Jan 17, 2018
#PutinAtWar: Khmeimim Under Mortar Fire
A deeper look into December 31 mortar attack in Khmeimim airbase
As the Russian military continued active military involvement in Syria, retaliation also grew. @DFRLab previously reported that on December 31, Khmeimim airbase was targeted with mortar fire. This report was soon contested by different media outlets and by the Russian Ministry of Defense. With new information surfaced, @DFRLab took a deeper look into the alleged mortar attack.
Different Reports
On January 3, Russian media outlet Kommersant (Коммерсантъ) published an article, which claimed that Khmeimim was shelled by mortar fire. Kommersant reported at least ten servicemen were wounded, as well as four Su-24 fighter bombers (NATO reporting name: Fencer), two Su-35S fighters (NATO reporting name: Flanker-E), an An-72 transport plane (NATO reporting name: Coaler), and an ammunition depot were destroyed by the shelling. Two “military-diplomatic” sources were cited.
On January 4, Sputnik News provided a different report, which stated only two Russian servicemen were killed and the Kommersant report was fake. The information in the Sputnik News report derived from the official Russian Ministry of Defense (MoD) statement released on Thursday. The fact that the Russian MoD released the statement four days after the attack and only after Kommersant leaked the information, suggested the MoD did not want this story to become public.
A recent report by the Wall Street Journal (WSJ) revealed further details, which questioned whether militants used mortars during the attack. According to an undisclosed WSJ source, Khmeimim was actually attacked by improvised and homemade drones.
Photos of Damaged Aircraft
Also on January 4, a few hours after Sputnik News denied the damaged airplanes, Russian reporter Roman Saponkov published three photos of damaged aircraft on his personal VK account, allegedly from the Khmeimim airbase. These photos received significant engagement online.
The photos showed damaged aircraft, which appeared to be Sukhoi Su-24. The post claimed each photo was taken after the mortar attack. @DFRLab previously reported on Russian Air Force actively using this aircraft in Syria last year.
In the first photo (showing a leaking fuel tank of the Su-24), military structures are visible. These structures, when cross-referenced with RT news video and satellite imagery, coincide with the structures behind the stationed aircraft on the Khmeimim airbase. Analysis suggests the damaged plane in the photo was located near Khmeimim airbase terminal.
In the background of the second photo (with a torn horizontal stabilizer of Su-24) a camouflaged military structure with a vertical pole resembling an antenna can be seen. This structure, much like the first photo, suggests that the location of this aircraft was also near the Khmeimim airbase terminal.
Here is the possible location of the damaged aircrafts pinpointed on the map.
Aircraft №29
The geolocation evidence provided enough geolocation information to claim the likely location of the aircraft was, in fact, Khmeimim airbase.
Nonetheless, what caught @DFRLab’s attention was the individual aircraft service number (№29), on a vertical stabilizer in one of the photos. This service number is given to the aircraft in order to recognize an individual aircraft in a large fighting fleet. After brief analysis of Russian media news reports from Khmeimim base, the Su-24 bearing the service number 29 was found in two videos: December 7, 2017 and January 5, 2018. The appearance of a Su-24 (№29) in a January 5, 2018 video (five days after the mortar attack) raises questions about the legitimacy of the photos, because aircraft seems to be fully operational.
When the aircraft from both videos are put into comparison, small details suggest that it might not be the same aircraft. The aircraft featured in the December 7 video lacked the bottom sign (ВBC России) on the vertical stabilizer, compared with the Su-24 in January 5 video. Also, the brim of the horizontal stabilizer in the December 7 video appeared to be grey/light-grey and the one in January 5 video appeared to be white.
When the video footage was compared with the picture posted by Roman Saponkov, it seems to resemble the aircraft from the December 7 video. The brim of the horizontal stabilizer appears to be light-grey and the sign (ВBC России) is not visible on the vertical stabilizer.
Even though there are no concrete evidence to address these small differences, a few explanations are possible. The first explanation argues that the aircraft might have been replaced after the attack and provided with the same service number to cover the loss. Changing of aircraft insignia and service numbers is far from a new practice for the Russian Air Force in Syria.
Another possible explanation could be that the aircraft was repainted in between the two videos being taken. Lastly, the January 5 video could have been filmed before the attack and only released a few days later. Nonetheless, these small mismatches raises doubts about the official Russian MoD narrative.
Conclusions
The reaction of Russian MoD in the story of Khmeimim airbase mortar attack remains conspicuous. Not only the official statement was released four days after the attack, it also appeared a day after the Kommersant report that depicted higher manpower and equipment losses. Comparison of small details of the aircraft suggests that the Su-24 №29 that appeared on January 5 video might be a different aircraft with the same service number. The whole set of evidence suggested that the mortar attack on Decemeber 31 was more damaging than the Russian MoD wanted the public to know. And judging from the late, and provoked, MoD public statement — they did not wanted public to know this story at all.
@DFRLab will continue monitoring Russia’s military involvement and developments in Syria.
Lukas Andriukaitis is a Digital Forensic Research Associate at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).
Follow along for more in-depth analysis from our #DigitalSherlocks.
