Investigation Redux: New Videos Appear and with Them a New Mystery

In May 2018, a little more than a year after Hamdi Bouta’s family held a funeral for him in secret in the summer of 2017, the victim’s family members reported receiving a copy of the video (Video A) depicting Russian speaking men beating Hamdi Bouta with a sledgehammer via WhatsApp. Syrian reporters with al-Jessr Press at that stage begin investigating the story. By this time, in the spring of 2018, the first video had already been circulating on the internet for at least a year, and the connection between the incident at al-Shaer and the Wagner Group convinced Syrian and French human rights activist groups to try to pursue a legal case in Moscow.¹ Still, at the time, little was apparently known about the incident location or identities of the men in the video other than their presumed affiliation with the Wagner Group.

Although the Kremlin has repeatedly denied any direct links between the Russian government and Russian PMSC operators on mission in Syria a preponderance of evidence suggests otherwise.² In the spring of 2019 the identities of dozens of men who reportedly were killed in a U.S. strike on a Wagner Group contingent on February 7, 2018 during a battle near another SPC operated gas plant near the town of Khasham in Deir Ezzor were beginning to surface in the international press.³ Impromptu virtual memorials to those killed in the battle also began to proliferate widely on Vkontakte, the Russian social media platform.⁴

There is significant circumstantial evidence indicating that at least two of the Russian men depicted torturing Hamdi Bouta at the al-Shaer plant in the video may have been wounded or killed in the U.S. airstrike on the Wagner Group column on February 7, 2018. The dots that connect these two incidents—the atrocity at al-Shaer and the Battle of Khasham in Deir Ezzor—do not run in a straight line, but they are readily apparent in the tightly latticed network of Russian firms, businessmen, and PMSC operators who fought together in Donbas before deploying to Syria.

Perhaps not surprisingly, social network analysis of the digital profiles of individual Russian PMSC operators whose paths crossed during the fighting at al-Shaer in the spring of 2017 and later in Deir Ezzor in winter 2018 shows close friendship ties via Vkontakte with Russian citizens who stand accused of committing war crimes in the eastern Ukrainian region of Donbas in the fall of 2015. Again, while these links between social media users are not necessarily dispositive of culpability in any specific wrongdoing open source analysis of the networks that knit together the virtual lives of individuals in each of these groups reveals quite a lot about their military experience as well as the capabilities and skills that Russian companies like EvroPolis have sought to cultivate.

Media reporting about the first two-minute clip surfaced on the evening of June 30, 2017. The video (Video A) shows several Russian-speaking men torturing a man by striking him in the extremities with a sledgehammer.⁵ The faces of the assailants are masked and only partially visible in the video. At the time, the involvement of Wagner employees was alleged by internet commentators but never confirmed. The victim’s identity and fate also remained unknown. Family members told journalists with al-Jessr Press that they last heard from Bouta when they received a recorded message from him on May 5, 2017. According to Arabic language news accounts, Bouta’s relatives only learned of his death a year later after a video surfaced online in May 2018.⁶

It is unclear whether the alleged posting of the torture video that circulated in June 2017 was the first time the video publicly surfaced. However, in early November 2019, Twitter users in the open-source intelligence (OSINT) research community began circulating segments of a new set of videos that appear to show a continuation of Hamdi Bouta’s torture and killing.⁷ Investigative reporters at Novaya Gazeta were among the first to pick up the thread and run with an expose about the second tranche of three video segments from the scene of Bouta’s killing (Videos B, C, D) on November 20, 2019.⁸

In November 2019, extended videos and images from the incident appeared on Vkontakte user profiles and were collected and archived by our team. These extended videos show complete or partial faces of many of the assailants and reveal a fuller sequence of events. The victim’s face was visible throughout the videos until the point at which his body was dismembered. However, there are no obvious signs as to where the video may have been recorded and other than the victim, little is known about those who appear in the video. This section outlines what our investigations revealed about the location and timing of the incident as well as what we were able to discern about the identities of the victim’s assailants. We first begin by describing what is depicted in the video and what we learned from our attempts to verify the accuracy of media reports suggesting the incident took place near al-Shaer. ⁹

Summary Description of Video Content

Video A (Beating) is 1 minute, 41 seconds long and it depicts four men beating Bouta with a sledgehammer. In this first video, the victim appears to be conscious and alive. Russian rock music can be heard in the background. In Video B (Decapitation) is 3 minutes, 16 seconds long and in it the assailants appear to use knives and entrenching tools (spades) to sever the victim’s head from his body. Video C (Dismemberment) is 1 minute, 33 seconds long and it appears to show the assailants using an entrenching tool to sever the victim’s arms. Video D is 2 minutes, 50 seconds long and it depicts the victim’s dismembered body suspended from a tall metal structure. In the same video, two of the assailants appear to douse the body with an accelerant and use an improvised torch to set it aflame. Someone off camera speaking in Russian says, “Come on. The wind is blowing hard.” About a minute and a half in, the body is aflame and one of the men who set the victim’s body on fire poses for the camera, and gestures with a crude bullhorn sign. A voice in close proximity to the camera microphone, possibly the man gesturing, says, “Jambo. Yeah, this will be the sign for mercenaries.”

Observations about the Assailants

There are at least five men who appear in the series of videos we reviewed other than the victim and the cameraman. At least two appear to film the incident on their own phones and one of the men appears to be documenting the incident on a small handheld camera. For the purposes of our analysis we have assigned an identifier to each of the assailants who appears in the videos, e.g. Persons 1-5.

Person #1

At various points throughout the videos, Person #1 steps into the frame, but he features most prominently in the fourth video segment, Video D (Immolation), in which the assailants burn the victim’s dismembered torso. He is wearing olive green cargo combat pants and a blue and white striped undershirt known as a telnyashka (тельня́шка), which is typically worn by servicemen in the Russian navy and by spetsnaz operators who serve in VDV airborne units.¹⁰ For much of the time his face is covered, but at one point in the final video, Video D (Immolation), he poses alongside the victim’s dismembered body before it is set alight. About midway through Video D (Immolation), he appears in frame with his face half covered. He gestures with an impromptu bullhorn sign, jokes and declares, “This will be the sign for mercenaries.”

Person #2

In several of the video segments, Person #2 appears to be filming with a small digital camera. He wears a green outfit that appears to be a flight suit and a black and white “Arafat” kefiyah around his face and neck. Using open source techniques, Novaya Gazeta Reporter Denis Korotkov and his team established the link between Person #2 and the social media accounts of a man referred to in the article as “Stanislav D.” Korotkov indicates that Stanislav D. hails from the Russian municipal district of Stavropol and is known by the call sign “Volk.” Novaya Gazeta reporters indicate that they first identified him by using a publicly available facial recognition application called FindClone.¹¹ Novaya Gazeta reporters further verified this initial finding by reviewing a passport photo, a security questionnaire, and a non-disclosure agreement obtained by the paper in other related investigations. According to Novaya Gazeta, Stanislav D. began his service for state security organs as a private in a police unit in Stavropol, Russia. Sometime before February 2016, he began working for the Wagner group as a “reconnaissance shooter,”¹² and he has allegedly made several trips to Syria.¹³

The Guardian, a U.K.-based newspaper, and the investigative research group Bellingcat claim to have independently verified Novaya Gazeta’s initial November 2019 findings.¹⁴ A subsequent separate report published under the name Romanova Mari on Narodnaya Pravada, a pro-Ukrainian blog, goes a step further, identifying S. Dychko as “Stanislav Dychko,” a 30-year-old Russian citizen.¹⁵ The Narodnaya Pravda article also indicates that Facebook users in a community group called “Gruz 200” (Cargo 200), which tracks information about combatants operating in the embattled eastern Ukrainian region of Donbas, identified Dychko by matching his photo with information published on the Myrotvorets, a website known for its links to current and former officials with Ukraine’s SBU intelligence service.¹⁶

While the Myrotvorets site indicates Dychko is a member of the Wagner Group who fought in Donbas it is important to bear in mind that the website’s operators have a specific agenda and anti-separatist bias that raises questions about the veracity of information posted on the site. More research is required to verify whether Stanislav Dychko described on the site is the same one reportedly depicted in the video. Yet, as will be shown later, a deeper dive into the social media networks of Dychko and others implicated in media reports about the incident at al-Shaer appears to at least partially corroborate the existence of links between individuals depicted in the videos and contingents of Russian-backed PMSC’s who fought in Syria in 2016-2017 and in Donbas in the 2014-2015 timeframe.

Person #3

Person #3 is most prominently featured in Video A (Beating), Video C (Dismemberment) and Video D (Immolation). He is wearing multi-cam green cargo combat pants, a black balaclava, goggles with a white band, and at various points his blue and white telnyaskha undershirt is visible. At one point in the video as it is showing the victim’s body being burned, Person #3 steps into the frame to douse the body with accelerant fluid and shouts something in what sounds as if it could be a Turkic or Persian language dialect.

Person #4

Person #4 is an active participant throughout all four video segments. He wears a short-sleeved tan shirt, combat cargo pants, ski goggles with a white band, and his face is partially covered with a black and tan kafiyah. In Video A (Beating), he wields a sledgehammer and uses it to torment the victim. He is addressed using the call sign “Volk,” or “Wolf.” In Video C (Dismemberment), Person #4 also appears to stand in the background while his associates mutilate the victim’s remains. He is shown along with Person #1 and Person #3 dousing the victim’s dismembered body with a liquid accelerant before it is set alight.

In early November 2019, as the second tranche of videos documenting the victim’s torture, killing, and mutilation begin to circulate online via WhatsApp and other social media platforms, OSINT researchers who track news about the Wagner Group began to tweet news reports that identified Person #4 as a man named Vladislav Apostol, a dual citizen of Russia and Moldova. In a December 2019 article, Meduza, an online news blog about Russia, specifically references articles published by Fontanka alleging that Person #4 is Apostol, and that Mikhail Kuznetsov, a volunteer with the InformNapalm project, had previously reported Apostol’s military activities in Syria on Facebook.¹⁷ The Meduza article additionally confirms that the person believed to be Apostol is referred to in the video as Volk. The article also referenced Fontanka as having identified a Vladimir B., a spetsnaz veteran of the 76th VDV Airborne division, the same division as Wagner’s titular head Dmitry Utkin, as a participant in the killing.¹⁸ When Fontanka reporters tried to verify these details by contacting the person referred to as Volk directly, they were told there was no connection. But, since details about the interview are vague at best, the denial of a connection in a news report does not preclude the possibility that there is some overlap between subunits of the 76th VDV. ¹⁹ Indeed, a bevy of social media data analyzed by our team and research and reporting by others who follow Russian military affairs closely indicates a high level of overlap between VDV spetsnaz veterans and the Wagner Group.²⁰

Around the same time that news of Apostol’s alleged link to Hamdi Bouta’s killing begins to circulate, Vkontakte groups that track news and developments in the Russian soldier fortune community also began to post lists of the names of Wagner Group operators allegedly killed in a U.S. airstrike in the now famous Battle of Khasham near the Conoco gas site in Deir Ezzor in February 2018. Apostol’s name appears in several of those mostly anonymous posts but it is unclear whether the posts regarding Apostol are merely referencing information made public by Ukrainian law enforcement authorities or other sources.

Several of the Vkontakte posts reference a September 2018 InformNapalm story suggesting possible links between Apostol and Alexey Milchakov, commander of a “volunteer” Russian unit that fought along separatists in eastern Ukraine.²¹ Links to that same article also cropped up again on Twitter accounts of OSINT researchers who track news about Wagner’s operations in Syria and elsewhere.²² These posts appear to corroborate Arabic language press reports indicating the video of Hamdi Bouta’s killing was likely shot at the al-Shaer gas facility in Syria.

The posts also hint at the web of social networks that link Apostol and others implicated in the incident to Russian separatist units who fought in Donbas before going to work for EvroPolis in Syria. This elevated Apostol as a person of interest connected to Bouta’s killing, and prompted our team to take a closer look at Apostol’s digital footprint and virtual friendships—an investigation that, as detailed below, revealed quite a lot about the organizational recruitment patterns of Russian PMSCs. ²³

Person #5

Person #5 remains off camera for nearly all of the videos, stepping into the frame only occasionally. When he does step into the frame it is clear that he is wearing long-sleeves and that the left sleeve bears a white patch with Cyrillic writing and a smiling joker’s face. It appears that he is functioning as a cameraman. His face is mostly covered with a kafiyah during the brief moment that the lens in trained on him.

A reverse image search of the patch leads to the website of a Krasnodar, Russia company called MidFort that sells gear for Russian Airsoft games enthusiasts and military apparel and accessories. The MidFort company website indicates the firm became an official dealer of tactical gear and uniforms for the Russian state in May 2016.²⁴ A review of MidFort’s Instagram account turns up a photo of the same joker patch worn by Person #5 in the video alongside several others, including an insignia patch for the ISIS Hunters group, a Syrian tactical group trained and equipped by Wagner Group operators that is part of the 5th Assault Corps.

At first glance, this detail would appear to offer—at best—circumstantial evidence of links between the assailants and Wagner Group operators. But, as will be seen further below, the fact that quite a few members of an Instagram account that purports to be the official account of Rusich also liked and posted commentary about the same types of patches opened up fresh lines of inquiry that ultimately reinforce publicly available reporting that placed the assailants, the victim and the cameraman at the al-Shaer site in the late spring of 2017. It also suggests that there are likely overlapping links between members of Rusich and those implicated in the incident. Social network analysis of social media data for individuals who subscribe to Rusich social media accounts also underscores the link between Russian ultranationalists who fought in Ukraine and units affiliated with Russian PMSC contractors who worked for EvroPolis in Syria, corroborating early reporting by Fontanka.²⁵

Observations about Implements & Weapons in the Video

The perpetrators utilize model MPL-50 entrenching tools (spade) to sever the arms of the victim. This model has been used by the Russian Empire and its successor states, nearly unchanged, since the late nineteenth century. Spetsnaz operators are typically trained to use their entrenching tools as weapons in hand to hand combat, and several authoritative accounts by Russian observes indicate that spetsnaz soldiers are taught in training to use entrenching tools for interrogations.²⁶ The presence of this tool supports, but does not necessarily confirm reports that the assailants are current or former members of the Russian military.

Two firearms are clearly visible in the videos. The first is a RPK-74 light machine gun. The furniture of the RPK-74 has been constructed from black polymer (as opposed to wood) since the model was introduced in 1974 as a primary squad automatic weapon for VDV spetsnaz paratroopers.²⁷ Therefore, the weapon pictured here appears to be an older model.

The next weapon is the AK-74M assault rifle. The age and quality of these weapons is difficult to assess due to poor camera angle and manual paint coating.

All weapons observed are in common use among various parties to the Syrian conflict. Painting weapons manually is uncommon among line infantry units. As a result, the weapon on the right may suggest that the user has a background in special operations. No specific information is implied about the identities of the perpetrators, however, by the presence of these weapons at the scene.

Observations about the Incident Location

Three months after initial reports by Novaya Gazeta and Fontanka about the videos on February 21, 2019, a Vkontakte war blog claimed in a post that the Hayan Petroleum Company posted an image on its page showing a memorial to “Russian volunteers in the Syrian Arab Republic” and indicating that there were unconfirmed reports that the site was a “permanent location for the Wagner Group PMC fighters” (Figure 14).²⁸ Comparison to satellite imagery (Figures 15 and 16) strongly suggests that the location of the monument is in a courtyard area near the entry way to Jihar gas facility, likely placing at least one of the Wagner Group contingents in the Hayan gas block area. 

The comparison of a Rusich Instagram account post (Figure 17) of the Wagner Group memorial statue with those posted elsewhere on Vkontakte (Figure 14) and satellite imagery of the Jihar site on the Hayan Block (Figures 15 and 16) appears to support the assertion that Russian PMSC employees affiliated with both the Wagner Group and Rusich were stationed at Jihar in the Hayan block and not far from the al-Shaer gas field at some point after Syrian and Russian operators retook control of the site in the spring of 2017. It also would appear to corroborate prior reporting that Wagner Group operators and Russian-trained ISIS Hunters assisted in the recapture of the facilities in the Hayan Block area from ISIL in April 2017.²⁹ A Facebook post on the Hayan Petroleum Company account that clearly shows before and after pictures of the Jihar gas plant, which also circulated among Vkontakte soldier of fortune accounts in 2017 and again in 2019.

Zooming in on the Al-Shaer Compound

In late April 2020, Novaya Gazeta reporter Denis Korotkov published a story placing the scene of Bouta’s killing at the al-Shaer gas facility.³⁰ According to widespread media reports, ISIS fighters destroyed most of the main facility of al-Shaer in mid-May 2016.³¹ This destruction preceded a series of battles in the vicinity of the site in late 2016. As a result of the destruction, and the ongoing threat of enemy attack or vehicle borne improvised explosive devices (IEDs), it is likely that any semi-permanent base of operations would be set up outside the main compound. Analysis of satellite imagery of the site reveals a number of places that would potentially be suitable for perimeter defense. We analyzed image stills from the video of Bouta’s murder (Video D) and determined that an outer perimeter fence appears to be visible from at least three angles.

Since it would appear that a considerable portion of the structures in the center of the site remained relatively intact, the shots showing the perimeter fence suggest that part of the videotaped incident occurred in a corner of the al-Shaer site with a relatively unobstructed view of the outer area of the site. This would seem to corroborate Novaya Gazeta’s claim in its April 2019 report that the men involved in the incident likely spiked the victim’s head on a fence in the northwest quadrant of the al-Shaer area.³²