With the United States threatening to attack Syria, U.S. and allied intelligence services are still trying to work out who ordered the poison gas attack on rebel-held neighborhoods near Damascus.
No direct link to President Bashar al-Assad or his inner circle has been publicly demonstrated, and some U.S. sources say intelligence experts are not sure whether the Syrian leader knew of the attack before it was launched or was only informed about it afterward.
While U.S. officials say Assad is responsible for the chemical weapons strike even if he did not directly order it, they have not been able to fully describe a chain of command for the Aug. 21 attack in the Ghouta area east of the Syrian capital.
It is one of the biggest gaps in U.S. understanding of the incident, even as Congress debates whether to launch limited strikes on Assad's forces in retaliation.
After wrongly claiming that Iraq possessed weapons of mass destruction before the 2003 U.S. invasion, the U.S. intelligence community, along with the Obama administration, are trying to build as solid a case as they can about what it says was a sarin nerve gas attack that killed over 1,400 people.
The Syrian government, backed by Russia, blames Sunni rebels for the gas attack. Russia says Washington has not provided convincing proof that Assad's troops carried out the attack and called it a "provocation" by rebel forces hoping to encourage a military response by the United States.
Identifying Syrian commanders or leaders as those who gave an order to fire rockets into the Sunni Muslim areas could help Obama convince a war-weary American public and skeptical members of Congress to back limited strikes against Assad.
But penetrating the secretive Syrian government is tough, especially as it fights a chaotic civil war for its survival.
"Decision-making at high levels within foreign governments is always a difficult intelligence target. Typically small numbers of people are involved, operational security is high, and penetration - through either human or technical means - is hard," said Paul Pillar, a former CIA expert on the Middle East.
One possible link between the gas attack and Assad's inner circle is the Syrian government body that is responsible for producing chemical weapons, U.S. and allied security sources say.
Personnel associated with the Syrian Scientific Studies and Research Council (SSRC), which has direct ties to Assad's entourage, were likely involved in preparing munitions in the days before the attack, they say.
A declassified French intelligence report describes a unit of the SSRC, known by the code name "Branch 450", which it says is in charge of filling rockets or shells with chemical munitions in general.
U.S. and European security sources say this unit was likely involved in mixing chemicals for the Aug. 21 attack and also may have played a more extensive role in preparing for it and carrying it out.
Bruce Riedel, a former senior U.S. intelligence expert on the region and sometime advisor to the Obama White House, said that intelligence about the SSRC's alleged role is the most telling proof the United States has at hand.
"The best evidence linking the regime to the attack at a high level is the involvement of SSRC, the science center that created the (chemical weapons) program and manages it. SSRC works for the President's office and reports to him," Riedel said.
U.S. officials say Amr Armanazi, a Syrian official identified as SSRC director in a State Department sanctions order a year ago, was not directly involved.
Much of the U.S. claim that Assad is responsible was initially based on reports from witnesses, non-governmental groups and hours of YouTube videos.
U.S. officials have not presented any evidence to the public of scientific samples or intelligence information proving that sarin gas was used or that the Syrian government used it.
The United States has also not named any Syrian commanders it thinks gave the green light to fire gas-laden rockets into Ghouta.
But U.S. and allied security sources say they believe that Syrian military units responsible for the areas that were attacked were under heavy pressure from top commanders to wipe out a stubborn rebel presence there so government troops could redeploy to other trouble spots, including the city of Aleppo.
An analysis by the Congressional Research Service, a branch of the Library of Congress, reported that a declassified U.S. government paper summarizing intelligence findings concludes that Syrian government officials were "witting and directed" the gas attack. But the evidence of who ordered it was not watertight, the analysis said.
The findings were partly based on intercepted communications "involving a senior official intimately familiar with the offensive" which "confirmed that chemical weapons were used by the regime," it said.
As more information has been collected and analyzed, early theories about the attack have largely been dismissed, U.S. and allied security sources said.
Reports that Assad's brother, Maher, a general who commands an elite Republican Guard unit and a crack Syrian army armored division, gave the order to use chemicals have not been substantiated, U.S. sources said. Some U.S. sources now believe Maher Assad did not order the attack and was not directly involved.