Investigation
The purpose of the investigations is not to determine the lawfulness of a incident, but rather to document each incident to the highest standard possible, providing a comprehensive factual and technical analysis. The assessments reflect all of the available open-source information at the time of publication. Investigations are ongoing, and we actively seek to incorporate new information from all sources. If you have new information regarding an incident or if you think there is an error in our investigations please contact us at yemenproject@bellingcat.com
Discovery/Identification of Content
Hunchly is used in our investigations to record the steps of the investigators and preserve the webpages and content viewed.
During this phase investigators discover and identify online information about an incident. This is split into two parts: word-based searches and image-based searches. Both Arabic and English are used during our investigations. Items of importance are entered into a DISCOVERY sheet and are maintained by our partners Yemeni Archive, the metadata concerning the URL's is automatically generated and inputted into the OBSERVATION sheet.
In the OBSERVATION sheet, investigators manually tag characteristics about the item (piece of content) such as weather, munitions, coordinates, etc.
Preservation
Preservation of items identified and collected are noted on the input sheet during the discovery process, this is maintained by Yemeni Archive to keep the preservation process separate from the investigators.
Satellite Imagery
Where possible, investigators download the images used in the incident assessment, ensuring there are no markings or words on them. The images are stored with the name of the incident and named according to what satellite captured the image and the date of capture (including the time if possible). For example: SENTINEL1A_27.01.2018_2030. Research is conducted using TerraServer, but due to licensing restrictions, any satellite imagery included in the published incident assessments comes from Google Earth or Planet Labs and is credited as such.
Verification and Analysis
This phase includes geolocation, software analysis, corroboration and descriptions of content. It informs what constitutes an incident assessment. Investigators show their work in the categories of analysis. The investigator's aim is first to focus on the collection of primary and secondary source media using text, source and image based searches. Secondly, the investigators then conduct analysis and verification of primary and secondary source media. The final step entails integrating supporting evidence from NGO reports and media reports. With this process, we are able to see how a basic review of open sources produced conclusions comparable to third party investigations from documenters on the scene.
Descriptions are logged in this manner displayed below:
[Video] appears to depict a munition falling in a populated area. A man can be heard saying “XXX”. After around ten seconds, a second explosion occurs. The area appears to have shops that sell clothing items and food.
Software searches are recorded as follows, hyperlinking to the search result when appropriate.
[Researcher ID] performed reverse image search and it appears that this content first appeared on line at [date, time] on [site name].
Online searches that do not result in usable UGC are also be recorded in this document. For example,
[Researcher ID] searched for closest Coalition airbase, which appears from this website (hyperlinking) to be located at [GPS coordinates]. The airbase shows that X jets were present 30 minutesbefore the strike occurred and Y jets were present after.
Jets at the closest Coalition air-base were identified as [model/make] based on measurements of wingspan and distinct characteristics.
Testimony published by [news source] suggests that civilians were walking around buying bread when the strike hit.
When using satellite imagery, investigators describe, in detail, where the image was obtained:
[Researcher ID] downloaded image [name]from [provider].
If advice is received from an expert, it is record as follows:
A Project ‘Arim [weapons] expert identified this as an MK84, or
A Project ‘Arim [military] expert noted that this scene would have been visible to a drone
The following guidelines were applied to the formatting of data entry.
Dates & Time
a. Written using this format YYYY-MM-DD for example 2015.12.03
b. When exact time of day can be referenced, 12 hour clock set to UTC
c. When time of day can not be referenced, AM/PM or N/A were used.
Coordinates
Entered in Decimal Degrees only, example 15.140625, 43.570938
Governorates
Spelling for governorates in Yemen are standardised in both Arabic and English by the team lead.
Sources
During investigations, sources are entered into the source table on the input sheet maintained by Yemeni Archive. Investigators conduct thorough research into a source's credibility, either as an individual or as an organisation by observing their interactions online, their affiliations and their previous posts. Investigators take note of anything which is relevant to the reliability of the source. Where possible, investigators detail the distinction between primary sources and reposts of content produced by primary sources, by adding a PS or SS in the note as well as tagging content from parties to the conflict, using official responses and media content from all parties to the conflict on related channels.
During data compilation, information is drawn from the 4 following channels:
(1) User generated content on video-sharing platforms and social media services
(2) Information from local, regional, national and international media that either supports or discredit USG content.
(3) Local and INGO reports are used to supplement both international and local media reporting in hard to access cases;
(4) Satellite Imagery, maritime trackers, aviation trackers or other forms of OSI tools.
Incidents are cross referenced with Yemen Data Project, Mwatana and Reprieve where possible.
Parties to the conflict
When referring to air power amongst parties to the conflict in Yemen on the incident assessments, our investigators are aware that only the Saudi-led Coalition and their allies have access to air power capabilities, such as jets and drones. The Houthis have access to a wide range of surface to air missiles, ballistic missiles and short-range unmanned aerial vehicles.
Deaths or Casualties Reported
The process of counting civilian deaths can be challenging and exact numbers are often inaccurate, due to contradictory reports. The definitions of civilians and combatants in conflict also pose a problem when investigating civilian deaths and casualties using OSI. Because of this, investigators are advised not to count casualties. We report on actual numbers of civilian deaths only where direct evidence from an established source is presented through the means of items such as - images/video of death certificates, hospital papers or images of tombstones - that can be reviewed and matched with images or footage of dead bodies or patients with injuries viewed on open source content or reports in the media. The images must contain metadata.
If contradictory accounts occur, where possible the database team will contact sources about their reports to clarify discrepancies. Investigators record any apparent deaths or casualties in the observation sheet on a Y/N/UNKNOWN basis, without making the distinction of whether the individuals killed or injured are civilian or not.
However, the range of reported casualties will be noted. That is, the range between the lowest reported and highest reported, without comment as to which figure appears more feasible.
Incident assessments
As part of the workflow, team members add their incident analysis document which is then finalised by the team leader. The final incident assessment is based on the structure outlined below, with a summary of findings to begin with and a conclusion at the end.
During the the investigative process whilst assessing incidents, investigators answered, at a minimum, these questions:
a. Where did this incident take place?
b. What can you tell about the location from content before the strike and after the strike?
c. What was the location being used for? Was it a market? A school, was the building in question empty? How can we verify this?
d. Who was operating in the area?
e. Were there any military targets, such as AA guns, checkpoints or bases nearby?
f. Was this area targeted by an airstrike before? When did the last airstrike occur?
a. What date did the incident take place?
b. What time did it occur? Can we confirm this using shadows from images?
c. Did the incident occur at a time when the location was busy or crowded.
a. What happened at this location? Did an explosion occur?
b. What was found? Can you describe the scene?
c. Were there any remnants of munitions found? What kind of munition was used in this incident?
d. Are there images of children at the site? Is an impact crater visible on User Generated Content? Are we able to measure the impact crater using satellite imagery?
e. What are we able to verify from the content being posted online using all the OSI tools available?
f. What are the responses from the parties to conflict on the incident, was there a press briefing or a public statement available? What are ally responses on social media, in news reports and on official websites/documents? Are those responses contradictory, have they changed over-time?
a. How did this incident occur?
b. Was there a "double-tap strike" (multiple munitions release)? Are we able to verify this through videos, images, online posts or by identifying the extent of damage?
c. Were there secondary explosions? What caused them?
a. What party to the conflict was operating in the area? Is there enough evidence to confidently identify who was responsible?
b. Who was present at the site? Are there large groups of people carrying weapons? Are there individuals with military uniforms?
c. What kind of vehicles are present in the images/videos?
d. Who is in the background of the content?
e. In interviews from the scene, who is being interviewed? What are they saying?
a. Why did this strike occur? What conclusions can we form by drawing out to the wider context?
b. Can we use the incident grading system to confirm it took place?
Despite answering why, investigators never infer intent behind an incident, but rather provide a comprehensive technical assessment of why an incident may have occurred by identifying any military activity in the area of question.
Incident grading
There is currently no universally accepted definition of what a single airstrike is. For the purposes of our investigations, an airstrike is a strike carried out by a aircraft, whether manned or unmanned, measured by time and distance, not aircraft or type of munition. Therefore, a single airstrike is considered as such when munitions hit within a radius of 1500m and a time period of 60 minutes or less. The distance is based upon the fragmentation radius of a 1000lb bomb [1], while the time is an arbitrary measure.
Investigators have reviewed the incident and have enough evidence to believe it was an airstrike, using multiple verification techniques and cross-referencing information with at least 3 sources. The Saudi-led Coalition has accepted responsibility for the incident. However, the latter is not a prerequisite to confirming that an airstrike took place.
Multiple sources report airstrikes, investigators are able to verify most of the information. There are minor contradictory reports from sources online which investigators are unable to verify but are confident enough that an airstrike occurred at the location in question.
There are single source claims that an airstrike occurred and multiple reports of airstrikes in vicinity to the location on the date in question. However, there is limited content to analyse from a reputable source.
After assessment, incident is shown to be not an airstrike, but another attack caused by an explosion. For example, improvised explosive device, mortar or surface to air missile.
Investigator is unable to reach a conclusion on whether an airstrike took place or not due to a lack of evidence/content available and is not confident in using any ofthe grades above.
6. Unknown
Cause of explosion unknown or unidentifiable.
Every incident is evidenced by at least 3 sources - a combination of one source from each channel mentioned above In lieu of less than 3 sources, satellite imagery can be used to authenticate an incident. Where there are 3 verifiable items - e.g local media, INGO, perpetrator - with similar but independent accounts, the strike could be marked as “confirmed”
The investigators inevitably collect content uploaded by all parties to the conflict or terrorist affiliated organisations operating in Yemen, such as Al-Masirah TV, Al-Arabia and Inspire. In accordance to the 3 source standard, content posted by perpetrators will not be the sole basis for the incident assessment.
Munition
Munition used are recorded in the OBSERVATIONS ITEM sheet.
