Masdar Maftouh – Open Source Investigations Through the Use of Social Media

Photo courtesy of the Local Council of Darayya City’s Website

Siege: Throughout the course of the Syrian Civil War Bashar al-Assad’s government has pursued a military policy of siege, indiscriminate bombardment, and eventual displacement of the people in towns and cities it has managed to surround. Notable examples of this policy include the siege of opposition-held East Aleppo in late 2016 as seen in the film For Sama, the five year long siege of the Damascus opposition enclave of East Ghouta , and the surrender of Daraa that occurred as a siege of the opposition-held areas became inevitable. On a smaller but equally as devastating scale, the siege tactics pursued by the Syrian government can be seen throughout the nearly four year siege of opposition-held Darayya, a suburb located southwest of Damascus. Through the use of digital open source investigation techniques to analyze social media uploaded by Darayya activists, we can determine the who, what, when, where, and how of the Syrian government’s indiscriminate targeting of Darayya in its effort to expel the local population at any cost.

Satellite imagery from Google Maps showing the suburbs of Darayya and al-Moadamyeh southwest of Damascus

Method: This investigation will primarily focus on footage from a YouTube channel managed by Darayya activists throughout the siege, Darya Revolution . Secondary information and images have been gathered from various other social media sources such as the Local Council of Darayya’s Facebook page and website. Additionally, due to the large amount of footage available from these sources, the author will focus on a specific video to demonstrate how one can conduct an independent open source investigation using publicly available digital tools.

Photo courtesy of the Local Council of Darayya City’s website

Finding the who, what, when, where, and how: On the 16th of March, 2015 a 38 second video titled “The helicopter drops 8 explosive barrels all at once! 2015-3-16” was uploaded to the YouTube channel “Darya Revolution”.
Original title: 2015-3-16 ! الطيران المروحي يلقي 8 براميل متفجرة دفعة واحدة

In determining the above four W’s and how, we must first scrape all possible information from the video. Throughout the video the narrator does not give much information presumably due to understandably being taken aback from the explosions a short distance away. However he does say “Darayya” multiple times as well as “(the) Bombing of explosive barrels” and the date 16/03/2015. This information at the very least supports the title of the video. Additionally towards the end of the video a helicopter can be heard in the distance.

Original Arabic:
0:13 – “قصف براميل متفجرة داريا”
0:27 – “داريا ستعش ثلاثة وخمستعش”

As this information does not provide extra detail other than what was already stated in the title, it is necessary to move on to the next step of the investigation, determining the location. As mentioned in the title and video itself we can determine that the suburb of Darayya is the approximate location. Yet finding the exact scene of the bombing requires a deeper analysis of the video combined with a search of publicly available satellite imagery. Identifying recognizable landmarks is a critical step in this process so that we can create a point of reference to these other image sources. At the beginning of the video a large mosque with a minaret located close to a graveyard can be seen.

By searching Darayya on Google Maps it appears that there is only one mosque in the suburb close to a graveyard with the apparent name of “al-Rahman Mosque.”

Since we know the general location of the airstrike based on using the mosque as a landmark, we can now start looking for the more specific area that the cameraman was filming from. We can use Microsoft’s free Image Composite Editor in order to create a panorama image using video stills so that a wider area is seen at once.

Image showing Microsoft’s Image Composite Editor stitching together stills from the video to create a panorama

Panorama 1 from roughly the first 7 seconds of the video

Panorama 2 from roughly the middle 10 seconds of the video

From these much larger images we can start selecting secondary landmarks to compare to the satellite imagery around al-Rahman mosque to locate the position of the cameraman. In addition to the mosque, in the first panorama we see a long, short building directly next to the mosque outlined below in red. We also see a small, short building adjacent to the long one outlined in blue. On the left side of the frame there is a sizeable, white apartment building outlined in yellow. Additionally the minaret next to the mosque appears to be on the left side.

The second panorama shows a larger apartment complex with a curving roof outlined in purple. In the foreground there is also a smaller building with a unique red slanted roof outlined in green. Also of note in the background of both are the large mountains.

Unfortunately due to the destruction that Darayya experienced between this video and updated Google Maps imagery, we must find another source with less destruction visible.

Google Maps satellite imagery showing Darayya sometime post-siege. Note the bomb craters and destroyed buildings making this area nearly unrecognizable.

Using Bing Maps pre-Syrian Civil War satellite imagery, it is possible to create a top down view displaying the secondary landmarks around al-Rahman mosque outlined in their corresponding colors. The black circle represents the location of the minaret next to the mosque while the block of buildings outlined in pink with outstretched lines is the approximate position of the cameraman who would be able to capture all the other landmarks from the roof of those buildings. Combining all this information allows us to know the cameraman was on the roof of a building in the pink area initially looking north north east towards the mosque as the bombs fell. Far behind the mosque the Mezzeh district of Damascus can be seen and behind this area are the distant mountains that Jabal Qasiyun belongs to.

Now that we definitively know the location we can determine the participants involved much easier. At this time in the Syrian Civil War the only operator of helicopters in the Damascus area was the Syrian Arab Air force (SyAAF). Thus, it is safe to assume the attacker is a helicopter from the SyAAF. Additionally, the bombs are visible in the video as they fall. Yet due to their velocity it is hard to determine their model and if they were truly barrel bombs or more conventional weaponry.

The YouTube channel that uploaded this video is named “Daraya Revolution” and its logo is the same green, red, and white colors of the Free Syrian flag. No weaponry is seen in this video from the ground and most other videos on this YouTube channel mainly show other bombings or shelling of Darayya. Therefore we can assume the cameraman is a local opposition activist from the Darayya or greater Damascus area.

Put together, the information gathered from this video looks like this:

Who: The Syrian Arab Air Force

What: The Syrian Arab Air Force bombs the opposition-held area of Darayya

When: March 16, 2015

Where: Around the al-Rahman mosque, Darayya, Greater Damascus.

How: With the use of an unidentified model of helicopter and 8 unidentified bombs, possibly barrel bombs.

Supporting Evidence: To further bolster the narrative we have been able to create using information from the video, we can reference both other videos from the “Daraya Revolution” YouTube channel and other open source investigations to support it.

First we can pin-point a possible location that the helicopter originated from. Just to the north of Darayya is the Mezzeh Military Airbase.

Supporting the possibility of this airbase being the origin of the attack are two videos from the outskirts of the airbase showing helicopters on the runways.

Title: “رصد مروحيات النظام ضمن مطار المزة العسكري داريا”
Translation: “Observation of the helicopters of the regime inside Mezzeh Military Airport Darayya”

Title: “هام للإعلام: طائرات مطار المزة العسكري مع الدبابات”
Translation: Helicopters of Mezzeh Military Airport with tanks”
From: mazzehrevolution

Although 2 years old by the time of the video used in the investigation, both of the above videos provide evidence that this airbase housed helicopters. When compared to a reference photo it can be seen that the helicopters on the runways are a variant of the Mil Mi-8.

\
Photo from a Bellingcat open source investigation of the T4 Airbase in Syria

Other videos from Daraya Revolution show Mil Mi-8’s dropping their bombs around Darayya including near the al-Rahman mosque.

Title: “البرميل المتفخرة والطائرات سوا في رحلة إنتخبات الدم على مدينة داريا”
Translation: “The explosive barrel and the helicopters both in the trip of the blood election on the city of Darayya”

Title: “إلقاء براميل متفجرة على الأحياء السكنية على المدينة داريا”
Translation: “Dropping of barrel bombs on the residential neighborhoods of the city of Darayya”

Yet this video evidence does not confirm the type of helicopter used but shows one of two possibilities. The other possibility, pictured below, is a Syrian operated Mil Mi-24. Videos from Daraya Revolution also show this variant of helicopter bombing Darayya.

Photo from a Bellingcat open source investigation of the Syrian Arab Air Force

Title: “مروحيات الأسد تلقي براميلها المتفجرة على مدينة داريا”
Translation: Helicopters of Assad drop their barrel bombs on the city of Darayya”

Title: “ميمز: أمتار فقط تبعد البراميل المتفجرة عن المصور”
Translation: “Special: Barrel Bombs only meters away from the photographer”

From the additional information gathered we can conclude that the origin of the helicopter in the March 2015 video was most likely from the Mezzeh Military Airport and that it was either a Syrian operated Mil Mi-8 or Mil Mi-24.

Conclusion: Using open source information gathered from Youtube videos and combined with investigative techniques we can prove that on March 16th, 2015 a Syrian Arab Air Force operated Mil Mi-8 or Mil Mi-24 helicopter which most likely originated from the Mezzeh Military Airport dropped eight unidentified bombs on an opposition-held residential area of Darayya south west of the al-Rahman mosque and graveyard.

In the bigger picture, one bombing such as the one investigated is a drop in the bucket for a conflict as violent and as well documented as the Syrian Civil War. However, through dedicated documentation and continued investigation trends emerge showing the length and scale of these crimes as they occurred. While independent investigators may not be able to hold the responsible parties accountable, it is possible that these investigations can bring awareness and possibly be used as proof of war crimes in authoritative investigations. Additionally well documented investigations that rely on primary source material empower individuals located across the globe to demand accountability and help to raise the voice of those directly impacted by conflicts.

Sidenote: In the background of the March 2015 video a large white building can be seen in the mountain range far beyond Darayya.

This building is most likely the Syrian Presidential Palace located on the mountains above Damascus. From this viewpoint it is possible that Bashar al-Assad witnessed many of the bombings across the Damascus suburbs that took place to violently oust the opposition.

Beginning in early spring 2015, a coalition of Syrian opposition groups began a long planned, far reaching series of offensives against remaining Syrian government positions located in the Idlib province. The participating groups involved ranged from extremist US-designated terror organizations like Jabhat al-Nusra to various Free Syrian Army formations including some of those who had been supplied with United States’ produced TOW anti-tank guided missiles. As the offensive progressed, many of these groups claimed advances on social media websites and applications such as Twitter, Facebook, and WhatsApp which were then verified by independent users on these websites using pictures and videos uploaded throughout the day. We will examine one such claim and show how it could be verified before being confirmed by official news or government outlets.

Authors Note: Many of the Syrian opposition social media accounts that were used to upload claims, pictures, and footage from this time period have been deleted due to breaking the terms of service on these social media websites or lost to time without any archiving. Therefore the sources used here will not have originated from their original posters but instead secondary accounts from the time period.

The Capture of Idlib: In the early morning (EST) of March 28th, 2015 reports began emerging from Syrian opposition accounts claiming the capture of the provincial capital of the Idlib province, Idlib City, from Syrian government forces.

Tweet originally posted by a Jabhat al-Nusra affiliated Twitter account, screenshot sourced from here.

Translation: “#Jabhat al-Nusra God is great and praise be to God, liberation of the city of #Idlib entirely and the Mujaheddin pursue the remainder of the Shabiha* during their attempt to flee. #Army of Conquest #Conquest of Idlib”

Tweet originally posted by a Ahrar al-Sham affiliated Twitter account, screenshot sourced from here.

Translation: “#Breaking #Operations_Room_of_Army_of_Conquest #The_Islamic_Front #Ahrar_al_Sham, Control of the entire city of #Idlib and the retreat of what is left of the remains of the militias of #Assad outside of the city.”

Verification: Although intense fighting had occurred on the outskirts of the city in the previous days with the capture of many government checkpoints by the Syrian opposition, the fall of the city proper was swifter than expected leading to the questioning of these claims. As the day progressed, Syrian opposition social media accounts as well as independent Syrian reporters began uploading images and videos supposedly from within side the city. By using techniques of open source investigations such as geolocation as well as cross-referencing social media posts, opposition positions and overall control of the city could be confirmed.

Image originally uploaded by a Jabhat al-Nusra affiliated Twitter account, screenshot sourced from here.

Translation: “The roundabout of the clock(tower) that was taken control of by the grace and praise of God.”

Image originally uploaded by an Ahrar al-Sham affiliated Twitter account, screenshot sourced from here.

Translation: “#Idlib_Liberated…Square of the Clock(tower).

The first step in verifying these photos is determining their position in the city.

Above is a view of Idlib City from Google Maps with the approximate location of the clock tower square circled in red.

By zooming in on Google Maps the clock tower can be seen roughly in the middle of the above photo. The total area of the park is outlined with a yellow line while another part of the square with a tree in the center is outlined in red. The blue circle with lines stretching outwards denotes the approximate position of the Jabhat al-Nusra cameraman who took the photo.

When compared to the original photo with the aforementioned colored lines inserted, a reference can be drawn between the two confirming the presence of the cameraman and thus Syrian opposition in that part of Idlib City. This can also be confirmed using the Ahrar al-Sham photo.

Once again, the yellow line outlines the rough area of the square. However this time the green line outlines the fountain object located behind the clocktower and the red line outlines a curving edge of the top of a building. Additionally the blue arrow depicts the approximate area of the Jabhat al-Nusra cameraman. Through a comparison to the satellite imagery below we can see the Ahrar al-Sham photo was taken from the back of the square looking over the fountain and to the clocktower. The blue circle with lines attached demonstrates the perspective of this photographer.

Finally, the location of these two images can also be confirmed through a video uploaded the same day by Syrian journalist Hadi Alabdallah titled “Video from the Clocktower Square in the heart of Idlib after its liberation.”

Conclusion: Although occasional gunshots can be heard in the background indicating the possibility of ongoing fighting for control of the city, this video clearly shows opposition elements as well as a journalist affiliated with the Syrian opposition in the clocktower square near the center of Idlib City. While not conclusive in proving that the Syrian opposition had taken control of the entire city, as the day went on more media would be uploaded to social media further showing the city in the opposition’s hands. Open source techniques like geolocation as demonstrated above are valuable in verifying claims using evidence from social media accounts. While not without their flaws, the ease of access provided by the internet allows for independent individuals to undertake their own investigations.

Target Darayya: Analyzing the Bombing of Darayya Through Youtube

Tracking Syrian Opposition Advances During the 2015 Idlib Offensive