Aug 5, 2016

Continued Examination of Technical Witness PRH705 (Touch)

The Prosecution resumed its examination of witness PRH705, an employee of Touch, followed by cross-examination from the Ayyash Defense (transcripts of 19-21 July). Much of the witness’s testimony refers to documents that were disclosed only to the parties, compounding the difficulty of following the technical line of questioning. Refer to our previous post for details on the beginning of this witness’s testimony.

On 19 July 2016, the Prosecution took the opportunity to summarize the thematic content of PRH705’s testimony up to that point. The witness had previously provided information on the services offered by Touch, the organization of the company, the subscriber database, call data and SMS records, network operations, and cell site materials, as well as other technical and corporate matters. 

The subsequent day, the Prosecution first asked for exhibit numbers for university records of the accused, which will be used to establish a relationship between a third party (through their phone number) and the accused. The Prosecution did the same for entry/exit, banking, medical, and civil records pertaining to Ayyash, Oneissi, Badreddine (aka Issa), Merhi, and Sabra, as well as their family members.

The Prosecution then requested witness PRH705 to confirm paragraphs of his statements, including the amendments provided by Touch. Most of the content of these statements is not immediately known, but they concern to the topics mentioned above. The Prosecution further clarified technical terminology, Touch’s billing practices, and third-party provisioning of SIM cards. Judge Akoum sought explanation of the differences between personal and commercial post-paid accounts.

Mr. Hannis for the Ayyash Defense subsequently began his cross-examination of the witness. The Defense began by inquiring about the organizational structure of Touch’s various departments, including the Legal and Government Affairs departments, and how they handle requests for assistance. The witness further testified about the creation of a quality control unit within Touch’s Technical Department, in addition to the process of logging changes to cell site configurations. This questioning indicated that the Defense may later submit that during 2004 and 2005, Touch did not adequately record modifications that could affect cell phone attribution.

Most notably for this day, the Defense asked the witness about various technical errors that might lead to inaccurate call data records. For instance, the witness testified that certain cell sites may produce overlapping coverage that can “overshoot” the location of the caller. PRH705 stated that the “propagation model” used by the company produced inaccurate locations 20% of the time. 

The second day of the Ayyash team’s questioning, on 21 July, revealed potential arguments against the Prosecution’s use of call data records to prove its case. The witness was questioned about the frequencies at which Touch transmitted cell signals between 2004 and 2005. Witness PRH705 testified that “frequency hopping” (whereby the cell site used to transmit a call is changed) occurs when the network becomes congested, the user is located on the border of two adjacent sites’ coverage areas, or a physical obstruction interferes with the signal. The Defense intimated that this may obscure the location of the caller, thus inhibiting cell phone attribution.

The witness testified that further instances of such “normal handover” may occur when the caller is moving and comes within range of a different cell site. After the Defense questioned the witness about the call logs that Touch stored between 2004 and 2005, the witness testified that Touch did not store end cell data at that time. Thus, a user’s location would have been recorded at the start of their call, but if they had moved by the time they disconnected, this would not be reflected in Touch’s logs.

Witness PRH705 also stated that it may not be possible to recreate actual coverage predictions for each cell site from 2004 to 2005 because these “snapshots” require certain data inputs that may not be available. Even if they could be generated, the witness said that they still may contain inaccuracies. Furthermore, the witness testified that to his knowledge, the propagation model used to generate the best predicted coverage sites could have been generated any time between 1997 and 2004. It is unclear from his evidence whether the witness was referring to one model used for the entire country or multiple models used for individual cell sites.

The witness additionally confirmed that Touch used relatively less accurate GPS devices between 2004 and 2005 compared to today. On another note, the witness said that he was not sure if “azimuth values” were stored during the same period. These inputs affect cell sites’ coverage and, therefore, their ability to locate callers’ positions. Moreover, PRH705 testified that Touch’s “mobile switching centers” were configured manually such that they did not all register call times in a synchronized fashion. The witness said these inaccuracies could range from a few seconds to ten minutes. Though the witness said that these discrepancies can be discovered, he admitted that they may be misleading.

In another matter on 19 July, members of the Prosecution read onto the record three summaries of separate witness statements that were previously admitted into evidence. The first witness, Timothy Holford, was a Prosecution investigator who stated that he undertook a GPS mission near the office of the Lebanese Ministry of Telecommunications to verify its location. This is where the telecarte used to make the false claim of responsibility to Al Jazeera was allegedly sold. The second witness statement pertains to Elvis Stana, who is an information management analyst with the Prosecution. Mr. Stana had performed a statistical analysis in order to evaluate the level of synchronization or variation among the clocks within various Beirut cell towers, which were used to record call times. This data is, of course, relevant to the call sequence tables that are used by the Prosecution to establish the activity of the colored networks. The third witness, PRH696, claimed in his statement that the text message that he sent in January 2005 from his phone to one of the phones in the red network (used by Mr. Ayyash), was sent by accident. This supports the Prosecution's theory that the red network was closed and covert.

On 21 July, the Prosecution requested several documents be marked for identification, including subscriber records that will be used to attribute various cell phone numbers to the deceased Badreddine. The Prosecution also provided summaries of two more witness statements admitted as evidence. Both statements were made by PRH045, a Lebanese journalist who personally provided political updates to Rafiq Hariri. The witness served as a liaison between the former prime minister and many political groups, including Hezbollah. PRH045 thus provided information on the political context of Hariri's assassination. Furthermore, Hariri had told this witness that Syrian president Bashar al-Assad had threatened Hariri, saying that if he did not approve the extension of Lahoud's presidency, Assad would "break the country over his head." The witness conveyed several ways in which Hezbollah would have benefited from Hariri's assassination, including the resulting void in Sunni leadership.

No comments:

Post a Comment