Members of the OTP testify in court

During the last few months of 2015 the Prosecution called many of its own team members to give evidence, an unusual practice in (international) criminal proceedings (with the exception of investigators and actual experts working for the Prosecution, who appear more often in court). Some of these witnesses were primarily questioned by the judges and seem to be called to provide information on technical aspects of the Prosecution’s case, including the creation of call data records and databases. Other members of the Prosecution are extensively questioned by the defence, whilst especially the investigators hardly received any questions. Below a summary of the evidence given by these Prosecution members (and one expert), divided into three main topics.

1. CALL DATA RECORDS (DATABASE AND ANALYSIS)

Mr Spartak Mkrtchyan (14-15 September)

Mr Mkrtchyan is the Prosecution computer information systems officer and the database administrator. He and his team are responsible for the Prosecution's call data record structured query language (or SQL) database. This includes the design of the database, the upload of the call data records, and the design of the database's built-in analytical functions or stored procedures. The Chamber has ordered the Prosecution to call witnesses to provide further evidence about the production of the call sequence tables and the underlying data (see decision of 5 May 2015, para. 115). Mr Mkrtchyan provides evidence on the format in which the raw call data and SMS content was received by the Prosecution, the database he created and filled with the raw data, and the stored procedures he wrote to search the database, which enabled the creation of some of the call sequence tables.

Professor Peter Sommer (15 September)

Although not a member of the Prosecution, Professor Sommer was hired by the Prosecution to audit the work of Mr Mrktchyan and therefore his testimony is included in this blog. Professor Sommer appeared as an expert witness on computer and information systems and the storage and security of data, including digital evidence. He wrote a report called “STL-OTP: Audit of Telephone Database Administration Processes” dated 17 July 2012. Professor Sommer visited the STL three times, and during two of these visits he met with witness Mr Mkrtchyan. He did an audit of the database system as set up by Mr Mkrtchyan, that is how the data received from the mobile phone companies was converted into a database, and to “get a clear overview of what the system is supposed to do, and constantly ask oneself: What could possibly go wrong, what is being done to prevent those things from going wrong, and what tests can one apply afterwards to establish that nothing has gone wrong.”

Professor Sommer concluded in his report that the system in relation to the handling and storage of the call data and SMS records was very thorough, and included a detailed manual, records of particular activities, and a unique number for each entry (making it easy to track back to the material provided by the phone companies). Professor Sommer further concluded that because of the processes employed, significant errors in the upload of data or data corruption are manifest or immediately apparent. Further, the fact that separate and matching records for calls between Alfa and MTC phones can be seen, provides some confidence in the accuracy and completeness of the records produced by the two mobile phone companies.

During cross-examination by Defence Counsel Mr Roberts, Professor Sommer explained that he thought he was asked to the audit, because the work was considered something of a novelty and there was a need to reassure the Tribunal that the work was done properly. Further Professor Sommer agreed that the errors he analyses in his report will not reveal data manipulation by the mobile phone companies. The witness does not have any knowledge about the data provided by two additional Lebanese phone companies to the Prosecution, and did not review the hard disks with data received by the Prosecution from the mobile phone companies.

Mr Elvis Stana (28 October)

Mr Stana is an analyst with the Prosecution, who did a statistical analysis of the call data records to determine the extent of synchronisation between the clock recordings in the call data records of the providers Alfa and MTC Touch. He explained that the mobile switching centres in Lebanon - that are recording and routing the call - were not centrally synchronised. This means that there could be a slight variation in the time recorded in the call data records for the incoming and outgoing side of a call. Some difference are only a few seconds, but especially in relation to one specific switching centre, the witness recorded a time difference of around 75 seconds. The Prosecution expects that the telephone companies will provide evidence to explain these large differences.

[Screenshot of Mr Stana testifying in court on 28 October 2015]

Ms Kei Kamei (16-19 November 2015 - cross-examination only)

Ms Kamei, an analyst working for the Prosecution, appeared in court in July and has already been cross-examined about the creation of the call sequence tables (see our blog on the five witnesses responsible for the creation of CSTs). This cross-examination is about additional topics. Defence Counsel Mr Mettraux for the accused Mr Sabra questioned the witness about information she received whilst interviewing witnesses, especially in relation to the person who claimed responsibility for the attack, Mr Abu Adass. The questions cover Mr Abu Adass’s visits to the mosques, the persons who accompanied him and his relation to certain organisations (including Al-Ahbash), the information found at his place and on his computer (including material on jihadist sites, a list on Hariri’s properties and foundations in Lebanon, and a series of maps), and phone calls made with the landline of the family Abu Adass. This results in a lot of hearsay evidence from Ms Kamei, of which the value seems questionable. She also does not remember many of the details put to her and explained that her role at that time was to focus on communication analysis. Mr Mettraux explains that he will seek to tender the actual statements of the witnesses in the future, mostly to establish the truth of their contents.

[Screenshot of Ms Kamei testifying in court]

The witness is also asked to comment on the video with the claim of responsibility, and on an alternative scenario on whom bought the phone card that was used to call Reuters and Al-Jazeera. This alternative scenario is to challenge the Prosecution’s scenario that it was the accused Sabra that was involved in this. Mr Mettraux further explains that they are not actually putting a positive case, but just an alternative possibility for the person who called the media about the claim of responsibility. The Chamber requests Mr Metttraux to further explain their defence position on this matter, and Mr Mettraux gives a lengthy explanation in court (see transcript of 19 November, p.101 and further). The Defence for the accused Sabra agree with the Prosecution that Mr Abu Adass was not the suicide bomber and that the video and letter were used to shield the identity of the real perpetrators. The information in their possession suggests that Hariri has been killed by a very sophisticated group of high-ranking state officials who used associates to commit the crimes. This includes members of Al-Ahbash and the Syrian and Lebanese security apparatus. Mr Mettraux also presents their very detailed views on how Abu Adass was lured into this. The Defence for Sabra thus does seem to present a positive case, at least on this topic, which is an interesting position to take in a trial in absentia.

Defence Counsel Mr Larochelle questions Ms Kamei about the investigations into the links and contacts between Abu Adass and members of a group called Al-Qaeda 13, including her analysis of the calls made through the landline of the family Abu Adass. He also questions the witness about the methods she used in attributing phone numbers to certain persons.

2. ELECTRONIC PRESENTATION SYSTEM

Andrew Fahey (16-17 September, 27 October)

Mr Fahey is an analyst with the Prosecution, and since November 2012 the project manager of the development of the electronic presentation of evidence software. The evidence of Mr Fahey can be divided into three parts: (i) the electronic presentation of evidence system; (ii) the associated area of what choices he made in respect of the cell site data that he used; and (iii) the various locations that have been plotted into the presentation system. His testimony on 16-17 September 2015 only dealt with the first subject.

Mr Fahey was taken through a presentation of this system, that the Prosecution intends to use to present its telecommunication evidence. The system has a database that holds evidence that the Prosecution is tendering, and creates the ability to search that database and display and record selected aspects of evidence. During his testimony the following matters were discussed:

• the five types of evidence that can be displayed in the system: a) the map of Lebanon; b) relevant locations, including routes taken by Hariri; c) cell site information (mast location, orientation and coverage); d) telephone call information (taken from the CSTs); and e) attribution (assigning of short names) of telephone numbers to users (including the accused) or networks;
• how these types of evidence are shown together;
•  record keeping (creating pdfs with screenshots and log tables); and
• quality assurance.

This system enables the Prosecution to visualise complex patterns of telephone usage. The question arises why court time would be used to explain software used by the parties, something that could easily be explained through an internal training? If there are any challenges to this software, a more logical option would be to file a written motion, or to suggest the use of different software if needed. From the transcript it appears that the parties have already met 14 times on this topic, and there seem to be no challenges to the functioning of the system, only to the selection of material used by the Prosecution.

The evidence of Mr Fahey on 27 October dealt with the map coordinates established by the witness of eight residences associated with the accused. On the basis of his analysis of documents, Mr Fahey has created a number of maps. Mr Fahey also established the map coordinates for 144 places and landmarks relevant to the Prosecution case, both for the movement of Hariri and the phone networks allegedly used by the accused in undertaking surveillance of Hariri in preparation of the attack.

Bastiaan van der Laken (9-11 November)

Mr Van der Laken works within the Prosecution and explained the functionality of the electronic presentation of evidence system, including the data management tasks associated with uploading data to the software. Like witness Fahey he explained the type of evidence stored in the system, and that this data is uploaded using an excel workbook. The witness also explained how two sides of a phone call are paired using the differences in the time records as established by Mr Stana (see above). The Defence has located  mistakes and/or differences in comparing the evidence presentation system and the call sequence tables, and confronted the witness with these mistakes. The witness explained that the software is functioning as intended, but that there always has to be a manual check of the underlying (call) data before presenting anything in court. The data set is still in progress. The Defence also attacks the underlying data, but that seems an issue to be raised with the telecommunication providers.

[Screenshot of Mr Van der Laken testifying in court]

3. INVESTIGATORS

Toby Smith (27 October)

Mr Smith is an investigator working for the Prosecution. He explained some documentary evidence he reviewed to establish the location of property allegedly belonging to the accused Merhi or his family, one of which was subsequently confirmed by witness PRH647 (see our previous blog on evidence and phones owned by the accused). The witness also reviewed documents in relation to a property for which the accused Sabra had an electricity prescription. The witness provides comments on various documents. A less time-consuming approach would be to put these comment in a bar table motion, as this is the Prosecution's view and the Defence does not cross-examine the witness. The Prosecution explains that the location of the residences of the accused are relevant to establish which phones belonged to the accused.

Timothy Holford (28 October)

Mr Holford is an investigations coordinator in the STL Beirut office. He went into the field to establish the GPS coordinates of a number of landmarks in the Prosecution's case and explained the methodology used. The locations include the Mitsubishi canter van dealer in Tripoli, branches of Samino jewellery owned by the accused Badreddine, the office of witness PRH078, residences of Hariri and other places Hariri visited, cell shops were network phones were purchased, and the Al-Jazeera and Reuters offices.

Erich Karnberger (28 October)

Mr Karnberger is an investigator in the STL Beirut office who photographed a number of locations which were plotted by the previous witness Mr Holford.

Evidence on phones and property owned by the accused

During the last few months of 2015, the Prosecution presented various witnesses (and documents; see our previous blog) as evidence that certain phones or houses were owned by the accused. The testimonies of these witnesses were relatively short, with the witnesses mostly commenting on documents the Prosecution wanted to tender into evidence. There was also very limited cross-examination; this raises questions about the need to hear these witnesses in court, as their evidence seems largely unchallenged.

PRH067 (30 September) on Oneissi's phone

The evidence of PRH067 is to establish that the so-called purple phone was owned by Mr Oneissi. The witness came into contact with Mr Oneissi around 1999. Mr Oneissi was a client of the witness, and they had over 80 professional appointments, with the last appointment on 21 August 2004. PRH067 testified that Mr Oneissi - who he knew as Hussein Hassan Issa - provided his office with a contact number, and this number is the same as the purple phone appearing in the Prosecution's case. The phone number and the meetings were recorded in a client file and business records. The witness's two office numbers had repeated contacts with the phone number of Mr Oneissi, the last time being approximately two weeks before the attack of 28 January 2005.

Witness PRH371, an analyst, observed that the phone number of Mr Oneissi's purple phone activated cells providing coverage in the area of the PRH067's workplace on 40 occasions, 37 of which were on days Mr Oneissi had an appointment with this witness.

Mahmoud Assi (1 October) on Ayyash's phone

The witness's evidence is to establish that a personal mobile phone was owned by Mr Ayyash. The name of this witness appears on two insurance documents for a claim for an accident that took place on 20 November 2004. However, Mr Assi is not the person who prepared the expert report, but his colleague Mr Kalash did. The witness is a vehicle accident expert with an insurance company and testified about what happens when accidents occur in Lebanon and when experts get called. The insurance documents also contain Mr Ayyash's name, and the phone number that the Prosecution claims to be Mr. Ayyash's.

PRH651 (2 October) on Merhi's phone

This evidence is about the attribution of phones to Mr Merhi. Witness PRH651 is a a senior manager for a furniture manufacturer and seller. He testified about certain business documents on the delivery of furniture on 24 and 26 November 2004 to the Merhi family. One document is an order that the phone number that the Prosecution claims to be owned by Mr Merhi and his family; another document is signed by Mr Merhi. The furniture was sold through a retailer but directly delivered to the customer.

PRH647 (9 November 2015) on Merhi's house

Witness PRH647 describes the Gardenia building in Beirut. The witness was shown a photograph of a man who looked like someone who lived in the Gardenia building in 2010-2012 and whose family name is Merhi. The witness believes that the same man has two sons. He may have had some limited contact with Merhi but does not recall the contact specifically.

PRH688 (10 November 2015) on Merhi's father's house

This witness gave evidence about the lease of a real estate in Haret-Hreik by Mr Habib Ali Merhi in the period 2005-2008, which he used to run a cloth shop. Mr Merhi, the father of the accused Merhi, lived across the street from these business premises, although after the building was partially destroyed during the 2006 war they moved temporarily to Aley. Mr Merhi had children, including a son called Haidar, and another son identified by the witness in a picture. According to the Prosecution, this evidence is relevant because the location of the home of the father of the accused is relevant to establish that three phones used in (preparing) the bomb attack were owned or used by the accused Merhi.

In addition, in September there was a witness testifying about Abu Adass, the person who claimed the responsibility for the attack through a video message.

PRH087 (29 September) on Abu Adass

PRH087 lived nearby the Abu Adass family in February 2005. He described them as a conservative, religious and well-mannered family who had no problems in the neighbourhood. The witness did not have much contact with the family. Ahmad Abu Adass was introvert and became more religious from 2001 or 2002; he let his beard grow and wore religious clothes like a Salafist. The witness never heard Ahmad express any political views, although he had seen Ahmad’s elder brother working for the Hariri election campaign in 1996 and he thought the family supported Hariri. The witness saw Ahmad going to the Arab University mosque on Friday, andAhmad would be reserved and sitting alone. Once, about a week before Ahmad’s disappearance, the witness saw him talking to a young man with a dark skin in the mosque. PRH087 describes meeting Ahmad’s father Taysir, who told him Ahmad had been missing for a couple of days, and that they had received a phone call from someone saying that he was in the north and that the car had broken down and he couldn’t come home. The witness has seen the tape with Ahmad claiming responsibility for the attack. Ahmad looked very different from the person he had known before and the family of Ahmad was totally destroyed after this.

A large amount of documentary evidence presented in court (June-November 2015)

During various trial dates in the second half of 2015 the Prosecution presented documentary evidence that has been tendered into evidence by Trial Chamber’s decisions, including lengthy explanations of its relevance. This is a very time consuming process, and although it seems to be directed at making available evidence to the public, it would be a lot more effective to give the public access to these exhibits, and explain the relevance in a (bar table) motion, a well-established practice at the ICTY for example. Now many days in court are used to discuss things which could easily be dealt with in written form. Further, this way of summarising evidence in court gives the Prosecution a lot of time and space to make submission about its case and its interpretation of the evidence, to which the Defence rightly objected (see the transcript of 5 November). The Defence argued that the judges should evaluate all evidence at the end of the trial instead of being influenced by the Prosecution’s interpretation during trial. Also, this affects the expediency of the trial. The Defence indicated that they will put their objections in written form; this will be an interesting discussion to follow. Judge Re explained that the reason they were spending so much time in court on presenting exhibits is to publicly show the evidence they’re receiving, and that the amount of time spend on this matter will depend on the availability of witnesses.

Below a summary of the documentary evidence presented in the period June-November 2015.

On 18 June 2015, the Prosecution presented 10 mobile phone contracts relating to nine blue phones and one yellow phone (see also our blog of 13 July). According to the Prosecution these phones were purchased anonymously, sometimes with false documents; other times the shop owners recycled people's IDs to protect the identities of the phone users, because these phones were used to provide a support role for the planning and execution of the bomb attack of 14 February 2005. The evidence from the contracts is linked to the statements or testimony of various Prosecution witnesses, who deny having bought these mobile phones. On 27 August 2015 the Prosecution presented the summaries of witness statements on this issue, including subscribers of telephone lines that according to the Prosecution have been used by the accused in the planning and execution of the attack on 14 February 2005. The witnesses however deny having bought these SIM cards, and point out the many mistakes on the subscription forms. There are also witness statements about the import and distribution of handsets and SIM cards to the various shops that eventually sold the handsets and lines used by the various networks.

On 18 June 2015 the Prosecution also dealt with part of 99 business records from mobile phone companies, one group relating to red phones and another two groups relating to green phones. These documents show the delivery of SIM cards to specific dealers, the origin of the phones and how the phones were paid for.

On 22 July 2015, the Prosecution presented 262 United Nations Information Centre Beirut Press Reviews which are relevant to the movement of Rafik Hariri and political events, including the political climate in the months leading up to the resignation and assassination of the former prime minister. Further, 11 exit and entry records of Beirut airport of Hariri in the period 16 December 2004 - 7 February 2005 were tendered into evidence. This evidence is also related to the political witnesses who testified earlier in 2015.

On 23 July 2015 the Prosecution presented 11 other documents tendered into evidence, including a phone directory of the Quraitem palace, various passports of Hariri, photographs, copies of newspaper clippings, decrees, parliamentary meeting notes and UN documents in relation to Lebanon. This evidence is partly relevant to show the movement of Hariri in relation to the surveillance with the network phones allegedly done by the accused. There also documents that list the addresses of the telephone boots, and the telephone cards, that were used to call Al-Jazeera and Reuters to make the false claim of responsibility for the attack.

On 5 October the Prosecution presented a summary of a witness statement of an injured victim of the bomb attack. Further, the Prosecution presented photographs of various areas in Beirut, including photographs in and around Nejmeh Place and parliament, and photographs of various points along a route that would commonly be taken and expected to be taken by the Prime Minister on his way to his villa in Faqra. This includes a ramp that according to the Prosecution was one of the places considered by the accused as an assassination site. This can be concluded from various factors including the activity and interest that the users of the red phones had in that particular location on a number of days. The Prosecution further explains that in its view there is a connection between the times that the network phones are present in the Faraya area, and the presence of the Prime Minister in December 2004.

During part of the hearings held on 14-16 October the Prosecution summarised tendered documents relating to two properties associated with the accused Ayyash (in South Beirut and in the Nabatiyeh region), one property associated with Mr Oneissi, two properties associated with Mr Merhi and two properties associated with Mr Sabra. These include financial and legal documents, and witness statements. The Prosecution asserts that the locations of phones used by the accused, and the patterns of use, can be linked to the residences of the accused. In addition, some of the documents filled out by Mr Oneissi in relation to his property contain the phone number that is part of the purple phone network.

On 4 (and 12) November the Prosecution read out the summary of witness PRH078, who had in his business computer records the name of a relative of the accused Mr Ayyash, together with two contact numbers, and the date of her visit to the witness’ business. The Prosecution attributes these two phone numbers to Mr Ayyash. The Prosecution also read out the summary of a tendered statement by Prosecution investigator Toby Smith, who conducted the interview with witness PRH078 and marked the location of the witness’ office. The Prosecution uses this location to show that the two telephones of Mr Ayyash connect to specific cell towers in the neighbourhood on the days of the visits of the relative of Mr Ayyash to the witness’ office. On 12 November the Prosecution read out the summary of witness PRH678, a relative of PRH078 who confirmed his statement.

On 4 November the Prosecution summarised the documentary evidence relating to the delivery of household furniture to the Merhi family between 21 and 26 November 2004, which involved the use of the Merhi family phone and a personal phone of the accused Mr Merhi, Purple 231. The evidence includes subscriber notes for the various phones used in this delivery of furniture, extracts from a customer database, an ID application by Mr Merhi, and witness statements by an employee of the furniture manufacturer and supplier (PRH675), an OTP analyst (Adrian Kirwan) and two OTP investigators (PRH539 and Toby Smith) about the origin of (some of these) documents. The furniture wholesaler is witness PRH651 who gave evidence on 2 October 2015. On 9 November the Prosecution read out summaries of further witness statements in relation to this issue. Witness Kamal Ismail (PRH645) is the owner of a retail furniture business called Ismail Furniture in South Beirut, and was in contact with the Merhi family through a mobile number. Witness PRH650 is a delivery driver for the furniture wholesaler from which Mr Merhi made a purchase. The witness was shown copies of documentation relating to a delivery on 26 November 2004 and recognised his handwriting and initials. PRH650 further identified mobile phone numbers of the company. Witness PRH649 is another delivery driver for the furniture wholesaler and gave a similar statement to witenss PRH650. According to the Prosecution this evidence assists in attributing phone Purple 231 to the accused Mr Merhi.

On 5 November the Prosecution continued with summarising 37 documents relating to various insurance claims by Mr Ayyash for his motor vehicle. These claims were made in October 2003, November 2004 and May 2005, and are relevant for the attribution of two phone numbers to Mr Ayyash. On 6 November the Prosecution read out the summaries of six witness statements. Witnesses Ghassan Saab and Maria Frangieh work for a Lebanese insurance company and gave evidence about the provenance of the insurance documents. Also Prosecution investigator Mr Karnberger gave a statement about this issue. Witness PRH050 met the accused Mr Ayyash in 1996 and 1997, and once or twice a year occasionally, also on the street; Mr Ayyash had a small scooter, worked for civil defence and was a car dealer. The witness also knows some of the family members of Mr Ayyash and identifies some their telephone numbers. Witness PRH086 was a tow truck driver who transported vehicles involved in accidents, although he did not recall the specific accident in November 2004 (for which Mr Ayyash filed an insurance claim). Witness PRH539, a Prosecution investigator, gave a statement about his contact with Mr Al-Kalash, the author of a report dealing with the car accident of November 2004.