Introduction

In June 2017, the world got a fresh glimpse into the heart of Russia’s burgeoning private military security industry from a social media post on a Reddit subchannel popular with military geeks. The anonymous post didn’t provide much commentary, only a link to a nearly two-minute long video clip shot with a shaky hand on a mobile phone camera.¹ The graphically violent video showed several men dressed in desert military uniforms taking turns beating a man with a sledgehammer. Within hours of the video’s appearance on the Reddit channel, a military affairs blogger reposted it and not long after that, Russian and Ukrainian open source investigators who track the activities of Russian mercenary fighters affiliated with the Wagner Group busily began dissecting clues to the assailants’ identities in the videos.²

Video footage subsequently circulated online in the summer of 2017 and late fall of 2019 and reporting in Russian, Arabic, and English media outlets indicates that at least five to seven Russian-speaking men beat, tortured, and beheaded a Syrian national named Muhammad Taha al-Abdullah³ (محمد طه إسماعيل العبدالله). The videos show the men who killed Abdullah, who is also known by his nickname Hamdi Bouta (حمادي طه البوطه), subsequently dismembered his body and then set it on fire amid the battle-torn remains of the al-Shaer gas plant.⁴ In early November 2019, the video of Bouta’s killing again went viral on Twitter and circulated widely on social media sites popular with Russian speakers, including Vkontakte, popular social media platform similar to Facebook that has hundreds of millions of users. This report is a summary of research efforts to date by Frontline Forensics, a joint initiative of New America and Arizona State University, to discover the circumstances surrounding the death of Hamdi Bouta.⁵

Bouta’s grizzly public execution at a site controlled by Wagner Group operatives illustrates how Russia’s new business model for expeditionary warfare poses serious challenges for the international security. The findings in this report show that the Russian state through its majority owned-stake in the companies that pay for Russian private military security contractors’ (PMSC) operations exercise effective control over a well-organized group of special operators for hire. Absent greater transparency and accountability for Russian PMSC operations and the Russian state enterprises who hire them to train and equip local fighters and to secure oil, gas, and mineral production sites are able to continue doing business as usual with impunity.

The purpose of this initial assessment of data discovered as part of our inquiry is to aid the general public, relevant international fact-finding bodies and project collaborators in developing a more complete account of this incident, and as well as a more comprehensive understanding of how overlapping social networks between Russian-backed foreign fighters in Ukraine and Syria have fused to form a sprawling, global social movement of mercenary fighters seeking to advance Russian ultranationalist causes. To the extent possible, investigators tasked with evaluating available digital evidence and open source data linked to the case endeavored to trace the identities of those directly involved in Hamdi Bouta’s death and to discover any links they may have had to other entities or individuals, who may have had a supervisory or contractual arrangement with those present at the time of Bouta’s killing. The research for this report was undertaken in collaboration with journalists, think tank analysts, and human rights investigators as part of a wider effort to analyze the role of Russian PMSC in contemporary armed conflict.

The analysis that follows below provides a detailed look at how a subunit of Wagner Group operators came to seize control of the Syrian gas plant where the gruesome video of Hamdi Bouta’s killing was recorded. It also explains how Yevgeny Prigozhin, a wealthy Russian oligarch who has been sanctioned for his role in interfering in the 2016 U.S. presidential elections, profited from the site where Bouta was executed and helped Russian state enterprises rake in billions from Syria’s energy sector. The analysis is divided into six sections, including this one, which briefly explains the methods we employed to exploit publicly available open source information and leaked data shared with Frontline Forensics about EvroPolis to trace the web of individuals and entities linked to the so-called Wagner Group’s operations in Syria. The second section describes the fact pattern surrounding the video of Hamdi Bouta’s killing in 2017. The third section provides contextual background on how EvroPolis and its PMSC operators came to be so central to Russia’s quest to bolster its export of military-technical and energy sector expertise to Syria, and hints at how the Kremlin has evolved its model for conducting the business of war since the start of the Arab Spring. The fourth section explains how new facts about Bouta’s killing emerged in late 2019 and shed more light on the connections between dozens of Russian special operators who fought in eastern Ukraine in 2014 and later in Syria. The fifth section dissects the videos of Bouta’s killing and related digital data that unearthed connections with a Russian PMSC contingent linked to war crimes in Ukraine and provides an overview of our early findings about links between the same PMSC contingent and Russian ultranationlist white supremacist group sanctioned by the United States in April 2020. The sixth section presents broader conclusions on the case and its meaning.

The Syrian civil war has often been referred to as the first “YouTube war.”⁶ Since the start of the conflict in Syria in 2011, countless videos, photos, and text-based commentary posted on social media platforms have traced the arc of the war’s rapid transformation from a popular peaceful uprising to a civil war and internationalized proxy war. The start of the conflict coincided with the peak proliferation of camera-enabled mobile phones and other sensing devices, expanded access to commercially available satellite imagery, and increased public access to data via the internet.⁷ Technological proliferation and the wider availability of tools for the collection, analysis, and archiving of large amounts of data subsequently has fueled the rise of a global movement of citizen journalists and investigators.

At the same time, the intractable stalemate between the five permanent members of the UN Security Council has led to the establishment of independent fact-finding bodies with a vested interest in documenting war crimes in Syria, including, most notably, the UN General Assembly mandated International Independent and Impartial Mechanism (IIIM) for inquiry into violations of international humanitarian law (IHL) since the start of the Syrian war in 2011.⁸ These developments underscore how the growing prevalence toward remote warfare and increasing shift to war by proxy⁹ is transforming the politics of evidence in the realm of international security and international law.

The tools, methods, and sources used by our team to discover the circumstances surrounding Hamdi Bouta’s killing at the al-Shaer gas plant are reflective of these massive shifts in the way war crimes and reported abuses of power can now be documented. In researching this case, we have collected and analyzed information that is publicly available either through open observation of publicly accessible websites and social media platforms or data that is obtainable by request or purchase. Our team also leveraged data shared by the Dossier Center, a Russian-language investigative research center, about the business dealings of the Wagner Group’s reputed management company, EvroPolis, and related Russian companies linked to Yevgeny Prigozhin and his firm Concord Management and Consulting LLC.¹⁰ We additionally conducted independent analysis of publicly available data about EvroPolis’s key clients in Syria, the Hayan Petroleum Company and Syrian Petroleum Company, to triangulate and verify data shared with our team by the Dossier Center.

A substantial portion of the data collected as part of the research for this case study consists of information and insights gleaned from traditional media outlets and compared with openly available social media accounts and user groups on Vkontakte and Odnoklassniki, social media platforms popular with Russian language speakers. Social media data analyzed for this report in many cases contained basic demographic information about the gender, educational background, reported residential location, military affiliation of users with express links to user groups focused on Russian military affairs culture.¹¹ Our team has built and applied a number of different computational social science tools and techniques to gain insights into Russian language social media users. Data collected for this and other reports draws largely on the social media user profiles of those who either openly profess that they have worked at one time for a Russian PMSC or whose demographic profile and posts indicate that they have served in areas of Syria and Ukraine where Russian PMSC contingents have reportedly operated.¹²

It should be noted that some of the images and videos reviewed for our research contain highly graphic content depicting extreme violence. Some sources and content also included information that might be considered sensitive. In several cases, as a result, we have been selective about the content and data referenced in the main body of this report, but where warranted we have collected that material for separate, independent review in the appendices to this report.