Marwah, a 21-year-old Canadian-Syrian activist, had unwittingly borne witness to his first cluster bomb attack. He was being driven through a town in northern Syria on Dec. 12, 2012, on the first day of a visit to the country.
Marwah's experience that day — and the video of it that someone else managed to shoot — would eventually become one piece of a steadily expanding digital mosaic that is giving the outside world an unprecedented snapshot of the enduring mayhem being wreaked by cluster bomb attacks inside Syria.
The Dec. 12, 2012 cluster bomb attack was one of at least 119 involving a total of 156 bombs across Syria since last October, according to a report by Human Rights Watch. (http://bit.ly/16M2pk1)
Those assembling the digital forensic work behind that initial report know full well it could form the basis of a potential war crimes prosecution against the regime of Bashar Assad, which began using the banned weapons for the first time last year.
Syria isn't a signatory to the Convention on Cluster Munitions. The treaty aims to ban the use of the deadly and indiscriminate bombs, each of which can unleash hundreds of deadly submunitions, or bomblets. Canada is one of the 112 countries that has signed the convention, but has yet to formally ratify it.
Syria is increasingly closed to journalists and researchers, which makes Assad's denials of cluster bomb use especially difficult to challenge.
But a sophisticated new brand of digital forensics is gradually emerging to overcome the obstacles. It combines social media video and photos, satellite imagery and ground-level reporting by researchers and activists on the front lines of a major attack.
"We've proved the concept. We've proved the workflow and the methodology, creatively integrating first-hand testimony and satellite imagery and the publicly released videos," said Josh Lyons, an expert in geospatial analysis with Human Rights Watch.
"It has provided insights into the conflict that we would have not been able to have obtained otherwise."
Lyons works in a non-descript white-walled room in his organization's Geneva offices, largely in front of twin computer monitors. The 42-year-old Detroit native offered The Canadian Press a first-hand view of how the cluster bomb tracking is done, and where it might be headed.
It begins with someone shooting a video of an attack, usually on a portable mobile smart phone and then posting it online.
As of late April, Lyons had helped document 450 videos depicting cluster munition use. The attacks were mapped with the aid of satellite imagery as well as the actual digital data imbedded in the videos themselves. Activist confirmation on the ground is a final key component.
"The primary concern in using any of these videos is the reliability. Is the video presenting a factual event? Has it been manipulated? Is it where they said it was?"
A frame-by-frame analysis of the video starts the verification process. That's followed by matching it with geographic data, especially satellite imagery, which is commercially purchased. Researchers try to contact the videographer or locals near the scene so they can conduct independent verification.
In the case of the Dec. 12, 2012, attack in the town of Mare, north of the city of Aleppo, the Human Rights Watch report concluded that four civilians, including one child, were killed in the 3 p.m. sortie by a jet dropping four cluster bombs. Another 27 were injured.
The report also identified the type of weapons used: an RBK-250 bomb containing PTAB-2.5M anti-armour bomblets, a weapon originally produced in the Soviet Union. That conclusion was based on the fact that local residents gathered at least seven unexploded submunitions, as well as numerous more YouTube videos.
"The video is simply a video without confirmation. It has no political or legal value," said Lyons.
It is only when it is authenticated, and linked to the people who recorded it and to the victims and names and families, "that video has been transformed into evidence of a potential war crime committed against this civilian population."
"The benefit of bringing this satellite capacity into Human Rights Watch is that it then provides a complete research mechanism," Lyons said. "We have people on the ground. They can give me feedback. I can give them an initial assessment."
The organization also recruited the services of another secret weapon of sorts: an unemployed British office worker-turned-weapons blogger, who has built up a credible pedigree as an online information source.
Eliot Higgins, 34, of Leicester, U.K., has been drawing a large online following because he has monitored and categorized weapons on his Brown Moses blog (named after a Frank Zappa song).
Higgins came to the attention of Human Rights Watch last fall. The group contracted him to do some of the very labour-intensive work of combing through hundreds of online videos. Higgins has worked with the organization's munitions specialists to help identify specific types of weapons as part of the ongoing authentication process.
"Using cluster bombs to put down a civil unrest is incredible, really — dropping them on your own country," he said in an interview over Skype.
Higgins, who is married, does the work from his suburban home north of London while caring for his 19-month-old daughter.
He recalled the point in time — over this past Oct. 8 and 9 — when he saw a noticeable spike in cluster bomb use.
"It literally went from being no cluster bombs to about a dozen in one day, and every day after that, another dozen, another dozen, which was just such a massive escalation," he said.
"The main thing people should realize is they're being used on a massive scale across the country in areas that don't have anything to do with ongoing military action."
While the recent reports of chemical weapons use in Syria are extremely serious, the long-term damage they cause won't be as bad as what cluster bombs will leave behind, said Higgins.
"People go on about chemical weapons and how awful they are. But you've got nine months of cluster bombs across the country. They're going to leave a legacy for decades to come," he said.
"You just have to look at Vietnam. There's still people being exploded by cluster bombs there."
The most haunting image Higgins has seen from the reams of footage he has viewed comes from that Dec. 12, 2012 attack.
One graphically explicit video shows someone carrying the severed head of a man and the burned-out hulk of the motorcycle he was riding before he was cut down by a cluster bomb.
"I think that has to be among the worst videos I've seen," Higgins said.
Marwah now lives in Ottawa and recently graduated from Carleton University with a major in law and mass communication.
He will never forget what happened to that motorcyclist. After the MiG fighter had cleared the area, he leapt out of his vehicle with his travelling companions to survey the macabre results. And like so many others did on that day, he started taking pictures.
"That was pretty devastating," Marwah recalled, as he clicked through the digital folder on his laptop that holds the record of what he witnessed in Syria.
"When I was in Syria, I wanted to document everything I could, so I took this picture ... and I put it on Facebook, right away."
— This story was written with financial support from the R. James Travers Foreign Corresponding Fellowship.
Note to readers: This a corrected story. An earlier version, which moved July 2, said the attack took place in the city of Aleppo, when in fact it was in the town of Mare, north of the city of Aleppo.