Times Insider explains who we are and what we do, and delivers behind-the-scenes insights into how our journalism comes together.
“Srabota,” the Russian pilot said.
The Russian phrase, which directly translates as “it’s worked,” was confirmation that he had released his weapon on a target in Syria: Nabad al Hayat Surgical Hospital near the town of Haas in Idlib Province.
Beginning in 2017, The Times’s Visual Investigations team has tracked the repeated bombing of hospitals in Syria, an apparent strategy of the Syrian military and Russia, its ally. More than 50 health care facilities have been attacked since the end of April in an offensive to reclaim Idlib Province from militants opposed to Syria’s president, Bashar al-Assad, according to the United Nations’ Office of the High Commissioner for Human Rights.
Our team combines traditional reporting with advanced digital forensics to understand major events in conflicts that Times reporters can’t access on the ground, like a chemical attack in Syria or an American airstrike in Afghanistan.
Finding visual evidence of Syrian hospitals that were badly damaged was not hard. We collected hundreds of photos and videos from Facebook groups and Telegram channels, two places on social media where Syrian journalists and citizens had shared hours of footage. Along with medical and relief organizations, users on those platforms sent us even more documentation, including internal reports and unpublished videos.
While Russia has long been suspected of being behind these hospital bombings, direct evidence of its involvement was difficult to find, and Russian officials have denied responsibility.
During our investigation, we obtained tens of thousands of previously unpublished audio recordings between Russian Air Force pilots and ground control officers in Syria. We also obtained months of flight data logged by a network of Syrian observers who have been tracking warplanes to warn civilians of impending airstrikes. The flight observations came with the time, location and general type of each aircraft spotted.
Could these communications, each only a few seconds long and riddled with seemingly indecipherable military jargon and code words, be direct evidence of Russia’s violating one of the oldest rules of war?
Times reporters spent weeks translating and deciphering code words to understand how Russian pilots carry out airstrikes in Syria. This spreadsheet shows part of the communication between one pilot, identified as “48,” and the ground controller, “Fuse,” during a strike on Nabad al Hayat Surgical Hospital.CreditThe New York Times
We needed to verify and match the Russian communications and flight logs with the other airstrike information we had gotten, including satellite images and doctors’ witness statements. Deciphering the communications and finding the precise time and location of each hospital strike proved to be the key.
We had months of data but decided to focus on May 5 and 6, when four hospitals had been bombed. Each was on a United Nations-sponsored “deconfliction list” meant to spare it from attack, according to the World Health Organization.
We eventually saw patterns in the data. The clearer the picture got, the more damning it became for Russia.
We then organized and merged all of this information into a spreadsheet database. A data analyst in our Graphics department, Quoctrung Bui, designed a tool that allowed us to filter and search thousands of data points by time and place.
For each airstrike, we examined the evidence recorded at the time of the attack: Were Russian Air Force aircraft in the air? Were they spotted near hospitals? What were they talking about on the intercepted audio?
In the case of Kafr Nabl Surgical Hospital, which had been bombed repeatedly and restored with help from the W.H.O. in March, local news coverage and incident reports placed the time of the attack at about 5:30 p.m. on May 5.
Witnesses are often central to estimating timing, so we spoke to a doctor who was working at Kafr Nabl when it was hit. He said the hospital was first struck at 5:30 p.m., with three more airstrikes following five minutes apart.
Local media activists started filming after the first strike. Four of them caught the next strike on video. Did they all show the same airstrike? Or multiple ones — perhaps even four, as the doctor described?
To find out, we needed to know whether the videos were filmed in Kafr Nabl. Using Google Earth, we labeled landmarks, like a minaret and a water tower, and kept track of the nearby hills and mountain ridge.
This practice, known as geolocation, can determine the exact site of a photo or video by using landmarks and geographical features and corroborating them with satellite imagery. We managed to geolocate all of the videos and determined that the explosions all happened at Kafr Nabl Surgical Hospital.
We then analyzed the explosions and smoke patterns. After going through each video frame by frame and lining up several videos next to each other, we realized we had footage of three different strikes from multiple angles.
Videos filmed by media activists in Syria capture the moment of an airstrike on Kafr Nabl Surgical Hospital on May 5, 2019. The World Health Organization-supported hospital was bombed four times in eighteen minutes.CreditCreditClockwise from top left: Halab Today TV, Hadi Alabdallah, Euphrates Post, via Facebook. Composite image: Dave Horn/The New York Times.
An analysis of the shadows in the video allowed us to estimate the times of the strikes. But to get the exact time, we asked local journalists and news agencies to send their footage so we could use the files’ metadata to see when each strike hit the hospital, down to the second: 5:36:12, 5:41:14 and 5:49:17 p.m.
We knew that at least three, possibly four, airstrikes had hit the hospital. But we didn’t have a culprit. The flight logs and videos of the aircraft above Kafr Nabl that day didn’t have the key either. Both Russian and Syrian air forces had been active. It was a perfectly ambiguous situation: We didn’t know who bombed the hospital, but it must have been one of the two.
But the Russian Air Force communications provided the clearest evidence of Russia’s responsibility because we had the exact time of the explosions from the video metadata. A Russian pilot released four weapons at those very times.
The pilot, who identifies himself as “72,” says “Srabota” at 5:30 p.m. He repeats that five minutes later, at 5:35 p.m. — and at 5:40 and 5:48 p.m. Four weapon releases in all, each about five minutes apart and about some 40 seconds before the time of impact we had calculated from video metadata.
Because the hospital was dug deep under its original building after repeated bombings, only one person was killed. Many others were injured.
We saw three other instances when the Russian Air Force “worked” on hospitals over a period of 12 hours in early May. The evidence was clear in each case. Less than a day of air activity in a four-year-old Russian air war paints a damning picture for a permanent member of the United Nations Security Council.
Reporting was contributed by Quoctrung Bui, John Ismay and Haley Willis.
Graphics by Dave Horn. Video credits: Halab Today TV, Hadi Alabdallah, Euphrates Post (via Facebook) and Syria Call.
Follow the @ReaderCenter on Twitter for more coverage highlighting your perspectives and experiences and for insight into how we work.
Real Estate, and Personal Injury Lawyers. Contact us at: https://westlakelegal.com