Moscow Attack: Refuting the Unfounded Allegations

Vladimir Putin has acknowledged that a certain group of individuals were responsible for the tragic attack at the concert hall in Moscow last week.

However, even though the Islamic State (IS) group has claimed responsibility, the Russian president remains adamant that Ukraine was involved.

BBC Verify analyzes the unfolding of the campaign to assign blame, as revealed by Russian officials’ statements, media reports, and social media posts.

Initial allegations

Allegations surfaced shortly after the initial reports of the incident at the Crocus City Hall were shared on social media on Friday at 1715 GMT.

Within just over an hour, a number of pro-Kremlin bloggers and certain officials posting to the messaging app Telegram placed blame on Ukraine.

According to Sergey Markov, a pro-Russia pundit, he suggested that the attackers appeared to be “Islamist radicals”. However, he also made an unsubstantiated claim that the attack was “probably orchestrated from Kyiv”.

Approximately 40 minutes later (1903 GMT), a national tabloid, Moskovsky Komsomolets, cited military expert Roman Shkurlatov suggesting that the attack could have potentially been coordinated with assistance from Ukraine’s Security Service and military intelligence.

At 1927 GMT, Russia’s former President Dmitry Medvedev expressed strong determination to retaliate if Ukraine was implicated.

The alleged claim of responsibility

Later that evening, at 2213 GMT, NTV – a prominent TV channel in Russia – broadcasted a video clip alleging the confirmation of a senior Ukrainian official regarding their country’s involvement.

In the video, Oleksiy Danilov seems to express his enjoyment of the current atmosphere in Moscow, suggesting that there is a lot of excitement. I hope we can organize similar enjoyable events for them in the future.

However, BBC Verify has confirmed that the clip is a combination of two Ukrainian TV interviews that were aired in the recent week.

You can find both of them on YouTube. We have an interview with Danilov from 19 March. Another article was released three days prior, highlighting Ukraine’s military intelligence chief, Kyrylo Budanov.

The quote by Danilov that is featured in the NTV video is not audible in the original interview.

An audio analysis conducted by the Advanced Forensic Technology Research Group at Liverpool John Moores University, on behalf of BBC Verify, indicates that the audio in the NTV video has been tampered with.

There appears to be a discrepancy in the audio frequency data, suggesting that the sound may have been altered. However, the researchers are unable to confirm whether the voice was generated by AI.

BBC Verify has also discovered evidence within the audio file indicating that it has undergone manipulation using editing software.

‘Window’ for crossing

In his address on Saturday, Vladimir Putin made an official accusation.

The Russian president claimed that the attackers were apprehended while attempting to escape to Ukraine, where they allegedly had an exit strategy in place.

However, Russia has not provided any evidence to support the claim of a “window” through which the attackers could have entered.

While BBC Verify cannot independently confirm the destination of the suspects, we have authenticated multiple videos and photos of their apprehension. Contrary to Putin’s assertion, the arrests occurred far from the Ukrainian border.

Based on the background details in their environment, it has been determined that two of the arrested suspects were captured on film approximately 90 miles (145km) away from the Ukraine border.

Despite Ukraine’s denial, the Islamic State (IS) group has claimed responsibility through its self-styled Amaq news agency.

Visual evidence, shared by IS, includes a photo of four attackers with their faces obscured and a highly graphic video captured from one of the assailant’s viewpoints.

Various details, such as the characteristics of the concert hall and the firearms utilized by the assailants, correspond to videos that surfaced online during the incident.

However, Russia persists in blaming Ukraine, despite the available evidence.

Margarita Simonyan, the editor in chief of the Russian TV network RT (previously known as Russia Today), stated on X that the attackers did not belong to IS. She pointed out that they were not wearing suicide vests and did not have any intention to sacrifice their lives.

However, despite IS’s repeated warnings to assailants about avoiding capture, the group’s attackers have managed to escape in the past.

In late 2022, a militant involved in an attack on a hotel in Kabul managed to escape and later carried out a suicide attack, as reported by IS media observed by BBC Monitoring.

What information do we have about the individuals involved?

The perpetrators were apprehended after driving a white Renault, which coincidentally resembled the vehicle captured in another video as their means of escape from the concert hall.

As per the statement of Russian State Duma deputy Alexander Khinshtein, an individual was apprehended near the vehicle, while the remaining three individuals escaped into the nearby woods and were captured after a thorough search.

According to Mr. Khinshtein, the Renault was found with weapons and Tajik passports.

Footage of the men being escorted into a Moscow court was published on Sunday. The individuals were identified by Russian authorities as Dalerdzhon Mirzoyev, Saidakrami Murodali Rachabalizoda, Shamsidin Fariduni, and Muhammadsobir Fayzov.

In the image published by IS, three individuals are depicted wearing different colored shirts: light brown, light green, and grey.

It seems that these shirts are similar to the ones worn by three of the suspects when they were apprehended.

In the video released by IS, two logos on the light brown t-shirt worn by the man named Rachabalizoda are also visible. He further identifies himself using the same name during a subsequent interrogation.

The suspect Mirzoyev, whose shirt is not visible in the IS picture, was apprehended while dressed in a long-sleeve green shirt, blue jeans, and a black belt. The three items of clothing are worn by an individual in the IS video.

Can we trust the credibility of IS’s claim of responsibility?

There is a video that was filmed by the attackers during the killings. The video contains graphic content and includes slogans commonly used by IS attackers. It has been distributed through official IS media channels, which is in line with the group’s usual methods.

Russian media has recently released an image showing one of the attackers inside the Crocus City Hall, indicating that the attack may have been pre-planned.

IS frequently waits for confirmation of the attackers’ fate before making any claims. When an attacker passes away, it hinders intelligence agencies from obtaining information through interrogation or torture.

It is quite uncommon for a claim of responsibility to be made while the culprits are still on the loose. This suggests that IS is eager to confirm its involvement.

Russia has been a repeated target of IS in the past. In addition to several smaller incidents in recent years, there were two significant attacks in 2015 and 2018.

About The Author