepared for the separatist attack. The Azov fighters entered the police headquarters and managed to secure the first floor of the building.

While the armed separatists held the second floor and besieged meeting members continued to maintain their barricade on the third floor, additional forces from Ukraine’s National Guard began to arrive. Due to a lack of coordination, the National Guard didn’t know how to distinguish between friends and foes; they arrested three members of Azov and Mariupol’s head of the Security Service of Ukraine (SBU).

The separatist attacked went unnoticed by most residents, as the police headquarters was not close to the Victory Day march. The fighting did, however, cause rumors to spread that Ukrainian forces were attacking policemen because they had chosen to side with the DPR. This was later also alleged by the leader of the Ukrainian Communist Party, Petro Symonenko, who stated that the policemen refused to carry out orders to disperse a pro-Russian rally. This version of events still remains popular on the Internet and in pro-Russian circles. Evidence to the contrary appeared in the form of anonymously taken photographs depicting the separatist militants in action, which were posted on a pro-Kiev social networking website:

These photographs show eight plainclothes men in front of the police headquarters, some of them armed with automatic rifles. Since no damage to the buildings can be seen, it’s clear that these were taken in the morning before the fighting. Some of the attackers were later identified on social networking sites as citizens from Mariupol.

Entry of the Ukrainian military (11:15 AM)

At approximately 11:15 AM, the first armored personnel carriers (APC) from Ukraine’s 72nd Guards Mechanized Brigade drove into Mariupol. They drove on Lenin Prospekt (Lenin Avenue) in the direction of Mariupol’s theater. The time of their arrival is based on webcam footage filmed at the intersection of Lenin Prospekt and Metalurhiv Prospekt, which showed the first two APCs (numbered 240 and 241) passing at about 11:25 AM. Their arrival was delayed because, just prior, one of the APCs had crashed into a billboard. Some commentators suggested that the APC deliberately knocked over the billboard because it may have advertised the Donbass referendum. It seems more likely that the APC had mechanical issues, since later that day the same APC (240) was abandoned due to engine failure. Residents by this time had begun recording clashes between soldiers and protestors. To reconstruct what happened, I will use the following video as a reference point:

Video 1 (1st part) – Duration: 39m19s (2nd part is here).

Based on the webcam footage, this video starts just before 11:25 AM, which allows us to understand how the standoff began. The beginning of the video shows APCs driving eastward on Lenin Prospekt. An angry crowd of about a hundred people gathers at the crossing with Ulitsa Kazantseva (Kazantseva Street). This crossing is near the city council building – the headquarters of Mariupol’s separatist movement. Some of the protestors throw rocks and tires and manage to block one of the APCs by forming a human chain. One of the activists climbs on top and tries to cover the vehicle’s sights. Two warning shots are fired from within the APC, and eventually it manages to pass. One protestor receives a wound to the head from a brick thrown at the APC, which can be seen at 3m39s.

As the cameraman runs after the APCs, distant firefights are already audible in the background. Ukrainian soldiers can be seen covering the northwestern and southwestern corners of Ulitsa Engels in order to secure the crossing of troops coming from the south. The crowd follows but initially keeps its distance. They are then persuaded by advancing protestors to close in on the soldiers. Warning shots are heard, but the crowd ignores them and slowly continues forward.

Injuries near theater square (11:56 AM)

Another injury can be observed at 31m45s, when one of the protestors, who I will call “Victim 1,” can be seen kneeled down on the road. Earlier on, Victim 1 persuaded the crowd to block the APC at Ulitsa Kazantseva and to close in on soldiers covering Ulitsa Engels. This video (Video 3), shows him nagging one of the soldiers at 4m04s. When a new column of APCs passes by, Victim 1 crosses the street. Three shots are then heard, and at 4m24s, a bullet impact next to him shows he’s being shot at:

This video (Video 2) shows how one of the soldiers fires two shots at the ground near the victim’s feet (at 6m40s):

Afterward, bystanders help Victim 1 stand up and assist him toward the sidewalk. Memorial judged Victim 1 to be “heavily intoxicated” and suggested that the shot may have saved his life, as otherwise the APC, driving at high speed, would have hit him. Video 3 shows a wound near his armpit (at 5m47s). Since the soldier aimed downwards, it seems that the victim was struck by a ricocheted bullet. This is a recurring feature throughout this reconstruction; sometimes soldiers seem unaware that shooting at a hardened surface can cause a bullet to ricochet.

As the last soldiers cross Lenin Prospekt, soldiers standing at the northwest corner of Ulitsa Engels fire more warning shots. One of the protestors, wearing a suit and holding an ID-card (Victim 2), moves closer towards the soldiers, and at 32m58s a 7 bullet strikes near his feet. He ignores the warning shots and continues forward, closely approaching one of the soldiers. He is joined by another protestor (Victim 3), who is crawling forward on his knees. The end of Video 2 shows the soldiers consistently signaling them to keep their distance. Warning shots are fired, but the two continue forward. At 34m16s three shots can be heard. After the second shot, Victim 3 drops to the ground and grabs for the left side of his face. He crawls away shortly afterward. Victim 2 also tries to walk away from the scene but drops to the ground due to an injury to his leg. Right after the third shot, a photographer in blue (Victim 4) can also be seen dropping to the ground against a small kiosk:

When Victim 2 and 3 drop, the cameraman can be heard saying “ricochet wounded.” Footage from the aftermath reveals that Victim 2 has a small wound to his left upper leg. It appears that he was either hit by a ricocheted bullet or impact debris from the pavement. Shock probably contributed to his collapse. In this video (Video 5), at 0m30s, Victim 4 can be seen sprinting around the kiosk, while seemingly unaware that a soldier is squatting just around the corner. When another soldier fires a shot the impact of the bullet is clearly visible in front of the photographer:

Since no other shots can be heard, it can be concluded that Victim 4 wasn’t hit by direct fire. Furthermore, Victim 3 doesn’t really appear to be seriously injured; at 34m54s he can already be seen trying to throw a chair at the soldiers. After the shootings, one frame at 36m58s shows that he has a small amount of blood above his left eye.

A stabilized version of the shootings confirms that Victim 4 was most likely hit by a ricocheted bullet or by debris from the bullet’s impact. 46 seconds later he can be seen standing up. The video also shows more clearly what happened to Victim 3: just before he drops, an unknown projectile coming from above can be seen hitting his face. Since the victim had a bruise on his left side, the projectile came from his left hand side. It’s unclear what hit him, but it was certainly too slow for a bullet.

Note: Victim 4 wasn’t Russia Today’s Ruptly stringer Fedor Zavaleykov, as some had reported. Zavaleykov was instead wounded later near the police headquarters. There, under unknown circumstances, he was shot in the stomach but was saved by a bulletproof vest. He was also present in the crowd at Lenin Prospekt; he can be seen in Video 1 at 12m45s (and not yet wearing a bulletproof vest).

Deadly shootout at café Arbat (11:59 AM)

When the three victims are seen dropping to the ground, the crowd becomes bolder and the situation quickly escalates. Just before this happens, a gunman makes his first appearance. In this video he can be seen (at 5m12s) talking to the crowd near the crossing with Ulitsa Engels, and can be heard saying: “look, there/who is walking, [we] must by, fuck, by, inaudible“:

At 5m33s, when the three victims are injured, he grabs for his gun:

Given his location at the time, he didn’t witness firsthand the injuries of the three victims. When part of the crowd begins charging towards the soldiers, the gunman runs with them:

At 34m42s of the main video he aims his revolver toward the soldiers and fires two shots (a protestor can also be seen handing out Molotov cocktails in the same frame):

The shots can also be observed in this video (Video 4) at 2m52s:

A protestor can also be seen shooting a slingshot toward the soldiers shortly thereafter.

After firing the two shots the gunman walks around the kiosk. One of the frames reveals his gun more clearly, which looks like a standard .38 revolver:

Together with the sound of clearly audible gunshots, this proves that Memorial’s assertion that he was firing a stun gun is incorrect.

At 34m50s a victim who is about to become mortally wounded (Victim 6) makes his first appearance; he can be seen running towards the tent outside café Arbat:

Another person, (Victim 5) is seen lying on the ground; at 2m59s, Video 4 shows how he is shot in the leg when he runs toward a soldier with a chair:

At 35m05s two rapid shots can be heard that resemble the earlier shots from the .38 revolver. This is followed by five rapid shots fired by the soldiers. This is when Victim 6 is shot in the head, which is confirmed by graphic footage of him lying in a pool of blood. He has a large wound to the head and another on his right lower leg:

In Video 5 the gunman can be seen firing two shots at the soldiers (at 1m15s) and then quickly ducking behind the crowd. One of the soldiers responds by shooting five times at the crowd. The original video is too shaky to establish how Victim 6 is shot. A stabilized version of this video (originally produced by the Ukraine@War blog), however, shows that the third bullet hits him in the leg and, as he is dropping to the ground, the fourth or fifth bullet hits him in the head.

Video 1 can be used to find out which one of the soldiers fired the shots. Again a stabilized version shows more clearly that one of the soldier fires the shots as he’s walking backwards:

The footage allows us to establish all positions during the shootout:

Judging by the footage and these positions, the soldier who fired the five shots was most likely also the one shot upon by the gunman. After firing his revolver, the gunman hid behind another member of the crowd, using him as a human shield. The soldier noticed someone trying to shoot him, and responded by shooting five bullets at the crowd. Because Victim 6 was only shot at leg height, it can be concluded that the soldier was still aiming at legs, which means that despite being shot at, he still didn’t intend to use lethal force in response.

Note: The Ukraine@War blog made a handy video reconstruction of these shootings with some of the recordings synched together.

After the shootout, the crowd temporarily stops chasing the soldiers. The wounded receive first aid from bystanders and are driven away from the scene. The body of Victim 6 is covered until someone finds out he still has a pulse. With help from the gunman he is carefully lifted into a car and driven away. Later reports stated he didn’t survive (see below for a list of casualties). One more protestor is shot less than one minute after the shootout; it turned out to be the man who previously fired a slingshot. Video 4 shows that he is about to shoot again from just around the corner (at 4m02s), but is stopped by a bullet to the leg. Though this might seem like a disproportional response, it should be taken into account that by now soldiers are wary of a gunman in the crowd.

After the wounded are evacuated, part of the crowd chases the soldiers north toward Ulitsa Varganova (4m6s). The rest of the crowd walks towards the theater square. A large firefight is audible in the background, most likely coming from the police headquarters, which is also where the soldiers are heading to.

Section Two: Tracking the Assailants

The aftermath of the deadly shooting allows us to observe the crowd more carefully. Though most of the crowd seems to be made up of local residents who had participated in the Victory Day march, some of them seem connected to the separatist movement and prepared for clashes. Also, there were two men dressed in military uniforms, but they didn’t appear to be armed. One of the two can be seen chatting at 37m42s; the other, wearing a Spetsnaz jacket, is later present at the police headquarters. In videos from May 10 he can also be seen burning down an abandoned APC in front of the National Council building.

At 36m42s, one of the protestors is clearly identifiable as one of the individuals who had been present at the separatist attack on the police headquarters. There, a photograph of him shows how he helped set up a blockade by placing dumpsters on the road. On Lenin Prospekt he was also dressed in black and wearing the same backpack:

During the protests he was one of the instigators who began closing in on the soldiers. On social networking sites he has been identified as a local resident, but I will continue to refer to him as “the activist with the backpack.” After the shootings, the activist with the backpack also followed the soldiers towards the police headquarters.

The identity of the gunman remains unknown, even though his face is visible in many videos, such as this one recorded later at the police headquarters:

The gunman couldn’t have participated in the assault on the police headquarters, since at the time of the assault he was present at the Victory Day parade. In this video, taken shortly after 10:00 AM, he can be seen as a participant in the Victory Day march (at 4m45s), which started at the theater square:

Several minutes later he can be seen in the webcam footage carrying and using a loudspeaker:

The activists around him waved blue-black flags, which belong to a local charity organization named “Iskrennost” (“Sincerity”). On 23 February, the final day of the Ukrainian revolution, some members of this organization participated in an Anti-Maidan demonstration that turned violent. Mariupol’s community website 0629 described how anti-Maidan protesters, including members of Iskrennost, had confronted a group of Maidan supporters. There, the leader of Iskrennost, Valeriy Onatsky, stated his readiness to take up arms (see this video at 3m15s, 7m14s, and 7m41s). The Maidan supporters left, but one of their activists named Yevgeni Korablyov was beaten by a mob, resulting in injuries to his head, hand and foot.

Several videos and photographs of the February 23 protests show how the gunman was present during these protests, often at the side of Onatsky. He’s visible in several photographs, which were posted on 0629, such as this one (Note: he’s wearing the same shirt as on May 9):

In one video he can be seen aggressively confronting a cameraman of Mariupol TV on Lenin Square, demanding that the cameraman show “only the truth” and threatening to put the camera “up his ass.” Afterwards he ensures the cameraman’s safe passage. Another video shows he was part of the mob that dragged the Maidan activist Korablyov (wearing the yellow-red scarf) on stage. Onatsky was also part of this mob (wearing a flat cap):

Though both act provocative, they also try to prevent the rest of the crowd from assaulting Korablyov and in the end secure a free passage for him.

By browsing through social media accounts related to Iskrennost, I was able to confirm that the gunman is a local resident. There is no evidence, however, linking Iskrennost to the 9 May assault, which means that the gunman may have acted on his own. Furthermore, after the website 0629 had accused Iskrennost of participating in the assault on the police headquarters, Iskrennost posted a message on VK denying any involvement.

Section Three: Clashes at the police headquarters (12:10 PM)

Fighting had intensified after the military arrived at the police headquarters. Heavy gunfire and explosions are audible in the last 15 minutes of Video 1 (2nd Part). This tells us that intensive fighting had occurred from about 12:10 to 12:25 PM. Much of the fighting was not recorded, as most protestors kept their distance. One video, filmed from the south, shows Ukrainian soldiers during the fighting. Another video, filmed from the north, shows one of the soldiers firing an RPG towards the eastern side of the police headquarters. A fire later started inside the police headquarters, but it’s unclear what started it. After the fighting ended, more videos were made by protestors. The deputy commander of Azov later alleged that the operation was muddled because Ukrainian forces were taking sniper fire and because many of the protestors were armed.

To found out what happened, I use the following video as a reference point: Video 6 – Duration: 48m56.

A crowd of protestors is seen standing near Ukrainian soldiers in front of the police headquarters. National Guard forces are also present, most of them in uniform, some in civilian clothes (Azov members). Some of the protestors are clearly recognizable as coming from Lenin Prospekt. These include the gunman and the activist with the backpack. Soldiers can be seen trying to calm the protestors and trying to prevent them from approaching further. At 5m20s, some protestors, including the activist with the backpack, begin charging towards Ukrainian troops, who appear to be taking away a handcuffed person:

This video shows (at 2m29s) that a lot of wrestling occurs after the charge. A single shot of unknown origin can be heard, after which Ukrainian forces begin firing into the air. Part of the crowd runs away.

Afterward, two wounded protestors are seen lying on the ground (at 5m35s and 6m18s). This video shows that one of them is carried away with a leg wound (at 0m35s). Another video shows the other victim receiving first aid (at 3m10s); he has considerable blood loss and some bystanders attempt to quell the bleeding by pinching his leg.

Two minutes after the shooting, soldiers can be seen helping a wounded soldier entering an APC. The soldier is able to walk, but not on his own.

At 11m16s another handcuffed protester can be seen. Judging by his clothes, he was one of the protesters who charged towards the soldiers:

Another interesting video is this recording from a live stream. The video suffers from considerable frame loss, but still reveals something important. It’s apparent from this video that the shooting incident begins at 44m11s, when the cameraman runs away 25 and ducks for cover. Next to him is a man wearing a black leather jacket and for a few seconds an AK magazine is clearly sticking out of his trousers (44m31s), which suggest there was at least one other armed man in the crowd. I have been unable to recognize him in other footage:

Shooting at the Courtyard Gate

After this incident, the main video moves onto Ulitsa Georgiyevskaya, where Ukrainian forces cover the courtyard gate of the police headquarters. At 15m33s, a shot from nearby can be heard, and the Ukrainian forces run for cover. Video 7 helps us understand what happened: right after the shot, the soldiers turn their heads toward one of their comrades who appears to be hit by sniper fire:

As soldiers fire their weapons, the wounded soldier is dragged inside the courtyard and given first aid. This is also seen in this video (video 8) (at 3m33s):

One of the protestors standing nearby is the activist with the backpack, who starts clapping as it happens (see Video 7; 0m30s, Video 6; 15m35,).

According to statements by Ukrainian forces, a sniper was positioned on the upper floor of the polyclinic opposite the police headquarters (other spokespersons alleged there were several snipers). Ukrainian forces claimed that they were later able to neutralize the sniper, who was either killed or captured.

Video 6 further shows a man being held by soldiers at the courtyard gate. At 29m20s a soldier can be seen hitting the man’s legs with his rifle butt, perhaps because of his association with the sniper. A higher quality video shows the captured man more clearly:

The detainee was later identified on social media as a local resident. He appears in the morning photographs as one of the armed men in the separatist assault, which further substantiates that these photographs are genuine:

Escape by Ambulance

When fire trucks arrive, protesters begin smashing the windows of the police headquarters to evacuate those trapped inside. Ukrainian forces continue to cover the courtyard, where they were able to evacuate several civilians and two of their wounded. One more incident was captured in two videos: Five men coming from the eastern side of the police headquarters can be seen rushing toward an ambulance:

As the ambulance takes off, soldiers fire at the ambulance, but are unable to bring the vehicle to a halt:

The ambulance driver was later interviewed, claiming that he drove away three individuals without knowing who they were. After driving as far away as possible they exited his vehicle and ran away. Judging by the speed with which they rushed toward the ambulance, and the fact that they later exited the vehicle, I think it’s safe to assume that the ambulance was simply used by militants to avoid capture.

Dust clouds in the second video suggest that the soldiers aimed at the tires of the ambulance. The last video shows that the ambulance ended up with at least one flat tire and that other parts of the vehicle were hit as well.

Retreat (approximately 13:00 PM)

Eventually Ukrainian forces began their retreat. One large unit of Ukrainian soldiers moved on foot toward military unit 3057, accompanied by a bus. Some of the protestors continued to follow the soldiers, some of them throwing stones at the bus. On Ulitsa Apatova, more people were injured by shootings. This video shows the soldiers firing into the air in an attempt to disperse the protestors. This happens shortly after an object is thrown at the soldiers, which can be seen in several frames (at 3m27s):

The object can be seen lying on the ground shortly after. It could be a bottle, but it’s hard to make out. While the soldiers are firing into the air, a soldier on the left fires two shots toward a protestor who refuses to keep his distance. Another soldier attempts to stop his colleague from firing the second shot, but he’s too late. Both shots land in front of the man, with two dust clouds clearly visible, but once again the hard surface causes the bullets to ricochet:

The man is hit by a ricocheted bullet and quickly suffers from large amount of blood loss. Bystanders immediately attempt to quell the bleeding. Another video (from RT) shows that another protestor was hit in the arm at around the same time.

On Lenin Prospekt, the webcam footage shows the first five APCs leaving the city at 1:03 PM and the last APC at 1:26 PM. In a video recorded at the intersection with Kazantseva Ulitsa, the last four APCs can be seen driving through newly setup barricades at high speed:

The APC numbered 240 didn’t return. Several videos show this vehicle standing still near the eastern end of Lenin Prospekt. Protestors can be seen confronting soldiers who had manned the vehicle. At one point another APC tries to tow the vehicle away, but eventually the vehicle is left behind. Residents begin to loot the vehicle, which causes a rather absurd event: This video shows (at 0m51s) one of the looters accidently firing the vehicle’s gun, resulting in a damaged wall and at least one wounded bystander:

Eventually a truck tows the damaged APC away. In an apparent claim of victory, flags of the DPR are planted on top, and bystanders cheer as the vehicle is towed westward on Lenin Prospekt. The next day, the vehicle is torched by activists in front of the city council building.

Section Four: Casualties

The fighting in Mariupol caused many casualties. The Ukrainian Interior Minister of Internal Affairs, Arsen Avakov, reported the death of one law enforcement officer and said five more were wounded. He further claimed that “at least 20 terrorists” were killed, while the rest had escaped. In addition, Ukraine’s Defense Ministry stated that eight soldiers had been wounded. On 10 May, Anna Neistat of Human Rights Watch (HRW) confirmed that seven people had been killed. She also cited a reliable witness who said no more than 10 people were brought to the morgues. Memorial’s report stated that about 41 wounded individuals were brought to the hospital, one of them being a soldier with a stomach wound who later passed away. On 14 May another body was found inside the police headquarters, which “certainly wasn’t a member of the Mariupol police,” according to the new Mariupol police chief.

The website 0629 collected information on and portraits of those who had been killed. Based on this information and other reports, I´ve been able to list 13 alleged casualties with varying degrees of confidence:

Viktor Sayenko – 41-year-old lieutenant colonel and chief of Mariupol’s traffic police, died during the clashes at the police headquarters. Sayenko was one of the meeting members. After the Ukrainian forces retreated, his body lay in front of the courtyard gate, and was later covered with a blanket. Because rumors had spread that Ukrainian forces that wanted to switch sides attacked policemen the cause of his death was disputed. A report on his funeral in Mariupol indicated that even funeral attendees weren’t sure who was responsible. Now that it’s certain that meeting members were attacked by separatists, Sayenko can be considered a casualty on Kiev’s side of the conflict.

Note: on 10 May a video was posted showing Sayenko discussing anti-terrorist operations with Radical Party leader Oleg Lyashko. This video is now circulating with the suggestion that the video is from 9 May, insinuating that Ukrainian forces had planned an attack on this day. The video, however, was taken before 9 May. We know this because Sayenko received an arm injury during a confrontation with DPR activists at the city council building on 8 May. Photographs of his deceased body show that his arm was bandaged. Since his arm was not yet bandaged in the video with Lyashko, the video was very likely recorded before the 8 May confrontation.

Mikhail Ermolenko – 38-year-old praporshchik of Mariupol’s patrol police, died during the clashes at the police headquarters. Ermolenko was also one of the meeting members.

On 22 June 2014, both Sayenko and Ermolenko were posthumously awarded the Order for Courage (3rd class) by presidential decree. This was celebrated with a procession in Mariupol, which was by that time government controlled.

Sergei Demidenko – 41-year-old professional soldier and deputy commander of the Dnipro Battalion, died during clashes at the police headquarters. Demidenko was one of the meeting members. According to Ukrainian reports, he was killed by sniper fire. Because of burns sustained in the fire, his body had to be identified by DNA.

Oleg Eysmant – 39-year-old mobilized soldier of the Dnipro Battalion, died from sniper fire at the police headquarters. Eysmant was also one of the meeting members. On July 19 Eysmant was also posthumously awarded the Order for Courage (3rd class) by presidential decree.

Rodion Dobromolov – 29-year-old resident of Kiev and member of Azov, died near the police headquarters. According to Ukrainian reports, he was killed by a separatist ambush in the courtyard during Azov’s counterassault. He was shot in his heart through the side of his body. Videos show his body lying behind a truck which closed off Ulitsa Georgiyevskaya during the clashes. One video shows a protestor tries to take off Dobromolov’s Ukrainian armband, but other crowd members stop him.

Bogdan Shlemkevych – 21-year-old resident of Biloberizka and conscript of the National Guard, died near the police headquarters. According to a Ukrainian report, someone in the crowd shot him.

Nikolay Kushnir – 53-year-old resident of Mariupol. According to 0629 he was one of the separatist militants who had attacked the police headquarters. His body was found inside. The last thing he wrote in text message to his relatives was, “I am wounded; we are barricaded in the police department.”

Sergei Drozdov – 32-year-old resident of Talakovka. According to 0629 he was also a separatist militant who was killed inside the police headquarters.

Gennady Zabovsky – 52-year-old resident of Mariupol who died at the police headquarters. According to 0629 he was also one of the separatist militants.

Peter Yeliseyev – 38-year-old resident of Mariupol, died from a gunshot wound to the head during the assault on the police headquarters. His affiliation is still unclear.

Oleg Koloshinskiy – Resident of Mariupol, reported by 0629 to be the man who was shot in the head by a soldier’s bullet in front of café Arbat.

Alexey Vorobyov – 39-year-old citizen from Mariupol. He was killed by a stray bullet to the heart while walking his dog in front of his house, two blocks away from the police headquarters. (Note: Another person named Leonid Vorobyov was also listed as a casualty, but I believe this may have been the same person. Their years of birth are close, and in other reports Alexey’s patronymic is the same as Leonid’s. I also couldn’t find anything more on Leonid).

Garnik Arzumanyan – 45- to 50-year-old Armenian, killed by a “blow” to the head. An Armenian archbishop reported his death, saying that he was unsure about the circumstances surrounding his passing. He further called upon Armenians to remain neutral in the conflict.

In addition to these casualties, the chief of Police, Valery Andruschuk, had been kidnapped by armed separatists during their assault on the police headquarters. He was one of the meeting members. On 12 May, Ukrainian officials reported his release, but stated that he was seriously injured, suffering a traumatic brain injury, broken ribs, and a number of bruises. The attached photograph confirms that he was still wounded upon release. (Note: Andruschuk can also be seen the video with Lyashko.)

Conclusion

The results of this investigation have shown that on 9 May, Ukrainian forces did not arrive in Mariupol to shoot at police officers and peaceful demonstrators. Instead, they were forced to support Ukrainian forces that were trapped and surrounded by separatist militants inside Mariupol’s police headquarters. The separatist attack was deliberately carried out at the start of the Victory Day march in a successful attempt to cause havoc. At least four men were killed on Kiev’s side, and their local police chief was kidnapped. After Ukrainian forces had withdrawn, most of the city remained in hands of the DPR. Nevertheless, Kiev demonstrated that it wouldn’t give up the city without a fight, and on 13 June, Ukrainian forces successfully recaptured the city.

The foregoing reconstruction of events was produced to counter allegations of Ukrainian forces using excessive force. Not surprisingly, Russia Today referred to the events as a “massacre,” but even mainstream news outlets criticized Ukrainian forces. Shaun Walker, writing in The Guardian, contended that “unarmed civilians were shot at by Ukrainian forces” during their retreat. Anna Neistat of HRW wrote, “My preliminary findings suggest that Ukrainian units might indeed have used excessive force near the drama theater, which resulted in deaths and injuries of some unarmed people.” In Memorial’s final report, the organizers of the anti-terrorist operation were held liable for criminal negligence, as they had failed to arm the soldiers with non-lethal material such as stun grenades and tear gas. They further suggested that the protestors were only armed with Molotov cocktails and stun guns.

The available video evidence shows otherwise: at theatre square soldiers received fire from someone who used a hostile crowd as a human shield. Only afterward did soldiers shoot protestors in the legs. Many of the protestors wrongfully believed that they were under attack by Ukrainian forces, which largely exacerbated the standoffs. At the police headquarters, Ukrainian forces were also attacked by some of the protestors, while simultaneously taking sniper fire. Here too the crowd behaved in an overtly hostile manner, and at least two protestors carried firearms. Though the soldiers did seem inexperienced and unaware that bullets could ricochet, they generally restrained themselves, despite operating under very difficult circumstances.",2015-01-28,"A Reconstruction of Clashes in Mariupol, Ukraine, 9 May 2014"
2015,1,https://www.bellingcat.com/news/uk-and-europe/2015/01/27/is-this-the-launch-site-of-the-missile-that-shot-down-flight-mh17/,/news/uk-and-europe/2015/01/27/is-this-the-launch-site-of-the-missile-that-shot-down-flight-mh17/,"

In a previous investigation related to the 17 July 2014 downing of Malaysian Airlines Flight 17 (MH17) in eastern Ukraine, the Bellingcat investigation team provided the origin and movements of a Buk M1 missile launcher filmed and photographed that same day that travelled from Donetsk past Zuhres, through Torez and Snizhne. Before reaching Snizhne, the Buk M1 missile launcher was transported on a red low-loader hauled by a white Volvo truck featuring a telephone number and unique blue stripes. In Snizhne, however, the Buk was unloaded off the hauler and driven south out of Snizhne under its own power. In the early hours of 18 July 2014 the missile launcher was spotted in Luhansk, where it was again being hauled by the same white Volvo truck, but this time it was missing one missile.

The location of the Buk between its last sighting in Snizhne and its appearance in Luhansk the following morning is a vital question that will shed light on the culprits and circumstances of the MH17 tragedy. This report will consider four vital clues that allow us to estimate the launch location for the missile that downed MH17: 1) photographs of a white smoke trail taken a few moments after the crash of flight MH17, 2) visible burn damage to a wheat field that appeared between 16 and 20 July 2014, 3) audio recordings reportedly from 17 July 2014, and 4) a US intelligence satellite image from 22 July 2014.

Two hours after the crash of the MH17, a photograph that showed a vertical white smoke trail and a smaller grey smoke patch to the left of the white smoke trail was posted on Twitter by someone who claimed that this photograph, provided by an anonymous photographer, depicted the launch site of the Buk launcher that downed MH17. A few days later, a number of bloggers geolocated features in the image, including the approximate location of the photographer and an approximate origin point of the white smoke trail. In December, the photographer provided additional photographs, and a Dutch news outlet enlisted the help of outside research experts to review the pictures. They assessed that they were authentic.

On 20 July, 1 August, and 15 August 2014, Google updated its satellite imagery to include images of Snizhne and Torez, revealing suspicious tracks in wheat fields and a part of what seemed to be a burned wheat field with scorched earth south of Snizhne.

On 22 July 2014, US intelligence officials published a blurry black and white satellite image with the flight paths of both MH17 and the Buk M1 missile that downed the passenger plane. Because of the relative low quality of the image, many were disappointed by the declassified intelligence. However, after re-examining this image, it turned out to be far more informative than first thought.

On 24 July 2014, conversations in Snizhne and Torez over the smartphone app Zello recorded at the time of the downing of MH17 were posted on YouTube. One conversation was of a woman recounting that she saw a missile flying overhead while she was in a garden and describing the direction of the missile. In addition, tapped phone conversations on 17 July 2014 between pro-Russian separatists published by the Security Service of Ukraine (SBU) provided information about the destination of the Buk missile launcher on 17 July 2014.

In consideration of all of these clues, this report concludes that the likely missile launch location was in a burned wheat field south of Snizhne.

The Separatists’ Buk Missile Launcher in Snizhne

In Bellingcat’s earlier investigation, “Origin of the Separatists’ Buk,” the Bellingcat investigation team established the route of the Buk on 17 July 2014: Donetsk to Zuhres to Torez to Snizhne and then to Luhansk the following morning. The first of two Snizhne sightings took place in the center of the city, where it was moving under its own power. A photograph taken of the missile launcher was posted on Twitter on 18 July, and after this photograph was taken, a video was shot of the missile launcher driving south through Snizhne. This video was first posted on YouTube on 17 July 2014. Both the picture and the video have been geolocated by Bellingcat and others.

The picture and video raise two important questions: Why was the Buk headed south toward the city limits of Snizhne? And why was the Buk no longer being hauled and instead driving under its own power? From various sources it is apparent that from July until the end of August, an ongoing battle between pro-Russian separatists and the Ukrainian army was taking place south of Snizhne in the villages of Stepanivka, Marynivka, and near the monument hill of Savur-Mohila in Saurivka. The road south of Snizhne (T0522) leads directly to this area, so it is possible that the Buk intended to provide anti-air support in the area. This may shed some light on the second question, as the Buk must be unloaded from the truck in order to fire its missile.

To our knowledge, no other pictures or videos have been made of the Buk M1 missile launcher in this area, and only one other video was posted on YouTube on 18 July 2014 of the missile launcher being hauled again by the white Volvo truck in Luhansk, this time clearly missing one missile.

July 2014 photographs of the white smoke trail

Just three hours after the crash of MH17, a picture was published on Twitter that appeared to show a ropeway on the horizon between “Lutugina” and “Tsof” in the area of Torez, which is close to Snizhne. The image was posted at 7:23 PM local time, three hours after the crash of Flight MH17.

Several claims have been made that assert that the picture was a fabrication of the Security Service of Ukraine (SBU). This is unlikely for the following reasons: The photograph was posted only three hours after the MH17 crash, the general location of the white smoke trail is in the same area where the Buk was seen heading toward when last seen in Snizhne, and the weather matches that of July 17 as demonstrated in subsequent photographs that were released. Additionally, the SBU did not share this photograph until two days later, while, in contrast, the 18 July 2014 Luhansk video was released very quickly by the SBU itself. The photograph did not appear on any official Ukrainian channels before it was posted on Twitter, and the earliest posting of the photograph by a Ukrainian official was by Ministry of Internal Affairs official Anton Gerashchenko on Facebook at 7:45 PM (local time).

On 21 July 2014, the blogger Ukraine@War geolocated the photograph. The Bellingcat investigation team has verified the geolocation, which indicates that the photograph was taken north of Torez in the direction of a mine in eastern Torez. A detailed look at the geolocation of this photograph can be found here.

Dutch news outlet RTL Nieuws conducted an interview with the anonymous photographer of the white smoke trail in December 2014. Along with the interview, RTL Nieuws acquired additional photographs taken right after the original photograph in the same location. Two research organizations, FOX-IT and NIDF, verified the authenticity of the photographs, while two other organizations, NEO and TuDelft (the Technical University in Delft), examined the white smoke trail and geolocated the photographs. The anonymous photographer has given the original photographs, including the memory card holding them, to the official Dutch investigation of the downing of MH17.

Considering the previous geolocation evidence, there can be no doubt that the photographs that claim to show the Buk launch site from 17 July 2014 were taken from northern Torez and show the area of eastern Torez near the Lutugina mine in the direction south of Snizhne.

Authenticity of photographs

There have been many claims that the 17 July 2014 pictures are not genuine, manipulated, or were taken at a different date.

As part of this investigation, Bellingcat contacted the photographer who took the smoke trail images, and provided the images in a RAW image format. To protect the privacy and safety of the photographer, we have decided not to publish anything about the exact file type of the pictures or any other metadata, as it would reveal the type of camera the photographer used. What we will publish is that the second published picture was taken first at 16:25:41 EEST, and the first published picture was taken 7 seconds later at 16:25:48 EEST. According to the photographer, the first picture was taken about 30 seconds after the explosion. Because we know that flight MH17 was hit around 16:20 EEST, the camera’s time stamp was approximately 4 minutes to 4 minutes and 30 seconds ahead of the real time. The metadata (or Exif data) of the original files show that all date and time properties like camera date, digitized date, modified date, and file date show a date of 17 July 2014 and times of 16:25:41 and 16:25:48.

Images in a RAW format can be edited in photo editing software and saved as a different format, like BMP, JPG, PNG, TIFF, etc., but this will always result in a different file date, namely, the date and time the file has been saved after editing. Photo editing software is not able to save files in a RAW format, because this is not a “positive” image format. In addition, because pictures can only be edited by photo editing software, changes to the pictures will always result in modified metadata.

While software capable of saving images in RAW format does exist, it is usually the software of the camera itself and cannot edit images because images in a RAW format first have to be converted to an editable image format (e.g. BMP, JPG, PNG, TIFF). Also, when the file in RAW format is saved, the modified date of the metadata will be changed.

Based on the metadata of the RAW files we received, we can be completely certain that these files are the original files and that the pictures were taken on 17 July 2014 at 16:25:41 EEST and 16:25:48 EEST, according to the date and time set in the camera. Though it is possible to set the camera itself to a different date and time, when we take into account that the first picture was released two hours after the crash, the only scenario where what we see on the pictures is not the launch of the Buk missile that was seen above eastern Torez on 17 July 2014 is that the photographer took a picture of a missile launch on a previous date, and his camera date and time was inadvertently set to 17 July 2014 at 16:25 EEST. The probability of this being the case, of course, is close to zero.

Another interesting detail noted by the Bellingcat investigation team is that, based on the movement of the smoke between the photographs, the smoke was moving toward the east, which corresponds to reports about the wind direction that day. The weather conditions in the photos are also consistent with the weather conditions that day, with clouds visible in the unzoomed photograph. A more detailed examination of the photographs can be found here.

Full-sized, uncompressed copies of the original RAW files can be found here.

The Possible Launch Location

With the smoke photographs geolocated, it was then possible to establish where the smoke was originating from. Early attempts by the person who tweeted the original photograph and the Ukraine@War blog pointed to fields to the south of Snizhne, where the Buk filmed heading out of Snizhne would have had easy access. The following image was created based on Bellingcat’s own geolocation and analysis of the photograph and closely matches the work done previously on Ukraine@War:

On 20 July 2014, social news agency Storyful shared satellite map imagery taken the same day that showed areas south of Snizhne, including the road the Buk missile launcher was filmed heading south on three days earlier and the fields at the end of that road. Track marks in those fields were noted by a number of individuals, including Ukraine@War and Roland Oliphant, a reporter with the Daily Telegraph who visited the area.

Oliphant discovered one field where a corner had been burnt over a wide area. He took a number of photographs, which were subsequently used by the Ukraine@War blog to geolocate the exact location of the field. This geolocation has been reviewed and confirmed by the Bellingcat investigation team and shows a field just south of where the tracks were visible on the 20 July 2014 satellite map imagery.

In the map below, the partly burnt and ploughed area of the field has been highlighted in yellow, and is in line with where the grey smoke was visible on the photographs of the smoke trail, marked with brown lines:

Audio Recordings

Shortly after the downing of Malaysian Airlines Flight 17 (MH17) on July 17th, an audio clip was shared on social media sites claiming to be a recording of civilians near the town of Snizhne discussing the crash on the audio chat application Zello. Zello is a popular service in separatist areas, and this particular recording purports to capture what would be a key discussion about events on July 17th.

The individuals in the video describe both an “upward” missile launch and the crash of MH17. While it is difficult to independently verify the authenticity of the audio, it is possible to compare what is described in the audio with other evidence about the downing of MH17, including the launch location of the missile.

Multiple times throughout the recording, people are heard referring to the location they are in or the location where they can see something happening. Two people talk about KhimMash (Химмаш in Russian), an industrial plant to the north of Snizhne, probably because they saw smoke rising from north of Snizhne. Other locations, like “mine 8” (“Шахта №8”) in the west of Snizhne and “Cheryomushky” (“Черемушки”) next to the KhimMash plant, are also mentioned, but one person describes a missile flying over her while she was in a garden. She says the missile came from the direction of Saurivka, a small village to the south of Snizhne near Stepanivka, where the Savur-Mohyla monument is located. The woman claims that the loud noise of the launch caused her to seek shelter in the basement of her home with her mother. This would seem to indicate the missile was launched relatively close to her house.

The woman describes herself as being in “Oktyabr” (“Октябрь”), which can be found south of Snizhne on the Russian Yandex Maps site:

With some uncertainty, she goes on to describe the direction she believes the missile was launched from, namely, Saurivka, which is south-southeast of her location.

On 18 July, the Security Service of Ukraine (SBU) published another audio recording relevant to identifying the missile launch location. In this conversation, we first hear separatists talking about a Buk M1 surface-to-air missile system and later that the Buk is in Donetsk. We then hear that the Buk was unloaded somewhere and driving under its own power and that the Buk has to be delivered to an area nearby called “Pervomaiskoe.”

A search for this location yielded a “Pervomaiske” near Donetsk, a “Pervomaisk” near Luhansk, a “Pervomaisk” near Mykolaiv, a “Pervomaskyi” near Kharkiv, a “Pervomaiske” near Dnipropetrovsk, a “Pervomaiskyi” to the southeast of Snizhne, and another village north of Snizhne called “Pervomaiske.”

The image below shows the locations mentioned in the audio recordings in relation to the suspected launch site visited by Roland Oliphant:

US Intelligence Satellite Map Imagery

On July 22nd, 2014, US intelligence officials published a black and white satellite map image showing what they claimed to be the path of the Buk missile that downed MH17.

Although the map marks Snizhne as the launch site of the missile, the exact location of the site was not immediately clear due to the quality of the image.

While the quality of the declassified satellite map image is relatively poor, it is nonetheless possible to find the approximate launch site indicated on the map. Certain large geographical features are visible on the satellite map image, and by examining Google Earth satellite map imagery, it is possible to find these same features.

For instance, there is a curved lake and two areas of forest northeast of the location identified as the launch site:

To the southwest, there are a series of small lakes running north to south which match perfectly with what is visible on both sets of satellite map imagery:

Zooming in closer, we can make out other features, including an oddly shaped field just south of the launch location:

The oddly shaped field is a just to the south of the village Chervonyi Zhovten, which is north of the Savur-Mohila monument in Saurivka and slightly west of Stepanivka. Due to the width of the line and the resolution of the US satellite map imagery it is not possible to find the exact location the line originates from, but it appears that it would be very close to the area where the lines below intersect, south of Snizhne:

Based on the image above, the line comes very close to originating from the suspected launch site:

Conclusion

Based on the foregoing information, it seems clear there are a number of pieces of evidence pointing toward one specific location south of Snizhne. Photographs published online two hours after MH17 was shot down point directly to an area that is clearly visible on satellite map imagery, showing a field that was unburnt on 16 July 2014 but visibly burnt only a few days after that date. On 17 July 2014, a Buk missile launcher was filmed only a few kilometres to the north of this site heading south in the direction of the location we have identified. US intelligence also points to the same field, and audio recordings, while difficult to authenticate, also point to roughly the same area.

Taken separately, these pieces of evidence are not particularly compelling. When combined, however, they provide strong support for the assertion that the missile that downed MH17 originated from the potential launch site we have identified.",2015-01-27,Is this the Launch Site of the Missile that Shot Down Flight MH17? A Look at the Claims and Evidence
2015,1,https://www.bellingcat.com/news/uk-and-europe/2015/01/23/were-chemical-weapons-used-in-donetsk-airports-last-stand/,/news/uk-and-europe/2015/01/23/were-chemical-weapons-used-in-donetsk-airports-last-stand/,"

By Jett Goldsmith

Donetsk International Airport in Donetsk, Ukraine, served over 1.1 million passengers in 2013 before it was seized by Russian-backed rebels aligned with the Donetsk People’s Republic (DPR) in May of 2014.

Large outbursts of conflict followed in the coming months, with Ukrainian forces conducting air raids, and both the Ukrainian army and the DPR heavily shelling the area. As of Jan. 22, 2015, after heavy fighting and with few holdouts from Ukrainian forces (somewhat endearingly termed “cyborgs” for their resilience in combat), Donetsk International Airport — although essentially destroyed — is reportedly under complete control of the DPR.

The Cost of Attack

Since Jan. 16, one of the heaviest days for clashes at Donetsk airport between the DPR and Ukrainian forces, conflicting reports have arisen regarding how the DPR managed to seize the airport in its entirety.

The Organization for Security and Cooperation in Europe (OSCE), the world’s largest regional security organization with 57 member states, has been consistently monitoring the situation in Ukraine since early 2014 through its Special Monitoring Mission to Ukraine (SMM). In its most recent report published on Jan. 20, the SMM reported significant shelling in Donetsk over the past several days. Damage to civilian property up to 3km away from the Donetsk city center was observed, with residents in the area citing shelling as the cause for damage.

Multiple other instances of shelling damage in DPR-controlled territory were reported by the SMM. The Ukrainian army and the DPR traded blows for several hours each night, with the SMM noting “approximately 10 outgoing and three incoming artillery rounds” in government-controlled territory north of Donetsk, and “six outgoing artillery rounds” in government-controlled Staronativka, 48km south of Donetsk.

Chemical Agents

Perhaps the most unusual part of the SMM’s Jan. 20 report consists of an interview conducted by SMM members with a Ukrainian soldier hospitalized in government-controlled Konstantinovka, an industrial city 56km north of Donetsk. The soldier stated he was being treated for injuries sustained through combat at Donetsk airport on Jan. 19, and that “80 Ukrainian soldiers in total” had suffered similar injuries, including “uncontrollable muscle spasms, vomiting, difficulty breathing,” and in some cases, loss of consciousness.

These symptoms are consistent with exposure to certain nerve agents and choking agents. Use of nerve agents by either party is unlikely, especially considering the relatively high mortality rate of these chemical weapons along with an absence of fatalities reported among those exposed to the attack. Use of choking agents is more likely – although potentially fatal, the use of these banned weapons often results in a lower mortality rate than their neurological counterparts.

Russia and Ukraine are both signatories of the 1993 Chemical Weapons Convention. Although Ukraine confirmed it had transferred all chemical weapons in its territory to Russia in early 1992 following the collapse of the Soviet Union, Russia still possesses a non-negligible stockpile of various chemical agents. Russia possessed 40,000 metric tons of chemical weapons when the Chemical Weapons Convention was ratified in 1997, of which around 10,000 metric tons remain as of 2013.

Among the chemical weapons possessed by Russia, there are several incidentally significant agents, including:

VR (a Soviet-developed isomer of VX)

Sarin (GB)

Soman (GD)

Phosgene (CG)

Additionally, Russian news agency RT reported in 2012 that Russia still maintained “vast stockpiles” of mustard gas, lewisite, and other chemical agents.

Precursor Attacks

Another instance of alleged chemical munitions use on Donetsk airport prior to the incident on Jan. 19 was reported several days earlier, on Jan. 16, with both sides accusing the other of using chemical munitions. Russian government-owned news agency ITAR-TASS quoted DPR president Alexander Zakharchenko’s accusations of chemical weapons use by Ukrainian forces during a tour of Donetsk airport on the 16th. “After the shells burst, a pungent cloud of gas spread across the old terminal,” Zakharchenko said. “They are firing banned munitions in breach of the Geneva convention.”

ITAR-TASS similarly quoted one of their correspondents, present at the tour of Donetsk airport, as having “felt the impact of chemical substances, which made his eyes tear and caused troubled breathing.”

These accusations may not be unfounded, but are perhaps overblown; the symptoms of this precursor attack are at least partially consistent with those of illegal chemical agents, but they are also consistent with military chemical compounds such as CS gas and other riot control agents.

The use of these agents are permissible for the purposes of riot control, but remain prohibited for warfare. Nonetheless, military chemical compounds – while still dangerous and potentially fatal – are exponentially safer than explicitly prohibited chemical agents, which are designed to cause severe injury and/or death.

The Interpreter, headed by global affairs analyst James Miller and Foreign Policy columnist Michael Weiss, provides a likely debunking of the Jan. 16 attack. According to their Ukraine live blog, reports of a chemical attack were non-lethal and inconsequential:

Last week, on January 16, the Russian state-controlled media reported a possible chemical weapons attack at Donetsk airport. However, Ukrainian soldiers reported the use of a smoke screen, and we were satisfied that the use of smoke grenades accurately matched the reports of the smell of the gas and the symptoms. It seemed like a “non-story.”

Were Chemical Weapons Used?

The question remains as to whether chemical weapons were used, and by whom, on Jan. 19 in Donetsk. It has been established that the use of chemical agents in warfare, regardless of their classification, is prohibited under OPCW regulations. Yet over the past 24 hours, accusations of chemical attacks via reports on Twitter have sprung up in large number from those in the region.

Environmental factors warrant particular consideration. As noted by 22-year CBRN veteran and former United States Army Chemical Officer Dan Kaszeta, melting points are a major factor in chemical weapons use – particularly in Ukraine, which over the past week has seen temperatures ranging from 20-35°F (–7-2°C).

Many chemical agents, including those mentioned above, are most commonly found in liquid form. The melting point of sarin, an unlikely candidate for the attack due to its high fatality rate, is around –69°F (–56°C), while VX dips as low as –60°F (–51°C). Soman and phosgene have melting points as low as –44°F (–42°C) and –198°F (–128°C) respectively. According to Kaszeta, few chemical agents have sufficient vapor pressure to function effectively at Ukrainian winter temperatures, but relatively mild temperatures in Eastern Ukraine over the past several weeks may mean vapor pressure is a non-issue.

Photographic evidence and social media reports may be more convincing. Frequently retweeted and apparently original photos from biased sources in the region show corpses of soldiers with signs possibly indicative of chemical exposure. Additionally, live footage of Donetsk airport broadcast by Russian television station LifeNews on Jan. 22 shows a DPR crate with what appears to be a Russian PMK-1 gas mask on top, and the caption “by the law of knighthood, militia helps UAF out of the rubble.” Respirators do have practical use in a warzone, but the PMK-1 mask broadcast by LifeNews appears to be equipped with a CBRN cartridge, rated specifically to filter chemical, biological, radiological, and nuclear particles.

On Jan. 23, the Ukraine-aligned but independently operated Kyiv Post reported on losses at Donetsk airport. As part of the report, the paper interviewed a wounded Ukrainian soldier who “kept in touch with his comrades fighting at the airport.” The soldier, who chose to remain anonymous due to lack of authorization, detailed use of chemical weapons by DPR forces.

He said the rebels started using grenades with a nerve agent – a prohibited means of warfare – over the last weeks. “If there is vomiting it is definitely a nerve agent. If there is a closed building a person may faint over them,” he said adding that the rebels definitely used such grenades on Jan. 20.

Outside of fiction, nerve agents are typically not weaponized into handheld devices, and certainly not deployed in conflict stricken zones. Phosgene gas, however, is relatively easily weaponized in grenade form, although the Russian military doesn’t have a history of producing chemical grenades. Reports by the Kyiv Post are contentious, but weaponized phosgene with any delivery system fits the description of the unknown agent given by Ukrainian soldiers to Kyiv Post and the OSCE. Symptoms of phosgene exposure, which onset anywhere between 6 and 24 hours after exposure, include difficulty breathing, nausea and vomiting, and blurred vision.

Russia has a history of using chemical weapons in crisis situations. During the 2002 Moscow theater hostage crisis, in which Chechen separatists held hostage 850 civilians in a crowded theater and demanded the withdrawal of Russia from Chechnya, agents from the Russian FSB pumped an unknown chemical substance into the theater and launched a successful raid. 133 of the hostages died due to chemical exposure, largely as a result of Russia’s refusal to disclose the identity of the chemical to health professionals.

The DPR assumes no responsibility for any chemical attack, nor does the Ukrainian government, and it remains that the symptoms described by the hospitalized Ukrainian soldier to OSCE officials could be indicative of other, lesser types of exposure. Inhalation of debris from the shelled airport remains a major contender, as the effects from overexposure to industrial particulates may mirror certain symptoms of chemical exposure.

Several additional factors, unattainable without on-the-ground presence in Ukraine, should be taken into account: ratio of fatalities to injuries, time of symptom onset, and symptom reports from affected soldiers and medics in the area. Without this data it is impossible to conclusively determine whether either party used prohibited chemical agents, and in what context the agents may have been used. Incidental evidence, however, as well as official reports from observer organizations and news media, speak to the possibility of a chemical attack in Eastern Ukraine – a possibility that could have tremendous effects on the Ukrainian conflict as it stands.",2015-01-23,Were Chemical Weapons Used in Donetsk Airport’s Last Stand?
2015,1,https://www.bellingcat.com/news/mena/2015/01/19/growing-pains-accounts-of-localized-resistance-to-isis-rule/,/news/mena/2015/01/19/growing-pains-accounts-of-localized-resistance-to-isis-rule/,"

It’s no secret that ISIS exerts an ironclad grip over its subject populace. Its media wing is willing and eager to document and exhibit its highly idiosyncratic of Islamic law, whether through distributing video footage of accused homosexuals being tossed from rooftops or the execution of suspected spies as performed by a child.

Less immediately evident is the widespread discontent that ISIS faces from residents under its control who are elided from the ISIS media narrative. But while their voices are stifled, activist and social media accounts can play an important role in illuminating the forms of resistance, passive and aggressive, that occur on a regular basis in ISIS territory in a bid to undermine their political hegemony.

Such resistance has taken many forms. Most notably, perhaps, was the abortive uprising of the al-Sheitat tribe in Syria, which resulted in the reported execution of hundreds of its members. Activists continue to find mass graves attributed to the massacre. This harsh repression effectively blunted any further resistance from the tribe, and pro-government social media sources reported that a number of its members have since allied with Syrian military forces in Deir Ezzor, opting to exercise resistance against ISIS in this capacity rather than fight on their own.

The emergence of the White Shroud, an enigmatic Deir Ezzor-based vigilante group, underscores the extent to which anonymous members of the public, perhaps former FSA fighters or Islamists, are willing to pursue coordinated armed struggle against ISIS. While its exact nature and composition is subject to debate, activists have attributed several assassinations of ISIS members to the White Shroud, and men claiming to be members of the group even made a cameo video appearance. Similarly, other attacks have been attributed to members of the mostly Sunni pro-government Ba’ath Battalions, who have a declared presence in Raqqa.

Yet such widely organized violence is not the only way in which locals have attempted to assert their own authority in ISIS-held Syria and beyond. While these actions have required a large degree of planning and tactical cohesion, organic resistance has taken root in some areas. According to activist accounts, residents have used several opportunities to fight back, whether through sudden acts of violence against targets of opportunity or in more indirect and surreptitious ways.

Activist sources converge on the basic details of an encounter in the village of Sbeikhan in mid-December in which local men reportedly killed a number of ISIS fighters. The anti-government Tahrir Syria network reported that a deadly fight erupted after ISIS religious police attempted to apprehend a woman in the village, and a pro-government news site also reported a similar version of the event.

Following the confrontation, Tahrir Syria also reported that several men were executed as punishment. A separate pro-government poster on social media seemed to corroborate basic details of the account a few days later.

A Syrian journalist from Deir Ezzor reached by Bellingcat was able to confirm the violence in Sbeikhan, saying that three ISIS fighters and seven village residents were killed the fighting. The journalist, a member of the DzGraph activist network, said that although ISIS detained a number of men following the incident, it wound up releasing them.

“There was a small deal between the guys from the village and ISIS to release the arrested,” the journalist said. “ISIS was afraid of protests, so they did.”

While he did not verify details of the alleged executions, both his account of ISIS brokering deals with locals, as well as social media accounts from opposition and pro-government sources suggesting a local backlash, illustrates the level to which ISIS authority was briefly called into question, forcing the group to either execute villagers fighting against their religious policing or negotiate with residents to stave off further disruption, or some combination thereof.

Likewise, the journalist said that other forms of more passive resistance are endemic throughout ISIS territory. Parents, he said, find schooling alternatives so their children can continue studying science and other subjects prohibited by ISIS’ austere and religiously focused curriculum. Indeed, in the stridently theocratic world of ISIS jurisprudence, even smoking can be a form of resistance. As the journalist noted, groups of men in Syria have formed secret smoking clubs to keep their habits alive, preferring to stay in their homes and away from the prying eyes of ISIS religious police.

“Now when you walk in the streets you see only kids, girls with scarves and boys with balls. The women don’t leave their houses,” he said. “The number of people hating ISIS is increasing day by day.”

Al Mayadeen, according to the DzGraph member and other activist sources, has become a hotbed of anti-ISIS resistance.

In one notable example, the journalist said, ISIS drafted a mentally ill man from the city and sent him to his death on the frontline against the Syrian military. He added that stories such as this are common, and that a silent protest movement has begun to build momentum within the country’s mosques. Others are reported to be taking more stringent measures.

“Lots of fighters and ex-fighters are preparing themselves for the day they can fight both ISIS and the regime,” he said, noting also that some former FSA members chose to join ISIS as a survival tactic when it consolidated its rule in the area, triggering resentment from locals who believe that ISIS uses the men as cannon fodder.

The journalist also said that several men across Deir Ezzor have claimed to be White Shroud members – if only in a bid to gain arms from outside backers, while others have taken to sporadic hit-and-run attacks against foreign ISIS fighters, especially in Al Mayadeen. He added that a Tunisian and another North African fighter were assassinated by unknown gunmen in recent weeks.

The alleged beheading of an emir in Al Mayadeen– head lopped off, cigarette wedged between his teeth in a morbid display of poetic justice – suggests that the group’s harsh disciplinary measures may come to haunt them. Yet activists from DzGraph and the activist network Deir Ezzor Under Fire contacted by Bellingcat treated the story with caution.

“Reporters inside are saying they didn’t see or hear something like that,” the journalist affiliated with DzGraph said. “It is only the SOHR (Syrian Observatory for Human Rights) who said that.”

Nor are social media accounts of resistance against ISIS limited to Deir Ezzor, since activist groups in other regions have reported similar acts of violent and nonviolent resistance.

ISIS members themselves have also engaged in very limited forms of resistance against the group, most recently brought to attention when ISIS arrested alleged Azeri “ghulat,” or extremists, planning a coup against its upper echelons. Pro-ISIS social media reported the arrests widely after ISIS released a video of the alleged plotters. As preposterous as such a plot seems to both outside observers and undoubtedly to the group’s regional and top-tier leadership, the group’s willingness to broadcast the arrests illustrates that it takes such threats seriously and is willing to acknowledge their existence as a way of asserting superiority and control.

ISIS also exhibited a rare loss of control over its members when revelers flooded Raqqa’s central square in early December to celebrate rumors that the Deir Ezzor air base had fallen. Activists reported swift retribution, alleging that the group quickly rounded up those involved on grounds of inappropriate behavior.

Nor, according to one prominent activist network, has the group been immune from internal fighting within its own ranks.

Activist reports must of course be treated cautiously, since they are not immune to fabrication, exaggeration or inaccuracies. Nevertheless, the aggregate body of reports from a multiplicity of sources, which sometimes have competing interests, suggests a populace striking back. And, despite a concerted ISIS propaganda campaign to paint life under its rule in a highly favorable light, a more in-depth account depicts a society slowly tearing at its seams, barely scraping by as the proclaimed caliphate attempts to govern under sustained airstrikes, counteroffensives and shortages as ISIS police in Raqqa go house-to-house in pursuit of those dodging combat duties.

It remains highly unlikely that burning flags or assassinating muhajireen will trigger a collapse, local or otherwise, of ISIS rule, but these varied reports testify to the level of dissatisfaction expressed by some of its subjects, who appear willing to secretly bend their new overlord’s stringent rules or engage in guerilla attacks, showing how a number of people are pioneering creative and sometimes lethal ways to subvert ISIS rule and reclaim social space on their own terms.",2015-01-19,Growing Pains: Accounts of Localized Resistance to ISIS Rule
2015,1,https://www.bellingcat.com/news/2015/01/19/how-did-american-weapons-end-up-at-donetsk-airport/,/news/2015/01/19/how-did-american-weapons-end-up-at-donetsk-airport/,"

On January 15th, Russian news agency RIA Novosti reported claims by Donetsk People’s Repulic’s (DNR) PM Aleksandr Zakharchenko that American weapons were found from areas of the airport previously occupied by Ukrainian forces. It was specifically claimed that the types of weapons included M-16 assault rifles, machine guns, Browning pistols as well as types of ammunition ‘banned by conventions’. Deputy Eduard Basurin also claimed the weapons were shown to OSCE observers, though RIA Novosti separately reported OSCE observers did not actually visit the airport, a fact which was also noted in the OSCE SMM daily report.

On January 18th, images of these weapons started appearing online. These included a video filmed by Russian LifeNews TV channel.

On the video, M4-family rifles are clearly visible and identifiable. A machine gun is also briefly seen in the video, along with what looks like the cylinder of a multiple grenade launcher (update: likely a Bulgarian ‘Lavina’), and a large case, which seemingly bears the logo of Harris Corporation, a communications equipment manufacturer.

Separately, a picture claiming to be the weapons was also posted on Google+, showing again the same type of M4 rifle, a machine gun, a rifle resembling an M24, a suppressed rifle, and two handguns; Glock- and M1911-style pistols. (Update: later pistol identified as FN 35 GP)

However, on Twitter it was pointed out that Russian troops are not unfamiliar with the M4. During the Russo-Georgian war of 2008, Bushmaster M4 rifles were looted by Russian troops, along with other weapons of Georgia’s army.

Related to the guns looted, a very interesting observation was made in 2010 on American hobbyist forums about the guns being destroyed: Israeli Negev machine guns were among the loot being destroyed.

Going back to the footage from Donetsk, we can actually see that the machine gun handled in the LifeNews video and visible in the photograph bears a strong resemblance to an Israeli Negev.

A nice reference photograph of a Negev can be found on a Russian LiveJournal page’s photo album titled 7-я десантно-штурмовая дивизия, 7th Airborne Assault Division.

A Google search reveals the unit in question is a Russian Airborne (VDV) troops unit based in Novorossiysk, near Crimea, about 300km south of Rostov-on-Don and about 400km from Georgian territory. What is also interesting is that the same picture with the Negev also includes a Bushmaster XM15-E2S, M4-family carbine, as well as a Browning M1911-style pistol.

A separate source yet confirms that the Georgian army also fields the M24 sniper rifle, meaning those could also likely have been part of the loot.

Given DNR’s history of dubious claims, it’s fair to ask how the guns shown by DNR in photos actually ended up at the Donetsk airport. From a military logistics point of view, it makes little sense to provide frontline troops with weaponry where the caliber differs from the one used by the standing army, making resupplies complicated. It’s also quite a coincidence several of the types of weapons identified are known to have been used by the Georgian army, or even in training use with Russian forces still a few years ago.

So, the question remains: which route did the guns actually take to Donetsk – East or West?

You may contribute to this story via the Bellingcat Checkdesk.",2015-01-19,How Did American Weapons End Up at Donetsk Airport?
2015,1,https://www.bellingcat.com/news/uk-and-europe/2015/01/18/unpicking-the-donetsk-peoples-republics-tangled-volnovakha-bus-massacre-narrative/,/news/uk-and-europe/2015/01/18/unpicking-the-donetsk-peoples-republics-tangled-volnovakha-bus-massacre-narrative/,"

At approximately 2:25pm (Kyiv time), a passenger bus near a Ukraine government-controlled checkpoint to the northeast of Volnovakha, Ukraine was attacked, leaving 12 dead and 13 wounded. Soon after, the Ukrainian government and pro-Russian separatist forces blamed each other for this attack: Ukraine accused separatists of firing a Grad rocket from a nearby village towards the checkpoint, accidentally hitting the bus, while separatists levied three different scenarios against the Ukrainian military and nearby forces. This report will examine the initial claims from each side and consider how these claims morphed—or stayed the same—in the days after the attack.

Claims within the first two hours

At 4:09pm (Kyiv time), the “Novorossiya First operative” VKontakte (VK) account posted a message that detailed an attack on a checkpoint near Volnovakha. This account has over 7,000 followers and has made over 4,400 posts, most of which detail attacks launched by separatist forces against Ukraine. The account edited the post soon after it became apparent that a passenger bus was attacked at the site detailed in the declaration of a separatist attack. The edited post can still be seen:

The tweet separatists sent on #Volnovakha about “Ukrop’s roadblock being destroyed” – screenshot via @euromaidan pic.twitter.com/51YeD0eBfa — Myroslava Petsa (@myroslavapetsa) January 13, 2015

“Ukrop (derogatory term for Ukrainian) checkpoint at the exit from Volnovakha to Donetsk has been destroyed, with information received at 3:53pm Kyiv time (4:53pm Moscow time).”

A pro-separatist Twitter user, who often reposts dispatches from separatist groups of ongoing battles, sent out a tweet at 4:17pm (Kyiv time) (eight minutes after the Novorossiya First operative post) with the exact text in the above screenshot. In case the tweet is deleted, an archived copy can be viewed here.

The Ukrainian Interior Ministry immediately accused pro-Russian separatists of conducting an artillery strike from a Grad launcher at the checkpoint outside of Volnovakha, and striking the passenger bus that was traveling from Zlatoustovka to Donetsk. In a Facebook post at 3:06pm (Kyiv time), less than an hour after the attack, a Ukrainian Interior Ministry official of the Donetsk region, Vyacheslav Abroskin, said that:

Thirty minutes ago from the direction of Dokuchayevsk, an artillery strike was carried out by militants on the Ukrainian law enforcement checkpoint in the area of Volnovakha. A direct strike on a passenger bus. As of now, ten people are dead and thirteen are wounded.

The village Dokuchayevsk is located approximately 19km (12mi) northeast of Volnovakha and 30km (19mi) south of Donetsk. This post was later edited to include additional details and a photograph, but the Facebook edit history clearly shows that this vital piece of information—that the strike was conducted from a town to the north-northeast of Volnovakha—was initially included less than an hour after the artillery strike (times in EST).

This claim did not change throughout January 13, the day of the bus attack.

January 13 claims from Donetsk People’s Republic (DNR)

The explanation from the Donetsk People’s Republic (DNR) on how the bus attack occurred changed throughout the day, depending who was providing an account and what time of the day they responded. Soon after the attack, the Donetsk People’s Republic Ministry of Defense gave the following explanation:

An expert of the Ministry of Defense has studied with photograph with detail of the attacked bus and has unequivocally concluded that, judging by the holes, an automatic weapon or machine gun was used to fire at this vehicle at a distance within 50 meters. If we had fired from Grads, as the Ukrainian side claims, then you would not recognize the bus. Shelling from Grads has an entirely different nature of consequences. And the wounded in the bus would not have remained after the shelling of Grads.

Donetsk People’s Republic politician and former chairman Denis Pushilin gave a different account on the day of the attack that did not include automatic weapon fire, instead blaming a rogue Ukrainian battalion:

The Ukrainian battalion ‘Sich’ has been conducting shelling Donetsk from the direction of the village ‘Peski,’ whose leadership has openly declared that the battalion does not obey the official orders of Kyiv. And they actually provide our militia to respond.

Pushilin went as far as to accuse Ukraine of conducting a false flag attack to pin blame on separatist forces:

I don’t rule out the possibility that [the attack] could be the Ukrainian army’s provocation, to attempt to put the blame for what has happened on local militia.

January 15 claims from Donetsk People’s Republic

Two days after the attack (January 15), the “operational-investigative group” of the DNR, which include “representatives of the police, prosecutors, and experts from the DNR Ministry of Defense,” introduced a new scenario for the Volnovakha bus attack. A document received by the Donetsk News Agency (DAN) describes how a MON-50 anti-personnel mine was responsible for the deaths on the bus:

The nature of the damage in the body of the bus based on the scattering of fragments, the height of their entry, and the diameter of the holes concludes that the striking [of the bus] came from a staff engineered explosive (directional) of the MON type, in service with the combined arms units of the armed forces of Ukraine.

Additionally, the report declares that along with a MON-50 explosion, “with a high probability, the bus came under fire from small arms using the 7.62mm caliber (AKM). This report from the DNR refutes that the bus was hit by a Grad rocket, explaining that (selected among a longer list):

The bus did not exhibit signs of “thermal shock” that would occur after a Grad attack, citing a bus that was completely destroyed in a Grad attack in Luhansk in summer 2014.

No fragments of a Grad rocket were found near the attack site.

A Ukrainian soldier was holding a MON-50 claymore in his right hand soon after the attack.

The nearest Grad crater to the bus was 300 meters away.

The report concludes that:

The destruction of the bus was carried out straightforwardly at the checkpoint by Ukrainian troops with a directional landmine and staff small fire arms of the 7.62mm caliber. The most likely cause of the deliberate landmine blasts and the subsequent firing at the bus by Ukrainian servicemen could be due to incorrect actions of the driver (not stopping the bus for inspection) being regarded as an attempt to break through the checkpoint.

OSCE findings and response

On January 14, the OSCE (Organization for Security and Co-operation in Europe) released its initial “spot report” of the scene of the Volnovakha bus attack. Their findings corroborated Ukraine’s initial claim and contradicted all of the DNR’s claims except for the possibility of a “rogue” Ukrainian artillery battalion

The bus had shrapnel damage consistent with a nearby rocket impact, estimated by the SMM to be 12-15 meters from the side of the bus.

On January 17, the OSCE released its findings from conducting crater trajectory analysis, which determines the origin direction of the rockets that were fired towards the Volnovakha checkpoint. This claim further bolstered Ukraine’s initial claims and contradicted all of the DNR’s claims, barring the possibility of a “rogue” Ukrainian artillery battalion operating from separatist-controlled territory in the north-northeast:

The SMM conducted a comprehensive inspection, focusing on five craters caused by explosions that had occurred during the incident. The investigation included comprehensive crater analysis of two specific blast craters, including the crater located 10 metres from the side of the passenger bus. In the SMM’s assessment all craters examined were caused by rockets fired from a north-north-eastern direction.

Andrei Kelin, Russia’s representative to the OSCE, released a statement that claiming that the findings of the OSCE contradict Ukraine’s claim:

The [OSCE] observers established that the firing came from a Grad, but from the north. This refutes the previously hypothesis that was sounded by Kyiv and taken up in Washington, that the militia fired from the east.

It is worrying that the Russian representative to an organization that takes a guiding role in monitoring the movement—which heavily relies on the cardinal directions of north, east, west, and south—of soldiers is unable to tell the difference between “north,” “north-northeast,” and “east.” For reference, below is a map marking the site of the attack (blue bus) and the general area of the suspected firing site (red warning sign), along with a compass showing north, north-northeast, northeast, and so on.

Since the morning of January 13, Ukraine has pushed a single narrative: a Grad rocket strike conducted by pro-Russian separatists from town of Dokuchayevsk caused the tragedy outside of Volnovakha. The Donetsk People’s Republic has maintained three narratives, sometimes combining them beyond the point of comprehension (a mine explosion, followed by a Ukrainian soldier firing an AK-47 into the bus, followed by a false flag artillery strike). Russia has not formally offered a scenario, but state-controlled media has clearly come out against the Ukrainian narrative, evidenced by their interview of a fake victim on Vesti on January 14 that supported the mine theory. The closest thing to an official Kremlin narrative has come from the Russian OSCE representative, Andrei Kelin, which left much to be desired in confirming the details of the attack. The Russian OSCE representative’s assertion that Ukraine claimed that the strike came from the east originates either from astonishing incompetence or willful deceit.",2015-01-18,Unpicking the Donetsk People’s Republic's Tangled Volnovakha Bus Massacre Narrative
2015,1,https://www.bellingcat.com/news/uk-and-europe/2015/01/17/new-images-of-the-mh17-buk-missile-launcher-in-ukraine-and-russia/,/news/uk-and-europe/2015/01/17/new-images-of-the-mh17-buk-missile-launcher-in-ukraine-and-russia/,"

Following the Bellingcat report Origin of the Separatists’ Buk, which showed that the Buk missile launcher linked to the downing of MH17 was filmed inside Russia a few weeks earlier, the Bellingcat investigation team has continued to search for additional information, and has recently discovered two more images of the Buk missile launcher linked to the downing of MH17.

The first image is one that appeared recently in the print edition of Der Spiegel, which was part of their joint investigation with Correct!v into the downing of MH17, which included visiting the same sites Bellingcat identified as being part of the route the MH17 linked Buk missile launcher travelled along on July 17th. This image shows the Buk missile launcher travelling through separatist controlled Donetsk on the morning of July 17th:

This image, provided by and reproduced with the permission of Paris Match, is the second of two images of the MH17 linked Buk missile launcher taken in Donestk, the first of which was published in Paris Match on July 25th. Here we can see much more of the Buk missile launcher, including the netting covering the rear of the Buk that was also visible in the photograph of the Buk missile launcher taken in Torez on July 17th:

More importantly, details on the Buk yet again confirms this is the same Buk missile launcher filmed inside Russia in June. In the Bellingcat investigation Origin of the Separatists’ Buk the damage on the rubber side skirts of Buk missile launchers seen in Ukraine and Russia was examined and a match was found between the MH17 linked Buk missile launcher and a Buk filmed inside Russia referred to as Buk 3×2

However, in the original Paris Match photograph that was used to compare the side skirt damage the right-hand side of the side skirt was not visible. In this newly published photograph that area is visible, and it continues to match the side skirt damage seen on Buk 3×2 inside Russia. On the exhaust slot on the right-hand side there’s also a black mark visible above the exhaust that’s also visible in the new Paris Match photographer. The following video shows the matching features:

While it’s reasonable to assume some of these exhaust marks might be removed in a short period of time, it seems unlikely that they would build up in a few weeks without very heavy use, and the fact this is another element that matches between images of the Buk missile launcher in Ukraine and Russia cannot be dismissed as a mere coincidence.

The second images uncovered by the Bellingcat investigation team is a new image of Buk 3×2 inside Russia, posted on VK.com in June to a page used by locals in the town of Alexeevka, southeast of Stary Oskol:

The time and location the photograph was taken fits with the route Bellingcat identified as travelled by the convoy containing Buk 3×2 towards the Ukrainian border in late June. In the earlier Bellingcat report it was noted there was a discrepancy between the comparison of the rubber side skirt of the Buk featured in the Paris Match photograph and the side skirt of Buk 3×2. This was a result of the skewing of the Paris Match image not being able to be correctly adjusted to take into account surfaces that were not flat, and we identified this discrepancy as being the result of major damage to the rubber side skirt:

What was particularly interesting about this damage is it seems while most rubber side skirts we examined on Buks from Ukraine and Russia had various dents, this level of damage is extremely rare, and this new photograph shows how severe the damage is to the rubber side skirt:

Both of these new images, as well as the Correct!v investigation supports the earlier findings of the Bellingcat report Origin of the Separatists’ Buk that a Russian provided Buk missile launcher was filmed travelling through separatists held territory towards the alleged launch location of the missile that shot down flight MH17.",2015-01-17,New Images of the MH17 Buk Missile Launcher in Ukraine and Russia
2015,1,https://www.bellingcat.com/news/mena/2015/01/16/the-syrian-arab-air-force-beware-of-its-wings/,/news/mena/2015/01/16/the-syrian-arab-air-force-beware-of-its-wings/,"

To everyone’s surprise, the Syrian Arab Air Force (SyAAF), often incorrectly abbreviated to SAF or SAAF, has been able to maintain a high pace of operations in the now almost four-year long war. Orginally destined to engage in a fierce but short war with Israel, it never anticipated to fight what is essentially a war of attrition between the Assad-led party and its adversaries, and has found its role in the conflict through trial and error. The SyAAF saw a large part of its aircraft and helicopters upgraded in the Ukraine and Russia before and during the Syrian Civil War, and as all aircraft were safely returned, the SyAAF has been able to enjoy a “fresh start”.

Apart from some negligible combat missions in the early days of the revolution, it was only in the end of July 2012 that the SyAAF became actively involved in suppressing the rebellion. This was done mostly by deploying L-39ZAs on bombing runs over Aleppo and its suburbs. These sorties resulted mostly in civilian targets such as hospitals and schools being hit, and unsurprisingly led to numerous civilian casualties. The months that followed saw MiG-21s, MiG-23BNs, Su-22s and a limited number of Su-24s also joining the fray, leading to a far increased amount of sorties throughout the country. The number of L-39 sorties gradually decreased over time however, and completely came to a halt in May 2013.

The first setback occurred on the 25th of November 2012, when Majr as-Sultan heliport was overrun, resulting in the capture and destruction of five Mi-8/17s. This was followed by the fall of Taftanaz on the 11th of January 2013, which saw at least fifteen Mi-8/17s and one Mi-25 being captured or destroyed. Next in line was Kshesh (commonly known as Jirah) on the 12th of February 2013, which apart from more than fifty inoperational MiG-15/17s and L-29s gave the rebels an opportunity to work on establishing their own air force, as at least eight intact L-39s were capture. This opportunity was later utilised by Jaish al-Islam. Dhab’ah (commonly known as Al-Qusayr) was captured on the 18th of April, and although several MiG-21s were found here, all were inoperational. Stocks of air-to-air missiles found here were later used as provisional rockets by the rebels. Abu ad-Duhor was stormed on the 30th of April 2013, but the defenders managed to fence off the assault. This marked a turning point in the rebels’ advances on SyAAF airbases, all of which subsequently came to a halt. Only the already surrounded heliport of Mennegh fell on the 6th of August 2013, where several Mi-8s were captured or destroyed. The latest airbase that fell was Tabqa on the 24th of August 2014. As much as eighteen MiG-21s, ranging from operational examples to piles of scrap, were captured by the Islamic State here. Of these eighteen only three were in operational condition as the few remaining airworthy MiG-21s escaped Tabqa before the base was given up.

As Kshesh and Mennegh were used for the training of fighter pilots and helicopter pilots respectively, their capture greatly hindered the training of future pilots. The complete encirclement of Kweres, the SyAAF’s main training base, made matters only worse for the SyAAF.

Apart from the several aircraft captured or destroyed at their home bases mentioned above, losses during this time were limited to five MiG-21s, two MiG-23s, one Su-24M2, two L-39s and six Mi-8/17s. And although these losses would gradually increase over time, they failed to hurt the SyAAF just yet.

Much more worrisome for the SyAAF was the increased amount of sorties that had to be undertaken by its fighter-bombers each day. Most of Syria’s MiG-21s date from the early seventies, the MiG-23BNs were all manufactured in the late seventies and the Su-22M-3/M-4 fleet dates from the eighties. Apart from the Su-22M-4, all were nearing the end of their lifecycle and were destined for replacement in this decade. Instead of enjoying their last few years in calmness, these aircraft now found itself at the forefront of the fight.

This was much less of a problem for the now twenty-strong Su-24 fleet, which forms the core of the SyAAF’s fighter-bomber department and are considered to be the pride of the SyAAF. Twenty Su-24MKs were ordered from the Soviet Union in 1988 and delivered in 1990 and one Su-24MK and one Su-24MR were donated by Libya in the mid 1990s.

Just in time to participate in the Civil War, the twenty-one Su-24MKs were upgraded to M2 standard by the 514 ARZ Aircraft Repair Plant in Rzhev in Russia between 2010 and 2013. The M2 upgrade brought the Su-24s on the same standard as the Russian Su-24M2. The upgrade provides for improved targeting, navigation and fire control systems by replacing the plane’s old control systems. The plane was also made compatible with newer versions of the KAB-500/1500 and for Kh-31As, Kh-31Ps, Kh-59s and R-73s, adding to the FAB, OFAB and RBK bombs, Kh-25s, Kh-29Ls, Kh-29Ts, Kh-31s and Kh-58s guided missiles, KAB-500s and KAB-1500s guided bombs, S-24 and S-25 air to ground rockets, rocket pods and R-60 air-to-air missiles already carried.



While the upgrade was supposed to ‘stay below the radar’, 514 ARZ workers publicly speaking about the presence of Syrian Su-24s at this plant, satellite imagery footage of Rzhev showing Syrian Su-24s and an image of a Syrian Su-24 being worked upon on the 514 ARZ’s official website did not work in its favour.

Back to the battered fighter-bomber fleet, which saw its target lists growing while the number of operational airframes continued dwindling. However, the then-imminent collapse of the SyAAF’s fighter-bomber fleet curiously never took place, leading to the conclusion Syria can still count on spare parts from Russia to keep its aircraft operational. This theory is strengthened by the upgrade of MiG-23MLDs, MiG-29SMs, Su-24M2s, Mi-25s and Ka-28s in Russia and the Ukraine (with after-sale support likely to have been included in the deals), the Russian Aircraft Corporation MiG opening an office near Mezze airbase in Damascus, the transition to a more modern maintenance system with help of Russian Aircraft Corporation MiG, the large flow of Russian arms that still reaches Syria every month and the regular sighting of the SyAAF’s Il-76s in Russia. Although in Syrian Air colours, the Il-76s are de-facto under air force command.

SyAAF personnel, along with numerous soldiers and officers of the Syrian Arab Army and Republican Guard, continue their training in Russia. A SyAAF pilot can be seen in front of a Russian MiG-29 below.

The first case of continuing weapon deliveries to the SyAAF became apparent in October 2013, when Mi-25s, MiG-29s and Su-22s employed B-8 rockets pods for the first time. The 80mm S-8 rockets fired from the B-8s already hit the Lebanese village of Arsal in June 2013, which marked the first use of the S-8s by the SyAAF. The Mi-25 and fighter-bomber fleet was until then still armed with UB-32 rocket pods using 57mm S-5 rockets, which lacked the penetration and firepower to destroy housing or personnel in cover.

The presence of B-8 armed MiG-29s usually indicated an absence of larger numbers of the wearing MiG-23BN or Su-22M-3/M-4 fleet, which has to be overhauled regularly in order to keep the aircraft operational. Temporarily grounding large amounts of its fighter-bombers to have them replaced by fighters has become a standard tactic within the SyAAF, and allows for some much needed rest for certain airframes. For example, during November 2014 not a single Su-22 was spotted over Syria, as increasing numbers are temporarily grounded or even completely phased out, as witnessed by the growing Su-22 graveyard at Dmeyr.[1]

This tactic allows the SyAAF to maintain a high number of sorties without putting all the burden on the MiG-23BNs and Su-22M-3/M-4s. Although MiG-29s regularly got involved in replacing some of the fighter-bombers from late 2013, the MiG-29s rarely take part in the Civil War nowadays. Only a few MiG-29s appear to be used to deliver precision-guided munitions (PGMs) throughout Syria.

Instead, the SyAAF’s MiG-23MF and in lesser extent the MiG-23ML and MiG-23MLD fighters began flying air-to-ground sorties over Syria. Mostly armed with two UB-16 and two UB-32 rocket pods, two B-8 rocket pods or iron bombs, they joined the MiG-23BNs and Su-22M-3/M-4s over the Syrian sky. As Syria still operates plenty of MiG-23MFs, MiG-23MLs and MiG-23MLDs, this tactic can easily be continued in the upcoming years.

A part of the MiG-23ML and MiG-23MLD fleet was upgraded in the Ukraine and Russia from 2008 until 2011 or 2012, and all aircraft returned to Syria virtually unnoticed in the same year. While the world was busy trying to stop a freighter carrying three Mi-25s returning from an overhaul in Russia, several batches of MiG-23s, MiG-29s and Su-24s entered Syria without any media attention: tunnel vision and hypocrisy at its finest. One of the MiG-23MLDs (lacking chaff/flare launchers) overhauled abroad can be seen below.

Unknown to many, the MiG-23 fleet was reinforced by some thirty examples in the past few years. Thirty-three MiG-23s, comprimising around thirty MiG-23MLDs and a few MiG-23UBs, were delivered by Belarus to Aleppo IAP/Neyrab airbase in 2008. While at first the intention of the deal was unclear, it soon appeared all were to be overhauled by ‘The Factory’, the SyAAF’s overhaul and maintenance facility at this airbase.

Four MiG-23s were deemed unsuitable for overhaul because of their bad condition and remained at Neyrab, and two of them were struck by TOW ATGMs here.[2] [3] As these aircraft were destined to never fly again, these strikes serve little purpose.

‘The Factory’, as it’s known as within the ranks of the SyAAF, is responsible for overhauling and maintaining the SyAAF’s combat and helicopter fleet. All of Syria’s combat aircraft, except for the Su-24, have been overhauled here. ‘The Factory’ also produces indigenously designed chaff/flare launchers for on the SyAAF’s MiG-21s, MiG-23s and Su-22s. After finishing its overhaul, the aircraft or helicopter in question gets the factory’s logo applied to it. With Neyrab in ATGM range, movement of aircraft is now limited. Two freshly overhauled L-39s were recently destroyed by a TOW missile[4], once again showing the vulnerability of the airbase. While Neyrab even used to overhaul MiG-29s in the past, it is obvious the security situation doesn’t allow the SyAAF’s most advanced aircraft to be maintained here.

Nonetheless, Syria’s MiG-29s have always been heavily reliant on foreign assistance to remain operational. Reportedly, this assistance also included help in solving cracks in the fuselage and wings. A number of MiG-29s also received a new camouflage pattern during overhaul at ‘The Factory’ at Neyrab Airbase. The total number of MiG-29s acquired by Syria in 1988 still remains somewhat of a mystery. The much-reported claim of forty-eight is likely to have been exaggerated, and only twenty-two to twenty-four are actually believed to have been delivered. Although this was enough to equip one squadron, plans for a second squadron with these fighters had to be shelved. Around fifteen to twenty MiG-29s should still be operational with 697 Squadron based at Seen (commonly known as Sayqal). A few planes are permanently detached to T4 (commonly known as Tiyas) airbase.

Russian Aircraft Corporation MiG continues to actively fulfill its contractual agreements with Syria (designated as customer 760). August 2010 saw the delivery of four flight simulators of an unknown type under contract number ‘776041110116’. In a secret agreement fulfilled in 2011 four SyAAF MiG-29B were upgraded to MiG-29SM standard, adding to Syria’s airborne ground attack capabilities. As the MiG-29B uses the 9-12 airframe which differs from the MiG-29SM’s 9-13M airframe, Mikoyan developed a special variant (likely lacking the Gardenia jammer) to suit Syria’s needs, as it did for India with the MiG-29UPG.

The development of this variant cost a total of 531,1 million Russian rubles, as opposed to the 925,7 million rubles used for developing the MiG-29UPG. Mikoyan’s 2011 report containing information about the upgrade was taken down and later re-uploaded with the information about the recipient of this deal, Syria, removed, emphasising the secretive nature of the deal.

The MiG-29SM features many improvements over the MiG-29B, such as an upgraded N-019ME radar, the capability to carry a larger payload and many more smaller upgrades to cockpit displays and navigational and communication systems. Arguably the most important upgrade, considering the MiG-29’s current use in Syria, comes in the form of an expanded arsenal of air-to-ground weaponry, such as the Kh-29T(E), Kh-31A/P missiles and KAB-500-Kr/OD guided bombs. Delivery of these weapons was included in the MiG-29SM contract.

Lastely it enables the aircraft to carry the dreaded R-77 (AA-12 ‘Adder’) air-to-air missile, which poses a considerable threat to foreign aircraft intervening in the conflict. MiG-29s have already been spotted in Syria carrying the AKU-170E launch rails used to carry this missile, as seen in the image below.

Yet another two deals included the repair of Syrian MiG-23MLDs and the transition to a more modern maintenance system. Traditionally, Soviet aircraft have to undergo checks, maintenance and overhauls after a certain amount of time. Certain aircraft components qualified for only a certain amount of time are usually removed during such overhauls. During recent times, a more modern maintenance system came into use, enabling certain components to continue use if deemed to be still in working order after passing a certain amount of time. The Russian Aircraft Corporation MiG aided the SyAAF in transitioning to this more modern maintenance system in 2009. This couldn’t have come at a better time for the SyAAF, as they greatly benefit from this new maintenance system in the Civil War.

This deal, along with the delivery of around thirty Belarussian MiG-23MLDs proves the SyAAF still relies heavily on these aircraft. One of the overhauled ex-Belarusian MiG-23MLDs equipped with chaff/flare launchers can be seen in the image below.

After two L-39s were struck at Meyrab air base, at least one L-39 was deployed to Deir ez-Zor where it took part in the counter-offensive against the Islamic State. As the L-39s are easy to operate and maintain, they can be easily deployed throughout Syria. The L-39 seen below was also recently overhauled at ‘The Factory’, where it received a new coat of paint.

Several L-39s were also wired for the carriage of the recently delivered 80mm B-8 rocket pods, a weapon not supported by the original L-39. A B-8 equipped L-39ZO deployed at Hama airbase can be seen below.

While the L-39s saw much action in the early stages of the Syrian Civil War, one of its bases was overrun by Jaish al-Islam, which later attempted to get at least four L-39s based at Kshesh operational. This project was supposedly continued by the Islamic State after their capture of the airbase.[5]

Bashar al-Assad’s regime then cleverly used this news report for its own gains, and went on to claim the Syrian Arab Army had destroyed both aircraft on the ground.[6]

“Regarding … that terrorists control three jets in al-Jarrah military air base in Aleppo, there are three old aircraft that the terrorists were testing so the Syrian Arab Army immediately destroyed two of them on the runway as they were landing.”

As the Syrian Arab Army has no presence anywhere close to Kshesh, any action against the Islamic State’s aircraft should have been carried out by the SyAAF. But as Kshesh is littered with around sixty plane wrecks, it is highly unlikely the SyAAF ever managed to find or hit the aircaft, which spend most of their time hidden in a Hardened Aircraft Shelter anyway. While the presence of two operational L-39s in rebel hands was already known back in November 2013, it was completely ignored by the SyAAF. Around a year later, when the Islamic State was reportedly working on getting the two L-39s operational again, these aircraft suddenly became a priority target. A great PR stunt nonetheless.

Two of the L-39s in question can be seen below, shortly after their capture by the Islamic State.

Syria’s most iconic interceptor, the MiG-25, hasn’t seen much action in the past couple of years however. The exact number of MiG-25s delivered remains unknown but is thought to be around forty. Versions are believed to include MiG-25P (later upgraded to MiG-25PDS) and MiG-25PD interceptors, MiG-25R and RB reconnaissance aircraft and MiG-25PU conversion trainers. Much of the mighty MiG-25 fleet was phased out by 2011, with as much as twenty-eight decommissioned MiG-25s visible at T4 in November 2013. A part of the fleet has been towed into the desert, suggesting most are never to fly again. A reason for the mass-retirement of the MiG-25 fleet might be the type’s vulnerability to Israeli jamming.

Nevertheless, a video released by rebels on the 8th of August 2012 confirmed some MiG-25s might still be operational at Tadmur (commonly known as Palmyra). The MiG-25s reappeared in March 2014, and again in April 2014, during which a MiG-25PD(S) fired two infrared homing R-40TD air-to-air missiles at the village of Aqaribat in the Hama Governorate. The first R-40 failed to detonate after hitting the ground while the second R-40 exploded in mid-air at around five kilometers distance from the other one. A week later, other MiG-25s launched four other R-40s, then four more launches followed in the same period. While the practice of launching R-40 air-to-air missiles at ground targets was already reported in 2013, it yielded the same results at every launch: a failure. What the SyAAF hoped to achieve here will always remain a question.

[7] :‘Over the past two days, regime air force conducted several air raids using what appears to be the new Su -25s, which fire from a very high altitude.…



They also fly for a longer period and fire from 5 km altitude, making it almost impossible to target them.…



He added that Syrian Arab Army soldiers at checkpoints surrounding the town of Khan al-Sheeh خان الشيح gloatingly asked women who pass by “Did you like the new warplanes?” Meanwhile, it is getting more likely the SyAAF recently received, or was already in the possession of multiple ejector racks (MERs) for its MiG-25RBs. When equipped with such racks, MiG-25RBs are able to deploy up to eight FAB-500Ts for bombing sorties, albeit with bad accuracy. However, with sufficient numbers of MiG-25RBs at hand, such sorties could replace the Su-24M2s currently used for this task as accuracy does not seem to be of much importance during these strikes.Eye-witness accounts on the ground already reported the use of a new aircraft in the Syrian Civil War. Although called a Su-25 here, it is more likely they were looking at a MiG-25 here

In short, several MiG-25PD(S) interceptors, MiG-25RB reconnaissance-bombers and associated MiG-25PU trainers are likely to be still be in use with the SyAAF. A pre-civil war photograph of a MiG-25PD(S) interceptor armed with two R-40s can be seen in the image below.

Contrary to the fixed-wing fleet, the helicopter fleet doesn’t enjoy the same luxurious position to rotate different squadrons and aircraft. Surviving Mi-8 and Mi-17s find themselves performing every task from supplying besieged Syrian Arab Army garrisons with food, weapons and munitions to dropping barrel bombs over towns, which started in August 2012.

Heavy attrition has meant that the surviving helicopters have to work even harder, and although this is exactly what the Mi-8s and Mi-17s were originally designed for, one can see their versatile tasks leaves little time for repainting.

The Mi-25 fleet largely remains intact and sees sporadic use throughout Syria. Two Mi-25s were detached to Tabqa in an effort to maintain control of this strategical airbase. While the Mi-25s were highly successful in striking convoys and positions of fighters of the Islamic State, Tabqa was already lost when it became completely encircled. Some twenty Mi-25s are still believed to be operational with 767 Squadron and another unknown Squadron based at Bley (commonly known as Marj Ruhayyil). Several Mi-25s are permanently detached to other airbases however.

The Mi-14s and Ka-28s have found little use in the conflict. As both were designed to hunt and destroy submarines or perform search and rescue duties, their use in the Civil War has until now been limited

Mi-14s did take part in the dropping of SADAF-02 naval mines over Syria on several occasions, possibly in an effort to test if they would explode on impact.[8] Unsurprisingly, this project yielded the same results as the R-40 fiasco did. Several Mi-14s recently joined the Mi-8/17s in bombing villages in an effort to partially relieve the dwindling Mi-8/17 fleet from this task.[9]

A Mi-14 was also used to transport the coffin of a SyAAF pilot (KIA) to his burial. Although the SyAAF’s helicopters regularly take part in flypasts in commemoration of fallen SyAAF pilots over their families houses, this was uncommon even for SyAAF standards. Six Mi-14s and four Ka-28s (of which two recently overhauled in the Ukraine) are still believed to be operational with 618 Squadron based out of Hmeemeem/Bassel al-Assad IAP.

The defence of Tabqa also saw the combat debut of the SA-342 ‘Gazelle’, which were only used on a limited amount of reconnaissance missions until then. The open desert surrounding the airbase proved to be the perfect combat environment for these helicopers. Armed with HOT missiles, they saw heavy action against vehicles of the Islamic State. Around ten SA-342s are still believed to be operational with 976 Squadron based at Mezze, with a few helicopters permanently detached to other airbases. It is likely several SA-342s operate out of T4 in aid of Suqur al-Sahara (Desert Falcons) combating fighters of the Islamic State in the nearby desert.

An overview of Syria’s airbases can be seen below. Map made by Luftwaffe A.S.

Most airbases currently have at least one or two Mi-8/17s assigned to them, which makes the current organisation of the helicopter squadrons incredibly hard to find out. Almost all of the SyAAF’s Squadrons currently have several of their aircraft detached to other airbases. Despite this, the SyAAF’s order of battle (ORBAT) can be seen here.

The much-reported deliveries of brand-new Russian aircraft are unlikely to take place in the near future. Although certain media outlets reported in May 2014[6] that Russia was ready to send the first batch of Yak-130s to Syria in late 2014, this was merely a mistranslation of the original statement made by a source close to Russia’s Rosoboronexport.

What the source actually said:

”Правда, по оценке источника “Ъ”, близкого к ФСВТС, сверстанный план является “очень оптимистичным”. “Он делался исходя из технологических возможностей производителя самолетов — Иркутского авиастроительного завода — и никаких политических аспектов не учитывает,— говорит собеседник “Ъ”.— Сложно предсказать, каким образом будут развиваться события, но планировать свою работу мы все равно должны”.”

[The newspaper’s source says: ] “The plan is very optimistic – it takes into account only technological capabilities of the Irkut aircraft plant, and doesn’t account for any political aspects. It’s hard to predict what can happen, but we should have some plan anyway”.

So while the Irkut aircraft plant might produce Yak-130s for Syria, there’s no guarantee the Russian government will allow the aircraft to be delivered to Syria. The exact same story applies for the MiG-29M2s, of which a few already have been produced.

This means the SyAAF has to do with what it currently has, which, considering its unexpected resilience, should not prove to be much of a problem. But as Syria’s rebels get squeezed between the Islamic State and the regime of Bashar al-Assad, and the once-strong hope of succeeding in completing the revolution is further away than ever, the world might turn a blind eye to deliveries of aircraft and helicopters to combat the Islamic State.

The continued stream of upgraded and repaired aircraft to Syria shows the extent of the Russian determination in their effort to aid the Assad regime, and once again makes clear that the conflict isn’t likely to come to an end anytime soon.

Special thanks to ACIG and Luftwaffe A.S.",2015-01-16,"The Syrian Arab Air Force, Beware of its Wings"
2015,1,https://www.bellingcat.com/news/uk-and-europe/2015/01/13/russian-radars-started-active-combat-duty-in-2014/,/news/uk-and-europe/2015/01/13/russian-radars-started-active-combat-duty-in-2014/,"

Last month Major-General Oleg Maidanovich, the commander of Russia’s Space Command announced that four early warning radars began active combat duty in 2014.

The long range Voronezh class radars located at Yeniseysk, Barnaul, Irkutsk and Kaliningrad are currently in a mixed state of full active and experimental combat duty.

The two variants, the Voronezh-DM and Voronezh-M/VP have been in the sights of Russian watchers for some time. That’s because they help form the backbone of Russia’s new early warning radar system, scheduled to be complete by 2020.

Their deployment supports Russia’s ongoing efforts to modernize the military which suffered following the collapse of the Soviet Union.

The four radars joined a network of existing Voronezh and older Dnepr, Daryal, and Volga radars located across Russia and the near abroad.

The latest in the series, they are meant to be more cost effective, capable and scalable, according to Russia’s Kommersant Daily. For example, the Voronezh-DM was reported to consume only .7 megawatts of power—down from 2 MWt and 50MWt that the older Dnepr and Daryal consume.

However, procurement costs have risen in recent years and the radars now range between RUB 2.85 billion and RUB 4.4 billion, up from initial estimates of RUB 1.5 billion. Despite doubling in price, gains have been made in other areas such as faster assembly using prefabricated modules and a lower personnel requirement for operation.

With a reported range of 4200 km, these third generation radars are designed to detect ballistic and cruise missile launches well beyond Russia’s borders. As the primary land-based component for the early warning mission, Russia has moved quickly to complete their construction. Once in operation, they compliment Russia’s early warning space assets, Cosmos 2422 and Cosmos 2446, both in highly-elliptical orbit.

Current Voronezh Locations

So far, the four radars join two additional Voronezh sites in operation, the Voronezh-M at Lekhtusi (outside St. Petersburg) and a Voronezh-DM at Armavir (Krasnodar Krai). They went on combat duty in 2012 and 2013, respectively.

According to satellite imagery, the Yeniseysk radar is located in Krasnoyarsk Krai less than 100km from Russia’s old Daryal radar site. Its UHF array is directed at Russia’s northeast boundary.

Watching the southeast, especially China, Pakistan and India, Russia has the Voronezh-DM at Barnaul in Altayskiy. The latest satellite shots viewed in Google Earth still showed construction activity in June.

The third radar, the Irkutsk-based Voronezh-M—also reported as Mishelevka—is located in Siberia’s Lake Baikal region. Fielding two arrays, one points northeast overlapping with Yeniseysk and another is directed southeast. Built at a previous Dnepr radar site, the radar fills gaps in coverage over parts of China and Japan.

The last radar station mentioned by Maidanovich is at Russia’s Kaliningrad located at the southeast section of the abandoned Dunayevka airfield. A beachhead between Lithuania and Poland, Kaliningrad sports a Voronezh-DM stretching coverage over most of Western Europe, overlapping with the site at Armavir.

Beyond these six sites, two additional Voronezh class radars are currently under construction at Vorkuta and Orsk. The latest imagery from August shows substantial construction activity at Orsk while a patchwork of imagery from 2013 and 2014 had yet to show signs of construction in Vorkuta. Russia announced in late 2013, that construction had commenced.

In the meantime, the Russian press in 2012 said that another Voronezh would be setup at Olenegorsk with a planned deployment date for sometime in 2017. Since the Voronezh can be deployed in approximately 12 to 18 months, we may not see signs of a site until 2016.

For those who haven’t kept up with the Voronezh deployments, Pavel Podvig, a Russian strategic forces analyst, has created a KMZ file with the Voronezh locations and their respective fields of view for display in Google Earth. I suggest you check out his work over at Russianforces.org.",2015-01-13,Russian Radars Started Active Combat Duty in 2014
2015,1,https://www.bellingcat.com/news/uk-and-europe/2015/01/10/su-25-mh17-and-the-problems-with-keeping-a-story-straight/,/news/uk-and-europe/2015/01/10/su-25-mh17-and-the-problems-with-keeping-a-story-straight/,"

While the investigations in to the downing of MH17 continue there’s been much debate about who was responsible, and the weapon system used to down MH17. These theories can be generally split into two broad groups, one where a Buk surface to air missile system was used to shoot down MH17, the other where a Ukrainian military jet, usually specified as a SU-25, shot down MH17.

Bellingcat has examined much of the evidence and claims related to a Buk missile system being used, in particular tracking a Buk controlled by separatists on July 17th and finding the same Buk in Russia in late June in our report Origin of the Separatists’ Buk. In this piece we’ll examine claims relating to the use of a jet fighter to shoot down MH17, which reveals not only continual inconsistencies between the various claims made by the Russian government and presented in the media, but also examples of outright and provable falsehoods being presented by the Russian government and media.

As with any major event there are many alternative theories and claims made on various message boards, social media sites, and blogs, but for the purposes of this piece we will focus on claims that have been made by the Russian government or have made their way into mainstream discourse.

The SU-25 Appears

On the day of July 17th it was already apparent competing claims about how MH17 was downed were being made by various sources. In the case of those sources claiming the Ukrainian air force was responsible there were a number of different claims made. It was reported that the Luhansk People’s Republic had claimed an Ukrainian SU-25 had shot down MH17 “after a ground attack aircraft was shot down by the militia of the Luhansk People’s Republic”, and rebel leader Andrei Purgin told Russia 24 News that MH17 may have been shot down after being mistaken for a Russian spy plane.

Elsewhere, the tweets of “Carlos”, who claimed to be an air traffic controller in Ukraine, were adding more details to the incident. In May, Russia Today had previously reported on Carlos, who had been commentating on the Ukraine crisis for a number of months, and claimed in his interview with Russia Today to have received death threats because of his work. In a series of tweets made on July 17th from his now deleted Twitter account, Carlos made a number of claims, including

The attack was the Ukrainian government trying to make it look like an attack by pro-Russian rebels.

Air traffic control in Kiev, where he claimed to work, was being taken over by the Ukrainian miliary, with phones and other equipment being confiscated from staff.

That MH17 was being escorted by two Ukrainian jet fighters minutes before MH17 was shot down.

That it was shot down by a missile, with the military present with Carlos confirming it was Ukrainian.

Already there’s clear contradictions between claims being made by Carlos and the Luhansk People’s Republic, for example the claim the Ukrainian government was trying to make it look like an attack by pro-Russian rebels, as opposed to the claim from the LPR that it was shot down in response to LPR militia shooting down a “ground attack aircraft”. Certainly, if Carlos was telling the truth the speculation by Andrei Purgin that MH17 may have been mistaken for a Russian spy plane would make no sense at all.

The Russian government owned news agency ITAR-TASS reported the claims made by Carlos, citing reports from the Russian government owned TV channel Channel One:

Two Ukrainian fighters were following the passenger Boeing-777 of Malaysian Airlines several minutes before the crash, Russia’s television Channel One said on Friday, citing a tweet made a Spanish air traffic controller of Kiev’s airport Borispol. According to the Spanish air traffic controller, two Ukrainian fighters had been seen near the Malaysian jet three minutes before it disappeared from radars. This information is confirmed by eyewitnesses in the Donetsk region who saw Ukrainian warplanes near the passenger jet. They say they heard sounds of powerful blasts and saw a Ukraine warplane shortly before the crash.

But as people began to look into the identity of Carlos some major questions were raised about his identity. The Spain Report contacted the Spanish embassy in Ukraine, asking about Carlos, and received the following reply:

This is not the first time we have been asked about him. This “Carlos” was also active during the Maidán revolution in Ukraine. We have no knowledge of “Carlos” having been in Ukraine. There is no record of his passing through the Consulate, and no one from the (relatively small) Spanish colony knows him. The airport where he supposedly worked for several years told us at the time that all of their air traffic controllers are Ukranian, and that in any case they have never employed any Spaniard for that or any other task. Furthermore, the last information he was posting before the airline tragedy was of the same sort. He was saying, for example, that he lived in Kiev and had been threatened by radical extreme-right elements. No Spaniard or national of another country—to my knowledge—has ever been threatened in this country

“The Facts Juggled”

On July 21st, the Russian Ministry of Defence gave a lengthy press conference on the downing of MH17. It was split into three main sections, examining what was claimed to be the flight path of MH17 and other activity in the air at the time of the event, satellite map imagery of Buk missile launchers in Ukrainian territory, and their “proof” that a video produced by the Ukrainian Ministry of Interior showing a Buk missile launcher being transported through separatists held territory actually showed it in government held territory. As Bellingcat demonstrated last year, the last claim by the Russian Ministry of Defence, that the video was filmed in government held territory, is a provable lie by the Russian MoD. But what about the other claims made about the air traffic on July 17th?

The press conference opened with a map that claims to show the route MH17 took. The head of the Main Operations Directorate of the HQ of Russia’s military forces, Lieutenant-General Andrey Kartopolov, described how the map showed MH17 deviating from its air corridor, turning north, then turning back to the air corridor:

Since this claim was made the Dutch Safety Board’s initial report on the downing of MH17 has shown this claim is completely false. The below image from the DSB report shows the flight path taken by MH17 up until moment it was shot down, based on various data:

It’s clear from the above image that there was no course alteration as claimed by the Ministry of Defence in their July 21st press conference. In fact, after overlaying the two images it’s clear the Russian MoD’s flight path is incorrect:

The Russian Ministry of Defence’s additional flight data shown at the same press conference and published on their website on same day, claims to show the flight path of MH17, followed by what they claim was an image showing the jet that had just attacked MH17 appearing after MH17 was shot down. This video begins shortly after the supposed course change claimed by the Russian MoD, which was not visible in the Dutch Safety Board’s data.

Later in the press conference the SU-25 make its first appearance, with Lieutenant-General Andrey Kartopolov stating the following:

A Ukraine Air Force military jet was detected gaining height, it’s distance from the Malaysian Boeing was 3 to 5km…. The SU-25 fighter jet can gain an altitude of 10km, according to its specification…. It’s equipped with air-to-air R-60 missiles that can hit a target at a distance up to 12km, up to 5km for sure.”

There’s no mention of the claims made by the Luhansk People’s Republic of the SU-25 attacking MH17 in response to an attack aircraft being shot down, or any reference to any other military aircraft being in the area. It’s also claimed at the press conference that the SU-25 was only detectable after MH17 was shot down, but a number of informed sources have criticised this interpretation of the data presented.

Former military pilot Carl Bergqvist wrote a detailed explanation of some of the issues with the claims made about that data on his website, explaining that what the Russian press conference described as the SU-25 appearing on the radar was more likely to be large chunks of debris from MH17 being detected.

However, if we take the word of the Russian MoD we now have the claim that a SU-25 flew up to towards MH17 and fired at it with what was likely at least one R-60 missile from a range of 3-5km. This claim soon fell by the wayside as a new theory began to emerge.

Cannon Canon

On July 29th CBC’s interview with OSCE Spokesperson Michael Bociurkiw sparked a new wave of speculation about how MH17 was shot down. He stated damage he had seen to the aircraft “almost looks like machine gun fire, very very strong machine gun fire”, and this sparked speculation that this damage was caused by a GSh-30-2 30mm cannon, one of the SU-25’s armaments.

An article by former pilot Peter Haisenko published on July 30th added to this speculation. The article also referenced the claims of Carlos the mystery air-controller, and the claims made during the Russian Ministry of Defence’s press conference, and Peter Hasienko’s claims were referenced by Robert Parry in an article for Consortium News, which was then reported on by Malaysia’s New Straits Times, referencing their own previous day’s report where it was claimed both missiles and cannon fire were used to shoot down MH17, which itself was reported by RIA Novosti.

Later on in the year the Russian Union of Engineers would release a study that was widely reported on by various Russian media outlets that expanded on those theories. In their report they examined various claims, and came up with the following conclusion

At 17.17‐17.20, the Boeing 777 was in Ukrainian airspace near the city of Donetsk at the height of 10100m. An unidentified combat aircraft (presumably a Su‐25 or MiG ‐29), which was a tier below, on collision course, in the cloud layer, sharply gained altitude and suddenly appeared out of the clouds in front of the civilian aircraft and opened fire on the cockpit, firing from a 30 mm caliber cannon or smaller. The pilot of a fighter jet can do this while in “free hunting” mode (using onboard radar) or with the help of navigational guidance using airspace situation data from ground‐based radar. As a result of multiple hits from shells there was damage to the cockpit, which suddenly depressurized, resulting in instant death for the crew due to mechanical influences and decompression. The attack was sudden and lasted a fraction of a second; in such circumstances the crew could not sound any alarm as the flight had been proceeding in regular mode and no attack was expected. Since neither the engines or hydraulic system, nor other devices required for the continuation of the flight were out of commission, the Boeing 777, running on autopilot (as is standard), continued on its horizontal flight path, perhaps gradually losing altitude. The pilot of the unidentified combat aircraft manoeuvred to the rear of the Boeing 777. After that, the unidentified plane remained on the combat course, the pilot provided a target tracking aircraft equipment, took aim and launched his R‐60 or R‐73 missiles.

This was the most detailed version of events so far, containing claims of both a missile and cannon fire being used, and even the revelation that the fighter jet had attacked the aircraft and turned around to finish MH17 off with a missile.

At this point it’s worth highlighting that the initial Dutch Safety Report states that “No aural warnings or alerts of aircraft system malfunction were heard on the cockpit voice recording, which ended at 13.20.03 hours. Crew communication gave no indication that there was anything abnormal with the flight.” This means that for the Russian Union of Engineers scenario to be correct the jet that managed to kill the crew also would have to disabled the black box recorders at exactly the same time, yet left MH17 in good enough shape that MH17 could continue on it’s course while the attacking aircraft flew past MH17, turned around, and then fired a R-60 or R-73 missile at it. This display of aerial acrobatics was something that had until their report been missed by everyone, including the Russian MoD’s radar, and certainly points towards a purposeful attempt to shoot down MH17.

By this stage even the Russian Ministry of Defence seemed to be doubting their version of events. On August 30th Reuters reported on comments made by Russia’s Deputy Defence Minister Anatoly Antonov, who said :

Where is the transcript of the recordings of conversations between the pilot of this plane and his command? How did a military aircraft come to be alongside a civilian one? If people are saying today that a rocket was fired from the ground towards that military plane, then I’d like to look that military pilot in the eye who used a civilian plane as cover, if of course that’s what happened.

Now, instead of a jet appearing in front of MH17 it’s appearing alongside it, maybe even using it as cover from a surfaced launched missile. This would be an impressive feat of piloting considering the speed and flight ceiling of a SU-25 are both much lower than that of MH17, and certainly contradicts the claims made by the Russian Union of Engineers.

There’s also some interesting questions to be asked about the type of damage done to the aircraft. The R-60 air to air missile used by the SU-25 is a heat seeking missile, meaning it would target the hottest part of the aircraft, in this case the engines. The question is then, why is the damage to MH17 focused nearly entirely around the flight deck? It also appears the damage to the flight deck isn’t consistent with 30mm cannon fire alone, with entry holes being a variety of shapes and sizes, some of them even on the roof of the flight deck. How could the damage be caused by a missile that would target the engines rather than the flight deck?

“How Could We Check It? It Came To Us From The internet.”

Unconcerned by such questions, the Russian Union of Engineers cast their expert eye on the following image which was shared online in November:

The above image, “authenticated” by the Russian Union of Engineers, showed a jet firing at flight MH17, and was broadcast on Russian Channel One as fresh evidence of an Ukrainian jet shooting down flight MH17. The claims made about the image soon were repeated on mainstream sites such as the Daily Mail Online, but unfortunately for the Russian Union of Engineers and Channel One the image was quickly debunked as being a composite of satellite map imagery and images of aircraft, and didn’t even appear to support the claims made by the Russian Union of Engineers own report. When questioned about their error the Russian Union of Engineers asked “how could we check it? It came to us from the internet”, and the presenter of the Channel One news show caught out by the faked image angrily demanded that bloggers criticising him “present your data, brutes!”

The Wrong Plane

On December 23rd Russian media outlets published reports of a new key witness in the MH17 case. This new anonymous witness claimed that on July 17th he was staying on the air base in the village of Aviatorskoe, near Dnepropetrovsk, and claims to have seen a SU-25 that had previously been loaded with air-to-air missiles returning to base and the pilot of the aircraft, stating that the pilot, Captain Vladislav Voloshin, was scared after landing, and talked about the “wrong plane”. Questioning the captain about the plane in question, Captain Voloshin replied “The plane was in the wrong place at the wrong time.”

The witness also made other statements:

Those missiles “air-to-air” are not part of the basic ammunition load. They are hung according to a special order. Usually, they tried not to rise into air such jets with such missiles. Because it is not allowed to transport such a missile along in the air.” Knowing a little bit that pilot… (quite possible that the other two jets were shot down in front of him), and he had some scared reaction, inadequate. He might be frightened or as a revenge run the missiles into the Boeing. May be he just took it for some other combatant air jet. The phrase he said after he was taken out of the jet: “The aircraft, it was not the one”. And in the evening there was a phrase, a question from a pilot for him, to the same Voloshin: “What about the aircraft?”. And he answered: “The aircraft got on a wrong time to a wrong place”.

The witness also provides his own theories on what happened in the sky, but it’s hard to think of these as anything more than speculation on the part of the witness. It’s interesting to note that this story does have some similarities with the stories presented during the day of the attack, with the Luhansk People’s Republic claiming an Ukrainian jet had shot down MH17 “after a ground attack aircraft was shot down by the militia of the Luhansk People’s Republic”. The question is then, if this was just a reaction to SU-25s being shot down, was it also just a coincidence the SU-25 in question had been unusually armed with air-to-air missiles on that day? If it wasn’t a reaction to other SU-25s being shot down, then what was the correct plane if MH17 was the wrong plane? If it was supposed to be a Russian spy plane as Andrei Purgin suggested on the day of the attack, wouldn’t it make more sense to assign the mission to one of the Ukrainian air force’s aircraft capable of flying at a high altitude, rather than an aircraft designed for attacking ground targets?

It’s also clear this scenario doesn’t match the claims made by the Russian Union of Engineers. According to the Russian Union of Engineers Captain Voloshin would have attacked MH17 with 30mm cannon fire, which would have been at a range where the aircraft would have been easily identifiable. Then, after the initial attack, Captain Voloshin would have then turned around to fire a missile at MH17. Given that Captain Voloshin would then fly back to base, shocked that he had shot down the “wrong plane”, it would seem he would have noticed it was the wrong plane before he turned around to fire a missile at it. It’s also worth noting the anonymous witness makes no claims about cannon fire being used to attack MH17.

Technical issues

Aside from all these claims made over the last several months being full of contradictions, errors, and outright falsehoods, there’s also the technical aspect of these claims that shouldn’t be overlooked. A number of experts have noted the damage to MH17, nearly entirely to the front of the aircraft, matches that of a larger fragmentation warhead as used by the Buk missile launcher, rather than the much smaller R-60 missile that the SU-25 would have used. In the recent piece by Correct!v on the downing of MH17 one expert states:

There is no doubt: flight MH17 was shot down by a missile. And this missile was fired from the ground and not from a fighter jet.

Another expert is quoted as saying:

Only a rocket fired from the ground has the explosive power displayed in the destruction of MH17.

Another question to be asked is why a heat seeking R-60 missile would hit the flight deck of MH17, instead of the hottest part of the aircraft, the engines? Why, if the SU-25 was below MH17 as claimed by the anonymous witness in December, are there signs of entry damage from shrapnel on the roof of the flight deck?

The list of these questions goes on, and it seems that not only is the SU-25 narrative a fractured and contradictory mess, but requires the equipment used to act in such a way that it resembles a strike by a Buk missile rather than an attack by a SU-25. Given that these claims keep on coming it seems not unreasonable to ask that next time a claim is made about a SU-25 being used to shoot down MH17 that we are given something more than mystery witnesses, dubious theories, dodgy experts, and fake evidence.",2015-01-10,"SU-25, MH17 and the Problems with Keeping a Story Straight"
2015,2,https://www.bellingcat.com/news/2015/02/22/internet-control-narrative/,/news/2015/02/22/internet-control-narrative/,"

If you’ve been following the Syrian conflict for almost the last 4 years, you’ve heard about the intermittently working Syrian Internet. Especially in the early days of the revolution, internet disconnection rhymed with fear of massacres for activists. The Assad regime has repeatedly disconnected [1] regions from the Internet before doing an assault to control the narrative of the events.

Yesterday, as Turkish soldiers entered Syria heading to the Suleyman Shah tomb, the Internet peering that connects Northern Syria with Turkey was offline. It came back in the morning around 8:40 AM UTC.

The Aleppo region and most of Northern Syria is connected by a network (technically called AS for Autonomous System) operated by the Syrian Computer Society. Interestingly, Northern Syria is not directly peered with networks operated by the Syrian Telecommunications Establishment. Instead, the Syrian Computer Society has a single peer, Turk Telecom. It means that information control in Northern Syria is very easy. If that single peering is disconnected, the whole region goes offline.

It could be a coïncidence but given the track record of Turkey regarding Internet censorship and timing of events that is very unlikely. If you have any more information about how the peering was dropped, feel free to reach out on Twitter.

[1] : Although the regime was to blame for almost all internet disconnections to date, the November 2012 instance was attributed to NSA as their elite hacker team failed to hack a core-internet router resulting in nation-wide disconnection.",2015-02-22,"Control the Internet, Control the Narrative"
2015,2,https://www.bellingcat.com/news/rest-of-world/2015/02/22/what-is-china-building-in-the-south-china-sea/,/news/rest-of-world/2015/02/22/what-is-china-building-in-the-south-china-sea/,"

The South China Sea contains some of the planet’s most disputed territory. Six countries — China, Taiwan, Vietnam, Malaysia, the Philippines, and Brunei — are squaring off as they compete over the rights to the sea.

The dispute centers on the contested Spratly Island Chain, a hodgepodge of small islands and submerged reefs which lie near the center of the South China Sea. All but Brunei have built military outposts in the Spratlys, and all of these countries minus China have built military airstrips on the islands. China, which arrived late to the Spratly land-grab, was left to occupy eight fully and semi-submerged reefs. With such little land to build upon, China has been playing catch up ever since.

Over the past year, China’s Spratly outposts have been systematically undergoing a process known as “land reclamation,” where dedicated dredging vessels dig up sediment from the sea and dump it on top of submerged reefs to make islands. China has already built five islands through reclamation, and at least two additional islands are in the early stages of development. China is not the first claimant to reclaim land – Malaysia’s Swallow Reef and several Vietnamese islands have been artificially built or extended – but China’s reclamation efforts are operating at a larger scale than any previous project. Already, the artificial island built on Fiery Cross Reef has eclipsed Taiwan’s Taiping Island as the largest in the Spratly Chain, and buildings are under development on several other Chinese reefs. As their new military outposts become operational, it is imperative that we understand just what China is building in the South China Sea.

Fiery Cross Reef

Fiery Cross Reef (also known as Yongshu Island) was completely underwater until August 2014, when Chinese dredgers began to dig up the surrounding sediment. Before construction began, the Chinese presence consisted of a single concrete bunker on the reef’s southwest end, but this island has since become the largest in the Spratly chain, measuring nearly 2.3 km². The new island includes a nearly two-mile long strip of land that appears to be the future site of an airfield.

Between November 2014 and January 2015, the southwest of the reef was reclaimed, connecting the airfield with the original concrete structure and enlarging the total land mass of the reef. Dredging activity has not ceased, and land is still being reclaimed. Recent photographs released by Philippine media show that foundations in development for a large scale construction project on the northeast of the island.

Johnson South Reef

Johnson South Reef has undergone one of the most extraordinary transformations of any Spratly feature. Photographs released by the Philippine Department of Foreign Affairs show that land reclamation began in early 2014, and new photographs indicate that reclamation is still ongoing.

In early September 2014, nearly simultaneous reports released by IHS Janes and the BBC revealed the beginnings of a large construction project. It is unclear exactly when this construction began, but photographs taken in early December of 2014 clearly show a sizable building, possibly as high as ten stories, under construction on the newly developed island.

The photographs taken and released by Vietnam’s Thanh Nien News agency show a number of construction sites under development, including what may be an air traffic control center. Philippine media has claimed that Johnson South Reef will one day contain an airstrip, but current photographs fail to backup this claim.The reef’s area is roughly 6 km², and the island itself is approximately .16 km², which leaves ample room for further reclamation.

Cuarteron Reef

Cuarteron Reef is both China’s southernmost and westernmost outpost in the Spratly chain. Land reclamation on the reef appears to have started in March 2014. As of January 2015, China has built between .3 and .4 km² of new land. The newly built island is home to a seawall, a small military outpost, a helicopter pad, an artificial harbor, and a dock. Satellite photographs show ongoing construction projects, however photographs are not clear enough to make out what is being built.

Gaven Reefs

The Gaven Reefs are home to a mid-scale land reclamation project that has produced an artificial island approximately .08 km². Between June and August 2014, this island expanded from one small outpost into the buttressed island that exists today. Photos show that the new island contains barracks for construction workers and military personnel, shipping containers used as temporary shelters, an artificial harbor, and anti-aircraft weaponry. A report from IHS Janes indicates that this island contains both radar equipment and anti-ship guns.

Hughes Reef

Land reclamation on Hughes Reef appears to have begun in March 2014. Satellite photographs suggest that construction is ongoing on the newly built island. Reports indicate that the new island is home to a lighthouse and a military outpost.

Subi Reef

Subi Reef, China’s northernmost outpost in the Spratlys, is the most recent subject of land reclamation. Satellite photographs from early February, 2015 show a significant presence of dredgers working two separate points on the southeast and the southwest of the reef. Dredging at Subi Reef first appeared in satellite photographs taken on January 26, 2015, which showed that two dredging ships had begun work on Subi Reef’s southwest end. Prior to the start of land reclamation, Subi reef contained a helicopter pad and a small concrete outpost used to house visiting troops.

Mischief Reef

Mischief Reef is China’s easternmost outpost in the Spratly chain. Satellite photographs from the end of January indicate that land reclamation has just begun. These photographs show a presence of dredging vessels on the southern end of the island, as well as the addition of new land separate from an existing concrete structure. Mischief Reef is less than 200 miles from the Philippine island of Palawan (less than 150 miles from some points), thus putting the reef well within the Philippines’ Exclusive Economic Zone. Predictably, the start of reclamation at Mischief Reef has been met with significant protest from the Philippines.

Eldad Reef

Eldad Reef is home to a naturally occurring teardrop-shaped sandbar on its north end. The sandbar’s size and shape remained consistent in photographs taken between January 2012 and November 2013. More recent photographs, show a slight increase in size of the sandbar, indicating that there may be a low-level reclamation project underway on Eldad reef. These photographs fail to capture dredging vessels and may simply be showing naturally occurring changes, however Philippine intelligence and media claim that Eldad Reef is in fact a current target of Chinese land reclamation. The situation on Eldad is ambiguous, and we should continue to watch the reef for signs of reclamation.

Based on satellite photographs and intelligence reports, it is clear that China is currently reclaiming land on at least seven of its eight reefs — Fiery Cross, Johnson South, Gaven, Hughes, Cuarteron, Subi, and Mischief — and that reclamation may have also begun on Eldad Reef. Reclamation on Johnson South, Gaven, Hughes, and Cuarteron Reefs started in early 2014, reclamation of Fiery Cross Reef began in August 2014, and reclamation on Subi and Mischief Reefs started in late January 2015. Land reclamation on Eldad reef may have started in December 2014.

Photographs indicate that massive construction projects are underway on the newly build islands at Fiery Cross and Johnson South Reefs, while less extensive but still serious construction is ondoing at Hughes, Gaven, and Cuarteron Reefs. Given the extent to which future control over the shipping lanes of the South China Sea will impact the global balance of power, China’s island construction is worthy of our attention.",2015-02-22,What is China Building in the South China Sea?
2015,2,https://www.bellingcat.com/news/2015/02/21/mr-simon-and-the-queen-bee-traffickers-above-suspicion-at-hsbc/,/news/2015/02/21/mr-simon-and-the-queen-bee-traffickers-above-suspicion-at-hsbc/,"

From 2002 until 2007 at least, HSBC Private Bank was the scene of an alliance between Atlanta-based ecstasy dealers and an Israeli arms trafficker, former Al-Qaeda supplier and money launderer for Mexican cartels.

By François Pilet, Marie Maurisse and Aliaume Leroy

Night was falling over an Atlanta suburb on Monday 22 March 2004 when Sergeant Sean Mahar’s patrol car stopped at a red light behind the blue Mercedes. He could see the long black hair of the two women sitting in the front. The passenger was wearing her seatbelt, but the driver’s one was clearly hanging down beside the door.

Sergeant Mahar tailed the car as it drove along Buford Highway. After 200 yards, the officer turned on his blue light. The car immediately swung left into the parking lot of an Asian supermarket, on the corner of McClave Drive, and stopped in the first free space.

The driver showed a licence in the name of Jenny Nguyen. The passenger was speaking nervously into her cellphone in a language the sergeant could not understand. She appeared to be looking out for someone. The police officer decided to search the car. In the trunk, a large amount of cash was carefully arranged in bundles of $10, $20, $50 and $100 bills tied with elastic bands in two white cardboard boxes and a plastic bag. That day, Jenny Nguyen’s car contained $414,870 from the sale of ecstasy on the streets of Atlanta by a Vietnamese gang.

When Sergeant Mahar stopped them on the corner of Buford and McClave, the bills had been on their way to accounts 31241 and 14025 at HSBC Private Bank in Geneva. The plan – done many times before – had been to transfer the cash in small amounts through independent money transfer offices such as An Chau Services and HO Express.

The data stolen from the Swiss bank by the computer analyst Hervé Falciani, and obtained by Le Monde and the International Consortium of Investigative Journalists (ICIJ), shows that the accounts belonged to two diamond traders: Toronto-based Anh Ngoc Nguyen, alias “Lenny”, and Alain Lesser from Antwerp in Belgium.

“Lenny” collected the money sent from Atlanta and used it to buy diamonds through Lesser. The precious stones were then forwarded to Vietnam for delivery to a man called “Uncle Five”.

A few days after Jenny Nguyen’s arrest, documents referring to the two HSBC Private Bank accounts were found during a raid on a house in Atlanta. DEA and police agents also discovered diamonds, bundles of dollar bills and a Beretta 9mm pistol.

The investigation into the Vietnamese ecstasy dealer (see original court cases at the end of the article), codenamed “Operation Candy Box”, had been going on for over a year. The U.S. Drug Enforcement Administration (DEA) did everything to achieve its ends. Jenny Nguyen’s arrest on the corner of Buford and McClave, for instance, owed nothing to luck.

An hour before he drew up behind the Mercedes, Sergeant Mahar had met with DEA Special Agent Kenneth McLeod at a gas station to receive his instructions. McLeod had asked him to find an excuse to stop Jenny Nguyen’s car. He knew from wiretaps that the car was loaded with cash. A seemingly unexpected check was meant to allow the investigators to gather evidence. They did not want to spoil the plan before the net closed on the dealers. Jenny Nguyen had made Sergeant Mahar’s job a whole lot easier by forgetting to put on her seatbelt.

Ten days later, “Operation Candy Box” led to the arrests of 130 people and the seizure of 400,000 ecstasy tablets, a stash of weapons and $6 million in cash. The gang had been supplying drugs to 18 U.S. cities from Canada since at least 2002.

The customer is king

Thi Phuong Mai Le, the gang’s chief money launderer, was dubbed “Queen Bee” or “Big Boobs” by her associates. According to the FBI, the 38-year-old Vietnamese was capable of laundering $5 million of drug proceeds each month. The U.S. authorities estimate that at least $8 million passed through HSBC in Geneva. Thi Phuong Mai Le was sentenced to 15 years in jail in 2008.

HSBC’s two diamond-trading clients, on the other side, were able to continue their business without any fuss. In January 2005, nine months after the Americans made a request for mutual assistance regarding Alain Lesser’s role in “Operation Candy Box”, HSBC bankers proposed to set up an offshore company in order to enable him to evade Belgian tax.

The bankers were even more indulgent towards Anh Ngoc Nguyen, the Toronto-based diamond trader who received the drug proceeds directly on his Swiss account. When the United States asked Switzerland to block the $300,000 he held with HSBC, the bank advised him to hire the law firm Baker & McKenzie to oppose the order.

28-year-old Rodolphe Gautier, who came third in the Geneva young lawyers’ public-speaking contest in 2001, a sailing enthusiast and specialist in white-collar crime, managed to get the sequestration lifted on a technicality.

At this stage, HSBC could have quietly shown its diamond-dealing client the door and told him to launder his money elsewhere. They did not.

As soon as the freeze order was lifted, the bank allowed Ang Ngoc Nguyen to open a second account to transfer the funds targeted by the U.S. The diamond trader made the most of this opportunity, siphoning off $200,000 in the process. It took months of proceedings between the United States and Switzerland to have the second account seized. In 2007, the year Hervé Falciani’s stolen files stop, Anh Ngoc Nguyen was still a client of the Geneva bank.

The diamond dealer from Toronto may have duped the Swiss authorities, but the game was much less easier when he sat down for questioning with Special Agent McLeod. Arrested during a trip to the United States with his family, he quickly agreed to cooperate. The facts he revealed are damning for HSBC.

Anh Ngoc Nguyen’s testimony revealed that the Swiss bank had not just held the funds of a gang of Vietnamese drug dealers. Its coffers had for years played hosted a vast crime cooperative, where drug proceeds were used to finance diamond-trading and gunrunning activities. The diamond trader’s confession also put the DEA investigators back on the trail of an Israeli arms trafficker they had been following since 2001.

Anh Ngoc Nguyen explained that one of his main partners in the money-laundering diamond scheme was a man he had met soon after opening his Swiss account, in 2002. He only knew him as “Moshe”. The DEA had their suspicions about who this man might be. They showed Anh Ngoc Nguyen eight photos to verify their belief. He pointed the one of “Moshe”, whose real name is Shimon Yelinek.

Having identified their man, the Americans ramped up their investigation, and two new investigators were brought in to assist Special Agent McLeod. In return for Anh Ngoc Nguyen’s cooperation, the U.S. authorities dropped the charges of money laundering against him in 2010.

Gunrunning

The files Hervé Falciani spirited out of HSBC show that Shimon Yelinek, who was born in Israel on 23 January 1961, had been a loyal client of Edmond Safra’s Republic National Bank since 1995. Despite being implicated in major arms trafficking since 2001, he was allowed to keep his HSBC Private Bank accounts until at least 2007, at which point they contained a little over $850,000.

Shimon Yelinek performed his first deal at the age of 40. He and his wife Limor moved into an apartment on the 23rd floor of Edificio Mirage, one of the highest tower blocks in Panama City with a view across the bay to the old colonial city. His associates knew him as “Mr Simon”, and he used the codename “Sierra” when answering the phone.

A name and phone number for “Mr Simon” first appeared on a handwritten note found during a Belgian police raid, in 2001, as part of an investigation into a network trafficking arms and diamonds between Liberia and Sierra Leone.

This network allowed Al-Qaeda to purchase tens of millions of dollars’ worth of precious stones to escape the freezing of its bank accounts by the U.S. authorities in the months before the 9/11 attacks. The FBI gave Shimon Yelinek’s name to the Belgians after they had traced the number on the note.

The organization’s brain was a Lebanese Shiite diamond trader and gunrunner named Aziz Nassour. His trail leads to Geneva, too. Hervé Falciani’s stolen files reveal that Aziz Nassour had also held an account at the Republic National Bank since 1991. He closed it in 1997, just after Shimon Yelinek opened his.

Yelinek has never been prosecuted for his links with Al-Qaeda’s diamond suppliers. Oddly enough, it was a different affair that brought him down.

On 7 November 2001 the cargo ship Otterloo, a Panamanian-flagged vessel, unloaded 14 containers filled with 3,117 Kalashnikovs and 5 million cartridges at the Colombian port of Turbo. The weapons came from the Nicaraguan army supplies. On paper the cargo was meant to reach the Panamanian police, but Shimon Yelinek had made arrangements for it to be delivered to its true consignee: the AUC, a Colombian paramilitary group specialising in cocaine production and seaborne drug shipments.

Sadly for Yelinek, news of the delivery got out and the affair became known to the world as the “Otterloo incident”. A year later, Shimon Yelinek was arrested at Tocumen airport in Panama City.

HSBC could not have remained unaware of its client’s illegal activities. The Washington Post revealed the links between Shimon Yelinek and the Aziz Nassour/Al-Qaeda nexus at the end of 2002, and the international press had given wide coverage to his arrest in connection with the “Otterloo incident”. Yet the data we have obtained shows that Shimon Yelinek was able to hold onto his Swiss accounts throughout this period and for many years thereafter.

Even more startling information has also come to light. The DEA’s investigations into the Vietnamese dealers in Atlanta revealed that Shimon Yelinek was able to use his HSBC Private Bank account to buy his way out of a Panamanian jail in 2004. Details of money transfers from Ang Ngoc Nguyen’s account show that $465,000, paid to Shimon Yelinek by the dealers, was sent on to Panama in 2003 via another Swiss bank. One of the recipients of these funds was Shimon Yelinek’s lawyer in the “Otterloo Incident”. The half a million dollars from Switzerland presumably paid for more than just his lawyer.

In April 2004, as if by magic, Panama’s Supreme Court dropped the charges against Shimon Yelinek. In a diplomatic cable published by WikiLeaks in 2010, the chargé d’affaires at the U.S. Embassy in Panama described the abandoning of proceedings against the Israeli as “yet another example of Panama’s Supreme Court deep-sixing a high profile corruption case on trumped-up technicalities”. He stated that such “egregious corruption (…) poses a threat to U.S. economic and security interests in Panama”. The cable also indicated that the DEA would still keep a close eye on the gunrunner’s next moves.

Their investigations bore fruit seven years later. On 23 February 2011 the U.S. Department of the Treasury put Shimon Yelinek’s name at the top of an international sanctions list against a network laundering money for the Mexico’s Sinaloa drugs cartel, one of the world’s most powerful crime syndicates. Yelinek was under the direct authority of the Cifuentes drug trafficking network, a Colombian organization affiliated to the Sinaloa cartel.

Although he has still not been charged with any crime, this measure compels all banks to freeze Shimon Yelinek’s assets and disclose them with the U.S. authorities. The Department of the Treasury has extended these sanctions to his wife’s children’s clothing company.

HSBC has refused to say whether the accounts that belonged to its embarrassing client between 1995 and 2007 were still active when the U.S. authorities announced their sanctions in 2011.

The United States have not provided any precise details about Shimon Yelinek’s involvement with the Sinaloa cartel. Their links were well established, according to the U.S. Bureau for International Narcotics and Law Enforcement Affairs (INL). The Mexican organization had, for instance, approved the 2001 “Otterloo incident”. The arms deal had been planned by the Colombian cartel.

Should these suspicions be confirmed, HSBC might one day have to explain why its Geneva subsidiary silently sheltered a man it had known for years was involved in narcotics and arms trafficking, linked to Al-Qaeda and who turned out to be a private money launderer for Colombian and Mexican drug barons. On February 18, Geneva prosecutors searched the offices of HSBC Private Bank in Geneva as part of a probe into suspected ‘aggravated money laundering’.

Ongoing investigations

The heads of several cartels have been arrested in the United States and Mexico in recent months, and they are due to stand trial soon. The DEA and the Department of the Treasury refused to comment about “ongoing investigations”.

The HSBC manager responsible for Shimon Yelinek’s account, M. B., was a member of the MEDIS (Mediterranean, Diamonds and Israel) department. He left the bank in 2012 following the forced disbanding of his “desk” and his entire clientele. M. B. quickly found a job with another private bank in Geneva. He did not respond to the messages we left at his home. Shimon Yelinek reportedly now lives with his wife and children in Israel.

Thi Phuong Mai Le, the Vietnamese gang’s “Queen Bee”, was extradited from the United States and tried in Canada in August 2013. She broke down in tears at the witness stand and apologized to her daughter, whom she had not seen since her own arrest ten years earlier. Her daughter was six years old at the time.

This article was originally published in French in the Swiss newspaper l’Hebdo.

Original Documents of “Operation Candy Box” Court Cases:

– Testimony of Sergeant Sean Mahar

– USA vs Jenny Nguyen and Nhung Nguyen

– ARZI Bank complaint for forfeiture

– ARZI Bank motion for forfeiture",2015-02-21,Mr Simon and the Queen Bee: Traffickers Above Suspicion at HSBC
2015,2,https://www.bellingcat.com/news/uk-and-europe/2015/02/19/how-echosec-found-evidence-of-a-russian-fighting-in-ukraine/,/news/uk-and-europe/2015/02/19/how-echosec-found-evidence-of-a-russian-fighting-in-ukraine/,"

Originally posted on the EchoSec Blog, reproduced with permission.

Recently, the media has been paying close attention to the Donetsk region in northeast Ukraine. We decided to look for ourselves to see if we could identify military personnel of Russian origin in the area.

In a military, or global security context, the data pouring from this region can play a pivotal role in command, control, communications and coordination of operations.

Quick, informed decisions are the best decisions.

We used a systematic, 3-phase approach to find, filter, and investigate the social media coming out of Ukraine and Russia.

We started by using a systematic grid search to identify clusters and outliers, then reviewed each cluster and outliers for interesting information. Finally, we reviewed each piece of flagged information across multiple social media sources to correlate information and draw conclusions.

This investigation took us less than 6 hours, and the results were astounding.

Here is how we did it:

Initially, our analyst drew a box over the Donetsk region in Northeast Ukraine. The purpose of this large initial search is not to find posts immediately, but to determine where a large number of the posts are clustering. These clusters are going to be prioritized, then analyzed later for anything that stands out.

Upon further inspection of the clusters in the Donetsk region on January 23rd, our analysts found an individual of interest. Due to the nature of the data, no firm conclusions can be draw about the pictured soldier; however, he appears to have crossed the Russian boarder into Ukraine to join the fighting, only recently.

This particular soldier identified himself as Amigo Desperado, probably an alias. Our analyst then tracked him to using a different social media source, VK. VK is Facebook-like application popular in Russia. As can be seen in the picture below, we can find his date of birth, current city, and the location of several recent posts.

In the following picture, we can see that he was located in Russian territory in early December. He is clearly pictured with the Russian flag, a tank, and a group of men.

We then found a photograph of him 8 days later on December 22nd. The location associated with this post was from within the Ukrainian boarder.

Finally, we find a photograph that he has posted, where the location tag was directly from the Donetsk region. Using Echosec we tracked this individual from his Russian home to the center of the conflict within Ukraine. Further information about his identity, his motivations, and his associations can be derived from other social media accounts similar to VK.

While our analyst was looking at the Donetsk region, he saw a number of graphic social media posts that captured the severity of the conflict in the region. These posts included several graphic images of bodies, ordnance and other evidence of the conflict. We elected not to display these graphic images on our blog, however, a social media search near the Donetsk airport, or near Mariupol may yield similar results.

Ultimately, the Echosec social media search tool was an effective tool for finding interesting information that is publicly available online. An effective user can sort through large amounts of information quickly to find what he needs. This can include tracking a person of interest, finding out new information in a crisis situation or gathering actionable intelligence.

All information contained in this post is open source and implications or inferences made by this publication are solely views of the writer.

Written by: Jason Jubinville @jpjubinville.",2015-02-19,How EchoSec Found Evidence of a Russian Fighting in Ukraine
2015,2,https://www.bellingcat.com/news/mena/2015/02/19/from-russia-with-love-syrias-ak-74ms/,/news/mena/2015/02/19/from-russia-with-love-syrias-ak-74ms/,"

The AK-74M has slowly earned its place as the most popular assault rifle currently in use with the various factions fighting for control over Syria. While originally acquired only in small numbers by Syria, recent deliveries ensured a now solid presence of this rifle in the war-torn country. The AK-74M is not only popular with forces of the Syrian Arab Army and the Republican Guard, but also with various other groups fighting for control of the country.

Syia acquired its first batch of AK-74Ms in the late 90s, albeit in very small numbers. This very first batch was believed to have been part of a deal struck with Russia in 1996, which would renew the military and technological cooperation with Russia after this had dwindled due to the collapse of the Soviet Union.

The deal envisaged the delivery of a wide selection of small arms, anti-tank missiles, night vision equipment and ammunition for weaponry already in use by Syria. Included in the package were large numbers of AKS-74Us, smaller numbers of AK-74Ms, RPG-29s, PG-7VR warheads for the RPG-7 but also 9M113M Konkurs anti-tank guided missiles (ATGMs) and even 9M117M Bastion gun-launched anti-tank guided missiles for use by Syria’s at that point recently upgraded T-55MVs.

Disagreements over Syria’s insistence on lower prices and extended payment schemes for future purchases and its debt to Russia led to the failure of a deepened relationship between the two countries. Nonetheless, much of the ordered weaponry did ultimately reach Syria.

The first public appearance of the AK-74M in was in 2000, when it was spotted being carried by a guard in front of the National Progressive Front (NPF) headquarters in Damascus. This AK-74M belonged to the first batch, and these along with AKS-74Us were mainly distributed to special units and personnel guarding places of high value. The amount of AK-74Ms was still too small to allow a wider distribution.

The second attempt to acquire AK-74Ms (at a more ambitious scale this time) took place in the years leading up to the Syrian Civil War. The Syrian Arab Army (SAA) launched an ambitious modernisation programme aimed at improving the protection and firepower of a part of its infantry force during this time.

The SAA tested two assault rifles as part of this future soldier programme in 2008, the AK-74M and the Iranian KH-2002 ‘Kheybar’, chambered in 5.45×39mm and 5.56×45mm respectively. For this purpose, the Iranian Defense Industries Organisation (IDIO or DIO) sent ten KH-2002s along with several representatives to Syria.

All but two of the ten KH-2002s malfunctioned during the tests, resulting in a chuckle from the Syrian side at the expense of the ashamed Iranian representatives. Unsurprisingly, the AK-74M was thus declared the winner of the ‘competition’

After Uruguay’s interest in the KH-2002 also vanished, the programme was cancelled in 2012. The failure to attract any export orders and a lack of interest from the Iranian Army to purchase the rifle doomed one of the few serious attempts to design and produce an indigenous assault rifle in Iran.

The programme also saw the manufacturing of two types of ‘new’ camouflage patterns, both exact copies of the US M81 woodland camouflage pattern, which is also worn by fighters of Hizbullah. Furthermore, large numbers of bulletproof vests and helmets were ordered and delivered from China, and a limited number of night vision devices for special forces were received from an unknown source. The soldier seen below depicts how the final product would have looked like. Note that his AK-74M comes equipped with an Alpha-7115 night laser sight and a GP-30M under-barrel grenade launcher.

Russia continues to prove it’s a staunch and reliable supporter of the Assad regime, and the Civil War evidently serves as no deterrent for Russia to continue delivering anything from small arms to tanks, multiple rocket launchers and even spare parts for the Syrian Arab Air Force (SyAAF). To no one’s surprise, several large batches of AK-74Ms also found their way onboard Russian Navy Ropucha-class landing ships to Syria in the past years.

Once arrived in Syria, these batches allowed for a wide distribution of the AK-74M within the Syrian Arab Army and, to a lesser extent, the Republican Guard. The National Defence Force (NDF) still has to make do with the old AK-47, Type-56 and AKM however, although Western firearms or ‘pimped’ AKs acquired via the black market in Lebanon are also available.

The Republican Guard’s 104th Brigade, under the command of Brigadier General Issam Zahreddine, received a sizeable batch of AK-74Ms and AKS-74Us when heading off to Deir ez-Zor to take on the fighters of the Islamic State.

The AK-74M is also the weapon of choice of Saqr al-Harath (seen below on the left), who serves as Issam Zahreddine’s personal bodyguard in Deir ez-Zor. Although Zahreddine’s personal firearm is the AKS-74U, he has also been seen using the AK-74M on more than one occassion.

The Islamic State is the largest AK-74M operator of the groups fighting for control over Syria. Surprisingly, and contrary to the usual weapons flow which mainly sees captured M16s and M4 rifles and carbines transferred to Syria from Iraq, numerous AK-74Ms also ended up with fighters of the Islamic State in Iraq.

The AK-74M itself is a modernised variant of the AK-74, and entered production in 1991. It not only provides more versatility compared to the AK-74, but is also lighter and features a new synthetic side-folding stock. This opposed to the earlier AKS and AKMS, which both use the typical under-folding stock.

Various types of Russian optical sights can be fitted to the AK-74M to ensure more precise targeting. These sights are fitted to the standard mounting rail on the left side of the receiver. In Syria, AK-74Ms equipped with such sights are more common than AK-74Ms using the standard iron sight.

The quantity of optical sights and under-barrel grenade launchers received by Syria in the past years was large enough to allow installment on numerous AK-47s, Type-56s and AKMs.

A number of AK-74Ms were also equipped with NSPU night vision sights. Only a limited number of such sights are available in Syria, and they have seen sporadic use throughout the course of the Civil War.

The AK-74M can also be equipped with a single-shot 40mm under-barrel grenade launcher, two types of which were acquired by the Syrian Arab Army to date: the GP-25 and the GP-30M. The first is intended for use on older generation rifles while the GP-30M was designed for more modern assault rifles such as the AK-74M or AK-103.

The GP-30M can engage targets in a range of 100m to 400m and is capable of firing fragmentation grenades and smoke grenades. It is aimed by the means of a quadrant sight.

The AK-74M: A rifle both dreaded and loved on the Syrian battlefield, and sure to continue to play a large role in the course of the war now that peace seems ever more distant.",2015-02-19,"From Russia with Love, Syria's AK-74Ms"
2015,2,https://www.bellingcat.com/news/uk-and-europe/2015/02/17/origin-of-artillery-attacks/,/news/uk-and-europe/2015/02/17/origin-of-artillery-attacks/,"

Summary

Ukrainian armed forces positioned near the Russian-Ukrainian border were attacked by artillery fire in the summer of 2014. Between 9 July and 5 September 2014, the Ukrainian Border Service and the National Security and Defense Council reported more than 120 artillery attacks from Russia. Russian officials, however, have denied the existence of any artillery attacks on Ukraine originating from its territory.

The pressure of sustained artillery attacks through early August led Ukrainian armed forces to lose control of hundreds of kilometers of border territory. Google Earth satellite images of eastern Ukraine from July, August, and September 2014 have enabled the Bellingcat investigation team to find evidence of these artillery attacks, determine their origin, and compare them with local sources.

After reviewing and analyzing these satellite images as well as videos from social media, local media reports, and the shifting maps of the ongoing conflict, the Bellingcat investigation team has determined that there is compelling evidence that artillery attacks on Ukrainian territory and against Ukrainian armed forces originated from the territory of Russia.

A PDF version of this report can be found here.

Deutsche Version des Berichts.

Introduction

In July 2014, Ukrainian armed forces launched an “anti-terrorist operation” against pro-Russian separatists and made significant territorial gains in eastern Ukraine, regaining control over a large portion of the Russian-Ukrainian border.

However, on the morning of 11 July 2014, the situation suddenly changed. A massive and unexpected artillery attack on units in the Zelenopillya region killed 30 and wounded over 100 soldiers. In the days and weeks that followed, the units at the border were subjected to dozens of additional artillery attacks. By late July 2014, the massive bombardment reversed Ukrainian gains and contributed to the encirclement of portions of the Ukrainian armed forces. A separatist offensive across eastern Ukraine began simultaneously with the artillery attacks, leading to the separatists capturing much of the Russian-Ukrainian border along with vast areas of the Donetsk and Lugansk oblasts.

Artillery attacks on Ukrainian forces near the border proved to be an important factor in turning the conflict in favor of the separatists. Using in-depth analysis of satellite imagery and social media sources, this Bellingcat investigation brings new evidence to help clarify to the origins of these artillery attacks against Ukrainian armed forces.

Research methods and sources

The starting point for this Bellingcat investigation was the distribution of updated satellite imagery from Google (DigitalGlobe satellite imagery) with a panchromatic resolution of 0.5m from the territory of eastern Ukraine and its border regions with Russia (17 July to 31 August 2014 satellite images). Additionally, the Bellingcat investigation team analyzed videos shared on social media (YouTube and VKontakte) and geolocated the events captured in these videos to key sites involved in the artillery attacks on Ukraine.

From the satellite imagery, the Bellingcat investigation team located artillery impact crater fields from artillery fire and conducted extensive analysis on a crater-by-crater basis. In the examination of each area, our team created a novel analysis method based on internationally-recognized ‘on-the-ground’ procedures to determine the trajectory of the artillery fire.

The satellite images from eastern Ukraine show two main types of craters, low-angle fuze quick craters (with distinctive ‘side spray’ areas projecting diagonally from a central crater) and high-angle shell craters (triangular-shaped craters that spread outwards towards the origin of fire):

Both types of craters are suitable for determining the trajectory of artillery fire. In reality, the trajectory of the projectile is determined by a variety of factors, such as the type and hardness of the ground struck, wind direction and speed, and the type of projectile. Our team adopted a simple linear trajectory in our analysis, but the actual trajectory may vary somewhat due to the aforementioned factors.

The Amvrosiivka attack 14 July 2014

In a 14 July 2014 summary of the “anti-terrorist operation,” Ukrainian media reported that an attack took place on positions of the Ukrainian armed forces in the vicinity of Amvrosiivka. It was suspected that the origin of this attack was from the territory of Russia.

On the satellite image below, taken on 16 July 2014, an extensive crater field south of Amvrosiivka is visible, located at the coordinates 47°45’52.38″N 38°30’47.65″E.

The Bellingcat investigation team counted a total of 330 craters in this crater field, and determined the observable direction of each impact crater based on the analysis methods previously described. From these 330 craters, the average trajectory was calculated, and was determined to be 193.97°, i.e. from the south-south west (180 ° being due south). When screening for possible firing positions from this trajectory, the Bellingcat investigation team found a firing position 14.6km from the crater field. Burn marks are visible at this location, which is on Russian territory and approximately 750m from the border near the Russian village of Seleznev at the coordinates 47°38’13.52″N 38°28’9.69″E.

Based on our crater analysis, we judge that these were very likely the five firing sites that caused the craters near Amvrosiivka. There are several pieces of evidence that lead us to believe that these strikes were performed by five 122mm BM-21 Grad or 9K51M Tornado-G Multiple Rocket Launcher Systems (MLRS) as opposed to BM-27 Uragan, the BM-30 Smerch, or other types of field artillery.

It is well known that BM MLRS create large areas of smoke behind them during and after firing, of which many examples are available online. This area of intense smoke and heat results in burned/singed ground behind the MLRS, and are visible from Google map satellite images. Such burned areas are visible at the firing position considered for the Amvrosiivka attack, and so we judge that these were very likely MLRSs.

Analyzing the satellite imagery of the firing position also gave us evidence for determining the type of MLRS most likely used to conduct the artillery attack.

The tracks of the vehicles that entered and exited the field to reach their firing positions are visible from the satellite imagery. This leads us to believe that there was no cross-border (Ukraine to Russia) movement of military equipment for this particular location.

In the Russian military three MLRS systems are primarily used (see Figure Russian MLRS systems).

The measurement of the average track width from the satellite images yielded an average value of 2.40m. As the resolution of the satellite images is 0.5m, the tolerance for this measurement is 1.9 to 2.9m. In comparison, the widths of the BM-21/Tornado-G, BM-27, and BM-30 are 2.4, 2.8, and 3.1m, respectively. The track width determined from satellite imagery is suggestive of a smaller vehicle, but because of the potential error due to imagery resolution, this is not conclusive.

Using the satellite images, we were able to determine the turning radii of the vehicles. The smallest turning radius was measured as 14m. The BM-27 and BM-30 MLRS have two steered front axles, so if they were used in this instance, we would expect to see evidence of two overlapping sets of wheel tracks in the turns leading to or from the firing position. However, the satellite image shows only the traces of one clear, single track. Based on this evidence, we conclude with high probability that a BM-21 Grad or 9K51M Tornado-G was used for this attack.

The visible traces of the vehicles also fit well for the typical spacing of BM-21/Tornado-G systems in battle formation (see the image above for the spacing of the units visible from the satellite image).

Our investigation of this attack shows that the average trajectory of the craters pointed toward the direction of the suspected firing positions with a high degree of accuracy; the maximum-to-minimum deviation of the analyzed crater angles is only 0.2%. Additionally, a measurement in the other direction, extrapolating the trajectories of the visible burn marks at the firing position, revealed that the trajectories led directly to the center of the artillery crater field.

Artillery attacks in the Chervonopartyzansk region 14 July to 8 August 2014

In early July 2014, units from the 72nd Motorized Brigade, the 79th Airmobile Brigade, the 24th and 51st Mechanized Brigades, and elements of the 3rd Separate Special Forces Regiment were tasked with securing the Russian-Ukrainian border south of the separatist-held towns from Marynivka to the Izvaryne checkpoint. This area, covering over 150km of border, was known as “Sector D”.

From the end of the ceasefire on 1 until the 11 July 2014, Ukrainian units advanced quickly and found relatively little resistance until they reached the Chervonopartyzansk/Gukovo checkpoint. Then, the situation changed dramatically. The Zelenopillya artillery attack against Ukrainian forces on 11 July was followed by artillery attacks against large conglomerations of Ukrainian units in the area close to Dolzhanskaya-Capital mine and Panchenkove, Chervonopartyzansk, Khmelnytskyi, Biryukove, Dolzhanskyi border control point, and the Dyakove region. As the world diverted their attention on the horror of the Malaysian Airlines Flight 17 (MH17) shoot down on 17 July 2014, the situation sharply deteriorated for the Ukrainian units on the eastern border.

On 22 July 2014, Dmytrivka, a town on the supply road to Sector D, came under attack from separatists. For the next two weeks, transport along the roads east of these towns greatly limited resupply and reinforcement for the trapped units (see examples here, here, and here). From interviews and media reports, it was evident that conditions were dire. Despite this, the units on the border continued to hold their positions.

On 3 August, a breakthrough by Ukrainian units in the west unblocked a potential resupply route (between Dyakove and Dmytrivka) to the beleaguered units on the border. That same day, pro-Russian forces sharply increased the number of attacks against the trapped units on the border. Out of ammunition, on 4 August, over 400 Ukrainian soldiers from the 72nd Mechanized Brigade fled across the border to escape the constant bombardment. By 8 August, the remainder of the 72nd and 79th brigades had broken out of the encirclement, and around 1,000 survivors were able to regroup with other units near Savur-Mohyla.

Massed artillery attacks upon Ukrainian units in the border region east of Dmytrivka were undoubtedly a key factor in the retreat of Ukrainian units from Sector D. However, until now, the trajectories and firing positions of the artillery attacks that led to this defeat have not been analyzed. In the following section, we analyze two of the largest visible artillery attacks close to Chervonopartyzansk and Sverdlovsk, where Ukrainian units were hit by hundreds of visible artillery shells during July and August 2014.

The Dolzhanskaya-Capital mine/Panchenkove attacks 14 July 2014 to 8 August 2014

On 14 July 2014, consistent accounts emerged in both Ukrainian and Russian media outlets that clashes took place in the vicinity of the mine called ‘Dolzhanskaya-Capital’, close to the Ukrainian town of Panchenkove.

Significant disruptions to the mine’s power system affected pumps and the ventilation system, leading to the evacuation of 278 miners.

The satellite image from 8 August 2014 shows the cause of the power outage: large amounts artillery fire that destroyed several electricity poles in the vicinity of the mine. Analysis of the damaged electricity poles and their connections suggested that the only lines leading directly to the mine were affected. Therefore there was no evidence to suggest that power to nearby towns was disrupted due to this attack.

The Bellingcat investigation team researched media reports from mid-July to confirm attacks from this time period. Official Ukrainian government sources reported artillery attacks on 23 July and 1 August, and Ukrainian media sources also reported attacks in this area on 16 and 24 July, and 1-4 August. The following comparison of maps provided by separatist sources shows the course of the battles in July and August throughout the region and also suggests several specific dates for attacks on Ukrainian forces.

The Bellingcat investigation team analyzed a number of videos shared on YouTube and VKontakte (VK), Russia’s most popular social networking site. From these sources, it was established that at least two attacks occurred on 16 July 2014.

Next, our team analyzed the crater field near the Dolzhanskaya-Capital mine outside of the village Panchenkove by using satellite imagery from 8 August 2014. A total of 813 craters were measured.

Analysis of the calculated trajectories in the attacked crater field reveals that there were six separate attacks from five different directions.

With maximum differences of 300m at a shelling distance of 15km, all of the calculated trajectories can be traced to five separate firing positions. Every one of these – with the exception of the position near Chervonopartyzansk, Ukraine, which is close to the border – is clearly within the territory of Russia.

The firing positions, from north to south, were located in the following positions:

1) Near Nizhnyaya Kovalevka, Russia at 48°07’51.4″N, 39°54’02.4″E

2) Near Chervonopartyzansk, Ukraine at 48°03’03.2″N, 39°49’52.2″E

3. Near Pavlovka, Russia at 47°56’28.1″N, 39°49’12.0″E

4. Near Ukrainskiy, Russia at 47°58’23.0″N, 39°51’01.5″E

5. Near Gukovo, Russia at 48°03’33.1″N, 39°57’22.6″E

The firing position near Gukovo is particularly noteworthy because numerous videos have been shared on social media showing artillery fire. The firing position shown in these videos will be examined separately in the following section.

The Bellingcat investigation team has also found that at all of the firing positions except one (Chervonopartyzansk), vehicle tracks show both an arrival from and departure to areas within Russia. In other words, in four out of five cases there were no observable tracks linking the firing positions to Ukrainian territory, and all the observable tracks near the firing sites were exclusively within the territory of Russia.

The firing position near Gukovo

On 17 July 2014, a series of videos were shared on YouTube and VK showing an attack with MLRS launchers. The attack occurred on 16 July 2014 in the vicinity of Gukovo, Russia. This attack has already been located by a number of blogs and articles, for example by the Interpreter Magazine.

The Bellingcat investigation team has found six videos on social networks that show the events of 16 July 2014 near Gukovo. Two of these videos were captured from the edge of the Kovalevsky pond on the afternoon of 16 July 2014.

Video001

г. Гуково (РФ), град бьет по Украине

“City of Gukovo (RF), a Grad strikes at Ukraine”

added 16.07.2014

Camera location 48°4’30.76″N 39°55’36.94″E

Alternative link: https://www.youtube.com/watch?v=6SIDxVxdIjw

Video001 shows several MLRS salvos west of the pond. This video has been successfully geolocated a number of times by various journalists, bloggers, and open source investigators.

Video002

Обстрел ГРАДами территории Украины. г. Гуково, Ростовская область.

“Bombardment of the territory of Ukraine with Grads, city of Gukovo, Rostov oblast“

16.07.2014, 17.05 (MSK)

added 16.07.2014

Camera location 48° 4’15.08″N 39°55’24.16″E

Alternative link: https://www.youtube.com/watch?v=zRCjUPa7qHU

Video002 shows burning fields northwest of the same pond that appears in Video001. It was suspected at the time that this fire came from MLRS launchers.

Other Grad rocket volleys were documented in four other videos on the same day in the evening. Each of these videos was captured exactly at sunset, leading to our determination that the videos were captured at approximately 19:15 (MSK, local time).

An important feature of this collection of videos is that each was captured from different angles facing the firing position. The Bellingcat investigation team was able to precisely determine the location of the firing position from the exact locations of the cameras and the angle and positions of the Grad launchers in each video.

Video003

Град в Гуково

“Grad in Gukovo”

added 16.07.2014

Camera location: 48°03’59.0″N 39°55’36.2″E

Alternative Link: https://www.youtube.com/watch?v=edE_FshuF2U

Video003 was captured from a cherry tree on a residential plot on Bazarnaya Street 84 in Gukovo. The identifying features of this video include buildings in the center of the video, the cherry tree as camera location, and the angle and distance from the firing position.

Video004

Залп российских ГРАДов из Гуково в сторону Украины

“Salvo of Russian Grads from Gukovo in the direction of Ukraine“

added 16.07.2014

Camera location: 48° 4’29.80″N 39°55’36.07″E

Alternative link: https://www.youtube.com/watch?v=8F9WFkA9C08

Video004 shows the firing position on the southwest side of Kovalevsky pond. The identifying landscape features in this video are the solitary tree on the right side of the camera’s perspective, the big bush in roughly the middle of the perspective, and the utility poles on the far left side of the perspective.

Video005

Град Гуково,Ростовской обл.,Россия по Украине Russian attacked Ukraine from Gukovo, Rostov Oblast

added 16.07.2014

Camera location: 48° 4’24.30″N 39°55’37.12″E

Alternative link: https://www.youtube.com/watch?v=6ufW8UxbkpM

The firing position in Video005 is visible from the southwest side of Kovalevsky pond. The identifying landscape features in this video are the same as Video004: a big bush, and utility poles.

Video006

Обстрел территории Украины из Гуково, россия

“Shelling of the territory of Ukraine from Gukovo, Russia”

Added Jul 16, 2014 at 10:18 pm

Camera location: 48° 3’33.15″N 39°57’22.60″E

Alternative link: https://www.youtube.com/watch?v=TsmcdunS0LA

Video006 was captured from a residential building on Botanicheskaya Street 7a in Gukovo. The identifying features of this video include a building on the right side of the video, another building on the left side, the road below, and the angle and distance from the firing position.

On the satellite image below, taken 8 August 2014, the intersection of the lines clearly shows two visible burns, marking the firing position.

The positions of the cameras in the previous videos clearly point to a firing position north of Platovo. These firing positions are visible from satellite imagery of the burned fields (image above).

As evident from the satellite imagery, there are two visible firing positions for four Grad MLRS launchers at 48°05’25.0″N 39°54’45.3″E. The Bellingcat investigation team has measured the direction of the traces of fire and calculated a trajectory for each firing position.

The calculated trajectories of the burn marks point towards two different crater fields on Ukrainian territory (image below). After analysis of the individual craters in the artillery strike site, we found that the calculated trajectories of the firing positions fit almost exactly the two trajectories determined from the artillery crater analysis of the crater field near Dolzhanskaya-Capital mine.

Thus, from the evidence of crater field analysis, social media geolocation, and local media reports, the Bellingcat investigation team has determined that the artillery attacks on the Ukrainian armed forces positions near the Dolzhanskaya-Capital mine were conducted on 16 July 2014 from firing positions near Gukovo, within the territory of Russia.

Video footage of the aftermath of the attacks

On 12 August, the separatists, via their so-called “Information and Analysis Agency South East” posted two videos entitled “Destroyed position of the ‘heroic’ 72nd Brigade APU near Sverdlovsk, Lugansk region.”

The Bellingcat investigation team has located the camera position of these videos as being in the crater field in the vicinity of the Dolzhanskaya-Capital mine.

The same destroyed military vehicles are clearly visible in the 8 August 2014 satellite image from Google Earth, taken just after the Ukrainian forces pulled out of this border area.

These videos show the extent of the destruction of the Ukrainian forces’ equipment based close to the Dolzhanskaya-Capital mine. Many heavily damaged trucks and armored vehicles are visible in the video, including a truck, several BMP-2 units, a self-propelled artillery unit, BM-21 ‘Grad’ launchers, and tanks.

The Khmelnytskyi attack 25 July 2014

On 28 July 2014, the Russian news agency Ruptly published a video on YouTube entitled”Ukraine: Battle aftermath litters after Sverdlovsk militia pummels 72nd Motorized Brigade.”

Several abandoned and damaged armored vehicles are visible in this video. The video description also gives us a date for the attack:

Ukrainian Army BMP-2, MT-LB and rocket launchers were left abandoned near Sverdlovsk on Saturday, after the 72nd Motorized Brigade suffered heavy losses during mortar shelling from the Lugansk People’s Militia on Friday. Lugansk People’s Militia has said that heavy losses were suffered by the Ukrainian army in both hardware and personnel after the Kiev troops were hit by the 12mm [sic] mortar shells.

The video was released on 28 July 2014, which means that the day of the attack (the previous Friday, as mentioned in the description) was the 25 July 2014.

Using the video footage, the Bellingcat investigation team has located the camera location of the Ruptly video as being a crater field close to the village of Khmelnytskyi, south of Sverdlovsk.

Analyzing the satellite imagery, The Bellingcat investigation team found a total of 209 craters. We were also able to determine three primary attack trajectories.

The trajectories of nine craters point directly east (green line). Two other trajectories (red and cyan lines) originate in a southeasterly direction. All three trajectories clearly point to firing positions within Russian territory.

These firing positions are directly connected to the military camp of the Russian army near Pavlovka and a smaller firing position close to Malyy.

Conclusion

The Bellingcat investigation team used internationally-recognized methods and satellite imagery to analyze a total of 1,353 artillery craters in eastern Ukraine and determine their trajectories. We located firing positions that closely matched these trajectories, all of which were inside Russian territory with one exception (which was less than 2km from the Russian border).

Three artillery attack case studies were investigated in this report: Amvrosiivka (14 July 2014), between Dolzhanskaya-Capital mine and the village of Panchenkove (16 July to 8 August 2014), and Khmelnytskyi (25 July 2014). Artillery crater analysis concluded that there were a total of ten primary attack trajectories across all the case studies. From each of these attack trajectories a firing position was identified. Nine of these firing positions were – without any doubt – within the territory of Russia, with three within 400 to 800m of a military camp. The one position in Ukraine was near Chervonopartyzansk, within the territory of Ukraine 1.2km south, and 1.5km north of the border with Russia.

The target trajectory of three firing positions was determined through analysis of scorch marks created by MLRS fire. All three of these trajectories led precisely to the target area of the crater field, allowing our team to calculate the trajectories in both directions (i.e., from crater field to firing position and from firing position to crater field). Vehicle tracks are also visible and showed clearly that they originated from, and led back to Russian territory near seven firing positions.

The firing position for an attack on 16 July 2014 in a field north of Gukovo, Russia was documented in a series of videos found on social media. Four of these videos show the same instance of 122mm MLRS fire from different perspectives. By comparing the video locations and views, the Bellingcat investigation team was able to geolocate the exact firing position. With a small deviation (300m at a shelling distance of 15km), the firing position geolocated through video analysis was the same as that from the crater analysis.

This study has provided compelling evidence that a series of artillery attacks on Ukrainian territory were conducted between 14 July and 8 August 2014 from firing positions within Russia. The first attack on 14 July 2014 originated from Russian territory near the Russian village of Seleznev and was directed towards positions of the Ukrainian armed forces south of the Ukrainian village of Amvrosiivka. Four attacks were conducted near Gukovo, Russian on Ukrainian armed forces close to the Dolzhanskaya-Capital mine and the village of Panchenkove between 16 July and 8 August 2014. Two additional attacks were conducted on this area from Russian territory north of Gukovo. On 25 July 2014, an artillery attack was conducted on the positions of the Ukrainian 72nd Mechanized Brigade near Khmelnytskyi village, south of Sverdlovsk. These attacks also came from locations within Russia, specifically from a military base in Pavlovka and a position east of the village of Malyy.

Acknowledgments

Based on the original work of Sean Case

The Investigation team:

Timmi Allen

Sean Case

Eliot Higgins

Veli-Pekka Kivimäki

Iggy Ostanin

Aric Toler

Editorial support provided by Nathan Patin

This report was created collaboratively using Slack.com",2015-02-17,Origin of Artillery Attacks on Ukrainian Military Positions in Eastern Ukraine Between 14 July 2014 and 8 August 2014
2015,2,https://www.bellingcat.com/news/africa/2015/02/16/hsbc-and-shimon-yelinek-arms-drugs-diamonds-and-terrorism/,/news/africa/2015/02/16/hsbc-and-shimon-yelinek-arms-drugs-diamonds-and-terrorism/,"

#Swissleaks

Shimon Yelinek is an Israeli businessman based in Panama. Behind this facade however, he is one of the most notorious criminals you may find among the clients of HSBC Private Bank (PB). An arms, diamonds and drug trafficker, he also took part in the financing of terrorism. His most impressive deal? The Otterloo Incident. At the end of the year 2001, a cargo of 3,117 AK-47s and 5 million rounds of ammunition is disembarked from the Otterloo ship in the port of Turbo, Colombia. Purchased from the Nicaraguan military, the weapons were intended to be delivered to the Panamanian National Police. However, Yelinek made sure they reached instead the United Self-Defense Forces of Colombia, a right-wing paramilitary group.

Born in Israel in 1961, Yelinek developed his skills and network of arms dealing in Africa between 1980 and 2001. In the 1980s and 1990s, Yelinek was the head of the security forces for the infamous Mobutu Sese Seko, the then dictator of Zaire (current Democratic Republic of Congo). It is during this time that he became acquainted with Aziz Nassour, a Lebanese diamond dealer. Close to dictator Mobutu, Nassour exported diamonds from Liberia and Sierra Leone to Antwerp, Belgium. At the time, both Mobutu and Nassour were either current or prospective clients at the HSBC PB.

In 2001, Al-Qaeda contacted Aziz Nassour. The terrorist group wanted to avoid fiscal sanctions by moving its cash away from the bank and investing it in diamonds, and decided to contact Nassour to facilitate the transactions. After the attacks targeting the two American embassies in Tanzania and Kenya, Al-Qaeda needed to preserve its liquidity in order to prepare the 9/11 attacks. The diamond market in West Africa was the perfect target, as a report from the NGO Global Witness describes the specific stages of the deal. In December 2000, two members of Al-Qaeda, Ahmed Ghailani and Fazul Abdullah Mohammed, approached Nassour in Kinshasa. They were well known for their participation in the terrorist attacks against the American embassies in Dar es Salaam and Nairobi in August 1998. The contact between the Al-Qaeda operatives and Nassour appeared promising.

At the time, Aziz Nassour was working along with his cousin Samih Ossaily on a deal that sought to buy diamonds from the Revolutionary United Front (RUF). Supported by President Charles Taylor, the RUF was attempting to replicate in Sierra Leone the successful violent takeover achieved by Taylor in Liberia. It was a done deal: the RUF needed to sell diamonds and Al-Qaeda was interested.

What role did Yelinek play in this affair? As part of the deal, Nassour committed himself to provide weapons to President Taylor and the rebel group he was helping, the RUF. At the end of 2000, Nassour contacted his old friend. Based at the time at the Marriott Hotel in Miami and answering the phone with the code name “Sierra”, the Israeli arms dealer forwarded the request to his colleague Ori Zoller. Ex-member of the Israeli special forces, Zoller owned an arms business in Guatemala. This proved to be a wise choice: Zoller was taking part in the Otterloo Incident that was unraveling itself.

Documents from the Belgian police (“Case Libi” and prosecution file) obtained by The McGill International Review (MIR) with the assistance of a few other journalists, along with emails (see the Global Witness report) between Yelinek et Zoller describe the composition and technicality of the deal. The cargo was supposed to contain AK-47s, rocket-propelled grenades, anti-aircraft guns, and anti-tank launchers. To bypass the United Nations embargo on weapons that was affecting the Liberia at the time, Nassour obtains an Ivorian end-user certificate (EUC). Used in international transfers, this document certifies that the buyer is the only user of the goods.

However, the deal collapses. At the beginning of 2001, Ali Darwish, a diamond dealer from Sierra Leone, decided to hand himself into the authorities. He was the one who put Nassour in touch with Ibrahim Bah, President Charles Taylor’s confidant and close ally to the rebels of the RUF. He informs the American authorities of the illegal arms trafficking taking place. They do not intervene but the trust that once allied the RUF and the arms and diamond dealers is now shattered.

Simultaneously, the discovery of the Otterloo Incident caused a scandal in the Latino-american press. Yelinek is in the spotlight. He is tried and jailed in Panama between 2002 and 2004. Thanks to some bribes using the money from his HSBC account, he was released, then vanished into thin air. He reappeared in 2011 when he was the subject of a joint Drug Enforcement Administration (DEA) and US Department of the Treasury investigation on his supposed links to the Colombian drug trafficking network of Cifuentes Villa. This network is tied to the infamous and violent Mexican cartel of Sinaloa.

The data retrieved by French newspaper Le Monde and Swiss newspaper l’Hebdo in the “Swissleaks” documents indicates that Yelinek was allowed to maintain his accounts at HSBC PB until 2007. At that time, Yelinek still had 860,000 dollars in this institution. These bank accounts were linked to shell corporations: Ubicon Corp. and Fenco Holding Inc. With the collaboration of journalists from the German newspaper Süddeutsche Zeitung, MIR managed to obtain the certificates of incorporation of these two companies. Already owning shell corporations in Panama, Yelinek wanted to diversify. The original documents show that Ubicon Corp. and Fenco Holding inc. were created in April and June 2004 in the British Virgin Islands under the name of Yelinek and his wife, Limor Yelinek, respectively .

Despite his history of gun-running and money-laundering on behalf of a Colombian cartel, HSBC PB did not command the closing of Yelinek’s bank accounts. However, the Geneva branch could not simply ignore the illegal activities of its client. He had been named multiple times between 2000 and 2011 in investigations carried by American, Belgian and Latino-American security agencies.

Even more compelling, the Washington Post mentioned Yelinek in its investigation on the diamond network of Al-Qaeda in West Africa in 2000. After the 2001 Otterloo Incident, his name was making headlines in the Latino-american press. HSBC PB is then complicit. Was it conscious or not? This has yet to be determined. With so many warning signs and evident symptoms of illegal activities, ignorance is not a sufficient excuse for HSBC’s lack of response.

This article was produced through the collaboration between the McGill International Review (Aliaume Leroy), Le Monde (Serge Michel), l’Hebdo (François Pilet) and the Süddeutsche Zeitung (Bastian Obermayer).",2015-02-16,"HSBC and Shimon Yelinek: Arms, Drugs, Diamonds and Terrorism"
2015,2,https://www.bellingcat.com/news/uk-and-europe/2015/02/14/monitoring-the-ukrainian-ceasefire-with-silk-and-checkdesk/,/news/uk-and-europe/2015/02/14/monitoring-the-ukrainian-ceasefire-with-silk-and-checkdesk/,"

Following the success of our Ukraine Conflict Vehicle Tracking Project Bellingcat is now starting a new project to monitor the Ukrainian ceasefire that comes into effect at midnight local time. As with the earlier project, Bellingcat will be using Checkdesk to crowdsource reports of ceasefire violations, and to also attempt to verify those reports. Once reports are verified they will be added to a Silk database allowing us to create a map of verified ceasefire violations embeddable on any website.

For this project, Checkdesk will be organised slightly differently from the Ukraine Conflict Vehicle Tracking Project. As before, we’ll be using Bellingcat’s Checkdesk, with users submitting links through the Submit Report option at the top of the page, but as we expect multiple reports to be linked to specific incidents each update will relate to an incident rather than individual reports.

For those of you who wish to participate this will be a chance to practise your skills at investigating social media, looking for information on events. If a violation is reported you should look at sites like YouTube, VKontakte, Twitter, Facebook and others, going keyword searches using the location names and other related words in Ukrainian and Russian. Text only posts from individuals in the local areas can be useful in these circumstances, as they help build a picture of what’s going on in those areas, that can be further verified with photographic and video evidence.

Visit Checkdesk to submit reports to the Monitoring the Ukrainian Ceasefire page.

Submitting data through Checkdesk

Checkdesk is a platform that allows users to collaborate on the verification of reports, videos, photographs, and other information. We also hope that by making the process as open as possible we encourage our readers to participate in the discovery and verification process, giving them the opportunity to learn about verification and giving those who already have experience verifying content chance to share their knowledge.

Using Checkdesk couldn’t be simpler. A Checkdesk story (example here) is made up of updates, and each update is generally based around verifying individual elements of a story, be it an image or a claim made about the story. Anyone can add verification footnotes to an update, and once “journalists” (site moderators) decide the update is verified or not they can update the status to False, Verified, Undetermined, In Progress, or Not Applicable (example here).

The following are guides and other resources on verification:

Tools

Google Earth Pro – Now free.

Clip Converter – Video saving site.

Keepvid – Video saving site.

Tube Offline – Video saving site for videos from VK.com.

Archive.org – Site for archiving web pages.

VLC Media Player – A free and light weight media player with various useful tools and options.

Paint.Net – Free digital photo editing software.

Guides

A Beginner’s Guide to Geolocating Videos

Verification and Geolocation Tricks and Tips with Google Earth

Geolocation Techniques – Mapping Landmarks

Open Source Information in Conflict Zones

War and Pieces – Social Media Investigations

The Verification Handbook",2015-02-14,Bellingcat Launches Monitoring the Ukrainian Ceasefire with Silk and Checkdesk
2015,2,https://www.bellingcat.com/news/uk-and-europe/2015/02/13/as-eastern-ukraine-heads-towards-the-ceasefire-russian-armour-heads-towards-ukraine/,/news/uk-and-europe/2015/02/13/as-eastern-ukraine-heads-towards-the-ceasefire-russian-armour-heads-towards-ukraine/,"

With the start of the Minsk ceasefire less than 48 hours away, a column of 38 BTR-80 armored personnel carriers (APC) was observed traveling north along the M18/E105 highway in Crimea on February 13, 2015. Their destination, as far as the videos show, is to Dzhankoi, a city lying just a 40km drive from the Ukrainian border. Russian military exercises for the Black Sea Fleet were ongoing at the time of the convoy, ending on February 14. This column of BTR-80 vehicles, many of which are marked with specific identifying numbers and markers, was first observed in two separate videos traveling north along the M18/E105 highway between Krasna Zor’ka and Novoandriivka, then later about 70 kilometers north on a major street in the city of Dzhankoi. In all three videos, the column of BTR-80 vehicles are headed north towards Dzhankoi. It is unclear if these 38 vehicles were involved in the military exercises, but one Crimean news source believes so.

A three videos that emerged on February 13 show the north-bound convoy appeared on February 13, 2015. The first video shows a driver headed north along the M18/E105 highway, passing a long column of BTR vehicles before reaching a point in which the separate lanes of the highway merge. In the image below, two key points–the merging of the separate lanes into one and a distinct tower to the right of the driver–are both present at 45.190737, 34.078051:

A separate video showing the same scene was also posted today, in which a driver traveling south (the opposite direction of the video above) captures the same scene. The same tower is visible, along with a truck that is visible at the very end of the first video:

In the Dzhankoi video, the perspective is from a large apartment building looking down on a street in Dzhankoi, showing a large convoy of BTR-80 vehicles. Highway M18/E105 turns into Radyans’ka Street, which is where the BTR column is located on the video. The video is shot from an apartment building located at 45.700278, 34.401819, which can be clearly identified when comparing a scene from the video with a photo on Panoramio showing the gas station to the south of the apartment building:

When taking these three videos into account, we can see the route taken by the convoy. At 0:45 seconds in the first highway video, we see the kilometer marker “632,” and at the end of the video where the lanes merge, the number “628” appears. We can thus assume that the video shows 4-5km of highway, giving us a better starting point for the route. The origin point of the convoy was likely Simferopol, or the convoy moved through the city before heading north on M18/E105.

The movement of military hardware through Russian-annexed Crimea is not necessarily indicative of aggression or conspiratorial machinations. The timing of the military exercises may be curious, as some have called it “saber-rattling,” but Russia has long emphasized the importance of the readiness of its forces in Crimea and these exercises are not out of out of the ordinary over the past year. However, saber-rattling or not, the Bellingcat Vehicle Tracking Project enables us to track these individual BTR-80 units in the future with any additional sightings in Crimea or, if the upcoming ceasefire does not hold and the situation seriously deteriorates, eastern Ukraine.

Update: Information added in the first and final paragraphs regarding the Black Sea military exercises.",2015-02-13,"As Eastern Ukraine Heads Towards the Ceasefire, Russian Armour Heads Towards Ukraine"
2015,2,https://www.bellingcat.com/news/mena/2015/02/11/how-the-islamic-states-pr-campaign-secured-its-rise/,/news/mena/2015/02/11/how-the-islamic-states-pr-campaign-secured-its-rise/,"

The third edition of ISIS’s news magazine, “Islamic State News”

Like most militant groups, the Islamic State of Iraq and al-Sham (ISIS) suffers from a public relations crisis. The group is intensely unpopular in the United States, and remains the subject of frequent criticism, derision, and airstrikes by nations across the globe. Yet despite an overwhelming international recognition of ISIS’s terroristic tendencies, the group’s foreign recruitment has reached an “unprecedented scale,” according to the United Nations — over 15,000 new foreign recruits in a period of only four months.

How does ISIS consistently manage to recruit foreigners, especially from Western nations, despite overwhelming condemnation of its activities? Many foreign recruits are already extremists, to be sure, but even Al-Qaeda at the height of its regional power is dwarfed by ISIS’s boastful foreign fighter statistics. In reality, ISIS has seen levels of recruitment from the Western world which are almost unheard of historically. Radio Free Europe estimates that upwards of 1,000 recruits from the Western world, predominantly from Belgium, Denmark, and Sweden, are fighting in Iraq and Syria. The mystifying appeal of ISIS even reaches as far as the United States, where dozens of citizens attempt to join the group every year, including two 15-year-old girls from a wealthy suburb of Denver, Colorado.

The answer to ISIS’s disproportional success in recruiting foreigners is simple: public relations.

With any other militant group, these tactics would be referred to simply as propaganda. But ISIS goes far beyond a simple propaganda campaign. Their massive, concerted public relations programs are perhaps singlehandedly responsible for their success in both recruiting foreigners, and even seizing control of sizeable swaths of land in Iraq and Syria.

Soldiers and citizens of Iraq have reportedly laid down their guns and surrendered surprisingly easily to invading ISIS militants — and that’s no coincidence. Depending on who you ask, ISIS has between 15,000 and 30,000 core members, and thousands more from local militias who fight alongside them. By comparison, the Iraqi Armed Forces have 271,500 active personnel, and 528,500 reserve personnel. According to Iraqi officials, when the militant group seized Mosul in June of 2014, Iraqi forces in the city outnumbered ISIS by 40:1 – yet Mosul was still captured. The Iraqi army is disorganized and poorly managed, but they outnumber ISIS many times in terms of sheer manpower. So if not solely because of their military strength, why has ISIS made so many significant territorial gains?

Public relations, not soldiers, are ISIS’s front line. The group exploits disadvantaged populations and overwhelmingly sectarian sentiment to convert the local populace and seize entire cities without firing a single shot. Local Iraqi militias, comprised largely of Sunni soldiers disillusioned with their treatment by the central Iraqi government, have joined in massive numbers to fight alongside core ISIS members. With the help of these local militias, ISIS has successfully established control over a plot of land nearly 95,000 square miles in size — as large as the United Kingdom.

Vendors sell cookware in a marketplace in ISIS-occupied Mosul

The recruitment of Sunni soldiers is spurred on by one small part of ISIS’s multi-faceted global public relations campaign. ISIS aren’t feared and reputed by citizens because those citizens have seen their actions: they’re feared and reputed because those citizens have heard of their actions. Due in large part to social media, word of mouth travels quickly in the Levant. ISIS earns their reputation among local populaces, but they also actively encourage the mythos that perpetuates all of their activities. In this sense, ISIS’s public relations department is the most critical element of their organization.

In the areas it governs, ISIS is fully committed to upholding its stated intent: the establishment of an Islamic caliphate. Perhaps as a byproduct of its state-building intentions, ISIS’s public relations have flourished in the regions it governs. The group holds regular religious services in these regions — which, for a state governed under Sharia law, is more of a propaganda tactic than a community service — and even establishes various social services, including consumer protection agencies. More traditional forms of propaganda are also a fundamental part of ISIS’s governance, and include billboards and flyers intended to enforce recognition of their radical Islamic message.

A member of ISIS distributes an edition of the group’s local newsletter in a village near Mosul, Iraq

On a disillusioned population, these PR tactics work wonders — and it’s easy to see why ISIS has been able to establish a functioning state with so much ease. Aside from propaganda, it’s also easy to see why ISIS’s caliphate state is so appealing to locals in the region, many of whom are perfectly willing, even eager, to live under ISIS rule.

But what about foreigners, who often live in relatively wealthy, socially stable areas, but flock to join ISIS regardless? In a similar sense, ISIS exploits the disillusionment of these people, but through heavy use of propaganda rather than more traditional state-building actions. Their media department works at tirelessly to continuously churn out PR materials and increase their foreign base. According to Matthew G. Olson, the director of the National Counterterrorism Center, ISIS “operates the most sophisticated propaganda machine of any extremist group.” This sophisticated propaganda machine works in three, highly coordinated sections:

Social media (Twitter, Facebook, etc.)

Social media is the most superficially effective, and, despite the best intentions of websites, the most easily embraced by ISIS members. Twitter periodically bans accounts belonging to ISIS members (and to the central organization itself), but the accounts are replaced just as quickly as they’re removed. In addition to thousands of radicalized ISIS members spreading propaganda — often in Arabic — the group maintains a set of “news” accounts in a dozen different languages (even English), which bill themselves as “the official media outlet of the Islamic State,” and feature news stories on ISIS actions with a distinctly pro-ISIS spin.

News and published media

News and published media encompasses ISIS’s Twitter accounts, but is also responsible for an entire array of physical media, including the aforementioned propaganda billboards and flyers, and even an English-language newsmagazine — with arguably better grammar than an article from The New York Times. Unlike their dragnet social media activity, this propaganda is more narrowly focused, targeting specific demographics to spread ISIS’s message.

A promo banner for the ISIS feature video, “‘Īd Greetings From the Land Of the Caliphate”

Digital media

The third and perhaps most prominent section of ISIS’s propaganda machine is its digital media. This is what has sparked fear in Western governments, and intrigue in radicalized Westerners and foreign fighters. Chances are if you’ve watched any major news outlet in the last year and a half, you’ve seen photos of ISIS atrocities, and heard reports of “beheading videos” and other recordings of ISIS actions in Iraq and Syria. The mere presence of these reports in Western media plays perfectly into ISIS’s public relations campaign, which wholeheartedly embraces the “no such thing as bad publicity” style of marketing. More broadly, the group produces dozens of propaganda videos targeted at everyone from Westerners to residents of Iraq, Syria, and the entire Middle East — so many that Washington Institute for Near East Policy fellow Aaron Y. Zelin’s “Jihadology” project has an entire category dedicated to them.

ISIS’s main news outlet refers to itself as the al-Ḥayāt Media Center, which suavely features a near-copy of Al Jazeera’s logo for its many publications. Al-Hayāt could be considered the central body of all ISIS’s media endeavors, which neatly coordinates and distributes most of its propaganda internationally — although the internal structure of the organization is unknown. What is known is that al-Hayāt employs every possible resource to produce its content, from native speakers who write and edit stories and videos in every possible language, to modern production tools: high-definition cameras, professional editing software, and graphic design programs.

Anyone who keeps up-to-date on global terror threats knows that most radical Islamic have readily embraced the technologies and resources of the 21st century long ago, if not a bit later than the rest of the world. Militant organizations from Boko Haram to Hamas frequently put out high-quality propaganda videos of similar production value to ISIS. But unlike ISIS, these groups rely primarily on conventional warfare to spread their message. ISIS breaks free from the tactics of its brethren through its industrious embrace of the propaganda machine — or more accurately, the public relations campaign — which has almost single-handedly led to its rise, in only a matter of months, as one of the most prominent and formidable militant groups in the Near East in many years.",2015-02-11,How the Islamic State’s Massive PR Campaign Secured its Rise
2015,3,https://www.bellingcat.com/news/2015/03/30/draft-new-facts-on-mh17-from-the-joint-investigation-teams-call-for-witnesses/,/news/2015/03/30/draft-new-facts-on-mh17-from-the-joint-investigation-teams-call-for-witnesses/,"

On March 30, the Joint Investigation Team investigating the cause of the downing of MH17 released a video calling for witnesses in eastern Ukraine to come forward with information regarding the transport of a Buk anti-aircraft system through eastern Ukraine on July 17th (the day of the MH17 crash) and 18th, 2014. In the video, the Joint Investigation Team summarize the path of the Buk from Donetsk, through Zuhres and Torez to Snizhne, to Luhansk, and back to Russia with photographs and videos of the Buk along with intercepted phone calls between separatists. The majority of this information has been long known, as can be found in Bellingcat’s November report on the Buk system that likely shot down MH17. However, this video also provides us with new information that further implicates Russia and the separatists with whom it collaborated in the form of intercepted phone calls placed after the downing of MH17. In these three previously unpublished phone calls, separatists discuss a Volvo low-loader truck hauling a Buk from Snizhne to Russian territory shortly after the MH17 shootdown.

Along with the newly published phone conversations, the Joint Investigation Team video confirms previous facts vital in determining the cause and culpability of the MH17 tragedy. The video, along with a description on the JIT website, confirm the following facts that were also recapped in the November Bellingcat report:

A Buk anti-aircraft system was transported in a Volvo low-loader with a telephone number on a distinct yellow background from Donetsk on the morning of July 17 and through Luhansk in the early morning of July 18

The same Buk was seen in the morning and early afternoon of July 17 in the towns of Zuhres, Torez, and Snizhne.

The Buk drove south of Snizhne in the afternoon of July 17 without the assistance of the Volvo low-loader.

The new information, which has largely been speculated upon before this video, concerns the location of the Buk before being photographed in Donetsk and after the shootdown of MH17.

The Joint Investigation Team has determined that the Buk was likely transported from Sjevernyi, Ukraine in the Luhansk oblast, through Luhansk, and into Donetsk. This transit took place overnight between July 16 and 17, though the exact route is not clear, as the video highlights a few possible alternate routes near Luhansk. The Joint Investigation Team does not speculate where the Buk was located before reaching Sjevernyi; however, the town is located less than a kilometer from the Russian border, raising obvious questions.

There are three additional calls that the Joint Investigation Team referred to, all of which occurred after the downing of MH17. The first took place at 9:32pm, approximately 5 hours after the MH17 crash, between two separatists. This call concerns how one of the crew members accompanying the Buk was left behind at a checkpoint east of Snizhne. The Joint Investigation Team is requesting any additional information available regarding the location of this checkpoint and petrol station, along with the identity of this crew member. There are a few errors in the English and small parts of the phone calls that are not included in the transcript, which are also not included in the below transcript. Additionally, the Joint Investigation Team redacted the names in the phone call, instead marking them as (…), and the transcript selectively marked expletives used in the phone calls. None of the expletives, excluded parts of conversations, or minor errors change the essential content of the phone calls from the original Russian.

A: Yes, (…)!

B: Hello, commander. Have you already left, yes?

A: Me? Yes. I have left for my task, you – for yours.

B: I got it. Within that very region or not?

A: No. I’m not within that region. I’m [going to] to the other direction.

B: …[inaudible] a fighter has got lost there from this one… [inaudible] launcher. He has (expletive) lost his crew (expletive)!

A: What a (sic) launcher?

B: From a Buk.

A: From a Buk?

B: Yes.

A: And where is he, (expletive)?

B: Here he is standing at the checkpoint.

A: Take him and bring in here, (expletive). I’ll be waiting for him in Snizhne near the petrol station.

B: Okay.

The other two intercepted calls took place at approximately 8:00am and 8:20am on July 18, the morning after the downing of MH17 and a few hours after the Buk and Volvo low-loader truck were filmed in Luhansk headed east.

First call, placed at approximately 8am on July 18, 2014:

B: Good morning (…)!

A: Good morning, (…) Yesterday was a (expletive) mess, I have nothing to say.

B: What’s up?

A: Where, is, whatsit (expletive) err…Why did your comrade (…) return. Incomprehensible such movements. I don’t know what was going on yesterday, tell me!

B: They brought the car [note: Every time car or vehicle is referred to in these transcript, the original word used is машина / mashina, which can refer to any vehicle, truck, or a machine. This word is likely referring to either the Volvo truck or the Buk] till crossroad, left it there, the lads went on themselves.

A: Well.

B: So, the car was going in the correct direction and arrived successfully.

B: There were strange incoming calls which began suddenly, from 10 persons.

A: Who are that (sic) 10 persons?

B: Err. There were different incoming calls got him on the phone from people who begun (sic) to introduce themselves…err…One and then the second, then the third, then the fourth…he told me that he had pissed off…later, (…) begun to phone up.

A: And he turned of (sic) his telephone. (Expletive) of a mess.. err… and we don’t know at all where is the car.

B: The car is in Russia.

A: (Expletive) shit… err…yesterday I [said] (expletive) that we didn’t know.

Twenty minutes later, a second call is placed between the same two people in the previous call (A and B).

B: Yes, (…)!

A: (…), you should take (…), and come to my place, there is no …car, no one saw it (expletive). That one, which had gone to meet it… returned back without the car, you know what I mean. Where? Whom? Which way did he bring it? (Expletive) disaster, you know…

B: And what about Bibliotekar [note: “The Librarian”]? This is that group of people transported it.

A: Well.

B: On the lowboy [note: The Volvo low-loader truck]. I have just made a (sic) contact with them, they are all in Russia, they will bring a new vehicle [note: Same word – машина – used as in the previous translation to “car”] from Russia.

A: Aha. But that…err…did he give it to Bibliotekar?

B: For sure!

A: Well, I got it.

There are several facts to be extracted from these calls, including the following, which were not included in the November Bellingcat report and only partially speculated upon from other open source investigations:

The first known origin point of the Buk on July 17 was not in Donetsk, but instead in a town less than a kilometer from the Russian border. Previously, many have claimed that this Buk was seized from an abandoned Ukrainian base in Donetsk. This new information indicates that either the Buk simply came from Russia, or separatists transported a captured (Ukrainian) Buk from Donetsk to a town at the Russian border (or further into Russia), and then returned to Donetsk.

The Buk was located at the checkpoint east of Snizhne in the evening of July 17, before traveling to Luhansk. For a map showing the checkpoints active on July 17 just east of Snizhne, click here for a KMZ file created by Bellingcat contributor Timmi Allen (use Google Earth to open file).

The Buk had a crew with it, though it is not explicitly said where the crew originated from (Russia or Ukraine).

The Volvo truck and Buk were transported into Russia after passing through Luhansk early on the morning of July 18.

Numerous people organized the transport of the Buk and many others knew about the situation, including: the separatists who picked up the person at the checkpoint on July 17, the crew transporting the Buk on July 17-18, the ten people who called the person who transported it on July 18, and the people who took the Buk in Russia from the other crew on July 18.

The “Bibliotekar” crew transported the Buk to Russia. The participation of Bibliotekar was previously known from an earlier call intercepted and released by the SBU (Ukrainian Security Services), as seen on this English transcript of the call. From the July 17 call, placed on the morning of July 17, a man named Khmuryi tells a separatist (named “Buryatik”) to call Bibliotekar for more information on the Buk, which was located near a motel in Donetsk. Khmuryi is supposedly the name used by Sergei Petrovsky, a separatist officer who was in Donetsk at the time. The identity of “Bibliotekar” is unknown.

The Volvo truck was taken to Russia on July 18, but was later used by separatists on August 6 and August 23 (second source). Thus, we can conclude that unless an identical Volvo truck was picked up as well, the машина (translated as both “car” and “vehicle” by the Joint Investigation Team) the Buk hauled by the Volvo.

This new video is the strongest indication yet from the Joint Investigation Team that the Buk photographed and filmed in eastern Ukraine on July 17 and 18 is the culprit of the tragedy. While the Joint Investigation Team has not explicitly ruled out other scenarios, it is telling that they have called upon witnesses in eastern Ukraine for more information while disclosing specific photographs, videos, and intercepted phone calls that all point to the same culprits.",2015-03-30,MH17 Joint Investigation Team's New Video Brings New Facts to Light
2015,3,https://www.bellingcat.com/news/2015/03/26/uae-united-40-block-5-at-test-airfield/,/news/2015/03/26/uae-united-40-block-5-at-test-airfield/,"

DigitalGlobe imagery from November 2014 shows ADCOM’s United 40 Block 5 UAV at the company’s test airstrip located south of Al Dhafra Airbase.

When the US denied the sale of armed Predator drones to fulfill UAE Air Force requirements in 2002, the Gulf country set out to fill the gap by developing its own medium altitude long endurance UAV. Local target drone manufacturer ADCOM Systems took up the challenge and has helped further develop the UAE’s defense industrial base with its United 40 model.

Satellite imagery from DigitalGlobe shows the UAE testing the United 40 block 5 at the company’s remote desert airstrip 30 miles outside of the heart of Abu Dhabi. Imagery from November 2014 captured the UAV along with the associated ground control station integrated in a van parked nearby.

Historical imagery suggests the 600 m long airstrip was paved a year prior — possibly in preparation for test and evaluation. Company video of the block 5’s maiden flight from March 2013 appears to match this airstrip.

One of the latest in the series, the block 5 was first displayed at Abu Dhabi’s International Defense Exhibition (IDEX) 2013 after a similar showing of a previous variant at IDEX 2011.

The block 5 preserves the unusual biplane configuration, though with some significant changes. Most notably, the block 5 swaps the aft fuselage-mounted single push propeller for twin-engine props positioned forward under-wing. The two 115 hp engines and 17.5 meter-long high aspect ratio wings allow the drone to carry payloads up to 1050kg — which includes the weight of two electro-optical cameras and optional synthetic aperture radar.

Like the previous version, the block 5 features an internal rotary launcher which contains six precision guided bombs, for a possible ten when including rear under-wing carriage. ADCOM reports the UAV has a maximum cruise speed of 220 km/h and a flight ceiling of 8,000 m. The company also claims a flight endurance of more than 100 hours. Unlike western counterparts, operators manning the associated ground control station can only pilot two of the UAVs at one time.

Keeping with previous trends, the company revealed a new naval variant, the block 6, at this year’s IDEX 2015 which took place last month. Developed with Italian manufacturer Finmeccanica and its subsidiary Whitehead Alenia Sistemi Subacquei, the platform now takes on the anti-submarine warfare mission fitted with sonobuoys and a single lightweight torpedo mounted center on the fuselage. In conversation with IHS Jane’s, ADCOM said the Block 6 could be used to “lay a barrier of sonobuoys”, while loitering overhead for up to 16 hours with its torpedo. With acoustic processing on-board, data is disseminated with other cooperating UAVs or maritime patrol aircraft.

While the company also suggested a few other concept of operations, it is clear the platform is still early in the testing phase. ADCOM and partners said they will continue working on advancing payload integration while planning a torpedo droptest demonstration for the UAE Navy sometime in 2015.

Despite a good showing at defense exhibitions, it’s still difficult to know how capable the United 40 platform actually is. Nevertheless, the Abu Dhabi-based firm thinks it’s good enough to continue pushing the platform abroad.

In 2013, the Russian military reported the purchase of two Block 5s with a service entry date around 2016. However, that entry date may have been delayed as Russia postponed the tests of the UAV in February last year. Imagery from November 2014 may have been related to the Russian test—though the company hasn’t confirmed. Beyond Russia, Algeria was considering the purchase of the aircraft for its intelligence, surveillance and reconnaissance requirement. (In 2014, Algeria was also evaluating the China-built Xianglong).

ADCOM has also offered several United 40 systems to the United Nations for use on humanitarian missions. Selex, a subsidiary of ADCOM partner Finmeccanica, also supports United Nations border surveillance missions in the Democratic Republic of the Congo with the Falco system.

Possibly due to a lack of military sales for its flagship drone, teaming with Finmeccanica could have been a strategic move to follow the partner into a new market segment. In a presentation made at the Berlin Airshow 2014, ADCOM reiterated the use of drones for NGOs engaged in wildlife conservation and governments requiring critical infrastructure monitoring.

Despite the build of block 6, the civil and non-military space may become an important area for ADCOM’s future growth.",2015-03-26,UAE United 40 Block 5 at Test Airfield
2015,3,https://www.bellingcat.com/news/americas/2015/03/20/assessing-mexicos-guerra-al-narco/,/news/americas/2015/03/20/assessing-mexicos-guerra-al-narco/,"

A week ago, the Mexican government celebrated another success in its Guerra al Narco: the capture of two drug kingpins. Servando Gómez Martínez (picture above), a.k.a “La Tuta” was arrested in a somewhat peculiar manner in Morelia, Michoacan state. The Mexican security forces located the leader of the Knights Templar cartel, a former primary school teacher, in part thanks to his girlfriend bringing him a birthday cake. A couple of days later, the head of another well-known violent Mexican drug-trafficking group, Las Zetas, wasapprehended by the security forces in the suburb of Monterrey, Nuevo Leon state. Omar Treviño Morales, known as “Z-42″ (picture below) had taken over Las Zetas cartel after the arrest of his brother, Miguel Angel Morales, in July 2013.

The Gómez and Morales captures fit in the larger government’s tactic against the narco-traffickers. Last year, the security forces made a huge buzz after the re-arrest of the leader of the largest and most powerful Mexican cartel: the Sinaloa group. Joaquín “El Chapo” Guzmán (featured image) was apprehended in February 2013, 13 years after escaping from one of Mexico’s high-security prisons.

As always, the scenario is well rehearsed. After their arrests, the drug kingpins are paraded on the tarmac of Mexico City’s airport. Escorted by two armed and masked Mexican security agents, they are led either to a police truck or helicopter. An agent always holds the drug leader by the neck, sometimes forcing him to bend the head.





The symbol is strong. Illustrated by its armed operatives, the Mexican government is shown as being all-powerful. It can subdue the narco-traffickers and stop short their drug trade. The drug kingpins are, on the other hand, depicted as weak. Wearing common clothes, their faces are shown to the world. Since shadow defines the drug-trafficking business, this tactic is a direct affront to it. The Mexican government can shed light on their activities. The message is clear: “One after the other, your leaders will fall like flies.” Is this political mediatization of the Guerra al Narco representative of the actual facts? The truth is, as always, quite different…

The Mexican government praises its approach against the drug cartels. The Mexican Interior Minister, Osorio Chong, stated that “we now have 90 of the 122 most dangerous [people] detained,” emphasizing that most of the drug kingpins were arrested without a gun shot being fired. While this might be true,violence and corruption nonetheless continue to plague Mexico. The best example is the 2014 disappearance and probable murders of 43 Mexican students in the city of Iguala at the hands of the local drug cartel supported by local security forces.

The current Mexican President, Enrique Peña Nieto, is following the strategy of his predecessor, Felipe Calderón, who initiated the “War on Drugs.” As I argued in a paper, Calderón’s approach proved to be a total disaster. Here are the concluding thoughts:

Rather than solving the security problems related to drug-trafficking activities, Calderón’s strategy exacerbated them. Firstly, Calderón’s approach failed to accomplish the three top priorities on his agenda: ensure public security, reinforce Mexican security structures, and reform both the legal and judicial systems. Secondly, it actually aggravated the situation. Violence skyrocketed over his term [and the number of drug cartels actually increased]. Corruption became endemic in the army and the police forces. All of this occurred despite his attempts to root out drug cartels’ penetration of the security forces, reform the judiciary, and disturb the drug-trafficking organizations’ structure and trade patterns. Finally, Calderón’s War led to three unexpected by-products whose potential negative effects could worsen even further the initial disaster. The militarization of the Mexican state, the psychological impacts of Mexico’s Drug War on the Mexican population, and the movement of drug cartels into Central America could respectively endanger Mexican democratization, produce a “lost generation”, and threaten the stability of the region as a whole. Why did Calderón’s approach fail? His policies were based on a deep misunderstanding of both actors involved in the drug issue: the drug-trafficking organizations and the Mexican security forces. In regards to the former, Calderón’s strategy perceived drug cartels as criminal organizations. It thus failed to see that they in fact behave like any other formal business with only one difference: as drug cartels cannot pretend to legal means to ensure their competitiveness, they resort to violence. By opening channels for newcomers and threatening drug cartels’ trade routes, Calderón’s response led to a surge in both inter-cartel violence and cartel-state confrontations. Focusing on the products, his approach did not target the source of cartel’s revenue: money laundering. Finally, Calderón overemphasized the Mexican security and judiciary’s capabilities to fight drug-trafficking organizations. Corruption is deeply rooted in both the military and the police structures. Furthermore, whereas the former is not tasked to fight drug cartels, the latter is ill-equipped and poorly trained. Despite reforms, the Mexican judiciary still fails to prosecute both drug cartel criminals and human rights violation committed by security forces. Within this body, corruption is also well-established but the main handicap is the simple fact that most justice officials fail to perform the most basic stages in investigation procedures, such as questioning witnesses.

Despite his promises to revert the errors made by Calderón, Peña Nieto did not establish a new strategy. To buff up the security with armed police, military and now vigilante patrols remains the main remedy. The vigilante case is nonetheless a new approach. The Mexican state of Michoacan, where “La Tuta” and the Knights Templar once strived, has for example experimented with this.

The vigilantes have both strengths and weaknesses. First, they are citizens defending themselves. This means that they know the people living in their towns or cities and have an idea of who belongs to which side. Unlike the Mexican military or federal police force that remain in camps and only go out to patrol, the vigilantes are constantly in town. In other words, they have a strong relationship with the local population. A strategy that has often be used by drug cartels to alienate the population from the Mexican state. Second, they blend in the crowd and are not as flashing as armed and dressed official security forces.

On the other hand, vigilantes represent often a loose group. Even though, they pledge allegiance to the Mexican government, there is no certainty that they will respect it. More worrying is the fact that they are as heavily armed as official security forces. The government provides them with the weapons. The risk is that they become powerful actors, attracted and corrupted by the drug trade. This appears to have already occurred in the Michoacan state. With the fall of “La Tuta” and his cartel, the Knights Templar, a vigilante group has stepped in to take-over their illegal activities. “The Viagras” are suspected by the Mexican government to run drug-trafficking networks. As the leader of the group states in the video, the government, rather than the Knights Templar drug cartel, is now their enemy.

If the vigilante groups start to be involved in drug-trafficking, Mexico could very well spiral down in a more alarming vicious circle of violence whereby three actors would fight for supremacy: cartels, vigilante groups, and state security forces. Before, small cartels filled the void left by larger ones. Even though leaders were captured, they were quickly replaced. Now, vigilantes might do the job. However, it is key to understand that vigilante groups also have a lot of potential. Unlike Mexican security apparatuses, they have the trust of the local population. The government thus must find a way to incorporate them into its tactics in the current Guerra al Narco. As of today, the most important task for the Mexican state remains to change its approach to the drug-trafficking problems. First and foremost, it needs to change and adapt its perception of the actors involved in the drug issues. In the following TED talk, Rodrigo Canales argues that “our current understanding of drug violence and what leads to it is probably at the very least incomplete.”

Calderón’s misunderstandings were fatal. Peña Nieto did not learn the lessons. Part of the solution might be offered by the words of the people the Mexican leaders are actually fighting. Referring to Mexico cartel violence, “La Tuta” stated that “this is not organized crime. If anything this is disorganized crime.” With this in mind, the Mexican government should start to work for the reduction of violence, rather than fight against the violence.",2015-03-20,Assessing Mexico's Guerra al Narco
2015,3,https://www.bellingcat.com/news/uk-and-europe/2015/03/17/updated-alastairmorgan-to-rupertmurdoch-you-are-in-a-unique-position-to-help-us-finally-lay-daniel-to-rest/,/news/uk-and-europe/2015/03/17/updated-alastairmorgan-to-rupertmurdoch-you-are-in-a-unique-position-to-help-us-finally-lay-daniel-to-rest/,"

With considerable speed and grace, on Monday 16 March, Rupert Murdoch replied to Alastair’s letter, promising to co-operate with the Daniel Morgan Independent Panel inquiry, and explaining how News Corp‘s Management and Standards Committee have already complied with requests from the police and the IPCC.

Questions about the role of News of the World and surveillance of chief investigating officer and his family were part of James Murdoch’s formal written submission to the Leveson Inquiry

Today, on the anniversary of his brother’s brutal murder in 1987, Alastair Morgan makes an impassioned appeal to Rupert Murdoch to fully co-operate with the Independent Panel Inquiry into the murder of Daniel Morgan, chaired by Baroness O’Loan.

The full text of the letter Alastair just hand delivered to Rupert Murdoch is here . But the personal appeal towards the end is particularly striking:

The work of the Daniel Morgan Independent Panel is almost entirely dependent on disclosure and I am appealing to you today – on the 28th anniversary of my brother’s murder – to ensure that News Corporation discloses all relevant material in confidence to the Panel. Daniel’s murder, the police corruption and the ensuing years of failed investigations have been agony for the whole family. Daniel’s children have grown up without a father and my mother is now 86 years old. We need to know the truth about what happened to Daniel and why. You are in a unique position to help us finally lay Daniel to rest. We feel that information released should include:

 News International emails deleted in 2010, but reconstructed in 7 ‘datapools’ by the software company Stroz Freidberg, and available for search on the Nomad system;

 Any relevant News International paperwork, formerly stored at the Crown archives; and

 The results of any internal investigations, such as the interviews carried out by lawyers from Linklaters in 2011-2012. Finally, I would also ask you to urge any of your employees or former employees who have information about the murder or activities of Southern Investigations to contact the panel.

Having spent nearly four years working on this story in the wake of the Milly Dowler scandal, I’ve become more and more convinced that phone hacking was just the tip of an iceberg of illegal news gathering in the British press: and that the Daniel Morgan Murder explains the dark mass beneath.

Indeed, my personal opinion is that it’s no coincidence that Glenn Mulcaire was hired as News of the World’s phone hacker just as Southern Investigations was disbanded. The length of time it took police to investigate that properly is also unlikely to be a coincidence.

The Daniel Morgan murder, and the police corruption around it, created a criminal-media nexus in the late 80s has spread outwards and upwards throughout the last three decades.

The Real Reason for Closing News of the World?

Rebekah Brooks explained to a packed ‘town hall’ meeting of News of the World journalists when she closed the paper in July 2011, she added that something worse than Milly Dowler would come out in a year or so to explain the decision.

But what could have been worse? The hacking of 7/7 victims or families of the two girls murdered in Soham? There’s little that could be worse than the hacking of a murdered schoolgirl, except perhaps the revelation that the world’s biggest selling English language newspaper had been colluding with suspected murderers for several decades.

There’s little doubt Brooks knew about the surveillance of the senior investigating officer around the murder in 2002. Not only were her editors Greg Miskiw, Alex Marunchak and Mazher Mahmood’s photographer Bradley Page involved in the surveillance, but Glenn Mulcaire’s notebooks from the time are filled with details on Cook and Hames.

According to Nick Davies in his book Hack Attack News Corp knew well in advance that a phone hacking story could go ‘Main Street’ and capture the public imagination. Sources say the Sun’s political editor Tom Newton Dunn approached Labour press supremo Tom Baldwin and told him “you can have Andy, but not Rebekah” a full two weeks before the Milly Dowler story broke in July 2011.

Three months previously in March 2011, the pre-trial case against the murder suspects in the Daniel Morgan case had collapsed at the Old Bailey. News Corp must have been aware of the information leaking out once the contempt of court threat had lifted. The full story of the News of the World‘s complicity with the murder suspects, and interfering with the murder investigation was bound to come out.

But then they had a stroke of luck. The MSC discovered correspondence between the Sun crime correspondent Mike Sullivan and Dave Cook about a potential book. No money had been changed hands, and Cook’s story was completely in the public interest. But it was enough to silence him if disclosed to the Met. Cook was promptly raided and interviewed under caution over misconduct, the day he was supposed to become a core Leveson participant in January 2012.

Three years on no charging decision has been made and Cook has remained muzzled.

So perhaps Brooks was being pessimistic about how long it would take the real reason for News of the World’s closure to come out. The legal restrictions around Cook, and around Marunchak and Rees who were arrested around suspicions of computer hacking have muffled any disclosure or debate because of the possibility of contempt. But that can’t last forever. And it doesn’t apply to those like Brooks, Miskiw or Mulcaire who have either been acquitted or served their time

So now is the time for senior News International journalists to come clean. I really hope Rebekah co-operates with the inquiry. She really has nothing to lose and could redeem her role in all this.

And just as he apologised to the Dowler family, I hope Rupert Murdoch does the honourable thing today, and fully commits to providing full disclosure to the panel so that this disturbing chapter in Fleet Street can be closed, and the Morgan family can find some kind of peace.

A Timeline of the Daniel Morgan Murder",2015-03-17,"UPDATED Alastair Morgan to Rupert Murdoch ""You are in a unique position to help us finally lay Daniel to rest."""
2015,3,https://www.bellingcat.com/news/mena/2015/03/16/the-mosque-of-umm/,/news/mena/2015/03/16/the-mosque-of-umm/,"

In October 2014, a Chechen woman living in the Netherlands kidnapped two of her children and fled to territory controlled by the Islamic State. Little is known about the fate of the children or their mother, who has been given the pseudonym “Umm” by Dutch media, but the woman has reportedly told relatives and friends on social media that she now lives in Raqqa, the Islamic State stronghold, and posted a photograph that reveals her possible location. The photograph, which was allegedly taken from the woman’s “backyard” and claimed to have been of “Raqqa,” shows what appears to be a minaret and communications tower. At the request of a Dutch newspaper, the Bellingcat team attempted to geolocate the photograph.

Because the information provided about the photograph indicated that it may have been taken in Raqqa, the Bellingcat team searched for imagery of mosques in Raqqa to find matching minarets. An image found on Twitter showed a promising match:

Further searches provided more imagery of the same mosque, which is not located in the city of Raqqa, but in Raqqa province, near the Turkish border in a town called Tal Abyad (تل أبيض‎). The same town is also said to be the last location where three British schoolgirls who traveled to Syria were last seen, according to The Telegraph, citing Turkish intelligence sources. The mosque in the picture, as shown by the Arabic calligraphy on the sign at the entrance, has been renamed by the Islamic State after Osama bin Laden.

The photo above, taken in daylight, provides further reason to believe that this could be the same minaret, as many of the visible details match.

Another important structure visible in the original picture is a communication tower. Incidentally, The Telegraph article mentioned above includes a photograph of the aftermath of an airstrike on Tal Abyad where such a tower is visible; it also closely resembles the one seen in the original photo.

A YouTube video from 2012 shows both the minaret and the communications tower together in a wide shot.

Satellite imagery shows that the two structures are indeed near each other.

Reorienting the image, we can also see that the following picture of the mosque and satellite imagery both show trees within the perimeter and that the structures line up.

With this information, we can be reasonably certain that we have the correct area narrowed down. Next, we can ascertain the approximate location of the camera by aligning the elements in the photograph. In the original picture, we can see that the minaret appears closer to the camera, while the communication tower seems to be farther away from the camera, to the right of the minaret. For the landmarks to orient in this manner, the photograph would have to have been taken to northwest of the mosque.

To further narrow down the possible area where the photo may have been taken, there’s another feature in the original photo that can be used: the light post between the minaret and the communication tower. Unfortunately, the Bellingcat team hasn’t been able to find additional ground imagery from this area, so we must use satellite imagery to match the remaining features. Examining the available satellite imagery in the area provides one possible match for a light post in the courtyard of a building complex. From there, the yellow line is used as a guide to line up the visible trees and buildings in the original photo with the satellite image, so that the tree would appear immediately to the right of the light post.

The other feature of the photograph that we can try to line up is the visible corner of the mosque’s perimeter with the base of the minaret.

By using these features, we get the following result, with a possible camera location near the point where the lines intersect.

To seek additional confirmation that this is the location where the photo was taken, we created in Google Earth a rough 3D representation of key structures in the viewing area with guesstimated heights in order to validate that the structures could align in this way. While there are inaccuracies in the approach due to the multiple unknown variables at play (e.g., height of the structures, height of the camera) and possible inaccuracy in model structure placement, it does further support our assumption that the picture was likely taken from one of the buildings in this area.",2015-03-16,The Mosque of Umm
2015,3,https://www.bellingcat.com/news/uk-and-europe/2015/03/13/vladmir-babak-and-reuters-missile-launch-witnesses-how-do-they-fit-with-what-we-know-about-mh17-so-far/,/news/uk-and-europe/2015/03/13/vladmir-babak-and-reuters-missile-launch-witnesses-how-do-they-fit-with-what-we-know-about-mh17-so-far/,"

In the last few days there have been a pair of interesting stories relating to the downing of MH17 in Ukraine that have attempted to shed more light on what happened on July 17th. Vladmir Babak, part of the team that designed the SU-25 and a senior figure at the SU-25’s manufacturer and developer Sukhoi Attack Aircraft Concern stated in an interview that an SU-25 would be unable to safely fire its weapons at the same altitude as MH17, and that an air-to-air missile fired by an SU-25 would have not been able to cause MH17 to break up in the way it did. He also went on to add he believed MH17 had been shot down by a Buk missile.

Yesterday, Reuters published a report, From ‘Red October’ village, new evidence on downing of Malaysian plane over Ukraine, where witnesses near the town of Snizhne described the launch of a missile on July 17th that downed flight MH17. But how do these new reports fit with other information published about the downing of MH17?

As we’ve previously noted on Bellingcat, the various claims about an SU-25 being used to down flight MH17 have been inconsistent at best. Vladmir Babak’s statement adds a new dimension to these statements as it excludes certain scenarios and makes it clear certain claims that have been made are false. Due to the very short effective range of the cannon used by the SU-25 Babak’s claim would exclude scenarios such as the one proposed by the Russian Union of Engineers where an initial attack on the cockpit with cannon fire, disabling the black box recorder, was followed up by an attack with an air-to-air missile.

It was also interesting to note in Russia Today’s response to Babak’s claim none of the experts addressed Babak’s statement that the SU-25 could not fire its weapons at an altitude of 10km, instead referring to the SU-25’s ability to fly above that altitude, something Babak himself confirmed was briefly possible.

In the same Russia Today piece they spoke to Gordon Duff, who has previously made a series of bizarre claims, including Google Ideas being involved with the August 21st 2013 Sarin attacks in Damascus (more details here), who stated “you can’t fire a missile on a flat area in the middle of the day leaving a smoke trail into the air and having everyone not see it”. Fortunately for Duff, Reuters was on the case.

Reuters spoke to a number of witnesses near the “Red October” area, which can be found south of Snizhne. What’s very interesting about this location is it was also mentioned in a audio recording of the chat programme Zello, which was claimed be local residents in the Snizhne area discussing the missile launch on July 17th

As detailed in Bellingcat’s earlier analysis of the various evidence of the Snizhne launch site, the “Red October” area is close to the site identified by a number of different sources, including the Zello witness. The below map shows the position of the Zello witness in the Red October area, as well as the position of a field believed to be the launch site and visited by the Daily Telegraph journalist Roland Oliphant. The lines marked in brown indicates the direction of a smoke column visible in photographs taken moments after the downing of flight MH17 (more details here).

It’s also worth noting the Buk missile launcher Bellingcat tracked travelling from Donetsk to Snizhne on July 17th unloaded from its transport vehicle in the town of Snizhne and was filmed heading south out of Snizhne only a couple of kilometres from the above launch site, heading in the direction of the launch site, only a few hours before MH17 was shot down. The new witnesses interviewed by Reuters adds to the information that points to this separatists controlled area as being the launch site of the missile that downed MH17, and, along with Vladmir Babak’s statements, further debunks claims an SU-25 was used to shoot down MH17.",2015-03-13,How Do They Fit With What We Know About MH17 So Far?
2015,3,https://www.bellingcat.com/news/mena/2015/03/13/irans-expanding-sphere-of-influence-iranian-t-72-tanks-in-iraq/,/news/mena/2015/03/13/irans-expanding-sphere-of-influence-iranian-t-72-tanks-in-iraq/,"

Iraq’s fight against the fighters of the Islamic State is one not only fought by Iraq’s Armed Forces and the Peshmerga, but also by an increasing number of Shiite militias, most of which receive extensive support from Iran. Iraq’s equivalent of the Lebanese Hizbullah movement, Kata’ib Hizbullah, is without a doubt the strongest and most influential of all Shiite militias currently present in Iraq. This has come to be so mostly thanks to Iranian funding, lethal aid and the presence of Iranian advisors on the ground.

Iran has supplied these militias with anything from 12.7mm AM.50 anti-materiel rifles, 40mm Nasir grenade launchers, Safir jeeps equipped with 107mm multiple rocket launchers (MRLs), recoilless rifles and even 122mm HM-20 MRLs, all of which produced in Iran. The amount and type of weaponry supplied depends on the size of the militias in question.

However, the rumoured presence of Iranian tanks with militias in Iraq could until now not be confirmed. These rumours quickly made their way around the world each time any vehicle with tracks on a tank transporter driving close to the Western border of Iran was sighted. Now photograpic evidence has finally arisen of Iranian tanks that have joined the fight against the Islamic State in Iraq, and are busy driving their fighters out of the town of Tikrit.

Seen above is an Iranian T-72S, clearly distinguishable from Iraq’s own T-72 ‘Urals’ and T-72M1s by the presence of attachments allowing for the installment of 155 Kontakt-1 explosive reactive armour blocks (ERA), all surprisingly missing on this example, and the smoke grenade launchers on the side of the turret instead on the front as seen with the T-72M1.

While one could argue that this particular T-72S could have been part of a recently struck arms deal between Iraq and Russia that has not been uncovered, yet the Iranian camouflage pattern on the tank leaves no doubt about the true origin of the tank. For comparison, an Iranian T-72S (with ERA titles) during a parade can be seen below.

It is currently unknown if the T-72S pictured near Tikrit is crewed by Iranians and part of Kata’ib Hizbullah’s arsenal, or if it is actually in service with the Iraqi Army. Kata’ib Hizbullah is known to operate just one tank, an M1 Abrams which was left behind by the Iraqi Army, and thus lacks the heavy fire-support essential for close combat fighting in towns such as Tikrit. Iran supplying a limited amount of T-72s drawn from Iranian army or Revolutionary Guard stocks makes perfect sense in this light.

Whatever effect they may have on the ultimate course of the war, it is certain that the influence of the Iran on conflicts in the Middle East and elsewhere is not to be underestimated. With Iran now using its military industry to exert influence in a host of Middle Eastern nations ranging from Iraq, Syria and Yemen to even Libya, its intentions of expanding its sphere of influence become ever more clear, and it’s certain Iran is not to be underestimated when devising policies on the Middle East.",2015-03-13,Iran's Expanding Sphere of Influence: Iranian T-72 Tanks in Iraq
2015,3,https://www.bellingcat.com/news/uk-and-europe/2015/03/11/vreditel-sobaka/,/news/uk-and-europe/2015/03/11/vreditel-sobaka/,"

Данный отчет также доступен на русском языке.

On March 2, Elena Kostyuchenko of the Russian independent newspaper Novaya Gazeta published an explosive interview (English) with Dorzhi Batomunkuyev, a 20-year old tankist from Mogoytuy in the Zabaykalsky Krai, bordering Buryatia. Batomunkuyev is a member of military unit 46108, the 5th Tank Brigade, based out of Buryatia, lying between Lake Baikal and Mongolia in the far east of Siberia. However, Batomunkuyev is far from home, now recovering from serious injuries in Rostov after being transferred from a burn recovery unit in a Donetsk, Ukraine hospital. Like many other Russian soldiers, Batomunkuyev sustained injuries while fighting against Ukrainian soldiers in eastern Ukraine. In this case, the Mogoytoy native and his fellow 5th Tank Brigade soldiers were firing upon Ukrainian soldiers in the “Debaltseve pocket” on February 19.

This report will verify and expand upon the claims made in the Novaya Gazeta report through open source information, including satellite photos, social media reports, and photographs from reporters working in and near Debaltseve in mid-February. Each claim from either Batomunkuyev, the Russian tankist, or Novaya Gazeta is presented below in bold. The English translation of the interview from Euromaidan press is used in each quotation.

Firstly, there is the issue of Batomunkuyev himself. Was he truly a Russian tankist in the 5th Tank Brigade, and if so, was the injured man that Novaya Gazeta spoke to really Dorzhi Batomunkuyev?

On February 27, the local news site Zabmedia.ru reported that the mother of Batomunkuyev was traveling to Rostov to see her injured son, who sustained injuries while fighting Ukraine. This news release was published a week before the Novaya Gazeta interview came to light. Additionally, as mentioned in the Novaya Gazeta report, the Russian singer Iosif Kobzon did indeed visit Batomunkuyev in a Donetsk burn ward on February 23. A video of this meeting, showing Batomunkuyev in the same bed as in the Novaya Gazeta report, can be viewed here [warning: graphic content]. Lastly, many online sleuths quickly confirmed the tankist’s identity after the Novaya Gazeta interview surfaced by finding Batomunkuyev’s VK (VKontakte) profile. Batomunkuyev’s VK profile has since been deleted, but numerous screenshots and archived versions of the profile are available:

(Novaya Gazeta) I know he was wounded in Lohvynove. Lohvynove – the bottleneck of the Debaltseve pocket – was cleared and secured in the early morning of February 9 by a DNR special forces company (90% of which were Russian organized volunteers). The pocket was closed so fast that Ukrainian soldiers in Debaltseve didn’t know that. In the next few hours the troops of the self-proclaimed Donetsk Republic burned cars running from Debaltseve with impunity. This is how a deputy ATO head was killed.

The claim that 90% of the soldiers were Russian cannot be verified or disproved. However, it can be confirmed that heavy fighting took place in Lohvynove on February 9, as seen in a documentary from Russian state television on “Vesti.”

On February 9, separatists released a video claiming to have killed the deputy ATO head near Lohvynove, as seen in a separatist video where a bloody document supposedly belonging to him is displayed. The Ukrainian military has not confirmed this claim, but supposed video evidence of the claim exists with this document and the separatist boasting of the feat.

(Batomunkuyev) On February 19, I got blown up. …

(Novaya Gazeta) The special forces fell back, replaced by rebel cossacks that were then shelled by Ukrainian artillery. Meanwhile, Ukrainian troops started preparing a breakthrough. A Russian tank battalion was sent to hold the position, after staying in Donetsk for several days before.

The specific battle that led to Batomunkuyev’s injury during dusk of February 19 is difficult to verify; however, fighting was reported as Ukrainian troops withdrew near Lohvynove on February 19.

A dispatch from separatist fighters on February 19 describes how the road between Debaltseve-Artemivsk in the area of Lohvynove has become a “road of death” for Ukrainian soldiers. From the other side, Ukrainian military blogger Dmytro Tymchuk wrote on the morning of February 19 that separatist forces, including about a dozen tanks, were positioned near the Debaltseve-Artemivsk road near north Lohvynove. Lastly, a member of the Ukrainian military claims that his 1st Tank Brigade damaged or destroyed three separatist/Russian T-72b tanks on February 19 near Lohyvnove, but this information cannot be independently verified and only appeared after the Novaya Gazeta report.

The specific skirmish that led to Batomunkuyev’s injuries cannot be confirmed through reliable open source information written on or shortly after February 19. However, numerous sources from that day indicate that separatist forces were positioned in the area where Batomunkuyev suffered his injuries and engaged with Ukrainian forces on the Debaltseve-Artemivsk road near Lohvynove throughout the day.

We painted our tanks over back in Ulan-Ude. Right on the train. We painted over the numbers, those who had Guards markings painted them over as well.

When searching through photographs of tanks on the Kuzminsky training ground, where the 5th Tank Brigade and others were stationed, numerous images of tanks with obscured numbers on the hull can be easily located.

However, not every identifying number on tanks at the Kuzminsky training ground was obscured:

The unloading ramp was at Matveev Kurgan. As we went from Ulan-Ude to Matveev Kurgan, we passed lots of cities. It took us 10 days to get there.

A number of 4th and 5th Tank Battalion soldiers photographed themselves in throughout the Winter at the Matveev-Kurgan railway station, marking it as a key rail yard for transporting military equipment.

Additionally, one 5th Tank Brigade soldier photographed himself and his comrades on the way to Matveev-Kurgan in key cities along the railway, including Poletayevo and Saratov:

Kuzminsky. There are lots of such training grounds there. Tent towns. Some went out, some went in. They greeted previous trains there. After us, there was the Kantemirovskaya brigade from Moscow Oblast. They had paratroopers and a weak tank company.

A large training ground near Chkalova, located at the coordinates 47.403252, 39.227971, grew out of nothing in 2014. The first satellite below is from 2013 with no trace of a training camp, while the others are from the most recent available imagery on Google Earth, clearly showing military build-up and signs of training exercises:

Recent satellite imagery, available on Google Earth at 47.403252, 39.227971

A number of 5th Tank Brigade members were photographed at this camp, along with members of military unit 19612 of the 4th Tank Brigade and unit 54096 of the 6th Tank Brigade, among others.

Geotagged locations on VK are often unreliable, but there is a common thread that links many soldiers together to confirm that they were at the same place at roughly the same time: two Siberian husky puppies. Many tank brigade members photographed themselves with these two huskies at the Kuzminsky base over the winter. In the background of the photographs with the dogs, various elements of the camp—tents, military equipment, trenches—are visible., allowing us to confirm the existence of the camp and the specific military units stationed there.

It is quite rare to have a common identifying feature that is unique to a specific date and time when conducting geolocation, but this is such a case. And yes, much like some camouflage patterns on uniforms and tanks, the fur patterns of the puppies match perfectly in each photograph.

Through the satellite imagery, geotagged photographs of soldiers at the base, and the common thread of two Siberian huskies, it is safe to say that members of the 5th Tank Brigade, and other Russian tank brigades, were stationed at the Kuzminsky base throughout the winter of 2014-15. This verifies a key detail from the injured tankist’s account, bolstering the veracity of his more explosive claims.

There were 31 tanks in the battalion. We went in company by company. Ten tanks in each company. Each 10 tanks got three BMPs, a medical MTLB and 5 Ural trucks with ammo. This is the composition of a company tactical group.

No one has verified the location or makeup of the exact convoy that Batomunkuyev entered Ukraine with, but the Bellingcat Vehicle Tracking Program has identified videos of two convoys in Makiivka uploaded on February 17 similar to those the tankist described (1198 and 1199). In video 1198, there are 4 BMPs, 10 tanks, 1 MTLB, 7 trucks, and 4 fuel trucks with white rectangles (keep this in mind for the next section). The second video, 1199, is filmed in the same location as the first video showing the part of the same convoy, with the same vehicles visible from a different angle. This Makiivka convoy is not Batomunkuyev’s, but the similarity between his description of a convoy’s makeup with BMPs, MTLB, and trucks accompanying the tanks reflect his familiarity with the organization of Russian/separatist military convoys in eastern Ukraine.

About 300 went in. All from Ulan-Ude. Most of us were Buryats. Locals saw us and said: “Well, you are sure reckless guys.”

While the presence of Buryats in eastern Ukraine is only circumstantial evidence, it is worthwhile to note that local residents remarked upon a large presence of Buryat soldiers who arrived around Debaltseve in early/mid-February. Ilya Barabanov of Kommersant published an article on February 19, weeks before the Novaya Gazeta article, describing how a number of Buryats (dubbed the “Donbass Indians”) were fighting in Debaltseve. Andrey Borodulin, a photographer who contributes to Agence France-Presse (AFP), photographed a small group of soldiers near Vuhlehirsk identifying as volunteers from Buryatia. These volunteers were wearing helmets typical for tankists. These Buryats playing football were located at around 48.3094917,38.2968535 in East Vuhlehirsk, next to a Russian T72b and BMP, both of which had white squares drawn on them (also seen here). As pointed out by Ukrainian open source investigator Askai, these white squares are in the same spots as the outline of squares on a T-72b tank photographed by a 5th Tank Brigade member. The 5th Tank Brigade member later deleted this photograph, but kept the rest of his account active. It may be circumstantial evidence that there are Buryat tankists in Deblatseve near tanks with squares in the same spots as tanks earlier photographed by a 5th Tank Brigade member, but it is quite a circumstance for these facts to overlap.

However, not all Buryats fighting amongst separatists in Ukraine are enlisted with the Russian military. There is not a very large Buryats population around Debaltseve, thus they raised considerable attention from both journalists and locals, but one cannot automatically accuse every Buryat in Ukraine of being an enlisted Russian soldier. One separatist fighter using the pseudonym “Vakha Donbass” has given interviews describing how he has traveled from Ulan-Ude in Buryatia to fight in Ukraine. Unlike those in the 5th Tank Brigade, this particular Ulan-Ude native is a bona fide volunteer to the separatist forces in eastern Ukraine.

Minakov got his leg torn off in the tank? It went off with the whole boot. He lost a toe on his right foot, also torn off. The battalion commander was burnt, Chipa the gunner, Spartak… that’s what I recall.

Ukrainian blogger Anton Pavlushko did not just confirm that some of the characters mentioned by Batomunkuyev exist, but that they were in the 5th Tank Brigade with the interviewed tankist. There is no open source evidence available proving that Aleksandr Minakov lost a foot, but we can say that he is a 21-year old contract soldier of the 5th Tank Brigade. Minakov’s VK page has been deleted, but a screenshot of his account remains:

Spartak also exists: a 32-year old man from Ulan-Ude seving in military unit 46108, the 5th Tank Brigade. His Odnoklassniki (Russian social network) profile is still working (archived version).

I had a very good tank. Not just a T-72, but a T-72b. The T-72b is different in that it has a 1K13 aiming device, intended for night shooting, night surveillance, shooting guided missiles.

Journalists have photographed numerous T-72b tanks around Debaltseve in mid-February, including a piece for Buzzfeed from Max Avdeev. Graham Philipps, who has given numerous video dispatches from eastern Ukraine throughout the conflict, gave one of the best available looks at Russian T-72b3 tanks near Debaltseve (more information here with identifying features of the uniquely Russian T-72b3). His useful video provides solid proof that this Russian tank is a part of the separatist arsenal, as reflected from Dorzhi’s claim of transporting T-72b tanks across the border.

In conclusion, the details of this interview stand up to scrutiny of open source research. Not every detail of Batomunkuyev’s story is indisputably verifiable or entirely damning to the Russian narrative of non-involvement in Ukraine, but the cumulative effect of all of these details is hard to dispute. Members of the 5th Tank Brigade of Ulan-Ude were indisputably at the Kuzminsky training ground throughout the winter, starting in November, but it is difficult to determine how many of the 5th Tank Brigade fought in Ukraine. Regardless, one of these tankists was in a burn unit in Ukraine from battlefield injuries, and nearly all of the verifiable details provided in his interview can be confirmed through open source data. It would have taken either an inconceivably talented conspirator or a cosmic coincidence for this interview not to be considered key evidence of Russian military involvement in Ukraine after the adoption of the February 15th Minsk cease-fire accords.

Special thanks to Kirill Mikhailov and Anton Pavlushko for contributions in research in this article.",2015-03-11,How These Adorable Puppies Exposed Russian Involvement in Ukraine
2015,3,https://www.bellingcat.com/news/uk-and-europe/2015/03/09/appeal-to-journalists-for-information-on-the-daniel-morgan-murder-and-its-cover-up/,/news/uk-and-europe/2015/03/09/appeal-to-journalists-for-information-on-the-daniel-morgan-murder-and-its-cover-up/,"

Tomorrow marks the 28th Anniversary of the murder of private investigator Daniel Morgan , and his family’s amazing decades-long campaign for justice . The police corruption around the most investigated murder in British criminal history has been described by an assistant Metropolitan police commissioner as one the biggest stains on Scotland Yard’s history. But Daniel’s murder also leads straight back to the doors of the British press and its relationship with private investigators. It is “the cradle where the dark arts were born” as a senior police officer once described it to me.

Baroness Nuala O’Loan, chair of the Daniel Morgan Independent Panel, has made this timely appeal:

“We are approaching the 28th anniversary of Daniel Morgan’s murder. We want to hear from anyone who believes that they may have information which is relevant to our work. “If you believe you have any such information, no matter how insignificant it may seem, please contact us by email at: contactus@dmip.gsi.gov.uk “

The suspects in the Daniel Morgan murder and its cover-up worked extensively in Fleet Street for over 20 years, and established long term relationships with many journalists and freelancers, particularly at the News of the World, but also at the Mirror Group. Andy Coulson re-employed Jonathan Rees on the latter’s release from prison in 2005. Apart from known collaborators such as Mazher Mahmood and Alex Marunchak, there must be dozens who have information.

It’s my belief nothing will be resolved until the truth of the Daniel Morgan murder comes out. The allegations of phone hacking and payments to public officials are still going through the courts in an atmosphere of recrimination. People can argue about the privacy of celebrities or cheque book journalism, but there can be few moral grey areas in this dark story of murder.

As with the Hillsborough Panel Inquiry, the Daniel Morgan Independent Panel is a fact finding mission

So, for the purposes of truth and reconciliation, and to finally come to terms with a very dark chapter in the history of the British press, all journalists with information should come forward and confidentially contact the panel.

contactus@dmip.gsi.gov.uk",2015-03-09,Appeal to Journalists for Information on the Daniel Morgan Murder and its Cover-Up
2015,4,https://www.bellingcat.com/news/2015/04/30/satellite-imagery-confirms-iran-deploying-additional-uavs-along-the-coast/,/news/2015/04/30/satellite-imagery-confirms-iran-deploying-additional-uavs-along-the-coast/,"

Iran’s southern coastline remains an important deployment location for unmanned aerial vehicles (UAVs).

Satellite imagery from DigitalGlobe shows a probable Mohajer-4 UAV attached to a pneumatic rail launcher on the side of an unmarked airstrip located near a naval base at Konarak. The airstrip is located on the coast of Iran’s southeast-most province of Sistan and Baluchistan. Support vehicles and the associated ground control station were parked nearby.

The development of the 600 meter-long airstrip was observed in late 2009 and the first aircraft hangar was built in early 2012 — the latter signaling the intention to support a regular deployment of UAVs at the airstrip. Iran announced in 2010 that it would equip all the country’s bases along the border with UAVs.

Located in an ideal position to monitor shipping near Chahbahar, the UAVs may support the Islamic Republic of Iran Navy base less than 5 miles to the southeast. Various fast attack craft and Iranian auxiliary vessels are based at this facility.

According to satellite imagery, Iran’s German-built Bander Abbas and Pakistan-built Delvar class boats have been consistently deployed to the base. Iran’s Ghadir coastal submarines, an export version of North Korea’s Yono class, have also made an appearance during naval exercises. In December 2011, up to six were deployed from Bander Abbas for Velayat-90, a 10-day military exercise in international waters spanning the Strait of Hormuz and the Sea of Oman.

Iranian UAVs probably support the base in maintaining situational awareness around areas of increasing economic importance. Last June, Admiral Habibollah Sayyari called the southern coast stretch along the Sea of Oman the country’s “Golden Gate”.

Chahbahar, the country’s only deep-water port, is located less than 10 nautical miles to the east and is currently in the process of being upgraded. Satellite imagery shows a cutter suction dredger reclaiming land for a new container terminal. Future plans would see the port become a major hub for Central Asian exports. China and India both have proposals for the site.

Growing recognition of the region’s importance may eventually see further improvements to the airstrip, similar to those observed on Qeshm. Until that occurs, current infrastructure constraints suggest Iran probably deploys its smaller UAVs with short range and endurance from this location.",2015-04-30,Satellite Imagery Confirms Iran Deploying Additional UAVs along the Coast
2015,4,https://www.bellingcat.com/news/mena/2015/04/27/chemical-crisis-a-timeline-of-cw-attacks-in-syrias-civil-war/,/news/mena/2015/04/27/chemical-crisis-a-timeline-of-cw-attacks-in-syrias-civil-war/,"

On April 16, 2015, the United Nations Security Council heard firsthand accounts of doctors who treated the most recent victims of a wave of Assad’s trademark barrel bombings. The Idlib Governorate in northwestern Syria, a region controlled mostly by opposition forces, was bombarded over several weeks in March by dozens of AIEDs dropped from SyAAF helicopters — many containing toxic chlorine gas.

The wave of attacks killed “at least 206 people, including 20 civil defense workers,” according to Human Rights Watch. Just a few days earlier, the United Nations passed Resolution 2209 condemning the use of chlorine gas in Syria, and claiming they would take action as per Chapter VII of the United Nations charter if chlorine use continued.

“If there was a dry eye in the room, I didn’t see it,” said Samantha Power, U.S. ambassador to the United Nations, in a press interview condemning the attacks. She said the United Nations would take every step possible to hold accountable those responsible for the attacks — a decent consolation for the 206 victims in Idlib.

But this wasn’t the first time the international community promised retribution for Assad’s use of chemical weapons.

In August 2012, a year before the deadly sarin gas attacks on the suburb of Ghouta, Damascus, which killed almost 1,500 Syrian citizens — many of them women and children — President Obama said Assad’s use of chemical weapons presented a clear “red line” for action by the United States. Obama clarified this statement in September 2013, only a month after the attacks, saying:

“The world set a red line when governments representing 98 percent of the world’s population said the use of chemical weapons are abhorrent and passed a treaty forbidding their use even when countries are engaged in war. […] Congress set a red line when it indicated that — in a piece of legislation titled the Syria Accountability Act — that some of the horrendous things that are happening on the ground there need to be answered for.”

Accountability for the Assad government’s red line violation came in the form of an OPCW decision, with support of the United States, Russia, and the United Nations, providing a directive for the destruction of Syria’s chemical weapons stockpiles. Syria agreed, and in October 2013, signed and ratified the Chemical Weapons Convention prohibiting the production, stockpiling, and usage of designated chemical weapons.

Outspoken critics, including the editorial board of the Christian Science Monitor, said the reactive destruction of Assad’s chemical weapons stockpiles wasn’t enough punishment for the Ghouta attacks — that economic and political sanctions, perhaps even military action, was the only suitable response for Assad’s violation of the red line set by the world when they convened in 1992 to sweepingly condemn the use of chemical weapons on any scale.

Others said stockpile destruction was just enough, that foreign intervention could only lead to more issues. Yet despite Syria’s ratification of the Chemical Weapons Convention and agreement to destroy their existing stockpiles, use of chemical weapons has only increased during the Syrian Civil War. As in the most recent wave of attacks in Idlib, the delivery method of these attacks is becoming increasingly more deadly — and Syrian citizens increasingly more demoralized.

Provided the United Nations follows through on their threat of action, the international community’s reaction to the Idlib attacks will certainly be unique: punishment may be handed down for the first time since 2013 for Assad’s use of chemical weapons.

But in the process of determining punishment for the most recent attack, it would be befitting for the United Nations to take a look at some other chemical attacks that have occurred since the inception of the Syrian Civil War to see whether they, too, violate international law. Including the Ghouta attacks in August 2013 and the Idlib barrel bombings in March 2015, there have been numerous chemical attacks throughout Syria, resulting in thousands of deaths. Below are a timeline of the most prominent attacks, up until the Idlib incident.

BZ | Homs | December 23rd, 2012

Video from an opposition media group purportedly showing a victim of the Homs attack

Marking one of the first reports that the Syrian government had deployed chemical weapons inside its own country, a secret State Department cable obtained by Foreign Policy and signed by the U.S. consul general in Istanbul concluded a “compelling case” that BZ was deployed in Homs in December 2012.

BZ is the common name for a non-lethal incapacitating agent, 3-Quinuclidinyl benzilate, controlled under Schedule 2 of the Chemical Weapons Convention. The agent is designed solely for incapacitation and disorientation, and thus has a relatively high margin of toxicity, but in general can cause confusion, stupor, and hallucinations. The Chemical Weapons Convention controls and limits the production of BZ under Schedule 2, meaning any party to the convention is prohibited from producing the chemical for military purposes, but due to BZ’s non-toxicity does not include the chemical under its list of Schedule 1 substances.

The investigation into BZ use was reportedly conducted by an NGO hired as one of the State Department’s facilitating partners inside Syria, and included on-the-ground reports from witnesses and “other first-hand information.”

“it’s incidents like this that lead to a mass-casualty event,” said an Obama administration official who detailed the cable to Foreign Policy — warning if the U.S. government didn’t react strongly to this incident of chemical weapons use, Assad would only be emboldened.

Sarin | Khan al-Assal | March 19th, 2013

Victims of the Khan al-Assal attack treated in a local hospital, March 2013

A victim of overshadowing by the far more deadly Ghouta attacks in August 2013, the Khan al-Assal administrative district of Aleppo became home to the first widely acknowledged use of a nerve agent in the Syrian Civil War. The attack resulted in at least 20 fatalities and over 80 injuries. Many of the killed and injured were civilians, but a significant portion were government soldiers — leading to disputes between which party to the conflict carried out the attack.

In February 2014, a UNHRC Commission of Inquiry released a statement concluding that sarin had been used on multiple occasions in Syria, and that the Khan al-Assal attacks bore similar hallmarks to Ghouta. However, the United Nations did not identify any perpetrators.

Russia, as in Ghouta several months later, claimed the attack was carried out by the opposition using Basha’ir-3 rocket-propelled unguided missiles, parroting claims made by Syrian state news agency SANA immediately after the attacks.

The United States claimed the opposite, with US Deputy National Security Advisor Ben Rhodes stating that the “Assad regime has used chemical weapons, including the nerve agent sarin, on a small scale against the opposition multiple times in the last year” — including on March 19th in Khan al-Assal.

In an interview with former UK CBRN Forces Commander Hamish de Bretton-Gordon, Eliot Higgins and de Bretton-Gordon concluded that the scenario of a DIY rocket being used by opposition forces as per Russian claims was “highly improbable,” simply due to the delivery methods of sarin and the level of sophistication involved in deploying the agent. Still, the incident remains unresolved on an international level.

Sarin | Saraqeb | April 29th, 2013

One of the canisters identified in the aftermath of the Saraqeb attack

Shortly after noon on April 29th, the town of Saraqeb in the Idlib Governorate was bombarded from a government-held position by conventional munitions. Later, eyewitnesses spotted two canisters dropped from a helicopter hovering over the town.

The canisters were reportedly emitting a trail of smoke as they fell, with a strong odor eyewitnesses described as “suffocating.” Mostly due to the small scale of the attack, Saraqeb was not acknowledged widely by media at the time, but reports have shown at least 19 casualties and one death.

Because of the agent’s delivery method and lack of fatalities reported, the canisters used in the attacks did not seem to contain a lethal nerve agent such a sarin. However, Saraqeb later became one of five locations confirmed by the United Nations to have experienced a sarin attack between March and August 2013, along with Ghouta, Jobar, Khan al-Assal, and Ashrafiat Sahnaya.

Sarin | Ghouta | August 21st, 2013

A spent Volcano rocket purportedly used in the attack

The most infamous of all Syrian chemical attacks, and perhaps the single most analyzed incident in Bellingcat’s brief history — the August 21st chemical attacks on Ghouta, Damascus. With over 5,000 people affected by the attack and 1,500 killed, according to estimates by US intelligence and various NGOs, Ghouta sparked the most extensive international reaction of any incident in the Syrian Civil War.

Blame for the Ghouta attacks has been pinned almost universally on Assad’s Syrian Arab Army, but there are a few holdouts — namely the more contrarian conspiracy sites, fueled by an official insistence from the Russian government that the attacks were carried out by the opposition. Still, at least a dozen independent sources, including six governments, have formally placed culpability on the Syrian government.

Following Assad’s ratification of the Chemical Weapons Convention in the aftermath of Ghouta, there has been an upswing in the use of toxic and often fatal chlorine gas, the manufacture of which isn’t prohibited by the Chemical Weapons Convention, over more traditional nerve agents like sarin.

Chlorine | Kafr Zita | April 11th, 2014

Cylinders containing an unknown substance found in the aftermath of the attack

In October 2014, the UNHRC confirmed use of chlorine gas via barrel bombings in the town of Kafr Zita, an incident which resulted in 100 casualties and three deaths — all civilians.

Due to its strategic location 40km north of Hama and relatively stable territorial control by the Syrian opposition, Kafr Zita has long been the subject of attacks by the Syrian government in its attempts to drive the opposition out. At the time of the April 2014 chlorine attacks, Kafr Zita was the forwardmost major town held by the rebels in relation to Syrian government-controlled territory, which stretches from Hama to Damascus.

Given the trademark use of barrel bombs as a delivery device for the chlorine, blame was placed by most critics on the SyAAF, while the Syrian government itself, through its state-run news agency, placed blame on JAN brigades — despite JAN not having an air presence. In a report for Britain’s Telegraph, the aforementioned CBRN specialist Hamish de Bretton-Gordon concluded via analysis of on-the-ground samples that chlorine was used in Kafr Zita. Further investigation by the Telegraph concluded, similarly to the UNHRC, that the source was likely barrel bombs dropped from SyAAF helicopters.

Chlorine | Idlib | March 16th-31st, 2015

Refrigerant canister found among the remnants of a barrel bomb in Idlib, March 24th, 2015

On April 14th, 2015, Human Rights Watch published a report accusing the Syrian government of using toxic chemicals including chlorine in a wave of six attacks in the Idlib Governorate between March 16th and March 31st, 2015. HRW called on the United Nations to “respond strongly” to the attacks, and to “act decisively to establish responsibility.”

The wave of attacks resulted in 206 casualties, and six civilians were killed in one incident of barrel bombing on March 16th. According to on-the-ground interviews from HRW, unlike traditional barrel bombings (which are particularly devastating for the Syrian populace simply due to their unpredictable nature), none of these attacks resulted in explosions — in many cases, locals only realized something was wrong when hospitals began filling up with patients showing signs of chlorine gas exposure.

The United Nations reacted strongly to the attacks, and promised decisive action. But with Russia as a permanent member of the United Nations Security Council, decisive action may remain indecisive for quite some time.

Since writing this article, yet another video has emerged purportedly showing a chlorine attack on a village in northwest Syria, in rebel-controlled territory.

The physical properties of the plume shown in the video are consistent with chlorine, and if the video is accurate, will make this incident the second example of weaponized chlorine use since the United Nations condemned the use of chlorine in Syria last month.

What is Assad’s end game? He clearly believes the United Nations will fail to follow through on their threats of action, yes, but the increased use of chemical weapons — a much less effective but much more demoralizing agent than conventional munitions — show desperation on the part of the government. With extensive territorial gains from foreign militants, attrition of Syrian armed forces across the country, and the largest non-ISIS rebel offensive since at least 2014, there is an air of uncertainty and perhaps even futility surrounding Assad’s military actions. He is four years into a war with no foreseeable end, and wariness has hit all sides hard. But Assad made the decision long ago to fight until there’s no fight left, even if it means using chemical weapons to do so.",2015-04-27,Chemical Crises: A Timeline of CW Attacks in Syria's Civil War
2015,4,https://www.bellingcat.com/news/africa/2015/04/25/libya-dawn-going-diy-s-125-sams-used-as-surface-to-surface-missiles/,/news/africa/2015/04/25/libya-dawn-going-diy-s-125-sams-used-as-surface-to-surface-missiles/,"

A lack of spare parts for Libya’s sophisticated weaponry has resulted in a number of interesting conversions by the Libyan National Army and Libya Dawn, both poised to get the edge over the other party. Recent examples of such conversions have included the installment of Oerlikon GDF naval guns on trucks by Libya Dawn and the installment of AK-230 naval guns on trucks by the Libyan National Army.

Libya Dawn, currently in control of Libya’s captital Tripoli and other large cities like Misrata , inherited a large number of surface-to-air missiles (SAMs) found in the vast swats of land it controls in the west of Libya. As there is little to no need to use the SAMs in their originally envisioned role, Libya Dawn began investigating the feasibility of turning some of the SAMs into surface-to-surface missiles. The militant group already gained experience with such conversions when they used several Kh-29 air-to-surface missiles, once equipping Libya’s Su-24s, as unguided rockets near Tripoli.

In a quite surprising move, Libya Dawn transferred at least two complete S-125 SAM brigades along with associated misssiles and equipment to Tripoli in early December 2014 and in early March 2015.[1] [2] While the initial move behind these transfers remained unknown, images now reveal Libya Dawn has begun using the S-125s as surface-to-surface missiles

The missiles, still installed on their (now mobile) original launcher, had their fins at the front removed for a more stable flight path in the unguided surface-to-surface role. More interestingly, the nose was lengthened, possibly to increase the size of the warhead. The original missile only packs a 60 kilograms heavy warhead, which is enough to heavily damage or destroy a potential aerial target but far too light for doing any substantial damage when used in the surface-to-surface role. The warhead might also have been replaced by a regular high explosive one, which is more effective than the original high explosive fragmentational warhead designed to wreck aircraft. Finally, it seems the proximity fuse usually associated with the system has been replaced by more appropriate ones for use against ground targets.

The conversion of SAMs to function in the surface-to-surface role by Libya Dawn is actually not a first in the world. Back in 1988, Iraq converted several S-125s to ballistic missiles with an intended range of 200 kilometers. The missile, called al-Barq, was modified to suit the surface-to-surface role by removing the features which enable the S-125 to be such a manoeuvrable missile: the missile’s canards and the radio fuse in the warhead were removed, and the missile’s self-destruct mechanism was disabled.

This conversion proved to be everything but easy as the S-125’s warhead is part of the airframe, and was difficult to modify. Work on the missiles progressed slowly, and although several flight tests were indeed carried out, the achieved range totalled only 117 kilometres with a circular error probable (CEP) of several kilometres. Because of the unsatisfactory results, the project was subsequently terminated in 1990.

Obviously, it is highly implausible Libya Dawn could cobble something together from dusty leftover missiles that would manage to achieve the range or accuracy of even the failed al-Barq, meaning the field conversions likely suffer from both abysmally short range and crippling inaccuracy. However, with more than enough S-125s to scavenge and a civil war that does not appear to be going anywhere, conversions like these will undoubtedly continue.",2015-04-25,Libya Dawn Going DIY: S-125 SAMs Used as Surface-to-Surface Missiles
2015,4,https://www.bellingcat.com/news/uk-and-europe/2015/04/01/coulson-cameron-brooks-the-political-element-in-phone-hacking/,/news/uk-and-europe/2015/04/01/coulson-cameron-brooks-the-political-element-in-phone-hacking/,"

Given the current febrile atmosphere of the election campaign here in the UK, this is worth revisiting. A comprehensive report by the Media Standards trust shows how politically targeted phone hacking at News of the World was – mainly under the editorship of Andy Coulson (the only surviving phone records to confirm hacking date from a year or so of his editorship

A striking number of targets were people in positions important to national security. Four consecutive Home Secretaries from 1997 to 2007 are reported to have been hacked, as well as many senior officers from the Metropolitan police (including Sir Ian Blair, John Yates, Mike Fuller, Andy Hayman, Brian Paddick and Ali Dizaei). And it turns out that the News of the World was seven times more likely to hack a Labour politician than a Conservative one. But what emerges most clearly is that the great majority of those who were hacked were people most of us had never heard of. Many were connected to public figures, but often simply by being related to them, or working with them, or being their friends. You might be hacked because you were, for example, the partner or ex-partner of a public figure, or a work colleague or a friend or acquaintance or a parent or step-parent.

via Who was hacked? A New Report Investigates | Policy Wonkers.

The odd thing about the occasional Tory target of phone hacking is that, by and large, they were rivals to David Cameron such as Boris Johnson or David Davies.

Coulson become Cameron’s press supremo in 2007, a few months after resigning from New of the World post the conviction of Mulcaire and Goodman. According to Leveson Inquiry evidence, it was George Osborne who suggested the former NOTW editor for the job. Two years previous, during Cameron’s leadership content, Coulson’s paper had spoiled a Sunday Mirror scoop about Osborne’s association with a dominatrix, Natalie Rowe, and a friend who used cocaine. The NOTW was seen as much more favourable and defused the story. Cameron went on to win the leadership campaign.

By this time Cameron is in the members register of interests accepting hospitality from Coulson’s predecessor and erstwhile lover, Rebekah Brooks. Brooks’ weekend home, of course, was only a few miles away from Cameron’s constituency home.

So it’s probably no surprise Cameron wasn’t the target of phone hacking. But given the future trajectory of many of the players – especially around the 2010 general election – the political element in phone hacking leaves many elements yet to be explored",2015-04-01,"Coulson, Cameron. Brooks: the political element in Phone Hacking"
2015,5,https://www.bellingcat.com/news/uk-and-europe/2015/05/31/mh17-forensic-analysis-of-satellite-images-released-by-the-russian-ministry-of-defence/,/news/uk-and-europe/2015/05/31/mh17-forensic-analysis-of-satellite-images-released-by-the-russian-ministry-of-defence/,"

In this new report Bellingcat examines satellite images released by the Russian Ministry of Defence as part of the July 21st 2014 press conference on the downing of Flight MH17.

The Russian MoD stated at the press conference that the satellite photos show the activities of Ukraine’s air defences on the day that Flight MH17 was shot down. In particular, the position of two Ukrainian Buk missile launchers south of the village Zaroschinskoe were shown to be within firing range of MH17. The Bellingcat investigation has found the following –

– Satellite images presented by the Russian Ministry of Defence claiming to shown Ukrainian Buks linked to the downing of MH17 on July 14th and 17th are in fact older images from June 2014.

– The discrepancies visible in the Russian MoD satellite map imagery which shows they are incorrectly dated are visible in publicly available imagery on Google Earth.

– Error level analysis of the images also reveal the images have been edited.

– This includes a Buk missile launcher that was removed to make it appear the Buk missile launcher was active on July 17th, and imagery where Buk missile launchers were added to make it appear they were within attack range of Flight MH17.

Full versions of the report are available in Russian, German, and English. Images used in this report can be found here, and here without text.. With this new report all four major claims made at the Russian Ministry of Defence press conference have now been shown to be false: – The flight path was not altered in the way claimed by the Russian Ministry of Defence. Data from the Dutch Safety Board’s preliminary report and other sources show Flight MH17 made no major course changes such as the one described in the Russian Ministry of Defence press conference. – The Russian Ministry of Defence claimed the video of the Buk missile launcher presented by the Ukrainian Ministry of Interior was filmed in the Ukrainian government control town of Krasnoarmeisk. This has been proven to be untrue, with analysis of the video showing it was filmed in the separatists controlled city of Luhansk. – Radar imagery was described as showing an aircraft close to Flight MH17 after it was shot down. Experts interviewed by various media organisations have stated this is almost certainly debris from Flight MH17 as it broke up over Eastern Ukraine. – Satellite imagery shows Ukrainian Buk activity around July 17th. As this report shows, those claims are untrue, and were based on fabricated satellite imagery.

These claims, representing the majority of information publicly presented by the Russian government since the downing of Flight MH17, are a clear attempt by the Russian government to deceive the public, global community, and the families of the Flight MH17 victims, only days after Flight MH17 was shot down.",2015-05-31,Forensic Analysis of Satellite Images Released by the Russian Ministry of Defence
2015,5,https://www.bellingcat.com/news/uk-and-europe/2015/05/31/avalanche/,/news/uk-and-europe/2015/05/31/avalanche/,"

Читать пост на русском языке

One of the most obvious examples of Russia’s supplying of military equipment to the Donbass can be found in the infantry fighting vehicle (BMP-2) with the inscription of “Lavina” [Avalanche] and painted-over hull number.

At the end of August 2014, “Lavina” was recorded in Staraya Stanitsa, Russa, just north of Kamensk-Shakhtinsky (coordinates of video here). “Lavina” was seen in a column of military equipment with the eloquent inscription of “За Донбасс!” [For the Donbass!] and flags of so-called Novorossiya. Army tractor haulers are carrying the equipment. Residents of Staraya Stanitsa recorded this column on video.

They also posted photos on social network sites:

(Archived here)

In September, the “Lavina” BMP-2 showed itself in Ukraine, as seen in this photo from Associated Press reporter Darko Vojinovic in Zhdanivka in the Donetsk oblast’:

In October, a video was uploaded online in which “Lavina” was recorded in a convoy of military equipment moving through Yenakiieve (coordinates of video here)

As seen on social network sites, separatist fighters pose in front of this BMP-2:

In 2015, the “Lavina” BMP-2 actively participated in the battles for Debaltseve. “Lavina” is repeatedly seen in Vuhlehirsk in videos shot by both separatist and Russian correspondents (coordinates of videos here).

Screenshot from this video:

Screenshot from another video:

Thus, with the help of online open source information, it is possible to verify that Russia has sent military equipment into Ukraine with the intent of the equipment’s use in ongoing hostilities.",2015-05-31,The Avalanche that Went from Russia to Ukraine
2015,5,https://www.bellingcat.com/news/uk-and-europe/2015/05/30/russian-official-account-of-attack-on-ukraine-border-guards/,/news/uk-and-europe/2015/05/30/russian-official-account-of-attack-on-ukraine-border-guards/,"

The hacker collective “Ukrainian Cyber Forces” released a trove of documents from servers of the Russian Interior Ministry in December 2014, revealing a document that disclosed details of a Russian military attack on Ukrainian border guards. Among the 36GB of files (1.7gb cache here), the vast majority are completely unrelated to Ukraine—bureaucratic paperwork, criminal cases, border inspections, and so on. However, buried underneath endless minutiae is Донесение Тарасовский 26.08.2014 2.doc.

This report was written to A.P. Larionov, an official of the Russian Interior Ministry in the Rostov oblast’ from I.I. Trofimenko, an official of the Russian Interior ministry of the Tarasovsky district. The report is a police account written on August 26 describing the circumstances of a battle that took place on August 25 between Russian soldiers and the Ukrainian National Guard. Four of these Russian soldiers were injured in the fight and were evacuated to a Rostov garrison hospital. The key section of the account is as follows (translation from original Russian):

On August 25, 2014 around 3:50pm, M.V. Polstyankin, O.Yu. Volgin, Yu.A. Alekseev, and A.A. Gerasimenko, serving in contracted Unit 51182 of the Millerovo locality, suffered injuries in the performance of official duties during a clash with the forces of the National Guard of Ukraine 10km north-west of the small village of Prognoi of the Tarasovsky region. At 6:52pm on August 25, 2014, the wounded were evacuated to the Rostov garrison hospital via a Mi-8 helicopter of the Russian armed forces.

Using open source investigation, we can find various pieces of information that confirm that this leaked account did indeed occur. On August 26, the day after the events described in the above leaked document, the spokesperson of the Ukrainian National Security and Defense Council gave a briefing that details an attack on Ukrainian border guards. This attack took place in the area of Krasnaya Talovka, resulting in the death of four border guards and three injuries.

On August 25 in the area of “Krasnaya Talovka” of the Luhansk oblast, a sabotage and reconnaissance group which crossed the border from Russia was detected. At 3:00pm, a well-disguised border detail used automatic weapons to stop the advance of the saboteurs. Additional operational combat groups of border guards arrived at the battle as reinforcements. The fierce battle with Russian mercenaries lasted for two-and-a-half hours. The diversionary group was supported with fire from mortars, two APCs, and two IFVs from the Russian Federation. Additionally, Ukrainian border guards were fired upon by unguided rockets from two Mi-24 combat helicopters of the Russian armed forces. During the battle, four border guards died and three were wounded. Thanks to the actions of the heroes, a breakthrough across the border did not occur. The enemy suffered significant losses. The wounded and killed saboteurs were evacuated from the battlefield in Russia with an IFV under the cover of fire from APCs and helicopters.

There are numerous details in the two accounts that align, leading us to believe that the Ukrainian and Russian accounts are describe the same event.

Both events occurred at August 25. According to the Russian account, four soldiers were injured “around 3:50pm,” while the Ukrainian account details how the two sides engaged at 3:00pm.

The Ukrainian details how account says that the border guards stopped a “sabotage and reconnaissance group” coming from Russia. The Russian account details how four Russians were injured “in the performance of official duties” while clashing with forces from the Ukrainian National Guard.

Both accounts describe how a helicopter entered the battlefield at the end of the fight. The Russian account goes into more detail, describing how the four wounded soldiers were evacuated with a Mi-8 helicopter.

The Ukrainian account describes how the fight took place near Krasnaya Talovka, while the Russian account says that the clash happened “10km north-west of the small village of Prognoi.” Krasnaya Talovka is almost exactly 10km north-northwest of Prognoy.

All of the press releases and leaked documents pale in comparison with the human stories of this fight, which are painfully real, despite any doubts that many cast on the veracity of the leaked documents. This human suffering exists for both Russian and Ukrainian families. As described in the leaked Russian document, the young Russian paratrooper Mikhail Polstyankin, who was serving in military unit 51182 in Millerovo, died in the fight with Ukrainian border guards. The Gruz200 blog (not to be confused with similar efforts that share the name) presented four posts from social media, including Facebook and VK, documenting the death of Mikhail Polstyankin. Two people from his hometown posted regarding the death of the soldier on August 28, three days after the firefight on the border, and a third person posted a message [archived] celebrating the “Eternal memory of Misha Polstynkin—The young Russian warrior who was for the Russian language and Rus’!!!”

There are also remarkable stories within these leaked documents regarding Ukrainian soldiers, with one standing out. In one document, a report describes how a Ukrainian lieutenant named Eduard Masko was injured on July 16, 2014 while fighting separatist soldiers. As we find in an article on Faktu.ua, Lt. Masko was indeed wounded while fighting on July 16 (further bolstering the legitimacy of these leaked documents) after separatist forces attack a block post near Marinovka, Ukraine. Masko was badly burned and could not walk on either of his legs, as one was broken and the other burned. Eventually after being dragged to a nearby safe area, an ambulance took Masko to a hospital—in Russia. However, as we learn in an interview with the injured soldier, the doctors and nurses at this hospital saved his life by amputating his injured leg. Unfortunately, Masko’s comrade who was also injured in the attack died in this hospital—the Russian doctors and nurses cried after he died. Soon after, Masko returned to Kyiv to receive additional treatment. He is now alive and well—perhaps even better than before. His newborn son Kostya was born shortly after he received near deadly injuries, and Masko was able to travel to America to receive superior treatment for his burns.

While leaked documents cannot always be trusted at face value, they can also be valuable in providing extra validation of some events. Leaked documents or not, there was a border clash on August 25, and Eduard Masko was hurt on July 16 and treated in a Rostov hospital. However, by following the leads provided in these leaked documents, the narratives can gain many dimensions with open source information, including both the tragedy of Russian soldier’s death after attacking a Ukrainian checkpoint and the joy in the kindness of ordinary Russians in saving a Ukrainian soldier’s life.

See this post from the Global Voices Online special project “RuNet Echo” for this story in its original form, along with a profile of the hacker collective who leaked the documents.",2015-05-30,Russian Official Account of Attack on Ukraine Border Guards
2015,5,https://www.bellingcat.com/news/uk-and-europe/2015/05/29/whos-lying-an-in-depth-analysis-of-the-luhansk-buk-video/,/news/uk-and-europe/2015/05/29/whos-lying-an-in-depth-analysis-of-the-luhansk-buk-video/,"

On July 21st 2014, only a few days after Flight MH17 was shot down in Eastern Ukraine, the Russian Ministry of Defence held a lengthy press conference, detailing what they claimed to be evidence of who was responsible for the downing of Flight MH17.

The claims included evidence of Flight MH17 significantly altering its course, radar data that showed an aircraft close to Flight MH17, satellite images of Ukrainian Buk missile launcher in the area on July 17th, and a video of a Buk missile launcher shared by the Ukrainian Ministry of Interior that the Russian Ministry of Defence claimed was presenting false information about its location.

One claim in particular was hotly debated. A video showing a Buk missile launcher was shared online by the Ukrainian Ministry of Interior on July 18th, reportedly filmed on the morning of July 18th.

This claimed to show the missile launcher linked to the downing of flight MH17 heading towards the Russian border. It was clear the Buk missile launcher was being transported by the same truck and low-loader (described as having a cabin unique in the area by its owner) seen in images and videos from July 17th, showing a Buk missile launcher being transported through separatists held territory.

However, the Russian Ministry of Defence disagreed. They claimed the video has been recorded elsewhere, showing a location in government held territory.

“For example, media circulated a video supposedly showing a Buk system being moved from Ukraine to Russia. This is clearly a fabrication. This video was made in the town of Krasnoarmeisk, as evidenced by the billboard you see in the background, advertising a car dealership at 34 Dnepropetrovsk Street. Krasnoarmeysk has been controlled by the Ukrainian military since May 11”

The Russian Ministry of Defence displayed the following image showing what they claimed the billboard said.

So on one side the Ukrainian Ministry of Interior is claiming the video shows the Buk heading towards Russia, while the Russian Ministry of Defence is claiming the video was filmed in territory controlled by the Ukrainian government, which is especially significant as the truck and low-loader is clearly the same one seen travelling through separatists held territory on July 17th.

Unfortunately for the Russian Ministry of Defence something that would have been at one time very difficult to prove is now, thanks to the internet, just a matter of looking in the right places. On July 22nd the following images were shared on Twitter, claiming to show the exact location the video was filmed in separatists controlled Luhansk, close to the Russian border.

Чуть подробнее по координатам съемки уезжающего российского Бука в Луганске. 48.545760°, 39.264622° #MH17 pic.twitter.com/yush3ACYyU — ЄВРОМАЙДАН (@euromaidan) July 22, 2014

Using a variety of online resources it is possible to confirm that this is the correct location. A website with feeds for traffic cameras in Luhansk included a camera pointing directly at the location that the Buk travelled through. Traffic cameras in Luhansk had been shut down a week before July 17th, but preview images from the cameras were still available. It should be noted since Bellingcat published its original work on the Luhansk Buk video the traffic camera site has been shut down for unknown reasons, but was archived on July 17th, where the preview image is still visible.



The traffic camera is positioned to the right of the location of the camera in the Buk video, which was pointing across the top of the trees in the bottom left corner of the picture towards the billboards and intersection. Clearly visible is a billboard with the same car advertisement and green border visible in the Buk video.

Billboards are not unique, but it’s also possible to explore the area using other resources. While Google Street View is a well known service for exploring ground level imagery of towns and cities, Yandex Maps also offers a similar service, which, unlike Google Street View, covers Luhansk, including the area visible in the Buk video. The imagery from the area is a few years old, and the billboards are recent additions to the area, so are not visible in the street view imagery from Yandex Maps.

The absence of billboards in the area is apparent in historical satellite imagery of the area from 2011 visible in Google Earth, with the earliest dated Google Earth imagery available showing them in March 2014.

The age of the Yandex Maps imagery is also apparent when looking at the nearby church, only partially constructed in the Yandex Maps imagery, but clearly visible in the image from the traffic camera.

Of particular interest is a set of buildings with silver and red roofs near to the church, visible in the traffic camera image to the right of the church. In the Buk video it’s possible to make out the red and silver roofs, as well as a red and silver chimney, matching perfectly with these buildings.

In addition to these matches a Luhansk local visited the site and took various photographs which were then shared on Livejournal, including a clear photograph of the billboards in the area and the local church.

The photographer also took a picture of the red and silver roofed buildings nearby, again confirming this is the same location shown in the video. It also shows that despite the street view imagery being at least 3 years old the roofs and chimney are still the same colour now as they were in the street view imagery and Buk video.

These images allowed smaller details in the video to be matched, such as the detail on the lamp posts, and shape of the curb.

It’s also possible to identify a second billboard visible in the Buk video, heavily obscured, and only visible briefly at the start of the Buk video. The same billboard is also visible in the traffic camera image.

Another image of the area is available on Panoramio, described as being taken on October 12, 2013, and showing a position closer to that of the position in the Buk video.

It’s possible to match objects in the Buk video with objects in the Panoramio photograph, also establish the position of the Buk video camera is to the right and below the position of the Panoramio photograph camera. In the below image the position of three features are highlighted, the right side of the billboard (red), the pole (green), and the chimney (yellow).

As we can see, to match the position in the Buk video the camera position in the photograph would need to move to the right for the right side of the billboard to line up with the pole, resulting in the chimney appearing to the right of the billboard and pole. That would also mean the tree marked in green in the below image would appear further to the left in the Buk video, obscuring more of the building marked in pink.

It’s also possible to make out the pole visible in the Buk video in exactly the right position in the Panoramio photograph.

And near the pole the cable connectors visible in the Buk video.

Yandex Maps street view imagery can be used again to show us the position of the Buk video camera from the junction where the Buk was filmed. This image shows apartments overlooking the trees visible in the Luhansk Buk video, further confirming this is the correct location.

It’s now clear the video was filmed in Luhansk, and based on the position of buildings and structures in the video it’s clear the camera is positioned west of the road, facing eastwards. In the first moments of the video a window frame is visible on the right side of the shot, indicating the camera is positioned inside the apartment buildings overlooking trees, which partly obscure the view of the road in the video. The following map shows the approximate position of the camera and the Buk in the video.

The Russian Ministry of Defence had claimed “This video was made in the town of Krasnoarmeisk, as evidenced by the billboard you see in the background, advertising a car dealership at 34 Dnepropetrovsk Street.”, but this is clearly untrue, the photographs taken of the billboard clearly show it says something completely different from what is claimed by the Russian Ministry of Defence.

This appears to have been a frustrating piece of evidence for someone, when Correctiv visited the site several months later the billboard had suffered a very specific piece of vandalism.

The same location was also visited by 60 Minutes Australia, who again confirmed the location was correct.

The 60 Minutes Australia report which visited the Luhansk site was attacked by Robert Parry (best known for his reporting on the Iran-Contra affair), who claimed 60 Minutes Australia had attempted to deceive their viewers, and that they were “engaged in a wilful fraud“. However, it is clear thorough analysis the 60 Minutes Australia visited the correct location, and that Robert Parry is wrong in his assessment.

Although most of the billboards have been stripped, it’s still possible to make out parts of the advertisements that were on them on July 17th. One example is the billboard that was partly obscured in the video, and photographed by the Luhansk local

In response to Parry’s initial accusations 60 Minutes Australia showed footage of the pole visible in the Buk video, that was also photographed by the Luhansk local, that also clearly matches.

Cables in the Buk video are also visible in the video from 60 Minutes Australia, with the black connectors (boxed in red) and the cable connected to the distinctive pole (boxed in green) visible in both sets of footage.

In a piece of footage filmed as they approach the location a distinctive building is visible, which is also visible on street view imagery of the area.

This building is next to the red and silver roofed buildings and the red chimney visible in the Buk video.

Moments later after the grey roofed building is visible the church that’s nearby is also visible.

60 Minutes also filmed the church in other shots, clearly showing that this is the correct location.

As we can clearly see, despite accusations by Robert Parry that 60 Minutes Australia was “engaged in a wilful fraud“, 60 Minutes Australia had in fact visited exactly the same site shown in the Luhansk Buk video, further confirming the Russian Ministry of Defence lied about the video at their July 21st press conference.

But this is just one of the lies and fabrications presented by the Russian Ministry of Defence in their July 21st press conference. Radar data presented, supposedly showing an aircraft near MH17 appearing on radar moments after it was shot down almost certainly showed instead the debris of MH17 as it broke up over Ukraine. The claim that MH17 was redirected from its flight path was shown to be utterly untrue, based on data released by the Dutch Safety Board investigation into the downing of Flight MH17.

From this it is clear that the reaction of the Russian government to the downing of Flight MH17 was to create a series of untruths and fabrications, and to present them to the world, including the families of those killed on July 17th. In addition to the above examples Bellingcat will soon be releasing a detailed report clearly demonstrating more of the evidence presented at the July 21st press conference was fabricated.

It is also clear that open source and social media investigation can play a major role in debunking lies and propaganda, and empowers anyone to find the truth, even when powerful governments attempt to obscure it.",2015-05-29,Who's Lying? An In-depth Analysis of the Luhansk Buk Video
2015,5,https://www.bellingcat.com/news/uk-and-europe/2015/05/26/mamai-geolocation/,/news/uk-and-europe/2015/05/26/mamai-geolocation/,"

Ruslan Leviev and his team of investigators recently released an in-depth report on three Russian soldiers who died fighting in Ukraine. Leviev and his team members managed to track down the gravesites of each of these soldiers, all of which belonged to and were still active servicemen in the Russian 16th Separate Spetsnaz Brigade, military unit 54607. One of these soldiers was Timur “Mamai” Mamayusupov, photographed in May next to a distinct APC with shark teeth. This location was assumed to be Luhansk, but only now can this location be confirmed via geolocation. Below is a summary of the English translation of a report detailing the investigation from Leviev and his investigation team.

Our investigation of three Spetsnaz servicemen killed in Ukraine featured several pieces of evidence that they really did visit Eastern Ukraine. A photo shows Ivan “Kardan” and Timur “Mamai” with weapons in a semi-ruined building, Kardan having white leg bands characteristic of rebels. “Mamai” was photographed close to two APCs, one of them bearing a distinct “shark” paint job.

(original message | original photo | saved copy).

However, until now we had not managed to find photographic or video evidence conclusively proving that the killed Spetsnaz servicemen were in the Donbass. So, we went back to Timur “Mamai”’s photo in front of the painted APC (we called “the shark APC”).

In the comments to the translation of our investigation published on Bellingcat, a reader noted that Mamai’s photo was probably mirrored. This is visible by the APC’s paint job, as well as that in the photo Mamai apparently has his left hand on the trigger. We can also see a part of the inverted “P” (from the word “ЛНР” meaning “Luhansk People’s Republic”), confirming that the image was mirrored. Thus, the tree branch is actually to the left of Mamai, not the right. The below photograph of Mamai is properly mirrored, showing the original photograph with distinguishable landmarks:

After searching for photos of the Shark APC, it turned out that this vehicle had already been noticed by many Ukrainian and Western investigators. We found an array of photos that show some of the landmarks visible in the photo with Mamai, including this photograph found on VK, which was taken at the same location as the Mamai photo, with several landmarks visible in both images.

There are five landmarks that are visible in these two images; all of these places must be located in order to verify a geolocation:

A distinct light-yellow two-storey building with white shutters (in both photos, purple )

) A red fence (in both photos, red)

A bent tree with distinct branch (in both photos, green )

) A tall chimney (only in Mamai photo, blue )

) A yellow marker on top of the red fence directly behind Mamai (only in Mamai photo, yellow)

All of these landmarks can be identified in photographs available in open source data.

On April 8, a local tweeted a picture of a rebel base, giving the location as the backyard of Mafia restaurant on Oboronna street:

In April, a Ukrainian English-language website lugansk-news.com investigated the likely separatist base in Luhansk quite thoroughly, giving, in particular, this geolocation near Oboronna and Sasyury streets:

The red fence, distinct tree, yellow marker, and yellow building are all visible in this photograph, showing a rebel base in Luhansk with numerous APCs.

But another landmark still remains–the tall chimney. A similar chimney is visible at a boiler near the location specified by lugansk-news.com, and in line with the previous geolocation:

After locating this chimney, we can now give exact coordinates for each of the landmarks visible in the photos:

Distinct light-yellow two-storey building: located at exactly 48.5604442, 39.3163428

Red fence: located at exactly 48.560453, 39.316130

Bent tree with distinct branch: shadow visible on current Yandex satellite imagery, located at exactly 48.560457, 39.316202

Tall chimney: located at exactly 48.558031, 39.319053

Yellow marker on top of the red fence directly behind Mamai: located on fence at exactly 48.560453, 39.316130

This base, and the location of the Russian soldier “Mamai,” is near the “Gratsiya” factory and “Mafia” restaurant in central Luhansk at 48.5605241, 39.316147.

This article is a summary of a more detailed geolocation report found here in English translation. The authors and translators have included information for supporting their research through donations to their Yandex wallet at the end of the detailed article.",2015-05-26,Confirmed: Active Russian Spetsnaz Serviceman Photographed in Luhansk
2015,5,https://www.bellingcat.com/news/2015/05/25/ramadi-haze/,/news/2015/05/25/ramadi-haze/,"

In my last post, I mentioned that

[The Islamic State] reportedly used the cover provided by a dust storm to gain a military advantage during the start of their assault last week; American warplanes were unable to provide air support for the Iraqi forces under attack owing to poor visibility.

Well, it turns out that the New York Times article that I referenced, which was based on remarks by unnamed “current and former American officials,” may have gotten its facts wrong. That is if new reports prove correct, which contend that there was no dust storm at all, just “minor dust and haze” that had “zero impact” on coalition air flights, according to Colonel Patrick Ryder, a spokesman for US Central Command.

Department of Defense spokesman Colonel Steven Warren echoed the point, saying,

What we know is that there was weather, that the weather did not impact our ability to conduct air strikes, but we are coming to the understanding that the commander on the ground believed otherwise and that was one of the factors that contributed to his decision to reposition.

So, the obvious question is What was the weather like in Ramadi when IS began its assault on Thursday (May 14) and Friday (May 15) of last week?

Unfortunately, Weather Underground’s data for May 14 is incomplete. WU reports hazy conditions between 5 AM and 7 AM, but most of the rest of the day is “unknown” with desultory reports of overcast and mostly cloudy conditions. WU’s May 15 data is more complete; the conditions are “unknown” for only 2.5 hours during during daylight hours. The conditions on Friday alternated between clear and partly cloudy conditions throughout the day.

In cases of actual dust storms, WU records “widespread dust,” as was the case in Salt Lake City last month, where visibility was reduced to a quarter of a mile.

While historical weather data seems to corroborate the new narrative that an Iraqi general used a little haze as an excuse to retreat, a number of tweets, a set of photos by the Associated Press, and a surprising lack of air support muddy the water.

Searching Twitter for “الرمادي” (Ramadi in Arabic) on May 14 yielded two tweets with photos referencing the weather:

and

#الرمادي اجواء غائم تماما وعاصفه ترابيه خفيفه اللهم مكن جنود الخلافه من فتح الرمادي اللهم امين يارب العالمين pic.twitter.com/NK157HIQjA — الانباري11 (@DHUYUTEQ) May 14, 2015

The first tweet, by @hmama8, says, “Ramadi – now.” While it does look quite hazy, it’s hard to determine the extent of the dust because of a lack of reference objects in the picture. The second tweet, by an IS supporter judging by his profile, is even more ambiguous. @DHUYUTEQ tweeted that cloudy skies and a light dust storm allowed IS to enter Ramadi. The pictures accompanying the tweet, unfortunately, are not helpful at all — there are no reference objects present, and, given the color of the images, they are likely not of weather conditions at all, but rather a reference to the fact that “ramadi” means “gray” in Arabic.

What’s more, there are only four tweets mentioning a “dirt storm” (“عاصفة ترابيه”) in conjunction with Ramadi on May 14 and 15 (all of which were posted on May 14), and no tweets mentioning a “sand storm” (عاصفة رملية). (Note that “dirt storm” is more commonly used than “dust storm” in Arabic.)

Omitting the Arabic word for “storm” and just searching for the terms “dirt” (“ترابيه”) and Ramadi on May 14 and 15 yielded one additional tweet, but it was @DHUYUTEQ’s mentioned above.

Additional Twitter searches using different combinations of weather related terms were also fruitless.

It appears, then, that Twitter posts from Ramadi on May 14 somewhat corroborate the notion that the weather in Ramadi at the start of the IS assault was dusty and cloudy. However, the extent of the dust, judging by the tweets alone, is difficult to gauge.

By contrast, several photos taken by the AP seem to provide a better idea of just how hazy and dusty conditions were on May 14:

Security forces defend their headquarters against attacks by Islamic State extremists during sand storm in the eastern part of Ramadi, the capital of Anbar province, 115 kilometers (70 miles) west of Baghdad, Iraq, Thursday, May 14, 2015. Islamic State extremists tend to take advantage of bad weather when they attack Iraqi security forces positions, an Iraqi officer said.

In any case, CENTCOM and the DoD maintained that the weather, however bad it was, wasn’t bad enough to proscribe coalition air support. If so, it’s curious that air support wasn’t provided May 14 at the start of IS’s assault. On May 14, the DoD reported that coalition airstrikes took place “in Syria and Iraq between 8 a.m., May 12, and 8 a.m., May 13, local time.” The next report of airstrikes was posted on May 16:

Coalition military forces continued to attack ISIL terrorists in Syria and Iraq between 8 a.m., May 15, and 8 a.m., May 16, local time … Near Ramadi, four airstrikes struck one large and three small ISIL tactical units, destroying four ISIL vehicles, three ISIL structures, two ISIL fighting positions and an ISIL VBIED.

So presumably there were no airstrikes conducted on May 14 — the day of the “sand storm” or “minor dust and haze,” depending on who one asks — but four airstrikes were conducted the following day and seven more the day after that.

A recent article by the Washington Post‘s Loveday Morris seems to provide the best explanation for the dearth of coalition air support on May 14:

Residents and fighters in the city said the weather was largely clear after the initial attack on Thursday, which occurred during a light dust storm. That dust, however, may have allowed the Islamic State fighters to position themselves before the assault, undetected by aerial surveillance. Reluctant to be drawn into a combat role, the Obama administration has held back from deploying spotters on the ground to relay real-time information to nearby attack aircraft, limiting the capabilities of strikes.

If this is correct, then it’s possible that both narratives contain kernels of truth — the weather conditions on May 14 may indeed have had no effect on the US-led coalition’s ability to conduct airstrikes, but the lack of visibility may have contributed to the coalition’s inability to identify IS targets to strike.",2015-05-25,Ramadi Haze
2015,5,https://www.bellingcat.com/news/uk-and-europe/2015/05/22/three-graves/,/news/uk-and-europe/2015/05/22/three-graves/,"The “military duty” part catches out attention. We keep looking and find another mourning post, but Anton’s not the only one featured there (original | saved copy):

The details become more interesting, it’s obvious now that they died together. We start looking for the names of the other two soldiers who died together with Anton. As we look through Anton’s friends’ profiles, we see a message that gives us their call signs (original message | saved copy): Sava, Kardan and Mamai.

This person’s profile also has lots of Spetsnaz references (photos, statuses), which clearly shows us he’s “one of them”. As we start looking for the other two’s call signs, we find Mamai and it’s a bit of luck: he is standing in front of two Donbas rebel armored vehicles (original post | original photo | saved copy).

The “toothed” APC to the right has been filmed many times in Luhansk, including a February 15, 2015 video(saved copy) that shows it driving in front of a Russian humanitarian convoy bearing an Luhansk People’s Republic flag. Here’s the same APC photographed in Luhansk, the letters “ЛНР” (“Luhansk People’s Republic”) clearly visible.

The beige building and metal fence indicate Timur’s photo was shot here as well.

Among those who reposted that message we find another account that hints that Mamai (full name — Timur Mamayusupov) was a Spetsnaz serviceman (original message | saved copy):

This person’s profile also features a post from May 9, 2015, with a video from the 16th Spetsnaz brigade (original message | saved copy):

Let’s sum up what we’ve got so far: Anton Savelyev, a 16th separate Spetsnaz brigade serviceman, died in early May (first message posted by relatives on May 6) “protecting the Motherland”, “on military duty”. Several profiles belonging to servicemen of the same Spetsnaz brigade feature messages that two other people, one named Timur Mamayusupov (call sign “Mamai”) and another (call sign “Kardan”) died together with Anton.

By the way, the 16th brigade’s parade video gives us another important hint: A Spetsnaz serviceman does not necessarily look like a bodybuilder and all the three people killed are built just like the guys in the video.

Moving on. Another project, also featuring war investigations, gives us info on Timur “Mamai” Mamayusupov. Turns out, they found the info on him before we did and published it long ago. The cargo200.org project has managed to find out several key details on Timur from his relatives’ messages: Timur was a soldier, was in the Spetsnaz and died at a war:

(link to cargo200.org profile)

— Nail’s original post, saved copy; — Albina’s original post, saved copy.

Right after that Albina’s wall features a series of memorial posts dedicated to Timur mentioning both the Spetsnaz and the war:

Saved copy.

In another Russian social network, Odnoklassniki, we see a member of the same 16th Spetsnaz brigade who posts photos showing “Sava”, “Kardan” and “Mamai” together. This means the three were good friends and served in the same unit as this serviceman.

By checking all the profiles of each of the deceased’s friends and their friends we find “Kardan”’s name — Ivan (saved profile copy | original of Kardan’s photo on a girl’s avatar).

As we browse through the accounts of the dead Spetsnaz soldiers’ friends, we find several profiles featuring joint photos with Kardan and stating one and the same person as a “best friend”: Alexey Butyugin’s profile (no photos with this person’s appearance in the post). We also find another confirmation that Kardan’s name is Ivan (original post | saved copy):

Kardan’s friend’s profile also features a joint photo of Timur “Mamai” and Ivan “Kardan”, geotagged in “Matveevo-Kurganskiy district” (directly on the border with Ukraine), original post | saved copy | original photo):

We are finally catching a scent, but it’s still faint, we need more proof. Since Anton’s and Timur’s profiles both feature the city of Tambov, and their military unit is also in Tambov, we decided they were both buried there. We pack our things, hop on a bus and spend a day to get to Tambov. As we arrive, we face a complicated task: We don’t know at which of the three graveyards in Tambov Anton and Timur were buried, and there are even more graveyards in the suburbs. We talk with local taxi drivers, explain the task (not getting into much detail), they suggest going to the city graveyard and asking the groundskeeer where this or that person is buried — groundkeepers have that information.

Meanwhile, people from our team continue looking for info on social networks and local forums as to where exactly Anton and Timur were buried. They find an ask.me profile of a girl who went to the same school as Anton, and, as we are driving to one of the Tambov graveyards, our team manages to find out where exactly he is buried (saved copy of questions and answers):

Talinka is a village in Tambov district. I recall Anton’s Odnoklassniki profile indicating that he finished secondary school in Novaya Lyada (a village next to Talinka). We ask the taxi driver for another advice, he says he knows where the Novaya Lyada graveyard is and we drive there. When we come, we start looking for Anton’s grave and find it almost right away:

Click to open an album with original photos in a better resolution. The album also has photos of wreaths with relatives’ last names — we found some of their social network profile with mourning posts (see screenshots below in the post).

There is also a wreath “To a defender of the Motherland from the Ministry of Defense of the Russian Federation”:

It was about 7 AM, it’s then that were recorded a video we published later, saying “we haven’t contacted the relatives yet” (which we really hadn’t at that point).

After that we came up to the groundkeepers and asked them about Anton. They told us that he indeed was a soldier, he was buried recently, they didn’t know how he died, and there wasn’t another military burial at that time (we were asking about Timur). When we asked how to contact Artyom’s relatives, they told us the way to Anton’s mother’s house.

Meanwhile, volunteers from our team found info in the relatives’ comments that the soldiers died because they “came under shelling”;

When asked “Where?”, they reply “I don’t know exactly, I heard it happened at the border”:

Link to post with comments.

However, if you try to find any reports of shelling the border on those days or three people dying due to the shelling, you will find nothing. That is weird, since if people did die in a border shelling, especially if they were soldiers, that would be a trump card for the Ministry of Defense and great proof of Minsk agreement violations. If these people were no servicemen but rebel volunteers, why would this be a “military secret”? Russia does not deny the presence of Russian volunteers among the rebels. Why would they be buried with such honors by the local military unit, with a wreath from the Ministry of Defense?

Other relatives, when asked how Anton died, reply “this is a military secret”:

It’s getting closer to 8 AM, we are planning the search for Timur’s grave and talking with Anton’s relatives. The taxi driver says that Anton’s mother probably works in Tambov and should be leaving her house right now to go to the city. We decide to go there and try talking to her. A still from our video:

As we approach Anton’s mother’s house, we realize it’s the same house we saw in Anton’s and his sister’s photos and tried to locate by asking the locals:

Anton’s mother wasn’t home. We talked to her neighbors and got her mobile phone number. Vadim Korovin called her, introduced himself as a State Duma member’s aide, said he wanted to help her in communicating with the Ministry of Defense since she’d have to demand a compensation. Natalya (Anton’s mother) replied that she was now at the military base and couldn’t talk. She asked to call her back.

We drove to the military base where all the three deceased served. We stopped next to a car. A Spetsnaz sergeant, wearing a uniform, was standing next to it. The taxi driver said it was his acquaintance (the city is small and the taxi driver has been working for years, so he knows lots of people) and he would come up to him and ask about the other deceased. When asked about two recently deceased Spetsnaz soldiers, the sergeant replied that they’d buried only one of theirs recently, at Novaya Lyada (the sergeant named the correct village, we did not prompt him). After that a Spetsnaz first lieutenant got out of car nearby and started approaching us with quite a disapproving look. We got in the car and left so that we wouldn’t get into trouble.

We decide to try to find out where Timur was from, looking for hints in his photos. We notice a photo with cars on Timur’s profile; both cars have region code 36 o their number plates (link to photo in Timur’s account):",2015-05-22,Three Graves: Russian Investigation Team Uncovers Spetsnaz Brigade in Ukraine
2015,5,https://www.bellingcat.com/news/2015/05/21/islamic-state-captures-tadmur-palmyra-in-new-sudden-streak-of-offensives/,/news/2015/05/21/islamic-state-captures-tadmur-palmyra-in-new-sudden-streak-of-offensives/,"

In a surprising new streak of offensives launched at targets in both Iraq in Syria, the Islamic State has managed to capture the ancient city of Palmyra, known today as Tadmur. With the strategically important town of al-Sukhna falling just over a week before, and the Iraqi city of Ramadi just days before Tadmur, it appears the Islamic State is far from being under control, and possibly attempting to revive the seemingly unstoppable upmarch of last summer.

Tadmur, which is also home to Tadmur airbase, is of high strategic importance due to its position at the base of the vital M20 highway, which leads through the recently fallen al-Sukhna to the regime’s last holdout in the East of the country: Deir ez-Zor. Without access to this highway and with little prospect of retaking both of the Islamic State’s newest gains, the Assad-regime will face extreme difficulty in keeping its troops in Deir ez-Zor supplied, and the fall of the city and associated airbase might soon become inevitable.

The town of Tadmur is best known for the ancient Roman monuments and ruins, which, given the Islamic State’s history with the destruction of historical sites, is now feared to be a target for vandalism. Although this aspect will likely incite a lot of coverage from Western media, it should not be forgotten that there are also thousands of lives at stake, with hundreds of casualties reported so far and many dead, despite earlier reporting from Syrian State Media that citizens were being evacuated. Of course, with mainstream media eager to find new stories that might interest a diverse public, events such as renewed poison gas attacks and the current offensive are less likely to be covered than a story on ancient Roman ruins in danger of destruction.

Also of great importance are the massive weapon depots located in Tadmur, one of the largest in Syria. While the exact contents of the depots remain unknown, there are reports of ballistic missiles being stored here. Should this be the case, it is likely images of such missiles in Islamic State’s hands will surface again soon, even though it is unlikely that they will get any to work. Perhaps more of interest is the fact that many other types of weaponry captured by the fighters of Islamic State as Ghaneema (spoils of war) will provide the means for future offensives, allowing the Islamic State to exert pressure on fronts throughout the region.

Hundreds of ammunition boxes captured during the early phase of the Islamic State’s offensive on the town just a few days ago give a clear indication of the amount of weaponry that is still likely to be present in the many storage bunkers littered around Tadmur.

Tadmur also serves as an important link in the production and distribution of a large portion of Syria’s gas supplies. Whoever is in control of Tadmur has easy access to the numerous gas fields and pipelines running through the area, all of which now also under control of the Islamic State. And without access to gas fields, the Assad-led regime could face a huge problem in keeping Damascus, Lattakia and Tartus supplied with enough gas.

The ease with which the Islamic State managed to capture Tadmur is a clear sign of the increasingly worn military force that has been spread thin over regime-controlled Syria, and is now slowly running out of men willing to give their lives for the regime. While the situation for the regime has been already been dire before, Iran’s and Hizbullah’s involvement in the Syrian Civil War managed to stall the Free Syrian Army’s advance throughout Syria, and eventually stabilised the situation for the regime early in the Civil War. However, this source of manpower is still finite, and Iran and the regime are increasingly forced to rely on other foreign fighters for their offensives, often Iranian jailed Afghan criminals and refugees, to carry the burden.

The offensive at Tadmur came as a surprise to many, and the quick victory must even have surprised the fighters of the Islamic State, which were until thus far unsuccessful in capturing any major towns, installations or army bases in Central and Eastern Syria since the fall of Tabqa in August 2014.

Tadmur was defended by the 18th Tank Batallion of the Syrian Arab Army (SyAA), the National Defence Force (NDF) and troops of Suqour al-Sahraa’ (The Desert Falcons). No attack on the town or the region was expected, and as a result, the regime’s miltary presence in Tadmur was minimal. With no reserves or reinforcements available, the regime’s troops in Central Syria simply collapsed. Caught completely off-guard, the regime never had any real chance to hold the town against the fighters of the Islamic State, and Tadmur was thus lost as soon as the Islamic State attacked it.

Although the fighters of the Islamic State reportedly freed the remaining prisoners in Tadmur’s prison, made infamous by the 1980 Massacre and after its reactivation in 2011 again one of the most notorious in Syria, it remains unknown how many of the prisoners actually survived. Executing any remaining prisoners before retreating has become a common practice for the regime, and Tadmur’s prison is unlikely to be different.

Tadmur airbase, strategically located in Central Syria, has traditionally been home to an unknown squadron operating the iconic MiG-25PD(S) interceptor and MiG-25PU two-seat trainer. The airbase lost much of its value after the gradual retirement of the Syrian Arab Air Force’s (SyAAF) MiG-25 fleet however, partially made-up by an increasing number of civilian flights. Nevertheless, the unknown squadron based at Tadmur was one of the last to continue flying the mighty MiG-25 ‘Foxbat’. A video released by the Free Syrian Army on the 8th of August 2012 confirmed some MiG-25s might still have been operational at Tadmur until 2013, or perhaps later. It is likely that the surviving aircraft remain stored in the sixteen Hardened Aircraft Shelters (HAS) found at the airbase. Two completely destroyed Mi-17s were also found at the airbase.

The airbase also served as an important link in the transfer of arms and munitions to Deir ez-Zor. This role will now have to be taken over by T.4 airbase, located West of Tadmur and likely the next target of the advancing fighters of the Islamic State. Three radar systems, a JY-27, a P-14 and a P-12/18, located at the airbase were responsible for guarding the airspace above Central Syria, a capability that is now lost. This means the SyAAF won’t be able to detect any aircraft in Central and Eastern Syria, a serious blow to the already crippled air defences.

The central location of Tadmur makes the town an important link in Syria’s road network, and the capture of the town opens the gates for the Islamic State to expand their base of operations deeper into Syria. The next targets for the Islamic State will undoubtedly be T.4 airbase and/or Deir ez-Zor. Although it is also possible that the fighters of the Islamic State will march in the direction of Homs, or even Damascus, capturing Syria’s most important airbase or consolidating its grip on Deir ez-Zor would make more sense.

The fall of Tadmur paints a dire picture for the regime’s grip on the Eastern half of the country, and should their last base in this area (Deir ez-Zor) also succumb to the increased pressure stemming from a lack of supplies and constant attacks from fighters of the Islamic State, the image of the regime’s firm grip on the largest part of the country will be destroyed. Due to the strategical position of Tadmur the fall of the city also means the Islamic State now has direct road access to many of Syria’s largest provinces, including the city of Homs and the capital of Damascus.",2015-05-21,Islamic State Captures Tadmur (Palmyra) in New Sudden Streak of Offensives
2015,5,https://www.bellingcat.com/news/2015/05/21/air-rescue-in-ramadi-geolocating-made-easy-with-heads-up-display/,/news/2015/05/21/air-rescue-in-ramadi-geolocating-made-easy-with-heads-up-display/,"

The strategic Iraqi city of Ramadi has fallen to the Islamic State (IS), bringing the number of provincial capitals under the militant group’s control to three (the others being Mosul, Iraq and Raqqa, Syria).

IS reportedly used the cover provided by a dust storm to gain a military advantage during the start of their assault last week; American warplanes were unable to provide air support for the Iraqi forces under attack owing to poor visibility. The momentum gained from this tactical maneuver culminated on Sunday with the militants overrunning the Anbar Operations Command and 8th Brigade Headquarters at Camp Ar-Ramadi, the last remaining government strongholds in the city.

Iraqi security forces were seen fleeing the IS onslaught in dozens of Humvees and other military vehicles, scenes distressingly reminiscent of the fall of Mosul nearly a year ago. Commenting on the rout, Chairman of the Joint Chiefs of Staff General Martin Dempsey didn’t mince words, saying on Wednesday that Iraqi forces weren’t “driven from” Ramadi, they “drove out of Ramadi.”

So, with yet another defeat at the hands of IS, it’s perhaps not surprising that the Iraqi Ministry of Defense (MoD) might want to put a good face on a situation that is nothing less than a serious setback. On May 19th, the Iraqi MoD posted to its YouTube channel footage purporting to be of a successful Iraqi Air Force rescue mission of Iraqi security forces trapped in Ramadi. While not exactly a propaganda coup, when your forces have once again melted away in the face of adversity, it’s arguably better than nothing.

Interestingly, the MoD doesn’t redact any of the data on the head-up display (HUD) overlaid on the video. Here’s what these videos typically look like:

US Central Command, earlier this month:

Iraqi MoD, last month:

The HUD overlay in the Ramadi air rescue video, by contrast, is completely visible, save for the date and time in the top-left corner:

Even the date and time, however, can be seen on the screenshot in the Iraqi MoD’s press release:

The 18th of May was Monday, which is consistent with the reported timeline of events. (Corroborating the date of the rescue may not seem particularly important, but the Iraqi MoD has been known to stretch the truth to boost morale.)

Because the HUD data isn’t redacted, it’s possible to geolocate exactly where the Iraqi security forces were rescued with the longitude and latitude visible in the bottom-right corner of the image. Because those coordinates refer to the target (“TGT”) in the HUD crosshairs, we have to wait for the security forces to come into view to determine their location.

The first 30-odd seconds of the video are spent searching for the security forces until the camera zooms in on a group of individuals who signal the aircraft:

Now that the stranded security forces have been spotted, we can use the TGT coordinates (33°24’49N 43°20’47E) to determine their location. But before doing so, it’s helpful to get a better idea of what the location looks like from the video. At 2:46, the video zooms out to reveal that the security forces are situated in the corner of a facility with a number of large, circular structures:

Entering the aforementioned coordinates into Google Earth takes us to this location, which looks somewhat similar but lacks the circular structures seen in the video:

It turns out that this is because Google Earth’s imagery was taken in 2010. Bing, on the other hand, has more recent satellite imagery of the area:

Here the circular structures present in video are clearly visible, confirming that the TGT coordinates indeed mark the exact location where the rescue mission took place.

It’s also interesting to note that the newer Bing imagery, which was taken in August 2013, can be seen side-by-side with Bing’s older imagery taken in August 2011, which is still more recent than the imagery used by Google Earth for this location:

Here’s the rendezvous location in relation to the rest of Ramadi:

The Iraqi MoD describes the rescue as taking place “in the district of the stadium”بمنطقة الملعب) ). Indeed, that neighborhood is less than a mile from the site of the rescue operation.

The video ends with understandably relieved Iraqis embracing one another and trotting down an airstrip. Once again, we can use the TGT coordinates (33°20’31N 43°35’58E) and Wikimapia to determine which airfield the rescued Iraqis were flown to.

As would be expected, the mission was conducted from al-Taqaddum Airbase, roughly 15 miles away:

Finally, the heartfelt coda on the runway provides the best view of the helicopters flown during the operation, which appear to be Mil Mi-17s.",2015-05-21,Air Rescue in Ramadi: Geolocating Made Easy with Head-Up Display
2015,5,https://www.bellingcat.com/news/uk-and-europe/2015/05/19/robert-parry-falsely-accuses-60-minutes-australia-of-using-mh17-fake-evidence/,/news/uk-and-europe/2015/05/19/robert-parry-falsely-accuses-60-minutes-australia-of-using-mh17-fake-evidence/,"

This weekend 60 Minutes Australia aired a segment where they investigated the Buk missile launcher that shot down MH17, using information gathered by Bellingcat to follow the route of the Buk through separatist held territory. As with previous investigations by news organisations visiting the locations Bellingcat identified in our earlier MH17 research the 60 Minutes Australia investigation confirmed the locations Bellingcat identified as being correct.

As with all reports of this nature attempts were made to debunk the findings, notable among which was an attempt by veteran journalist Robert Parry. Like other veteran journalists, Robert Parry has relied on unnamed sources for his recent work, releasing articles that attack the narrative that separatists downed MH17 with a Buk missile launcher on his Consortium News website.

In his article, Fake Evidence Blaming Russia for MH-17?, Parry claims there appears to be “some fakery involved in the Australian documentary”.

However, for one crucial scene – the image of an alleged “getaway” BUK launcher lacking one missile and supposedly heading back to Russia after the shoot-down – the documentary broke with that pattern. The program showed the earlier video of the truck moving past a billboard and then claiming – based on information from blogger Eliot Higgins – that the TV crew had located the same billboard in Luhansk, a rebel-held city near the Russian border. This was the documentary’s slam-dunk moment, the final proof that the Russians and particular Vladimir Putin were guilty in the deaths of 298 innocent people. However, in this case, there was no overlay of the two scenes, just Australian correspondent Michael Usher pointing to a billboard and saying it was the same one as in the video. But the scenes look nothing at all alike if you put them side by side. While Usher is standing in an open field, the earlier video shows an overgrown area. Indeed, almost nothing looks the same, which might explain why the film crew didn’t try to do an overlay this time.

This refers to the well known video showing the Buk travelling through Luhansk, which the Russian Ministry of Defence notoriously claimed to have been filmed in a government controlled city, a claim which was later exposed as a lie.

Parry provides the following image comparison in an attempt to prove his hypothesis

Parry then repeats his damning accusation that 60 Minutes Australia faked evidence.

The significance of the Australian news show’s sleight of hand is that if the BUK launcher was making its “getaway” through government-controlled territory, not through Luhansk on its way back to Russia, much of the Russia-did-it scenario collapses. It also means the Australian audience was grossly misled.

Unfortunately for Parry, his accusation is entirely unfounded, and reveals his lack of investigative skill when it comes to this kind of open source information. Had Parry spent a few minutes on Google he could have easily found Bellingcat’s work on the video, and realised his error.

As we detailed in this July 22nd 2014 post, it was possible to establish the position of the camera, which is key to understanding what’s visible in the video. This image from a traffic camera shows the intersection featured in the video.

As we can clearly see the area has groups of trees, and in this image we can see apartment buildings to the west of the intersection, where the video was filmed from.

What Parry thinks is an overgrown field is in fact the top of the trees visible in the satellite imagery and traffic camera image. Because Parry apparently has very poor skills in examining and investigating these kinds of images he’s falsely accused 60 Minutes Australia of faking their report, extremely serious allegations for a veteran reporter like Parry to make against another news organisation.

Update

Crikey contacted 60 Minutes for a response who replied with the following:",2015-05-19,Robert Parry Falsely Accuses 60 Minutes Australia of Using Fake MH17 Evidence
2015,6,https://www.bellingcat.com/news/uk-and-europe/2015/06/30/low-loader/,/news/uk-and-europe/2015/06/30/low-loader/,"

Thanks to the generous donations of our supporters last month, Bellingcat was able to purchase 25 square kilometers of satellite imagery from Digital Globe. Our latest report used this imagery to definitively demonstrate that the Russian Ministry of Defense (MoD) falsely dated satellite photos it presented to the international community in the days after the MH17 tragedy last year in order to implicate Ukraine. Now, we will use the same Digital Globe imagery to show that the low-loader that hauled the Buk linked with the downing of MH17 was in fact absent from its vehicle yard when it was photographed by Paris Match on the morning of 17 July 2014.

On 25 July 2014, eight days after MH17 was shot down by a Buk missile system over eastern Ukraine, the French weekly Paris Match published a photograph of a red and white low-loader transporting a Buk through the separatist-controlled city of Donetsk.

Subsequent geolocation confirmed that the low-loader hauling the Buk was headed east on the H21 highway. Inquiries by Storyful established that the photograph was taken at “about 11 a.m. on the morning of July 17”; shadows cast by the vehicle are consistent with this time of day. Paris Match also confirmed that this was the best quality version of the image available.

Using the phone number on the side of the low-loader, Paris Match contacted the owner of the vehicle rental company, who claimed that the low-loader had been stolen by separatists who had occupied his warehouses since 8 July and that the vehicle was unique in the region. The phone number was also used to track down the exact location of the company, which is located in Donetsk.

Historical Google Earth imagery shows that the low-loader can be seen in the vehicle yard facing north on 2 July 2014, while on 21 July 2014, it has clearly moved and can be seen facing east.

2 July 2014 vs 21 July 2014

The new Digital Globe imagery Bellingcat has purchased shows that at 11:08 a.m. (local time) on 17 July 2014, the low-loader was not present in the vehicle yard, as would be expected if Paris Match photographed the low-loader heading out of Donetsk on H21 around 11 a.m. Here is the new imagery compared with the most proximate Google Earth imagery available (taken 2 July):

17 July 2014 (DG imagery) vs 2 July 2014

The low-loader’s absence from the vehicle yard at this time is consistent with the timeline of events in the hours before the downing of MH17, as documented in various social media postings, which have been verified by Bellingcat and others.

After being spotted heading east on the H21 highway by Paris Match photographers around 11 a.m., the low-loader was subsequently filmed roughly 36 kilometers farther east on H21 in the town of Zuhres, reportedly at 11:40 a.m.

The low-loader was then photographed roughly 25 kilometers east of Zuhres in Torez, at approximately 12:30 p.m., this time with camouflage netting over the Buk.

While a photograph and a video posted to YouTube showed the Buk driving under its own power in the town of Snizhne at approximately 1:30 p.m., the low-loader was once again seen hauling the Buk through separatist-controlled Luhansk, reportedly on the morning of 18 July, in a video posted by the Ukrainian Ministry of Interior. Indeed, the Buk can be seen missing one of its 9M38M1 missiles.

To recap, a Buk being transported by a low-loader was seen headed east on H21 out of Donetsk around 11 a.m. on 17 July 2014, hours before MH17 was shot down. It was then filmed on H21 east of Donetsk in the town of Zuhres at approximately 11:40 a.m. At 12:30 p.m. on the same day, the low-loader was seen hauling the Buk through Torez. The following morning, the Buk, minus one missile, was seen being hauled by the low-loader through Luhansk.

With these sightings, it is possible to surmise the most likely route taken by the low-loader. A portion of this route can be seen in the full Digital Globe preview imagery from which the crowdfunded portion was purchased.

This full Donetsk image from Digital Globe – which, after purchasing the imagery, we know was taken at 11:08 a.m. – extends roughly one-third of the way to the town of Zuhres. Based on the time of the Donetsk satellite image and the time the Buk was seen in Zuhres (11:40 a.m.), we judged that there was a reasonable possibility that the Buk and low-loader would be visible in the satellite imagery. In order to find out, we crowdfunded the purchase of another sliver of the Digital Globe imagery, this time showing the route depicted above. Unfortunately, the low-loader could not be seen in this image. (We, therefore, will not seek funding for the additional $1,500 required to publish the image.) There are two plausible reasons as to why this may be. First, while the imagery is by and large clear for large stretches of the route, there are not insignificant sections of road that are obscured by either cloud cover or the tree line. Second, the assumption that the Buk would be visible was based upon a number of unknown factors that may have affected the low-loader’s travel time, including the speed of the low-loader, the heaviness of the traffic, and whether any stops were made.

On 30 March 2015, the Joint Investigation Team investigating the cause of the downing of MH17 released a video calling for witnesses in eastern Ukraine to come forward with information regarding the transport of a Buk anti-aircraft system through eastern Ukraine. The JIT video also featured three previously unpublished intercepted phone calls in which separatists discuss a Volvo low-loader truck hauling a Buk from Snizhne to Russian territory shortly after the MH17 shootdown. Two of these calls take place between 8 a.m. and 8:30 a.m. on 18 July 2014, the morning after the downing of MH17 and a few hours after the Buk and Volvo low-loader truck were filmed in Luhansk headed east. The individuals in these two calls can be heard discussing, among other things, the whereabouts of the low-loader (or “lowboy”), which was apparently transported into Russia.

While the low-loader was taken to Russia on 18 July, it returned to eastern Ukraine shortly thereafter and could be seen being used by separatists to transport military equipment. In a photograph shared on 6 August 2014, the low-loader can be seen transporting a BMP infantry fighting vehicle through the streets of Makiivka, just east of Donetsk.

Later that month, on 26 August 2014, a photograph and video of an identical low-loader were posted online. The video featured a woman who had appeared in previous separatist-filmed videos, and it appears that the low-loader was being used to transport a damaged vehicle.

Once again, historical Google Earth satellite imagery shows the low-loader in the yard on 9 August, while on 3 September it has since clearly moved.

9 August 2014 vs 3 September 2014

The PDF version of this piece is available in English and Russian.",2015-06-30,Tracking the Vehicle that Transported the MH17 Buk
2015,6,https://www.bellingcat.com/news/rest-of-world/2015/06/30/kazakhstan-has-received-four-russian-su-30sm-fighters/,/news/rest-of-world/2015/06/30/kazakhstan-has-received-four-russian-su-30sm-fighters/,"

In case you missed it, Kazakhstan’s recent military parade in May confirmed that the central Asian country is operating at least four Su-30SM aircraft. The parade, which took place in Astana, commemorated the 70th anniversary of the Soviet victory in World War II.

The Kazakhstan Air Defence Forces took delivery of the 4++ generation Russian-built fighters at the Taldykorgan Airbase also known as the 604th Airbase. Satellite imagery from April also confirmed that KADF had received four fighters.

The SU-30SM is a variant of the Indian Su-30MKI featuring an improved radar, communications system, ejection seat and weapons system. Back in February, Major General Nurlan Ormanbetov made the acquisition public during a visit to the Irkutsk Aviation Plant where the Su-30SM is built.

The KADF has been in desperate need to acquire new aircraft and modernize its aging force as most of its aircraft were acquired from older Soviet stocks in the 1990s. Its most recent efforts include a 2007 agreement with Belarus’ 558 Aircraft Repair Plant to modernize 10 of its Russian made SU-27. [1]

The repair plant reportedly modified the KADF aircraft to the SU-27M2 and SU-27UBM2 standard featuring both Belarusian and Israeli systems. Those aircraft are now joined by Kazakhstan’s latest acquisition of SU-30SM fighters.

Imagery from earlier this year shows both platforms along with KADF’s MIG-27 parked on the operations apron at the airbase.

Kazakhstan is part of Collective Security Treaty Organization where Russia has been promoting a unified air defense system with allies in the region. Over the years Russia has worked bilaterally to bring nearby states into the fold. Kazakhstan’s acquisition of SU-30SM help support that goal.

Notes:

[1] Media reports from Sept 2014 said that “two senior pilots” were killed in a crash involving an Su-27 near Almati. Although the variant of the aircraft wasn’t identified, imagery would suggest this was one of the upgraded Su-27UBM2. Recent imagery from 2015 only shows nine of the different camo scheme aircraft on the operations apron. However, this doesn’t discount that the other aircraft could have been in covered storage.",2015-06-30,Kazakhstan Has Received Four Russian SU-30SM Fighters
2015,6,https://www.bellingcat.com/news/rest-of-world/2015/06/29/satellite-imagery-reveals-chinas-new-drone-base/,/news/rest-of-world/2015/06/29/satellite-imagery-reveals-chinas-new-drone-base/,"

Satellite imagery of Hangzhou Bay shows that China has recently renovated a reserve airfield for dedicated drone operations in the East China Sea.

With military aviation being a priority, China’s been slowly moving toward operating more capable UAVs. Analysts and policy wonks alike have little doubt those capabilities will be put to good use as China develops a more assertive foreign policy.

In fact, they may already have.

Space snapshots acquired by DigitalGlobe from April 2015 show three of China’s BZK-005 parked in front of aircraft shelters on Daishan Island, located just off the coast in the East China Sea. The platform’s associated ground control stations were parked nearby.

Imagery suggests they’ve been operating from the airbase for at least two years—not surprising given the government called for the development of 11 new drone bases to be positioned along its 14,500 km coastline back in 2012. At the time, Colonel Li Jie, a researcher with Beijing’s Naval Research Institute, suggested they would be used to “track any foreign aerial vehicles within [China’s] maritime territory” — a comment probably aimed at U.S. drones.

However, with territorial disputes in nearby waters, they’ve also been used to create friction with China’s neighbors. In September 2013 for example, Japan’s Self Defense Force scrambled fighters to identify what it described as an “unknown aerial vehicle” flying toward the disputed Senkaku/Diaoyu islands.

The Japanese Ministry of Defense released handhelds that revealed the drone as the BZK-005. Given the time-frame of the incident and the azimuth of flight, it seems likely the drone flew from Daishan—a detail not previously disclosed.

According to historical imagery, China began renovations at the airfield patching concrete runway tiles and removing encroaching vegetation between mid-2010 and 2013. At the same time, authorities constructed two new support areas.

Located near the south-end of the runway, the first area features seven aircraft shelters, each measuring approximately 22 x 27 meters. Those dimensions suggest each shelter could potentially house at least two of the UAVs. The second area, located less than 800 meters to the east, probably supports a barracks and a motor pool. Construction activity at this location was ongoing in early 2015.

The Daishan airfield is one of the few dedicated facilities for drone operations known in China—though mobile ground control stations are increasingly common at other airfields.

It’s a growing sign that China continues to operationalize its drone fleet, a move that has created some unease in the Pentagon. A 2013 report from the U.S. DoD’s Defense Science Board said “China’s move into unmanned systems is alarming.” The group judged that China’s resources and technological awareness might allow it “to match or even outpace U.S. spending on unmanned systems in the future.”

However, if and when that will happen is not entirely clear. A more recent Teal study estimates that the U.S. will still “account for 65% of total worldwide [UAV] Research Development Test & Evaluation spending over the next decade, and about 41% of the procurement.”

While China’s growing economy has allowed it to translate economic gains into military capabilities, it still has a ways to go in order to close the gaps with its more capable competitors. But given the specs of the BZK-005, China is moving in the right direction—to say nothing of its more advanced models.

The BZK-005 is a medium altitude long endurance drone with a reported flight ceiling of 8,000 meters, a max range of 2400 km and a maximum endurance of 40 hours. Despite it being a strictly reconnaissance drone, such capabilities have led most to compare it with the U.S. MQ-1 Predator.

While such UAVs won’t be sinking ships or hitting ground targets, it represents China’s first step to put unmanned eyes in the sky to monitor nearby territory it wants to control. Given recent developments in the South China Sea, it’s bound to step on the toes of its neighbors sooner rather than later.",2015-06-29,Satellite Imagery Reveals China's New Drone Base
2015,6,https://www.bellingcat.com/news/mena/2015/06/29/nouvelle-image-satellite-du-17-juillet-confirme-que-la-russie-a-publie-de-fausses-preuves-sur-le-crash-du-mh17/,/news/mena/2015/06/29/nouvelle-image-satellite-du-17-juillet-confirme-que-la-russie-a-publie-de-fausses-preuves-sur-le-crash-du-mh17/,"

Dans le rapport du Bellingcat du 31 mai 2015, Forensic Analysis of Satellite Images Released by the Russian Ministry of Defense (Analyse Judiciaire des Images Satellites Publiées par le Ministère de la Défense Russe), l’équipe d’investigation du Bellingcat a souligné de multiples différences entre les images satellite présentées par le Ministère de la Défense russe (MoD) et l’imagerie satellite de Google Earth du 2 juillet 2014 et du 21 juillet 2014. Grâce aux donations des lecteurs de Bellingcat, l’équipe d’enquête a pu acheter l’image satellite de Digital Globe datée du 17 juillet 2014 et collectée à 11:08 du matin heure locale et qui montre un des sites présent dans l’imagerie du ministère de la Défense russe.

Imagerie de Digital Globe du 17 juillet 2014 versus image du MoD datée du 17 juillet 2014 ; notez le Buk qui est manquant dans l’imagerie du MoD:

À notre connaissance, c’est le premier cas d’achat d’une image satellite datée du 17 juillet 2014 de ce site. La comparaison entre l’imagerie de Digital Globe et celle du Ministère de la Défense russe montre qu’il existe plusieurs différences visibles entre les images. En plus de ces divergences, il y a de nombreuses similarités entre l’imagerie du Ministère russe de la Défense et les images satellite de Google Earth de mai et juin 2014. Ces similitudes ne sont pas présentes dans l’imagerie de Google Earth et de Digital Globe de juillet. Ceci démontre bien que les images présentées par le Ministère de la Défense russe ont été prises avant juillet 2014, certifiant ainsi le fait que le gouvernement russe a publié une imagerie satellite falsifiée lors de sa conférence de presse du 21 juillet 2014 portant sur le crash du vol MH17.

Le rapport complet est accessible ici et est aussi disponible en anglais, russe et allemand.

Ci-dessous se trouvent des comparaisons interactives entre l’imagerie du Ministère de la Défense russe et celle de Digital Globe datée du 17 juillet 2014.

Image de Digital Globe du 17 juillet 2014 versus imagerie du MoD datée du 14 juillet 2014 ; notez les variations au niveau du terrain, de la végétation, et des véhicules :

Imagerie de Digital Globe du 17 juillet 2014 versus image du MoD datée du 17 juillet 2014 ; notez les modifications de terrain :

Image de Digital Globe du 17 juillet 2014 versus imagerie du MoD datée du 14 juillet 2014 ; notez les variations dans la végétation :

Imagerie de Digital Globe du 17 juillet 2014 versus image du MoD datée du 14 juillet 2014 ; notez les changements dans le champ :

Traduit de l’anglais par Aliaume Leroy",2015-06-29,De nouvelles images satellite confirment que la Russie a retouché des images concernant le crash du MH17
2015,6,https://www.bellingcat.com/news/mena/2015/06/29/fortress-t4-an-airbase-at-war/,/news/mena/2015/06/29/fortress-t4-an-airbase-at-war/,"

The Islamic State’s offensive in Central Syria has not only allowed the fighters of the Islamic State to expand their operations into areas previously out of reach, but it now also threatens the regime’s gas supplies, its presence on numerous fronts, its control over the only road leading to the vitally important T4 airbase and the airbase itself, the largest of its kind in Syria.

T4, sharing its name with the nearby pumping station, is more commonly (yet incorrectly) known as Tiyas and a whole host of other names. After the fall of Tadmur airbase, it is now one of sixteen operational airbases under control of the Syrian Arab Air Force (SyAAF), and its defence is essential to the SyAAF’s ability to exercise control over the Syrian skies. No less than three fighter-bomber squadrons and one helicopter squadron are currently operating out of T4, including the pride of the SyAAF: its Su-24M2s. The airbase is also home to the now decommissioned MiG-25 fleet, largely phased out in the previous decade. Despite being Syria’s largest airbase, T4 only has one runway, making the airbase extremely vulnerable in case this single runway gets taken out.

In anticipation of an Islamic State offensive on T4 after their lightning advance throughout Central and Eastern Syria in mid and late 2014, the airbase’s assets were heavily reinforced by a temporarily detachment of L-39s, formerly deployed to the then recently overrun Tabqa airbase and by one detachment of at least four Mi-8/17s.

Fully aware of the high military value of T4, the regime has made extensive efforts to defend the airbase, making it come close to being an impenetrable fortress. ‘Fortress T4’ also serves as a barrier between the now Islamic State controlled Tadmur, and regime controlled Homs, further adding to its importance. The regime forces defending T4 have clashed with the fighters of the Islamic State on numerous occasions throughout the past year, with the latest offensive coming close to the officer’s housing and T4 pumping station. According to various reports by Islamic State related Twitter accounts, T4 was targeted with artillery in late May 2015, although it remains unknown if this caused any damage to the airbase.

While the airbase itself is not in imminent danger of falling to the fighters of the Islamic State, the control over the only road leading to T4 is disputed, and will likely completely be under the control of the Islamic State if they continue their push towards Homs. This would isolate T4 and make access by road impossible, leading to significant problems in the long run. Resupplying the airbase would then be in the hands of the SyAAF’s transport aircraft and helicopters, but such an airlift would have serious drawbacks as it would be unable to bring in any heavy weaponry and fuel, not to mention the fact that it would also cost the regime loads of precious resources.

The resident fleet of aircraft and helicopters has the potential of being a major eyesore to the fighters of the Islamic State, and has the ability to thwart the Islamic State in any of its future offensives undertaken in the Homs Governorate. But as the SyAAF remains largely unable to respond to actual developments, and often only joins the fray after the battle on the ground has been fought, better coordination between regime forces on the ground and SyAAF aircraft and helicopters in the sky is required to fully optimise the assests available at T4. Furthermore, the desperate revenge strikes flown by the SyAAF on recently lost towns could be stopped to spare not only the life of the many innocent civilians killed during these sorties, but also the precious airframes used in these useless sorties, with the wasted flight-hours instead allocated to supporting the regime’s ground forces

For example, only one symbolic sortie from T4 was flown in aid of the defenders of Hulayhilah, while the defenders of al-Sukhna, al-Hail, Arak and the numerous other towns and gasfields recently captured by the fighters of the Islamic State received no aerial support whatsoever. The SyAAF also largely stood by when Tadmur was captured, only flying some aimless sorties to boost moral of the regime forces on the ground. The town was heavily hit only after it was captured by the Islamic State, with the ordnance used randomly dropped on residential areas.

The huge weapons depots and airbase present at Tadmur provided the fighters of the Islamic State with large amounts of weaponry and associated ammunition, a logical target for the SyAAF’s fighter-bombers, which can be equipped with sophisticated precision guided weaponry. However, none of the depots were targeted by the SyAAF, and it was the US-led coalition that had to step in to destroy six anti-aircraft guns captured at Tadmur.[1] This while the majority of the aircraft capable of deploying precision guided munitions is stationed at T4, located only sixty kilometers from Tadmur.

While extensive in terms of types, Syria’s numerically limited stock of precision guided missiles has seen little use throughout the Civil War, making it likely that the majority is still being withheld for a possible future conflict with the U.S. or Israel. But as the war has now entered its fourth year, one would question if such weaponry wouldn’t be better off used in this conflict instead. While the SyAAF’s current arsenal of precision guided weaponry would be quickly depleted, it could be quickly replenished by Russia; the continuous flow of Russian-made weaponry that reaches Syria on a regular basis is a testament to that fact.

When examining T4 using the latest (public) satellite imagery available one can spot a large number of seemingly inoperational aircraft spread around the airbase, with as much as thirty-two decommissioned MiG-25s visible at T4 in October 2014. While certainly an impressive sight, it marks the end of an era for the once mighty ‘Foxbat’ fleet. The fleet of MiG-25s was slowly decommissioned throughout the previous decade, with only a few examples remaining operational by the turn of the century.

The exact number of MiG-25s Syria received is thought to be around forty. Versions are believed to include MiG-25P (later upgraded to MiG-25PDS) and MiG-25PD interceptors, MiG-25R and RB reconnaissance aircraft and MiG-25PU conversion trainers. A reason for the retirement of the MiG-25 fleet might not only be its age and the increasing costs to keep the aircraft operational that come with it, but also the type’s vulnerability to Israeli jamming.

The career of some MiG-25s appeared to have been revived on several occasions throughout the Syrian Civil War; the last confirmed sorties were flown in March and April 2014, during which a MiG-25PD(S) launched R-40 air-to-air missiles at ground targets. These sorties, to no one’s surprise, yielded no beneficial results.

The last to operate the MiG-25s was an unknown squadron at Tadmur, sporting three MiG-25PD(S) and one MiG-25PU in its ranks until late 2013. These aircraft were then likely flown to T4, where they joined the remainder of the MiG-25 fleet already stored here.

The majority of the active aircraft operating out of T4 are housed in the airbase’s fifty-eight Hardened Aircraft Shelters (HAS), including the SyAAF’s Su-24M2s. T4 has traditionally been the home of Syria’s Su-24s, with most located in the South-Eastern part of the airbase. A few examples are also detached to Seen at any given time. The Su-24s are undoubtedly the most important assets of the SyAAF, and have seen heavy usage in the past four years.

Although T4 is located closely to Islamic State held territory, 819 Squadron flying the Su-24s rarely participates in sorties flown against the fighters of the Islamic State. Instead, the Su-24 serves as the SyAAF’s long arm, mostly striking villages throughout all of Syria. From Deir ez-Zor to Quneitra and even testing the reaction time of the Royal Air Force based at Akrotiri, Cyprus, the Su-24s done it all.

Contrary to earlier reports, the transfer of one Su-24MK and one Su-24MR by Libya to Syria in the mid 1990s might have not taken place, and has been disclaimed by several SyAAF pilots and the former base commander of T4. This means that the number of Su-24s Syria received stands at just twenty. However, nineteen of these Su-24MKs were upgraded to M2 standard by the 514 ARZ Aircraft Repair Plant in Rzhev in Russia between 2010 and 2013. Just in time to participate in the Civil War, all aircraft returned to Syria relatively unnoticed.

The upgrade provides for improved targeting, navigation and fire control systems by replacing the plane’s old control systems. The plane is also made compatible with newer versions of the KAB-500/1500 and with Kh-31As, Kh-31Ps, Kh-59s and R-73s, adding to the FAB, OFAB and RBK bombs, Kh-25s, Kh-28s, Kh-29Ls, Kh-29Ts and Kh-58s guided missiles, KAB-500s and KAB-1500s guided bombs, S-24 and S-25 air to ground rockets, rocket pods and R-60 air-to-air missiles it can already carry. In Syrian service, all but the R-73 are available to the Su-24M2s, which are reserved for the SyAAF’s MiG-29SMs instead.

Out of the twenty Su-24s originally acquired by the SyAAF, eleven examples remain operational as of June 2015. All but one loss incurred during the Civil War, with one airframe damaged beyond repair after suffering an accident before it had commenced. One was shot down with a MANPADS by the Free Syrian Army above Daret Izzah on the 28th of November 2012, another was shot down by an Israeli Patriot surface-to-air missile (SAM) after having strayed into the airspace over the occupied Golan Heights on the 23th of September 2014 and another fell near Nahtah on the 11th of June 2015, likely due to premature detonation of its ordnance. One Su-24M2 was heavily damaged by anti-aircraft fire in May 2015, after which its pilot managed to guide the airframe to T4 despite the condition it was in. However, it crashed while on approach to the runway after it became apparent that the damage done to the aircraft would prevent a safe landing. Both the pilot and navigator ejected safely. An additional two Su-24s were believed to have been destroyed in an accident on the 28th of May 2015, during which an explosion occured while both aircraft were being rearmed for another sortie, resulting in the death of at least five and wounding another dozen. Additionally, two Su-24s are out of service after having been hit by ground fire. While the damage on both of these aircraft is minimal and can be repaired, the SyAAF currently lacks the resources to do so. The fleet of available airframes has thus almost been cut in half, and each loss is a heavy blow to the SyAAF.

A second fighter-bomber squadron based at T4 operates the Su-22M4, all of which are located in the North-Western and South-Western part of the airbase. 827 Squadron has seen heavy use against the fighters of the Islamic State in the past year, mainly flying in support of Suqour al-Sahraa’ (Desert Falcons) units patrolling the Syrian desert.

The Su-22M4 is outfitted for the carriage of S-24 and S-25 air-to-ground rockets, unguided rocket pods, FAB, OFAB and RBK bombs, KMGU-2 munitions dispensers, Kh-25, Kh-28, Kh-29L, Kh-29T and Kh-58 air-to-ground missiles and R-60 air-to-air missiles. The Su-22M4 has almost exclusively been used to deliver unguided weaponry in the Syrian Civil War: its potential to deliver guided weaponry again being ignored.

Although its Su-22s are often targeted by anti-aircraft guns of the Islamic State, 827 Squadron has suffered relatively light losses in the past four years, with only one Su-22M4 shot down by the fighters of the Islamic State near the Shaer gas field on the 30th of November 2014. As seen with the Su-24M2s, a couple of airframes are awaiting repair after having suffered some form of combat damage.

In the mid to end of 2014, T4’s aerial assests were further strengthened by the deployment of a detachment of L-39s. Although nowadays rarely sighted in Syria’s skies, the remainder of the SyAAF’s L-39 fleet remains active on nearly every front, the L-39ZOs and L-39ZAs almost exclusively flying their sorties in the night in the Aleppo and Damascus region.

The L-39s based at T4 were among the examples overhauled at ‘The Factory’, the SyAAF’s repair and maintenance center located at Neyrab/Aleppo International Airport. The overhauled examples were distributed between Syria’s remaining operational airbases, including Tabqa before it fell to the fighters of the Islamic State on the 24th of August 2014. The L-39s now present at T4 are believed to have been formerly based at Tabqa. These aircraft have thus followed the fighters of the Islamic State as they carried out their offensives in Syria.

In an effort to boost the firepower of the L-39s, all of the overhauled airframes were rewired for the carriage of 80mm B-8 rocket pods, a weapon originally not destined to be used on the L-39. A B-8 equipped L-39ZO now stationed at T4 airbase can be seen below. The carriage of B-8 rocket pods greatly enchances the L-39’s capabilities, which previously could only be armed with 57mm rocket pods and bombs.

Recent satellite imagery of T4 shows the presence of at least five L-39s at any given time, most sitting on the tarmac formerly used by the SyAAF’s MiG-25s or by the double HAS, now acting as a support facility for the L-39s.

A detachment of Mi-8/17s now based at T4 act in support of the remaining regime forces in the region, and as a liaison between the airbase and the rest of regime-controlled Syria.

Four Mi-8/17s can be spotted on recent satellite imagery, stationed right next to the L-39s.

Many of the HAS’s now empty after the decommissioning of the MiG-25 fleet have been turned into barracks, weapon depots and defensive strongholds. Two HAS’s located on the North-Eastern side of the airbase and one HAS located on the South-Eastern part of the airbase have seen specifically much activity around them, with several trucks present in or near the HAS’s at any given time.

A tank company, now stationed in the centre of T4, further strengthens the airbase’s defences.

Russian contractors from the Slavonic Corps, sent to protect the oilfields around Deir ez-Zor, also passed by T4 on their journey to the city. The contractors, apparantly spending more time posing for photos than actually fighting, were routed after being ambushed by rebel forces near the town of al-Sukhna on the way to Deir ez-Zor, and swiftly returned to Russia afterwards, where the owners of the Slavonic Corps was subsequently imprisoned by the Federal Security Service (FSB) because the operation was deemed illegal by the Russian government. Five contractors together with Su-24M2 ‘2514’ can be seen below.

The two S-75 and three S-125 surface-to-air missile (SAM) sites surrounding the airbase remain active, and regularly change positions to throw off their adversaries. Although they are unlikely to be of much use during a potential Coalition air campaign against the Assad-regime due to their outdated nature, they would force the flight ceiling of coalition aircraft up in the early stages of such a campaign and might deter stand-alone strikes by other parties. The systems tasked with directing these SAMs to their targets are two P-18 ”Spoon Rest D” and two P-35/37 ”Bar Lock” radars, which are responsible for detecting any plane flying in this part of Central Syria, a crucial task now that Tadmur airbase and its many radars have been captured by the Islamic State. One RSP-7 radar and one Parol Identification friend or foe (IFF) system also present at T4 guide the aircraft that are coming in to land.

The latest offensive of the Islamic State on this vital airbase has once again been stopped before reaching the airbase, and with the recent setbacks for the Islamic State, this might have been their last chance to take it. Fortress T4, as large as it is important, will indubitably continue to serve as a major hub for the Syrian Arab Air Force.

Written in collaboration with R.S from Luftwaffe A.S. Satellite imagery by finriswolf.",2015-06-29,Fortress T4: An Airbase at War
2015,6,https://www.bellingcat.com/news/uk-and-europe/2015/06/22/revealed-how-the-metropolitan-police-covered-up-for-rupert-murdochs-news-international/,/news/uk-and-europe/2015/06/22/revealed-how-the-metropolitan-police-covered-up-for-rupert-murdochs-news-international/,"

By Joe Public

A Bellingcat and Byline investigation can for the first time reveal Scotland Yard had intelligence Mazher Mahmood was corrupting police officers as far back as the summer of 2000.

The Yard’s 1999/2000 Operation Two Bridges had surveillance on Mahmood in The Victory pub, in Thornton Heath, south London by CIB3 officers (also known as the Ghost Squad), who were working from London’s Belgravia police station. An intelligence report dated 26th September 1999 damningly states:

While in the company of Rees, ‘Maz’ was with a plain clothes officer aged about 45 – officer was selling a story to Maz about inter-race marriage and the payment in dowry in the form of livestock

The ‘Rees’ mentioned in the intelligence report is private investigator Jonathan Rees from Southern Investigations. The Victory, a rundown pub in Gillet Street, Thornton Heath, is no longer there but was frequented by corrupt police officers, private detectives and journalists who often met there.

This is significant because it confirms there was a corruption cover-up by the Metropolitan Police (MPS), not only concerning Mahmood who’s currently under police investigation for alleged perjury, but also reveals the true extent of Scotland Yard’s knowledge of the wider corruption between private investigators (Southern Investigation), News International, and MPS officers stretching back 16 years – and their failure to break up the criminal nexus.

As a direct result of this, it also confirms that both phone hacking and the interference of the Daniel Morgan murder investigations in 2002 by News of the World could have been prevented had the police acted on intelligence they possessed.

Far from acting, in December 2000, after Rees was found guilty and convicted on a totally separate charge (of conspiring to plant cocaine on an innocent mother to discredit her in a child custody battle and was sentenced to seven years imprisonment for attempting to prevent the course of justice), the MPS astonishingly DROPPED Operation Two Bridges, and when Rees walked out of prison, he was rehired by Andy Coulson for News of the World after serving his sentence and on a £150,000 salary – as if nothing had ever happened.

Such is the gravity of that single decision by the police not to pursue Operation Two Bridges, that it would later come back and personally haunt the sitting Prime Minister David Cameron when the phone hacking scandal erupted over a decade later in the summer of 2011: his judgment acutely questioned for taking Coulson into government as Director of Communications after Coulson had hired Rees. The News International scandal soon became a Conservative Party scandal too.

Initially, the MPS launched Operation Nigeria in 1999 to infiltrate the agency Southern Investigations and its premises to advance the investigation into the murder of private investigator Daniel Morgan, who was murdered in the car park of The Golden Lion pub in Sydenham South London – with a blow to the head with an axe in March 1987. The axe used to kill him struck with such force it was left embedded in Morgan’s face.

Rees and Morgan, who had been business partners of Southern Investigations in nearby Thornton Heath since 1984 had been drinking together at the Golden Lion pub on the night of Morgan’s murder. Morgan started the agency and once established he took on Rees. Morgan’s brother Alastair told The Daily Beast in 2013 that his brother had become suspicious of Rees and concerned about police corruption. He was preparing to expose corrupt local police officers to the News of the World according to colleague Brian Maddigan

After the murder, Detective Sergeant Sid Fillery from the local police station in Catford was assigned to the case. Already even by this point the investigation was severely compromised by Fillery who failed to disclose to his superiors he had been moonlighting for Southern Investigation. When Fillery took a statement from Rees, it did not include that both himself and Rees had been drinking with Morgan the previous night in the same pub or details of a robbery from the previous year in which Rees had claimed to have been robbed of £18,000 takings from a cash job at an auction house that Morgan did not want to take. Rees took on the job using off-duty police friends moonlighting.

Tony Thompson reported in the Observer in 2004:

Rees took the money to a local bank, but discovered the night safe had been glued shut. He decided to take it home, but claimed it was stolen on his doorstep by two men who sprayed noxious liquid in his face. No one was ever caught in connection with the robbery. Many believed the attack was a sham, including the car auction company, which demanded the return of its money. Rees agreed to repay the cash and wanted to take it from the Southern Investigations company account, but Morgan refused to allow him to do so, arguing that the loss had been down to Rees alone. Desperate to take control of the company, Rees allegedly tried on several occasions to have Morgan arrested for drink-driving, knowing that if he lost his licence he would have to give up working at the agency, but to no avail.

Observer’s report went on to quote a witness statement given to a inquest hearing of the murder in 1988 of an employee of Southern Investigations, Kevin Lennon:

According to Lennon’s statement, read at the inquest, Rees soon decided his only option was to have Morgan killed. ‘John Rees explained that, when or after Daniel Morgan had been killed, he would be replaced by a friend of his who was a serving policeman, Detective Sergeant Sid Fillery.’ Lennon also told the inquest that Rees said to him: ‘I’ve got the perfect solution for Daniel’s murder. My mates at Catford nick are going to arrange it.’ Lennon added: ‘He went on to explain to me that if they didn’t do it themselves the police would arrange for some person over whom they had some criminal charge pending to carry out Daniel’s murder.’ In the hours after Daniel’s death a murder inquiry was launched headed by Detective Superintendent Douglas Campbell. One of the detectives assigned to the squad was none other than Detective Sergeant Fillery. Roger Williams MP told the House of Commons: ‘Not only was Sid Fillery among those officers, but he played a key role in the initial murder inquiry during the first four so-called golden days before he was required to withdraw from the murder squad for reasons of personal involvement with the primary suspect, Jonathan Rees. During those four days, Fillery was given the opportunity to manage the first interview under caution with Rees, and to take possession of key incriminating files from the premises of Southern Investigations Ltd, including Daniel’s diary, which has never since been found.’

Subsequently, there have been four further police inquiries investigating the murder in nearly three decades since – costing the taxpayer nearly £30m. However, nobody has ever been convicted and the suspects have always remained the same: Rees, Fillery, Vian brothers Gerry and Glenn and later the getaway driver, James Cook.

In May 2013, the Home Secretary, Theresa May announced that the Government was setting up the Daniel Morgan Independent Panel to review police handling of the murder investigation including:

police involvement in Daniel Morgan’s murder;

the role played by police corruption in protecting those responsible for the murder from being brought to justice and the failure to confront that corruption; and

the incidence of connections between private investigators, police officers and journalists at the News of the Worldand other parts of the media, and alleged corruption involved in the linkages between them

It was in the midst of a bugging operation at Southern Investigations during Operation Nigeria that police became aware of amongst others, two specific journalists using the agency: Alex Marunchak and Mazher Mahmood both of News of the World. They launched Operation Two Bridges (an Operation Nigeria spin-off) and further discovered Marunchak was the middleman between Southern Investigations and News of the World. In fact he was so close to Rees, they even registered companies at the same address in Thornton Heath.

Our investigation can further reveal police were in possession of phone records, letters, invoices and receipts going back and forth between Southern Investigations and News International going back many years. One invoice from Fillery addressed DIRECTLY to Mahmood. Dated 30th July 1999 read:

Dear Maz, Further to our rather enjoyable operation to assist you in France and Belgium, I now take the liberty of enclosing a note of our charges. Our costs are quite high but I have taken such steps as practicable in order to reduce them. For instance, rather than charge our normal rate of 44p each mile, I’ve reduced our time spent traveling to and fro on the ferry. I’ve only charged sufficient to cover fuel and costs. You will see I was obliged to pay an extra £24 to the ferry company in order for us to take a later ferry, although of course, it was cheaper to do this than simply pay for Mel and I to be waiting around in Calais. Best regards Sid

Fillery’s letter certainly gives the impression Mahmood and Fillery enjoyed a rather friendly working relationship. The ‘Mel’ mentioned in the letter is believed to be former police officer Melvyn Heraty, who also worked for Southern Investigation.

Another piece of police intelligence that can also be revealed for the first time is a request for security made dated 29th April 1999 by Marunchak on behalf of Mahmood, who was due to appear in court as the prosecution witness in actor John Alford’s cocaine “sting” set-up by Mahmood at the Savoy Hotel in 1997. It is believed one of the Morgan murder suspects were hired as Mahmood’s security at the trial at Snaresbrook Crown Court. Alford was sentenced in May 1999. He was found guilty of supplying the drug to Mahmood but Alford still maintains to this day he is innocent and that he was targeted and entrapped by Mahmood. He is currently appealing against his conviction and has referred his case to the Criminal Cases Review Commission (CCRC).

His lawyer Siobhain Egan said of our investigations:

It is as we have long suspected that the Met knew and repressed information about corrupt relationships between their officers, employees of The News of the World and Southern Investigations. This information was deliberately repressed by the Metropolitan police and should have been disclosed to those representing defendants in the so called “stings” orchestrated by Mazher Mahmood. It is information which should be immediately disclosed to those lawyers advising relevant convicted individuals whose cases are now before the CCRC, and the Daniel Morgan Investigation Panel.

It was Assistant Commissioner Bob Quick at the Metropolitan Police who led both Operation Nigeria and Operation Two Bridges and reported directly up to Assistant Commissioner Andy Hayman.

They both appeared at the Leveson Inquiry in March 2012. Quick submitted a written statement which covered his role in Operations Nigeria and Two Bridges. Of all the core participants who appeared at the inquiry, four paragraphs in Quick’s statement are arguably the most relevant, insightful, as well as the most overlooked evidence given:

During 1999, Anti-Corruption Command was conducting an operation, code named, Operation Nigeria, which was a covert infiltration of office premises operated by Southern Investigations whose proprietors were two men, Jonathan Rees and Sidney Fillery. Both were suspected of involvement of a former partner in the company, Daniel Morgan, who was murdered with an axe in a pub car park in Sydenham in 1987. Fillery had been a former police detective and had worked on the original murder investigation. The objective of this operation was to advance the investigation into the Morgan murder. During the course of Operation Nigeria, it became clear, amongst other criminal activities, Southern Investigations was acting as a clearing house for stories for certain newspapers. Many of these stories were being leaked by police officers who were already suspected of corruption or by unknown officers connected to officers suspected of corruption, who were found to have a relationship with Southern Investigations. A number of journalists were identified as having direct relationships with Southern Investigations. To the best of my recollection these included journalists from papers like The Sun and News of the World but may have included other newspapers. My recollection is one of the journalists suspected was [REDACTED] an executive with News of the World. During the operation it became clear that officers were being paid sums of between £500 and £2000 for stories about celebrities, politicians, and the Royal Family, as well as police investigations. Matters in Operation Nigeria were brought to a head when evidence emerged that Rees was conspiring with a known criminal to plant cocaine on the criminal’s wife in order to have her prosecuted so as to enable the criminal to win a custody battle over their one year old child. The Operation Nigeria investigations revealed that this conspiracy involved two corrupt Metropolitan police detectives who were actively involved in attempting to pervert the course of justice in order to ensure the conviction and imprisonment of an innocent woman. These events precipitated the end of Operation Nigeria as police were forced to intervene and arrest those involved, thereby revealing Southern Investigations had been infiltrated covertly by police. Rees, two know criminals, and two detectives were arrested and subsequently convicted and imprisoned for these crimes. Following these events and as a result of Operation Nigeria, in around 2000, I wrote a short report highlighting the role of journalists in promoting corrupt relationships with, and making corrupt payments to officers for stories about famous people and high profile investigations in the MPS. Despite detailed archive searches, the MPS have been unable to provide me with a copy; ordinarily material of this nature would have been destroyed after six years. In my report, I recommended the commencement of an investigation into such activities. I believe my report also names some newspapers but I cannot recall which ones. I proposed an investigation of these newspapers/officers on the basis that I believed that the journalists were not paying bribes out of their own pockets but were either falsely accounting for their expenses and therefore defrauding their employers or, that the newspaper organisations were aware of the reasons for the payments and were themselves complicit in making corrupt payments to police officers.

Quick continues:

I submitted my report to Commander Hayman, who was at the time the head of MPS Professional Standards Department (DPS) and the person I reported to directly. I recall speaking to Hayman about these matters and that he had reservations based on potential evidential difficulties pertaining to privileged material (journalistic material). I did not believe that the circumstances in which these stories were being obtained offered the facility to hide behind the legal protections available to journalists and I recall debating this with him. I’m unable to say whether commander Hayman referred this matter further up the command chain although I was under the impression he had. I did not sense much appetite to launch such an investigation although I felt Hayman was sincere in his reservations at the time. I do recall Hayman making a suggestion that he should visit a particular editor or newspaper and confront them with this intelligence but I do not know what action was taken in this regard .

On close inspection, what Assistant Commander Quick told Leveson was truly remarkable: he was blocked from investigating and prosecuting corrupt police officers and journalists by Commander Hayman and/or “further up the command chain” – that would be the Commissioner himself: John Stevens.

When Commander Andy Hayman submitted his written evidence to the Leveson inquiry, he makes no mention of either Operation Nigeria or Operation Two Bridges, but that’s not where the curiosity ends:

Q (33): To what extent were leaks from the Metropolitan Police Service to the media a problem during your career with the MPS? Andy Hayman: At the MPS it is the DPS that would investigate reported or suspected leaks to the press or bribery by the press concerning officers. I am informed that during my time as Commander DPS from September 2000 to April 2001 and as Deputy Assistant Commissioner for DPS from April 2002 to December 2002 there was one public complaint made alleging leakage of information to the media by an officer and the result of that investigation that followed was that the complaint was unsubstantiated. I do recall one successful leak investigation which occurred in my time as ACSO and was led by my then Deputy, Peter Clarke. This investigation, which was resource- intensive, resulted in a member of staff being convicted. Q (34): What systems and procedures were in place to identify, respond to and detect the source of the leaks? Andy Hayman: Given the size of the MPS and the volume of valuable information it holds, leaks to the media might unfortunately always be a risk, albeit to a small extent. Q (35): What payments (if any) were considered to be legitimate financial transactions between MPS personnel and the media? Andy Hayman: I understand that the current Commissioner has included details in his statement of the current regime at the MPS to deal with inappropriate disclosures to the media Q (90) What levels of awareness and experience were there in the Metropolitan Police Service of “media crime” and in particular: (A) unlawful interception of communications (including the Regulation of Investigatory Powers Act); (B) bribery of officials by the media; (C) blackmail; (D) harassment by paparazzi and journalists; (E) traffic and/or public order offences committed by photographers pursuing stories; (F) inciting officials to communicate confidential information held by the MPS/ conspiring with them to obtain such information; and (G) crime within media organizations other than the foregoing (e.g. dishonest expenses claims)? Andy Hayman: The term “media crime” is not a term I recall as part of operational police terminology. However there are a lot of very experienced officers at the MPS who would have a thorough knowledge of the offences mentioned. Any of the matters listed in the question would be dealt with as an individual allegation, and the relevance of any “media” aspect would be addressed on a case-by-case basis. This might mean seeking guidance from the DPA or restricting access to Crime Reporting Information System (CRIS) or Criminal Intelligence System (CRIMINT) if the matter is sensitive. Q (91): What sort of priority was given to, and what level of resources are available to deal with the above? (Question 90) Andy Hayman: Resources for all investigations would be a local matter first and foremost and would depend upon the priority levels set for the type of crime under local policy. For example, It is likely that traffic or public order offences committed by photographers or journalists pursuing stories would be dealt with by borough but leaks to the media would be handled by DPS.

Commissioner John Stevens (now Lord Stevens) also appeared at the Leveson Inquiry in March 2012. The relevant part of his written statement on leaks follows:

Q (31): To what extent were leaks from the MPS to the media a problem during your service with the MPS? Lord Stevens: I have had considerable experience with problems of leaks of confidential information to the media from my experiences in Northern Ireland and the NCIS Inquiry. On at least one occasion, we had to deal with the issue of leaks immediately prior to making significant arrests. On the plane returning to Belfast we were informed by journalists that they were covering the arrests for the following day. As a result, I was forced to delay the operation by 24 hours. Such leaks in a hostile environment like Northern Ireland could have potentially have life threatening consequences and therefore I was always mindful of them. Inadvertent or deliberate leaking could also severely prejudice the investigations. On this occasion it was known elements in the Security forces were responsible for these leaks (oddly, Lord Stevens makes no mention of leaks at the MPS, as the question asks). Q (32): What systems and procedures were in place to identify, respond to and detect the sources of leaks? Lord Stevens: To the best of my recollection during my time as commissioner I was not aware of any specific cases of leaks to the media by individual officers. Q (33): Whilst you were Commissioner, how many investigations were conducted into actual or suspected leaks from the MPS and how many led to the successful identification of the source of the leak. What was the outcome of the other investigations? Lord Stevens: Ordinarily, any cases involving leaks to the media would be referred to the Directorate of Professional Standards (DPS), in my time under deputy commissioner Blair. The general stance was that officers who leaked information should be dealt with by the existing disciplinary process and where appropriate arrested and prosecuted. In any organisation as large as the MPS there will always be some that will leak information and use it for their advantage for financial gain. These officers and staff should be ruthlessly weeded out. Q (34): Was disciplinary action taken against any member of staff (whether civilian or police officer) for leaking information to the media whilst you were commissioner? If so, please identify the number of cases and their outcome. There is no need to identify the person or persons the subject of disciplinary process. Lord Stevens: During my time as commissioner, there was no leak that could not be dealt with through normal chain of command (referral to DPS) and there was no need to instigate any formal inquiries. Q (35): What payments (if any) were considered to be legitimate financial transactions between MPS personnel and the media? Lord Stevens: I made it very clear in the new media policy 19-00 that the MPS would not tolerate any officer who disclosed information to the media for financial gain or favour. If any officer did so they would be dealt with using all the disciplinary and criminal process available. I also implemented a new policy for reporting wrongdoing within the MPS in 2004 Q (37): To what extent do you believe bribery of personnel by the media was a problem for the MPS (if at all)? Lord Stevens: When i was commissioner there were concerns about bribery of personnel by the media. It was a continual battle to fight this form of corruption. Corruption was always a significant issue during my career, regardless of whether I was commissioner or fulfilling any other operational police role.

Lord Stevens’ statement ironically goes on to say:

We used the media a great deal in our anti-corruption drive. Corrupt personnel read newspapers, watched TV and listened to the radio so we relied on the media to get out anti-corruption message across.

But during Lord Stevens’ cross-examination by the leading counsel for the Leveson Inquiry Robert Jay QC, an astonishing exchange developed:

Robert Jay QC: Were you aware, at the time when you were Deputy Commissioner and/or Commissioner, that the News of the World were extensively using a private investigation company called Southern Investigations? Lord Stevens: No. Robert Jay QC: Did there ever come a time when you were aware of that? Lord Stevens: No. Robert Jay QC: So does this follow: that you weren’t aware that the News of the World made extensive use of Southern Investigations illegally to obtain information about police officers? Lord Stevens: No. Robert Jay QC: You say in your book: “At the end of the 1990s, an independent detective agency called Southern Investigations, based in Sydenham, was frequently coming up on the anti-corruption squad’s radar.” So when did you become aware of that? Lord Stevens: As Deputy Commissioner, a presentation was made to me to try and get a probe into Southern Investigations’ offices. Robert Jay QC: …Your book goes on to say: “Eventually, it became possible to monitor conversations and the hidden microphones picked up much intelligence about the activities going on inside. Via the agency, corrupt officers were selling stories about their investigations to newspapers and being paid quite handsome amounts of money, an unsavory business all around.” Lord Stevens: Yes. Robert Jay QC: So when did you become aware of that? Lord Stevens: When prosecutions took place, and one or two people were successfully prosecuted.

Bellingcat has previously disclosed in the same year Assistant Commissioner Quick and his team were investigating Operations Nigeria and Two Bridges, Stevens had a lunch meeting with Dick Fedorcio, Rebekah Brooks and ALEX MARUNCHAK:

The incoming MPS Commissioner John Stevens wanted to encourage positive press through a closer relationship with national newspapers. His Director of Public Affairs, Dick Fedorcio was in favour of Stevens’ new strategy. A key lunch meeting was convened early in 2000 comprising Stevens, Fedorcio, Rebekah Wade and Alex Marunchak. Was this the crucial point where MPS-NOTW common goals and mutual benefits were mapped out? What exactly was on the table for discussion? Who was grooming who? From that point, MPS and NOTW enjoyed a special relationship of collaboration, particularly in standing up Mazher Mahmood stings. Commissioner Stevens generous dealings with NOTW were not universally popular with hard-pressed working MPS police officers though: One senior police officer recalls the sort of collaboration that went on with News International in the early 2000s. ‘There was a time when they were all over us’ he says. ‘Mazher Mahmood was forever giving us jobs, and us coming in on the back of it. It was always a fait accompli, there was no question of us saying – Hang on, is this one a sensible use of our time and resources? We just had to get on with it. The Commander at the time was quite aware of it. It was generally their management talking to our management, but it always came through a chain of command down to us on the shop floor.

It gets worse. Just two years after Operations Nigeria and Two Bridges in 2002, and in a period of two months between April and June – events took place that will define the whole scandal: the hacking of school girl Milly Dowler and the surveillance of Detective Chief Superintendent David Cook who at the time was leading the Daniel Morgan murder case.

Phone hacking went on to grow on an industrial scale and to the point where even the Royal Family and their circle became targets. The police moved in but ONLY to prosecuted the Royal hackings – and bury evidence up to 4,000 others – including Dowler’s. Who was overseeing the police operation? Commander Andy Hayman.

The MPS’ line has always been resources were too stretched fighting terrorism, despite already having the evidence under their noses. It was through the sheer tenacity of the Guardian journalist Nick Davies with his front page revelation of the Dowler hacking that the dam finally burst for the MPS and News International.

Meanwhile, the surveillance of DCS Dave Cook was instigated by Alex Marunchak. In March 2012 he wrote in Press Gazzette:

I received information from a source that then minor BBC Crimewatch personality Jacqui Hames was having an affair with a senior officer who was appearing on her TV show. For the avoidance of doubt, I did nothing to check this, because it was of no interest to me. I did not look at cuttings, because I had no time, and I was editing the Irish News of the World. But I passed the tittle-tattle on to the London newsdesk as a bit of gossip, which had been passed on to me, and left it to them to deal with as they saw fit. I do not know to this day what checks they carried out, if any at all, or indeed if they did anything about the information. Nor did I ask them to keep me posted with progress or developments. End of story. But I do know that I did nothing more than have a 30 second conversation passing on the rumour to the London newsdesk and that was the end of my involvement.

Nick Davies wrote in the Guardian in 2011:

The targeting of Cook began following his appearance on BBC Crimewatch on 26 June 2002, when he appealed for information to solve the murder of Morgan, who had been found dead in south London 15 years earlier. Rees and Fillery were among the suspects. The following day, Cook was warned by the Yard that they had picked up intelligence that Fillery had been in touch with Marunchak and that Marunchak agreed to “sort Cook out”. A few days later, Cook was contacted by Surrey police, where he had worked as a senior detective from 1996 to 2001, and was told that somebody claiming to work for the Inland Revenue had contacted their finance department, asking for Cook’s home address so that they could send him a cheque with a tax refund. The finance department had been suspicious and refused to give out the information. It is now known that at that time, the News of the World’s investigator, Glenn Mulcaire, succeeded in obtaining Cook’s home address, his internal payroll number at the Metropolitan police, his date of birth and figures for the amount that he and his wife were paying for their mortgage. All of this appears to have been blagged by Mulcaire from confidential databases, apparently including the Met’s own records. Mulcaire obtained the mobile phone number for Cook’s wife and the password she used for her mobile phone account. Paperwork in the possession of the Yard’s Operation Weeting is believed to show that Mulcaire did this on the instructions of Greg Miskiw, the paper’s assistant editor and a close friend of Marunchak. About a week later, a van was seen parked outside Cook’s home. The following day, two vans were seen there. Both of them attempted to follow Cook as he took his two-year-old son to nursery. Cook alerted Scotland Yard, who sent a uniformed officer to stop one of the vans on the grounds that its rear brake light was broken. The driver proved to be a photojournalist working for the News of the World. Both vans were leased to the paper. During the same week, there were signs of an attempt to open letters which had been left in Cook’s external postbox. Scotland Yard chose not to mount a formal inquiry. Instead a senior press officer contacted Brooks to ask for an explanation. She is understood to have told them they were investigating a report that Cook was having an affair with another officer, Jacqui Hames, the presenter of BBC Crimewatch. Yard sources say they rejected this explanation, because Cook had been married to Hames for some years; the couple had two children, then aged two and five; and they had previously appeared together as a married couple in published stories.”The story was complete rubbish,” according to one source.

Intriguingly, on the very same day Jacqui Hames appeared at the Leveson Inquiry to give evidence, the MPS press office released a statement that they had loaned a retired police horse to Rebekah Brooks. This diverted press coverage from Hames’s evidence which was far more damaging. Hames broke down in tears and accused News International of colluding with Southern Investigations.

After their departure from the MPS, both Lord Stevens and Andy Hayman were hired to write columns for News International titles News of the World and The Times respectively.

When Rebekah Brooks stood in the newsroom and announced to staff the closure of News of the World in 2011, she told them:

In a year you will understand why we made this decision

Was Brooks implying there were more revelations to come besides phone hacking, and was it Operation Two Bridges?

Mark Lewis from Seddons, and lawyer for the Dowler family, remarks:

As the Fake Sheikh might have said “we’ve passed our file to the Police”. Remember, Rebekah Brookes warned that there was worse to come, we’re still at the entrance, what’s inside is far murkier. The extent of cover up, corruption and collusion is astonishing. Truth will out.

Dr Evan Harris, Associate Director of Hacked Off, said:",2015-06-22,Revealed: How The Metropolitan Police Covered-Up For Rupert Murdoch's News International
2015,6,https://www.bellingcat.com/news/rest-of-world/2015/06/19/did-china-just-build-a-new-midget-submarine/,/news/rest-of-world/2015/06/19/did-china-just-build-a-new-midget-submarine/,"

Imagery acquired by commercial satellite firm DigitalGlobe from October 2014 shows what appears to be a new midget submarine at China’s Wuchang shipyard.

The space snapshots captured the vessel berthed at the shipyard’s fitting out pier. According to imagery measurements, the vessel has a load waterline length of approximately 35 meters and a beam of approximately 3.5 meters. Although Jane’s Underwater Warfare Systems reports China fielding midget submarines, I have been unable to locate open source reporting suggesting China is currently building such a vessel. Alternatively, the boat could be for a foreign customer. Few additional details beyond those acquired via imagery are available at this time.

Midget, mini, or sometimes coastal submarines typically weigh below 150 tons and are operated by small teams varying in size. Because of their size they are limited in their endurance, which often means they are operated along side a mother ship. In the past, they’ve been used for harbour penetration, concealed attacks on individual ships, or for reconnaissance purposes functioning as a swimmer delivery vehicle. Most of our modern examples—of the North Korean and Iranian variety—are commonly armed with torpedoes and mines, fitted either in the nose or detachable side loads.

That said, this vessel should not be confused with recent reports of China building a Type 093T SSN variant. That variant is said to support the Chinese equivalent of a “SEAL Delivery Vehicle” (SDV). The vessel viewed above is not a SDV. Also ignore reports like this.

Wuchang is most well-known for building China’s Type 035 Ming Class, Type 039 Song Class and the novel Type 032 Qing class vessels. The shipyard is often photographed but no new handhelds have appeared for this boat as far as I’m aware.

Any additional insight readers can provide is welcome.",2015-06-19,Did China Just Build a New Midget Submarine?
2015,6,https://www.bellingcat.com/news/mena/2015/06/15/satellite-imagery-shows-saudi-armor-near-iraqi-border/,/news/mena/2015/06/15/satellite-imagery-shows-saudi-armor-near-iraqi-border/,"

The latest satellite imagery acquired by DigitalGlobe of Saudi Arabia’s northern border region shows the Kingdom bolstering the deployment of its troops with some substantial firepower.

With conflict in Iraq, Syria and Yemen, everyone’s on edge in the Middle East. And none more so than the Saudis.

Space snapshots from November and December 2014 of Turaif shows tanks, self-propelled artillery as well as armor personnel carriers deployed behind newly erected defensive berms. A total of three new bermed positions were located on imagery in the area since early 2014.

Last year in July, Saudi-owned Al Arabiya had reported that 30,000 Saudi troops were dispatched to the border region. At the time, King Abdullah ordered “all necessary measures to secure the kingdom from terrorist groups or others who might disturb the security of the homeland.”

Turaif, located about 40 miles southwest of the Iraqi border, appears to be an important defensive location in support of the order. The move was announced as Iraqi troops were reported to be abandoning their posts in Karbala.

If imagery is any indicator, it appears troops may be deployed at this location in the short-to-medium term. At the time of capture, the snapshots also showed ongoing construction of semi-permanent shelters and a parade ground.

Beyond the armor, three Apache helicopters were parked on an auxiliary apron at the nearby civilian-military airport. Other civilian-military airports near the border have also seen Apache deployments, according to satellite imagery.

In the meantime, the Kingdom continues to improve the country’s border security situation — though it still may have its work cut out for it.

Notably in January, three border guards were reportedly killed in a suicide attack while three others were wounded near Judayyidat Arar. One of the guards was General Oudah al-Belawi, the commander of Saudi forces in the north. Due to the high level death, many have speculated that the attack was an inside job.

The skirmish came just three short months after the country’s latest border fence project was inaugurated. According to the Saudi Press Agency, the Kingdom is now focused on training up to 3,400 people to defend the multi-barrier fence stretching 900km along the northern border.

The project, executed by Airbus Military and Space (formerly EADS), features 78 monitoring towers, 32 rapid response centers as well as various surveillance equipment.

While the recent project and additional defenses may help keep foreign militants out, it does very little to address the root cause of Saudi troubles: internal radicalization. Saudi citizens continue to be among the highest foreign fighters joining ISIS in the fight in Syria as well as among the highest arrested in local terrorist groups.

With two additional attacks last month targeting Shia mosques in the Kingdom, Saudi leadership may need to do more than build walls and deploy armor.",2015-06-15,Satellite Imagery Shows Saudi Armor Near Iraqi Border
2015,6,https://www.bellingcat.com/news/rest-of-world/2015/06/13/us-caspian-sea-strategy-and-azerbaijans-shipbuilding-facility/,/news/rest-of-world/2015/06/13/us-caspian-sea-strategy-and-azerbaijans-shipbuilding-facility/,"



US interests in the Caspian Sea are part of the larger framework of US geo-strategic interests in the Eurasian region. US proxies such as Israel provide support, technical advice and military equipment to the Azerbaijani navy. Both US and Israeli interests against Iranian and Russian influence in the Caspian Sea have aided Azerbaijan in its efforts towards building a modern navy.

Following the collapse of the Soviet Union in 1991, Azerbaijan continued to rely on Russia for its arms purchases, though as the decade progressed this dependence shifted towards other manufacturers of advance weaponry. The removal of Azerbaijan from the list of countries eligible to purchase military equipment from the US in 1996-1997 again left the country eying other sources of advanced western standard military equipment. However, while the US has abstained from selling equipment to Azerbaijan that could affect the balance of power in the Nagorno Karabagh conflict, it has continued to indirectly support Azerbaijan in developing its coastal and maritime interests. Israel, whose regional geostrategic interests are co-aligned those of the US, also support the larger framework of military collaboration.

US cooperation with Azerbaijan is motivated by a range of factors, the most important being the current geopolitical crisis in the region and the need to contain Iran and Russia in order to protect US interests in the Caspian. The fragile relationship between the US and Iran has led to a broader containment against Iran, involving not only US naval power docked in the Persian Gulf, but also the creation of a foothold in the Caspian. Israeli assistance in developing Azerbaijan’s maritime capacity is part of the broader US strategy of offsetting Iranian and Russian influence in the region, especially since both nations dispute Azerbaijan’s share in the Caspian.

Imagery of Azerbaijan’s new shipbuilding facility points to the indigenous upgrade of Shaldak MK boats purchased from Israel. Traditionally, Azerbaijan’s shipbuilding facility’s capability has been limited to upgrades only, as indicated by Azerbaijan’s order of Shaldak Mk and Saar 62 patrol vessels from Israel as recently as 2014. Imagery shows evidence of continuous upgrades, with two ships fully upgraded with Spike missile systems and front main guns. Other Shaldak vessels, as well as larger vessels, are berthed for upgrades, including a Saar 62.

More recently, however, reports indicate two Shaldaks being built in a new shipbuilding facility near Turkan, as seen in image below. The ability to reconstruct vessels is indicated by the vessel components in the image. The capacity for the full reconstruction of ships is a turning point in Azerbaijan’s technological development. A closer look reveals the absence of a dry dock in the second image, which could suggest that operations are still based on reconstruction and not full development from design stage. Nevertheless, this is a major step towards future technological advances for Azerbaijan.

1. http://www.janes.com/article/41108/azerbaijan-inaugurates-shipbuilding-facility

2. http://www.janes.com/article/42534/azeri-coastguard-revamps-fleet-with-israeli-help",2015-06-13,US Caspian Sea Strategy and Azerbaijan's Shipbuilding Facility
2015,6,https://www.bellingcat.com/news/uk-and-europe/2015/06/13/the-russian-forpost-drone-shot-down-in-ukraine/,/news/uk-and-europe/2015/06/13/the-russian-forpost-drone-shot-down-in-ukraine/,"Видео (с русскими субтитрами)

Shortly after Ukrainian troops captured two Russian Spetsnaz soldiers, a Ukrainian special forces unit of the Dnipro-1 Battalion shot down a $6 million Russian Forpost drone near Avdeevka in Eastern Ukraine. The Russian government was quick to distance itself from the soldiers, and even went so far as to parade their families in front of the media to deny their active status. However, the drone that was shot down that day is not something the Russian government can deny owning and operating. Drones, advanced as they might be, do not as of yet have the power of free will, so this particular one could not get lost and fly into Ukraine, or leave its unit to volunteer for service in Ukraine.

Russia’s repeated attempts to convince the international community and its own citizens that there are no Russian troops, or weapons in Ukraine have grown tiresome and farcical, especially when compared against the meticulously researched mountain of evidence to the contrary.

It is one of the most advanced pieces of technology in the Russian arsenal. It’s equally capable of operating at night and in the day. It’s used to acquire a complete picture of the battlefield and relay real time information to artillery teams in order to correct their fire which devastates enemy positions. Although it doesn’t drop bombs, the impact of the surveillance is equally lethal.

This is a UAV that the Ukrainian government has never owned, rented or operated so it couldn’t have been captured by ‘miners and truckers.’ It takes over one year to develop the ability to operate these sophisticated machines and many more to develop the technology required to build them. They also require multi million dollar ground control stations which the separatists cannot build, operate, buy, rent, lease or sublet themselves.

Most importantly, there is no other country in the world that flies the Forpost Drone but Russia. Some countries fly the Israeli Searcher drone, which the Forpost is a licensed copy of, but no other country outside the Russian Federation flies the Forpost, which was shot down on May 20th in Eastern Ukraine. This particular drone contained clearly marked ‘Forpost’ metallic plates with serial numbers inside it’s body.",2015-06-13,Exclusive Access to the Russian Forpost Drone Shot Down in Ukraine
2015,7,https://www.bellingcat.com/news/uk-and-europe/2015/07/29/the-strange-story-of-the-ten-thousand-bitcoin-mh17-investigation/,/news/uk-and-europe/2015/07/29/the-strange-story-of-the-ten-thousand-bitcoin-mh17-investigation/,"

For most people, the website Joker.buzz is totally unknown. The site, which offers users the chance to broker information anonymously using the Bitcoin cryptocurrency, has in recent weeks come to the attention of those who have taken a close interest in the shooting downing of Flight MH17 in July last year. At the start of June a new auction was posted online, asking for 10,000 Bitcoins (approximately $3 million at current exchange rates) for evidence collected as part of an investigation by a “private detective agency” into the events on July 17th 2014. It claims to include over 20 sets of evidence, including videos of witness questions, a forensic examination of the wreckage, results of autopsies, and much more.

To bolster these claims two videos were posted on the site, the first showing footage filmed inside a Buk missile launcher, likely part of the 15 minutes of Buk footage listed on the site:

The audio seems to suggest this is the Buk missile launcher that fired at Flight MH17, but it’s impossible to establish if the audio is authentic, or if the video footage is from July 17th. A second video released on June 22nd contains an audio recording, this time between what appears to be a pilot in an aircraft and a second person.

Today audio was released by Life News in an article in which “experts” claim MH17 was in fact downed not by a jet or Buk missile, but by a bomb on board the plane. The audio in the article is claimed to be a conversation between a Ukrainian SU-27 pilot near MH17 and his controller, and includes a claim by the pilot the explosion that downed MH17 was possibly on board. What’s particularly interesting about this recording is it appears to be the same one being sold on the Joker.buzz auction. As pointed out elsewhere, not only does the audio in the Joker.buzz video appears in the Life News video, but the playback device is identical, even down to the precise position and alignment of the smallest screws. The experts who provided the tape said they had to pay $250,000 to purchase the recording, so it is possible they did in fact purchase the tape from the same people selling it on Joker.buzz. That does raise the question of how can it still be part of the Joker.buzz auction if it has already been sold, including the playback device, to the experts featured in the Life News article.

Since the publication of the audio on Life News on July 29th Joker.buzz has announced the price of the information will be raised to 35,000 Bitcoins, $10 million at current exchange rates, justifying the price increase due to the availability of “irrefutable evidence” in the MH17 case.

Another curious audio recording also appeared today, after going unnoticed on a website since July 17th. The article posted on the site Pressbox.co.uk, a site for posting press releases, claims the following:

David L. Stern, a citizen of the USA, working as a CIA agent under cover in international media, in particular in GlobalPost and BBC, in the middle of July of 2014 was near Grabovo village of the Donetsk region of Ukraine where the Boeing Malaysia Airlines Flight 17 (MH17/MAS17) was shot down. The given transcripts of David L. Stern’s phone talks partially clarify the events preceding the air crash on July 17, 2014 in Ukraine. Audio files were provided by people of the ex-head of the Security Service of Ukraine (SBU) Valentyn Nalyvaichenko after his resignation. For confirmation there is a phone talk with David Stern attached, the audio file is available on: http://s000.tinyupload.com/?file_id=89052498329097996975

The article then has the transcripts of six short phone calls reportedly recording in the days before July 17th 2014, including calls where “David Stern” is discussing the movements of a Buk missile launcher, and preparations of a nefarious sounding plan. The clear intent of these transcripts are to claim David Stern was directly involved with organising the shooting down of Flight MH17 with a Buk as part of some sort of conspiracy.

The Pressbox article went unnoticed until today, when it was identified by users of several forums and social media sites, and it was soon picked up by the Russian media. The Russian articles claims the author of the Pressbox article is Caleb Gilbert, a “British columnist”, but it appears that apart from the Pressbox article itself Caleb Gilbert has no British media presence at all, nor is it possible to find any journalist named Caleb Gilbert. Other Russian sites go further, claiming David Stern has been involved in other CIA conspiracies, with claims of activity going back as far as the 1996 Russian presidential elections.

Despite all these wild accusations there is one fairly major problem with the Pressbox recording. If you actually listen to David Stern speak (for example, in this BBC video), it’s clear his accent is different from the stilted British accent that the speaker in the audio recording has, and that’s ignoring the rather unnatural way the participants in the conversations are talking. But how does this tie to the Joker.buzz auction? In addition to the Pressbox audio file, a 2nd audio file was added to the Joker.buzz auction, and the conversation in this audio file matches the transcript of one of the six conversations on the Pressbox article. It seems these two audio recordings, and the 6 transcribed recordings on the Pressbox article are all most certainly the six “records of mobile phone conversations made by foreign intelligence agents” listed on the auction.

This raises the question why evidence from the auction is seemingly being released bit by bit? If it’s an attempt to drum up interest in the auction why is none of this information being linked to the auction when it’s published? Could it be someone has manufactured a set of evidence pointing to conspiracy around the downing of Flight MH17, and after failing to sell it is now trying to get it into the open piece by piece? It seems that with the continual leak of the information from the auction it’ll only be a matter of time until more is published online.",2015-07-29,The Strange Story of the Ten Million Dollar MH17 Investigation
2015,7,https://www.bellingcat.com/news/mena/2015/07/29/algerias-hardened-s-300-site-almost-complete/,/news/mena/2015/07/29/algerias-hardened-s-300-site-almost-complete/,"

Satellite imagery acquired by DigitalGlobe in May 2015 shows further progress on a probable S-300 site at Mers El Kebir.

While rumors of Algeria receiving a S-400 battery from Russia continue to permeate the blogosphere, construction of the S-300 site over at Mers El Kébir is well underway.

Situated in Oran Province near the coast, Mers El Kébir is an important deployment location. It’s home to the Air Force’s frontline MIG-29 multi-role fighters, the Navy’s Kilo diesel electric submarines and OMCN/CNE shipbuilding, among others.

Once completed, it’ll be the country’s third S-300 site supporting the only known S-300 unit located on the northwest coast. The two other sites thought to host the system sit near Algiers, the nation’s capital and most densely populated city. [1]

According to satellite imagery, the site has been under construction for over two years and follows a configuration similar to those located at Ouled Fayet and Reghaia. Like before, imagery shows that Algeria has taken its time hardening the site by erecting earth bermed protective shelters.

Recent space snapshots from May (right image; left image from May 2014) confirm that the protective shelters have been covered and that concrete access ramps were completed. A nearby support area was still under construction at the time of capture.

Unlike other S-300 sites around the globe — which typically follow basic Russian configurations of ‘C’ and ‘E’ shaped revetments — these hardened sites reiterate the system’s use for strategic defense.

Such systems are imperative for protecting airspace against illegal incursions by a would-be aggressor.

The S-300 is by far the most advanced platform in the country’s inventory which is mainly composed of older Soviet-era systems. It’s a proven and capable system that allows Algeria to engage targets well outside its territorial boundaries, in this case the Mediterranean.

The export variant that Algeria purchased, the S-300PMU2, also known by its NATO reporting name SA-20B Gargoyle, is capable of launching six missiles at once and engaging 12 targets simultaneously, both at high and low altitudes. The system sports the 48N6E2 missile with a range of 200 km paired with the 30N6 Tombstone radar.

It’s most effective when deployed with other air defense assets like the Pantsyr S-1, or SA-22, which acts as a point defense system. In other words, it provides air defense for your air defense.

Algeria reportedly acquired a handful of SA-22 in 2010.

As far as the African continent is concerned, Algeria is the only S-300 user, although Egypt has been in talks with Russia recently to acquire the system. Handhelds from Russia’s Army 2015 forum suggest a S-300VM battery is in the works.

Imagery suggests that Algeria’s new site will probably be complete by the end of the year. And with it, Algeria will have S-300 coverage for most of its coastline.

According to SIPRI, Algeria is the largest arms importer in Africa (2010-14) taking 30 percent of the approximate $18 billion a year trade.

Notes

[1] These are the only sites that are known. Algeria reportedly ordered 8 battalions of S-300 in the 2006 agreement.",2015-07-29,Algeria’s Hardened S-300 Site Almost Complete
2015,7,https://www.bellingcat.com/news/uk-and-europe/2015/07/25/ukraines-dnipro-battalion-combines-drone-footage-with-open-source-intelligence/,/news/uk-and-europe/2015/07/25/ukraines-dnipro-battalion-combines-drone-footage-with-open-source-intelligence/,"

Early this week Ukraine’s Dnipro Battalion produced a rather unusual video on their YouTube channel. The battalion has released a number of videos containing drone footage of Russian-backed separatists positions in the past, but this new video contained something unusual:

The video opens with the question “Where does the terrorist Givi celebrate his birthday?”, “Givi” being Mikhail Sergeyevich Tolstykh, commander of the pro-Russian “Somalia Battalion”. The video then shows a Google Maps satellite image of Donetsk, showing the distance of the area filmed in the drone footage that follows from the frontline down of Avdeevka, 7.29km away. The video then highlights a location in the drone footage where a number of T-72 tanks are parked, as well as provided the address and co-ordinates of the location featured (Donetsk, street Zlitna 11A, 48.062107, 37.759581) The video then cuts to footage filmed by a pro-Russian blogger showing separatists troops celebrating Givi’s birthday party on July 19th, and uses Google Street View to confirm the location the video was filmed by comparing buildings in the footage filmed by the blogger to buildings visible in the Google Street View imagery:

The video then goes on to describe the rest of the area, criticises the separatists for flautning the “Minsk protocol”, and various other statements. What’s interesting about this video is it combines drone footage with open source material from tools such as Google Maps and Google Street View, and video filmed by a blogger. They also include the co-ordinates of the sites they are showing that makes it easy for anyone interested to check what they are showing is correct. This is a very unusual combination of open source material in a video produced from a military unit, but shows that groups in Ukraine might be coming around to the idea that by combining non-classified material with open source material it’s possible to present a much more stronger case that the information being presented is reliable.",2015-07-25,Ukraine's Dnipro Battalion Combines Drone Footage with Open Source Intelligence
2015,7,https://www.bellingcat.com/news/uk-and-europe/2015/07/24/sputniks-mh17-reporting-spins-out-of-control/,/news/uk-and-europe/2015/07/24/sputniks-mh17-reporting-spins-out-of-control/,"

In the long months between the shooting down of Flight MH17 in Ukraine and the publication the Dutch Safety Board report and completion of the criminal investigation various conspiracy theories have been put forward to explain why the reports are taking so long, and how the reports will be inevitable cover ups. Recently Fred Westerbeke, the chief investigator with the Dutch National Prosecutors’ Office investigating the downing of Flight MH17, had to reiterate that the disclosure agreement signed by participants in the investigation, which required all participants to agree on what was published, was only for the duration of the investigation, and was not a way for Ukraine or other countries involved to cover up the true culprit in the crime, as some conspiracy theories had suggested.

This week Sputnik news has published multiple articles on what has been presented as another attempt to cover up the results of the MH17 Dutch Safety Board investigation. Their July 19th article “Ground for Manipulation? MH17 Crash Investigation Results to be Classified” begins with this ominous passage:

The results of the official international investigation into the MH17 Malaysia Airlines plane crash will be classified, the Ukrainian Deputy Foreign Minister for European Integration, Olena Zerkal, said at a briefing on Tuesday.

This is based on statements made by Olena Zerkal about the August 10th meeting where the Dutch Safety Board report will be discussed at a closed door meeting:

The Netherlands will present a report on an investigation into the Malaysia Airlines Flight 17 (MH17) crash in eastern Ukraine at an August 10 closed session of an international task force investigating the crash but will not publish it for the time being, Ukrainian Deputy Foreign Minister Olena Zerkal said. “The task force is supposed to meet on August 10 in keeping with Annex 13 to the Convention on International Civil Aviation. They [the Netherlands] will present this report at the working meeting,” Zerkal told Interfax on Tuesday. The report will only be discussed at this meeting and will not be published because the meeting will be held behind closed doors, she said.

This is not unexpected, as it’s part of the process of the publication of the report, first beginning with the draft report beinghanded to representatives of Australia, Malaysia, Ukraine, the United States, Russia, the United Kingdom and the Netherlands on June 2nd, who were invited to make comment on the report. The expected release date of the report after all the correct publication procedures are followed is October 2015, and nothing in Olena Zerkal’s statement suggests otherwise.

Dutch Safety Board spokeswoman Sara Vernooij confirmed the October release date in response to a question about Olena Zerkal’s statement:

Reports which say that a final report on the Malaysian Boeing crash in Ukraine will be published on August 10, 2015, are not true, Dutch Safety Board spokeswoman Sara Vernooij has said. “No, we are still working,” she told Interfax, replying to the relevant question. “We are going to publish the report in October,” Vernooij added.

Undeterred by such statements, Sputnik continued to push the claim Ukraine was blocking publication of the Dutch Safety Board report, first with their interview with Consortium News’ Robert Parry, in an interview titled “Kiev Acts to Classify MH17 Probe Report Points to Continuing US Cover-Up“. It stated Parry had told Sputnik:

Ukraine’s decision to classify the new report on the MH17 airliner crash a year ago strongly suggests that it exonerates Russia and embarrasses Ukraine and the United States.

Thus reiterating the claim Ukraine was responsible for classifying the Dutch Safety Board report. Sputnik followed this with a further report, “Classifying Results of MH17 Crash Probe Unacceptable for Victims – Lawyer“, which states:

Earlier in the week, the Ukrainian Deputy Foreign Minister for European Integration Olena Zerkal claimed that the results of the official MH17 international investigation would not be available publicly.

And then quotes John Beer, a lawyer for some of the families of MH17 victims, as saying:

I think it would be unacceptable if our clients would not be informed about the full results of the investigation.

This is followed by another Sputnik article, “Results of MH17 Crash Investigation Must Be Disclosed – Russia’s EU Envoy“, which again opens with:

Earlier this week, Ukrainian Deputy Foreign Minister for European Integration Olena Zerkal claimed that the results of the official MH17 international investigation would not be made publicly available.

Most of the rest of the article is dedicated to other matters not directly related to MH17, and the opening paragraphs seem only to exist to reiterate the claims made in earlier reports, with even Russia’s permanent representative to the European Union Vladimir Chizhov stating “I don’t think this statement reflects the real situation”, probably unaware of how it had been taken out of context by Sputnik in its reporting. It seems Sputnik couldn’t resist using the quote repeatedly to prop up the conspiracy theory that Ukraine is blocking the publication of the Dutch Safety Board, despite the clear statement from Dutch Safety Board spokeswoman Sara Vernooij that the report would be published in October.",2015-07-24,Sputnik's MH17 Reporting Spins Out of Control
2015,7,https://www.bellingcat.com/news/uk-and-europe/2015/07/24/grand-theft-moldova/,/news/uk-and-europe/2015/07/24/grand-theft-moldova/,"

By Paul Radu, Mihai Munteanu, and Iggy Ostanin

The bank theft was so outsized and bold that citizens of the Republic of Moldova came out in the streets this past May by the thousands to protest: “We want our billion back!”

They used the number — US$ 1 billion – that news accounts reported had gone missing from three Moldovan banks in November of 2014. Unsure who to blame, the protestors denounced the government, politicians, banks and organized crime.

The theft was a serious setback for Moldova, one of Europe’s poorest countries, with a gross domestic product of only US$ 8 billion and an average wage of US$ 200 per month.

It set off chaos in the local banking system and led to the World Bank and the International Monetary Fund suspending financial aid to the country earlier this year. The European Union also froze funding for Moldova until a new government was formed. These moves prompted fears that the country might default on its international obligations.

The protestors last spring, outraged as they were, didn’t know the half of what had been done to them. The November billion was just the latest outrageous crime in a massive, decade-long series by criminals who use this small, Eastern European country as their personal bank.

They also didn’t know that police could have shut down the ring years ago when they confiscated key company stamps and documents central to the corruption ring. But higher-ups stepped in and prevented arrests. The police returned the stamps and documents — which were then used six years later to launder huge sums.

Moldova’s problem goes way behind a single audacious theft. It involves a transnational nexus of government workers, organized criminals and businessmen, all of them untouchable despite their crimes.

A police investigation continues but it seems nobody in the government or law enforcement has had the knowledge, skill, or desire to get at the root of the problem.

The Organized Crime and Corruption Reporting Project (OCCRP) analyzed tens of thousands of records, and found that the same people who stole the bank money operated a seemingly unrelated, large-scale, money laundering operation that laundered more than US$ 20 billion, much of it from Russian and Russian state companies, over the past seven years.

“The main authors of the theft are not in Moldova, they are in the east,” said former Prime Minister Ion Sturza in a television interview. “Moldova laundered Russian Federation money.”

The Vanishing Billions

Moldova is a tiny country squeezed between the interests of Russia and the European Union. Despite or perhaps because of its rampant poverty, it has grown into one of the biggest money laundering hubs on the continent.

Billions in black money flow annually through local banks. Moldova is a proxy – most of the money flowing through its banking system is not Moldovan. But the process has corrupted Moldovan society and wreaked havoc on the country’s politics, economy and judiciary.

The November billion vanished after the banks gave loans to companies owned by people whose identities remain hidden in a maze of offshore corporations. The borrowers took the money and ran. The collapse of these loans was a serious blow to a Moldovan banking sector already buffeted by corruption scandals:

The Magnitsky Affair began in 2007 when US$ 230 million was stolen from the Russian budget. Eventually, the money was routed through a group of Moldovan banks; some of it was traced to high-end real estate in New York City.

The Russian Laundromat, uncovered by OCCRP in October of 2014, was much bigger, passing US$ 20 billion in stolen Russian funds through some of the same Moldovan banks en route to Europe.

The Moldovan government did try to trace the missing billion. In January 2015, it hired the private global due-diligence company, Kroll Inc. Kroll’s first report was leaked to the public by Andrian Candu, the Moldovan Parliament’s president, just days before the mass protests. It revealed little about who ended up with the money, further deepening the mystery.

Following the Kroll report, the Moldovan authorities placed Israeli-born businessman Ilan Shor under house arrest. Shor’s name had been mentioned in the report in connection with the bad loans. Shor runs Banca de Economii bank (the bank involved in the Magnitsky case and one of the three banks robbed) and a football club in Moldova.

Police are still investigating Shor and consider him a suspect in the theft, but they are unsure of his role. He says he’s innocent. In June, he was elected mayor of the small town of Orhei in Moldova.

A major stumbling block for investigators was the fact that in November 2014, right after the theft, an armored transport vehicle carrying 12 sacks of bank documents related to the fraud was stolen and burned in what looked like a well-executed plan to erase any trail that might have led back to the organizers.

This was deja-vu.

The same thing happened in the Magnitsky case, when a truck carrying bank records related to that theft crashed and burned, impairing the ability of the Russian law enforcement to investigate.

The Raiders and the Stamps

The fondness for using Moldovan banks for crime dates back a decade. The mid 2000s were wild years when the local police were overwhelmed by both the advanced money laundering techniques the fraudsters developed and by rampant corruption in their own ranks.

A confidential 2011 Moldovan police report summarized that: “Our investigations and analysis indicate that an organized group specialized in ‘raider’ attacks against large companies operates on the territories of Moldova, Ukraine and Russia. Between 2005 and 2010, this group used decisions issued by courts in Moldova, Ukraine and Moldova to get more than US$ 100 million.”

(A raider attack is the hostile and illegal takeover of a company, sometimes achieved through violence and sometimes through forgery, fraud or corrupt court decisions).

In some cases the raiders were only interested in extorting large sums from companies. A typical scheme might involve getting corrupt judges in Moldova or Ukraine to issue judgments in the raiders’ favor in cases where they claimed fictitious debts from state-owned commercial entities.

Using the court-approved debt as a basis, they could legally take over the company.

The report details a few such cases at length, but one in particular, Penal Case 2008030181, seeded the huge money-laundering tsunami that crashed over the country in the following years.

The Lost Opportunity

In July 2008, Moldovan law enforcement officers were working a relatively small $4 million fraud case when the investigation led them to 67 Bucharest Street in the center of the Moldovan capital of Chisinau. They raided three offices there and confiscated six desktop computers full of files.

It was all pretty routine, until they located three paper boxes under one desk that contained “an imposing number” of official rubber stamps belonging to companies registered in exotic offshore locations.

Two of the stamps were related to the fraud they were investigating, but the rest meant nothing to them: Mirabax Limited, Liberton Associates, Felina Investments, Albany Insurance, Caldon Holdings and many other companies, including some based in the US state of Delaware or the United Kingdom.

Some belonged to Moldovan companies and one of these, Luminare LTD, was a company founded by Veaceslav Platon, a key player in Moldovan political and business circles. Platon, 42, is Moldova’s sixth richest businessman and a politician with dual Moldovan-Russian citizenship. He was a member of the Moldovan Parliament between 2009 and 2010.

He has also been on the governing board of at least two Moldovan banks including Moldindconbank, which has frequently been at the center of money-laundering controversies. He is frequently called by media “The No. 1 Raider in Moldova.”

As police were staring at the boxes of stamps in downtown Chisinau, in neighboring Ukraine their counterparts were conducting their own investigation into a string of raider attacks including the same $4 million fraud.

They, too, found rubber stamps stashed in an apartment in the outskirts of the Ukrainian capital of Kyiv, as well as blank stationery stamped with company letterheads such as the British-based Goldbridge Trading Limited, a company already involved by 2006 in laundering money and defrauding at least one Moldovan company.

Platon’s name popped up in the Kyiv raid as well, but this time the name of the Moldovan-Russian politician was imprinted on powers-of-attorney documents issued by Moldindconbank.

An investigator present at the 2008 Moldova raid, who declined to be identified because he is not authorized to speak, said, “In those times the big frauds, the raider attacks, were conducted via Moscow-Minsk-Kiev-Chisinau.”

Then something really strange happened.

On July 23, less than two weeks after the Moldovan law enforcement seized the stamps and the computers, an order came from high up to return everything. The report says the police did not even have the time to perform forensic tests on the evidence.

Penal Case 2008030181 got shelved and was never worked on again. No investigation was ever concluded on the Ukrainian side, either.

These same companies would be used over and over again in a series of massive money-laundering operations that siphoned billions of dollars out of Russia and, moving through Moldova, into the European Union.

Neither the Moldovan investigators, nor their Ukrainian counterparts, knew they had been on the brink of stopping one of the biggest money-laundering operations uncovered in Europe.

The Agents and the Easterners

In the beginning of 2015, while the Moldovan government was asking Kroll to investigate the November theft, OCCRP reporters were knocking on doors thousands of kilometers away from Chisinau, in Edinburgh, Scotland.

Two street addresses on Brunswick Street in the Scottish capital kept popping up in records of the British companies involved in the November billion theft, and also in many other much bigger instances of massive money-laundering and raider attacks in Eastern Europe.

Brunswick Street does not look affluent. Cheap cars are parked outside terraced red brick housing and the two addresses don’t look like the headquarters for multi-billion-dollar businesses.

The people who live there are “formation agents”, people who set up companies for others who wish to conceal their identities, and “proxies” or front men for the people who actually own the companies.

At one of the Brunswick Street addresses, the door was answered by Ishbel Papantoniou, a plump lady in her early 60s who is the wife of the man behind the Brunswick companies, Marios Papantoniou. He is a former chief tax inspector in Cyprus who moved to Edinburgh in the early 1990s and set up an accounting and company-formation business there.

At first, Ms. Papantoniou greeted a Russian-speaking reporter in a friendly manner. She said that “a lot of Russian companies, from what I know, register so they can work within Europe.” She also added that Russian businesses might want to do this because “it opens a world with less restrictions, so to speak.”

On a second visit, however, Ms. Papantoniou became agitated when the reporter told her that OCCRP was investigating high-level money-laundering operations involving companies where she, her husband, her son and her 81-year-old mother showed up in paperwork.

“I don’t think that’s any of your concern at all. You’re looking into something that you’ve no idea what you’re getting into,” she said. “We offer office facilities for these companies…there’s absolutely nothing that’s illegal or anything. You’re trying to find something in a company that’s providing services, that pays income tax, that provides employment for people in this country.”

The offices next door belong to a company called Axiano that was also established by Marios Papantoniou. This company, too, was the registration agent for a number of companies involved in Eastern European fraud. In the office reception area, several women were having lunch. A closed-circuit TV camera was trained on the entrance.

A young woman answered and, in an Eastern European accent, said that Marios Papantoniou wasn’t available, but his son Alexandros was.

The former tax chief inspector’s son arrived soon after but seemed nervous and reluctant to speak. Expressionless, he brushed aside the questions with the invariable statement, “the best person to talk to might be my father.”

OCCRP made one more attempt to talk to Marios Papantoniou to seek his response to a document signed by Kerry Jane Farrington, an employee of the local Edinburgh Crematorium, who Papantoniou used as a proxy in companies he established for Eastern Europeans.

Marios Papantoniou was unavailable, so OCCRP left the document with a Russian-speaking office worker. Marios Papantoniou promptly responded via email but refused to answer questions about the involvement of his companies in Eastern corruption and crime.

The Grand Mockery

On April 5, 2013, Moldovan Judge Victor Orindas issued a verdict: a group of Russian companies must send US$ 580 million to the Latvian bank account of Mirabax Investments Limited, a Brunswick company connected to Marios Papantoniou and one of the companies whose rubber stamp was confiscated and then returned by the police back in 2008.

The scam, outlined in OCCRP’s series The Russian Laundromat, was simple. A Russian company wishing to move money into Europe would guarantee a contract signed between two fake companies. Then one of the fake companies would file a complaint against the other in a Moldovan court for non-payment and ask that the guarantor, the Russian company, make good on the unfulfilled contract. A bribed Moldovan judge would certify the debt as real and order payment. Then the Russian company would pay the fake company, which was actually working with them. Combined with the judge’s order, the money could be moved through Moldova into a Latvian bank account – freshly laundered and ready to use.

The rubber stamps the police briefly seized seven years previously were used over and over again on documents that were introduced as evidence into Moldovan courts to falsely certify debts that finally amounted to US$ 20 billion.

By 2012, the organized crime group that began operations in 2005 had upped their game significantly and had become brazen. The initial frauds totaling millions had turned into billions. When Judge Orindas issued the US$ 580 million verdict he was ruling on a clumsily forged document; other judges across Moldova did likewise, enabling the criminals to move huge volumes of money from Russia.

All the Moldovan rulings were based on promissory notes presented as evidence to courts. In the case of the US$ 580 million, the promissory note was concluded between a Delaware company called Albany Insurance and a British company,Golbridge Trading Limited. Albany promised to pay Golbridge more than half a billion US dollars and the note is signed by a Mrs. Jasse Grant Hester and rubber-stamped with Albany’s stamp, another one of the stamps seized and returned back in 2008.

But there is no Golbridge Trading in the UK and there is no Mrs. Jasse Grant Hester. There is, however, a Mr. Jesse Grant Hester who is the director of the Delaware-based Albany Insurance and there is a London-based Goldbridge Trading Limited, a company connected to Brunswick street and, again, one of the names that emerged in the police operations conducted six years earlier in Moldova and Ukraine. In the end, Goldbridge diverted the money to Mirabax, the company that ultimately cashed in in its Latvian bank account.

It’s likely the criminals slightly altered the names each time to provide some deniability and reduce the traceability should the scheme ever get discovered.

The Moldovan judge could have annulled the proceedings just by comparing the promissory note to the other documents in the court file where the original documents spelled the names correctly. In at least one case the fraud was even easier to spot as the text on the promissory note said Golbridge while the name of the company on the rubber stamp that was applied in the lower right corner was spelled correctly as Goldbridge.

Judge Orindas and other judges in Moldova chose instead to ignore the blatant forgeries. Some are now under investigation for their role.

All the promissory notes used to siphon more than US$ 20 billion from Russia were forged in the same way.

On the Russia-Moldova-Latvia route, the money was held for a short time by Moldindconbank, where Veaceslav Platon served as vice president. By the time the transfer transited the bank, Moldindconbank was owned by offshore companies including a Gibraltar firm connected to Jesse Grant Hester, a Brit working as a formation agent and living in Mauritius, and to another proxy, James Damian Calderbank, another British formation agent living in Dubai. Both names, Calderbank and Hester, kept on appearing in the Laundromat’s deals but neither would answer OCCRP’s questions. Platon did not answer repeated attempts to contact him.

The Bad Banks

The three banks involved in the November theft were owned in the same way as Moldindconbank, by secretive offshore companies. None of the offshores owned more than five percent of any bank, keeping them below the threshold which would trigger greater Moldovan Central Bank scrutiny and ultimately approval. Recently, Moldova lowered that threshold to one percent in the hope of driving out corrupt practices.

These ownership schemes were created after 2008 before the wholesale money laundering started. OCCRP looked at the records and found out that many of the offshore companies involved in the bank’s ownership are also connected to the companies that got the big, unsecured loans on which they would later default.

The same formation agents and proxies have been used over and over. The offshore companies owning the banks also followed geopolitical lines: when war broke out between Ukraine and Russia, the Ukrainian proxies were quickly replaced with Russian citizens.

Meanwhile, the citizens of Moldova are left wondering who stole the November billion.

Sturza, the former prime minister, said those involved in the corruption includes a who’s who of Moldovan politics, sport and culture. But he said many were used as pawns.

“…Platon and Shor coordinated from the outside and executed the schemes in the Republic of Moldova,” he said during an interview with the Interpol TV show in Chisinau.

Sturza said when the amounts being laundered grew to be so huge, the Moldovans demanded a bigger cut, which ultimately led to a collapse of the system.

Platon left Moldova on Feb. 14, 2014, and has not returned. He is under investigation for his role in the thef

Contributors: Ion Preașcă and Iurie Sănduță in Chișinău

Graphics: Sergiu Brega",2015-07-24,Grand Theft Moldova
2015,7,https://www.bellingcat.com/news/mena/2015/07/24/iran-carrier-mockup-anchored-off-bandar-abbas/,/news/mena/2015/07/24/iran-carrier-mockup-anchored-off-bandar-abbas/,"

Prior to signing the historic nuclear deal between the EU3+3 and Iran earlier this month, Iran’s propaganda piece, a mock-up of a U.S. Nimitz-class aircraft carrier, was moved outside the harbor of Bandar Abbas.

Satellite imagery acquired by DigitalGlobe in June shows the mockup floating west of the peninsular breakwaters at the Iranian naval base. The mockup was used in the Great Prophet 9 exercise earlier this year to demonstrate Iran’s resolve in closing the Strait of Hormuz.

Imagery shows that it had been towed away from its berthing position (27.141731 56.201896) in late May where it was observed during mobilization in January and after exercises in March.

The latest space snapshots also confirmed that the “floating barge” had not been repaired at the time of capture. Damage was still visible to the deck and the mock-up control tower.

While it’s still difficult to determine what Iran has in-store for the mock-up, its future use may be limited. The much heralded Iranian nuclear deal could signal a change in US-Iran relations. Iranian President Hassan Rouhani emphasized that the agreement begins “a new chapter” and if carried out correctly could “gradually eliminate distrust.” Such sentiments were echoed by President Obama when he noted: “This deal offers an opportunity to move in a new direction. We should seize it.”

On the surface, the agreement could potentially tone down Iran’s signaling of an all-out confrontation between the two countries’ naval forces. However, with skeptics and detractors in both countries remaining hostile to the agreement, it may be too early to say.

After 20 months of negotiations, hardliners still believe the agreement has made their countries less secure. The American GOP calls it a “diplomatic failure,” “deeply flawed” and a “historic mistake.” In Iran, the IRGC criticizes the deal as violating Iran’s redlines (even though it potentially improves their grip on the economy).

All of which could suggest that this shitty (ahem, low fidelity) mockup may yet have some role to play. The true test will be after it returns to the ISOICO shipyard.

To dismantle or repair, that remains the question.",2015-07-24,Iran Carrier Mockup Anchored off Bandar Abbas
2015,7,https://www.bellingcat.com/news/uk-and-europe/2015/07/16/in-their-own-words/,/news/uk-and-europe/2015/07/16/in-their-own-words/,"

On July 17, Bellingcat conducted a reenactment of the social media reaction to the MH17 disaster from the account @mh17live. All of the information here, along with many other reactions and speculations from 1 year ago, was retweeted and translated on this account.

Этот пост также доступен на русском языке в переводе “Радио Свобода”

In the days following the downing of MH17, narratives fell into place from the sides of Russia / pro-Russian separatists and Ukraine / Western nations. Journalists and investigators have gathered numerous witness accounts that attest to both Ukrainian narrative (a Buk anti-aircraft system brought down MH17 from south of Snizhne) and the Russian narrative (Ukraine shot down MH17 either with an SU-25 fighter jet or with its own Buk, likely near the village of Zaroshchenske). The most raw and unfiltered information available is not in the interviews taken in the weeks and months after July 17, 2014, but instead the social media postings that were composed in the morning and afternoon of July 17 before the tragedy, and immediately after the downing, before it was clear that nearly 300 innocent people died in a senseless act.

This article will examine the available social media accounts available that confirm the existence, location, and general timeline of a Buk anti-aircraft system in separatist-held territory on July 17 and reports of locals reporting an event that is consistent with a Buk missile launch just minutes after 4:20PM (Kyiv time), when the tragedy took place. Even though initial witness reports can be unreliable, there is a clear, remarkable consistency in these independent reports that strongly support the notion of a separatist-controlled Buk being murder weapon in the MH17 disaster.

The generaly accepted timeline of Buk 3×2, which is suspected in the downing of MH17, with very approximate and broad ranges of time:

Left Donetsk, eastbound along H21: ~10:45am (Kyiv time) Passed Zuhres, Shakhtersk on way to Torez along H21: ~11:00am-12:00pm Entered, passed through Torez (eastbound): ~12:00pm-12:45pm Entered Snizhne: ~1:00pm Unloaded Buk from Volvo truck in Snizhne, left city (southbound): ~1:30-2:30pm Shootdown of MH17: 4:20pm

Donetsk and Shakhtarsk

Many of the tweets attesting to a Buk (or, at least, a large piece of military equipment that very well may have been a Buk) are attributed to @666_mancer. This popular user likely may not have seen any of the scenes himself, but instead collected witness accounts from others and re-posted them in one place. A similar pattern will later be seen with @Wowihay, who no longer lives in Torez, but collects witness testimonies from locals. As it is often not safe for someone to post an sighting of separatist military maneuvers on a personal Twitter account, it is safer for a single person (who is either anonymous or no longer lives in the town) to post them. Additionally, the #Stopterror (#Стоптеррер) hashtag that frequently appears in these tweets was meant to inform the Ukrainian military of separatist military maneuvers, thus providing crowd-sourced intelligence from locals with eyes and ears on the streets.

Donetsk 30minutes ago along prospect Ilicha by molokozavod some sort of anti-aircraft complex, like a Strela, was transported on a platform underneath a cover, accompanied by 10 normal vehicles

#Donetsk 25-30 minutes ago around the Gruzia area something that looks like a Smerch was seen. It was sitting there. But maybe they are going to transport it somewhere or another. #Stopterror

Donetsk: “Not a smerch. 1. Its base is tracked. 2. No long firing tubes are not long. It visually resembles a BUK a lot. However, there were no mounted rockets” #Stopterror

#Donetsk witnesses: the front of the vehicle is similar, but then came a trailer on which there was something underneath a cover, tracked, with one cannon #Stopterror

in the morning people wrote that it [a Buk] was at the crossing Shakhtostroiteley Boulevard and Prospekt Ilyicha, facing Makiivka. they were waiting, it seemed…

shakhtersk kamaz of terrorists, 3 tanks. Before them possibly a Buk passed by, covered up #ato

Torez and Snizhne

A surface-to-air launcher has just passed us in the direction of the city center. 4 rockets, they say that it’s a Buk #stopterror #torez in the direction of #snizhne

They hauled a rocket complex on a low-loader escorted by two vehicles through Torez towards Snizhne at 12:10pm

12:51pm “Whose equipment?” 12:52pm “The DNR” [Donetsk People’s Republic]

12:53pm “It looks like a Buk, it was covered up top”

A BUK is going through #Torez to #Snizhne #Stopterror

Rocket

Something just made a loud as hell sound from the direction of Shakhtarsk

Below are the replies to this message, which describe the sounds that the locals heard minutes before:

4:28pm @NikolasFather: No, it was between Shakhtarsk and Torez, closer to Torez and further north. Sounded like a Grad volley (if it is that, then what was it firing at?)

4:29pm @HuSnizhne: No, grads fire with a droning, and this was a singular [sound], they are saying

4:30pm @NikolasFather: I heard an uninterrupted droning for like 70-90 seconds

4:30pm @masiluta: And it seemed to us that it was in Snizhne

4:32pm @masiluta: did they shoot down a plane in the neighborhood?

4:33pm @NikolasFather: And maybe a volley and then after the explosion of an unguided missile from a plane (or whatever they are called with planes).

4:35pm @other331: At first it was a single explosion that wasn’t too strong, and then after a minute a second stronger one thundered

5:19pm @IrinaWayreed: During the ongoing droning I heard separate loud booms, and right now a volley has gone out

A local Snizhne woman (who is pro-separatist) named Olya Krivosheenko heard what was likely a rocket above her before MH17 was struck. Later in the comment thread, she said that it was good that they hit a Ukrainian plane if they were there to bomb the town, as had happened in Snizhne just a few days prior.

Dima, got it, something buzzed above us but not like a plane, they say that a rocket went up to it

Sergei Petrov, a man who lives in Snizhne without any clear ideological leanings (other than a love of football), described a series of events that sound much like a rocket launch.

Vlad, I also didn’t immediately realize. I saw that something was flying. I was out in the country in a tree and picking pears. And then an explosion. There was an extremely strong sound…I would have captured it on my phone (((( but people did capture the end

A local man who supports separatist forces in the area posted:

I saw how this rocket flew!!! I even saw where it came from and where it went!!! It was terrible as hell to see it!!!!

Irina Shcherbakova, a local Snizhne woman who supports the local separatists, saw a rocket launch immediately before the downing of MH17:

I saw how a rocket flew from the direction of Saurovka…and then a minute-long lull and a loud explosion…a trail remained in the sky from the rocket…I didn’t see the explosion myself it was very loud….all of my family ran out into the street…..we were all very scared……….I don’t know who to believe but we didn’t hear the sound of an SU[-25]…..it was quiet just like with a normal passenger plane and then that’s all……

Reply soon after from Anastasiya, another local woman from Snizhne who supports the separatists:

Anastasiya: Yes, it was so.

Irina: Anastasiya, you also heard it

Anastasiya: Irina, I saw it

Andrei Tsarev: Someone says that a rocket flew from mine #4, someone from Saurovka, what’s the truth?

Irina: I am saying that I saw it

Kolychiy: Andrei, this is in a direction in relation to the location of the crash

Anastasiya: Andrei, I live at Cheremushki, the rocket flew from the direction of the city. Exactly where it was fired from, I can’t say.

Irina: But the sound it made….

(later on, Irina posts that she “wants to become Russian” and posts a picture of a Taras Shevchenko [edit: thanks to Andriy Makukha] statue holding a Donetsk People’s Republic flag)

Miscellaneous

There were two messages from “Vanek Samarsky,” a separatist fighter living in Snizhne whose real name is Ivan Krivobedry, written immediately after the downing of MH17. These seem like they could be related to the incident, but lack context.

are you around the cannon that was at the 4th?

Reply from a local:

I’m living at the 8th and at the very moment I was outside and saw where it launched from and where it flew to

The word “cannon” here (пушка) is very broad (see Google Image search result here for a good idea), and most often refers to an actual 18th century cannon or a wide range of modern weapons, including an anti-aircraft gun or nuclear missile launcher.

She uses the feminine pronoun (она) when speaking about the thing that launched and flew. She is almost certainly talking about a rocket (ракета), which is grammatically feminine in Russian.

When discussing “the 4th” and “the 8th,” the two are almost certainly talking about the 4th and 8th mines. The latter is located in Snizhne proper, while the former is located in the village of Removka, just south of Snizhne. When Vanek is talking about the “4th,” he is not just talking specifically about the mine, as locals often refer to the area around the mine as the 4th, or 4th mine (for examples, see these posts: 1, 2, 3, 4)

don’t write where they fired from if you don’t want them to bomb us.

“Vanek” (Ivan Krivobedry) posted this message twelve minutes after his previous message about the “cannon” being near Mine #4.

This is the most famous of all messages regarding MH17. This particular post comes from the “Dispatches from Igor Ivanovich Strelkov” VK group. Strelkov (Girkin) himself did not post this message; rather, some “fans” of his posted the message from local information. It was taken down as soon as it was evident that a passenger plane, not an AN-26 transport plane, was shot down.

17.07.2014 5:50 (Moscow time) Message from militia

“In the area of Torez an AN-26 plane was just shot down, it is somewhere near the mine ‘Progress.”

We warned them – do not fly in “our skies.”

And here is video proof of yet another “falling bird.”

The bird fell behind the mine, residential areas were not hit. Peaceful citizens were not hurt.

And there is also information about a second shot down plane, likely a SU[-25]”

Conclusion

Though each piece of social media evidence described in this article is not conclusive on its own, a clear pattern emerged and matches the widely accepted narrative of July 17. A Buk anti-aircraft system was located in Donetsk in the late morning, headed east through Shakhtarsk, moved through Torez at around 12:10, and headed south out of Snizhne later that afternoon. A rocket was fired—both seen and heard by locals supporters of separatist forces—from south of Snizhne immediately before the downing of MH17.

Analysts have investigated (investigated the investigations of) the events of July 17 endlessly over the past year. Among these investigations include dishonesty and the outright fabrication of evidence, as seen in the July 21 Russian Ministry of Defense press conference, the infamous fabricated satellite photo on Russian state television, and a false Ukrainian claim of its arsenal of Buk missiles. While much of this analysis has been vital and necessary in debunking such lies and establishing the narrative of July 17th, one does not need to look much further than the eyewitness accounts of the residents of the Donbass from July 17, 2014 to find the true cause of the downing of MH17.",2015-07-16,"MH17 In Their Own Words: Witness Testimonies on Social Media from July 17th, 2014"
2015,7,https://www.bellingcat.com/news/uk-and-europe/2015/07/16/russias-colin-powell-moment-how-the-russian-governments-mh17-lies-were-exposed/,/news/uk-and-europe/2015/07/16/russias-colin-powell-moment-how-the-russian-governments-mh17-lies-were-exposed/,"

In the year since the shooting down of Flight MH17 in Ukraine on July 17th 2014 there have been many different theories about who was responsible and the exact circumstances under which MH17 was shot down. For much of that time those theories have fallen into two broad categories, that either a separatists controlled Buk shot down MH17, or a Ukrainian military aircraft. Since the official criminal and Dutch Safety Board investigations have begun governments have generally avoided making any specific claims about who was responsible, but in the days after MH17 was shot down governments were making various claims. The US and Ukrainian governments both claimed a Buk missile was responsible, while on July 21st the Russian Ministry of Defence gave an hour long press conference where they presented their evidence of who could have been responsible for the attack.

The press conference covered four main claims:

That a video published by the Ukrainian Ministry of Interior showing a Buk in separatist controlled Luhansk was in fact filmed in government controlled territory in another town.

MH17 significantly changed course just before being shot down.

Radar imagery shows an aircraft close to MH17 shortly after it was shot down.

Satellite imagery shows Ukrainian Buk missile launchers operating on July 17th.

Since the July 21st press conference it has been possible to establish that all four claims were false, and in some cases involved the Russian Ministry of Defence producing faked evidence to support their claims.

The Luhansk Video

Following the downing of Flight MH17 the Ukrainian Ministry of Interior published a video that was filmed in the separatist controlled city of Luhansk, close to the Russian border with Ukraine, which they claimed showed a Buk, carrying three missiles instead of the usual four, heading towards the Russian border on the morning of July 18th.

In the Russian Ministry of Defence’s July 21st press conference they claimed that the video had in fact been filmed in a government controlled area:

For example, media circulated a video supposedly showing a Buk system being moved from Ukraine to Russia. This is clearly a fabrication. This video was made in the town of Krasnoarmeisk, as evidenced by the billboard you see in the background, advertising a car dealership at 34 Dnepropetrovsk Street. Krasnoarmeysk has been controlled by the Ukrainian military since May 11

To support this claim they provided an image of the billboard visible in the video, along with what they claimed the line of text read.

Unfortunately for the Russian Ministry of Defence it was possible to establish the true location the video was filmed using open source investigation techniques, which confirmed the exact location in separatist controlled Luhansk. This location was visited by a Luhansk local who took photographs of the area which both helped confirm the location, and what was written on the billboard.

Here it can be clearly seen that the text on the billboard is completely different from what the Russian Ministry of Defence claimed. This location was confirmed as being correct by journalists who visited the same location, including 60 Minutes Australia and Correctiv, who photographed a very specific piece of vandalism on the billboard.

MH17’s Significant Course Change

The Russian Ministry of Defence presented the following image during the press conference, claiming that Flight MH17 had been significantly diverted from its course:

The Russian Ministry of Defence stated that:

On the scheme you can see the international airway. The Boeing-777 was supposed to fly on this airway. Draw your attention to the fact that the aircraft followed inside the specified air-corridor to Donetsk, then it deviated from the route to north. Meanwhile the maximum distance from the left border of the air-corridor was 14 kilometers. Then we can see that the Boeing-777 turned back to the borders of the specified air-corridor. Nevertheless Malaysian aircrew didn’t succeed the maneuver. At 17.20 we entered the event of the aircraft rate reduction, at 17.23 the aircraft’s point blinked off on the radar. Why did the aircraft cross the border of the air-corridor? Was it the navigation mistake, or the aircrew followed the Dnepropetrovsk ground control orders? We will find the answers after “black boxes” and communication decoding

The preliminary Dutch Safety Board report did in fact answer the questions the Russian Ministry of Defence asked “after “black boxes” and communication decoding”. The Dutch Safety Board preliminary report in fact showed that MH17 had been on an entirely different course than the Russian Ministry of Defence had claimed, and had not changed course in the way described in the Russian Ministry of Defence imagery. A comparison of the Dutch Safety Board’s flight path and the Russian Ministry of Defence flight path can be seen below.

Again, we can clearly see that the Russian Ministry of Defence is making a claim that is simply untrue, and this is provable using publically available information.

Russia’s Radar Data

The Russian Ministry of Defence also presented radar data that showing Flight MH17, claiming “Russian system of air control detected the Ukrainian Air Force aircraft, purposed Su-25, moving upwards toward to the Malaysian Boeing-777. The distance between aircrafts was 3-5 kilometers.” Chief of Staff of the Air Force Lieutenant-General Igor Makushev was then invited to comment on the radar data.

“At 17.20 P.M. at the distance of 51 kilometers from the Russian Federation state boundary and the azimuth of 300 degrees the aircraft started to lose its speed obstructively which is quite distinctively to be seen on the table of the aircraft characteristics. At 17.21 35 seconds P.M. with the aircraft speed of 200 km/h at the point of the Boeing crash there is a new mark of the aircraft to be seen. The aircraft was steadily monitored by radar stations of Ust-Donetsk and Butirinskoe during 4 minutes period. Air control officer having enquired the characteristics of newly appeared aircraft couldn’t possibly get them because it is in all likelihood that the aircraft had no secondary deduction system amounted on it, which is put typically for military aircraft. The early detection of this aircraft appeared to be quite impossible because the air situation control is usually performed by radars working in a standby mode which detection possibilities at the given distance are over 5000 m altitude.

The detection of the aircraft turned out to be possible as the aircraft ascend it.”

However, radar experts were interviewed by a number of news organisations who gave a different opinion, with Dutch NOS news asking four experts to give their opinions. Comments included “it is really impossible for [it to be] a fighter”, “no aircraft was in the vicinity of flight MH17”, “it seems likely that the signals are the wreckage of MH17”, and “falling debris are the most likely explanation”. Again, another Russian claim that doesn’t stand up.

Russian Satellite Imagery

Russia also presented sets of satellite imagery showing three different locations, including two military bases and a field outside the town of Zaroshchens’ke. At one military base, the 1428, it was claimed images from July 14th and July 17th showed that a Buk missile launcher had moved from the base on July 17th.

However, it was possible for Bellingcat to purchase an image from the satellite company Digital Globe of the same location on July 17th, and compare that image to the images presented by the Russian Ministry of Defence. For example, large areas of vegetation visible in the July 14th Ministry of Defence images were absent from the July 17th Digital Globe image.

It was also possible to find historical satellite imagery of the same location from July 2nd and 21st of the same area on Google Earth, which confirms the vegetation had be cleared weeks before July 17th.

Patches of worn away grass visible in the Russian Ministry of Defence imagery were also absent in the Digital Globe July 17th imagery.

But, as with other discrepancies between the images, the patches of missing grass were visible in earlier historical imagery on Google Earth, clearly showing the Russian Ministry of Defence images were from weeks before MH17 was shot down.

More differences are detailed here, and images of the other areas also showed the dates provided by the Russian Ministry of Defence just didn’t match with publically available satellite imagery of the same areas around the same dates. In addition to that, the Zaroshchens’ke site, where the Russian Ministry of Defence claimed they detected two Ukrainian Buks, was under separatists control on July 17th and locals interviewed by Russian media stated no Buk missile launchers were in the area on that date, and no missiles were launched from the area.

It’s clear that not only did the Russian Ministry of Defence lie about evidence it presented on July 21st, but also presented fake evidence in attempt to place blame on Ukraine for the shooting down of Flight MH17. The July 21st press conference represents nearly all the information the Russian government has presented on MH17 to the public, and it’s clear that the Russian governments reaction to the murder of 298 people was to lie, produced fake evidence, and attempt to deceive the public, the global community, and the families of the 298 people murdered on July 17th 2014. The one big question that remains is whether the Russian government presented this information to the criminal investigation into the downing of Flight MH17.",2015-07-16,How the Russian Government's MH17 Lies Were Exposed
2015,7,https://www.bellingcat.com/news/uk-and-europe/2015/07/13/zaroshchenske-launch-site-claims-and-reality-a-bellingcat-investigation/,/news/uk-and-europe/2015/07/13/zaroshchenske-launch-site-claims-and-reality-a-bellingcat-investigation/," - A Bellingcat Investigation

This report (which can be found in its entirety here) analyzes in detail one aspect of the downing of Malaysia Airlines Flight 17 (MH17) by a Buk missile system in eastern Ukraine: the plausibility that Zaroshchens’ke was the launch site. First, the Russian Ministry of Defense (MoD) claimed in a press briefing on 21 July 2014 that Ukrainian Buk M1 TELARs (transporter erector launcher and radar) were positioned in an area south of Zaroshchens’ke. The Russian MoD supported this assertion with a satellite picture of the area showing the vehicles. While it was not explicitly stated that a missile was fired from this position in the briefing, the information is persistently interpreted as evidence of possible Ukrainian involvement in the downing of MH17.

Later, a larger area south of Zaroshchens’ke that included the Russian MoD’s Buk position was claimed to be the launch site of the Buk M1 missile that downed MH17. This claim stems from Almaz-Antey, the successor company of the original Buk M1 producer. Almaz-Antey’s analysis uses publicly available pictures of the wreckage of MH17 and is primarily based on a calculation of the missile’s last position using the impact direction of the warhead fragments. Almaz-Antey claimed that this method allowed them to identify the possible launch site using the trajectory profiles of the particular missile used.

This report assesses the validity of both the Russian MoD’s and Almaz-Antey’s claims using open-source information. In particular, the analysis utilizes maps showing the situation in eastern Ukraine and Google Earth satellite imagery. The satellite imagery is used to identify with varying degrees of certainty the locations of military positions in the area surrounding the alleged launch site. This information is then used to reconstruct the area under control on 17 July 2014, the day MH17 was shot down. This report also draws upon various press reports from the area.

Based on this report’s analysis of the aforementioned information, two conclusions are reached, namely, on 17 July 2014:

The area south of Zaroshchens’ke was not under Ukrainian control

There were no Ukrainian Buk M1 (TELARs) in the area identified by Almaz-Antey as the launch site

It is also possible to assess the likelihood of a missile launch from the area south of Zaroshchens’ke on 17 July 2014. While it is not possible to reject that claim completely, it can be concluded that:

It is highly unlikely that a missile was launched from the area south of Zaroshchens’ke on 17 July 2014

This assessment also provides additional evidence that the Russian MoD misinformed the general public in their 21 July 2014 briefing. The satellite image presented that claimed to show Ukrainian Buk M1 TELARs south of Zaroshchens’ke must be either a fabrication or a deliberately misinterpreted satellite photo meant to mislead or confuse the public.

The full report is available in English, German, and in Russian.",2015-07-13,Zaroshchens'ke Launch Site: Claims and Reality
2015,7,https://www.bellingcat.com/news/uk-and-europe/2015/07/11/geolocating-mh17-crash-videos-with-checkdesk/,/news/uk-and-europe/2015/07/11/geolocating-mh17-crash-videos-with-checkdesk/,"

In the wake of the downing of Flight MH17 in Ukraine on July 17th dozens of videos of the aftermath of the crash were uploaded to social media sites. In the days and weeks after July 17th it was possible to geolocate some of these videos, and ahead of the 1 year anniversary of the attack we are looking at some of those videos that weren’t geolocated in the hope of creating an interactive map showing the locations where these videos were filmed.

To participate in the geolocation of these videos visit Checkdesk where we will be posting a few videos at a time to geolocate.

The following are guides and other resources on verification:

Tools

Google Earth Pro – Now free.

Clip Converter – Video saving site.

Keepvid – Video saving site.

Tube Offline – Video saving site for videos from VK.com.

Archive.org – Site for archiving web pages.

VLC Media Player – A free and light weight media player with various useful tools and options.

Paint.Net – Free digital photo editing software.

Guides

A Beginner’s Guide to Geolocating Videos

Verification and Geolocation Tricks and Tips with Google Earth

Geolocation Techniques – Mapping Landmarks

Open Source Information in Conflict Zones

War and Pieces – Social Media Investigations

The Verification Handbook",2015-07-11,Geolocating MH17 Crash Videos with Checkdesk
2015,8,https://www.bellingcat.com/news/mena/2015/08/31/military-ramp-at-abu-dhabi-international-is-operational/,/news/mena/2015/08/31/military-ramp-at-abu-dhabi-international-is-operational/,"

Over the last decade, the UAE has improved its transport capabilities with the acquisition of some of America’s best strategic and tactical aircraft.

The latest satellite imagery acquired by DigitalGlobe shows a new operational military ramp dedicated to the country’s transport aircraft located on the north-eastern side of Abu Dhabi International.

The Directorate of Military Works Abu Dhabi commissioned the Dorsch Gruppe to construct the approximate 260,000 square meter apron, a parallel taxiway and maintenance hangar. According to work previously posted on the Dorsch Gruppe website, the hangar was built to support the C-17 and A330 MRTT — the latter imagery currently shows based at Al Ain. [1]

Space snapshots from July 2015 show seven Boeing C-17 Globemaster III, two Lockheed C-130 (one H variant, one J variant), 2 Casa CN-235 light transport and a DHC-6 Twin Otter. Previous imagery has shown up to five of the CN-235 and up to four C-130s parked on the apron.

Beyond transport, the Twin Otter is often associated with the UAE’s special forces Group 18 out of Sas al Nakhil. Along with the unit’s Cessna 208, the DHC-6 is used for reconnaissance missions.

In total, the UAE Air Force has six Globemaster III in its inventory which suggests the 7th pictured above is from one of the country’s allies. Currently, Australia, the U.K. and the U.S. routinely use the platform to ferry troops and supplies back and forth to regional conflicts.

In February, the UAE announced the order of two more C-17 which will bring their total inventory to eight. The order comes as Boeing plans to close the C-17 assembly by the end of the year.

In the meantime, deployments to the new area started in early 2015 — though major construction which began between late 2011 to early 2012, was already complete by 2013.

Note

[1] In 2013, the Dorsch Gruppe removed all work related to the UAE’s military from their website. The UAE is the company’s largest Middle East customer.",2015-08-31,Military Ramp At Abu Dhabi International Is Operational
2015,8,https://www.bellingcat.com/news/mena/2015/08/26/the-other-foreign-fighters/,/news/mena/2015/08/26/the-other-foreign-fighters/,"

An estimated 20,000 to 30,000 foreigners have traveled to Iraq and Syria to fight with the Islamic State (IS) and other Sunni jihadist groups. Of those, roughly 150 to 200 are American citizens. This report seeks to shed light on a related, yet understudied phenomenon, namely, that of Americans traveling to Iraq and Syria to fight against IS. While there have been a number of vignettes in the media highlighting particular Americans or groups of Americans who have traveled abroad to combat IS, this is the first systematic study, relying solely upon open source information, to provide a concrete understanding of not only the scale of the anti-IS American foreign fighters in Iraq and Syria, but also their backgrounds and motivations.

This report’s principal finding is that there have been at least 108 Americans who have volunteered to fight the Islamic State in Iraq and Syria between August 2014 and the beginning of August 2015. Other key findings include the following:

As of 13 August 2015, 70 of the Americans appear to still be abroad.

The Americans hail from at least 31 states across the US; more foreign fighters come from Texas than any other state.

More than two-thirds of the Americans have prior military experience.

With the exception of the Coast Guard, every branch of the US armed forces is represented among the Americans, with the Marine Corps and Army predominating.

The age range of the Americans is between 23 and 61; anecdotally, the Americans appear to be in their 20s and 30s on average.

Ranging from software engineers to surf instructors, there is no one-size-fits-all occupation or career field – other than military service – that characterizes the Americans.

The three primary groups that the Americans join are – in order of popularity – the YPG, PUK Peshmerga, and Dwekh Nawsha.

A wide range of motivations inspire the Americans to fight IS, not the least of which is a sense that something needed to be done in the face of IS’s continuing barbarity.

The report can be found in its entirety here.",2015-08-26,The Other Foreign Fighters: An Open-Source Investigation into American Volunteers Fighting the Islamic State
2015,8,https://www.bellingcat.com/news/rest-of-world/2015/08/23/satellite-imagery-captures-chinas-divine-eagle-uav/,/news/rest-of-world/2015/08/23/satellite-imagery-captures-chinas-divine-eagle-uav/,"

China’s enormous Divine Eagle UAV is larger than the U.S. Air Force’s Global Hawk, recently released satellite imagery suggests.

While China’s UAVs are getting better, if not bigger, little is known about one of its latest models.

Photos of China’s mysterious UAV appeared in May and June while a concept of operations along with payload specs was released earlier in February.

The Divine Eagle (or Shen Diao) is built by the Shenyang Aircraft Corporation’s 601 Institute and will operate as a high altitude long endurance surveillance drone helping defend China’s airspace against would-be adversaries.

China’s concept of operations suggests the drone will provide early warning against enemy aircraft and support the battle management mission directing friendly targeting of enemy carrier groups.

A recent space snapshot acquired by DigitalGlobe shows the twin-fuselage, single-engine drone parked on the south end of Shenyang’s runway, possibly indicative of pre-post flight activity.

Although, the activity could also suggest taxi trials, it was rumored that the aircraft’s first test flight occurred sometime in December, according to Chinese internet sources.

Imagery also confirmed details about the drone’s specific characteristics. Measurements taken in Google Earth would indicate a wingspan and length of approximately 40 and 15 meters, respectively.

With its large size and aft-mounted high aspect ratio wings, it’s suspected to have a take off weight over 15 tons, which would be larger than the Global Hawk, just over 14.5 tons.

Though little else can be confirmed, payload specs released in February of a similar variant appeared to suggest a variety of surveillance and targeting capabilities.

The graphic identified at least 5 radars integrated into the airframe including a 160 degree forward-looking X/UHF AMTI AESA radar, two 120 degree side-looking X/UHF AMTI/SAR/GMTI AESA and two rear-looking X/UHF AMTI AESA covering 152 degrees.

In other words, the drone’s radars provide 360-degree coverage, identifying targets regardless of weather conditions and stealth characteristics.

Assuming the specs are correct, the Divine Eagle would represent a serious step forward for Chinese unmanned capabilities potentially bolstering China’s A2/D2 strategy.

It’s this type of platform that would not only extend the reach of the country’s situation awareness but also help collect targeting information beyond the first island chain. Similarly in 2013, China began using UAVs to watch over the East China Sea with a previously renovated airfield.

Given China’s recent runway construction in the disputed Spratleys, it’s possible this drone may one day be deployed to watch over activity in the South China Sea.",2015-08-23,Satellite Imagery Captures China’s Divine Eagle UAV at Shenyang
2015,8,https://www.bellingcat.com/news/2015/08/22/rastreando-relojes-suizos-en-sinaloa-las-6-marcas-mas-populares-entre-los-narcotraficantes-mexicanos/,/news/2015/08/22/rastreando-relojes-suizos-en-sinaloa-las-6-marcas-mas-populares-entre-los-narcotraficantes-mexicanos/,"

François Pilet (L’Hebdo) and Aliaume Leroy. English to Spanish by Diego Recinos .

For the article in English

In the old days, discretion was the rule to follow for drug kingpins in Mexico. Take the example of Joaquin “El Chapo” Guzman, known as “the world ‘s most powerful trafficker.” The 60 year old man appears only in a few shots. He does not need to cultivate his fame, especially after his last escape to MacGyver style of a Mexican maximum security prison, which attracted worldwide coverage of the media.

The rules have begun to change with the emergence of social networks and a new generation of drug traffickers. This new group of young capos loves bragging on Twitter, Facebook and Instagram, showing his ostentatious life styles as if they were football stars.

Drug trafficking in Mexico has become public and conspicuous for two reasons.

First, the drug cartels have gained so much power that show no fear of facing or being dismantled by Mexican security forces. These organizations have infiltrated most, if not all state levels. The recent escape of Chapo, for example, which is rumored that was orchestrated and used by the Mexican government to let it go, shows the omnipotence of the Sinaloa Cartel.

Second, in times of economic difficulty, the extravagant lives of drug barons, they are attractive to the millions of young and poor in Mexico abandoned by the state, which has failed to restore peace and security under the leadership of Felipe Calderon and Enrique Peña Nieto .

In their profiles of social networks, modern drug traffickers published photographs of their aircraft, drugs, luxury cars, women, covered gold weapons, luxury homes and Swiss watches.

Twenty-five years after Pablo Escobar and his gold Rolex, Swiss watches remain as the most popular symbol of wealth among narcos in 2015. They apparently look very rare limited editions worth hundreds of thousands of euros as well as editions economic.

To better understand the scope of Swiss luxury brands among Mexican capos, we have analyzed the profiles of three senior members of the Sinaloa Cartel in social networks: Ivan and Alfredo Guzman, two of the children with greater influence of The Chapo Guzman, and Jose Rodrigo Arechiga-Gamboa, alias “El Chino anthrax”, who was a rising star of your organization-leader of the violent cartel called “the anthrax” -before his arrest in the Netherlands at the request of US authorities end of 2013.

Here are the 6 marks favorite Swiss watch luxury appearing in their profiles-classified by the number of models by brand and overall value.

Fonts and background are described at the end. Not all models were included due to problems with identification (poor quality photos, etc) and clarity.

FIX: As you can see below, some of the tweets along with the images were removed from an account after the publication of this article. However, we have retained links and original photos.

1. Richard Mille

The small mark of Les Breuleux, in the Swiss Jura mountains, was founded in 1999 by French entrepreneur Richard Mille. This brand has won first place in our rankings with five appearances with a total of 1,098 million euros. (It is worth noting that the brand Richard Mille made headlines recently when Dmitry Peskov, spokesman for Vladimir Putin, was photographed using a model of $ 620,000, raising questions about his wealth).

– From izquierdia to right: Richard Mille Tourbillon RM 59-01 Yohan Blake limited edition (only 50 pieces), 648,000 euros. Richard Mille RM 011 Felipe Massa Flyback Rose Gold Chronograph, EUR 100 000. Richard Mille RM 055 Bubba Watson, EUR 105 000. Richard Mille RM 011 Flyback Chronograph Black Phantom, 140 000 euros:

Without knowing which put pic.twitter.com/XVVYF7HKVE

– Ivan Guzman (@Ivan_Guzman_) June 10, 2014

– Left: Richard Mille RM 055 Bubba Watson, EUR 105 000. Right: Audemars Piguet (see the next section about this mark):



2. Hublot

Although it was originally created in the 80s , Hublot only managed to jump to fame after Jean-Claude Biver took over management section in 2003. Mexico is a favorite mercador Hublot. The brand has two stores and is associated with 34 distributors, more than in the UK (29 distributors) and even China (14 distributors). The CEO of TAG Heuer, one of the owners of Hublot, is not surprised by the success of its brand among drug kingpins, “If you prefer a Lamborghini on a Bentley and rap about classical music, then you will like our watches. “Hublot has won the second place with five points valued at 554,400 euros.

– Hublot King Power Miami 305 Limited Edition (10 pieces), EUR 435 000:

– Hublot Big Bang 41mm Steel Pavé Diamonds 114, EUR 21 500:



– Hublot King Power Unico King Gold Pavé, 53,100 euros:



– Hublot Big Bang Gold Ceramic 44mm, 27 700 euros:

-Hublot Big Bang 44mm Steel Diamonds, 17,100 euros:

For a while …. very good day pic.twitter.com/xzZR7QodFJ?✌️

– Ivan Guzman (@Ivan_Guzman_) June 23, 2014

3. Rolex

Rolex is among the most powerful brands in the world. It is the only Swiss brand whose products have reached the wrists of two generations of the capos of the most notorious drug in the world, from Pablo Escobar to Guzman. With six watches, Rolex Hublot has more appearances, but its value is below and amounts to only 118,750 euros.

– Rolex Oyster Day-Date 36mm Yellow Gold, 19 350 euros:

That they may walk to throw pic.twitter.com/zu60ln0EPW??✌️??

– Ivan Guzman (@Ivan_Guzman_) September 2, 2014

– Rolex Oyster GMT-Master II 40mm Steel and Yellow Gold 18 Carat, 11,300 euros:

– Left: Rolex Yacht Master II 44mm, 21,950 euros. Right: Rolex Oyster GMT-Master II 40mm Steel and Yellow Gold 18 Carat, 11,300 euros:



– Left: Rolex Daytona Cosmograph Steel and Yellow Gold, 14,650 euros. Right: Rolex Sky-Dweller Oyster 42mm Yellow Gold 18 Carat, 40 200 euros:



4. Audemars Piguet

Audemars Piguet was founded in 1875. Based in Le Brassus, in the Canton of Vaud, it is one of the oldest manufacturers of watches and is still under possession of creative family . Only two appearances, Audemars Piguet is ranked in fourth place. However, the value of the two clocks is very high, 360 200 euros combined.

– Audemars Piguet Royal Oak Concept Carbone, 309,600 euros (see picture section Richard Mille).

– Audemars Piguet Royal Oak 18 Carat Pink Gold, 50,600 euros:

Muy buenos dias plebes =) pic.twitter.com/bJIvPDmZht — Alfredo Guzmán (@AlfreditoGuzma) January 9, 2015

5. Romain Jerome

Romain Jerome is a new name among manufacturers of Swiss watches, but this model showing the Chinese dating back several years.

– Romain Jerome Titanic Chrono Red Gold Limited Edition (2012 pieces)

32 700 euros.

With only one model each, the Urwerk and Romain Jerome brands are positioned in the fifth and sixth respectively.

References and Background

Our conclusions emerge from the analysis of different social networking accounts belonging to the former leader of the armed wing of the Sinaloa Cartel called “The anthrax” Jose Rodrigo Arechiga Gamboa (35 years old) aka “El Chino anthrax.” He was arrested, as part of Operation Narco Polo of the Drug Enforcement Administration (DEA), to disembark from the flight KLM 686 from Mexico City to Amsterdam Schiphol Airport in December 2013. the Chinese was caught using a false identity with the name of Norberto Sicairos-García. His capture approach significantly to the DEA, Interpol and other law enforcement agencies to its main objective of the 2014 catch “El Chapo”. The capture also caused the death of the alleged girlfriend Chino, Yuriana Castillo Torres, who was kidnapped and then found dead on a street in Culiacan . The Chinese, extradited and charged with trafficking marijuana and cocaine to the United States, pleaded guilty in May this year . We also investigated the profiles of the two sons of “El Chapo” Ivan Archivaldo Guzman-Salazar (32 years old) aka “El Chapito” and Jesus Alfredo Guzman-Salazar (29 years old) aka “El Gordo , ” who also they are sought by US justice. The objects of our research were not chosen randomly. The Chinese and the two sons of Chapo have thousands fans and followers on social networks. Here is a list of your profiles-we could not verify its authenticity-with the number of followers or “likes” in parentheses:

Jose Rodrigo Arechiga-Gamboa, “El Chino anthrax” (135 000 fans in total):

https://instagram.com/miauuuu5_7/ (58 000) https://twitter.com/comandante57 (39 000) https://twitter.com/Miauuu5_7 (1000) https://www.facebook.com/ pages / CHINESE-Anthrax / 1580417675517056? fref = ts (13 000) https://www.facebook.com/pages/Chino-antrax/1423206714617137?fref=ts (10 000) https://www.facebook.com/ pages / Chinese-Anthrax / 1488585071414812? fref = ts (8000) https://www.facebook.com/pages/Chino-antrax/647502882031840?fref=ts (6000)

Ivan Archivaldo Guzman-Salazar, “El Chapito” (325,000 followers in total):

https://twitter.com/lvanArchivaIdo (192 000) https://twitter.com/_IvanGuzman (88 000) https://twitter.com/Ivan_Guzman (21 000) https://www.facebook.com/pages / Ivan-Archivaldo-Guzman / 1579988752275513 fref = ts? (18 000) https://www.facebook.com/pages/Ivan-Archivaldo-Guzman/503433706472751?fref=ts (5000) https: //www.facebook .com / pages / Iv% C3% A1n-Guzm% C3% A1n / 119074448433670? fref = ts (1000)

Jesus Alfredo Guzman-Salazar, “El Gordo” (330,000 fans in total):

https://twitter.com/_alfredoguzman (192 000) https://twitter.com/AlfreditoGuzma/media (138 000)

Note: The image presented at the beginning of the article shows the Chinese anthrax with a Kalashnikov covered in gold. On his left wrist, he wears a Cartier Pasha Miss , 18 800 euros.",2015-08-22,Rastreando Relojes Suizos en Sinaloa: Las 5 Marcas Más Populares Entre Los Narcotraficantes Mexicanos
2015,8,https://www.bellingcat.com/news/mena/2015/08/21/hell-cannons-from-minor-nuisance-to-major-threat-the-evolution-of-syrian-opposition-siege-artillery/,/news/mena/2015/08/21/hell-cannons-from-minor-nuisance-to-major-threat-the-evolution-of-syrian-opposition-siege-artillery/,"

When historians discuss defensive capabilities in conventional wars between two major powers, traditionally each power tends to have either domestic arms manufacturing or has secured the services of another nation (or nations) to do most of the heavy lifting for their defense needs. For the Syrian regime, it is a mix of the two, with most ammunition being domestically produced by EID (Etablissement Industrial de la Defence) in Damascus, and nearly everything else is typically supplied by Russia or former Soviet bloc countries, though there is an increasing reliance on Iran as an arms supplier. In contrast, the opposition lacks both domestic conventional arms manufacturing capabilities and a formal arms supplier, making them reliant on other sources, including what benefactors deliver to them, what they can purchase on black market, and what they can manufacture themselves. In past civil wars, this has led to all sorts of domestic cottage industries (such as steel mills making cannon balls, foundries turned into cannon producing plants, chemical industries repurposed to make gun powder, etc.). However, in the 21st century the overwhelming use of modern weaponry and methods of warfare has meant that an opposition force without a major sponsor is at a decided disadvantage. As a result, the Syrian opposition has turned towards home brewed weapons that are not as effective as factory produced ones but that can still pack a punch.

A rudimentary Hell Cannon fires in Aleppo, Syria.

When discussing historic homemade weapons, many of them have typically fallen short of the capabilities granted by mass produced weaponry. The molotov cocktail is capable of causing serious damage to armored vehicles but requires the user be incredibly close to the vehicle, all while risking life and limb to get a lucky bottle or two onto the vehicle. IEDs and double stacked mines provide a powerful anti-vehicle and anti-personnel weapons, but they are only as useful as the opposition’s ability to emplace them near routes of transport for the enemy force. With combat lines of Syrian cities often being fairly static, the opportunities for emplacing such weapons are increasingly less practical, particularly when the opposition is concerned about the two-way threat posed by victim operated IEDs (those triggered by the intended victims) and the potential for collateral damages. Syria’s siege oriented style of warfare, punctuated with brief surges of intense violence, has led to the reemergence of static warfare methods that are often absent from modern combat. Syria has seen not only the widespread use of bulldozers and earth moving equipment to establish redundant berms and trenches around hundreds, if not thousands, of defensive positions around the country, and tunnels both for resupply and transport of troops as well as for sappers to emplace explosives,but also the serious fortification of apartment blocks into veritable concrete and sandbag fortresses. But perhaps nothing embodies this siege environment better than the advent of homebrewed shock artillery almost mass produced by the opposition groups in Syria. The Hell Cannon of 2012/2013, initially a weapon of desperation, has both become and remains a mainstay of the opposition’s arsenal and an increasingly lethal threat in Syrian opposition military offensives. In the next few hundred words we will cover down on what exactly the Hell Cannons are, how they are produced, and what they are capable of.

Infographic from Ahrar al-Shamal on their first Hell Cannon

a basic infographic on the design of the initial weapon (translation available here ). The basic design involves heavy vehicle tires for transport/shock absorption, “feet” to plant the weapon in place and prevent it from recoiling backwards violently when firing, a pipe/barrel upon which the projectile is placed with the rod through which the propellant is expelled being inserted directly into the barrel to propel the round forward. This differentiates it from the more common Hell Cannons seen today where the entire projectile is inserted into the barrel. After ignition the round is propelled forward with distance being determined by how much propellant (and what kind of propellant) is supplied. Range correction is made by altering the angle of the cannon and changing the amount of propellant. Ignition can be either manually by lighting a fuse or from a standoff distance with electronic ignition by way of car battery and wires. Appearing initially in Idlib province, as early as 2012 (disputable- the first reports don’t appear about it until 2013) with the group Liwa Ahrar al-Shamal part of Liwa al-Tawhid (itself a part of the FSA and the SRCC). The group releasedon the design of the initial weapon (translation available). The basic design involves heavy vehicle tires for transport/shock absorption, “feet” to plant the weapon in place and prevent it from recoiling backwards violently when firing, a pipe/barrel upon which the projectile is placed with the rod through which the propellant is expelled being inserted directly into the barrel to propel the round forward. This differentiates it from the more common Hell Cannons seen today where the entire projectile is inserted into the barrel. After ignition the round is propelled forward with distance being determined by how much propellant (and what kind of propellant) is supplied. Range correction is made by altering the angle of the cannon and changing the amount of propellant. Ignition can be either manually by lighting a fuse or from a standoff distance withby way of car battery and wires.

Multi-barreled Hell Cannon mounted on an earth-mover/front end loader

complicated aiming and firing mechanisms, others literally just tubes think enough to absorb the recoil of the firing aimed crudely in the direction of the area intended for bombardment, like this quad-barreled hell cannon mounted on a bulldozer by al-Jabhat al-Shamiyah (adopted elsewhere in a slightly more refined bulldozer design ). After catching on in Idlib, Hell Cannon design spread to Aleppo when (the now defunct) Katai’b Shuhada Badr (Martyrs of Badr Brigades – no relation to Iraqi Shi’a militia the Badr Brigades) picked up the design and began to produce it locally. Gradually the initial design spread and regional restraints or improvisation led to significant variety of Hell Cannons, some very complex with, others literally just tubes think enough to absorb the recoil of the firing aimed crudely in the direction of the area intended for bombardment, like thisby al-Jabhat al-Shamiyah (adopted elsewhere in a).

A Hell Cannon under construction by Ahrar al-Shamal

seven minute promotional video . Produced in several shops with a plethora of machine tools and pre-existing parts, this is one of the best examples of non-conventional weapons being produced by non-state actors in Syria. In areas where less expertise or less equipment is available cruder examples tend to emerge and conversely more complex models have shown up elsewhere in Syria (additional construction photo here ). All a basic hell cannon needs is a tube larger than the munition and some means of angling towards its target. More complex models have legs to stabilize the cannon for greater accuracy (and prevent it from jumping out of place , recoil springs for the same purpose, traverse and elevation mechanisms for aiming, a platform for the gunner to stand on to load larger cannons, and a variety of other improvements. Projectiles themselves are produced, usually, by taking an empty metal canister (most commonly a propane canister), welding together the canister and the guidance assembly, filling the canister with explosives, and attaching a fuse (detailed more below). Explosives can be homemade by way of common chemicals used to build explosive material, harvested from unexploded barrel bombs, land mines, or other unfired explosives, or even be repurposed intact explosives themselves (also detailed more below). Footage of the manufacture of either the cannons or the projectiles is fairly limited but at least a few videos and still photos have come out. The best example comes from the inventors of the Hell Cannon, detailing most steps of the process to build theirs in a. Produced in several shops with a plethora of machine tools and pre-existing parts, this is one of the best examples of non-conventional weapons being produced by non-state actors in Syria. In areas where less expertise or less equipment is available cruder examples tend to emerge and conversely more complex models have shown up elsewhere in Syria (additional construction photo). All a basic hell cannon needs is a tube larger than the munition and some means of angling towards its target. More complex models haveto stabilize the cannon for greater accuracy (and prevent it from, recoil springs for the same purpose, traverse and elevation mechanisms for aiming,to load larger cannons, and a variety of other improvements. Projectiles themselves are produced, usually, by taking an empty metal canister (most commonly a propane canister), welding together the canister and the guidance assembly, filling the canister with explosives, and attaching a fuse (detailed more below). Explosives can be homemade by way of common chemicals used to build explosive material, harvested from unexploded, land mines, or other unfired explosives, or even bethemselves (also detailed more below).

After being filled with explosives, rudimentary fuses are installed in Hell Cannon projectiles

initial design with stabilizing fins on the warhead itself, more modern variants of the same design with stabilizing fins placed closer to the base of the weapon along narrow vanes , and perhaps most common today is the kind inserted completely inside the Hell Cannon with a single rod centered on the bottom of the canister and stabilizing fins located at the bottom , helping keep the round oriented in the same direction upon firing and preventing tumbling. Other varieties include larger oxygen cylinders with fins welded to them and “Thunder Cannon” shells which are once-fired tank shells with the mouth of the casings welded shut/ filled with explosives and a rocket motor placed on the base of the shell (video available here ). Sometimes existing explosive munitions such two stage artillery rounds (those lacking their own propellant) are repurposed to become projectiles again as hell cannon rounds. Undoubtedly as the war continues on and new ideas are thought up there will be even more varieties of Hell Cannons and their munitions. The variety in launcher design is matched equally by the variety in munitions themselves, but the vast majority of munitions appear to be built using the very common propane cylinders used for heating and cooking, with propulsion, detonation, and guidance varying from round to round. Among the most common are those placed atop the barrel like thewith stabilizing fins on the warhead itself, more modern variants of the same design with stabilizing fins placed, and perhaps most common today is the kind inserted completely inside the Hell Cannon with a, helping keep the round oriented in the same direction upon firing and preventing tumbling. Other varieties include largerand “Thunder Cannon” shells which are once-fired tank shells with the mouth of the casings welded shut/ filled with explosives and a rocket motor placed on the base of the shell (video available). Sometimes existing explosive munitions such two stage artillery rounds (those lacking their own propellant) are. Undoubtedly as the war continues on and new ideas are thought up there will be even more varieties of Hell Cannons and their munitions.

Jabhat al-Nusra displays double impact fused hell cannon projectiles used in the shelling of Fu’ah in Idlib governorate

do not explode immediately after landing taking as long as 15-20 seconds after landing before exploding. Initial confusion about what was causing this led to competing theories of what led to the delay before explosion. Further video and pictorial evidence (follow on image here) indicates these homemade delayed action fuses are really just a timed fuse, that is lit prior to launch, burning down. Depending on the length of the fuse and the time of flight the fuse will have so many seconds left before exploding. In a 200 Hell Cannon strike compilation provided by reddit user /u/purpleolive, dozens of examples of these delayed action fuses can be observed as Hell Cannon rounds slam into building walls and rooftops, penetrating and exploding inside to much greater effect. The delayed impact fuses are desirable for static targets where the aim is to destroy a structure, but when immediate detonation is required impact fuses are required. To this end a variety of innovative means have been employed in Syria from repurposing conventional mortar or rocket impact fuses and attaching them to Hell Cannon projectiles. Initial rounds used a single impact fuse but gradually began switching to two fuse like these from Jabhat al-Nusra and (video of them being installed here ) and occasionally three fused variants appear. While not certain, it is likely that the shift to multiple impact fuses is to ensure that the round does not strike at an angle (either because of tumbling or simple a bad strike trajectory) and fail to detonate. Each style of fuse serves a function though it is likely that the availability of material to produce one fuse or another is the driving factor behind the selection for each rounds. Having covered a number of different cannons and their projectiles, it’s perhaps important to discuss how these munitions are detonated. One of the first things one notices when watching Hell Cannon strikes is that quite a few of them taking as long as 15-20 seconds after landing before exploding. Initial confusion about what was causing this led to competing theories of what led to the delay before explosion. Further video and (follow on image) indicates these homemade delayed action fuses are really just a timed fuse, that is lit prior to launch, burning down. Depending on the length of the fuse and the time of flight the fuse will have so many seconds left before exploding. In a 200 Hell Cannon strike compilation provided by reddit user, dozens of examples of these delayed action fuses can be observed as Hell Cannon rounds slam into building walls and rooftops, penetrating and exploding inside to much greater effect. The delayed impact fuses are desirable for static targets where the aim is to destroy a structure, but when immediate detonation is required impact fuses are required. To this end a variety of innovative means have been employed in Syria from repurposing conventional mortar or rocket impact fuses and attaching them to Hell Cannon projectiles. Initial rounds used a but gradually began switching tolike these from Jabhat al-Nusra and (video of them being installed) and occasionally three fused variants appear. While not certain, it is likely that the shift to multiple impact fuses is to ensure that the round does not strike at an angle (either because of tumbling or simple a bad strike trajectory) and fail to detonate. Each style of fuse serves a function though it is likely that the availability of material to produce one fuse or another is the driving factor behind the selection for each rounds.

An FSA unit’s Hell Cannon demonstrating an electronically ignited variant. Not the retractable wheels that allow for the entire weigh of the system to rest on the ground reducing rearward recoil and adding to potential accuracy.

that is ignited from the breach while an unknown FSA group displays their Hell Cannon variant utilizing electronic ignition. The volatile nature of handling explosives leaves little margin for error with the manually ignited methods means that accidents occur when the munition doesn’t go off when expected. The munition is ignited by three different methods known thusfar: 1) ignition at the base or “breach” of the barrel, 2) prior to insertion into the barrel, 3) or most rarely by electronic ignition. A Southern Storm unit in Daraa, Katai’b al-Handasiyah wa al-Sawareekh demonstrates an oversized Hell Cannon while an unknown FSA group displays their Hell Cannon variant utilizing. The volatile nature of handling explosives leaves little margin for error with the manually ignited methods means thatwhen the munition doesn’t go off when expected.

Fateh Haleb coalition member launch a simultaneous lateral barrage of Hell Cannon projectiles on ISIL positions in northern Aleppo

fired through a window in close proximity to the gunners (also a good example of delayed fuse). Like the game Pocket Tanks accuracy and range with Hell Cannons comes down to two major considerations: the angle of fire and the amount of propellant provided. An experienced gunner will have a rough idea what angle and how much propellant to use to get it to a general area, modifying those variables after observing the impact to make follow on shots more accurate. Use of levels, topographic/satellite maps, calculators and computer mathematical programs significantly improves this accuracy if precision fire is desired. A common critique of Hell Cannons is their use in indiscriminate shelling of a given area and the civilian casualties that occur. This is largely dependent on the end user and their purpose in shelling as it has been repeatedly demonstrated that rough estimates of trajectory and range can be calculated, so repeated shelling of civilian areas is largely the choice of the operator, particularly when the impacts can be observed. At closer range accuracy is often quite achievable with repeatable only meters apart from each other, giving some Hell Cannons similar accuracy to infantry mortars and allowing for the suppression of very close range targets. Volley fired batteries of Hell Cannons recently achieved a 100-150m lateral suppression with impacts only meters apart with near simultaneous firing of Hell Cannons on ISIL positions in Aleppo demonstrating the relative accuracy at close range even when fired in groups. Accuracy and range will be different for cannon, munition type, consistency of propellant type, and the crew gunning it. Numbers as high as 1500 meters have been quoted and rough distance estimation from videos confirms this as feasible. When low charges are provided hell cannons can hit targets only a few hundred meters away with significant accuracy, like this shot of a Hell Cannon round being(also a good example of delayed fuse). Like the gameaccuracy and range with Hell Cannons comes down to two major considerations: the angle of fire and the amount of propellant provided. An experienced gunner will have a rough idea what angle and how much propellant to use to get it to a general area, modifying those variables after observing the impact to make follow on shots more accurate. Use of levels, topographic/satellite maps, calculators and computer mathematical programs significantly improves this accuracy if precision fire is desired. A common critique of Hell Cannons is their use in indiscriminate shelling of a given area and the civilian casualties that occur. This is largely dependent on the end user and their purpose in shelling as it has been repeatedly demonstrated that rough estimates of trajectory and range can be calculated, so repeated shelling of civilian areas is largely the choice of the operator, particularly when the impacts can be observed. At closer range accuracy is often quite achievable with repeatable only meters apart from each other, giving some Hell Cannons similar accuracy to infantry mortars and allowing for the suppression of very close range targets. Volley fired batteries of Hell Cannons recently achieved a 100-150m lateral suppression with impacts only meters apart withon ISIL positions in Aleppo demonstrating the relative accuracy at close range even when fired in groups.

Very basic model Hell Cannon fires a projectile. Note the platform for loading, weight placed to keep the cannon steady and rocks placed behind the wheel to keep it from moving

In conclusion, Hell Cannons are not the first nor the last variant jury-rigged or non-conventional weapons of war, but in a conflict where progress is often measured in meters not miles, the proliferation of homemade siege artillery by non-state actors has grown from laughably crude and ineffective to massively widespread and capable of massive destruction. Lacking an air force to deliver the raw destructive power of the government’s barrel bombs, the opposition has reacted by inventing it’s own weapons of terror, albeit smaller and far more controllable, spreading quickly throughout opposition arsenals. Hell Cannons emerged initially as a small project of a single group, used to shell a hostile area and have grown to become as versatile and widely used as any other piece of artillery or indirect fire weapon used in the Syrian conflict, presenting a serious threat for Syrian military forces to confront and defeat.",2015-08-21,The Evolution of Syrian Opposition Siege Artillery
2015,8,https://www.bellingcat.com/news/mena/2015/08/20/8_21chemicaltrail/,/news/mena/2015/08/20/8_21chemicaltrail/,"

The purpose of this post is to detail the various investigations I undertook between 21 August 2013 and the end of the year.

As Brown Moses’ first commentator on chemical weapons, I was immediately involved in the investigation of events in Ghouta in August 2013. Early on in the process, a natural division of labour was laid out between myself and Eliot Higgins. Eliot and others were focussing on the weapon system used and the geography and geometry of the attacks. I was focussing on the chemical weapon aspects – what was the substance used, and what can we tell about the perpetrators, if anything, based on the information available.

The First Few Days:

The immediate aftermath of the chemical attacks left us with a variety of confusing information to process. The nature of the attack was not obvious to us, nor was the diagnosis of nerve agent poisoning clear. The vast majority of the information available during and after the incident consisted principally of videos, and the limitations of video analysis of a chemical event became clear. While many people jumped immediately to the (eventually correct) conclusion that Sarin was the causative agent, I myself was not firmly convinced based on the available evidence, and numerous alternative explanations were circulating. This paper (DK 26 Aug PDF and weblink ) was one of my first attempts to analyse the data available at the time. Further thoughts and considerations are in this papers (Kaszeta early Sep 2013 PDF and weblink)

One thing that became quite clear was that many people knew little or nothing about the admittedly niche subject of chemical warfare forensics. Amateur efforts to collect evidence were evidently occurring and many members of the media were interviewing me about how one goes about conducting an investigation of this nature. I wrote a paper on chemical warfare forensics (CW Forensics PDF and weblink here) to help remediate this gap in knowledge.

The UN Report:

The deployment of a joint OPCW/WHO team to Damascus to collect evidence provided a wide variety of useful information. An interim report was issued in mid September that provided some useful information, but which was lacking in some essential details. My reaction to that report is detailed here: DK Initial UN Report PDF and weblink.

A key finding of this report is that Sarin was definitively the causative agent for the chemical casualties. Sarin and Sarin-specific degradation products were found in environmental samples.

My paper raised many questions and I was asked by numerous people to look into various aspects of the report. I did so and prepared another paper in the form of an FAQ: FAQ on UN report PDF and weblink. Keen observers will note that, at this time, I had not yet discovered the role of hexamine in this interesting puzzle.

Estimating the size of the Attack:

The OPCW had definitively identified the chemical warfare agent as Sarin. But how much had been used. In this article entitled “Managing The Deficit” in CBRNe World Magazine (link here) I attempt to calculate, using old Cold War-era offensive target analysis methods, a rough estimate of the size of the attack. I estimated, rather crudely given the method, that about 1000 kg of Sarin was used.

Further Details from the UN and OPCW

In November 2013, the role of hexamine in this story became more interesting. The OPCW released an expression of interest document for contracting purposes that happened to contain an inventory of chemicals from the Syrian offensive chemical weapons production program. (It is here if you are interested.)

In response to conspiracy theories mooted by Seymour Hersh, I wrote this piece in NOW Lebanon, which is a good summary of the evidence up to that point in time. This article is my first public speculation on the use of hexamine as a necessary acid reducer in the production of Sarin. The astute journalists at the New York Times picked up on this in this article. Incidentally, this is the exact point in time that numerous episodes of trolling against me started.

An additional version of the UN/OPCW report was released, a more full-bodied document with interesting details. My reaction to this report is found here: Reaction to Dec 2013 UN Report PDF and weblink.

By the end of 2013, I was convinced that Sarin was the causative agent, that hexamine had been used in the manufacturing process, and that hexamine was one of a number of factors that linked the Assad government’s forces to the 8/21 attack.

2014 lead to more interesting developments, but I will leave them for a later post.

Further information and articles are available at my website: http://strongpointsecurity.co.uk/resources/syria/

A table of physical characteristics of Sarin is located here.",2015-08-20,Reviewing the Sarin Attacks: The Chemical Trail from 8/21 to the End of the Year.
2015,8,https://www.bellingcat.com/news/uk-and-europe/2015/08/13/billy-six-interview-investigating-the-luhansk-mh17-buk-video/,/news/uk-and-europe/2015/08/13/billy-six-interview-investigating-the-luhansk-mh17-buk-video/,"

Freelance journalist Billy Six has recently come to the attention of the world’s media after publishing previously unpublished footage of the MH17 crash site filmed shortly after impact, as well as featuring in Russia Today’s recent MH17 documentary. In this interview with Bellingcat, Billy Six details some of his other investigations into the events surrounding the downing of Flight MH17.

Can you start with your thoughts on the debate over MH17?

Unfortunately public discussion on crash of Malaysian Airlines airliner on 17th of July 2014 has left its rational pathway. There are too many false stories distributed. I´m distressed that the public at large seems to lose interest due to confusion.

You’ve been to Ukraine yourself investigating the circumstances around MH17, including the video filmed in Lunhansk. Can you tell us about that?

Yes, I´m ready to confirm what I know about the famous 14 seconds video which shows a BUK missile launcher on a truck trailer – with at least one missile missing.

As you know Russian officer lieutenant Andriy Kartapolov gave a speech on 21st of July 2014, saying that the car billboard which is visible in the video shows “Dnipropetrovsk Street number 34” in Krasnoarmiisk town as address of car showroom.

And you visited the street itself?

I went there on 14th and 15th of December 2014 to check that place. Indeed there was a car dealer in Dnipropetrovsk Street number 34, but its chief Mr. Jura B. told me that this poster doesn´t belong to him. He didn´t know how to comment on the fact that Russian government announced something different. But he answered that there hasn´t been any state authority or journalist asking him before about this story. He echoed it to me via e-mail on 31st of July 2015. It seems in Ukraine this information was never taken seriously.

Did you speak to other people in the area?

All people in the streets of Krasnoarmiisk who I asked told me this place wouldn´t be Krasnoarmiisk, although some confirmed to have seen Ukrainian BUK launching systems passing in Krasnoarmiisk and neighbouring Dimitrov.

Do you look for anything else in Krasnoarmiisk?

On the internet Gorky Street number 49 was claimed to be that place in the video (see here) – but I didn´t find any hint for that. Shop owner at this place didn´t do either. That place looks completely different. Furthermore Krasnoarmiisk doesn´t have trolley wire.

What did you do next?

When I read your posts about the location at Pavlivska Street / Nechuya Levyts´koho Street, I went there to check this one. I explored the area and talked with people of the flats opposite that big street on 27th, 29th, 30th and 31st of January 2015. People confirmed that a lot of army vehicles were transported along this street. Well, each day I could see myself. But nobody confirmed a BUK launching vehicle. However several hints matched with the original video. I don´t need to repeat them, you´ve published it already. Just a new car poster had been pasted over the old one. And the metal chimney behind the billboard had been bent.

And you managed to find the person who filmed the video?

On 30th of January 2015 I met the person who told me they had made this video. I don´t want to mention the exact flat in order not to endanger those people. But I can say that it was from 4th floor of the Soviet style apartment buildings overlooking the road. From a window in the corridor I was able to have a look, and it nearly matched from there. I made a video from here.

My meeting happened in the afternoon, approximately between 1 to 3 pm. I was ringing the bell. A bald man aged between 30 to 40 opened the door. When I tried to tell him that I´m journalist, he became angry. As I didn’t speak Russia I called a friend of mine from Lugansk who was currently in Kiev who did. She explained to him that I was searching for the person who had made the BUK video. He became even angrier and closed the door. I continued talking with my friend on phone, discovering that she hadn´t gotten any answer. So I told her that I would try again.

This time a small woman opened the door. She was between 40 to 60 years old, smiling, a nice character. Opposite type of the guy. She asked me to come inside the private corridor of the apartments. It was for storing the shoes of 2 renters. I gave her my phone to talk to my friend in Kiev as she didn’t speak English. The flat straight ahead was the one with the windows to the street side. But the woman lived in the flat to the right. The guy locked the door and looked at me in an evil way. He demanded to see my press accreditation and passport, using abusive Russian words all time. It was a moment when I started to fear about the whole situation due to the fact that I wasn´t free anymore … caught by someone who seemed to be afraid himself or a psychopath.

What happened then?

The woman returned after some minutes of conversation on the phone – and gave it to me. My friend told me that “she made this video”, but she had mostly asked about me. My goal was to know about the time this video has been made, as well as getting the raw file. But the guy came closer to me, starting to raise his volume of insults. I gave him the number of my Lugansk host from whom I´ve rented a private room – in order for him to feel certain about me. He called the owner and questioned about me – by this way I got his phone number. The woman who claimed to have filmed the video came back and asked me whether it would be a problem to call the police. I said she could do it, no problem with me. She nodded without any emotion. The man showed me something which could have been his passport, but wrapped by Lugansk Peoples Republic cover. I understood that he wanted to emphasize his alleged pro-rebel position. I wanted to come away from this uncomfortable situation, saying that I would feel locked up. The man answered this wouldn´t be true … unlocking the door and kicking me out. I took a deep breath.

What happened once you left?

All this lasted 23 minutes … and my friend who was all the time with us on the phone encouraged me to run away – police would come! But I waited. There was nothing to hide. But the police didn´t arrive for about 30 minutes. So I left, taking some videos of the highway. Because of this I was arrested after some minutes.

Can you tell me about your arrest?

The police who brought me to “Ministry of State Security” didn´t know anything about what had happened in the flat before. Intelligence gave me food and a room to sleep. No interrogation.

The next day chief officer wanted to see me. He called himself Roman Anatolitsch from Sevastopol. “Sorry for your detention”, he said. So I saw a chance for conversation. I asked him for his opinions regarding the BUK video … for some investigation in a case of which he believed rebels to be innocent. He just smiled. Other things were important, MH17 not. “You can research as much as you want“, Roman said. “We don´t care what is written in Western papers – we are unable to keep up at that level.” I could go, not a single image on my confiscated camera was deleted.

Did you return to the apartment?

In the afternoon I returned to the scene of interest. Another friend of the Kiev-based one helping me on phone yesterday came with me personally for translating. Another woman was standing on the window from which Buk video has been made. She was smoking. The window was always open, even though it was cold winter. I very clearly announced my will to buy information. But she answered: “You have been here yesterday with our (inside-corridor) neighbours already. I don´t have anything to say.” However we found a way to come inside the building once more. But ringing the bell at floor number 4 was without success. We waited. After some time a man arrived who wanted to meet the same people. He explained the small woman from yesterday was the aunt of the aggressive man, and he was his brother. Asking about the Buk video he claimed all of this to be a “bullshit story” in a very trustable way. But he also didn´t know that his brother and the aunt had left Lugansk. We discovered it after some minutes, reaching him on the phone. He said: “Everything was told. Don´t ask anything more.”

On August 4th 2015 I received the message of another translator of mine whom I´ve asked to call once more. His (unedited) answer:",2015-08-13,Investigating the Luhansk MH17 Buk Video
2015,8,https://www.bellingcat.com/news/2015/08/07/tracking-swiss-watches-in-sinaloa-top-6-luxury-brands-among-mexican-drug-lords/,/news/2015/08/07/tracking-swiss-watches-in-sinaloa-top-6-luxury-brands-among-mexican-drug-lords/,"

By François Pilet (L’Hebdo) and Aliaume Leroy

Spanish Version

In the old days, secrecy and discretion were the rule for Mexican drug lords. Take Joaquín “El Chapo” Guzmán, for example. Known as “the world’s most powerful trafficker,” the 60 year old only appears on a handful of pictures. He does not need to cultivate his fame, especially since his latest MacGyver-style escape from a Mexican prison attracted a worldwide media coverage.

Things have started to change with the rise of social media and the emergence of a new generation of narcotraffickers. This new breed of young drug barons loves to brag on Twitter, Facebook, and Instagram, showing their flashy lifestyles like football stars.

Drug dealing in Mexico has become public and ostentatious for two reasons.

First, drug cartels have become so powerful that they show absolutely no fear when confronting or being dismantled by the Mexican security forces. Their organisations have infiltrated most, if not all levels of government. El Chapo’s recent flee, for instance, which is rumoured to have been staged and used by the Mexican government as a way to let him go, shows the omnipotence of the Sinaloa drug cartel.

Second, in times of economic hardship, the flamboyant lives of drug barons are appealing to millions of young and poor Mexicans abandoned by the state, who failed to restore peace and security under the presidencies of Felipe Calderón and Enrique Peña Nieto.

On their social media profiles, the modern narcotraffickers post pictures of their planes, drugs, luxurious cars, ladies, gold-plated guns, posh houses and Swiss watches.

Twenty-five years after Pablo Escobar and his gold Rolex, Swiss watches remain the most popular sign of wealth among the narcos in 2015. They appear to wear rare limited editions worth hundreds of thousand euros as well as much more affordable models.

To better understand the reach of Swiss luxury brands among the Mexican drug lords, we analyzed the social network profiles of three high ranking members of the Sinaloa cartel: Ivan and Alfredo Guzmán, two of the most influential sons of El Chapo Guzmán, and José Rodrigo Aréchiga-Gamboa, alias “El Chino Ántrax”, who was a rising star of the organisation -leader of the cartel’s violent gang named “Los Ántrax” – before his arrest in Netherlands at the request of the US authorities in late 2013.

Here is a top 6 of the favorite Swiss watches luxury brands appearing on their profiles – ranked by the number of models per brand and overall value.

Sources and background information are discussed below. Not all models were included because of issues with identification (bad quality of pictures, etc…) and for clarity.

UPDATE: As you can see below, some tweets along with their pictures were deleted from one of the account after the publication of this article. We nonetheless kept the links and added the original images.

1. Richard Mille

The small brand from Les Breuleux, in the Swiss Jura mountains, was founded in 1999 by French businessman Richard Mille. It wins the first place in our ranking with 5 appearances for a total of 1, 098 million euros. (It is worth noting that Richard Mille made the headlines recently when Vladimir Putin’s spokesman Dmitry Peskov was photographed wearing a $620 000 model, raising questions about his wealth).

– From left to right: Richard Mille RM 59-01 Tourbillon Yohan Blake limited edition (50 pieces), 648 000 euros. Richard Mille RM 011 Rose Gold Felipe Massa Flyback Chronograph, 100 000 euros. Richard Mille RM 055 Bubba Watson, 105 000 euros. Richard Mille RM 011 Flyback Chronograph Black Phantom, 140 000 euros:

Sin saber cual ponerme pic.twitter.com/XVVYF7HKVE — Ivan Guzman (@Ivan_Guzman_) June 10, 2014

– Left: Richard Mille RM 055 Bubba Watson, 105 000 euros. Right: Audemars Piguet (see section on this brand):



2. Hublot

Although it was originally created in the 80s, Hublot only found its real success after Jean-Claude Biver took over the management section in 2003. Hublot loves the Mexican market. The brand owns two shops there and works with 34 retailers. This is more than in Great Britain (29) or even China (14). The CEO of TAG Heuer is not surprised by the success of his brand among the narcotraffickers: “If you prefer Lamborghini over Bentley, rap over classical music, then you will like our watches.” Hublot is in second position with a total of 5 models valued at 554 400 euros.

– Hublot King Power Miami 305 Limited Edition (10 pieces), 435 000 euros:

– Hublot Big Bang Steel Pavé 41 mm 114 Diamonds, 21 500 euros:



– Hublot King Power Unico King Gold Pavé, 53 100 euros:



– Hublot Big Bang Gold Ceramic 44mm, 27 700 euros:

-Hublot Big Bang Steel Diamonds 44mm, 17 100 euros:

De hace rato …. muy buen dia ?✌️ pic.twitter.com/xzZR7QodFJ — Ivan Guzman (@Ivan_Guzman_) June 23, 2014

3. Rolex

Rolex is among the most powerful brands in the world. It is the only Swiss label to have made it to the wrists of two generations of the world’s most notorious drug lords, from Pablo Escobar to the Guzmáns. With 6 watches, Rolex ranks before Hublot in terms of appearances, but their total value is well below, at only 118 750 euros.

– Rolex Oyster Day-Date 36mm Yellow Gold, 19 350 euros:

Que anden al tiro ??✌️?? pic.twitter.com/zu60ln0EPW — Ivan Guzman (@Ivan_Guzman_) September 2, 2014

– Rolex GMT-Master II Oyster 40mm Steel and Yellow Gold 18 Carat, 11 300 euros:

– Left: Rolex Yacht Master II 44mm, 21 950 euros. Right: Rolex GMT-Master II Oyster 40mm Steel and Yellow Gold 18 Carat, 11 300 euros:



– Left: Rolex Cosmograph Daytona Steel and Yellow Gold, 14 650 euros. Right: Rolex Sky-Dweller Oyster 42mm Yellow Gold 18 Carat, 40 200 euros:



4. Audemars Piguet

Audemars Piguet was founded in 1875. Based in Le Brassus, in the Canton of Vaud, it is one of the oldest watch manufacturers still owned by its founding family. With only two appearances, Audemars Piguet is ranking in 4th position. The two watches value is however pretty high, at 360 200 euros combined.

– Audemars Piguet Royal Oak Concept Carbone, 309 600 euros (refer to the picture in Richard Mille’s section).

– Audemars Piguet Royal Oak 18 Carat Pink Gold, 50 600 euros:

Muy buenos dias plebes =) pic.twitter.com/bJIvPDmZht — Alfredo Guzmán (@AlfreditoGuzma) January 9, 2015

5. Romain Jerome

Romain Jerome is a new name among Swiss luxury watchmakers, but the model on El Chino’s wrist dates from several years back.

– Romain Jerome Titanic Chrono Red Gold Limited Edition (2012 pieces),

32 700 euros.



With only one model each, the brands Urwerk and Romain Jerome rank respectively 5th and 6th.

Sources and Background Information

Our conclusions stem from the analysis of different social media accounts belonging first to the ex-leader of the armed wing of the Sinaloa cartel named “Los Ántrax,” José Rodrigo Aréchiga Gamboa (35 years old) a.k.a “El Chino Ántrax.” He was arrested, as part of the DEA Operation Narco Polo, as he disembarked from KLM Flight 686 Mexico City- Amsterdam at the Schiphol Airport in December 2013. He was caught using the fake identity of Norberto Sicairos-Garcia. His capture notably brought the DEA, Interpol and other security agencies closer to their primary objective in the year 2014: arrest El Chapo. It also led to the death of his supposed girlfriend, Yuriana Castillo Torres, who was abducted and then found dead on the street in Culiacán. Extradited to the US and indicted on charges of importing marijuana and cocaine into the US, “El Chino” pled guilty last May. We also looked at the profiles of two sons of “El Chapo,” Iván Archivaldo Guzmán-Salazar (32 years old) a.k.a “El Chapito” and Jesús Alfredo Guzmán-Salazar (29 years old) a.k.a “El Gordo” (“the Fat One”) which have also been indicted by the American justice. These were not random choices. The two sons of El Chapo and El Chino have thousands of admirants. Here is a list of their accounts – we could not verify their authenticity – with the number of followers or likes in parentheses:

José Rodrigo Aréchiga-Gamboa“El Chino Ántrax” (135 000 admirers in total):

https://instagram.com/miauuuu5_7/ (58 000)

https://twitter.com/comandante57 (39 000)

https://twitter.com/Miauuu5_7 (1 000)

https://www.facebook.com/pages/CHINO-Antrax/1580417675517056?fref=ts (13 000)

https://www.facebook.com/pages/Chino-antrax/1423206714617137?fref=ts (10 000)

https://www.facebook.com/pages/Chino-Antrax/1488585071414812?fref=ts (8 000)

https://www.facebook.com/pages/Chino-antrax/647502882031840?fref=ts (6 000)

Iván Archivaldo Guzmán-Salazar, “El Chapito”(325 000 followers in total):

https://twitter.com/lvanArchivaIdo (192 000)

https://twitter.com/_IvanGuzman (88 000)

https://twitter.com/Ivan_Guzman (21 000)

https://www.facebook.com/pages/Ivan-Archivaldo-Guzman/1579988752275513?fref=ts (18 000)

https://www.facebook.com/pages/Ivan-Archivaldo-Guzman/503433706472751?fref=ts (5 000)

https://www.facebook.com/pages/Iv%C3%A1n-Guzm%C3%A1n/119074448433670?fref=ts (1 000)

Jesús Alfredo Guzmán-Salazar, “El Gordo” (330 000 fans in total):

https://twitter.com/_alfredoguzman (192 000)

https://twitter.com/AlfreditoGuzma/media (138 000)

NB: The featured image of this article depicts “El Chino Ántrax” with a gold-plated Kalachnikov. On his left wrist, he wears a Cartier Miss Pasha, 18 800 euros.",2015-08-07,Tracking Swiss Watches in Sinaloa: Top 5 Luxury Brands Among Mexican Drug Lords
2015,8,https://www.bellingcat.com/news/uk-and-europe/2015/08/07/mh17-conspiracies/,/news/uk-and-europe/2015/08/07/mh17-conspiracies/,"

Just over a year after the anniversary of the tragic downing of Malaysian Airlines Flight 17, a new trickle of conspiracy theories have emerged, including the use of an Israeli rocket launched from a Georgian aircraft downing MH17 and an undercover CIA agent working for the BBC plotting the plane’s downing. These new narratives are yet more entries in an ever-expanding corpus of outlandish theories to explain the tragedy, which have received varying levels of support from the Kremlin and its media outlets.

This is the first half of a two-part series that will attempt to catalogue all of these theories, from completely outlandish ideas that receive virtually no attention to elaborate theories touted by Russian state media. This half will document the more outlandish theories that have not received Russian support, though the second half will also have a few oddball ideas.

THEORY:

Israel assisted the Ukrainian shoot down of MH17 by using an F-15E plane out of Azerbaijan as an airborne radar system, allowing a Ukrainian SU-22 to target the passenger plane. Poroshenko was acting under the orders of Israeli Prime Minister Benjamin Netanyahu.

MOTIVE:

In order to distract the world from its ongoing offensive against Gaza, Israel framed Russia for the downing of a civilian airliner.

IN THEIR WORDS…

“I’ll put my hand on my heart & say Putin had nothing to do with this. He had nothing to gain, everything to lose & there is NO evidence to even suggest he did such a thing! (…) Here’s what’s in my tank – there is zero question in my mind as to who was responsible for the downing of flight MH17 – BENJAMIN NETANYAHU!”

RATING:

2 out of 5

Sources:

http://www.veteranstoday.com/2014/11/15/israel-and-mh17/

http://www.presstv.ir/detail/2014/07/20/372121/israel-benefits-from-downed-malaysia-jet/

http://falastinews.com/2014/11/23/israel-behind-downing-mh17/

THEORY:

The Illuminati/New World Order/Satan downed MH17 in a false flag attempt, with Russia, Ukraine, and all other major countries in the world complicit in the disaster.

MOTIVE:

In order to usher in World War III, the rise of the Antichrist, and the end of the world, Satan used his Illuminati reptilian puppets of Putin and Ukrainian PM Yatsenyuk to commit a horrible tragedy.

IN THEIR WORDS…

“The MH17 false flag attack has been orchestrated by the illuminatis as a trigger for 2014 WW3 in order to open the reign of their master Satan: The New World Order.”

RATING:

6 out of 66

Sources:

http://truthfromgod.canalblog.com/archives/2014/07/24/30304398.html

https://www.youtube.com/watch?v=TJ7F3Ag5EsE

THEORY:

MH17 never existed. No plane ever crashed. The West transported debris into a poultry farm in the village of Grabovo, spread it out, and said that a plane was shot down. There are no victims, and all of the relatives are lying crisis actors. Russia always knew that there was never an actual plane crash, but could not say this without coming across as heartless, so they put together a series of ineffective retorts to the West regarding SU-25 planes, a Ukrainian Buk, and so on. However, none of these worked, and Russia has been outmaneuvered in a grand conspiracy.

MOTIVE:

To humiliate Russia and isolate it from the West.

IN THEIR WORDS…

“They just trivially planted a stale corpse at the door of Russia and forced it to make roundabout excuses about how it didn’t kill anyone. And then they invited Russia to court. And now just try to prove that you didn’t kill anyone, when you have already acknowledged a corpse that doesn’t even exist!”

RATING:

There is no rating low enough for the breathtaking amounts of insensitivity in this theory

Sources:

http://amfora.livejournal.com/268917.html

THEORY:

Occult forces guided by the IMF and its head, Christine Lagarde, orchestrated the downing of MH17, as proven by the event’s connections to numerology. This allegation is irrefutable due to the repetition of the number 7 (MH-17, 7/17/2014, Boeing 777), an occult number that was discussed by Lagarde in a 2014 speech.

MOTIVE:

To gain a casus belli against Russia, the lone country that stands in the way of the New World Order and its economic hegemony over the world.

IN THEIR WORDS…

“It is my thesis that Lagarde is referring possibly to the “magic 7” event of the Malaysian Plane false flag, and that this may be a signifier of the coming international economic order and reorganized monetary reset, as well as war with Eurasia or Russia, primarily signified and fulfilled in the MH17 false flag fiasco.”

RATING:

7 out of 7

Sources:

https://www.youtube.com/watch?v=QYmViPTndxw

http://21stcenturywire.com/2014/07/21/mh17-malaysian-airlines-false-flag-scripting-straight-out-of-bbcs-sherlock/

THEORY:

The West framed Russia and its separatists for MH17 by repainting and planting the debris of a previously crashed plane in the fields of eastern Ukraine. This flight was likely British Airways Flight 38, which crashed outside of London Heathrow airport during a botched landing. MH17 disappeared (along with its 298 souls) and no one knows where it is now, if it ever even existed.

MOTIVE:

The United Kingdom (and only them) wanted to frame the pro-Russian rebels in eastern Ukraine of shooting down a civilian airliner.

IN THEIR WORDS…

“The MI-6 and British government are preparing a justification for a situation in which parts of other aircrafts are found in the remains of MH17, and accordingly, it turns out that no one ever shot down MH17 and to this day its location is unknown.”

RATING:

0 planes out of 5

Sources:

http://ymuhin.ru/node/1106

THEORY:

Ukraine and its Western, Modi-hating backers shot down MH17, thinking down the flight was actually the plane carrying Indian Prime Minister Narendra Modi from Frankfurt.

MOTIVE:

In order to prevent the rise of India and its independence from Western institutions, Ukraine and its western allies shoot down Modi’s plane in order to further entrench themselves into the Indian economy. Unfortunately for them, Modi’s plane narrowly missed the time frame in which MH17 was targeted and shot down.

IN THEIR WORDS…

“If it was mistakenly brought down, it is important for those who are interested in the truth to investigate those who have opposed Modi for more than 12 years. Since late 2001, many international forces have carried out a sustained campaign against Modi and have used their favorite method of using human rights organizations to fling mud at him and have even accused him of human rights violations.”

RATING:

I out of BRICS

Sources:

http://indiafacts.co.in/narendra-modi-real-target-mh-17-shooters/

THEORY:

The Illuminati shot down MH17 in order to kill AIDS researchers

MOTIVE:

The global elite, who have a vested interest in the continued growth of the pharmaceutical industries and the depopulation of the planet, shot down MH17 in order to prevent a cure for AIDS to surface. The conspiracy theorist is “just asking” the question if the actual cure for AIDS was on board MH17, giving a motive to the shadowy global conspirators to shoot down the plane.

IN THEIR WORDS…

“If we take all of these ‘clues’ into consideration would it be safe to assume that the scientist on board MH17 were about to present breakthrough research which could have resulted in the AIDS cure? Could these men have been ‘taken out’ by the global elitists in order to protect their highly-profitable AIDS industry, which generates billions of dollars for government run pharmaceutical companies?”

RATING:

3 Rothschilds out of 5

Sources:

http://indiafacts.co.in/narendra-modi-real-tahttp://beforeitsnews.com/power-elite/2014/07/illuminati-takes-down-malaysian-airline-mh17-to-hide-the-cure-for-aids-getting-rid-of-the-cure-to-keep-money-in-their-pockets-and-continue-their-depopulation-agenda-2446354.htmlrget-mh-17-shooters/

THEORY:

A Chinese crew shot down MH17 with an anti-air missile, and Putin knows about it, thus causing a supposed cool down in Sino-Russian relationship building. A Chinese crew used an HQ-16, a Chinese mid-range surface-to-air missile system. Oh, and China also shot down MH370 too, probably with an HQ-16 as well.

MOTIVE:

Unknown.

IN THEIR WORDS…

“This raises the intriguing possibility that MH-17 was actually shot down by the Chinese, as the Ukrainians would not have any crews trained on the HQ-16, whose instrumentation would probably be marked in Mandarin or Cantonese. There are not a lot of Chinese-speaking Ukrainians, in fact there are not a lot of Chinese restaurants in Kiev.”

RATING:

HQ-16 out of SA-11

Sources:

http://www.veteranstoday.com/2014/07/31/mh17-shootdown-continues/",2015-08-07,The Weird World of MH17 Conspiracy Theories
2015,8,https://www.bellingcat.com/news/mena/2015/08/01/additional-saudi-deployments-on-iraqi-border/,/news/mena/2015/08/01/additional-saudi-deployments-on-iraqi-border/,"

The latest space snapshots of the Kingdom of Saudi Arabia’s northern border region show additional construction activity to support the presence of its troops.

With the current conflict in Iraq and Syria, Saudi Arabia has had no choice but to rush equipment and supplies to defend the border area.

Imagery from January and June 2015 of Judayyidat Arar shows ongoing construction activity within a newly bermed area just outside the city. (The imagery from June is unavailable for publication at this time). Like with Turaif, subsequent imagery has shown Saudi armor deployed to the region.

Last year in July, Saudi-owned Al Arabiya had reported that approximately 30,000 Saudi troops were dispatched to the Iraqi border. At the time, King Abdullah ordered “all necessary measures to secure the kingdom from terrorist groups or others who might disturb the security of the homeland”.

The move was announced as Iraqi troops were reported to be abandoning their posts in Karbala.

Arar, located less than 40 miles south of the Iraqi border, is an important defensive position in support of the order. It’s the capital of the Northern Border province and has a population of over 320,000. With border attacks reported earlier this year, the Kingdom doesn’t appear to be taking any chances.

In March, Saudi forces launched a military exercise nearby focused on urban conflict. It sent a strong signal about the additional security measures being taken in the region. News reporting and handhelds suggest the exercise involved conventional and special forces troops supported by helicopters and armored vehicles.

Although few details were released to the public, it’s likely the exercise involved the same troops that have taken position outside the city. It wouldn’t be surprising as recent infrastructure additions suggest troops will be deployed in the near-to-medium term. Imagery from June shows three different staging areas (or parade grounds) along with what appears to be five new drive-through sheds, probably for vehicle storage. Other support buildings were also erected.

The nearby civilian-military airport, featuring a new helicopter apron since 2014, showed little change. The temporary support shelter that can be seen in January, was being replaced by permanent shelters in June. Six helos including 2 x Apache, 2 x Black Hawk and 2 x probable Combat Scouts were parked nearby in the earlier imagery. They could still observed at the airport in June.",2015-08-01,Additional Saudi Deployments on Iraqi Border
2015,9,https://www.bellingcat.com/news/uk-and-europe/2015/09/29/russias-6th-tank-brigade-pt-2/,/news/uk-and-europe/2015/09/29/russias-6th-tank-brigade-pt-2/,"

This post originally appeared in Russian on the LiveJournal of Askai707, sled-vzayt.livejournal.com.

English translation by Aric Toler

Translator’s summary:

The following post is the second half of a two-part research project from Askai707. An English translation of the first half can be found here, in which Askai researches the mysterious deaths of two 6th Tank Brigade soldiers during the Battle of Ilovaysk and a Russian T-72B3 tank found on the Ilovaysk battlefield containing the documents of a 6th Tank Brigade serviceman.

In this second part of Askai’s research, his primary findings are that:

Two Russian T-72B3 tanks from the 6th Tank Battalion, one damaged and the other destroyed, were in villages near Ilovaysk at the end of August 2014

Two Russian servicemen of the 6th Tank Brigade — Ivan Badadin and Evgeny Chernov — were captured by Ukrainian soldiers during the Battle of Ilovaysk

Russian servicemen of the 6th Tank Brigade, including a young man named Anton Dmitriyev, posted photographs of themselves in Ukrainian villages near Ilovaysk during the ongoing battle, even going so far as to photograph themselves by a sign of the Ukrainian village name.

—-

In the morning of August 29, 2014, the “southern” column of Ukrainian soldiers, retreating from Ilovaysk, fell under fire from Russian army units at the village of Chervonosel’skoe in the Donetsk oblast’. While carrying losses, the Ukrainian soldiers engaged in battle. On the eastern outskirts of the village, fighters of the volunteer battalion “Donbass” were able to beat back a Russian T-72B3 tank and destroy a second (interview of a participant in the battle).

Fighters from the Donbass battalion took photographs of these tanks. On September 1, their photos were published on a news report of the television channel “24.”

The damaged Russian T-72B3 tank:



The destroyed Russian T-72B3 tank:

Some more details about these tanks.

Thanks to video clips and photographs that were saved by Ukrainian soldiers, we are able to examine the damaged T-72B3 tank in detail. White, medium-sized circles are clearly visible on its fender (area on the side of tank above the caterpillar track), on the box for instruments on the left side of the turret, and on the lower part of the upper-front section of the hull. These white circles are the identifying marks used on the T-72B3 tanks of Russia’s 6th Tank Brigade in August & September, 2014 (further details about the identifying marks of the 6th Tank Brigade are in the 1st part of this article).

White circles on the fender and on the box for instruments and other implements:





The white identifying circle on the lower part of the upper-front section of the hull:

The tank was damaged by a grenade. The arrow below points to the hole caused by the anti-tank grenade:

The structure in the video frame is a rural house. It is located on the left side of the destroyed tank, consisting of three parts, which differ in height and the shape of the roofs:

It is not very difficult to find this structure on the satellite map of Chervonosel’skoe.

Here are the outskirts of the village from the east side. The house is among three structures, adjacent to one another. The north structure has the pronounced, acute roof. See the satellite image from August 2013:

On the satellite image for June 2014:

On the satellite image for September 2014, the northern half of the house has been badly damaged. Probably, after the video of the disabled T-72B3, Russians were shelling Ukrainian soldiers who had taken refuge in Chervonosel’skoe, and this northern side of the house suffered from it.

With the help of the satellite maps of the site Terraserver.com, which specializes in selling high-quality satellite images, we are able to see two positions of Russian tanks dug into the ground. The tanks fired on the Ukrainian column from there, when the column was driving up to the village. On August 29, the damaged and captured T-72B3 was located at the top of the firing position, which is shown in the snapshot of the map below:

The destroyed tank, as said by the fighter in this video, is positioned near the damaged one, behind the line of bushes at the bottom of the gully:

http://ic.pics.livejournal.com/sled_vzayt/73245930/179671/179671_original.jpg

For verification, we can look at even earlier satellite images and be sure that there were not objects of similar shape or size at the same place at the bottom of the gully:

See the following photographs of this Russian T-72B3 tank, taken at different times:

On the upper part of the front section of the tank is a white circle—a mark that has traditionally been used for T-72B3 tanks from Russia’s 6th Tank Brigade during this period:

In all of these photos, the burnt turret with missing reactive armor bricks is to the left of the gun, which was seen near the tank’s hull in the pictures taken on August 29 immediately after the battle:

A video from the village of Chervonosel’skoe from Rupty TV (September 2) shows this T-72B3 tank turret, displaying the traces of heavy fire, and lacking any reactive armor bricks in the same location. This is clearly the tank’s turret, burnt up at the bottom of the gully:

Aleksandr Yermochenko filmed and photographed the turret on September 3:

Therefore, it is not the hull of the tank near the turret in the later, but the visible tracks on the earth.

The location of the T-72B3’s turret from the gully may be determined using a video that was filmed by fighters on the outskirts of Chervonosel’skoe and from photos on social media. We can pick out meaningful objects on the photographs: the turret of a Ukrainian T-64BV tank, a grouping of trees in the distance, the turret of a Russian T-72B3 tank, and some bushes:

The same thing in a screenshot from a fighter’s video:

These objects, just like Ukrainian equipment destroyed on the road, presents itself in the September satellite images of the northern edge of the village of Chervonosel’skoe:

Clearly visible in the images is the furrow that the T-72B3 turret was left in after being dragged along the ground. Perhaps Russian soldiers tried to take it away right after the end of the fighting, but they were not successful.

The next important part of the evidence regarding the Russian 6th Tank Brigade: the prisoners.

On August 29, as a result of the battle in Chervonosel’skoe, Ukrainian soldiers captured several Russian servicemen, including two tankists from the damaged T-72B3 tank. On this day, fighters from the “Donbass” battalion took a video of their interrogation. In March 2015, the Security Service of Ukraine (SBU) published this video clip.

There are two servicemen of Russia’s 6th Tank Division from the September group photos (see photos 1, 2, and 3 from Part 1 of this article) that seem to be in the footage: Ivan Badanin (number 17 in the group photos), and Evgeny Chernov (number 10 in the group photos).

During the improvised interrogation, Badanin and Chernov admit that they serve in military unit 54096 of the 6th Tank Brigade. Ivan Badanin introduces himself as Ivan Aleksandrovich, born in 1988, from Vologda. On his VK page, his given birthday is May 25, 1988. The city in his contact information is Nikol’sk, likely the one in the Volgodskaya oblast’. Evgeny Chernov is named as Evgeny Yuryevich, born in 1995, from Kaluga. On both of his VKontakte pages (seen here, and here), Chernov puts his city as Kaluga, and both of his pages come up when you search for people who are 20-years old in the city—therefore, his given birth year on VK is 1995.

The fact that Chernov is a tankist and was completing his service in the 6th Tank Brigade can be found from his photographs on social networks.

Evegeny is next to a T-72B3 tank with the tactical mark of Russia’s 6th Tank Brigade. The photograph’s geotag is at the village of Mulino, the place of deployment for military unit 54096. Under the photo is Chernov’s description: “Me and my iron horse.”

Another photo of Chernov with a T-72B3 tank in Mulino:

Fall, 2014. Chernov (in the center) on a tank of the 6th Tank Brigade with the identifying white circle in a field camp near the village of Latonovo in the Rostov oblast’:

Chernov (lower row, on the right) and his comrades are posing in front of a T-72B3: in the upper row in the center is Sergey Danilov (number 13 on the group photos), on the lower row on the left is Sergey Yakushev, also known as Gradov (number 2 on the group photos).

Naturally, Evgeny Chernov saved the group photos of 6th Tank Battalion from the field camp near Latonovo in his VK photo albums. Here are the links to the pages of these photo albums:

https://archive.today/KZbaS

https://archive.today/pdLJW

https://archive.is/NZuXQ

https://archive.is/HqNPk

On his VK page, tankist Ivan Badanin left few compromising photographs, and after the appearance of the interrogation video, he entirely deleted his profile. Investigative blogger Anton Pavlushko of InformNapalm saved screenshots of a few photographs of Badanin.

Ivan Badanin near a memorial with a tank on the territory of the 6th Tank Brigade in summer, 2011:

Badanin in his military uniform with the insignia of the armored troops, and on his sleeve is the badge of the Western Military District of the Russian Armed Forces—the district into which the 6th Tank Brigade from Mulino is in.

Here is a snapshot of Badanin with his comrades of the 6th Tank Brigade—second on the left is Garik Pleshkov (number 3 in the group photos), and on the far right is Maksim Korotkov (number 4 on the group photos):

This photo remains on the VKontakte pages of these servicemen of the 6th Tank Brigade, along with their photos with Ivan Badanin.

Archived pages with Badanin in a photo with Garik Pleshkov:

https://archive.today/ERHtE

https://archive.today/Z98zv

https://archive.today/OPlfv

Archived pages with Badanin in a photo with Maksim Korotkov:

https://archive.today/mCD6i

https://archive.today/DBXlK

https://archive.is/npSkt

Fighting ceased on August 30, 2014 near the village of Chervonosel’skoe. Facing encirclement from a large enemy force, a lack of ammunition, numerous injured soldiers, no prospects for reinforcements, and the threat of the destruction of Ukrainian servicemen defending Chervonosel’skoe, the soldiers decided to lay down their arms.

After the ceasefire, some Russian tankists photographed themselves at the signpost of the village of Chervonosel’skoe. Two pictures posted online were found by investigative blogger Anton Pavlushko. Thus, even more direct evidence of the participation of units from the Russian 6th Tank Brigade in the war in the Donbass came to light.

The first photograph was posted by Anton Dmitriyev after he registered on VKontakte under the name “Antokha Dmitriyev.”

In this photo on the left side is Dmitriyev’s colleague: tankist Roman Gromov (number 8 in the group photos). On the right is Antokha Dmitriev himself (number 9 in the group photos). White markers (strips, ribbons) are on both servicemen, which are used by Russian soldiers and fighters in order to tell their own soldiers apart on the battlefield:

Shortly after the publication of this photo, Dmitriyev deleted his “Antokha Dmitriyev” account and created a new one under the name “Anton Yuryevich.” He uploaded a number of photos from his old page onto his new one, with the exception of the picture at the road sign “Червоносільське” (Chervonosil’skoe). Let’s look at a few of his photos.

Dmitriyev (right) and Roman Gromov, again posing together:

Here is a photo of three tankists on the roof of the engine compartment of a tank. From left to right: Nikolay Minakov (on VK he registered under the nickname Nikola Woolf), Anton Dmitriyev, and Sergey Malafeyev. White ribbons are tied onto Minakov and Malafeyev. As previously stated, Russian servicemen participating in fighting use these ribbons for differentiating themselves from opposing soldiers:

Here is Dmitriyev with two of his comrades, dressed in their uniforms. From left to right: Anton Dmitriyev, Roman Gromov, Pavel Osytchenko (number 6 in the group photos). In their hands, they’re holding NSVT anti-aircraft machine guns, taken from tanks.

And, of course, Dmitriyev has that old, familiar group photo in his photo album:

Similarly, the same photo is available on the page of the comrade of Anton Dmitriyev, Roman Gromov, who was photographed with him in Chervonosel’skoe: https://archive.is/TrBbL

In the following photograph, Gromov is next to a comrade, whose identity has not yet been established:

Both of them are in camouflage without any kind of military insignia, but at the same time they are wearing the identifying white bands and have light firearms. On the right, in the visible building, is a window without glass and a burnt frame. Behind it, random objects are strewn. In the foreground we can see the open door of a car, and the body of another car.

An analogous scene can be found after the battle in Chervonosel’skoe, seen clearly in three photographs (1, 2, 3).

Sergey Malafeyev posted the second photo near a road sign showing the name of the village of Chervonosel’skoe. In the photograph, he (highlighted with a red rectangle) is photographed with Anton Dmitriyev.



The next few photographs of Sergey Malafeyev were saved after he deleted his VK account.

Photograph in January 2014. The insignia of the armored forces is clearly visible on the uniform:



A photograph uploaded in March 2014 (you can find the date of publication for the photograph in the archived page here)

In the September photograph, the unshaven Malafeyev is sitting on a T-72B3 with the identifying white ribbons on his legs. The tank has a small white circle on the panel by the gun on top of the turret:

Returning to the group photograph of the 6th Tank Brigade servicemen, it must be mentioned that Sergey Malafeyev is present. Also present is Nikolay Minakov, mentioned above. In my previous post with the group photographs, they were not numbered, in contrast to the other identified servicemen.

Malafeyev and Minakov are quite similar in appearance, and there was a risk in making a mistake and mixing up their places. Now, it seems that the most accurate identifications—seen in the photograph below—is red for Sergey Malafeyev and blue for Nikolay Minakov.

For comparison:

For completeness of information, let’s determine the exact location of the road sign (so beloved by these Russian servicemen) for the village of Chervonosel’skoe.

The sign is located on the bend of the road at the entrance into Chervonosel’skoe from the north (its location on Google Maps). The road sign and other objects are marked below on an image from Google Earth:

Behind the “Червоносільське” on the photographs, a Ukrainian military truck is visibly turned onto its side:

This very truck is on a video from Rupty. Aleksandr Yermochenko’s photo shows the same truck, along with a sign:

The road sign in the video of the fighters (on the photo, the Russian tankists are standing with their backs to the village and place from which the video was taken):

There is no detailed and exhaustive information about which units from the 6th Tank Brigade fought near Ilovaysk and in what capacity. According to the shooting card of Aleksey Berezin, whose T-72B3 was captured near the village of Agranomichskoe, we only know that the third tank company (abbreviated “3ТР” in the card photo) of the first tank battalion (“1ТБ”) participated in the battles.

Below is a screenshot from the video of journalist Rostislav Shapashnikov and Yegor Vorobyev. On the cartridge box of Berezin’s T-72B3 tank’s anti-aircraft gun, we see the abbreviation “3ТБ,” thus confirming that the tank came from the third tank company:

Below is a screenshot from Yegor Vorobyev’s film “Ilovaysk – report from hell.” The ammunition box of the T-72B3 tank on which several tankists from the 6th Tank Brigade posed has the exact same abbreviation. In the photograph below, we see Nikolay Minakov and Oleg Sapurnov.

On the following photo, from left to right, are: Sergey Danilov (number 6 in the group photos), Andrey Komarov (a shared photo of Danilov and Komarov in February 2014 here), Nikolay Minakov, and Oleg Sapurnov. The identity of the fifth serviceman has not yet been established.

We cannot consider the entirety of the destroyed and damaged tanks in the Battle of Ilovaysk to be from the 6th Tank Brigade. Ukrainian soldiers destroyed two T-72B3 tanks of the 6th Tank Brigade: one near the village of Novodvorskoe, and the second in Chervonosel’skoe. Two were damaged and temporarily seized: the damaged T-72B3 in Chervonosel’skoe was on Ukrainian-controlled territory for about a day, and the captured T-72B3 near the village of Agronomicheskoe was by Ukrainian servicemen for 3-4 days.

Other than these tanks, the 6th Tank Brigade has other damaged and destroyed T-72B3 tanks, which were taken back to Russia. To date, we know about two such tanks.

On September 5, 2014, the tankist Aleksandr Lebedev (he has two accounts on VK, one old and one new) posted a photo of a T-72B3 with traces of an explosion and fire on the left side:

Screenshots of the comments for the photo were saved. Lebedev writes that this is his tank with the side number of 612, and that his tank was damaged in battle by a guided anti-tank rocket in Ukraine.

After this information was made public, Lebedev deleted the photo, along with other photographs where he is in a military uniform and with tanks. People managed to save a few of the photos (1, 2, 3). A screenshot was also saved of Aleksandr Lebedev’s VK profile page before it was changed:

In the photograph, he is in the 6th Tank Brigade group and has group photographs with other 6th Tank Brigade servicemen. We can see several accounts in his friend list who are tankists of the 6th Tank Brigade: Aleksey Berezin, Oleg Sapurnov, Vyacheslav Tumashov, Evgeny Lyubimov, Nikola Woolf (Nikolay Minakov), Vadim Romanyukha. It is evident that Aleksandr Lebedev also served in Mulino.

Lebedev’s damaged tank happened to be captured in a photo from Sergey Yakushev (“Gradov”), who was number 2 in the group photos.



At the end of 2014, the site Lostarmour.info published two photographs of a burnt-up T-72B3 tank. As of now, this is the last destroyed T-72B3 tank of Russia’s 6th Tank Brigade we know about.

Later, other photos appeared:

In the bottom of the upper-front part of the hull, an identifying white circle is still visible – like on other T-72B3 tanks of the 6th Tank Brigade that participated in the Battle of Ilovaysk (two additional photos: 1, 2)

Photographs of this T-72B3 were put onto social networks by Russian servicemen from the field camp near the village of Vodino. These soldiers were deployed on the border in the Myasnikovsky and Neklinovsky regions of the Rostov oblast’.

Vitaly Makarevich of military unit 11386 (105th Logistical Support Brigade) posted photographs on his VK page that have a geotag at Vodino. In these photographs, destroyed or damaged equipment is visible, including: a self-propelled howitzer 2S3, a T-72B tank with dismantled reactive armor (archived page), two hulls from armored personnel carriers, with one on top of the other (archived page).

Near these object is the a burnt-up T-72B3:

This survey has come to its end. It is now evident that the armored group of the 6th Tank Brigade was far from the only Russian army unit that has fought against Ukrainians near Ilovaysk. However, judging by the evidence of their presence in the Donbass, the tank brigade from Mulino was certainly among the leaders of the participating Russian groups in the Battle of Ilovaysk.",2015-09-29,"Russia's 6th Tank Brigade: The Dead, the Captured, and the Destroyed Tanks (Pt. 2)"
2015,9,https://www.bellingcat.com/news/uk-and-europe/2015/09/22/russias-6th-tank-brigade/,/news/uk-and-europe/2015/09/22/russias-6th-tank-brigade/,"

This post originally appeared in Russian on the LiveJournal of Askai707, sled-vzayt.livejournal.com.

Part 2

English translation by Aric Toler

Translator’s summary:

The following post was written by Askai707, a Ukrainian open source investigator that has written numerous reports on Russian tanks and soldiers in the Donbass. This report details the involvement of Russia’s 6th Tank Brigade in the now infamous Battle of Ilovaysk from August 2014. The primary evidence for this claim is:

The death, and secret burials, of two 6th Tank Brigade soldiers on the same days as the battle.

The discovery of a damaged T-72B3 (exclusively Russian) tank on the battlefield, holding the documents of a soldier of the 6th Tank Brigade

The identification marks of this tank, and others, matching that of the 6th Tank Brigade from August 2014.

—

Two hundred years ago, it was said that “In Russia — everything is a secret, but there is no secrecy.” Since then, little has changed. If they are trying to disavow the Russian military’s involvement in the war in the Donbass at the highest state level and from the television screens of state television channels, then nothing is hidden at the household level. On social networks, Russian soldiers share photographs from Ukrainian war-zones with their friends, acquaintances, and other readers. They do this while boasting of war stories. Soldiers are made to sign the “Obligation of non-disclosure of restricted information,” threatened with the penalties carried by the law. However, as in the case of a junior sergeant of the 32rd Separate Motorized Infantry Brigade Stepan Potylitsin, such “Obligations” are also spread onto the Internet:

In this regard, the troops of the 6th Separate Tank Brigade of the Russian Federation (military unit 54096 of the village of Mulino, Nizhegorod oblast’) are no exception. The following post will examine evidence of the participation of a unit of the 6th Tank Brigade of the Armed Forces of the Russian Federation in fighting in the Donbass, collected from open source information.

The first half of September 2014. Fierce fighting near Ilovaisk had ended a few days before. In the Rostov oblast’ near the village of Anastasievka and in the field camp near the village of Latonovo, tankists from Mulino were taking a series of group pictures and posting them on social networks.

The field camp near the village of Latonovo on Yandex Maps:

About two dozen VKontakte accounts of soldiers were established from these group photos.

In the following list, the name(or nickname) that each person registered with in the VKontakte social network is connected with the corresponding number of the above photos. Furthermore, an archived link (or screenshot) of the front page of each soldier’s account is hyperlinked to his name.

The two people in normal clothing, standing on the edge from the right side are not soldiers: Misha Zhurbin and Sergei Zhurbin.

Membership of the group of soldiers to the 6th Tank Brigade is easily established through their profiles on social networks.

In the “military service” field, Yevgeny Lyubimov (number 11 in the group photos) filled out the number of his military unit of the 6th Tank Brigade — 54096, his place of work — the village of Mulino, military unit 54096, tank commander:

In the following photo, Lyubimov (badge on his uniform with the name “Gollandskikh E.R.) next to a T-72B3 tank with the tactical sign of the 6th Tank Division — white dots (likely, depending on which battalion, there are one, two in a row, or three dots, like on the photo below), which are located inside a white square:

The very same tactical signs and tank with the number 666 can be seen in the photo from December 2013 in a report from the Mulino firing ground. It was then that the 6th Tank Brigade received modernized T-72B3 tanks to replace their T-80BVs:



Kolya Bazylevich (number 6 in the group photos), until the deletion of his account under the nickname Jack Daniels, indicated in his profile that he served in military unit 54096, in the first tank battalion since 2009:

In the preserved account, Bazylevich left only the information about how he is from the village of Mulino:

This village Mulino is the place of deployment of the 6th Tank Brigade, as indicated in the profile of tankist Vadim Romanyukha (number 12 in the group photo).

Photographs remained on the page of First Lieutenant Garik Pleshkov (number 3 in the group photo) depicting T-80BV tanks of the 6th Brigade with the old tactical sign, before rearmament to T-72B3 tanks:

This is a photograph of Lekha Fedoseyenko (number 16 on the group photos) during his time of military service, with a geotag for the village of Mulino:

Another photo with a geotag for Mulino is of Lieutenant Maksim Korotkov (number 4 on the group photos):

The tankist Ivan Badanin (number 17 on the group photos), with a tank monument in the background on the territory of a military unit of the 6th Tank Brigade in Mulino:

Yevgeny Chernov (number 10 on the group photos) in a picture with a geotag for the village of Mulino next to a T-72B3 tank, on which the tactical sign of the 6th Tank Division is clearly visible:

Various T-72B3 tanks of the 6th Tank Brigade fall into the frame of the photographs of the tankists. White paint marks are marked on some of the tanks, easily recognizable as white circles:

The next photo, judging by the non-regular uniform without chevrons and with identifying white bands, was taken in the war-zone in the Donbass. On the 6th Tank Brigade tank, you will notice a white circle, printed onto a box for instruments on the left side of the turret. Earlier in this place was the side number and tactical sign of the unit:

On the left of the photograph is Nikolay Minakov (registered on VKontakte under the nickname Nikola Woolf), and on the right is Oleg Saprunov. They serve together with the aforementioned tankists in the 6th Tank Brigade, as indicated in two photos (first, second) in which they are photographed back in Russia on the base of the 6th Tank Brigade with fellow soldiers Vadim Romanyukh and Yevgeny Lyubimov.

So, in summary, identification marks of medium-sized white circles can be found on T-72B3 tanks of the 6th Tank Brigade: on the top of the front plate of the body close to the bottom edge; on the front of the turret to the left (in the direction of movement) of the gun barrel; on the left side skirt; on the rack above the crawler; on the box for instruments and accessories on the left side of the turret.

It’s known that in addition to the 6th Tank Brigade, units of the 17th and 200th Motorized Infantry Brigades have utilized T-72 tanks with T-72B3 modifications in the Donbass. However, this system is characterized by markings that are only seen with the 6th Tank Brigade.

During the time of fighting in the summer and autumn of 2014, the T-72B3 tanks from the 17th Motorized Infantry Brigade had markings of white circles twice the diameter on the front of the body and on the side rubber screens:

Yellow small triangles were used as markings on the T72-B3 tanks of the 200th Motorized Infantry Brigade during the same time period. They were applied onto the boxes for instruments on the left side of the turret and on dynamic protection blocks from the right side of the turret. Additionally, in attempting to make the tanks look like they were from the so-called “militia,” they would sometimes make notable markings on the side screens of the tank in the spirit of Soviet propaganda of the 1940s:

Taking this evidence into account, we can move on to a review of the evidence of the participation of the 6th Tank Brigade from Mulino in battles in the Donbass…

The end of August 2014. At the height of fighting near Ilovaysk. On August 26, new information appeared about killed soldiers from Mulino — Vladislav Barakov and Sergey Rusakov. On the social network site VKontakte, their colleagues made their first tragic notes.

Dmitry Gorbachev (his photo is in the background of the T-72B3 tank with tactical marks of the 6th Tank Brigade) published photos of Barakov and Rusakov, accompanied with the text “this terrible war has taken you”:

Andrey Frolov (photograph of the T-72B3 tank with the side number 662 with the tactical marks of the 6th Tank Brigade and writing “My Patsansky Taz for one year” in an album on the account of Frolov) on August 27 wrote a note of analogous content:

In the comments, he blames the Russian government for the concealment of Russian soldier deaths in Ukraine:

There is not much information about the deceased soldier Sergey Rusakov. Journalists have not written stories about his death. The VKontakte page of Rusakov was quickly deleted, and the last message from his Twitter was on August 15, 2014, saying that he was being sent near the border to Taganrog.

With Barakov it is different–his death could not be silenced. On social media, his profile remains:

Barakov on a T-72B3 tank:

Barakov in his Russian tankist protective armor (6B15):

The diploma that Junior Sergeant Vladislav Barakov received in the 6th Tank Brigade for “successes” and “conscientious performance of military duty”:

At the end of September, the New York Times published an article about the secret burials of Russian soldiers that died in the Donbass. Reporters went to the village of Selizovo, spoke with the relatives of Barakov, and visited the grave where Vladislav was buried. According to the plate on the cross, he was killed on August 24:

Thus, we know that at least two tankists of the 6th Tank Brigade perished.

On August 26th (the same day when records about the death of the 6th Tank Brigade tankists appeared), the news service Radio Svoboda reported, referencing journalists from Espreso.tv, that Ukrainian soldiers “in a battle, fought of Russian tanks, which had documents from a Russian military unit.” The next day, Espreso.tv put up a video clip of the captured tank.

In the video, taken by a journalists from “Dorozhny kontrol'” (Road Control) named Rostislav Shaposhnikov and a journalist from Espreso.tv named Egor Vorobyev, the captured Russian tank was a T-72B3 (the visual differences of a T-72B3 tank with other modifications is included in the first part of my previous article “Russian armored vehicles in the war in the Donbass”)

At that time, Ukrainian servicemen had already marked the tank with its two white stripes — distinctive signs of the vehicles of the Armed Forces of Ukraine [translator’s note: the soldiers presumably marked it quickly in order to avoid friendly fire during the ongoing fighting], but still had not painted over the Russian identifications–a white circle on the box on the left side of the turret:

On the photos, we can see a white circle from the front angle, located on the upper front plate of the body close to its lower edge:

The identification marks of this T-72B3 tank correspond with the identification marks used at this period in the 6th Tank Brigade of the Russian Federation. However, this is not direct evidence. In this tank, the firing practice card of Aleksey Alekseyevich Berezin from the third tank company of the first tank battalion was discovered:

Aleksey Berezin — the very same serviceman who was #1 on the 6th Tank Brigade group picture. It was the tank of his crew that the Ukrainian soldiers seized and the journalists Rostislav Shaposhnikov and Egor Vorobyev videotaped:

On Berezin’s VKontakte account, there is a group photo of the 6th Tank Brigade:

And another photo from the Rostov Oblast:

Berezin in his tankist body armor (6B15):

Berezin in his military uniform with the insignia of the tank forces:

The details about Berezin’s captured tank differ. The head of armored weapons service of the “Yug” (South) command, Colonel Yevgeny Sidorenko, indicated in his story that the tank was captured on August 24, and the captured tank was used in battle on August 25. Colonel Mikhail Kovalsky, who was the head of the engineering service of the “Yug” command, said that the tank was captured by his battle group on August 26 after shelling from an infantry fighting vehicle operating out of the village of Agronomicheskoe.

They did not manage to withdraw Berezin’s tank from Ilovaysk. On August 29 near the exit of the encirclement, Ukrainian soldiers were forced to leave the captured tank behind. In an article by Yaroslav Tinchenko called “September 2014. Ilovaysk. Part V. Exit of the ‘Southern’ group,” it is mentioned that Colonel Yevgeny Sidorenko managed to take the Russian T-72B3 to the outskirts of the village of Novokaterinovka.

Then, fighters of the DNR (Donetsk People’s Republic) discovered the tank. A picture from the VKontakte page of Mikhail Pishch:

On September 14, Berezin’s tank suddenly appeared in an episode of “Vesti nedeli” (News of the week) on the Rossiya 1 (Russia 1) channel. The T-72B3 tank was presented as a Ukrainian T-72 tank allegedly captured by the “militia,” and was “not of Russian or Ukrainian origin.”

Apparently, this T-72B3 was returned to the Russian military.

Berezin’s tank was captured near the village of Agranomicheskoe. In the same area — another T-72B3 tank of the 6th Tank Brigade of the Russian Federation was destroyed at the village of Novodvorskoe. This tank was shown in the programs “Segodnya” (Today) and “Chrezvychaynoye proisshestviye” (Emergency situation) on the NTV channel on September 9, 2014. The voice-over called the scorched T-72B3 tank of the Russian Army a “mighty Ukrainian tank” made in the Czech Republic.

The identifying mark of the 6th Tank Brigade has been preserved on the tank–a medium-sized white circle, located on the lower part of the upper end-plate of the body:

Other photos of this T-72B3 tank, taken at a different time:

The destroyed T-72B3 tank at the village of Novodvorskoe is on the fighter’s video “Roads of war. Donetsk”:

The exact position can be seen on Google Earth on the September 14, 2014 satellite photo:

Part 2",2015-09-22,"Russia's 6th Tank Brigade: The Dead, the Captured, and the Destroyed Tanks (Pt. 1)"
2015,9,https://www.bellingcat.com/news/mena/2015/09/21/confirmed-su-25s-join-russias-flankers-in-latakia/,/news/mena/2015/09/21/confirmed-su-25s-join-russias-flankers-in-latakia/,"

Satellite imagery acquired by Airbus of al-Assad International Airport shows new arrivals supporting Russia’s growing military presence.

Space snapshots from 20SEPT15 show twelve SU-25 Frogfoot joining the four SU-30SM Flanker already parked at the airport, a location ten miles south of Latakia.

Earlier the SU-30SM were misidentified by the media as SU-27.

The latest imagery was published by AllSource Analysis via several partner sites (ISW) (Stratfor).

The SU-30SM multirole fighters are some of Russia’s more advanced combat aircraft capable of air superiority and ground attack roles. They’re highly maneuverable 4+ generation fighters often compared to the US F-15E.

The Frogfoot is the Russian equivalent of the US-built A-10 Warthog, providing dedicated close air support. The twin-engine Sukhoi has five hard-points underneath each wing for carrying weapons and an array of attachments.

The aircraft first proved itself in the 1980s during Soviet counterinsurgency missions in Afghanistan, and has since joined the inventories of countries around the world.

It’s expected that these aircraft will soon be joined by other Russian SU-24M Fencer which news reports say are already at the airbase. Videos on youtube of alleged sightings also suggest they’re deployed to the country.

In total, US officials claim Russia has 28 combat aircraft in Syria which include the SU-25s.

However, this isn’t the first time Russia’s dedicated ground attack aircraft have been employed to take part in the conflict.

Next door in Iraq, three former Russian Air Force Frogfoot were delivered to Baghdad’s al-Rashid airbase in late June 2014. Iraq’s forces were doing so poorly combating ISIS, they were rushed to the Middle Eastern country without their desert camo scheme.

Imagery from last November still shows them operating from the airbase, circled above in red. They’re easy to distinguish thanks to their darker colour camo pattern.

They were parked on the apron next to four Iranian SU-25 which reportedly deployed last July from Shiraz airbase. Imagery from 2015 of Shiraz airbase would suggest they still remain in the fight.",2015-09-21,Confirmed: SU-25s Join Russia's Flankers in Latakia
2015,9,https://www.bellingcat.com/news/uk-and-europe/2015/09/21/bellingcat-investigation-russias-paths-to-war/,/news/uk-and-europe/2015/09/21/bellingcat-investigation-russias-paths-to-war/," - Russia's Path(s) to War

Full report here.

The extent of Russia’s role in the ongoing conflict in Eastern Ukraine has yet to be determined. Thus far, Russia denies any direct involvement in the war. However, most Western nations do not share Russia’s position and assume that Russia is directly or at least indirectly involved. This same ambiguity, which continues to affect the conflict in Eastern Ukraine to this day, also characterized the annexation of Crimea last year. At first, Russia denied any direct involvement in the military operations that blocked Ukraine’s armed forces and led to the seizure of key buildings and other locations on the peninsula. Later, however, Moscow acknowledged the active role played by Russian servicemen. (It should be noted that photographic and video evidence had already clearly depicted the involvement of Russia’s armed forces in March 2014.)

The current state of the conflict in Eastern Ukraine is similar to the situation in Crimea in March 2014. Russia claims that its forces are not involved despite a plethora of evidence to the contrary. Reports have been published analyzing the presence of Russian equipment in Ukraine, documenting cross-border artillery attacks, and demonstrating the participation of active Russian servicemen in the conflict. This report examines one aspect of the Russian-Ukrainian war, namely, the alleged cross-border traffic of Russian forces into Eastern Ukraine. If it is possible to link cross-border traffic to Russia’s armed forces, this not only provides additional evidence for Russia’s involvement, it also allows for a better assessment of the extent of Russia’s involvement. This report, which primarily focuses on events in the summer of 2014, is solely based upon open source information; the identification and verification of border crossings was performed relying on publicly available satellite imagery.

Using satellite imagery, this report’s assessment of the border area in the conflict zone shows that there are at least 60 tracks crossing the border. Four to five border crossings are of a scale not seen along the border before, and roughly two dozen are assessed as being closely related to the Russian army. Two different types of border crossings were identified: tracks crossing the border to launch attacks from inside Ukraine and tracks crossing the border to enter Ukraine and reach – in most cases – an unknown target inside Ukraine. New tracks were documented for July, August, and September 2014, the months that saw the most intense fighting along the border last summer. The key findings and results of this report include:

A description of approximately 30 of the visible border crossings and the close relationship – both in place and time – between all major border crossings and major battles in the border area of Eastern Ukraine.

New visual evidence documenting the border crossings, including military vehicles and equipment stationed along the border and large groups of military hardware traveling on paths clearly related to border crossings

An assessment establishing or strengthening (as the case may be) the links between the border crossings and Russia’s armed forces through the documentation of Russian bases via satellite imagery and/or photographs uploaded to social media by Russian soldiers

The evidence presented below confirms that Russia’s armed forces participated in the war throughout the entire summer of 2014. Moreover, it is further shown that this participation by Russia decisively changed the course of the war.

You can explore the report on StoryMap here.

The full report can be downloaded here.",2015-09-21,Bellingcat Investigation
2015,9,https://www.bellingcat.com/news/mena/2015/09/20/clarification-russian-su-30sm-in-syria-not-su-27/,/news/mena/2015/09/20/clarification-russian-su-30sm-in-syria-not-su-27/,"

This post was originally written for Offiziere.ch after several comments questioning the imagery identification were posted on Twitter.

Recent satellite imagery acquired by Airbus of al-Assad International airport in Syria shows four SU-30SM aircraft, not four SU-27 Flanker as originally reported by the Institute for the Study of War.

The aircraft are easily mistaken for the SU-27 due to the modern variant’s use of the same airframe. The only predominant identifier on satellite imagery separating these aircraft from the earlier model is the canards positioned forward on the fuselage which assist with the aircraft’s thrust vectoring capability.

Located on the north side of the runway at Latakia, the SU-30SM multi-role fighters are one of Russia’s more advanced 4+ generation aircraft, often compared to the U.S. Air Force F-15E Strike Eagle. This variant is equipped with a passive electronically scanned array (PESA) BARS radar, fly-by-wire flight controls, modern ECM as well as thrust vectoring, making this a highly maneuverable and capable fighter.

The Flankers complement Russia’s growing presence in the Middle Eastern country which now include main battle tanks, APCs and attack helos (ISW, NYT, Reuters). Some sources have even hinted at a Russian S-300 presence, though that’s not yet confirmed.

Russia’s Irkut Corporation delivered the first batch of SU-30SM to the 6982nd Air Base at Domna in November 2013. As of June 2015, a total of 17 of the aircraft have been observed at the Siberian airbase on satellite imagery. Given orders confirmed at the end of last year, Russia should acquire at least 72 of the aircraft.

Since the post was created at Offiziere earlier today, the Institute for the Study of War updated their tweet:",2015-09-20,"Russian SU-30SM in Syria, not SU-27"
2015,9,https://www.bellingcat.com/news/rest-of-world/2015/09/18/vietnam-expands-new-aircraft-support-apron/,/news/rest-of-world/2015/09/18/vietnam-expands-new-aircraft-support-apron/,"

Located near the important deep-water port of Cam Ranh Bay, a new aircraft support apron has been recently added and expanded, satellite imagery confirms.

Vietnam is currently engaged in a long delayed military modernization program. For obvious reasons, part of the modernization has been centered on the Navy which aims to bring substantial combat capability online in the shortest time frame.

Available space snapshots from March 2015 show the expansion of an aircraft ramp located on the southeast side of Cam Ranh International airport. Construction on the ramp has been ongoing since late 2013.

Additional imagery from July, unavailable for publication at this time, has shown at least two Ka-28 ASW helicopters parked in front of the hangars. It’s possible these may be the two observed in Vietnam’s colors last November in the Crimea.

If imagery is any indicator, Vietnam could be making room for more.

Given the vessels on order for the Navy, it’s likely the apron represents the land-based component supporting Vietnam’s ship-based helos. Most notably, the helos deployed on the Russian-built Gepard class frigates and other coastal patrol vessels.

Two Gepards, the King Dinh Tien Hoang (924-979) and King Ly Thai To (974-1028), were delivered in 2011. Both are currently home ported nearby at the Cam Rahn Bay naval base, not far from Vietnam’s four Kilo submarines.

Russia’s Zelenodolsk Shipyard in Tatarstan has been contracted to build four more of the Gepard class for the southeast Asian nation. The second frigate batch, reportedly optimized for the ASW mission, is scheduled for delivery in 2017. A third batch was also reported last February.

Two helos are thought to support each assigned vessel.",2015-09-18,Vietnam Expands New Aircraft Support Apron
2015,9,https://www.bellingcat.com/news/mena/2015/09/17/iran-isoico-shipyard-imagery-update/,/news/mena/2015/09/17/iran-isoico-shipyard-imagery-update/,"

The latest commercial satellite imagery shows some new developments at Iran’s ISOICO shipyard near Bostanu. In August, the Kharg (431) replenishment ship, which has been berthed at the shipyard since last November, was moved to the yard’s floating dry dock. Imagery suggests that the ship may be undergoing more extensive maintenance. Prior to the vessel’s arrival, it had been home ported at Bandar Abbas where monthly imagery suggests it has remained since late 2013 despite news stories to the contrary. The Kharg is operated by the Islamic Republic of Iran Navy and is the largest Iranian military vessel by tonnage.

Not far from the Kharg near the shipyard’s fabrication shop, new imagery from earlier this month showed two Ghadir coastal submarine out of water near the transverse table. The two boats may have come back to the shipyard for a refit as Iran continues to advance its submarine technology. For routine maintenance Iran has a facility over at Bandar Abbas that it made operational in 2009. Publicly available imagery in Google Earth from November 2014 also showed two Ghadir submarines near the fabrication shop. Over the years, the Ghadir have been spotted less frequently at the shipyard where they were initially built.

The Ghadir submarine are reportedly operated by both the Islamic Republic of Iran Navy and the Islamic Revolutionary Guard Corps Navy. The majority of the coastal submarines are based out of Bandar Abbas where no more than 10 have been consistently observed.",2015-09-17,Iran ISOICO Shipyard Imagery Update
2015,9,https://www.bellingcat.com/news/2015/09/16/sighting-of-r-166-0-5-signals-vehicle-affirms-inflow-of-russian-military-into-syria/,/news/2015/09/16/sighting-of-r-166-0-5-signals-vehicle-affirms-inflow-of-russian-military-into-syria/,"

The past few days have seen a steep increase of evidence revealing the true extent of direct military involvement by the Russian military on the ground in Syria. The sighting of recently delivered Russian UAVs and Russian BTR-82A infantry fighting vehicles (IFVs) in addition to sound fragments confirming Russian military personnel directly participated in one of regime’s offensives in the Lattakia Governorate all proved Russia was deeper involved in the Syrian Civil War than many previously thought.

The true extent of Russia’s commitment in aiding the regime was further revealed by the frequent transits of a large number of Russian landing ships bound for Syria through the strait of Bosphorus along with at least fifteen flights made by Russian Air Force An-124s strategic airlifters to Lattakia. These ships and aircraft brought large numbers of vehicles, equipment and personnel to Syria. In order to house the Russian contingent, Hmeemeem/Bassel al-Assad IAP has been turned into a Russian military base and is currently being reconstructed to allow the deployment of land and air assets.

Newly published images showing a Russian R-166-0.5 (ultra) high-frequency signals (HF/VHF) vehicle driving through Syria’s coastal region now leaves little to no doubt on Russia’s intentions in Syria. The R-166-0.5 provides jam-resistant voice and data communications over a long range, enabling Russian troops to communicate with their bases in the coastal strongholds of Tartus and Lattakia while operating far inland.

The vehicle can be seen escorted by Syrian military personnel, likely belonging to the National Defence Force (NDF). Far more interesting however is the soldier sitting near the open hatch of the vehicle. Seemingly unaware that a photo is being taken, he is wearing the Russian Army’s standard digital flora uniform, once again proving that we’re truly dealing with Russian military personnel.

On the rear of the vehicle, darker olive paint has been used to conceal the tactical number of the R-166-0.5, eliminating any chance to identify the brigade the vehicle belongs to. Concealing the tactical number or any other identification marks became standard practice during the Ukrainian conflict.

According to an unofficial Russian Army brigade TOE (Table of Organization & Equipment), a total of eight R-166-0.5 signals (HF/VHF) vehicles equip the communications battalion of a brigade. The sighting of the R-166-0.5 thus means that a brigade HQ or, at least, a reinforced battalion (so-called Battalion Tactical Team) of Russian combat troops has recently arrived in Syria.

Some of the specifications of the R-166-0.5 (an example operated by the Russian Army can be seen below) as translated from this Russian Army fact-sheet:

Max range:

HF, stationary (with deployed antenna) – up to 1000 km

HF, on the move – up to 250 km

UHF, stationary – up to 70 km

UHF, on the move – up to 25 km

Frequency range:

HF – 1.5-29.99999 MHz

UHF – 30-107.975 MHz”

As new information on Russia’s secretive operation in Syria continues to come to light, the deployment to Syria is yet to be strongly condemned by any nation. Although the U.S. has so far been watching with growing concern, warning Russia that its operation might further escalate the Syrian Civil War, it appears to have no real answer to the Russian operation in Syria. Unwilling to provide the Free Syrian Army with MANPADS, and with the majority of the mere sixty U.S. trained FSA fighters already out of action, the U.S. might have sidelined itself in Syria for good.",2015-09-16,Sighting of R-166-0.5 signals vehicle affirms inflow of Russian military into Syria
2015,9,https://www.bellingcat.com/news/mena/2015/09/07/are-there-russian-troops-fighting-in-syria/,/news/mena/2015/09/07/are-there-russian-troops-fighting-in-syria/,"

This post originally appeared on the LiveJournal of Ruslan Leviev in both Russian and English. The following text is a cross-post of the English translation that appeared on Leviev’s personal blog. When Leviev refers to “we” and his “investigation team,” he is referring to his “WarInUkraine” research team that has previously produced posts on such topics as Russian military personnel in Luhansk and the (lack of) credibility of a news report claiming to know the number of Russian casualties in Ukraine.

Recently information has been spreading through blogs and media on Russian troops being moved to Syria with an intent to take part in the fighting.

We tried to investigate the information, verify, confirm or refute the assumptions and find new facts. Here’s what we got.

The information on “Putin moving troops to Syria!” became widespread after a recent video from Syria, shot presumably on August 23 during fighting to the north of Latakia, Syria’s main port city.

Two things were pointed out in this post. Firstly, a BTR-82А APCRU with a 30-mm 2А72 cannonRU — a rare sight even in Russian military units.

http://youtube.com/watch?v=IK0m9a6JJ80&w=853&h=480

The APC has camo painting and a number 111:

Secondly, many heard people speaking in Russian at 02:04 — 02:15 in the video above. We cut out the speech fragment and tried to increase the volume and reduce the noise:



https://soundcloud.com/russiansound-217754771/converted-latakia

Concerning BTR-82A

Russia does not deny supplying military vehicles to Syria. Specifically, at least thirty BTR-80 APCs were supplied to SyriaRU from December 2013 to March 2014.

But, firstly, this is an older model radically different from BTR-82A, secondly, BTR-80 photos from Syria show them having the simplest factory paint jobs, thridly, these photos show that Syrian government troops do not put numbers on vehicles supplied to them. We double-checked this and saw that if Assad troops do put numbers on their vehicles, the numbers are painted differently.

Concerning Russian voices

Firstly, we decided to make sure the “Russian words” we hear in the video aren’t actually similar-sounding Arabic words. That wouldn’t be impossible. We, as Russian native speakers, could hear familliar sounds and take them for Russian words. Firstly we asked a friend of ours who knows Arabic to listen to the fragment and tell us if he heard Arabic words.

Then he asked several Arabs (not people who know Arabic but actual native speakers) to listen to the part of the video and tell what they heard. Here’s the result we got:

We believe we hear the following shouts in Russian:

— Давай! (“Go/Come on!”)

— [unintelligible], many heard “Бросай” (“Throw!”)

— Ещё! (“More!”)

— Ещё давай! (“Come on, [give them] more!”)

As we hear these shouts, the video shows armed men standing far away behind a half-destroyed wall:

After every “[give them] more!” shout we can clearly hear double shots, probably made by someone following those orders. We asked our readers to listen to these shots and suggest what weapon they could be coming from. Everyone unanimously came to a conclusion we share as well: we hear the shots of a 30-mm 2A72 cannon installed on a “BTR-82A” APC. As a reference example you can listen to a video from Russian Defense Ministry TV channel “Zvezda”. At timestamp 1:59—2:07 you can hear identical shots from a BTR-82A’s 2A72 cannon:

https://youtu.be/pvKnh5Rgf1g?t=1m59s&w=853&h=480

We conclude that the shouts we hear on the video are related not to the armed men behind the half-ruined wall but to the BTR-82A: we hear orders to the APC’s gunner who is shooting his cannon.

Summing up: in the video we see a quite rare “BTR-82A” APC with color scheme and number characteristic of Russian military units. Moreover, this APC has a Russian-speaking crew.

Footage location

The video’s title describes it as fighting close to Latakia. It also says it was shot on August 23. On that day, an independent organization “Syrian Observatory for Human Rights” (SOHR) published dispatches confirming fighting close to Latakia:

Other SOHR dispatches on fighting close to Latakia on August 23:

• http://www.syriahr.com/en/2015/08/clashes-continue-in-latakia-mountains-and-rebel-battalion-target-the-countryside-of-hama/

• http://www.syriahr.com/en/2015/08/violent-clashes-continue-in-lattakia-countryside/

• http://www.syriahr.com/en/2015/08/the-clashes-renew-in-lattakias-mountains-and-shells-target-the-capital/

To understand the situation in the region we can refer to a current situation map.



Black circles represent ISIS. Yellow circles are Kurdish troops. Red circles are Assad government troops. Green circles are rebels. Grey circles are Jabhaat al Nusra, a “local franchise” of Al Qaeda.

Anti-Assad forces are rapidly gaining ground: In March Assad lost Idlib (numbered “1” on the map), in April — Jisr al-Shughur (numbered “2”). Latakia is of extreme strategic importance as Syria’s largest port. To Latakia’s south there’s Bassel Al-Assad International Airport (link to map), which at the same time is a military airbase (marked with a fighter jet icon on the map).

Should Assad lose Latakia, he’d soon lose that airbase, and from there it’s quite a short road to Tartus.

Russian jets in Syria’s skies?

Several days later, on September 2, photos appeared on social networks allegedly showing Russian fighter jets and an UAV flying over western Idlib. The authors noted that the photos were posted by an account associated with Jabhaat al Nusra (Al Qaeda’s Syrian “franchise”, grey circles on the situation map). The author did not specify what was meant by “Western Idlib”. The city of Idlib is the capital of Idlib Governorate (region).

In the first photo we see what looks like a Russian recon UAV Pchela-1TRU (or its visually identical predecessor, Shmel-1RU):

Comparing to existing Pchela-1T photos, we can confirm it is indeed seen in the Jabhaat al Nusra photo:

According to the UAV’s manufacturer’s official specificationRU, its radius is 60 km. If we draw a 60km radius circle from the center of Idlib (city) , none of government-controlled airbases would fall into that radius: circle map tool link or screenshot:

But if we move the circle’s center to the western border of Idlib governorate (which could be meant by al Nusra’s message), say, closer to Jisr al-Shughur and the battles between government troops, rebels and al Nusra, the circle would cover the Latakia air base:

Given that Pchela-1T requires a bulky launch vehicle (on a tracked or truck chassis), it would seem logical to launch the UAV right from that airbase. Moreover, Russia has previously used that airbase to unload both humanitarian supplies (video) and military cargo: Reuters sources told in January 2014of delivering Russian military hardware including UAVs to the Latakia airbase.

Together with the Pchela photo, images of three fighter jets were published. The images’ quality is too poor to conclusively identify the fighter jet’s model. The images show only jet wing silhouettes, which are almost identical for several different models. Nevertheless, below we show the three images published with suggestions (not ours, but spread through blogs and media) on the jets’ models as well as examples of close-up images of these fighters.

Presumably a Sukhoi Su-34 (Fullback):

(by Dmitry Barashev and Dmitry Chushkin)

Presumably a Mikoyan MiG-29 (Fulcrum):

Presumably a Sukhoi Su-27 (Flanker):

We repeat that the images’ quality makes it impossible to conclusively identify the models. All the three jets shot could be MiG-29s operated by Syria’s Air Force. Here’s an image example which shows how similar the three fighter jets are:

However, all the jets were photographed together with a Pchela-1T UAV.

Summing up: The Syrian government is losing territory. Its enemies captured Idlib and Jisr al-Shughur in Spring, coming close to strategically important Latakia. Latakia is Syria’s largest port. Near Latakia there’s an air base where Russian humanitarian aid and military cargo has been unloaded. In August, a video of fighting near Latakia shows a Russian “BTR-82A” APC, obviously shipped to Syria not from the factory but from a Russian military unit (see color scheme and number). What’s even more interesting, the APC has a Russian speaking crew. Several days later, in the skies over Idlib governorate (bordering Latakia governorate) a Russian Pchela-1T UAV is spotted. Simultaneously, three unknown fighter jets are spotted in the same area, their silhouettes resembling MiG-29 / Su-34 / Su-27. The area where “Pchela-1T” was spotted and the UAV’s radius prove this UAV could have been launched from the Latakia airbase.

Are Russian troops in Syria?

To the south of Latakia lays the port city of Tartus. Since 1971 Russia has had a naval base in Tartus. Actually, not quite. This is not a base, but a “Russia’s Navy Forces sustainment center #720“. The difference lies not only in the name. This depot has always been used only for ship repairs and resupply with fuel, water and other consumables. Tartus has never been an actual base, i.e. an installation with continued Russian troops and hardware presence. Another fact showing just how small this installation is: until recently, it was manned by a staff of 4 (four) Russian military seamen. This last number is especially important in the context of the photos we will show below.

In 2010 talks circulated of modernizing the depot and turning it into a bona fide naval base, but in 2011 Arab Spring and the Syrian civil war happened, radically changing the plans. Recently many pro-Kremlin commenters have said that we’ve had lots of troops there helping the Syrian government. Actually, this is not true. Since the start of the Arab Spring, Kremlin became a lot more cautious. In 2013 both military and civilian Russian staff was evacuated from the base, according to Russian deputy Minister of Foreign Affairs Mikhail Bogdanov. This was done to make sure no incidents involving Russian personnel would happen during the Syrian civil war. Moreover, Mikhail Bogdanov stressed that the Tartus depot had no strategic or military importance. The Russian advisors and instructors (the ones pro-Kremlin blogers love bragging about) were withdrawn as well.

Why did the strategy turn around. why did Tartus become strategically important and why did out troops re-enter it (as we show in the post below), risking “incidents with Russian troops”? We believe the reason was realization that Syrian government can’t stand on its own and will soon lose both Latakia and the airbase close to it, and then Tartus.

On August 26 media told that a Russian delegation arrived to Tartus to meet Syrian army representatives and agree on technological cooperation including providing satellite imagery. This indirectly confirms that the Pchela-1T UAV was identified correctly and used by Russian operators. A satellite (if it’s not geostationary) can’t take a picture of a required location at any moment and immediately transmit it, and the changing situation on the ground requires frequent and readily available images. The obvious way out is using UAVs. Below we will also prove that Russian military vessels did arrive to Tartus on August 26.

Wives are a spy’s best friend

Yuri Artamonov

Recently we were prompted with a link to a women’s forum where a girl complained about his husband being sent to Syria for a long period (3-8 months) and said she was worried about him.

As we knew that Tartus has a Russian naval depot and he wasn’t necessarily sent straight to war, we tried to learn the details from the girl (she could have been exaggerating her husband’s words). We created a fake account and asked Yulia to clarify the information, and she did:

She said her husband was sent to “guard an airport“, which is another indirect confirmation of our Latakia airbase hypothesis.

We found Yulia’s social network profile and from there — the profile of her husband, Yuri Artamonov (saved copy). The fact that Artamonov is an active Russian serviceman (marine) is supported not only by Yulia’s forum post, but also with numerous Instagram photos:

Konstantin Ditrikh

As we looked through profiles of Artamonov’s friends and their groups, we found Konstantin’s profile (saved copy). In the profile we noticed a recent photo showing loading the “Caesar Kunnikov” large landing craft (#158), signed “Off to Syria again“:

UPDATE (Sept., 7): As it turns out, this photo was originally posted on December 17, 2014. It’s quite probable Ditrikh used an older photo to illustrate his new voyage, given the status “off to Syria again”. Source.

His photo shows about 300 servicemen with full backpacks. On Caezar Kunnikov’s deck there are military Tigr cars and Kamaz trucks, a tanker truck and a medical vehicle. Other vehicles may be in the landing craft’s lower hold. Here’s Konstantin’s picture with a paper showing Caesar Kunnikov landing craft and congratulating him with his marine inauguration:

Yesterday Konstantin also noted that media reported Russian vehicles moving towards Syria (the article he cited concerns Nikolai Filchenkov landing craft — later we will present proof both these ships did go to Syria one after another.

Konstantin’s profile says he is a member of the group of military unit 56529-4 (Vladivostok):

Anatoliy Golota

While searching for more marines, we found Anatoliy Golota whose status says “Off to Syria :))“:

Anatoliy’s vk.com profile says he is a member of groups dedicated to 810th separate marine brigade (military unit 13140, Sevastopol, Crimea). Anatoliy’s profile also shows his photos in front of the brigade’s vehicles. In this photos we also can see the brigade’s tactical marking — a white diamond.

On an image from turkishnavy.net (more on that later) we can see Nikolai Filchenkov landing craft passing the Bosphorus straight on August 22. Let’s have a closer look at a military Kamaz truck; recognize anything?

This means that in the August 22 images we see Nikolay Filchenkov large landing craft with 810’s separate marine brigade vehicles on deck. As we know from Anatoliy’s status, they’re “off to Syria”, and the images show Nikolay Filchenkov passing the Bosphorus south in the direction of Syria.

Anatoliy served his draft time in a separate operative internal troops division of the Russian Ministry of Internal Affairs:

After serving his draft term, he signed a contract with the 810’s marine brigade (military unit 13140):

Maxim Mazhnikov

After Anatoliy Golota we started searching for other profiles of the 810th marine brigade and found a contract soldier from it, Maxim Mazhnikov:

We immediately noticed his profile picture: He is standing in military uniform and with a gun on a landing craft’s deck with the Bosporus bridge seen in the background. He uploaded this picture on March 29, 2015. But the photos he uploaded on August 22 are of way more interest. Some of them have been taken in Syria:

There are also fresh photos from the landing craft’s deck taken while passing through the Bosporus:

Bosporus bridge in the background:

Maxim’s profile shows that he’s been a contract soldier in the same 13140 military unit (810th separate marine brigade) since 2006:

In a vk.com group dedicated to the city of Vladikavkaz we found another message. A Vladislav Ivanov wrote contract soldiers were being sent to Syria:

Vladislav’s profile shows he’s from the same 810th marine brigade:

Are photos of Russian marines in Syria sensational or groundbreaking?

A lot of photographs of Russian soldiers posing in Syria with weapons have been posted recently. But until these photos show them taking part in actual fighting (which they don’t), they aren’t anything sensational, new or scandalous. Saying that Russian troops are fighting in Syria based on these photos is quite a stretch, to say the least.

We remind that Tartus hosts a Russian naval depot (not a naval base, this is a different thing), so Russian soldiers can move into that depot, walk around it with weapons and take pictures (almost all the photos published recently have been shot in Tartus). During our investigation we’ve found lots of images of Russian soldiers in Tartus dated June, March and even February 2015. Moreover, some images from early 2015 show Russian draftee soldiers there.

Currently the large number of Russian soldiers in Syria indicates only a sharp change of approach and moving troops to Syria (not necessarily for combat operations). I.e. until 2013 the whole staff of the depot was 4 people, then they got evacuated so that there would be no incidents involving Russian military that could lead to escalation (which is why you can’t find Russian soldiers’ photos from Tartus earlier than 2015), but since spring 2015 the depot suddenly became strategically important (despite earlier statements to the contrary) and became a staging ground for Russian troops. More importantly:Unlike early 2015 or before, it’s contract soldiers that are getting deployed to Tartus, and for longer periods at that (from 3 to 8 months). Earlier this year or before we could see draftees on Tartus pics, the photos clearly showing they came for a very limited period of time – probably for servicing a vessel. Now you can’t find draftees on Tartus pics.

Why are Russian troops being moved to Tartus?

Why did Tartus suddenly become so important? The conflict’s escalation risk has now become a lot less important than the possible loss of Tartus and a future fall of Assad’s government due to military defeat. For Putin it is especially important not to allow the loss of Latakia and maintain Assad’s control over it. Should Assad lose Latakia, he’d also lose the airbase near it and the fighting would move to Tartus. In that case, Russia would have to fully commit to fighting to defend the Tartus depot.

We believe actual (naval) infantry is used for two purposes:

1) strengthen the Tartus depot and prepare for the worst-case scenario above;

2) guard the Latakia airbase used to launch Russian UAVs and probably Russian jet fighters.

We believe Russian infantry currently doesn’t take part in actual fighting. Another matter is heavy vehicles with heavy weaponry and their crews. We believe Russian servicemen in military vehicles are taking part in the fighting since Putin realizes Assad won’t hold Latakia on his own. It seems better to stop anti-government forces at Latakia than resort to infantry combat at Tartus and suffer considerable losses. An example of such participation in the fighting is the Russian-made “BTR-82A” APC #111 with a Russian-speaking crew. There is no conclusive proof yet that this APC is manned by active Russian servicemen. That the Russian vehicles taking part in the fighting have Russian soldier crews is but a hypothesis based on several indirect indications.

Pavel Felgengauer, Russian Novaya Gazeta’s military expert, has given a comment to The Telegraph to pretty much the same effect:

What information needs to be found

It is important to prove that Russian vehicles crewed by Russian soldiers are taking part in the fighting. Armed Russian soldiers being in Syria is not a sensation per se, because thanks to the Tartus depot Russian servicemen may go there and take selfies.

It’s important to find the #111 BTR-82A in images from Russa. As we’ve found out before, currently 810th separate marine brigade from Sevastopol is being moved to Tartus. A photo shows Nikolay Filchenkov large landing craft passing the Bosporus straight with military vehicles on deck bearing tactical markings of the 810th marine brigade.

Does 810th marine brigade have BTR-82As with this camo scheme?

While searching for information we found that the 810th marine brigade started receiving BTR-82As last year, but they don’t appear in routine army service photos: these only show older BTR-80s (in another color scheme). However, during parades, competitions or maneuvers (more) we can see BTR-80s with the same camo as the one spotted in Syria,

as well as BTR-82As (photo from a 810th brigade serviceman’s profile):

Turkishnavy.net blog regularly features photos (taking by local photographers) of military vessels passing the Bosporus and giving the direction (southbound/northbound) and strait passage date. They also have a table for summer 2015 showing which ships went through the Bosporus and when. If we leave only Russian ships in the table, we will see the following picture:

The red rows indicate a southbound vessel (i.e. in the same direction as Syria but not necessarily there). The black rows indicate a vessel moving north (in the direction of Russia). This table also corresponds to the news that on August 26 Tartus received a Russian military delegation that struck a technical aid deal with Syrian government troops.

Navy spotters say that during 2015 Russian vessels have made about 40 voyages to Syria.

Final conclusion

Since 1971, Russia has had a naval depot in Tartus, Syria (once again, not a naval base), Since the fall of the Soviet Union, the depot hasn’t been particularly important. Russian vessels visited it for service from time to time. The depot was manned by a total of four Russian servicemen. In 2010, Russian government pondered over turning the depot into a full-blown naval base, but in 2011, Arab Spring and Syrian civil war happened. To be on the safe side, in 2013 all the Russian staff, including civilians, was evacuated from the depot. Later, in comments to the press, Russia’s deputy foreign minister Mikhail Bogdanov said that the depot had no strategic or military importance and all the Russian servicemen and civilian staff had been evacuated to Russia to avoid risks to their lives and escalating the conflict. Among the evacuees there also were military advisors.

In spring 2015, government troops suffer huge defeats close to Latakia, losing Idlib in March and Jisr al-Shughur in April. Latakia is strategically important for Assad: this is Syria’s largest port, and close to it there is an international airport/airbase, where both Russian humanitarian aid and military hardware have been unloaded. To the south of the airbase there’s Tartus, housing Russia’s naval depot.

Due to this threat, a quick shift of Kremlin strategy occurs: the Tartus depot suddenly becomes important for Russia once again, talks are renewed of turning it into a bona fide naval base, Tartus sees an influx of military vehicles and Russian soldiers. The Tartus depot used to house but 4 Russian seamen servicing it. Now it has hundreds of soldiers and heavy vehicles.

In late August, fighting close to Latakia goes on. Combat footage captures a Russian-made BTR-82A with a color scheme and number characteristic of Russian military units. As the APC is shooting, we can hear orders to the gunner in Russian. Several days later, in Western Idlib governorate, Jabhaat al Nusra (Al Qaeda) spot a Russian Pchela-1T UAV. 3 fighter jets are also spotted there, believed by many to be Russian.

Meanwhile, posts appear on social networks about contract soldiers being sent to Tartus (while in early 2015 draftees went to Tartus as well) for long periods from 3 to 8 months.

Based on all of the above, our team believes that currently Russian marines have been moved to Syria to guard and strengthen the Tartus depot as well as the airbase close to Latakia. We believe infantry does not take part in the fighting. However, we believe that Russian vehicles with Russian crews do go into battle. Support is also rendered at least by Russian UAVs.",2015-09-07,Are there Russian troops fighting in Syria?
2016,1,https://www.bellingcat.com/news/mena/2016/01/29/iran-isoico-imagery-update/,/news/mena/2016/01/29/iran-isoico-imagery-update/,"

The latest commercial satellite imagery shows some new developments at Iran’s ISOICO shipyard near Bostanu. In December, the extension on the yard’s smaller syncrolift appeared complete with new winches and a larger platform visible in imagery. Workers in the eastern part of the yard should now be able to handle heavier vessels. This may be useful as the shipyard appears to be building one of the country’s Mowj class boats. The hull of the ship appeared on the transverse table back in August 2013 and has subsequently been observed on handhelds in the fabrication shop.

The Kharg (431) replenishment ship, which has been berthed at the shipyard since November 2014, exited the floating dry dock. Given the clutter still observed on the deck, it may not depart the shipyard anytime soon. When it does however we expect it will return to its previous home port at Bandar Abbas. The Kharg, operated by the Islamic Republic of Iran Navy, is the largest Iranian military vessel by tonnage.

No significant activity was noted in the yard’s new dry docks, though additional leveling around the area was underway. The completion of the dry dock is thought to be associated with a new joint venture created between the yard and South Korea’s Hyundai Heavy Industries. The Iranian press also reported in December that it would look to build partnerships with Germany’s Nordic Yards Wismar, among others.

Other notable developments include the arrival of Iran’s Kilo submarine. The Kilo, berthed near the eastern fabrication shop since October, is an unusual sight at the shipyard. Typically, Iran conducts routine maintenance and in the past has overhauled the diesel-electric boats over at Bandar Abbas. The appearance of the submarine at the shipyard could suggest a more serious problem. Unfortunately, we will have to await future imagery for more insight.

Iran’s two other Kilo, located at Bander Abbas, have departed the dry docks as of 27 December 2015, just in time for Velayat 94.

Beyond military, we also noticed that two of Iran’s oil and gas rigs departed the shipyard possibly in preparation for Iran’s “Implementation Day”. With economic sanctions lifted, Iran plans to bolster production within six months to over 1 million barrels per day. Given the crude glut and low oil price, watching Iran develop an export strategy should be interesting. Comments made to the press suggest Iran will continue the various oil-for-goods bartering relationships and potentially acquire interests in refineries in India, Brazil and Spain. The latter, if successful, should help maintain and increase crude exports abroad.",2016-01-29,Iran ISOICO Imagery Update
2016,1,https://www.bellingcat.com/news/mena/2016/01/28/syria-new-iranian-drone/,/news/mena/2016/01/28/syria-new-iranian-drone/,"

Iran has sent another model of drone to northern Syria, according to imagery posted on social media in the latter half of 2015. Pictures of wreckage taken inside Syria indicate that Turkey shot down the unmanned aerial vehicle (UAV) in a May border incident in which Turkish officials claimed the aircraft violated Turkish airspace. The drone also appeared over the southern suburbs of Aleppo in October as a Syrian offensive, backed by Iranian ground troops and Russian jets, was underway in the province, according to a photo posted to Facebook.

The aircraft in the imagery is an Iranian tactical reconnaissance drone with a V-tail and rotary engine in a pusher configuration, resembling a smaller version of the Islamic Revolutionary Guard Corp – Aerospace Force’s (IRGC-AF) purported medium altitude long endurance Shahed-129 drone. In contrast to the boastful publicity Iran often lavishes on the drones it produces, Iranian officials have revealed relatively little about the drone, leaving few clues about its specifications or even its name.

The pictures from Syria match an Iranian drone seen in photographs of a crash in Saravan, Iran in February 2014. Iranian television has broadcast footage of UAVs which appear to be the same or slight variants of the model seen in Syria, but photographs from the Saravan crash remain the best available source of reference imagery for identifying the drone.

Iranian military forum posters have referred to the Saravan drone as the “Shahed-123,” a plausible designation, but drawing firm conclusions about the drone’s name or capabilities is difficult in absence of further information from Iranian officials.

Turkey Wreckage

On May 16, a Turkish F-16 flying out of Incirlik Air Base shot down an aircraft it accused of violating Turkish airspace near the Cilvegozu border crossing with Syria. Turkey’s Prime Minister Ahmet Davutoğlu and Defense Minister İsmet Yılmaz claimed it was a Syrian helicopter. However, a subsequent statement by the Turkish Armed Forces referred only generally to the downing of “a Syrian aircraft.” Syria rejected the assertions of a lost helicopter, claiming instead that it had lost a drone in the incident.

Pictures of the wreckage posted on Twitter and in news outlets support Syria’s claim that the aircraft shot down was a drone, given the lack of a recovered pilot, alive or deceased, and wreckage inconsistent with a helicopter.

The wreckage and Syria’s contention that it lost a drone in the incident further narrows the pool of candidates for the aircraft, as Syria’s UAV fleet is comprised mostly of Iranian drones, with the notable exception of Soviet-era Tu-143 Reys. Two photographs taken in Syria where the wreckage of the aircraft landed reveal an engine cowling, rotary engine, V-tail stabs and a landing skid that are consistent with the components seen on the “Shahed-123” drone which crashed in Saravan, Iran.

Engine Cowling

Two pictures taken at the scene of the crash in Syria show a metal cowling atop a rotary engine from two different angles — one showing the cowling as it appears from the rear of the aircraft and the other lying on its side.

Zooming in on the second picture and turning it upside down offers a clearer view of the cowling as it would appear looking at the starboard side of the aircraft.

A number of similarities are apparent when compared to the engine cowling on the Saravan “Shahed-123.”

The cowling in both the Syria and Saravan pictures have the same shape with an inlet that rises above the fuselage to allow air to reach the engine. Each has a seam that runs along the side of the engine, splitting the covering into top and bottom pieces held together by bolts.

The cowlings on both aircraft also have serial numbers in roughly the same position. The Saravan Shahed has a three digit serial number painted both above and below the seam where it meets the aircraft’s rear fuselage. In the Syria picture, the lower half of the cowling is missing, but the number 8 is visible. The number is painted above the seam in approximately the same place as the Saravan imagery, albeit to the left of a bolt hole rather than above it. The area to the left of the number is slightly discolored, suggesting scuffs or scratch marks that may explain the single vs. triple digit discrepancy in serial numbers seen in the two images.

Engine

Both the aircraft wreckage in Syria and the Saravan aircraft show a rotary engine in a pusher configuration that is consistent with another apparent source of “Shahed-123” reference imagery: a November 2014 Iranian TV program highlighting Islamic Revolutionary Guard Corps annual military technological achievements. The broadcast shows workers assembling a UAV, with an upsweep on the rear fuselage, a two-tone paint scheme and yellow prongs for attaching V-tail stabs that are all consistent with a “Shahed-123.”

The November 2014 program shows workers testing out a rotary engine and attaching it to the rear fuselage of the UAV in a pusher configuration.

V-tail Stabs and Landing Strut

The two photos of the Syria wreckage where the engine is visible also show an elongated rectangular plank lying at a roughly 45-degree angle relative to the rear fuselage fragment. The shape and placement of the object is consistent with a V-tail stab that may have broken off on impact with the ground.

Another picture from the scene of the crash in Syria shows men carting away pieces of the aircraft wreckage, including, as some noted on Twitter at the time of the crash, curved piece of metal. The size and shape of the object is consistent with the curved struts on the landing skids of the Saravan “Shahed-123.”

Aleppo Image

Five months after the incident along the Turkish Syrian border, Syrian opposition new outlet Halab Today TV published an image on its Facebook page along with a description saying the picture showed a “drone that belongs to the regime and its allies in the sky of the southern side of Aleppo suburbs.” The drone in the Facebook picture matches the “Shahed-123,” with the same metal landing skids, V-tail and general shape seen in the Saravan imagery.

Designation and the Shahed Family of Drones

Some evidence supports the claim offered by Iranian military forum posters that Iran has designated the drone seen in Saravan and, by extension, Syria as the “Shahed-123,” placing the aircraft within Iran’s better-known Shahed family of drones.

First, the name matches the 12X format of Iran’s Shahed family of UAVs, which is comprised of three officially-designated members. The Shahed-129 is the most famous of the family, which Iran claims is capable of firing Sadid air-to-ground missiles. Iranian media has also acknowledged two other Shahed UAVs: the Shahed-121 and Shahed-125.

As Oryx noted in an inventory of Iranian weapons, Iranian media aired video of the Shahed-125, which resembles the U.S. RQ-7 Shadow drone, at an August 2014 defense exhibition in Iran. Confirmed imagery of the Shahed-121, despite IRGC-AF chief Brigadier General Amir Ali Hajizadeh claiming its presence the “Towards Jerusalem” exercise in November 2015, is not yet evident.

Second, a photograph posted to an Iranian military forum suggests that Iran produced a drone with the name “Shahed-123.” In 2010, a member of the military.ir forum posted a picture of a chart titled “UAV manufacturing” purportedly taken at an Iranian aviation museum showing production numbers for different models of Iranian military UAVs in the Iranian calendar years 1384 and 1385 (corresponding to March 2005 through March 2007). Among the models listed are a “Shahed-123,” three of which were produced as of March 2007 according to the chart.

Until firmer evidence linking a name to images of the UAV appear, the “Shahed-123” designation remains speculative.

Other Sightings of “Shahed-123”-like UAVs in Iranian Media

Iranian television has run footage of a number of UAVs since 2012 that look similar to the “Shahed-123” but the limited, often blurry and distant footage combined with Iran’s generally murky drone nomenclature makes it difficult to say whether they represent slight variants of the “Shahed-123” or entirely different, as-yet unidentified models.

Early July, 2012 : Iranian television teases video of a number of UAVs which Iran hasn’t yet been officially rolled out, including the Yasir and the Shahed-129. Two drones similar to the “Shahed-123” are visible in the program, one with landing skids and another model which resembles a “Shahed-123” with tricycle landing gear instead of metal skids. [Photos via Uskowi On Iran blog]

March 11, 2013 : The Aviationist runs a story on a photograph reportedly showing IRGC troops placing an unidentified drone fished out of the waters near Jask, home to an Islamic Republic of Iran Navy base, onto the back of a pickup truck. Seaweed and mud obscure much of the UAV, but the size, V-tail stabs, metal landing skids and engine in a pusher configuration all point to a “Shahed-123.”

May 11, 2014 : The IRGC-AF holds an exhibition attended by Supreme Leader Ayatollah Ali Khamenei, showing off a number of the service’s aircraft and equipment, including Iran’s alleged copy of the U.S. RQ-170 drone. Iranian news sites report that the Shahed-121 and Shahed-125 drones were present at the exhibition. Iranian military forum members also notice a handful of UAVs similar to the “Shahed-123” in the background of footage from the exhibition.

November 2014 : The aforementioned November 2014 Iranian TV program featuring a “Shahed-123” under construction also runs footage of two other, similar UAVs featuring tricycle landing gears instead of metal skids. The first one, painted with the colors of the Iranian flag, is shown with a piece of fairing covering the junction between the wings and fuselage and a second appears without the fairing but sporting a more pointed nose.

September 2015: Iranian television runs a documentary on Iranian aerospace technologies, which includes a shot of UAV looking much like the Saravan “Shahed-123” shortly after taking off. The presence of an apparent launch rail in the background as the drone becomes airborne suggests that it may be capable of taking off from a mobile launcher, either by catapult or or jet-assisted take off, as a number of other Iranian drones are.",2016-01-28,"Syria's ""New"" Iranian Drone"
2016,1,https://www.bellingcat.com/news/uk-and-europe/2016/01/27/osint-research-methods-utilized-in-ukrainian-corruption-investigation/,/news/uk-and-europe/2016/01/27/osint-research-methods-utilized-in-ukrainian-corruption-investigation/,"

On January 23, the 112 Ukraine television channel aired an investigation into a former Ukrainian prosecutor who, among other things, reportedly purchased a Ferrari for his 13-year old son. This former prosecutor, Aleksandr Nikolayevich Bondarenko (Oleksandr Mikolayovich in Ukrainian), was appointed during the years of Viktor Yanukovych’s presidency in Ukraine, and was lustrated in late 2014. Bellingcat provided support to the investigators of 112 Ukraine, led by Julia Makarenko, in researching the lustrated ex-prosecutor via open source intelligence (OSINT). In conjunction with a wide-ranging use of open source research methods, 112 Ukraine used traditional investigative journalism to follow up leads. Much like a previous Bellingcat post on OSINT methods used by Aleksey Navalny’s FBK group, this post will explore the open source research techniques employed by Makarenko and her team at 112 Ukraine in their investigation of the assets of the seemingly corrupt ex-prosecutor and how this research can complement traditional investigative methods used in newsrooms across the world.

The subject

The subject for the investigation is Aleksandr Bondarenko and his assets. As seen on the Ukrainian Ministry of Justice’s lustration website, Bondarenko was subject to lustration in late 2014 and is described as an employee of the general prosecutor of Ukraine. His job duties included, among other things, combating corruption and crime in the transportation department of the general prosecutor’s office.

While Aleksandr Bondarenko himself does not maintain any detectable online presence, his actions did leave a footprint, along with the social media profiles of his family members.

The Ferrari

The investigation was triggered by an very obvious clue: a shiny, red Ferrari outside of the Monacco (Монако) restaurant in central Kyiv. The photograph was taken in October 2014 and provided by an anonymous tip to the television station, providing an opportunity to employ OSINT in conjunction with traditional investigative journalism.

112 Ukraine used geolocation to confirm the location of the Ferrari in question. On Wikimapia, a reference photograph for Monacco provides sufficient details to match to the Ferrari photograph:

Thus, the 112 Ukraine investigators were able to confirm that the Ferrari was indeed in Kyiv, at approximately 50.4562668, 30.5128017.

Red Ferraris are not a common sight in Kyiv, and some online research revealed some interesting information for the 112 Ukraine journalists. Another Ferrari with the exact same color scheme was photographed elsewhere in 2015 on the Auto Gespot site (archive), with the license plate ZAKHAR (ЗАХАР)–the name of Aleksandr Bondarenko’s 13-year old son who, according to the anonymous tip that spurred the investigation, received the Ferrari as a gift. The Ferrari evidently underwent a Mansory modification, making it even rarer and more identifiable on the streets of Kyiv.

Further investigation reveals that a Ferrari with the same color scheme and Mansory modifications crashed in Kyiv in 2012. A few stories were written at the time about it, and a video surfaced on RuTube showing the aftermath of the damaged car:

While this open source research alone cannot confirm a link between the crashed 2012 Ferrari and the 2015 Bondarenko Ferrari, 112 Ukraine followed up by conferring with an automotive body expert, who examined the damages and repairs to determine that the Ferraris from 2012 and 2015 are indeed the same.

The Rolex and Maldives

112 Ukraine was able to obtain the 2013 financial declarations of Aleksandr Bondarenko, revealing that his official salary is about 300,000 UAH per year (approximately $37,500 before Euromaidan, $19,000 when Bondarenko was lustrated). While this is a quite respectable salary for a government official in Ukraine, it cannot explain the expensive lifestyle that his family maintained. Suspiciously, Bondarenko claimed that his family makes almost a million UAH per year (approximately $125,000 pre-Maidan, $63,000 during lustration), even though 112 Ukraine was not able to find any evidence that Bondarenko’s wife, Karina, held any employment, let alone would bringing home more than double Aleksandr’s declared income. Open source research revealed further information about the luxury goods disproportionate with the declared income of the Bondarenko family.

While Aleksnadr does not maintain an online presence, his wife Karina actively uses Odnoklassniki (OK), a popular Russian-language social network site. She has deleted her OK profile since the 112 Ukraine investigation aired, but archived copies still exist via Archive.is. Many of the photographs that she posted on her profile show her wearing luxury watches, allowing 112 Ukraine to match it against various luxury brands until a match was found. A match was found for one of these watches, revealing that it is a Rolex from the Cosmograph Daytona series.

This open source research finding was confirmed by a timepiece expert, who was interviewed during the television program. He valued the watch, assuming it is not a counterfeit, to be at least $37,000–approximately the same as Aleksandr’s declared salary.

Karina also posted numerous vacation photographs on her OK page, spurring 112 Ukraine to geolocate the vacation destination, and consequently find out an average price for such a vacation. One image on the OK profile was particularly useful: a snapshot of a resort island from a small airplane, posted in October 2014.

The island has a few particular features that could be seen from a satellite map: at least two long docks on the ends of the island, including numerous branches on the one visible on the far right, a handful of buildings on the left part of the island, and another island towards the top of the frame. The Maldives is one of the most popular vacation destinations for Russians and Ukrainians, so it was a logical place to start searching. However, there are hundreds of islands throughout the atolls, with dozens of lavish resorts scattered throughout, leading to a tedious Google Earth search for the right slice of paradise resembling Karina’s picture. After a few days, the 112 Ukraine investigators found a matching island–Rangalifinolhu, located at 3.617005, 72.715106.

With a confirmed geolocation in hand, 112 Ukraine was able to confer with a travel agent to determine a flight to the Maldives runs around $6,000 for two people–about a third of Aleksandr Bondarenko’s declared salary when he was lustrated.

The house

Lastly, open source research led 112 Ukraine to the Bondarenko’s most expensive asset: a large house with somewhere under a half-acre of land. Looking through Karina Bondarenko’s photographs on Odnoklassniki, it becomes clear that the family has a house somewhere in a suburban residential development, judging by the modern design of the house, the spacious property, and the neighboring house’s similar architectural style.

112 Ukraine accessed the public directory of property ownership in Ukraine (semi-open source, as full access is only available by providing identifying information as a Ukrainian citizen) to search listings for Aleksandr Bondarenko. This search revealed that Bondarenko became the owner of about 0.16 hectares (0.4 acres) of land in the Kyiv suburb of Vishinka in September 2015. However, there is no exact address provided.

After knowing the layout of the property and the orientation of the paths, trees, fence, and structures from Karina Bondarenko’s photographs, it was now a matter of geolocating the house through brute force, just like finding the correct island in the Maldives. Eventually, 112 Ukraine managed to find what seemed to be the same property as seen in the social media photographs, located at 50.296711, 30.667546. The journalists at 112 Ukraine visited this location, flew a drone over the house, and confirmed that it is indeed the same as the one seen in Karina’s photographs. The security guards at the house were not receptive to the journalists’ arrival, and denied that Bondarenko owned the property.



Conclusions

This investigation from 112 Ukraine (with assistance from Bellingcat) exemplifies how open source research and verification can provide leads for on-the-ground investigative journalism. Their journalists used geolocation, public directory searches, message board posts, social media, and other open source resources to complement their traditional journalistic methodology of knocking on doors, conducting interviews, and working off of anonymous tips. In sum, they were able to discover, locate, and then calculate the wealth currently held by the lustrated ex-prosecutor Aleksandr Bondarenko. He owns numerous vehicles outside of the Ferrari, including a 2013 F-Type Jaguar, a 2008 BMW 740i, and a Land Cruiser driven by Bondarenko suspiciously registered to his mother-in-law. As reflected in both the open source evidence and investigative research, Bondarenko’s vehicles, property, and luxury goods far are disproportionate to his and his family’s declared income.",2016-01-27,A Ferrari for a 13-Year-Old Boy: OSINT Methods in a Ukrainian Corruption Investigation
2016,1,https://www.bellingcat.com/news/mena/2016/01/23/is-the-u-s-expanding-an-airfield-in-syria/,/news/mena/2016/01/23/is-the-u-s-expanding-an-airfield-in-syria/,"

Low resolution Landsat imagery shows new activity at an airfield rumored to support a U.S. military presence in Syria’s Al-Hasakah province. The imagery acquired via the U.S. Geological Survey suggests the U.S. could be establishing further supply lines to Kurdish and friendly forces in the region in the effort to fight the Islamic State.

Space snapshots from 12 December show an expanded runway at the airfield since 05 December. Measurements taken on low resolution imagery suggests the total length is nearly 1,350 meters, almost double the original 700 meters.

Rumors reported in the Lebanese press in December suggested the agricultural airfield would reach at least 2,500 meters (al-akhbar) (Now). However, that seems unlikely as probable paving activity appeared to be underway in imagery from 28 December. (This is suggested by the discoloration of the runway).

The airfield, located less than five miles southeast of Rmeilan, is also less than 10 miles northwest of the Yarubiya-Rabia (Tel Kocher) border crossing. It’s located in an area that’s been under the control of the Kurdish People’s Protection Units (YPG) since at least September 2013 when they took the territory from the Islamic State.

Rmeilan, an oil rich area, sits in defense of the Sweidiyeh Oil Field which is located northeast of the town. It’s part of territory held by almost 30,000 YPG fighters. Throughout 2015, YPG and associated forces took back major territory in eastern Al-Hasakah clashing with Islamic State. U.S. airstrikes helped support the fighters carrying out the offensive against the terrorist group.

By October, the U.S. began sending small arms and ammunition via airdrops to friendly groups in the region as a part of a new effort to increase the pressure and maintain hard-won gains.

It appears this airfield may be apart of those efforts. Unconfirmed reports from the group “Local Coordination Committees of Syria” suggest two helicopters carrying light ammunition and explosives landed on 17 January 2016 at the now, military airfield.

With a longer runway and improved surfaces, we suspect the airfield could become something more than just a supply point for regional forces. We’ll continue to look to future imagery for insight.

More Information",2016-01-23,Is the U.S. Expanding an Airfield in Syria?
2016,1,https://www.bellingcat.com/news/uk-and-europe/2016/01/16/russias-200th-motorized-infantry-brigade-in-the-donbass/,/news/uk-and-europe/2016/01/16/russias-200th-motorized-infantry-brigade-in-the-donbass/,"

The following post originally appeared on the Russian-language blog of the author, Askai707

Below is an English translation of the post (translated by Aric Toler), which concerns the direct open source evidence regarding the participation of the 200th Separate Motorized Infantry Brigade (military unit 08274) in the conflict in eastern Ukraine in the summer and autumn of 2014. The primary evidence for this, as presented below by Askai, is that the military equipment photographed and captured in video footage near Luhansk in 2014 were returned to their base in Russia in 2015, with the changed identifying features (yellow numbers, triangles) unchanged since their time in the Donbass. The second entry to this investigative series can be found here, and the third and final here.

In the fierce battles near Luhansk at the end of August 2014, Ukrainian soldiers and volunteers faced a group made up of various units of Russian military brigades. The 200th Separate Motorized Infantry Brigade (military unit 08275, Pechenga) was one of them. This post will given direct evidence of of the participation of units of the this Russian brigade from Pechenga in the war in the Donbass.

Going into the warzone in the Donbass, Russian military units paint over the signs of their tactical units on military equipment in order to avoid detection. Some military units apply temporary identification signs. This is done in order to minimize the chance of accidentally opening fire on one’s own combat vehicles in a situation in which the enemy has the same or visually similar military equipment. However, now it is possible to identify which Russian military units fought in Ukraine by the visible identification signs.

In the Armed Forces of the Russian Federation, like before in the Soviet Army, so-called tactical signs and hull numbers are applied to military vehicles in each military unit. Before the outbreak of hostilities in the Donbass, there was not a single tactical mark used for the whole 200th Separate Motorized Infantry Brigade. Instead, each unit used its own sign.

The first, second, and third motorized infantry battalions had their own tactical symbols (a circle, inverted equilateral triangle, and a circle within a square, respectively, all painted in white), and their own numbering sequences:

The tactical sign of the tank battalion of the 200th Separate Motorized Infantry Brigade was a white diamond within a square, formed by a white line:

An artillery installation of a 2S3 Akatsiya self-propelled howitzer of the artillery battalion of the 200th Brigade also has its own tactical sign:

Below is an example of the tactical sign of the anti-aircraft rocket-artillery battalion of the 200th Brigade, on the anti-aircraft complexes of a Strela-10 and a Tunguska.

In order to hide their participation in hostilities in the Donbass, these white tactical signs and hull numbers were painted over. In their place, new numbers and a tactical sign of a small triangle were painted in yellow. In some cases, the old numbers were painted over, but the new ones were not put on.

Obviously, the sequence of numbers has also been changed for reasons of secrecy. The numbers used on the hulls of the armored transporters MT-LB BMK, T-72B3 tanks, and anti-aircraft complexes Tunguska were unusual for the relevant units of the 200th Brigade, as they began with 7 and 8.

Below are examples of military equipment of the 200th Motorized Infantry Brigade with identifying yellow triangles, hull numbers, and similar markings (the full collection of available photographs will be presented in a later enumeration of indirect evidence of the brigade’s participation in the war in the Donbass).

The Tunguska complex carries many marks and a new yellow number, but they were not able to completely cover up the tactical sign of the anti-aircraft/artillery battalion of the brigade:

In place of the old hull numbers and tactical signs on the T-72B3 tanks, we can now see new numbers and a triangle tactical sign in yellow:

The yellow triangles and hull numbers on the Akatsiya howitzer and a BTR:

The armored vehicles with the identifying signs of yellow triangles actually belong to the 200th Separate Motorized Infantry Brigade, as demonstrated in the photographs below.

A serviceman registered on the Russian social network site “VKontakte” as “Tolik Kondrashov” made a post in March on his page. In this post, he published a crude poem about how life is horrible for a kontraktnik (contract soldier) in Pechenga, about the false promises of commanders, and about a trip to Luhansk with the goal of killing enemies and saving his Slavic brothers. The poem has little value when compared to the photograph below it.

On Kondrashav’s photo, a number of units of military equipment from the 200th Brigade are in a village called “19th Kilometer,” near Pechenga, where the unit is located. Dozens of vehicles have the yellow identifying triangles and hull numbers on the front side of the chassis. Also in this photograph is a MT-LB BMK with its “relatives” that is not adorned with white numbers and tactical signs.

The high resolution version of the photograph allows us to distinguish the yellow hull numbers on the BTRs: 786, 800, 804, 810, and 811.

It’s possible to identify the location of this group of military equipment with the use of additional photographs from social networks and satellite maps:

The MT-LB BMK is the main type of armored vehicle for the 200th Separate Motorized Infantry Brigade, which it uses for infantry transport. Up until Spring 2015, in the brigade we would find MT-LB BMKs with the conspiratorial yellow numbers that begin with 7 and 8, and yellow triangles. They were later painted over, and then carried the standard of the old numbers and a new tactical symbol for all of the units of a square with white lines.

Analyzing the accounts of the 200th Brigade servicemen on VKontakte allows us to find seventeen photographs of MT-LB BMKs with yellow numbers. The following list contains the yellow hull numbers on the MT-LB BMK with the original photographs hyperlinked and archives of the VKontakte pages where the photographs were found.

Additionally, the MT-LB BMK with the yellow hull number 805 and identifying yellow triangle was visible in media coverage of the training exercises of the coastal forces of the Northern Fleet in February 2015. The exercises were held at Kolsky Bay at Guba Gryaznaya in the Murmansk oblast’. In their training, servicemen practice amphibious landings with the MT-LB BTK numbered 805.

The screenshots below are from a video about the Northern Fleet’s training exercises from RT.

The very same vehicle numbered 805 is in a photograph on the news site SeverPost.ru.

The fact that these exercises were held at Guba Gryaznaya in the Kolsky Bay is confirmed by the common feature of certain buildings along the coast in a photograph on VKontakte and a photograph on Panoramio.

In the following photograph, it is easy to see both the yellow number 805 and the identifying yellow triangle on the hull of the MT-LB BMK chassis:

Thus, we have a photograph of the “yellow numbers” in a collection of military equipment in a village near Pechenga, numerous photographs with them on the social network pages of Russian servicemen, and photographs/videos of them in training exercises in the Murmansk oblast’. There is obviously more than just a mere connection between the 200th Separate Motorized Infantry Brigade of the Northern Fleet and the vehicles with yellow triangles and numbers on the front part of their chassis.

We will now consider the most direct evidence regarding the participation of this brigade in combat operations in the Donbass.

In early September 2014, a video was uploaded online that was shot from a vehicle on September 3, 2015 near a village Severo-Gundorovsky in the Luhansk oblast’. The video recorder took the GPS coordinates of the vehicle, by which we can establish that the beginning of the video is at 48.379461, 39.874896, headed northward. The vehicle stops at 48.380638, 39.875110, where we see a column of military equipment headed southward.

Ahead of the column is a camouflaged jeep ‘UAZ Patriot.” Until the moment when the video ends, we see the following vehicles pass by:

1 BTR-80

10 MT-LB BMK transporters

3 Strela-10 missile complexes

2 T-72B3 tanks

7 Ural trucks

2 KamAZ trucks

7 2B16 Nona-K artillery installations

Judging by the models of the military equipment (the T-72B3 tank, the modified MT-LB BMKs, the Nona-K), it is clear that this column is made up of vehicles from the Russian Armed Forces. The identifying signs on the MT-LB BMK are small yellow triangles, and there are yellow numbers on the front part of the chassis. These two features on the vehicles clearly point to the 200th Separate Motorized Infantry Brigade.

The quality of the video allows us to distinguish the following numbers on the MT-LB BMK vehicles: 775, 784, 785, 790, 791, 792, and 797. From these seven, which were already noticed in the previous list, we can find photographs of the MT-LB BMK vehicles with the yellow hull numbers 792 and 797 on the VKontakte pages of 200th Brigade servicemen.

Photograph from the account of Maksim Belozerskikh:

Additionally, see here (archive) for a second photograph of MT-LB BMK with the number 792 from Maksim Belezersky, and another photograph (archive) with resemblance to it on the page of “Zenka Nechayev,” another serviceman of the 200th.

The MT-LB BMK transporter with the yellow hull number 979 is in the photographs of a Russian serviceman registered on VKontakte under the name “Kolya Liba,” and also on the page of a serviceman under the name Yury Shcherbakov.

The pro-Russian channel ANNA-News happened to publish a video in September 2014 of armored vehicles from the 200th Separate Motorized Infantry Brigade. In the segment, in which the story is told of how the courageous “militia” of the Donbass liberated the Luhansk Airport from mythical Polish and Georgian mercenaries, we can see an MT-LB BMK in the fifth minute. The video tells of how there was the “removal of wounded militiamen from the airport.” The faces of the servicemen on the vehicle are hidden due to image blurring.

In fact, what ANNA-News showed was one of the Russian MT-LB BMKs of the 200th Separate Motorized Infantry Brigade. In the video, we can clearly see the yellow number 784 and the identifying triangles on the hull of the chassis, to the right of the armored door.

The MT-LB BMK with the number 784 was filmed in the northern edge of Luhansk at 48°28’44.9″N 39°21’44.2″E. This segment of the road can be viewed on Yandex Panorama (similar to Google Street View).

The MT-LB BMK with the hull number 784 can also be seen in the column near the village of Severo-Gundorovsky:

Other than the outskirts of Luhansk, we can also find photographs of the armored vehicles of the 200th Brigade at the Luhansk Airport.

An LNR fighter from Izhevsk, who is a member of the Vityaz’ Battalion, is registered on VKontakte under the name Pavel R. On September 3, 2014, he posted an album titled “Luhansk Airport 03.09.14” on his account. In this album, a variety of photographs of the Luhansk Airport are published. On two of them, we can see the MT-LB BMK vehicles of Russia’s 200th Motorized Infantry Brigade.

The photographs were taken in front of the facade of the airport’s building at 48°25’20.5″N 39°22’46.4″E. Alongside the army truck is a MT-LB BMK, on the front chassis of which we can see a yellow hull number.

Below is a comparison of the features of the photograph with a video from “Novaya Rus'” at the Luhansk Airport:

In a different photograph, we can see part of the right rear of the armored vehicle, where a small yellow triangle is visible:

We have also seen this mark on the majority of the MT-LB BMK vehicles of the 200th Brigade, including many of the vehicles at the 200th Brigade vehicle yard.

This photograph from Pavel P was also taken at the Luhansk Airport, at 48°25’22.3″N 39°22’37.4″E.

Additional confirmation of the location can be attained with some easily recognizable objects in the photograph (pipes and two large reservoirs) with the help of the video “IGCP. Luhansk Airport (30 September 2014) 18+.”

At the end of our survey of the direct evidence of the participation of the 200th Separate Motorized Infantry Brigade in military aggression against Ukraine, we have the photographs of the Russian serviceman Sergey Kalashnikov. Kalashnikov does not indicate that where he is serving in his profile; however, there is good reason to believe that he is a sergeant in the 200th Brigade.

In a photograph uploaded in April 2015, Sergey Kalashnikov is in a Russian military uniform with the chevron of the Northern Fleet:

In a photograph published in November 2014, Kalashnikov poses in front of a T-72B3 tank with the yellow hull number 830 on blocks of reactive armor on the right side of the turret. Additionally, there is a KMT-6 mine-clearing plow attached to the front of the tank.

Exactly one T-72B3 tank in the 200th Brigade in 2014 had the yellow number 830 on blocks of reactive armor plates to the right of the turret, and had such a mine-clearing plow:

In addition to the above evidence, Kalashnikov also uploaded a photograph of military equipment of the 200th Brigade with the identifying yellow triangles and photographs from the ruined Luhansk Airport. In these photographs, we can see elements of the MT-LB armored transporter chassis.

Thanks to the photographs on Kalashnikov’s account, we can find two other locations in the Luhansk oblast’ through which the military equipment of the 200th Motorized Infantry Brigade passed.

A column of military equipment of the 200th was in the village of Khryashchevatoe, which is near Luhansk and about ten kilometers from the Luhansk Airport. The photograph below was uploaded in November 2014, but was likely taken around the end of August or beginning of September.

At the head of the column is a camouflaged “UAZ Patriot” — just like in the video at the village of Severo-Gundorovsky.

This video was shot at the coordinates of 48°30’31.3″N 39°25’43.4″E. We can easily match elements of this photograph with those in the video “Road from Luhansk to Pridorozhnoe 14 September 2014.”

Archive: https://archive.is/pvNNm

Original: https://pp.vk.me/c622521/v622521959/8edb/5He0ptTiwiw.jpg

Below, we can see the highlighted objects in the area along with the direction of the column on a satellite map:

In the following photograph from Sergey Kalashnikov, a column of military equipment (MT-LB BMK and Strela-10) is moving through the city of Krasnodon along Artyoma Street (located at 48°17’18.0″N 39°44’19.1″E).

We can find the matching elements in the photograph with the help of the video “Trip to Krasnodon through Luhansk and ruined Novosvetlovka.”

Below, see the highlighted objects in the area and the direction of the column on a satellite map:

In this summary, we reviewed the direct evidence of the participation of the 200th Separate Motorized Infantry Brigade of the Armed Forces of the Russian Federation in military activities in the Donbass in the summer and autumn of 2014. The evidence was presented in the form of photographs and videos from open sources, including social networks, videos on YouTube, and reports in the mass media. Another selection of circumstantial evidence regarding to the 200th Brigade in the Donbass in 2014 will be presented in a second section, still to come.

Translator’s note: Bellingcat will publish the second part of this investigation soon after the author finishes his work.",2016-01-16,Russia's 200th Motorized Infantry Brigade in the Donbass
2016,1,https://www.bellingcat.com/news/mena/2016/01/15/did-russia-deploy-a-combat-robot-in-syria/,/news/mena/2016/01/15/did-russia-deploy-a-combat-robot-in-syria/,"

According to Sputnik and multiple Russian-language blogs, the Syrian Arab Army (SAA) recently deployed ten Russian combat robots in a battle in the Latakia province, leading to “about 70” dead rebel fighters and no dead SAA soldiers in fighting. Per the reports, these ten robots included six “Platform-M” systems and four “Argo” robots, which were controlled from a Russian command post. This news — if true — would warrant significant coverage, as it would mark the first successful use of combat robots in actual warfare, bringing about a significant number of casualties of enemy combatants.

So, did it happen?

The Sources

In such a spectacular story, the first practice should be to examine the sources of the claims. The original source for the “combat robot” story is from Aleksandr Popov on the Russian social network Maxpark.com on December 20, 2015 (archive). On Maxpark, the post garnered over 30,000 views. Popov is a prolific writer on Maxpark–a site not known for its journalistic integrity–but does not seem to have any inside connections with the Syrian or Russian armies, judging by his past posts. Popov’s post (which will be detailed in the following section) was reposted seemingly verbatim (archive) on December 24 on the popular Russian LiveJournal account Beriozka_Rus. Finally, the post was rewritten and cleaned up (archive) for the Kremlin-funded news site Sputnik on December 25. In this final iteration of the post, the core information–number of dead, locations, type and number of robots used–are unchanged from Popov’s original claim.

The Location and Time

Each version of this post (Maxpark, LiveJournal, and Sputnik) describes the battle taking place in the province (Governorate) of Latakia at Height 754.5, with the Maxpark/LiveJournal version also indicating that the battle took place at the Syriatel Tower. Both of these locations are just north of Ateera, with the Syriatel Tower located at 35.8535679, 36.0403007 and Height 754.5 just west of the tower, near the area 35.8529244, 36.0291374.

The killing of 70 rebel fighters and the successful use of cutting-edge Russian military equipment would surely be a significant, PR-worthy event for Assad’s cause. One would think that if such an event occurred, it would not be difficult to find some report of it in the Syrian media. When searching for military clashes near the Syriatel Tower and Height 754.5 in December, we find reports in social media (archive), Iranian media, Russian media, and Syrian media that the SAA has took control of various points in the Latakia province, including the Syriatel Tower and Height 754.5. This military offensive took place just a few days before the Maxpark post on the supposed use of Russian combat robots.

A Syrian news broadcast from December 19 shows the SAA offensive at the Syriatel Tower. In the broadcast, there are no mentions of Russia, Russian cooperation, combat robots, or anything else that would indicate that the Maxpark or Sputnik stories are accurate:

https://www.youtube.com/watch?v=Nxmn3iCwDDg

Matching the tower and landscape seen in this video with the geographic and structural features of the Syriatel Tower in Google Earth and Wikimapia demonstrates that this is indeed the correct location:

In this video broadcast, there are no visible combat robots, and no mention or sight of 70 dead rebels. Syrian media reports describe specific maneuvers from the SAA, such as dismantling mines in a tunnel, but again, there are no indications of Russian cooperation or the use of ten combat robots. In fact, as one Russian-language blog pointed out, some reports of the offensive indicate that there was Hezbollah cooperation with the SAA in the attack on the Syriatel Tower, with no mention of Russian support. Some reports indicate that twenty “radical Islamists” died, or over 25 “Takfiri terrorists,” but there are no mentions of numbers even half as large as the 70 dead cited by Maxpark and Sputnik.

The Robots

The combat robots in questioned have been long hyped by the Russian defense sector, best summarized by Robert Beckhusen at War Is Boring. A successful deployment of these robots would be a tremendous boon to the reputation of the Russian military, so it would be in their best interests to take an significant number of photographs and videos of the robots in action in Syria. After all, as the Sputnik article describes, there were reconnaissance drones “deployed to monitor the situation on the battlefield” during the battles near the Syriatel Tower. So, what sort of juicy footage do we have from the world’s first successful deployments of combat robots, resulting in scores of deaths of enemy combatants? As it turns out, none.

All of the photographs posted in the Maxpark story from Aleksandr Popov are from times and locations other than the December battles in the Latakia Governorate.

For example, a photograph that comes before a description of the 70 killed soldiers and the attacks near Syriatel tower is actually from a scene of the conflict between Saudi Arabia and Yemen. This video was published on December 18, 2015, making it a relatively new source that could not be easily traced back (thanks to user vybralimya for this finding).

The various photographs of the robots being deployed are not from the actual operation, but from training exercises.

And so on. While some of these photographs were likely used by Popov to serve as context for the reader, some–such as the screenshot from the Saudi video–were clearly meant to represent events in Syria. Therefore, we can say that there is no photographic or video evidence of combat robots in the December battles near the Syriatel Tower, as the posted images are incorrect, and media reports from the battle do not show or describe any combat robots.

Conclusions

Syria almost certainly did not use Russian combat robots in military activity of mid-December in the Latakia Governorate. The Sputnik article is careful to not use the misattributed photographs of the Maxpark post, but the core information used in the report is still almost the exact same as that of the blog post from five days earlier. It is possible that Sputnik has inside knowledge that combat robots were used and 70 militants were killed in Syria, but there is no available open source information–local media reports, videos from the scene, social media reports, etc.–that contradicts the more likely conclusion that Sputnik simply rephrased and reposted a crude, fake blog entry from a Russian social network.",2016-01-15,Were Russian Combat Robots Used in Syria?
2016,1,https://www.bellingcat.com/news/rest-of-world/2016/01/11/china-bolstered-rotations-at-gonggar/,/news/rest-of-world/2016/01/11/china-bolstered-rotations-at-gonggar/,"

China has increased the size of rotations at its Lhasa Gonggar airbase located in Tibet, satellite imagery has revealed.

DigitalGlobe space snapshots from November 2014 show eight Chengdu Aircraft Corporation J-10s parked on the operations apron at the Lhasa-based civil-military airport (above image). The airport is located approximately 130 miles from the disputed territory of Arunachal Pradesh. Four additional aircraft joined the apron since March 2014 when a flight of four was visible at the airfield.

A review of historical imagery has shown that China has typically rotated between four and five J-10 or J-11 fighter aircraft since 2010. The Shenyang J-11 are a derivative of the Russian-built SU-27SK Flanker. Imagery from 2009 showed no fighters at the airfield.

While we’ve been waiting on an imagery update to confirm the ongoing deployments of additional flights, we’ve also been taking note of the larger rotations at other border airbases. Last month we posted on developments at the high altitude Hotan airbase that occurred over the last two years. We suspect the enlargement at both airbases could be part of a bigger trend to bolster more forward areas. (Hotan is near the disputed territory of Aksai Chin, currently controlled by China and disputed by India.)

While we wait, we’ve also noted new activity at the surface-to-air missile site less than 2 miles to the east of the airport. An HQ-9 unit was in residence in November 2014, complete with the HT-233 Tiger Paw engagement radar (center) and the YLC-2V long range target acquisition radar (top right corner). It’s currently unknown from where the unit deployed.

But apparently we’re not the only ones who’s been watching the site — even if they didn’t know it. The guys writing over at Indrastra back in September exploited handhelds from Google’s Panoramio, identifying an HQ-12 unit deployed to the same location. Unfortunately, they failed to geolocate the image and misidentified the unit’s location as Shigatse. [1] That airfield is approximately 90 miles West of Gonggar. The handheld’s metadata, still visible at the Panoramio website and confirmed by Exif viewer, suggest the unit was deployed in September 2014.

The HQ-12, also known as the KaiShan-1A, is a truck-mounted derivative of the HQ-2 featuring a dual-mounted rail or box launcher. It distinctly functions in the medium range role. The HQ-9 on the other hand is a four cannister TEL featuring technology from the Russian-produced S-300P and supposedly the U.S. Patriot. It provides air defense at longer ranges. Both are highly mobile, unlike the static HQ-2 which hasn’t been observed at the site since 2010.

Bottom line, satellite imagery continues to highlight improvements in China’s deployed capabilities both qualitatively and quantitatively.

Notes

[1] Shigatse is another airfield of note as it has also featured rotations of fighters. For example, imagery from 28MAY12 showed 5 x J-11s while imagery from 09OCT13 shows three J-10s. However, geolocated handhelds (undated) have shown up to 12 x J-11s.",2016-01-11,China Ramps Up Rotations at Tibet's Gonggar Airfield
2016,1,https://www.bellingcat.com/news/2016/01/08/watching-the-world-burn-is-attacks-in-libya-against-the-oil-industry/,/news/2016/01/08/watching-the-world-burn-is-attacks-in-libya-against-the-oil-industry/,"

Contrary to other armed groups in Libya, the strategy behind the Islamic State’s attacks on oil facilities is not purely military. It is also part of a wider strategy calling for the disruption of the oil industry, not only to affect opposing regimes but also western society and the global economy. Damage to oil facilities can have severe negative consequences for the environment and public health. Interestingly, Al Qaida’s strategist Abdullah bin Nasser al-Rashid wrote guidelines for attacks on the oil industry, which also took into account environmental and public health considerations and the preservation of natural resources. But with this week’s attacks on oil installations in Libya, IS seems to be diverging from this position and is taking a more destructive approach.

IS groups in Libya are currently staging attacks on the oil industry in As Sidr and Ras Lanuf. The attacks on export storage facilities have seen five oil tanks set alight, each containing 400,000 barrels of oil; with one facility taken over. Libya, as a petrol-state heavily dependent on oil revenues, has witnessed frequent attacks by a variety of rebel groups on its oil facilities. As noted by the International Crisis Group, the collapse of Gaddafi’s regime precipitated a range of oil disputes as corrupt individuals and militias fought over the spoils. For example, in December 2014, during Operation Sunrise, which was led by the Libya Dawn coalition, damage to oil installations resulted in the burning of 1.8 million barrels of crude oil.

And in February 2015, an IS attack on the Mabruk oil field resulted in 12 people being killed, and a halted production at the 40,000 barrel a day facility. With the rise of IS, battles between federalist, Islamist and other factions over access to oil resources have dramatically increased. As a result, Libya’s total oil production has dropped to less than 600,000 barrels a day, from the 1.65 million barrels per day before the civil war erupted.

The recent waves of attacks by IS has brought a new element to the conflict, namely the intentional destruction of oil facilities in order to create an economic collapse. As outlined [PDF] by Libyan IS spokesperson Al-Qathani, in IS magazine Dabiq, IS’s aim is to cripple Libya’s oil industry: “[Libya] also contains a well of resources that cannot dry. All Muslims have a right to these resources. […]It is important to note also that the Libyan resources are a concern for the kāfir West due to their reliance upon Libya for a number of years especially with regards to oil and gas. The control of the Islamic State over this region will lead to economic breakdowns especially for Italy and the rest of the European states.”

Initial geolocation of these sites located attacks on oil storage sites south west of Sidr and south of Ras Lanuf, and NASA satellite images showed considerable damage and huge smoke plumes at these sites. While tackling the blaze, the commander of Sirte’s fire brigade made an appeal for help to the UN, as they are facing an “economic and environmental disaster”.

Jihad and economic destruction

To understand the reasoning behind this strategy, it’s important to look further into jihadist thinking on natural resources and what constitutes a legitimate attack. Osama Bin Laden pointed out the dependency of the West on Arab oil resources and attacked the Saudi Arabian government for supporting the West in stealing these natural resources from Muslims. He justified attacks on the oil industry as a means of low-intensity warfare to prevent the theft of natural resources through the Saudi state by Western governments, which resulted in attacks against foreign oil companies in Saudi Arabia and the failed attack on the Abqaiq oil facility. While in 2002, Yemen experienced a successful attack against the Limburg, a French oil tanker.

These considerations where later rooted in a theological rationale and became part of Al-Qaida’s strategy when targeting the oil industry. It was outlined in their directive in 2004, written by Al Qaida’s strategist Abdullah bin Nasser al-Rashid, called The Laws of Targeting Petroleum-Related Interests. Al Qaida considered these tactics as a means to inflict economic damage to the Saudi government and US interests. The strategy divided legitimate petroleum industry targets into four categories:

“a. Oil wells: The targeting of oil wells is not permitted as long as an equally powerful alternative exists. This is because the negative consequences of such an operation outweigh the benefit.

b. Oil pipelines: These are among the easiest targets to attack. The benefits of attacking pipelines outweigh the costs.

c. Oil facilities: These are not to be targeted if they are privately owned by a Muslim.

d. Individual leaders from the petroleum industry: these are among the easiest targets to attack, and the benefits of such operations far outweigh the disadvantages—as long as [spilling] the blood of the person who is being targeted is permissible. As for industry leaders whose blood has not been permitted, they should not be targeted except in situations where there is no other choice but to attack a facility they are currently located in…”

However, the strategy did note that “operations against oil wells […] are also detrimental to the environment and to public health. Moreover, attacking the oil wells also means forfeiting the opportunity to use them again once the Muslim nation reassumes ownership over them. Interestingly enough, after some deliberations on the costs and benefits of using such a tactic, the directive advised against attacking oil wells, “…because of the negative impact on public health and the environment” and stating that it prevents future use, whereas attacks on “oil pipelines and “facilities” seemingly have less of an environmental and public health impact and are therefore viewed as legitimate.

These reservations are interesting, as they reflect environmental considerations in military operations, a discourse that is under-addressed at present. For example, during the intense bombing campaign by Russia and the US on IS controlled oil sites in Syria. Environmental damage from attacks on oil facilities can result in acute and long-term public and environmental threats. Oil fires release harmful substances into the air – including sulphur dioxide, nitrogen dioxide, carbon monoxide, polycyclic aromatic hydrocarbons and lead. These can be transported over a large area before deposition in soils, potentially causing severe short-term health effects for people and wildlife, especially people with pre-existing respiratory problems. Damage to oil storage sites and processing facilities can lead to the release of a range of dangerous substances. Groundwater contamination can threaten agricultural land and the people who rely on ground and surface water for irrigation, drinking, and domestic purposes. Long-term exposure to hydrocarbon pollutants may lead to respiratory disorders, liver problems, kidney disorders and cancer

The importance of inflicting economic damage by attacking the oil industry was also reflected in the writing of Babu Mus’ab Al-Suri, another Jihadi ideologist and strategist. In discussing the strategy of the new jihadist global autonomous cell structure and their primary targets, he wrote: “So, the most important enemy targets in detail: First, the oil and sources of energy from the source until the drain: These are among the most important targets of the Resistance: “Oil fields, oil pipelines, export harbours, sea navigation routes and oil tankers, important harbours in their countries, storage depositories in their countries…”[1]

Targeting natural resources.

Due to its inherent vulnerability, the oil industry has traditionally been a key target for terrorist groups, especially in the Middle East, where many governments are dependent on oil revenues. These industries are usually concentrated in certain parts of the country, often isolated, and therefore relatively easy targets and, if successful, attacks can have major national and international implications. Considerations similar to those rooted in Al Qaida’s strategy are likely key to IS’s strategy in Libya as well: to cause economic damage in order to destabilise the energy market and prevent both national parties in Libya as well as Western states from profiting from the oil revenues. Economic disruption may also damage efforts to bring Libya’s warring factions together.

Whereas other factions fight over access to natural resources in order to control and make a profit out of them, a strategy IS also uses in Syria, the IS groups in Libya appear to have few qualms about inflicting heavy damage to the oil industry. Yet, some commentators also consider it part of a tactic to inflict damage to oil installations, making them less valuable for their owners, and therefore too risky to protect. As a result, they are easier to take over. The recent clashes with IS attempting to take over access to Ajdabiya could cut off all supplies to the ports and gas fields, and has been said to be a “game-over” for Libya’s economy.

In light of IS’s destructive rationale behind the recent attacks, the Libyan forces in control of the remaining oil facilities, as well as the states supporting these groups should step up their efforts to protect facilities. Although it might seem that IS shares similar theological considerations with Al Qaida’s Al Rashid guidance, and therefore would ideally aim for preservation of these sites, the recent attacks indicate an appetite for their destruction, rather than preservation. In the Libyan context, it may be that IS views economic and political disruption and damages to natural resources as a more valuable commodity than oil.

[1] Cook, David (2008) Oil & Terror. In: The Global Energy Market: Comprehensive Strategies to Meet Geopolicital and Financial Risks. The G8, Energy Security, and Glboal Climate Issues. Accessed at: https://bakerinstitute.org/media/files/Research/b5edc3ae/IEEJoilterrorism-Cook.pdf

Thanks to Doug Weir from the Toxic Remnants of War Project for additional comments and edits.",2016-01-08,Watching the World Burn: Islamic State Attacks Against Libya's Oil Industry
2016,1,https://www.bellingcat.com/news/uk-and-europe/2016/01/07/belarus-adds-new-sam-revetments-on-polish-border/,/news/uk-and-europe/2016/01/07/belarus-adds-new-sam-revetments-on-polish-border/,"

Belarus has constructed new surface-to-air missile revetments since 2014, a review of commercial satellite imagery reveals.

DigitalGlobe space snapshots from 2014 show new ‘C’ shaped drive-through revetments at two existing S-300 sites near the Polish and Lithuania borders. The expanded sites could provide prepared firing positions for jumped Russian units or potentially future Belarusian S-300 units. The countries are currently in the process of setting up a joint regional air defense system.

Russia has said for the past several years that it was ready to send little brother additional S-300 systems. But given recent friction regarding a Russian airbase in the territory, it would appear Russian deliveries of military hardware could be linked to access. Then again, with NATO bolstering security on its eastern flank, Russia may do the same.

The two sites, located in Brest and Grodno, are fewer than 15 miles from the borders. Although we don’t have any units in residence in our historical imagery, each expanded site is fairly typical and could host at least a battalion of six TELs and associated equipment. The additional unit(s) would increase overlapping fields of fire and allow for the launch of more missiles per engagement.

The site in Brest (above) was fully complete by 2015 with TEL hardstands. (The imagery on the right is from July 2012 and the left November 2014.) No unit had occupied the site by September 2015.

The Grodno site near Lithuania and Poland may support up to two battalion. Imagery from July 2014 shows the expansion located less than a mile from another S-300 unit and adjacent to an early warning site. Four ‘C’ shaped revetments were under construction at the time of capture. Given the date of the imagery, it’s likely this site has been completed. No additional imagery could be located at this time to confirm.

Bottom Line, imagery shows preparations being made for Belarus or Russia to increase surface-to-air missile deployments on NATO’s border.

This post was originally written for Offiziere.ch and is provided here with permission.",2016-01-07,Belarus Adds New SAM Revetments on Polish Border
2016,1,https://www.bellingcat.com/news/africa/2016/01/03/imagery-confirms-nigers-new-cessna-208-caravan/,/news/africa/2016/01/03/imagery-confirms-nigers-new-cessna-208-caravan/,"

The latest commercial satellite imagery acquired by DigitalGlobe confirms the arrival of two Cessna-208 Caravan to Nigerien Air Force’s Base Aérienne 101 in Niamey. In October 2015, it was reported that the U.S. Ambassador presented the two Caravan along with $36 million worth of additional equipment and training. The U.S. Embassy in Niger notes the aircraft are equipped for the Intelligence Surveillance and Reconnaissance mission.

Along with the Caravan, imagery shows what appears to be a new hangar under construction. [1] The new construction activity may suggest that the aircraft will be based in Niamey. A total of three Caravan are visible in imagery acquired in November. Niger previously received two Caravan with FY 2012 Section 1206 Funding which included expenses like maintenance and pilot training.

In relation to recent funding, the Federal Business Opportunities portal in July announced that the U.S. Air Force was soliciting contractors to provide Multi-Engine Land and Instrument Rating Pilot Training for the country’s air arm. The 3 month period of performance will take place during 01NOV15 and 31MAR16. Like previous training, it’s expected to occur in the continental U.S..

In addition to the aircraft, the U.S. also donated 40 military vehicles (Toyota Land Cruisers, ambulances, and cargo trucks), 250 uniforms, personal protection equipment, and radios to the 24th Battalion Interarmée based at Dirkou in northeast Niger as a part of a second project. Official sources had few additional details.

Left: DigitalGlobe imagery dated November 04, 2015 / Right: DigitalGlobe imagery dated December 22, 2014

Lastly, space snapshots from 2015 continue to show the expansion of the airport. New aircraft support shelters, additional leveling and the construction of aircraft hardstands were noted. Two additional fuel bladders were also added north of U.S. and French deployments. The additional fuel bladders were in place by August, the same time the Defense Logistics Agency requested fuel be prepositioned at Zinder airport, a location less than 100 miles from the Nigerian border.

This post was originally written for Offiziere.ch and is provided here with permission.

Notes:

[1] The hangar measures approximately 22 x 50 meters.",2016-01-03,Imagery Confirms Niger's New Cessna 208 Caravan
2016,2,https://www.bellingcat.com/news/uk-and-europe/2016/02/29/mh17-zaroshchenske-revisited-almaz-anteys-new-launch-areas/,/news/uk-and-europe/2016/02/29/mh17-zaroshchenske-revisited-almaz-anteys-new-launch-areas/,"

Download the full report here: Zaroshchens’ke Revisited: Almaz-Antey’s New Launch Areas

Данный отчет также доступен на русском языке

The cause of the crash of MH17 was investigated by the Dutch Safety Board (DSB). In their final report, presented on 13 October 2015, the DSB identified a 9M38 series missile, launched from a Buk surface-to-air missile launcher positioned in an area near Snizhne, as the cause of the crash. This finding has been criticized by Russia. Almaz-Antey, the successor to the original producer of the Buk M1, had already published its own calculations, including a proposed launch area, on 2 June 2015. The DSB report indicates that these findings were forwarded to them. On 13 October 2015, just hours before the DSB’s presentation, Almaz-Antey presented new findings, including the results of a live explosion test performed on the ground. The new Almaz-Antey presentation also included two new launch areas, one for a 9M38 missile and one for a 9M38M1 missile.

The plausibility of the first launch area presented by Almaz-Antey was already discussed in a previous Bellingcat investigation. That investigation analyzed situation maps, satellite imagery, and press reports from the area and arrived at the following main conclusions: The Almaz-Antey launch area presented on 2 June 2015 was under Russian control, and there were no Ukrainian troops in the area on 17 July 2014. Also, there were no Ukrainian Buks in the proposed launch area on 17 July 2014. However, there is not enough information to reject a missile launch from the area. Because there are relevant differences between Almaz-Antey’s old launch area and its two new launch areas, it should be asked whether these conclusions still hold for the new launch areas. This question is covered in this report.

The preceding investigation on the alleged Zaroshchens’ke launch area primarily based its conclusions on three sources of information: press reports from the area after the downing of MH17, situation maps depicting forces controlling the area, and satellite imagery to assess the situation on the ground. This report also draws upon the information presented in the preceding report. However, additional information is also introduced. This includes new press reports and a closer look at two villages of special interest: Shaposhnykove and Velyka Shyshivka. Given the relocation of the Almaz-Antey launch areas, the importance of both villages for the assessment has increased.

Applying the same evaluation principles that were already applied to the Zaroshchens’ke launch area in the previous Bellingcat study mentioned above, it is possible to reject the claim that Ukrainian troops were present on 17 July in the launch area for the 9M38M1 missile. It is also possible to reject the claim that a Ukrainian Buk was in the area on that day. The rejections of both hypotheses substantiate that a potential missile launch from this area could not have been performed by a Ukrainian Buk. But it is possible to go further and assess that even a missile launch from this area can be rejected.

The assessment for the alleged launch area for the 9M38 missile does not allow for the rejection of the claim that Ukrainian troops were in the area on 17 July 2014. However, it can be rejected that a Ukrainian Buk was in the launch area. A missile launch from the area is considered highly unlikely, but there was not enough evidence to reject a missile launch from this area completely.

Read the full report for more details: Zaroshchens’ke Revisited: Almaz-Antey’s New Launch Areas",2016-02-29,Zaroshchens'ke Revisited: Almaz-Antey's New Launch Areas
2016,2,https://www.bellingcat.com/news/mena/2016/02/27/russias-strong-arm-diplomacy/,/news/mena/2016/02/27/russias-strong-arm-diplomacy/,"

By @JettGoldsmith

Since the start of its bombing campaign in Syria in late 2015, Russia has racked up an impressive list of accomplishments: over 1,000 civilians killed, over two dozen hospitals and aid buildings bombed, and numerous instances of illegal cluster bomb use on civilian populations – all of which puts the Russian Federation squarely in the running for “most war crimes committed by a foreign actor in less than six months.”

A wealth of evidence exists to support claims of Russian airstrikes in Syria – including witness testimony, video footage, photos, and satellite imagery. So much evidence exists, in fact, that we’ve written two articles fact-checking Russian airstrikes on two different hospitals in Syria:

Yet despite overwhelming physical evidence of Russian war crimes in Syria, the state’s Ministry of Defense (MoD) categorically denies any wrongdoing. Accusations of Russian airstrikes on hospitals, bakeries, or civilian convoys are met with casual dismissal and outright denial. Indeed, Russian officials in the MoD become increasingly confident in their ability to flout any sort of international punishment for their crimes, to the point where Major General Igor Konashenkov outright blamed a Russian bombing in Aleppo on US airstrikes.

How does Russia manage to maintain this status quo of reckless behavior in Syria without criticism or retribution from the international community? Strong-arm diplomacy and an almost irreverent policy of outright denial. Amid a sanctioned and nearly crippled Russian economy, Putin, Lavrov and the Ministry of Defense have managed