Aug 27, 2018
#BreakingSyria: Tracking Incendiary Bombings in Idlib
A small area in Syria near the Turkish border constantly bombed with incendiary munitions in last month
Since the fall of the Daraa and Quneitra fronts in Syria’s south, rebels in the northern pocket face increasing pressure from Syrian Arab Army (SAA) and forces aligned with Assad’s regime.
Most regime offensives have begun with aggressive Syrian Air Force raids, supported by the Russian Air Force. Idlib was hit by air raids countless times throughout the conflict and recently faced a surge in aerial attacks. These attacks suggested the imminence of a regime ground offensive against rebel held Idlib.
An unprecedented large-scale employment of incendiary weapons was reported from the area surrounding Badima and Najiyah, only four kilometers from the Turkish border. The 1980 Convention on Conventional Weapons (CCW) banned the use of incendiary weapons, but Syria never signed this convention.
@DFRLab investigated current the situation that civilians in Badima currently face.
Allegations of Incendiary Munitions Use
Videos and photos of alleged incendiary munitions use in the local area appeared in July 2018. Most of the videos were recorded by civilians and were claimed to be taken around Badima and Najiyah, the western part of Idlib governorate. Reverse image searches suggested that the videos and photos used in this research were not recycled or posted in any prior instances, and were therefore likely genuine.
Videos and photos captured hundreds of small balls of fire falling in clusters on urban areas, described as the towns of Badima and Najiyah. After falling to the ground, the fireballs continued to burn, as white smoke rose from the area. This was typical to the incendiary munitions previously used in the conflict, which @DFRLab reported on earlier this year.
Using only visual evidence is not enough to verify the use of incediary weapons, the captured frames resemble the attributes of the incendiary munitions recorded throughout the conflict.
Geolocating these images allowed to confirm the locations mentioned on social media posts and daily satellite imagery helped to verify the extent of the damage. Combining these two methods allowed to collect evidence of the use of incendiary munitions on civilian areas in Syria.
Najiyah
The town of Najiyah was one of the locations frequently bombarded with apparently incendiary munitions. Images posted on social media on July 30 helped to geolocate the area. We verified this location by using the golden dome of a mosque and a minaret in- the southern part of the town.
Additional pictures from the ground allegedly showed the damage caused by this bombardment. Due to the lack of geolocation data in these photos, their location could not verified.
Comparing Planet satellite images taken around the time of the incidents further verified the attacks. Due to cloud coverage and limited satellite imagery for that area, comparison of sequential images was unavailable. Nonetheless, comparison of July 25 and August 5 imagery revealed large scorched areas around the city. Due to the limited resolution of the images, the damage done to the town itself was hard to assess, but the northeastern part of the city seemed to be hit by the incendiaries as well.
More images were taken on July 31, 2018, and showed an attack on a residential area to the north of the town. A large complex of residential buildings, the mountain range and the highway visible in the photos helped geolocate the area.
Analysis of the satellite imagery revealed scorched areas visually similar to the ones around Najiyah. It was unclear what damage was done to the civilian residences, due to limited resolution, but the damage done to the surrounding areas was clearly visible due to the fires these munitions sparked.
In satellite image from July 5, an ongoing fire was clearly visible. Comparing it with the scorched areas seen in the August 5 photos, it was highly likely that this fire was the result of an incendiary attack.
Badima
The other town in the area which was mentioned in a large amount of social media posts was Badima. This town is located only few kilometers northwest from Najiyah. A Syrian news outlet uploaded a video on YouTube on July 6, which showed the bombardment of the town with incendiaries.
This video helped verify the location of these attacks to be in the town of Badima.
Another photograph showed the falling balls of fire over a residential area, which was most likely in the eastern part of Badima.
Videos of the alleged incendiary attacks during the night were also available. These videos could not be verified due to their low quality and limited details. Nonetheless, knowing the constant bombardment of the area with incendiary munitions during this period of time, these videos were likely genuine.
Images of fire falling from the sky and the documented destruction were consistent with previously recorded incendiary weapon attacks. This recorded video evidence suggests that the weapons in the video could be white phosphorus munitions, allegedly used by Russian and Syrian Air Forces throughout the conflict.
Conclusion
Recent aerial attacks were reported by civilians in the vicinities of Ariha, Kafr Zita, Idlib, and Ltmanah. All of these attacks show that SAA refocused forces relieved from the fighting in the south to the last pockets of resistance in the north.
The most immediate concerns remained the intense incendiary bombardments in the north eastern part of the country. The sheer scale of the incendiary attacks on the area of Najiyah and Badima was one of the largest that @DFRLab recorded throughout the Syrian conflict. Most likely these attacks were used both as weapons of terror and preparatory strikes for an upcoming large-scale attack. It was unclear who was responsible for these attacks, but the two potential culprits are the Syrian and Russian Air Forces.
@DFRLab will continue to monitor significant military developments and operations in Syria.
Lukas Andriukaitis is a Digital Forensic Research Associate at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).
Follow along for more in-depth analysis from our #DigitalSherlocks.
