Irrespective of the SAM operator’s actions, standard defence procedure would dictate that SAM units operate as part of an integrated structure with steady information exchanges between complementary C2 elements. Based on the information available, the Forensic Team has assessed that the command unit should have known that there was a significant misalignment and notified the SAM operator of the situation. Furthermore, if a SAM unit is not aligned properly, then there would probably be a mismatch between the targets’ directional information received from C2 and the information that is on the display in the misaligned SAM unit. Traditionally, the information would flow between the SAM unit and the immediate C2 through a form of digital data link and/or voice communications relaying headings and target. The SAM unit arrived at its location west of the capital around midnight TT on January 8, 2020.138 It was set up and likely operational for over six hours before Flight PS752 was shot down. With nine other flights departing IKA before Flight PS752 on this date, including eight departures after Iran launched missiles into Iraq, there should have been ample opportunity for C2 to detect and correct this misalignment.
Operator Action # 3 – Firing Missiles without Authority The SA-15 system is effective in conflict zones against short-range threats. The system cannot, however, by itself easily distinguish between airliners, military aircraft, and cruise missiles.139 According to experts, militaries using these systems typically link them to a broader air defence command system that has better situational awareness of civilian air traffic. In such circumstances, permission is typically required from the air defence C2 before an operator fires a missile at a target.140 Aside from Iranian official reports, the Forensic Team was not able to identify any information suggesting the SAM operator requested or received authorization to fire upon Flight PS752. Iranian official reports and public statements also indicate that missile release authority was never delegated to the level of the SA15 operator and the operator fired without permission.141 The Forensic Team consulted military experts, who indicated that it is a common practice for air defence forces to launch two missiles, often one after the other, and then conduct a damage assessment of the target (shoot-shoot-look). In this case, the SAM operator appears to have employed a different approach known as a purposeful re-attack strategy (shoot-look-shoot). That is, the SAM operator fired the second missile at Flight PS752 after observing the first missile failed to destroy its target, as indicated in Iran’s Final Report.142 Iran has provided no information to substantiate these claims or demonstrate whether the decision to fire the second missile was consistent with IRGC procedures. The Forensic Team has assessed the significance of Iran’s purported communications outage between the SA-15 operator and his immediate C2. The veracity of this claim is unknown; however, if it did occur, this would have denied the operator the ability to enhance his situational awareness and receive authority for missile release. It should have also impacted other SA-15 operators, not just the one who shot down Flight PS752. The IRGC aerospace commander pointed to saturation (or communications system overload) as a possible cause of this alleged communications outage rather than to external factors.143 According to Gholam Abbas Torki, the Military Prosecutor for Tehran, “there were hypotheses on the cyberattack, hacking of the defense system, disruption of the aircraft systems and the defense network, but none of them have been substantiated by any solid reasons.”144 The Forensic Team found no evidence of a cyberattack. 47
