Date of Report: 30th July 2020
The OPCW-IIT (Organisation for the Prohibition of Chemical Weapons – Investigation and Identification Team) claim to have “authenticated” a video of the “attack of 30 March 2017”. That attack, as most of you will know, was an alleged sarin attack on the outskirts of Al-Lataminah town in the Hama Governorate of Syria.
In this investigation I take a closer look at the video, it is believed the OPCW are referring to, with the view to establishing whether the facts fit with their claim. I take a look at the source of the video, it’s timing, it’s narration and ask, how it is possible the OPCW ‘authenticated’ it?
From the footage I’ve watched Mahmod Hamway seems to be highly regarded by the fighters and White Helmets who operated in Hama, especially around Lataminah. He was definitely their go-to cameraman and would be at, or near, any incident worth reporting. Yet he wasn’t at the alleged chemical attack sites of 24 March, 25 March and 30 March 2017. Though, his video claims to show the 30th March sarin attack taking place.
The IIT provides two useful details about the video that we can work from when trying to verify if the Mahmod’s footage is the one they refer to in their report.
- Time – “around 6:00”
- Description – “shows a grey smoke plume”
Given that there is only one known piece of footage circulating on social media of the alleged attack, the first task is to simply see if that footage matches the two pieces of information provided by the IIT.
Taking the YouTube video I checked its metadata to ascertain date and time of upload. For this I used Mattw.io and cross-referenced the findings with another metadata checker from Amnesty International.
The video was uploaded to Youtube at 04:17 (UTC) on March 30, 2017. Bear in mind that London was then UTC+1 therefore 05:17 and Syria was EET (UTC+2) therefore 06:17. To confirm and validate the timezones I used timeanddate.com.
This information fits with the IIT’s claim the video was uploaded “around 6:00”.
Mahmod has quite a catalogue of footage of aerial attacks on his YouTube page so it isn’t a surprise for him to post this type of video.
What we can also deduce from this footage is that it “shows a grey smoke plume”. Note the IIT’s use of the singular “plume” and not plumes.
Here is the narration translation:
Title: Poisonous gases perpetrated by the Military Airforce on the city of Lattamneh, Hama countryside, causing injuries 30-3-2017
Military Airforce bombards the city of Lattamneh in the Hama countryside.
Bombardment by the Military Airforce on the city of Lattamneh in the northern Hama countryside.
At 0:20, inaudible.
30/03/2017 & the Military Airforce remains in the skies overhead.
The Military Airforce remains in the skies overheadTranslated with Thanks by @keljabi
I could find no other footage of the alleged strikes for the morning of 30th March 2017 and I searched extensively. It is therefore almost certain Mahmoud’s footage is what the IIT are referring to as them having “authenticated”.
It’s also clear from Annex 3 of the OPCW-FFM report into the incident that the mission received and viewed Mahmoud’s footage adding further validity to my belief this is the video the IIT are also referring.
On page 34, Table A3.3, the FFM notes receiving a “Removable Disk” containing footage of “غازات سامة نفذها الطيران الحربي على مدينة اللطامنة بريف حماة وتسببت بإصابات”. Pasting that text straight into Google takes us to Mahmoud’s video.
So there’s little doubt left that the video the IIT claims shows the attack happening is the video discussed in this report.
The OPCW-FFM said the alleged attack began at “approximately 6:00″ – according to witnesses. The IIT used the FFM’s declared start time but they also point to evidence from the “Independent International Commission of Inquiry on the Syrian Arab Republic (IICISyria)” who themselves claim, also according to witnesses, the alleged attacks began:
At around 6.30 a.m. on 30 MarchA/HRC/36/55, paragraph 69
But does the start time matter? Yes – it’s vital if we are to factor in the Mahmod Hamway video as evidence.
Recall, the OPCW-IIT stated:
The video, authenticated by the IIT as being from the attack of 30 March 2017, shows a grey smoke plume.
Mahmod’s video cannot have been of the alleged sarin bomb itself as, if we refer back to witness statements given to the FFM,
Witnesses to the event described one of the detonations they heard as having a “different, quieter” sound than the three other impacts they heard, with no odour and causing no visible smoke. (Emphasis mine)
Throughout both OPCW reports (FFM & IIT) there is a concerted effort to stress that one of the alleged bombs was different from the other three. The reason for this is that an aerial sarin bomb would only contain a small amount of explosives, just enough to disperse the sarin to an aerosol but not destroy it. Of course, this begs the question that if an aerial sarin bomb was used on the 24 March then how was there “black bubbling liquid” several days later? That’s for my next report though.
When investigating the timing of the upload I randomly l flicked through Mahmod’s Twitter feed looking for videos that show similar aerial attacks to ascertain their upload times and I quickly began noticing a pattern:
Note the times of the uploads? Now, there was one exception to the rule. This video was uploaded at 9:47am, and I add it here for transparency:
But the rule, none-the-less, was that videos of aerial strikes were uploaded in the evening, or late afternoon, and there is a very good reason for that as we will see in the next section.
So, from the information gathered so far we can conclude the alleged attacks began sometime between 06:00 and 06:30 on the morning of 30 March 2017. We have also established that Mahmod’s video of aerial attacks was uploaded to YouTube at 06:17 that morning.
The most obvious question to be asked then is; How would he have known what he was recording was a chemical attack?
When reading the IIT report it got me thinking a lot about the time of the Mahmod video upload to YouTube, in relation to the time given by the FFM for the alleged attacks. Even taking the earliest time from the FFM of 6:00am and let’s assume that Mahmod had recorded one of the alleged high explosive bombs (according to the FFM there were 4 bombs dropped, one was a chemical bomb the other 3 conventional bombs, though the IICISyria claimed there were 2 bombs, 1 of which was a sarin bomb. It should also be noted that FFM say that nobody saw the bombs drop).
If attacks began at 6am and if we assume the 4 bombs dropped seconds apart…then let’s create a scenario:
- 06:00 Bomb 1 Drops
- 06:01 Bomb 2 Drops
- 06:02 Sarin Bomb Drops
- 06:03 Bomb 4 Drops
Considering the OPCW tells us it was the third bomb that was the chemical bomb then it follows, at a massive stretch of reasoning, that Mahmod must have recorded the fourth conventional explosion if he had been made aware a chemical attack occurred. With me so far?
Again I must ask how would he have been made aware that, seconds before he recorded the 4th explosion, there had been a chemical bomb dropped? Especially when that bomb is said to have landed in a field, 300m from people sleeping in cave?
But let’s assume, by some stroke of fortune, he found out instantly the bomb was a chemical bomb. He needed to act very fast to get it uploaded to YouTube.
Using the above scenario Mahmod had 14 minutes to get his video showing the 4th explosion uploaded, (6:03 drop time, 6:17 upload time) whilst sitting on a roof, amidst aerial bombardments.
How would such a task be accomplished?
I began by asking myself if Mahmod could have been using a phone which would have made uploading to YouTube much more easier. However, it’s obvious he wasn’t given the zoom on the camera.
I then began clutching at straws and looking into the concept that maybe some cameras have YouTube enabled software that would simply require connecting a mobile phone as a wifi hotspot to upload directly. I was genuinely making an attempt to prove the video’s claim as authentic.
I struggled with this questions for a long time until, whilst researching the damage to the Lataminah hospital on the 16 April 2017, I spotted Mahmod with a camcorder in his hand.
Whilst I heard him speaking on the video I needed to prove it was him actually holding the camera. Separate footage of the destruction of the hospital on 26 April 2017 would, quite bizarrely, show him holding the camera:
Whilst I knew it was Mahmod I wasn’t sure I could convince the casual observer it was, based upon the evidence presented above, so I decided to dig deeper.
I asked on Twitter for help ID’ing the camera and in minutes eagle-eyed @RealDavidCarter nailed it.
The next challenge I set myself was to ascertain if this was one of many cameras used by Mahmod or if it was the one he used regularly. This is important when working out how he uploaded the video. So I spent some time digging around on social media to I found exactly what I was looking for. A video of Mahmod with his laptop and his camera.
Searching on DuckDuckGo reveals the camera to be a Sony Handycam HDR-CX405:
The camera has no bluetooth or wifi capability so it needs to be connected to the computer/laptop via USB when only then a file transfer can be possible. Assuming the video file doesn’t require editing of any description, including size adjustment etc, then from the laptop the video would be uploaded to YouTube providing an internet connection is available.
The question now arises, would Mahmod have sat on the roof with his laptop at 6am, connected his camera to it, transferred files and then uploaded to Youtube, if internet access was possible of course, whilst airstrikes were raining down around him?
As you will have noted with the evidence I supplied from Mahmod’s Twitter feed, he uploads his videos, for the most part, in the evening and the likely reason for that is that it affords him time to complete the process effectively and at this stage to shorten or trim any footage he didn’t need. Anyone who has uploaded video to Youtube will know that it’s only a simple process if the video is ready to go.
Let’s remind ourselves of the quote we began this investigation with:
The IIT are a NATO-grouplet instigated by the British government to bypass Russian and Chinese UNSC vetos. After Khan Sheikoun, and the alleged sarin attack of April 4, 2017 Russia refused to vote in favour of renewing the OPCW-JIM’s mandate given their very clear political bias. What Russia requested was that the team become more representative of the states concerned; in this instance instead of having all pro-NATO member states represented in the JIM, there was a need to balance this out with representatives from BRICS countries or countries not aligned to NATO. The US, UK and France objected so Russia’s proposal to renew the JIM’s mandate. The British immediately moved to circumvent the UNSC and thus the IIT was born.
With that said, for us to believe that Mahmod’s video is showing the alleged sarin attack taking place we would have to believe the following:
- The very second the 3rd bomb hit the ground someone would have to have known it was sarin and relayed that information via radio – though for a person to have been that close to a sarin crater they would have died almost immediately. There are no claims of anyone having died at the crater.
- Mahmod would had to have had such a radio switched on – there is no evidence, audible or otherwise, of this being the case
- Mahmod would needed to have his laptop with him and connected to the internet. I watched hours of his videos and never once saw him with his laptop apart from when at home, editing footage. Why would he take a laptop on to the roof of a building at 6am?
- No editing of the video would have been possible so we must assume the 31 second clip he uploaded to YouTube was all that he recorded
- He would have needed to sit on the roof, amidst airstrikes, and providing he had his laptop with him, and that it was connected to the internet, then transferred the video this laptop, then uploaded it to YouTube all in a very tight 14 minute window.
I think you’ll agree that’s a very far-fetched scenario to believe when there’s an alternative, less complicated scenario that could be true.
The video was recorded previously and uploaded at that time as part of a staging. Applying Occam’s Razor – the simpler explanation of an entity is to be preferred – the staging scenario is much more likely.
Is there any evidence the video was maybe recorded on a different day? I noted from Mahmod’s Twitter feed that two days later, on 1 April, he uploaded a similar video shot from a different angle, but from the same location the 30 march video was shot. The recording would also appear to be of the same impact location, or not far away from it. I also noted the wind blowing in the same direction on both videos. (Click to open larger image)
Here are both tweets containing both videos for your information.
So how did the OPCW authenticate the video? They don’t say and like most of their claims, remains unsubstantiated. A guess would be they literally did what I just did and confirmed its upload time and given the wording of their statement..“as being from the attack of 30 March 2017” they had already concluded the attack happened, as it was claimed, and were now employing some reverse reasoning by seeking the evidence to confirm their preconceived conclusions.
The evidence points to the Mahmod video not being from the alleged sarin attack of 30 March 2017.