#PutinAtWar: Civilian Casualties in Ash Sha’Fah

A closer look into official Russia’s military claims about bombings in eastern Syria

(Source: YouTube / Минобороны России)

As Russia continues to back the Assad regime fighting across Syria, a series of bombing raids in the eastern part of the country did not fall exclusively into their stated mission of fighting ISIS. The Russian military was accused of killing at least 53 civilians in an air strike on November 26 using Tu-22M3 (NATO reporting name: Backfire) long-range bombers. Russia publicly denied the claim of civilian casualties.

@DFRLab has previously reported on Russia’s alleged fight against ISIS in eastern Syria. In this instance, we found open source evidence that shows Russia was, in fact, operating in the area in which they denied any activity that led to 53 civilian casualties in the village of Ash Sha’Fah.

General Overview

On November 23rd the Russian military released a public statement and readout a long-range bomber raid in Syria. As with most of the Russian Ministry of Defence (MoD) public statements, it briefly mentioned the mission, the supposed target, and units and military equipment involved. According to the statement, on November 23rd, Tu-22M3 long-range bombers of the Russian Aerospace Forces carried out a massed air strike on terrorists’ objects in and near Abu Kamal, Deir ez-Zor province, Syria. These bombers allegedly targeted ISIS strongholds near the settlement of al-Qut’ah. Pinpoint Su-24 bombing was also briefly mentioned.

No videos were added to the statement, but Russian MoD released video footage claiming to be bombing during the same period via official YouTube or Twitter accounts.

Russian Air Strikes

@DFRLab analyzed provided video footage to see if the locations mentioned actually match the video footage. Here’s how it looks on the map:

November 23rd video:

In the video published on November 23rd, a Russian Tu-22M3 bomber appeared together with Su-30 fighter jet (NATO reporting name: Flanker-C). The Tu-22M3 dropped a series of bombs in the vicinity of Ash Sha’Fah, the Euphrates river bend in the background appears to be right next to the village of As Susah.

Footage from November 23rd video. Left: (Source: GoogleMaps); Top Right: (Source: YouTube / Минобороны России); Bottom Right: (Source: YouTube / Минобороны России).

November 24th videos:

On November 24th two different videos were released. In both, the Tu-22M3 also appeared to drop bombs in the Deir ez-Zor province.

In the first video, we can clearly identify that the planes were flying close to the town of Hajin. It is impossible to tell where the bombs are dropped, because of the clouds in the background.

Footage from November 24th video. Top Left: (Source: GoogleMaps); Bottom Left: (Source: GoogleMaps);Top Right: (Source: YouTube / Минобороны России); Bottom Right: (Source: YouTube / Минобороны России)

In the second video released on November 24th, the Tu-22M3 bomber appeared to be flying in the opposite direction than in the first video. The river bend next to the town of Subaykhan is observed on the horizion. The bombs in the video most likely fell somewhere between the towns of Hajin and Subaykhan.

Footage from November 24th video. Left: (Source: GoogleMaps); Top Right: (Source: YouTube); Bottom Right: (Source: YouTube / Минобороны России)

November 26th video:

The bombings before November 26th did not receive media attention, and the military operation was carried out business as usual. However, on November 26th, the Russian Military was publicly accused by the UK-based Syrian Observatory for Human Rights (SOHR) of killing at least 53 civilians in the village of Al-Shafah in the air strikes. Russian military denied hitting the village and called the report fake news on the same day without providing verifiable evidence.

The official Russian MoD website released no official statement about the alleged November 26th bombings. An articles about a four day long-range bombing campaign in Deir ez-Zour province was published in Kremlin media outlet — RT on November 27th. The reports mentioned strikes were made on Sunday, November 26th. In parallel, a video appeared on the official Russian MoD YouTube channel on November 26th. According to Amnesty International YouTube viewer, the video was uploaded on 15:23:57 (UTC). The main difference from the other bombing videos posted by the Russian MoD was that this video was cropped right when the bombs start to fall, as if no geolocation details were intended to be exposed.

Compared with the videos of November 23rd and 24th, no geolocation clues were visible, which is most likely deliberate given the claims of civilian casualties in the same time period. @DFRLab deconstrucuted the video in question frame by frame. At exactly 0:16.29, a single frame revealed additional and important information.

Slow-motion version of the video (0:14–0:17s). (Source: YouTube / Минобороны России)

The snapshot showed the bombs falling and the contours of Euphrates river.

Snapshot of the video at 0:16.29. (Source: YouTube / Минобороны России)

The snapshot is low image quality, there are a number of clouds in the picture, and the details are blurry. Nevertheless, the contours of the Euphrates river suggest that the location of falling bombs is in the vicinity of Ash Sha’Fah village, where the civilian deaths were reported by the Syrian Observatory for Human Rights and where RT reported a four day long-range bombing campaign.
The top right image is the snapshot from the Russian MoD’s video, the bottom right image is the exact same snapshot with enhanced colors, in order to see the river bend more clearly. Judging from the river bend contours and the semi-circle of the dessert in bottom right of the image, the location of the snapshot is a match with the vicinity of Ash Sha’Fah (image on the left).

Left: (Source: GoogleMaps); Top Right: (Source: YouTube / Минобороны России); Bottom Right: (Source: YouTube / Минобороны России).


Russian Military officials claimed the bombing of Ash Sha’Fah, which killed 53 civilians, as fake news. Open source evidence raises questions about these claims. The official bombing video that surfaced on November 26th had a snapshot image, which was not supposed to be there. The video has arguably been cropped to remove all the geolocation information, which lends to the conclusion that this time the Russian military did not want the public to know more details about the bombing.

The snapshot image suggests that the location of the bombing was in the vicinity of Ash Sha’Fah. Even if this single frame cannot be used as solid proof of Russia’s activity in the vicinity of Ash Sha’Fah, it is actual evidence that there are more videos of the bombings which Russia is reluctant to share, and corrobores third party claims from the Syrian Observatory for Human Rights. 
 @DFRLab will continue monitoring Russia’s military actions in Syria.

Lukas Andriukaitis is a Digital Forensic Research Associate at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Follow along for more in-depth analysis from our #DigitalSherlocks.