Jan 27, 2016

Members of the OTP testify in court

During the last few months of 2015 the Prosecution called many of its own team members to give evidence, an unusual practice in (international) criminal proceedings (with the exception of investigators and actual experts working for the Prosecution, who appear more often in court). Some of these witnesses were primarily questioned by the judges and seem to be called to provide information on technical aspects of the Prosecution’s case, including the creation of call data records and databases. Other members of the Prosecution are extensively questioned by the defence, whilst especially the investigators hardly received any questions. Below a summary of the evidence given by these Prosecution members (and one expert), divided into three main topics.


Mr Spartak Mkrtchyan (14-15 September)
Mr Mkrtchyan is the Prosecution computer information systems officer and the database administrator. He and his team are responsible for the Prosecution's call data record structured query language (or SQL) database. This includes the design of the database, the upload of the call data records, and the design of the database's built-in analytical functions or stored procedures. The Chamber has ordered the Prosecution to call witnesses to provide further evidence about the production of the call sequence tables and the underlying data (see decision of 5 May 2015, para. 115). Mr Mkrtchyan provides evidence on the format in which the raw call data and SMS content was received by the Prosecution, the database he created and filled with the raw data, and the stored procedures he wrote to search the database, which enabled the creation of some of the call sequence tables.

Professor Peter Sommer (15 September)
Although not a member of the Prosecution, Professor Sommer was hired by the Prosecution to audit the work of Mr Mrktchyan and therefore his testimony is included in this blog. Professor Sommer appeared as an expert witness on computer and information systems and the storage and security of data, including digital evidence. He wrote a report called “STL-OTP: Audit of Telephone Database Administration Processes” dated 17 July 2012. Professor Sommer visited the STL three times, and during two of these visits he met with witness Mr Mkrtchyan. He did an audit of the database system as set up by Mr Mkrtchyan, that is how the data received from the mobile phone companies was converted into a database, and to “get a clear overview of what the system is supposed to do, and constantly ask oneself: What could possibly go wrong, what is being done to prevent those things from going wrong, and what tests can one apply afterwards to establish that nothing has gone wrong.”

Professor Sommer concluded in his report that the system in relation to the handling and storage of the call data and SMS records was very thorough, and included a detailed manual, records of particular activities, and a unique number for each entry (making it easy to track back to the material provided by the phone companies). Professor Sommer further concluded that because of the processes employed, significant errors in the upload of data or data corruption are manifest or immediately apparent. Further, the fact that separate and matching records for calls between Alfa and MTC phones can be seen, provides some confidence in the accuracy and completeness of the records produced by the two mobile phone companies.

During cross-examination by Defence Counsel Mr Roberts, Professor Sommer explained that he thought he was asked to the audit, because the work was considered something of a novelty and there was a need to reassure the Tribunal that the work was done properly. Further Professor Sommer agreed that the errors he analyses in his report will not reveal data manipulation by the mobile phone companies. The witness does not have any knowledge about the data provided by two additional Lebanese phone companies to the Prosecution, and did not review the hard disks with data received by the Prosecution from the mobile phone companies.

Mr Elvis Stana (28 October)
Mr Stana is an analyst with the Prosecution, who did a statistical analysis of the call data records to determine the extent of synchronisation between the clock recordings in the call data records of the providers Alfa and MTC Touch. He explained that the mobile switching centres in Lebanon - that are recording and routing the call - were not centrally synchronised. This means that there could be a slight variation in the time recorded in the call data records for the incoming and outgoing side of a call. Some difference are only a few seconds, but especially in relation to one specific switching centre, the witness recorded a time difference of around 75 seconds. The Prosecution expects that the telephone companies will provide evidence to explain these large differences.

[Screenshot of Mr Stana testifying in court on 28 October 2015]

Ms Kei Kamei (16-19 November 2015 - cross-examination only)
Ms Kamei, an analyst working for the Prosecution, appeared in court in July and has already been cross-examined about the creation of the call sequence tables (see our blog on the five witnesses responsible for the creation of CSTs). This cross-examination is about additional topics. Defence Counsel Mr Mettraux for the accused Mr Sabra questioned the witness about information she received whilst interviewing witnesses, especially in relation to the person who claimed responsibility for the attack, Mr Abu Adass. The questions cover Mr Abu Adass’s visits to the mosques, the persons who accompanied him and his relation to certain organisations (including Al-Ahbash), the information found at his place and on his computer (including material on jihadist sites, a list on Hariri’s properties and foundations in Lebanon, and a series of maps), and phone calls made with the landline of the family Abu Adass. This results in a lot of hearsay evidence from Ms Kamei, of which the value seems questionable. She also does not remember many of the details put to her and explained that her role at that time was to focus on communication analysis. Mr Mettraux explains that he will seek to tender the actual statements of the witnesses in the future, mostly to establish the truth of their contents.

[Screenshot of Ms Kamei testifying in court]

The witness is also asked to comment on the video with the claim of responsibility, and on an alternative scenario on whom bought the phone card that was used to call Reuters and Al-Jazeera. This alternative scenario is to challenge the Prosecution’s scenario that it was the accused Sabra that was involved in this. Mr Mettraux further explains that they are not actually putting a positive case, but just an alternative possibility for the person who called the media about the claim of responsibility. The Chamber requests Mr Metttraux to further explain their defence position on this matter, and Mr Mettraux gives a lengthy explanation in court (see transcript of 19 November, p.101 and further). The Defence for the accused Sabra agree with the Prosecution that Mr Abu Adass was not the suicide bomber and that the video and letter were used to shield the identity of the real perpetrators. The information in their possession suggests that Hariri has been killed by a very sophisticated group of high-ranking state officials who used associates to commit the crimes. This includes members of Al-Ahbash and the Syrian and Lebanese security apparatus. Mr Mettraux also presents their very detailed views on how Abu Adass was lured into this. The Defence for Sabra thus does seem to present a positive case, at least on this topic, which is an interesting position to take in a trial in absentia.

Defence Counsel Mr Larochelle questions Ms Kamei about the investigations into the links and contacts between Abu Adass and members of a group called Al-Qaeda 13, including her analysis of the calls made through the landline of the family Abu Adass. He also questions the witness about the methods she used in attributing phone numbers to certain persons.


Andrew Fahey (16-17 September, 27 October)
Mr Fahey is an analyst with the Prosecution, and since November 2012 the project manager of the development of the electronic presentation of evidence software. The evidence of Mr Fahey can be divided into three parts: (i) the electronic presentation of evidence system; (ii) the associated area of what choices he made in respect of the cell site data that he used; and (iii) the various locations that have been plotted into the presentation system. His testimony on 16-17 September 2015 only dealt with the first subject.

Mr Fahey was taken through a presentation of this system, that the Prosecution intends to use to present its telecommunication evidence. The system has a database that holds evidence that the Prosecution is tendering, and creates the ability to search that database and display and record selected aspects of evidence. During his testimony the following matters were discussed:
  • the five types of evidence that can be displayed in the system: a) the map of Lebanon; b) relevant locations, including routes taken by Hariri; c) cell site information (mast location, orientation and coverage); d) telephone call information (taken from the CSTs); and e) attribution (assigning of short names) of telephone numbers to users (including the accused) or networks;
  • how these types of evidence are shown together;
  •  record keeping (creating pdfs with screenshots and log tables); and
  • quality assurance.
This system enables the Prosecution to visualise complex patterns of telephone usage. The question arises why court time would be used to explain software used by the parties, something that could easily be explained through an internal training? If there are any challenges to this software, a more logical option would be to file a written motion, or to suggest the use of different software if needed. From the transcript it appears that the parties have already met 14 times on this topic, and there seem to be no challenges to the functioning of the system, only to the selection of material used by the Prosecution.

The evidence of Mr Fahey on 27 October dealt with the map coordinates established by the witness of eight residences associated with the accused. On the basis of his analysis of documents, Mr Fahey has created a number of maps. Mr Fahey also established the map coordinates for 144 places and landmarks relevant to the Prosecution case, both for the movement of Hariri and the phone networks allegedly used by the accused in undertaking surveillance of Hariri in preparation of the attack.

Bastiaan van der Laken (9-11 November)
Mr Van der Laken works within the Prosecution and explained the functionality of the electronic presentation of evidence system, including the data management tasks associated with uploading data to the software. Like witness Fahey he explained the type of evidence stored in the system, and that this data is uploaded using an excel workbook. The witness also explained how two sides of a phone call are paired using the differences in the time records as established by Mr Stana (see above). The Defence has located  mistakes and/or differences in comparing the evidence presentation system and the call sequence tables, and confronted the witness with these mistakes. The witness explained that the software is functioning as intended, but that there always has to be a manual check of the underlying (call) data before presenting anything in court. The data set is still in progress. The Defence also attacks the underlying data, but that seems an issue to be raised with the telecommunication providers.

[Screenshot of Mr Van der Laken testifying in court]


Toby Smith (27 October)
Mr Smith is an investigator working for the Prosecution. He explained some documentary evidence he reviewed to establish the location of property allegedly belonging to the accused Merhi or his family, one of which was subsequently confirmed by witness PRH647 (see our previous blog on evidence and phones owned by the accused). The witness also reviewed documents in relation to a property for which the accused Sabra had an electricity prescription. The witness provides comments on various documents. A less time-consuming approach would be to put these comment in a bar table motion, as this is the Prosecution's view and the Defence does not cross-examine the witness. The Prosecution explains that the location of the residences of the accused are relevant to establish which phones belonged to the accused.

Timothy Holford (28 October)
Mr Holford is an investigations coordinator in the STL Beirut office. He went into the field to establish the GPS coordinates of a number of landmarks in the Prosecution's case and explained the methodology used. The locations include the Mitsubishi canter van dealer in Tripoli, branches of Samino jewellery owned by the accused Badreddine, the office of witness PRH078, residences of Hariri and other places Hariri visited, cell shops were network phones were purchased, and the Al-Jazeera and Reuters offices.

Erich Karnberger (28 October)
Mr Karnberger is an investigator in the STL Beirut office who photographed a number of locations which were plotted by the previous witness Mr Holford.

No comments:

Post a Comment