Chapter 15: Fakes and Fantasies
Advocates of conspiracy theories usually avoid questions about how any particular conspiracy might have been organised. They talk about “controlled demolitions” in connection with the 9/11 attacks but don’t explain how the buildings could have been rigged with explosives without anyone noticing or why no one among the many people who would be needed to implement such a plot has spoken about it since.
Similarly with Syria, fabricating chemical attacks wasn’t as simple as the regime’s defenders made it sound, especially under war conditions. To create a trail of false evidence for a sarin attack rebels would, at the very least, need some sarin. But laboratory tests on samples from the scene of attacks showed it couldn’t just be any kind of sarin. It would have to be sarin with chemical “signatures” that were consistent with the formula and production process used – apparently uniquely – by the Syrian government. Questions about how this deception might have been contrived drew only vague answers from the believers in rebel fakery but they were questions that the OPCW’s Investigation and Identification Team (IIT) had to consider as part of its brief to identify perpetrators.
The IIT had a list of nine cases to work through – including Douma – and its first report focused on three incidents in Ltamenah during March 2017. Two of them, on 24 and 30 March, involved sarin and the IIT found “reasonable grounds” to believe that both attacks were carried out by an Su-22 warplane belonging to the 50th Brigade of the Syrian 22nd Air Division and operating from Shayrat airbase. At least 16 people were affected by the first attack and at least 60 by the second one.
The IIT said its conclusions were based on a “holistic assessment” of the evidence, and on “the combination, consistency, and corroboration of all of the information gathered as a whole”. Explaining the phrase “reasonable grounds”, it said this degree of certainty was in line with standard practice of international fact-finding bodies and commissions of inquiry and meant that “an objective observer would reasonably conclude that a violation was committed”. A classified version of the IIT’s report available only to OPCW member states named military commanders on the government and rebel sides who were active in the area at the time. Names were omitted from the published version, though it retained their job titles, making some of them very easy to identify. One was “General [REDACTED]”, the armed forces’ Chief of Staff, reportedly acting “upon the directives of President [REDACTED]”.
Based on metal fragments recovered from Ltamenah, the IIT concluded that the munition involved on 24 and 30 March was a M4000 aerial bomb designed and made by the Syrian government for use as a chemical weapon. Syria’s sarin was stored in binary form as two separate chemical components to be mixed just before use, and for that reason the M4000 had two compartments separated by a membrane. One compartment was to be filled with methylphosphonyl difluoride (DF) and the other with hexamine and isopropanol. The rear compartment included a paddle to pierce the membrane and start the mixing process before attaching the bomb to an aircraft. To release sarin, the M4000 contained a small bursting charge of TNT triggered by a fuse attached to the nose.
The Syrian government denied having any M4000 bombs in its possession at the time of the Ltamenah attacks. It claimed they had all been destroyed or converted into explosive bombs shortly after Syria joined the Chemical Weapons Convention, though in the absence of supporting evidence OPCW officials were sceptical of the claim.
Before reaching its conclusion that government forces were responsible, the IIT considered various alternative scenarios where the attacks might have been faked by rebels. Since the rebels were not in a position to drop bombs from aircraft, one hypothesis was that they could have obtained an empty M4000 bomb and blown it up with explosives (so as to appear that it had been used), later adding illicit chemicals to the wreckage.
Munition specialists consulted by the IIT found this an unrealistic proposition. In particular, they pointed out that a fuse recovered from the scene in Ltamenah showed signs of having functioned “in a normal way on impact”, with no evidence of damage from an external explosion. If the rebels had used their own explosives to damage the munition they would also have had to ensure that the resulting crater was the right size, since in normal use the M4000 left a smaller crater than conventional bombs. The idea that rebels had obtained an empty M4000 was also ruled out by the Syrian government, which repeatedly denied that any of its stockpile had been lost, stolen or captured.
The IIT also explored an alternative suggestion: that rebels might have gathered fragments of chemical munitions from an old testing range. It considered this implausible, partly because of the difficulty rebels would have had in keeping the fragments “in appropriate conditions” for later use in a faked attack. It did, however, learn of a testing range which the Syrian government had stopped using in 2009. Armed groups close to ISIL/Daesh had reached the area in 2016 and early 2017 though it was unclear whether they ever took over the facility and, according to further information obtained by the IIT, none of the aerial munitions tested at the range had contained sarin.
The overriding problem with these alternative scenarios was that laboratory tests revealed evidence of sarin not only in the remains of the munitions but also in soil samples. This meant that even if rebels had faked the attacks they would still have needed their own supplies of sarin. Furthermore, the only known source for the type of sarin involved was the Syrian government.
Various chemical markers showed that the sarin used in Ltamenah was “consistent” with sarin from the Syrian government’s stockpile and also with the government’s production processes. The report said: “The IIT received no information that the sarin found in Ltamenah could have been developed in this way elsewhere, yet resulting in the ‘signature’ evidenced by that specific collection of chemicals. On the basis of the investigations of the IIT, this type of sarin is not known to have been developed and manufactured by states or entities other than the authorities of the Syrian Arab Republic.” The report added that the chemical “signature” from the two incidents in Ltamenah suggested the sarin was from the same source as that used in the Khan Sheikhoun attack a few days later – for which the UN’s Joint Investigative Mechanism had previously blamed the Syrian government.
Regarding the other incident in Ltameneh, on 25 March, witnesses had reported seeing a helicopter dropping cylinders, one of which crashed through the roof of an underground hospital, releasing a chemical. The hospital was quickly evacuated but a doctor who stayed behind to complete an operation later died.
An earlier report from the Fact-Finding Mission concluded it was “very likely” that chlorine had been used as a chemical weapon and after further investigation the IIT reported: “There are reasonable grounds to believe that, at approximately 15:00 on 25 March 2017, a helicopter of the Syrian Arab Air Force, departing from Hama airbase, dropped a cylinder on the Ltamenah hospital; the cylinder broke into the hospital through its roof, ruptured, and released chlorine, affecting at least 30 persons.” The IIT said it had considered the possibility that the cylinder “was delivered not by helicopter, but rather by surface-to-surface weapons or placed in the hospital” but found such a conclusion “incompatible with the information obtained, considered in its totality”.
The IIT’s second report, issued in April 2021, concerned an incident in Saraqeb three years earlier. It found “reasonable grounds” to believe that a military helicopter from the regime’s Tiger Forces had dropped at least one cylinder. “The cylinder ruptured and released a toxic gas, chlorine, which dispersed over a large area affecting 12 named individuals,” the report said.
The Syrian authorities had claimed the Saraqeb attack was faked and, according to the IIT, suggested specific leads for investigation but without providing concrete evidence. Nevertheless, the report said, the IIT had “pursued these avenues of inquiry with a variety of other sources”. In that context, the IIT said it received information that the damage on two cylinders found in the area was the result of being dropped from a 200-metre radio mast in the vicinity rather than from a helicopter. However, the IIT said it could find no source, other than mere speculation, supporting the idea. It added that imagery of the ground near the radio mast showed craters caused by explosions but not the type of crater that would be caused by dropping a cylinder.
Pursuing the perpetrators
The IIT’s findings had no automatic consequences for those identified as perpetrators but its investigations were a step towards accountability and a way of supporting the norm against chemical weapons. At an international level it was about maintaining a rules-based international order – specifically, compliance with the Chemical Weapons Convention by its signatories – but the obstacles were not to be underestimated, as a report from the UN Institute for Disarmament Research noted:
“In international law, states are, at the same time, the source of the law, the prosecutor of violations, the judge, the executioner, and (if in violation of norms) the culprit. Enforcing international law requires a degree of cooperation and acceptance of generally agreed rules by all states concerned. Unity in the Security Council is key to creating conditions that would ensure such cooperation. When this willingness to cooperate and apply common rules is lacking, narrow national interest and geopolitical considerations can become predominant and collectively enforcing the law becomes increasingly difficult.”
At the level of individuals, though, it was about criminal responsibility and there were various initiatives to compile evidence for eventual use in war crime trials. One of these was the International, Impartial and Independent Mechanism (IIIM), established by the UN General Assembly in 2016 “to collect, consolidate, preserve and analyse evidence of violations of international humanitarian law and human rights violations and abuses and to prepare files in order to facilitate and expedite fair and independent criminal proceedings, in accordance with international law standards”.
This was followed in 2018 by the International Partnership Against Impunity for the Use of Chemical Weapons, initiated by France and supported by the European Union and 40 individual countries. Unlike the IIIM, which was concerned specifically with breaches of international humanitarian law in Syria, the focus of the International Partnership was on combating the proliferation or use of chemical weapons – potentially in other countries besides Syria. One of its stated aims was “to gather, compile and retain all available information on those who use chemical weapons” and another was to share this information “with countries and relevant international organisations so that the perpetrators will one day be held accountable for their actions”. It maintained a public list of individuals and entities sanctioned as a result of being identified for involvement in the use or development of chemical weapons.
Previous experience in the Balkans, Libya and the Democratic Republic of Congo had shown the importance of collecting evidence of atrocities while a conflict is ongoing, rather than waiting for it to end. The Commission for International Justice and Accountability (Cija) sought to do so and by 2021 it had collected more than 1.3 million documents from Syria, including 300,000 items relating to the Islamic State group (Daesh). As a non-governmental organisation, though with funding from governments, it worked largely undercover collecting documents in bulk from recently abandoned offices and other facilities in Syria. These were then transported abroad, often at considerable risk, and stored in a safe location. Cija staff worked with scanned copies to index them and analyse their content.
These activities began to bear fruit when a court in Germany jailed Eyad al-Gharib, a Syrian security officer, on charges of “aiding and abetting a crime against humanity in the form of torture and deprivation of liberty”. It was the first trial of its kind for a Syrian government official and Cija’s evidence played a part in his conviction.
Cija also uncovered evidence that helped authenticate photographs passed to an opposition group, the Syrian National Movement, by a defector codenamed “Caesar”. Caesar worked as a police photographer in Syria and had access to a vast database of images, many of them showing the bodies of people who had died in custody after being tortured. By the time he defected, Caesar had copied more than 50,000 images from the database.
Many of the photos showed bodies of soldiers, rebel fighters and civilians killed in the conflict but others showed people who had who died in detention or after being transferred from detention to a military hospital – a total of at least 6,786 detainees, according to Human Rights Watch. President Assad claimed the photographs were faked, though there was plenty of evidence indicating they were genuine. Many of the detainees’ bodies had obvious signs of torture – including eyes gouged out – and had a prisoner number, either marked on the body or attached to it. Documents retrieved by Cija provided further verification because of some the numbers on the bodies matched those in documents detailing where individual prisoners had been held.
Cija’s activities had come to the attention of Paul McKeigue of the Working Group on Syria, Progaganda and Media – the Edinburgh University professor who believed rebel groups were killing people in gas chambers. McKeigue wrote in an email that his group had “serious concerns” about the reliability of the evidence provided by Cija and “the possibility that this could lead to miscarriages of justice”. To counter Cija’s activities he proposed using what he described as the Al Capone tactic. “Even if we can’t bring them down over war crimes we may be able to get them over fraud,” he wrote.
At the time, Cija was facing allegations of financial irregularities and was under investigation by the EU’s anti-fraud agency, Olaf. However, according to the European Commission the issue was about invoicing on an EU contract and did not cast doubt on Cija’s work compiling evidence from Syria.
Exchanging emails with Ivan
Meanwhile, Professor McKeigue had begun his own investigation of Cija and he sent a list of questions to Bill Wiley, the organisation’s Canadian founder and director. Wiley was immediately suspicious because McKeigue didn’t ask about Cija’s work and seemed only interested in Wiley’s business activities.
Shortly afterwards, McKeigue received an email from an unknown sender. It said: “My office heard from London yesterday that you have some questions about Cija. Perhaps we can help you get to the truth.” This marked the start of an email correspondence that continued for three months. McKeigue’s new contact told him: “We know your work which is consistent with our thinking. Send your questions. One or two to build confidence. Any answers will be on background only.”
In response, McKeigue asked about Wiley’s sex life and whether he might have a drug habit, but the contact steered him away from that: “We are interested in Wylie’s attacks on Syria and its people, not these personal matters ... He is an American CIA asset hiding in the open.”
McKeigue replied that he would need more details of the alleged CIA connection: “If we just come straight out with ‘Wylie is CIA’ I think we will be derided as conspiracy theorists making wild unsourced allegations.” His contact responded: “My colleagues laughed in a knowing way when this was read to them. What sort of evidence would you want to feel comfortable stating this fact? If we can provide it without damage to our sources we will do that.”
The contact’s use of English was a bit odd, suggesting it was not his mother tongue. After a while he identified himself as “Ivan” and began addressing McKeigue by his first name. “Dear Paul,” Ivan wrote. “Thank you very much for your letters from last night and now. We translated it and pasted your email yesterday into cable to Moscow. Your letter from today we will also send it to Moscow without a translation, to not cost time because some speak English but not the bosses.”
Ivan gave plenty of hints that he was working for Russian intelligence, though he never said so explicitly. He advised McKeigue about people to speak to and people to avoid, and McKeigue agreed not to contact any Cija staff without checking with Ivan first.
McKeigue eventually reported to Ivan that he had found evidence of Bill Wiley’s CIA connection. Although Wiley said he had never worked for the intelligence services he had been employed by the US Defense Department in Iraq in connection with the trial of Saddam Hussein. McKeigue, however, had discovered a book which mentioned a briefing for Vice-President Dick Cheney attended by “Bill, the CIA analyst” in Baghdad.
Apparently untroubled by the lack of a surname, McKeigue told Ivan: “This can only be Wiley. What do you think? The CIA’s Publication Review Board redacted many other passages [in the book], but missed this.” Ivan replied: “This is why we admire you and your work so much ... Funny, we did not know that the meeting [with Cheney] was in the public. We thought it was our secret!”
On another occasion McKeigue sent Ivan details of “the UK network of Syria narrative enforcers” – journalists and academics who had been openly critical of the Working Group – implying that Ivan and his colleagues might like to investigate them further: “If you don’t have any leads from these names, I can add a few more that might help to make connections.” 
He also alerted Ivan to a journalist at Ruptly, a video news agency funded by the Russian government, who had emailed the Working Group with some unwelcome information about Douma. The Working Group claimed the bodies found in Douma were not those of local residents and McKeigue believed they had been murdered by rebels in a gas chamber. However, emails from the journalist suggested otherwise. Ruptly’s “stringers” (freelance reporters) on the ground in Syria had found a man who said his wife and four children were all killed in the Douma chemical attack – thus casting doubt on claims that it was faked. This made McKeigue suspicious of the Ruptly journalist and he advised Ivan: “I suggest that your office keeps an eye on what [he] and his stringers (if they exist) are doing, without letting him know that anyone has raised concerns.”
From time to time McKeigue provided Ivan with updates on the Working Group’s activities. He drew Ivan’s attention to a “Statement of Concern” about the OPCW’s Douma investigation, signed by various prominent figures, which he said Piers Robinson, the group’s convenor, had “worked over the last few months to coordinate”. Ivan seemed puzzled by this and asked McKeigue why he and Robinson had not added their own signatures to the document. McKeigue informed him that the Working Group was “somewhat controversial” and had been smeared in the media. “Piers [Robinson] thinks it’s best for him to stay behind the scenes.”
Ivan was also curious about how Lord West, a former admiral in the British navy, had been persuaded to sign the statement. “Lord West is not a friend of Russia,” he said. McKeigue replied that Lord West was important “precisely because he is not a friend of Russia” and could therefore not be smeared as a Kremlin stooge. “In April 2018 both he and the former commander of UK Special Forces, Jonathan Shaw, gave TV interviews in which they were sceptical about the alleged chemical attack in Douma.”
McKeigue added: “A new interview with Lord West will be in the Mail on Sunday newspaper tomorrow. He is now on Parliament’s Intelligence and Security Committee which is chaired by Julian Lewis MP, another independent minded sceptic ... We hope that they'll use the committee to launch an investigation of how the intelligence services briefed the Prime Minister in April 2018 that the Douma incident was a chemical attack by the regime.”
McKeigue’s emails to Ivan were a mixture of truth, fantasy, conspiracy theory and wishful thinking, and he admitted later that he had embellished some of them. Their content might never have come to light except for one thing. “Ivan” was not a Russian agent – in fact, he didn’t exist. McKeigue had been caught in a sting set up by staff at Cijra when they became aware of his efforts to discredit them.
Continue reading >>>
 Author’s note: In the emails I was described as one of the “narrative enforcers”. McKeigue added: “We conclude ... that Whitaker is close to the inner core of the UK operation to stage chemical attacks, and that planning for this operation began in 2012.”