Chapter 6 - Applying open-source methods to debunk 'fake news' about Syria

From analogue to digital

Fake news, disinformation, propaganda, no matter the term, the challenge of disinformation has reached a new level of complexity in a hyperconnected world. The days in which information flowed in one direction, from governments, publishers and broadcasters to the public are over. Today, every smartphone user can be broadcaster as well as consumer, reporter as well as reader. This tectonic shift only began a decade ago, but already more than 3.8 billion people have access to the Internet; 2.9 billion are social media users; and 2.7 billion are mobile social media users.

This revolution presents potent new tools for the study of conflicts, crises and disinformation and has motivated an entire movement of so called Digital Sherlocks to focus on methods that help filter through the fog of disinformation. Conflict zones and hotspots that were once unreachable can now be accessed through online posts. Hostile disinformation actors are aware of the opportunities this new environment presents and are working around the clock to exploit this information and undermine the basic principles of reality.

Background of the Syrian conflict

The case of Russia’s role in Syria underscores the challenges posed when a state actor utilises disinformation and deception to back its acts of aggression. Such methods allowed Russian President Vladimir Putin, in the last few years, to move from one foreign policy adventure to the next, in the process weaponising information against Western societies.

In 2014, Putin ordered the annexation of Ukraine’s Crimea, overseeing a clandestine war in eastern Ukraine and backing Russian proxies with weapons, fighters and entire army units. As that war ground down into stalemate, Putin turned his eyes to Syria. After a rapid diplomatic campaign, and an equally rapid military build-up, he launched air strikes in the war-torn country. Russia’s military campaign allowed Assad’s forces to retake lost ground, a task they completed with great brutality and immense human suffering. Far from shortening the war, it exacerbated it, and in so doing, it sent yet more waves of refugees flooding into Turkey and Europe. None of this would have been possible without the veil of disinformation under which Putin and the Assad regime covered their actions and atrocities.

The veil

Putin cynically claimed that Russia’s presence in Syria was aimed at fighting Daesh, openly encouraging the myth that Russia was fighting terrorism, that the Assad regime was innocent of atrocities, and that the Syrian uprising was instigated by the West. The veil was successfully held in place by employing three strategies:

1. Denying the deed. The simplest response to allegations of civilian casualties and indiscriminate strikes was to deny them. Throughout the conflict, and in defiance of the evidence, both the Syrian and Russian governments rejected such allegations outright.
2. Militarising the victims. In parallel to the campaign of denial, Syrian and Russian officials repeatedly misidentified their targets, presenting civilians as combatants. This re-branding of civilians as legitimate military targets covered both entire city areas and individual buildings. By repeatedly blurring the distinction between Al-Qaeda-linked forces and other groups, Russia and Syria were able to create an impression that all groups targeted by them were extremists.
3. Attacking the witnesses. As became particularly clear during the siege of Aleppo in 2016, eyewitness evidence could discredit the Russian and Syrian attempts to militarise victims; airstrikes were hitting civilian buildings and civilians were dying. In response, Syrian and Russian officials began to attack the credibility of such witnesses. One of the most important witnesses to the suffering was the aid organisation initially called Syria Civil Defence, later dubbed the ‘White Helmets’ after its staff’s trademark headgear. In Aleppo, the White Helmets began as a rescue organisation in early 2013^{Footnote 25}. As the conflict intensified and independent journalists no longer had access to the front lines, the White Helmets increasingly became a main source of evidence of the true nature of the bombings, posting GoPro footage of airstrikes and their aftermath. This put them on a collision course with the government and its allies.

Those seeking to spread disinformation leave a distinctively different digital footprint than those that are found in reality, offering an opportunity to confront such actors through a verification and fact-centred approach to information utilising open-source, social media and digital forensic research that harnesses the power of the digital age. In doing so, the aggressor’s actions can be limited by exposing its falsehoods and lifting the veil that covers its crimes and atrocities.

Lifting the veil

Open-source footage shows the repeated use of banned cluster munitions and strikes on targets, including mosques, hospitals and water treatment plants in Syria. By comparing and using the masses of information available about these attacks and atrocities, it is possible to examine their number and scale across Syria, the anatomy of individual incidents, and the impact of multiple attacks on individual facilities. This becomes a particularly powerful tool in response to Russia’s false claims, lifting the veil of disinformation.

In the final weeks of the siege of the strategic city of Aleppo, Kremlin spokesperson Dmitry Peskov argued that there was no evidence of hospital strikes, and Assad claimed that there was no such policy of targeting. However, the verified proof (including witness testimonies, news footage, videos shot from security cameras and by rescuers, as well as photographs) suggests that the Assad government and its allies, including Russia, did indeed have a policy of targeting Syria’s hospitals. For example, the SAMS-supported M2 hospital in al-Maadi district was reportedly damaged in at least twelve attacks between June and December 2016. By examining digital breadcrumbs from the incident (such as open-source videos and images, satellite images of the area around the hospital, and published CCTV footage) it is possible to confirm that the M2 hospital was repeatedly struck between June and December 2016, the damage being consistent with the use of air-dropped bombs and artillery. Equipment and vehicles used by the hospital were damaged and destroyed, and the attacks severely reduced the hospital’s ability to serve the local population.

As public awareness of the plight of Aleppo’s hospitals grew, so did official denials. Between 28 September and 3 October 2016, the SAMS-supported al-Sakhour hospital (also known as the M10 hospital), was hit in three separate incidents, damaging the hospital buildings and killing staff and patients. In a press conference, the Russian Ministry of Defence (MoD) denied that attacks on the facility had taken place. The MoD briefer, Lieutenant-General Sergei Rudskoy, presented satellite imagery, which he claimed was taken between 24 September and 11 October, stating “no changes to the facility can be observed” and that “this fact proves that all accusations of indiscriminate strikes voiced by some alleged eyewitnesses turn out to be mere fakes”. However, open-source and satellite imagery illustrated different levels of damage to the hospital area after each attack, proving that the Russian MoD’s imagery was deceptive^{Footnote 26}.

As with hospital strikes, reports of incendiary strikes have been vigorously denied. In late 2015, Major-General Igor Konashenkov, the spokesperson of the Russian MoD, explicitly denied the use of incendiary weapons and accused Amnesty International of “fakes” and “clichés” in a report alleging their use^{Footnote 27}. However, RT (formerly Russia Today) broadcast a striking piece of evidence on 18 June 2016, from Hmeimim, a primarily Russian air base southeast of the city of Latakia. Footage of the Russian defence minister visiting the base showed RBK-500 ZAB-2,5S/M incendiary cluster weapons being mounted on a Russian Su-34, a fighter ground attack aircraft operated only by Russia in Syria^{Footnote 28}. The specific part of the video showing the incendiary cluster weapons was later cut out of a version of the video report uploaded to YouTube by RT^{Footnote 29}.

As with the hospital strikes, some of the reported incendiary attacks have been documented in detail and can be independently verified. One such attack occurred between the towns of Rastan and Talbiseh in Homs province on the night from 1 October to 2 October 2016. Local pro-opposition media uploaded a video to their Facebook page that purportedly showed the moment of impact of the incendiary weapon^{Footnote 30}. In the days following the incident, the Syrian Civil Defence—the White Helmets—published photos on their Facebook page claiming to show weapon fragments^{Footnote 31}. Using reference photos and inscriptions on those remnants, the Conflict Intelligence Team (CIT), a group of Russian digital forensic researchers, positively identified the weapon as a RBK-500 ZAB-2,5S/M incendiary cluster bomb^{Footnote 32}.

The Cyrillic inscriptions on the casing read RBK 500 ZAB-2,5S/M. ZAB is an abbreviation of the Russian Зажигательная Авиационная Бомба (‘incendiary aviation bomb’). Further, weapon remnants resembled reference photos of the cluster and submunitions available from open sources. A large remnant strongly resembled the lid (nose part) and cylindrical casing of an RBK-500 series cluster bomb, and the smaller remnants were identified as two different types of incendiary submunitions: the ZAB-2,5S and the ZAB-2,5(M). These specific types of weapons were not documented prior to Russia’s intervention in Syria, leading CIT to conclude that the airstrike was likely conducted by the Russian Air Force. CIT was not able to establish whether the buildings targeted had been inhabited: if they had, the group argued, the attack would have been illegal under the convention^{Footnote 33}.

The opportunity

Even though the conflict in Syria rages on and Vladimir Putin managed to keep the international community in a stalemate over how to address the crisis, Russia’s disinformation campaign in Syria has also shown weaknesses that serve as opportunities to hold regimes and autocratic governments accountable.

In a hyperconnected age, fighting disinformation by countering disinformation only one event at a time is an approach that brings limited gains and leaves the wider challenge unsolved. Simply countering disinformation by presenting opposing narratives is a symptoms-focused approach, and fails to address the source and methodology of information campaigns. Further, a lack of digital resilience and the lack of government guidance and education to equip policy-makers and citizens with appropriate tools have left societies vulnerable to less benevolent forces that know how to take advantage of such a vacuum.

What is required is an approach that empowers individuals not only to discover information about Putin’s war in Syria, but also to verify the information themselves. Such an approach is the polar opposite of Russia’s opaque disinformation campaign, which relies on ideological narratives over verifiable facts. Western societies must be armed with methods that assist them to differentiate between what is fact and what is fiction.

Only with a robust civil society in place can a credible response unveil the crimes committed by regimes. Adopting hyperconnected solutions around a methods-centred approach to defeating disinformation by actors such as Russia in the Middle East will become more important as the Internet expands. More importantly, as the use of artificial intelligence and deep learning to create disinformation grows, undermining disinformation through a robust level of digital resilience will become increasingly important.