An OSINT study by NIGMA Conseil by Marwan Khoury (Ph.D) and Lt-Col (ret.) Fabien Tabarly
Introduction
At a time when the final toll has yet to be determined, it is more than essential to reveal what happened in the port of Beirut on the evening of August 4, 2020, at 6:08 p.m. local time.
An explosion of a magnitude that is unmatched to any other in the history of the country was heard hundreds of kilometers away, shattered structures that were standing as far as tens of kilometers from the epicentre, and destroyed a large portion of the city of Beirut. The destruction was most heavy in the regions of Charles Helou, Gemmayzé, and Ashrafieh.
Multiple contradictory claims with regards to the cause and the source of the explosion were publicly shared on the traditional media, the web, messaging applications, and through official governmental declarations. A number of local TV channels favoured the hypotheses that fireworks were at the source of the explosion, before governmental officials spoke about the unsafe storage of 2750 tons of Ammonium Nitrate for 6 years.
However, the widespread disagreement on the cause of the disaster, in an extremely volatile geopolitical context, requires the study and evaluation of other scenarios in order to rule out as scientifically as possible some theories ranging from a deliberate attack by a third state to a nuclear strike. We brought together our forensic and military expertise and evaluated these scenarios by dissecting and analyzing some of the available open source information (OSINT).
Importantly, this report in its current form is far from being addressed to the court, but rather represents a preliminary investigation that may serve as a starting point to reconstruct the events as they happened. The authentication of all the used sources remains a necessary step to move forward in the case work.
What happened?
With the help of photos and videos that were provided by multiple social media users we determined the presence of a relatively large cloud of white smoke at 17h57 local time (image 1) followed by an explosion at 18h08 (image 2) (witness testimony talks about the fire presence since 17h40 at least). This time sequence is copied from Jean Kassir’s Facebook page, a journalist and researcher who felt the necessity of documenting the unusual events that he saw happening while driving towards the affected area.
M. Kassir’s chronological sequence is compatible with the CCTV clock of a mobile phone store in the region of Ashrafieh, which distance to the explosion was measured at 1155 m. The camera shows the moment the blast wave penetrates the shop and destroys it heavily. According to the CCTV, this happened at 18h08m20s.
A second confirmatory type of temporal data comes from the earthquake that was caused by the explosion and that was recorded at exactly 18h08 (15h08 UTC) of a magnitude of 3.3 (see image 7).
A video that was taken closer to the event and from a different angle revealed important features related to the sequence of the events. A live fire had already begun inside the northern part of a warehouse (image 8). It was followed by a first explosion that pierced the warehouse’s roof and ejected part of its southern facade (image 9). A second detonation occured 29 seconds after the first explosion (image 10) sending the people behind the camera inside their home which was subsequently destroyed as a result of this detonation. Importantly, this sequence of events goes against a conventional air or sea missile strike behind the two explosions and raises the question of when and how the fire was ignited.
This second explosion is rapidly surrounded by a white layer that quickly expanded outwards and caused much damage as it travelled through space before dissipating. It is from this layer that a mushroom-shaped cloud developed and kept many wondering about the possibility of a nuclear explosion. We insist on the fact that a mushroom-shaped cloud may form in any strong detonation as a result of forcing the interaction of two (or more) fluids or gases of different densities, a phenomenon known as the Rayleigh-Taylor instability. In simpler terms, this mushroom can be the result of debris, smokes, and water vapors that are propagating into the air (compare images 11 and 12). Professor Jeffrey Lewis from the Middlebury Institute’s James Martin Center for Nonproliferation Studies discards the nuclear-related hypothesis especially after the sequence of events – fire, first explosion, second explosion – was revealed.
What could have exploded in this manner?
Many witness accounts recalled the presence of fighter jets flying over the explosion’s area. While many claimed to have heard these planes, some declared to have observed them. We cannot support this hypothesis based on the information that we analysed. We were able to find other videos of explosions inside warehouses where the sound of jet engines was also heard before the boom. We believe that the sound of a “controlled” gas combustion in a semi-confined space might produce this roaring sound. Moreover, the sequence – fire, first explosion, second explosion – discards the theory of a missile strike.
Nevertheless, many insist on the aerial strike and some went as far as to produce or spread fake videos online. While we analysed two of these videos, we are able to verify the authenticity of all such videos that we saw spreading online and we are currently working on guidelines to help our readers do the exercise themselves.
We detected the artificial incorporation of a moving missile by superimposing two images from two videos that claim to have detected this missile through a negative filter (images 14, 15). We deduced the fake from the overlapping shape, size, and angle while the videos were filmed from different perspectives (image 16).
After debunking various videos and images, and determining the sequence of events – fire, first explosion, and second explosion – we comfortably discard the hypothesis of a classic air strike or even sea born missile strike.
However, it is impossible to eliminate the intentional malicious act, whether executed through a ground infiltration to light the fire, or a more sophisticated operation involving drones. A precedent to the latter was experienced on 25 August 2019, with two drones having penetrated Beirut’s southern suburb in a worrisome manner and with a yet unclear mission. A complete investigation that will allow us to determine the possibilities of such unconventional acts and compare them with the possibility of an accidental fire requires an advanced forensic investigation that not all countries can properly conduct. Trusted international experts are therefore welcome in such cases until Lebanon succeeds in building its technical and scientific investigative apparatus.
On the other hand, a revealing element resides in the analysis of the smoke colours that change from grey during the fire and after the first explosion (images 17 and 18), to reddish after the second explosion (image 19). This red plume is compatible with the release of nitric oxide vapours from an eventual explosion of Ammonium Nitrate. The initial fire and the first explosion would in all likelihood come from something else. It is in fact very difficult for Ammonium Nitrate to ignite and trigger an explosion by itself.
The reddish cloud is compatible with the explosion of Ammonium Nitrate. What about the grey smoke that resulted from the fire and the first explosion?
Two videos were filmed from a closer angle showing the western side of the warehouse. The filmers of the first video were geolocated to the northern terrasse of the port’s silo building overlooking the warehouse (images 20-22), while the second video was taken just outside of the warehouse with the firefighters in action (images 23-25). The fact that these videos are taken at this short distance to the fire and show a clear image, suggests a time prior to the first explosions that was seen to damage the area at the end of the first video (image 22). These videos reveal the continuous development of grey smokes in parallel with distinct small flashing explosions (image 21) that suggest the presence of fireworks, or small arms ammunition stocks inside the warehouse.
The light and repetitive explosions are confirmed by the second video (images 23-25) that also shows the work of firefighters as they arrived at the scene and feel already the situation slipping out of their control:
“Call for backup” shouts one of them.
The warehouse’s doors are seemingly locked, which may explain image 26 with two firefighters and a man in civilian clothes trying to force in door n.11 of warehouse n.12. We linked this photo to the video of the firefighters through the haircut and clothes of two men, and through a matching door inscription: door n.11 of warehouse n.12 (image 25, 26). The man wearing a white T-shirt in image 26 is also wearing a surgical mask which indicates the recent date of this photo (such COVID-19 precautions became common in Lebanon since April 2020). While the exact date still needs to be verified, the surgical mask and the lack of known previous fires with repetitive explosions in warehouse n.12 of Beirut’s port suggest that the firefighters’ video and photo 26 were taken a few minutes before the first explosion on August 4, 2020. Situating these photos and videos in place and time make of them important evidence that reveal the fire, the repetitive explosions, the warehouse number, and the fact that it was left completely inaccessible to the firefighters who were ultimately sent to their own death.
One of the men in image 26 is wearing a surgical mask suggesting a recent date of the photo.
We geo-located all the multimedia used in this report through a map of the port (image 27) as well as satellite images available online through Planet Labs (image 28). This allowed us to locate the sequence of events happening inside warehouse n.12 of Beirut’s port which then became the epicentre of the explosion.
Warehouse n.12 disappeared together with the grounds on which it was constructed to form the crater: an important part of the crime scene disappeared. We should note that this is the only crater that is visible by satellite imagery which suggests the absence of high explosives’ stocks anywhere else in the affected area (image 28).
While a number of experts have already speculated about the explosive charge based on the crater’s dimensions, the fireball’s diameter, and an assessment of the damaged areas, we choose to abstain on this point. We believe that our presence on the ground combined with a careful examination of how things were stored and where, are essential to get an accurate answer on this matter. In fact, the same initial charge may explode at different magnitudes depending on the environment and ways in which it was triggered. Temperature and pressure conditions that were created by the warehouse’s structure, the conformation of the items that were stocked inside, and the decomposition state of the Ammonium Nitrate (near the sea and the silo), have undoubtedly influenced both the triggering and the magnitude of the explosion.
What was in the warehouse then?
Shortly after the fireworks theory was mentioned in the local media, the directorate of general security’s chief, major general Abbas Ibrahim, evoked the possible presence of high explosive substance that was recently confiscated. This was followed by two statements from the custom’s general director, Badri Daher, and the national security’s chief, general Tony Saliba, who spoke about the presence of 2750 Tons of Ammonium Nitrate stocked in the port since 2014. This version of events was quickly adopted by the majority of local and international media, and supported by a number of photos that spread online.
The images 29 to 33 show High Density Ammonium Nitrate that is packed in one ton bags marked “Rustavi Azot LLC” (one ton each) which suggests that they were produced by this company in Georgia. The bags are deposited in rows of two to three stacked on top of each other inside a structure with a door, roof lights, and windows that are similar to warehouse n.12, presuming that all the images are of the same warehouse.
The images 29-32 look like they were printed on paper before they were photographed (see image 31). They were shared on Twitter by journalist Dima Sadek on Saturday 7 August 2020 at 12:27 local time and attributed to the National Security service “days before the explosion”. While the government’s version spoke about their storage for about 6 years (2014), “Rustavi Azot LLC” answered that it has no information about this shipment and that their production of Ammonium Nitrate in the city of Rustavi did not start before 2016 (rustaviazot.ge). This presumed shipment and storage of Ammonium Nitrate in the port of Beirut is currently being thoroughly and publicly investigated.
We will limit our focus on the analysis of the images that suggest the presence of Ammonium Nitrate inside the warehouse and evaluate their potential investigative value. Similar window dyeing allowed us to confirm that images 29 and 30 were taken in the same warehouse. While the piles that are shown in these two images differ in shape and conformation, it is not possible to confirm whether the bags or their content had moved over time without a proper “forensic architecture” analysis based on each image and the time it was photographed. We mention this detail as a door opener for essential future research.
Other media brought forward the possibility of welding works having taken place a few hours before the explosion. A day after the explosion, a BBC journalist published the first photo showing bags of ammonium nitrate (image 33) that match the bags in the previously described photos (images 29-32).They are stored in what could be one of the port’s warehouses, with the sliding door open, and three men that seem to be inspecting the place. Here again, at least one of the men is wearing a surgical mask suggesting a recent photo due to the COVID-19 precautionary measures. However, no sign of welding works can be deduced from the photo.
Even though many elements inside the images 29 to 33 give the impression of a common location, there are at least three other warehouses (9, 10 and 11) that look similar to warehouse n.12 as viewed from satellite imagery. Moreover the lack of markings on the sliding door in image 33 is discordant with the previously described door in image 26 : warehouse n.12, door n.11. This does not exclude image 33 from portraying warehouse n.12 as it has eleven other side doors (as seen by satellite imagery).
Is the door in image 33 a different door of the same warehouse?
The fact that no crater was left behind any of the other warehouses combined with the fact that they were all completely destroyed, indicate that large quantities of Ammonium Nitrate could only be present in warehouse n.12 (if stored in the port on 4 August 2020).
Conclusion
What we can confirm
With the help of filmed, photographed and written online material, we revealed a sequence of events that started with a fire at least 11 minutes before the explosion, followed by a first explosion of a moderate force, and ended 35 seconds later with a large detonation that produced a reddish cloud which is compatible with the explosion of Ammonium Nitrate. Although the first explosion has definitely increased the likelihood for the setting off of the second explosion by significantly raising the temperature inside the warehouse, the time lapse (35 seconds) eliminates the possibility that the first explosion primed the second explosion in a conventional primary-secondary explosives sequence. All of the events took place inside warehouse n.12.
The sequence described above discards the missile strike and goes in the direction of a fire with small repetitive explosions that increased the temperature inside the warehouse and caused two major explosions. The small repetitive explosions suggest the presence of fireworks but could also comprise the deflagration of small ammunition stocks.
Firefighters arrived at the scene prior to the first explosion but were quickly overwhelmed by the events. Not only were they not warned about the dangerosity of their specific mission but warehouse n.12 was kept locked and inaccessible to them. The presence of a single crater leads us to conclude that, if in the port of Beirut, the Ammonium Nitrate was stored in this warehouse. If the images 29 to 33 show the Ammonium Nitrate that exploded, we can deduce a paramount negligence in their storage conditions through the lack of:
Aliquoting to reduce storage quantities, separation and insulation of combustible/explosive materials, fire evacuation procedures, heat sensors, fire alarm, closed-circuit television (CCTV) surveillance, regular checks, transparent records … None of these measures were put in place.
What we can’t confirm yet
Even with such a sequence of events – fire, first explosion, second explosion – we can’t confirm whether this was accidental or intentional. The interests at stake given the geopolitical context must be taken into consideration. Therefore, a hostility characterised by unconventional attacks similar to the ones we observed in recent months in the region cannot be ruled out. Only advanced forensic analyses on the ground will permit to assess this hypothesis.
We also can’t confirm the presence of fighter jets in the surrounding skies of Beirut, nor of any other aircraft. While a sound resembling that of an active jet engine was heard by several witnesses, no images are there to support this information. On the other hand, a video tends to prove that the sound was indeed due to a “controlled” gas combustion preceding the main explosion.
Could this disaster have been avoided?
Without a doubt. A well-equipped port, with a real fire-fighting service, clear procedures and direct communication (e.g. radio link) with functioning emergency services could have possibly contained the fire. The application and control of upstream regulations on warehouses and storage of hazardous materials, and the sanctioning of offenders, would very likely have avoided the tragedy.
Apart from the larger question about the presence of this enormous explosive charge close to people’s homes and businesses, the only question to which we must find an answer from a technical and scientific point of view is: what factor or act caused the fire? The rest is relatively well understood. It is the reason why we believe that the presence of international investigators is a first step to allow an independent and methodical reconstruction of the facts.
Any information or data that was not analysed in this report, may change the conclusions.
