WARNING: While no actual cutting or gore will be shown in this post, some of the images and animations in this article and the comments may be disturbing.
A low resolution video appeared on the web site of pro-Russian hacking group CyberBerkut, dated July 10th, with the description:
http://www.cyber-berkut.ru/main/20150710_00.php
The video shows a very brightly lit stage with simulated desert floor and a greenish backdrop. A film crew and multiple lights surround the stage, but they are strongly backlit. The video has no audio, and is very low resolution so no details can be made out. The kneeling man wears a head cover, to suggest that the head could be replaced by a computer generated image, or separately recorded video.External Quote:
The video appears to be an attempt to replicate one of the "Jihadi John" beheading videos of 2014. In particular it appears to be an attempt to replicate the video of James Foley. None of those videos show actual beheadings, and instead show Jihadi John sawing at the neck with no apparent blood, and then they cut to a shot of a decapitated head posed on top of a body. This led to speculation that the videos were faked.
The CyberBerkut video seems to be an attempt to reinforce that idea, and has been picked up as such by several alternative media outlets, like Infowars:
http://www.infowars.com/corporate-media-covers-staged-isis-beheading-video/
However we can tell it is not a video of the faking of any of the Jihadi John videos for a number of reasons.
The video does not match
The actions in the video most closely resemble the James Foley video. The "Jihadi John" figure in the Cyberberkut video seems to be trying very carefully to replaced the actions of the original when he steps in to pretend to cut the neck. But putting these videos side by side (synced up with the moment the JJ figure puts his hand on the neck) reveals differences.
The first thing you notice is how similar they are, which indicates a deliberate attempt to duplicate. However there are several differences, apparent even here.
At the start, the real Jihadi John has his arm by his side, but the second Jihadi John has his arm on the back of the prisoner's neck.
The prisoner has his knees wider, which then forces JJ2 to have a much wider stance.
Notice also the gun. In the original the gun in the holster swings out level with his hand. In the fake it is not visible at all during the same motion.
After that point, the video diverges even more significantly. The JJ figure has his head tilted in the opposite direction, and starts fake cutting far too quickly.
This incorrect head tilt applies to all of the similar videos: Foley, Sotloff, Haines, and Henning - in all four videos Jihadi John's head is angles to the camera right. This means that the CyberBerkut video matches none of them.
The lighting is all wrong
In the original the scene is lit from the front with the sun high, and to the right of the camera. It's very clear there's a single light source, and that it's the sun. In the fake, the primary lighting on the prisoner comes from the comes from behind the prisoner, and to the left of the camera
In fact the scene is very strongly lit from behind. You can see multiple shadows cast towards the camera by the actors, and the "director". So it's clear the strongest light sources are coming from behind. This does not match the original at all.
The people faking the video do not seem to have considered that the ground is visible in a portion of the original, so you can quite clearly see the direction of the shadows is wrong.
It's not real green screen
The "studio" does not really look like a green screen studio either. Compare it to real green screen studios:
Does the Metadata tell us anything?
The link to the "original file" on CyberBerkut goes to:
http://www.cyber-berkut.ru/docs/world_need_to_know_this.mp4
(File mirrored here: https://www.metabunk.org/sk/world_need_to_know_this.mp4 MD5=
9a37e2f7a6396bf71fb351d7917e58c6 )
Dumping the Time metadata gives us:
Code:
mp4file --dump world_need_to_know_this.mp4 | grep Time
"world_need_to_know_this.mp4": creationTime = 3517850714 (0xd1ae245a)
"world_need_to_know_this.mp4": modificationTime = 3517850714 (0xd1ae245a)
"world_need_to_know_this.mp4": creationTime = 0 (0x00000000)
"world_need_to_know_this.mp4": modificationTime = 3517850715 (0xd1ae245b)
"world_need_to_know_this.mp4": creationTime = 0 (0x00000000)
"world_need_to_know_this.mp4": modificationTime = 3517850714 (0xd1ae245a)
"world_need_to_know_this.mp4": creationTime = 3517850714 (0xd1ae245a)
"world_need_to_know_this.mp4": modificationTime = 3517850715 (0xd1ae245b)
"world_need_to_know_this.mp4": creationTime = 3517850714 (0xd1ae245a)
"world_need_to_know_this.mp4": modificationTime = 3517850715 (0xd1ae245b)Other than the zero timestamp there are two timestamps, one second apart in Mac timestamp format, which can be converted here:
http://www.epochconverter.com/epoch/mac-timestamp.php
And they resolve to Mon, 22 Jun 2015 20:45:14 GMT (and one second later).
All this timestamp tells us is the likely date that the file was exported from the video creation software. It's not 100% as timestamps can be faked, but it would seem more likely that the creators would want to fake an earlier time, so this is likely the correct date and time.
However this does not tell you when the original video was recorded. It only tells you when it was exported from the video editor.
Last edited:
