Was an M4000 deployed at Khan Sheikhoun?

What caused the release of the alleged release of sarin at Khan Sheikhoun? Allegations abound and theories in abundance, Eliot Higgins of Bellingcat believed he’d found the smoking gun: an M4000 Syrian chemical bomb. But is he right? What does the evidence say?

Date of Incident: 4 April 2017

Location: Khan Sheikhoun, Idlib

Date of Report: 18 August 2019


This report is not about what happened at Khan Sheikhoun, I will write about that at another time. This report is about what the evidence shows didn’t happen.

The dispersal method of the sarin or “sarin-like substance” has been a point of contention for many over the prevailing years since the alleged attack occurred. Was it delivered by an aerial munition? Surface to surface munition? Or by other means?

In this report, I will focus on a specific claim made by Eliot Higgins of Bellingcat who has believed, since November 2017, that the munition used was an “M4000 Syrian chemical bomb”. He came up with this idea after watching a press conference given by the Russian MOD who showed a graphic of, what they label, an M4000 and an MYM6000.

Since then Eliot has maintained he found the smoking gun of how the chemical agent was released. But does the evidence support his claim? Let’s take a look.

Eliot’s Claim

During the aforementioned press conference, the Russian MOD provided several slides showing what they believe and don’t believe occurred at the crater. In one slide we see the MYM6000 and the M4000;

For this report, we will focus on the bottom image which, allegedly, depicts this M4000.

Before progressing it is worth noting that this munition if it indeed exists, has never before been seen, recorded in use, evidenced as having been used or photographed. Indeed Eliot admits this himself:

Remarkably, the Russian presentation appears to be the first-time images of these munitions have been made public, and before the press conference, no other references to MYM6000 or M4000 bombs appear online.

So, like Eliot, we must, therefore, take the word of the Russian MOD at face value which is an odd thing for Eliot to do given he suggests we shouldn’t believe a word the Russian MOD comes out with:

First, we need to establish whether Higgins is hypothesising this M4000 was used at Khan Sheikhoun or whether he is stating as fact that it was.

“Thread…showing how we established a Syrian M4000 Sarin bomb was used in…April 4th in Khan Sheikhoun.”

That’s a pretty conclusive statement. Eliot has “established” that an M4000 was the cause of a sarin release at Khan Sheikhoun. He also claims the M4000 is a “Syrian” sarin bomb. I will look at these claims separately. But first, let’s see what else he says on this.

When discussing the Khan Sheikhoun crater and debris, or lack thereof, Eliot tends to pivot to the Al Lataminah incident of 30 March 2017, 5 days before the Khan Sheikhoun incident, which is also alleged to have been a sarin attack. Why does he pivot? My guess is because of the lack of evidence at Khan Sheikhoun to support his claim. Here’s an example,

The diagram published by the Russian government of the M4000 munition provides multiple matches to the debris recovered from the Al-Lataminah attack, linked to the munition used in the Khan Sheikhoun attack by the presence of the same filler cap.

Eliot is attempting to link the two incidents via ‘filler caps’ that were present at both locations. Filler caps that do, incidentally, look similar.

Left -Al-Lataminah Right -Khan Sheikhoun

Whilst Al-Lataminah is not the subject of this report, I do touch upon it occasionally as it’s pertinent to the discussion, however, my focus is on the Khan Sheikhoun crater.

So, was the filler cap present in the crater at Khan Sheikhoun? Yes.

Some may question whether that cap was placed in the crater manually and after-the-fact or whether it was indeed a remnant of the delivery mechanism for the chemical. For it to be the latter it must be matched to the other piece of debris, that being the green cylindrical ‘tube-like’ structure poking out from the rubble.

Given that Eliot has “established” the crater was caused by this M4000 bomb, therefore, the filler cap and ‘tube’ must form part of this munition. But do they?

Eliot took the graphic of this “M4000” and attempted to make the evidence presented at Khan Sheikhoun and Al-Lataminah fit its design.

I note the group “Forensic Architecture” carried out a 3D modelling investigation, commissioned by Bellingcat, using some of the fragments allegedly recovered from Al-Lataminah and that is also shown in Eliot’s graphic. They concluded the fragments match that of the M4000. It appears they couldn’t match all the fragments to the bomb and rather than inform the viewer of such they just ignore them and move on. I have reached out to Forensic Architecture for further information and this will be included in an Al-Lataminah study in the future.

The first problem an analyst encounters is the validity of the data presented concerning the claim/s made. What do I mean by this? What is the claim being made? That this “M4000” graphic depicts a real chemical bomb and that bomb was used at Khan Sheikhoun. What’s the evidence? A filler cap and piece of ‘cylindrical tubing’. Where does the ‘tubing’ fit into Eliot’s graphic? He doesn’t say and neither does Forensic Architecture. So I asked him about this back in October 2018:

Eliot responded; “..there’s not enough clear views of the debris to make the determination.”

Given that only two pieces of remnants at the Khan Sheikhoun crater are of any significance to an investigation it’s strange how Eliot simply ignores 50% of the evidence as he is unable to make it fit with his conclusion. That is a shocking methodology that would see a child fail a school exam let alone pass as a serious analysis of an alleged chemical attack by a person deemed by some as an “expert” in the field.

I decided to press Eliot on this given the enormity of what happened at Khan Sheikhoun and how ludicrous his determination was and based upon 50% of the evidence being excluded when forming said determination.

Eliot says he has “theories on it” yet he never shared those theories with me, on the graphic or anywhere else that I can tell. Given the fact he only had theories and couldn’t explain 50% of the evidence that didn’t stop him from ‘establishing a Syrian M4000 Sarin bomb was used in…April 4th in Khan Sheikhoun’.

Again, note the pivot to Al-Lataminah in his tweet above. Was he seriously asking that we link the green cylindrical remnant to another site based upon matching colours? If all it takes to prove a link to a munition is colour then here’s a better colour match. It’s an image I found whilst researching Khan Sheikhoun.

There’s your colour match and a reasonable match for the cylindrical ‘pipe’. Now I’m not suggesting this hell cannon munition is what hit the road, I genuinely don’t know what caused that crater or the sarin release. Here, I am merely suggesting that if we concluded evidence matches based upon the colour of remnants then where would this line of guessing ulitmately take us?

The Filler Cap

So where does that leave the filler cap presented at the crater? Is that enough to conclude this never-before-seen “M4000” chemical bomb was used at Khan Sheikhoun?

The fragments used by Eliot above are all said to have been found at the Al-Lataminah site so that doesn’t help us with his determination the same bomb was used at Khan Sheikhoun. That said, there are many oddities with his claims in the schematic, such as, but not limited to, him claiming a 45° angle became a 90° curvature after an impact. Discrepancies that I will of course address in a future report.

At the Khan Sheikhoun crater though Eliot reached his determination that an “M4000” bomb was used based upon this filler cap. As quoted previously:

The diagram published by the Russian government of the M4000 munition provides multiple matches to the debris recovered from the Al-Lataminah attack, linked to the munition used in the Khan Sheikhoun attack by the presence of the same filler cap. – emphasis mine

We have no idea if this cap is linked to an M4000 bomb given that we have no photographic or physical evidence the bomb exists. How, then, can one determine that a remnant matches that of a bomb never before seen? Eliot needs to prove this cap is a unique component of this bomb and that isn’t used on other ordnance.

Here is a Russian ODAB-500. Now, I’m not suggesting this was used at Khan Sheikhoun but rather pointing out the design feature of the cap and lug is similar to the filler cap of Al-Lataminah and Khan Sheikhoun, though the lug is missing at this site and only the cap is present. The distance between the lug and the cap on the ODAB does appear to be greater than that of the Al-Lataminah cap, going by the remnant supplied, but as said, the design feature is the same. So he either needs to show uniqueness or prove this setup is not common. The ODAB shows it is common.

Past history of guesswork

As I have shown many times in previous studies, the evidence is something that Eliot uses to support a predetermined conclusion. It isn’t necessarily something he uses to reach a determination. Even if the evidence is missing he uses the absence of evidence to claim evidence. Here’s an example I’ve used before from my 1 Feb 2018 report:

This is an image of an alleged crater in Douma on 1 Feb 2018. It is alleged by the reporter that a chlorine cylinder caused the crater. One identical to this:

Can you spot the glaring inconsistencies? A cylinder’s ends are both rounded. The crater is angled at 90°. Not only that, the cylinder disappeared upon impact. Boom and it was gone. Such discrepancies don’t appear to concern Eliot. He went ahead and used the crater to guess the launch location.

I provide that example to show you how evidence, especially disappearing evidence, doesn’t seem to matter much to him. The narrative takes precedence. No matter what. And we see that again with the Khan Sheikhoun crater and his claim of an “M4000” being used.


What have we established so far?

  • We have established that Eliot established an “M4000” was used at Khan Sheikhoun
  • We have also established that he ignored 50% of the evidence at the crater
  • We have established that his annotated graphic only uses alleged evidence from Al-Lataminah to support his claim an “M4000” was used at Khan Sheikhoun.
  • We have established he attempts to draw parallels between the two sites using similar filler caps and by matching colours of remnants
  • We established that we have no way of knowing if that filler cap, presented at the crater, is the same filler cap on a munition that, for all intents and purposes, only exists on a drawing

But what of the rest of this “M4000” – if it was used at Khan Sheikhoun, are we to presume that, like the cylinder in Douma (discussed above) it all vanished on impact leaving a sole filler cap and some random piece of debris that nobody seems to know what it is? Is that enough to “establish” what type of munition was used? I certainly wouldn’t like to be the one trying to defend that claim.

Is The M4000 a Syrian Chemical Bomb?

According to Eliot, it is. But where did he get his information from? I asked him on 20 October 2018:

Eliot points to the Russian MOD presser we discussed at the beginning of this report as his source for the claim.

The small blue outlined box depicting the munitions contains some tiny Arabic writing. Scott Ritter provided me with a clearer image of that slide.

As I don’t speak Arabic I am unaware of what is being claimed in the text apart from maybe labelling the different parts of the images. It may say these drawings represent real Syrian chemical bombs or it may not. But like Eliot, I struggle to pin my hopes on the Russian MOD telling me the truth.

That all said, if it does state it is part of the Syrian military chemical program then Eliot has never pointed to where it says this and provided the translated text for readers or mentioned where he did get his information from. It’s one of those annoying principles of OSINT that you must show your workings in a clear, concise manner. To not do so could be misconstrued as laziness, or worse, your claim lacking supporting evidence.

Trying to force him into showing me he could prove what he’s saying I suggested he simply made up the idea this was a Syrian chemical bomb:

He then defers to Gregory Koblentz to support his claim that it is part of the Syrian chemical arsenal. Gregory goes the extra mile and claims the M4000 and MYM6000 were declared by Syria to the OPCW.

That claim is so remarkable that even Eliot casts doubt on it;

Gregory Koblentz, Associate Professor and Director of Biodefense Graduate Program in the Schar School of Policy and Government at George Mason University, noted that “these designations match bombs declared by Syria to the OPCW”, although there appears to be no open source material that provides specifics about the types of bombs declared to the OPCW. – emphasis mine

I have tweeted asking Gregory how he knows this information but as of the time publishing, he hasn’t responded. If and when he does I will update this report with his input.

Forensic Architecture, in their Bellingcat commissioned investigation, also claimed:

“In addition he (MOD spokesman) presented detailed drawings of two chemical weapons used by the Syrian Arab Airforce..MYM6000 & the M4000″

Emphasis mine

They continued..

..a weapon that the Syrian regime had already admitted to investigators that it uses.”

Emphasis mine

Note the similarities in their claims and the claims made by Gregory Koblentz and Eliot Higgins? I’d really like to ascertain how Gregory and FI are determining the Syrian government declared these munitions and to whom, exactly. As stated, I have reached out to FI for comment but as yet received no response.

What does the OPCW say?

When the OPCW-FFM drafted their final report into the incident they concluded, “…the FFM could not establish with a great degree of confidence the means of deployment and dispersal of the chemical.”

The FFM interviewed witnesses, analysed data and studied crater remnants and concluded they couldn’t say with confidence how the sarin was dispersed. In other words, they don’t know what caused the crater.

A few months later, and after the investigation by the OPCW-JIM, we have a completely different analysis. In their report of 26 October 2017 they write:

Here the JIM has found the remnants at the crater to be “associated with an air-delivered chemical bomb.” Given the event was blamed on Syria and they have jets then this is when the narrative of a “Syrian chemical bomb” is validated by ‘authority’. Or is it? The next sentence says more than its word content suggests.

The absence of a chain of custody relating to the munition remnants diminishes their probative value.

Wow. Two sentences earlier they seemed certain it was “an air-delivered chemical bomb” now they’re pointing to the fact they can’t stand over the chain of custody of the evidence that helped them reach their conclusion!

So the above sentence by the OPCW-JIM could be changed to read:

The absence of a chain of custody relating to the munition remnants diminishes their evidential value.

That is a considerable claim for the JIM to make yet the questions hanging over the authenticity of the evidence didn’t prevent them from reaching a conclusion.

Also bear in mind that neither the FFM or JIM could go to the site as it was controlled by HTS (aka Jabhat al-Nusra, aka al-Qaeda). So instead they relied upon groups such as the White Helmets, who have a vested interested in the outcome of such investigations, to supply them with evidence. Imagine that in a court of law – the prosecution in charge of the evidence!

Alternative Possibilities

How do we then explain the filler cap and the cylindrical piece of debris? That’s way outside the limit of my capabilities as it was outside the experience of the OPCW FFM team. But can we rule out staging? Is it possible the filler cap was manually placed in the crater? It is certainly possible and I have shown many cases of the opposition staging scenes of alleged chemical attacks elsewhere on this blog. Furthermore, these stagings required a bit more effort than setting a filler cap in a hole in the ground. I’m not claiming this is what happened but suggesting it can’t be ruled out.


The detail matters greatly in making an informed decision.

Flawed data in = flawed output. This is why I think it’s important to confirm whether the OPCW received a declaration from Syria these bombs formed part of their chemical arsenal as claimed by Koblentz, Higgins and FI. Where is the evidence this happened?

Outside of the Russian schematic depicting the MYM6000 and M4000 – is there any further evidence these chemical bombs exist? An important question, that if it can’t be answered, due to either being a false claim or because the bombs are part of a secret program, should give us reason to tread carefully when accepting, at face value, information from an organisation that has a proven track record of misinformation.

It’s possible the M4000 is real and exists as part of the Syrian chemical arsenal. But to accept that it is we must first accept the Russian MOD is being truthful and we also must believe in something there isn’t any physical evidence to prove exists. What is dangerous though is to accept it exists, without proof, then to start looking for evidence to try and match to it. Ascertaining whether it exists or not is not the objective of this report. The goal of this report is, assuming it is real, to ascertain if it was used at Khan Sheikhoun as Eliot Higgins claims it was and based upon the evidence he uses to support his claim.

The only conclusion that can be reached when following the evidence is that there is no evidence, let alone proof, this M4000 caused the crater at Khan Sheikhoun. What Eliot offers as proof, the filler cap, isn’t enough, by any standards, to prove the use of an M4000. This is possibly why he goes some way to continually deflecting from Khan Sheikhoun to Al-Lataminah. In trying to conflate the two he can lose unsuspecting readers in the confusion, drawings, and claims of matching evidence.

Simply ignoring a vital piece of evidence when forming your conclusions because you either can’t explain it or it doesn’t fit with those conclusions is to investigate from a starting point of a predetermined conclusion. The result of this is that you end up in front of the evidence rather than behind, allowing it to lead you. Thus you end up with a flawed analysis based upon personal bias and not based upon the evidence or lack of.

He may have an argument if the crater consisted of a large amount of debris that could be verifiably linked to the bomb in question and there was one piece (the tube-like remnant) he was struggling to match up. But when that ‘tube’ makes up a solid 50% of the evidence and it is brushed aside because it can’t be explained then the results of that investigation are flawed, biased and indeed fraudulent.

Even the pieces of debris he claims match that of an M4000 from Al-Lataminah have their own questions marks hanging over them. I gave one example of such doubts elsewhere in this report. There are more for another report.

In summation; Eliot’s claim an M4000 was used at Khan Sheikhoun is absent any supporting evidence.

However, I would welcome input from Eliot and would be interested to see his rebuttal to my report especially surrounding his “established” fact the M400 was used at Khan Sheikhoun. Maybe I’ve missed a piece of his evidence? Maybe I’ve misunderstood him? Maybe I am just flat out wrong about it all? No doubt if any of that is true he will let me know in due course and then we can get a serious technical conversation going into his claims and what they are based upon. The truth is what is important. Not who is right or wrong.

Take Away Points

  • The absence of evidence does not prevent Eliot from drawing conclusions
  • One must be alert to an investigator’s claims of “establishing” a fact that has no evidence to support it. (eg: How can something be “established” whilst absent supporting evidence?)

As always if anyone notices any inaccuracies in my report please feel free to point these out to me here or on Twitter. All constructive criticisms are welcome. – Philip

*Update on the existence of M4000 * (21/8/19)

Following on from my questioning of the existence of this M4000 and whether it is/was a Syrian chemical bomb, I can now shed further light on that question.

Following an exchange with @Qoppa999 on Twitter yesterday he brought to my attention an article from 2016 in Foreign Policy by Colum Lynch which made mention of an “M400”:

He suggested the difference between the wording of M400 and M4000 would likely be a typo. Being aware of similarly named Russian bombs like the FAB 500 and FAB 5000 I needed to be sure it was typo rather than a different bomb.

I made contact with Colum via email who kindly informed me that it was indeed a typo and that he was referring to an M4000 in the article.

Worth noting the date of Colum’s article was August 2016 and 14 months before the Russian MOD press conference. So I believe that is as close as we are going to get to proof the M4000 exists and is a Syrian bomb.

Given the OPCW-DAT (Declarations Assessment Team) links the M4000 to mustard gas it is likely they formed part of the Syrian government declaration. If it was part of that declaration in 2013 then the question remains should they not have been destroyed?

A question for another day. Confirming the existence of the M4000 does not change the conclusion of this report, there is no evidence to prove it was used at Khan Sheikhoun. When writing this report I assumed it’s existence to challenge Higgins’ determination.

I’d like to thank “Qoppa” for his interaction and for bringing the FP article to my attention. I’d also like to thank Colum Lynch for his welcoming and helpful exchanges. Colum permitted me to include his confirmation in this report.

2 thoughts on “Was an M4000 deployed at Khan Sheikhoun?

Leave a Reply