From Sarin to the Chain of Command: The Ghouta Chemical Attack Investigative Reference File

This investigative reference file is designed for investigators, journalists, civil-society researchers, advocates and international legal practitioners working on the chemical attack that struck Eastern and Western Ghouta on 21 August 2013. It separates technical findings from judicial facts, official assessments, civil-society and open-source conclusions, and propositions that remain investigative hypotheses.

Thirteen years after the attack, the central difficulty is not the absence of material. It is the tendency to merge different evidentiary categories. A laboratory result may be presented as attribution; an arrest warrant may be reported as a conviction; an administrative sanction may be treated as a judicial determination; and an open-source assessment may become a “fact” through repetition without its assumptions being preserved. This file is intended to prevent those category errors.

Download the Full Arabic Report — Edition 3.0

Executive Summary

The crime base is technically strong. The United Nations Mission concluded that there was clear and convincing evidence that surface-to-surface rockets containing sarin had been used on a relatively large scale in Ein Tarma, Zamalka and Moadamiya in the early hours of 21 August 2013. Environmental, biomedical and munition-related findings reinforced one another. The Independent International Commission of Inquiry on the Syrian Arab Republic likewise concluded that large quantities of sarin had been used in a well-planned attack with indiscriminate effects.

Those conclusions establish the use of a prohibited chemical warfare agent and the occurrence of mass harm. They do not, by themselves, identify every person who authorised, prepared, transported or launched the munitions. Attribution and individual criminal responsibility require additional links: access to the agent and munition; an order, communication or operational record; movement and launcher evidence; identification of the crew; and a reliable connection between those acts and the impact sites, samples and victims.

The French proceedings have moved the accountability inquiry beyond a general description of state structures. A judicial investigation was opened in Paris in 2021. Arrest warrants announced in 2023 concerned Bashar al-Assad, Maher al-Assad, Bassam al-Hassan and Ghassan Abbas. A further warrant concerning Talal Shafiq Makhlouf was announced in 2025. Public litigation has also addressed the immunity attached to the office of a serving head of state and the legal consequences of the loss of that office. Nevertheless, as of the cut-off date of 22 August 2026, there has been no public trial on the merits and no final conviction in the French case concerning the attacks of 5 and 21 August 2013.

The precise legal conclusion: an arrest warrant records a judicial basis for seeking and bringing a named person before the competent authorities. It is not a final finding of guilt. A ruling on immunity determines whether proceedings may lawfully be directed at a person in a particular official position; it does not determine responsibility for the chemical attack.

How This File Classifies Evidence

The reference file uses five status labels. They are not rankings of moral credibility; they describe the procedural and evidentiary position of a proposition at the cut-off date.

• T — Technically established: a high-confidence scientific or institutional finding, such as the detection of sarin. It does not automatically establish the perpetrator.
• J — Judicially or procedurally established: a fact contained in a public judicial record, including the opening of an investigation, issuance or annulment of a warrant, or an immunity ruling. It is not a conviction unless expressly identified as such.
• A — Official or administrative assessment: a governmental assessment, designation or sanction. It may provide an important investigative lead, but normally discloses less evidence and applies a different standard from criminal adjudication.
• C — Civil-society investigation or OSINT: a conclusion developed by a rights organisation, archive or open-source researcher that has not been tested publicly through adversarial judicial proceedings.
• H — Hypothesis or investigative lead: a possible connection that still requires an original record, witness, forensic match or other independent corroboration.

What Has Been Established — and What Has Not

Technically established

• Sarin was used in the 21 August 2013 attack and was detected through multiple environmental and biomedical samples examined within the UN Mission’s process.
• Surface-to-surface rockets associated with the affected locations were documented and examined.
• The scale, distribution and medical presentation were consistent with a large chemical-agent incident rather than an isolated exposure.
• Ein Tarma, Zamalka and Moadamiya were principal documented impact or exposure locations in the UN investigation.

Not established by the technical record alone

• The precise launch point of every munition.
• The identity of every launcher, vehicle, crew member and logistical participant.
• The specific order or communication that connected the highest decision-making level to each munition and impact site.
• The mental element, knowledge and contribution required to establish the criminal responsibility of each person named in public allegations or warrants.

There is also no single final UN casualty figure. Public estimates differ because they use different source pools, verification rules and definitions. A defensible reference file therefore records each figure together with its source and method rather than aggregating incompatible counts or selecting the highest total.

The French Proceedings: What the Public Record Shows

The French case began with a complaint submitted by Syrian survivors with the support of the Syrian Center for Media and Freedom of Expression, the Open Society Justice Initiative and Syrian Archive. In April 2021, a judicial investigation was opened in Paris before judges specialising in crimes against humanity and war crimes.

Public descriptions of the case indicate a mixed evidentiary architecture: survivor and witness testimony; expert evidence; declassified intelligence assessments; photographs and videos; civil-society documentation; open-source analysis; and material concerning the structure of the Syrian military and chemical-weapons programme. The public record does not disclose the complete witness statements, expert reports, intelligence files or judicial reasoning supporting every warrant. Consequently, this file distinguishes three different propositions:

1. What complainants and civil parties allege. These submissions define lines of responsibility that the investigation may examine, but they are not automatically judicial findings.
2. What a public judicial decision or warrant procedurally records. This can establish that a legal step occurred and identify the person concerned, without proving guilt at trial.
3. What remains inside the confidential investigation. The existence, content and weight of non-public evidence should not be inferred beyond what a court or authorised participant has publicly stated.

Persons and Institutions in the Public Accountability Record

Due-process rule: inclusion in this matrix does not establish criminal responsibility. It identifies a person or institution that appears in the public accountability record and states the legal or evidentiary limitation that must accompany the reference.

The Chain of Command: From Organisational Chart to Proof

An organisational chart shows formal reporting relationships. A criminal-responsibility map must do more. It must connect a person’s conduct, knowledge, authority or effective control to the preparation or commission of the crime. This file therefore treats the chain of command as a sequence of proof gateways rather than a descending list of names.

1. G1 — High-level decision: identify an order, authorisation, approval or other evidence capable of showing a decision attributable to a particular person or body.
2. G2 — Coordination: establish a specific and consequential communication between the decision-making level and the technical or operational structure.
3. G3 — Preparation: identify the agent, munition and personnel involved in preparation, including relevant records, witnesses or material traces.
4. G4 — Transfer and custody: connect a specific batch or munition to the later Ghouta evidence through a reliable custody trail or forensic match.
5. G5 — Operational order: identify an order, duty roster, operations log, communications record or equivalent evidence concerning the relevant unit and time.
6. G6 — Movement and launcher: establish the movement of the munition and launcher through geolocation, imagery, radar, logs, communications or corroborated testimony.
7. G7 — Crew: identify the operational personnel and prove each person’s function, knowledge and contribution.
8. G8 — Impact and harm: trace the act to the impact site, samples, medical consequences and victims through a defensible causal chain.

The Two Most Important Public Evidentiary Gaps

First, the material-linkage gap. Public sources establish sarin exposure and document relevant munition remnants. What remains insufficiently public is a forensic or documentary bridge connecting a specific Syrian programme batch or munition, through preparation and custody, to the Ghouta samples. Such a bridge might be built through production records, chemical impurity profiles, container or component identifiers, transfer logs, witnesses, archived samples or other material capable of independent examination.

Second, the operational-crew gap. Public analysis has examined possible launch areas, relevant formations and command positions. Individual criminal responsibility nevertheless requires the identification of the people who performed or materially facilitated operational acts, together with evidence of their function, knowledge and contribution. Platform attribution is not crew identification; crew identification is not proof of knowledge; and knowledge is not automatically proof of the contribution required for a particular mode of liability.

How the Principal Source Families Should Be Used

• UN Mission: the central public technical record for sarin detection, biomedical and environmental sampling, and examined munitions. Its mandate was not to identify perpetrators.
• UN Commission of Inquiry: a broader human-rights and international-criminal-law assessment drawing on its own evidentiary base. Its published conclusions must be quoted with the limits it expressly stated.
• OPCW, FFM, IIT and DAT/OSM: institutionally distinct mechanisms with different mandates. Findings relating to other Syrian chemical incidents cannot automatically be transferred to the Ghouta case, but may be relevant to programme structure, methods, declarations or investigative comparison.
• IIIM: a mechanism that collects, preserves and analyses material for future criminal proceedings. The absence of public disclosure does not imply the absence of evidence; equally, it cannot justify claims about confidential holdings.
• SCM, OSJI and Syrian Archive: central civil-society actors in the French complaint and in the preservation and analysis of documentation. Their public statements explain important lines of inquiry but do not disclose the entire judicial file.
• HRW, GPPi, Bellingcat and other open-source researchers: valuable for munition analysis, chronology, geolocation, programme patterns and hypothesis testing. Their findings must retain stated assumptions, confidence levels and alternative explanations.
• European and United States sanctions: useful for identifying official allegations, institutional roles and investigative leads. Sanctions are administrative measures applying standards different from criminal proof.

Investigative Priorities

A serious next-stage investigation should prioritise original and testable material rather than additional repetition of public allegations. The most valuable categories include:

• original orders, communications, operations logs, duty rosters and movement records for the relevant dates and units;
• production, storage and transfer records capable of identifying the agent or munition batch;
• preserved samples and analytical data suitable for independent comparison and peer review;
• radar, satellite, aerial or ground imagery with a documented provenance and time basis;
• testimony from insiders and operational witnesses assessed for access, consistency, corroboration and motive;
• platform, vehicle and crew identification supported by more than one independent source;
• evidence relevant to knowledge, effective control, prevention, punishment and reporting after the attack;
• a complete chain of custody for every digital, documentary and physical exhibit intended for judicial use.

Publication and Updating Method

The reference file is designed as a living publication. A material update should record the date, source, affected proposition and reason for changing its evidentiary status. A new report should not silently overwrite an earlier conclusion. The public database should remain separate from a protected investigative repository containing witness identities, sensitive documents and material whose disclosure could endanger people or compromise future proceedings.

Legal notice: this is an open-source research publication, not a judicial ruling and not a substitute for a confidential investigative file. The inclusion of a person, unit or institution does not mean that criminal responsibility has been established. Unless expressly stated otherwise, allegations and warrants are reported as procedural or investigative facts rather than findings of guilt.

Read the Complete Arabic Reference File — Edition 3.0