Russia’s Attack on Kafr Nabl Surgical Hospital and the Role of Open Source Information in Building a Case for Legal Accountability

[Libby McAvoy is a Legal Advisor at Mnemonic, where she specialises in digital evidence archives, litigation support, and open source investigations into international crimes and human rights violations. Syrian Archive is Mnemonic’s founding programme.

Daragh Murray is a Senior Lecturer at Queen Mary University of London, and his research focuses on the intersection of technology and international law.]

The authors were members of the case team involved in preparing the case.

Introduction

This post sets out the role played by open source information in the first legal filing against the Russian Federation alleging war crimes committed in Syria. Forming part of a broader strategic litigation effort, the filing involved a number of complexities that open source investigative techniques are well suited to address. Here we set out how open source information played a key role in: selecting an appropriate incident for further investigation, ensuring that sufficiently robust evidence was available prior to seeking out and engaging with survivors of the attack, and developing key elements of the case.

The case itself concerns a Russian Air Force attack on Kafr Nabl Surgical Hospital in Idlib, Syria, on 5 May 2019. Two brothers died as a result of the attack, and the lives of approximately 30 people working in and using the hospital were endangered. Attacks of this type were, and are, a common feature of the conflict in Syria, to the extent that the UN Security Council issued a resolution calling for the protection of medical facilities. These attacks are widely documented online, and Syrian documenters have filmed and shared extensive footage of attacks on hospitals and their aftermath.

On 1 May 2024 survivors of the attack filed a human rights case against Russia before the UN Human Rights Committee. The supporting case team included: Hand in Hand for Aid and Development, as the organisation supporting the hospital at the time of the attack; Physicians for Human Rights as medical experts working on access to healthcare in Syria and other countries; academics and researchers from the University of Essex Human Rights Centre and Middlesex University; open source practitioners with Syrian Archive and the University of Essex Digital Verification Unit; and the Open Society Justice Initiative and Professor Philip Leach as representatives for the applicants.

This case advances two strategic accountability objectives. The first is to pursue accountability for Russia’s conduct in the Syrian conflict, and in particular for the devastation linked to its air campaign, including specifically against medical facilities. The second is to underline the significance of extraterritoriality within international human rights law in situations where States lack physical control, such as drone strikes, air strikes, or missile attacks.

Accountability How? Using Online Information for Case Scoping

Preparing a case of this nature is not a simple task. A number of legal issues had to be addressed, notably: demonstrating that the attack involved a clear violation of international human rights and humanitarian law, proving Russia’s responsibility, and ensuring that the open source information collected was appropriate for a legal filing. To begin scoping incidents that satisfied the first two criteria, a group of investigators met in Berlin in the late summer of 2019.

Identifying an attack that was unambiguously illegal was complicated by the applicability of International Humanitarian Law (IHL) to the conflict in Syria. IHL permits certain acts conducted as part of a war that would otherwise be unlawful under human rights law. For example, IHL allows attacks on civilian objects (such as houses) that have been converted into military objectives by their use (if, for example, soldiers have taken over the house and established a command post there). IHL also allows civilians to be killed during the targeting of a military objective under certain circumstances (i.e.,  as long as the civilian harm is not disproportionate to the anticipated military advantage). These IHL requirements set the parameters guiding the initial discovery phase for this project:

• Under IHL attacks on hospitals are absolutely prohibited, and only lose their protection from direct attack in very narrow circumstances. Even then, an attack is only permissible if an effective advance warning is given, irrespective of the presence of any fighters. This meant that if  an attack on a hospital where no warning was given could be identified, this would go a long way towards overcoming questions as to the potential legality of the attack.
• To best establish that a hospital was deliberately attacked, case scoping also required considering whether legitimate military objectives were present in the vicinity of the hospital. This meant prioritising incidents where there was no nearby fighting or fighters, or where the hospital clearly was not in close proximity to potential military objectives (more or less ruling out a dense urban environment).

These scoping parameters were incredibly useful to the discovery process as they facilitated the development of a long list of potential attacks for more in-depth analysis.

The attack on the hospital also had to be directly attributable to Russia. It would be too easy for Russia to challenge the case if there was any doubt as to who was responsible. This was a difficult problem to address as both the Russian and Syrian air forces were active over Syria at the time. Again, however, these restrictions helped to guide the initial research and discovery process which focused on existing investigations that attributed specific attacks to Russia, as well as factors that might distinguish Russian from Syrian attacks, such as: the aircraft or munitions used, unique characteristics regarding how the attack was conducted, or – ideally – official Russian claims of responsibility. The Berlin meeting resulted in a shortlist of incidents involving attacks on hospitals, and some promising lines of inquiry regarding attribution to Russia.

Preserving Potential Evidence

Syrian Archive, meanwhile, was rapidly preserving online documentation of attacks impacting medical facilities in Syria before it could be taken offline and possibly lost. As of March 2021, Syrian Archive had preserved online, open source videos documenting 410 separate, verified attacks against a total of 270 medical facilities, between 2011 and 2020.

Keeping in mind the distinct evidentiary challenges that can be anticipated for online, open source information – and social media documentation in particular – the ability to prove the integrity of the preserved records starts at the point of collection and preservation, by ensuring the material is handled and secured in the best available manner. For this, Syrian Archive – the founding programme of Mnemonic – has developed in-house technology and procedures designed to ensure successful archiving of online information in anticipation of the ways in which it may later be scrutinised in court.

Conducting the Preliminary Investigation and Identifying Leads

Having identified a shortlist of incidents and having preserved a relatively substantial amount of online documentation, the project was at a feasibility crossroads: was there enough to present survivors with a reasonable chance at legal accountability?

At this point there was an unexpected but fortunate development: shortly after the Berlin meeting the New York Times independently released an investigation into a series of attacks on hospitals in Syria, which they attributed to Russian forces on the basis of a number of factors, including intercepted communications between Russian pilots and ground control. One of the featured attacks was also on the shortlist: the attack on Kafr Nabl Surgical Hospital on 5 May 2019. A team from the University of Essex Digital Verification Unit did a deeper dive into this attack, using open source imagery preserved by Syrian Archive, including real time footage of a number of the air strikes. The Essex team geolocated and chronolocated the footage, and they prepared a report with additional background information on the hospital and the attack itself. This work provided lead information that the case team could later use to prepare a comprehensive investigation plan, as well as an information package that could be presented to military experts for initial advice regarding potential attribution to the Russian air force.

The process so far already demonstrates open source information’s added value: open source researchers identified a number of potential cases (remotely, and with limited resource implications), conducted in-depth research into a specific incident, and developed an initial evidence package that could be reviewed by experts and which could be used to conduct an initial assessment as to the case’s viability. Most importantly, the feasibility assessment could be done without imposing any resource constraints on the organisations active in Syria (who had a significant amount of work on their hands already), and without contacting survivors or witnesses (which has significant security, trauma, and expectation management implications). When these essential steps were ultimately taken it was from a more informed position.

Producing an Open Source Investigation Report for the Filing

To carry forward with additional verification and analysis, a next step in working with the relevant online documentation was to create a standalone, open source investigation report –  for this project, the report was produced by Syrian Archive. This type of work product involves collecting all potentially relevant open source content and providing step-by-step verification and analysis to present reasonable and reliable findings of fact. The primary purpose of this report was to independently and impartially assess in a methodologically rigorous manner how the available open source information might answer the basic “facts” questions of any legal investigation: where, when, who, what, and how?

The report was also approached with due consideration as to the main legal challenges for this type of case. While the report drafters worked entirely independently from other fact-finding efforts to preserve the integrity of the outcome, Syrian Archive intentionally sought out online information that would enable litigation partners to more accurately and reliably respond to legal questions around attribution, possible military objectives, prior warnings, and deliberate targeting. For each legal question, researchers drew on context-specific expertise to map out all possible lines of inquiry that could point to a responsible party, their targeting intent, and what was happening at the hospital around the time of the attack. Researchers also collected and meticulously documented all claims and the sources’ justifications for those claims.

Each line of inquiry and claim justification then became a section in the report structure and a box to tick on the investigative checklist. These were inquiries like: Who was present at the hospital immediately prior to the attack? At the time of the attack? In the attack aftermath? Can we find any clear documentation or subtle indicia of a military presence? Did the hospital have any stated rules about armed groups’ presence on its grounds? How were these monitored and enforced?Box-by-box – inquiry-by-inquiry – researchers compiled the relevant information, tested it, re-tested it, tested it in a different way, and in the end presented clear, reasonable and reproducible findings.

Fundamentally, while creative and context-informed work can uncover significant online source material – here 102 relevant pieces of online documentation – any investigation naturally depends on whether the information exists online in the first place. Even then, for legal issues like deliberate targeting, open source information is unlikely to directly reveal the mindset of the attacker. However, by an informed assessment of more commonly posted types of information such as aftermath footage, researchers could verify information that circumstantially points to an attack being carried out in a targeted manner like: patterns of attack, use of precision munitions, or the relative remoteness of the impact site.

Another indicator of deliberate targeting is same-day, repeated strikes impacting the medical facility and its immediate surroundings. Accordingly, a relevant piece of analysis for this report was an assessment of the points of origin of four distinct smoke plumes – including one detonation – identified in the collected documentation.

Each documented plume of smoke was geolocated to assess the likely filming perspective and the documented plume’s position relative to visible reference points. When geolocated all smoke plume origin estimates overlapped with the hospital structure and its immediate surroundings. Below is an example geolocation estimating the origin of Smoke Plume A, established by comparison of the plume itself against other objects visible in satellite imagery.

This component of the research did not definitively conclude that the hospital was deliberately targeted, but it did indicate that on 5 May 2019  at least four separate airstrikes directly hit or indirectly impacted Kafr Nabl Surgical Hospital, causing extensive damage to the medical facility.

Considering Open Source with Other Types of Evidence in the Filing

Once finalised, the case team incorporated the full Syrian Archive investigation report findings into the draft filing, examining the open source evidence alongside other collected evidence to assert the facts of the case and argue the illegality of the attack. This included information like testimony from eyewitnesses, forensic assessments of the Russian pilot audio recordings first published by the New York Times, and expert remote damage assessments of the attack. With this, the case team had access to sufficient evidence to reach reasonable conclusions about the legal issues – like deliberate targeting – and subsequently craft the corresponding legal arguments for presentation to the UN Human Rights Committee.

It was only at this stage – after the report was finalised and submitted to the case team – that researchers had the opportunity to see how the open source information and analysis would interact with the other evidence presented in the filing.

For example, relevant to attribution and targeting, open source footage was considered alongside closed source documentation for expert weapons analysis and remote damage assessments. The smoke plume assessments offered in the open source report were consistent with the all-source analysis by subject matter experts: remote damage analysts identified craters in closed source documentation that are situated within the smoke plume origin estimates geolocated by Syrian Archive.

Similarly, eyewitness testimony describing what had happened at the hospital during and after the attack proved consistent with the visual clues identified and verified in collected open source footage. Aspects of the timeline of events established from witness testimony could be corroborated by aftermath footage examined in the open source report: possible blood stains identified in the online documentation correspond to the location where witnesses say a victim of the attack was treated.

The case team also took this opportunity to make their own assessment of Syrian Archive’s work, checking the report’s findings against other evidence and closely examining the step-by-step presentation of the report. Drafting the report in such a way that each finding is presented as holistically and plainly as possible was essential to the feasibility of this review as well as to future scrutiny by legal fact-finders.

Conclusion

On 5 May 2019, Syrian journalists uploaded footage of new smoke plumes above Kafr Nabl Surgical Hospital in Idlib. In the hours and days that followed, documenters and first responders including the White Helmets continued filming and uploading to social media what had unfolded at the scene of the attack. This triggered a chain of investigative steps, and almost five years later survivors of the attack filed their landmark human rights case against Russia before the UN Human Rights Committee. The survivors await the Committee’s timely review and adjudication.

The preparation of this legal filing demonstrates the added value of open source information and investigative techniques in the preparation of strategic litigation. Three key benefits are identified. First, open source information facilitated the development of a shortlist of incidents, which could then be subject to further analysis. Second, a feasibility assessment was conducted without the need to contact survivors of the attack, mitigating known issues with respect to re-traumatisation, security, and expectation management. Third, open source information played a key role in the development of the evidence package: without open source information, including the real time footage filmed and posted by citizen documenters, building this case may have been impossible.