Evidence on phones and property owned by the accused

During the last few months of 2015, the Prosecution presented various witnesses (and documents; see our previous blog) as evidence that certain phones or houses were owned by the accused. The testimonies of these witnesses were relatively short, with the witnesses mostly commenting on documents the Prosecution wanted to tender into evidence. There was also very limited cross-examination; this raises questions about the need to hear these witnesses in court, as their evidence seems largely unchallenged.

PRH067 (30 September) on Oneissi's phone

The evidence of PRH067 is to establish that the so-called purple phone was owned by Mr Oneissi. The witness came into contact with Mr Oneissi around 1999. Mr Oneissi was a client of the witness, and they had over 80 professional appointments, with the last appointment on 21 August 2004. PRH067 testified that Mr Oneissi - who he knew as Hussein Hassan Issa - provided his office with a contact number, and this number is the same as the purple phone appearing in the Prosecution's case. The phone number and the meetings were recorded in a client file and business records. The witness's two office numbers had repeated contacts with the phone number of Mr Oneissi, the last time being approximately two weeks before the attack of 28 January 2005.

Witness PRH371, an analyst, observed that the phone number of Mr Oneissi's purple phone activated cells providing coverage in the area of the PRH067's workplace on 40 occasions, 37 of which were on days Mr Oneissi had an appointment with this witness.

Mahmoud Assi (1 October) on Ayyash's phone

The witness's evidence is to establish that a personal mobile phone was owned by Mr Ayyash. The name of this witness appears on two insurance documents for a claim for an accident that took place on 20 November 2004. However, Mr Assi is not the person who prepared the expert report, but his colleague Mr Kalash did. The witness is a vehicle accident expert with an insurance company and testified about what happens when accidents occur in Lebanon and when experts get called. The insurance documents also contain Mr Ayyash's name, and the phone number that the Prosecution claims to be Mr. Ayyash's.

PRH651 (2 October) on Merhi's phone

This evidence is about the attribution of phones to Mr Merhi. Witness PRH651 is a a senior manager for a furniture manufacturer and seller. He testified about certain business documents on the delivery of furniture on 24 and 26 November 2004 to the Merhi family. One document is an order that the phone number that the Prosecution claims to be owned by Mr Merhi and his family; another document is signed by Mr Merhi. The furniture was sold through a retailer but directly delivered to the customer.

PRH647 (9 November 2015) on Merhi's house

Witness PRH647 describes the Gardenia building in Beirut. The witness was shown a photograph of a man who looked like someone who lived in the Gardenia building in 2010-2012 and whose family name is Merhi. The witness believes that the same man has two sons. He may have had some limited contact with Merhi but does not recall the contact specifically.

PRH688 (10 November 2015) on Merhi's father's house

This witness gave evidence about the lease of a real estate in Haret-Hreik by Mr Habib Ali Merhi in the period 2005-2008, which he used to run a cloth shop. Mr Merhi, the father of the accused Merhi, lived across the street from these business premises, although after the building was partially destroyed during the 2006 war they moved temporarily to Aley. Mr Merhi had children, including a son called Haidar, and another son identified by the witness in a picture. According to the Prosecution, this evidence is relevant because the location of the home of the father of the accused is relevant to establish that three phones used in (preparing) the bomb attack were owned or used by the accused Merhi.

In addition, in September there was a witness testifying about Abu Adass, the person who claimed the responsibility for the attack through a video message.

PRH087 (29 September) on Abu Adass

PRH087 lived nearby the Abu Adass family in February 2005. He described them as a conservative, religious and well-mannered family who had no problems in the neighbourhood. The witness did not have much contact with the family. Ahmad Abu Adass was introvert and became more religious from 2001 or 2002; he let his beard grow and wore religious clothes like a Salafist. The witness never heard Ahmad express any political views, although he had seen Ahmad’s elder brother working for the Hariri election campaign in 1996 and he thought the family supported Hariri. The witness saw Ahmad going to the Arab University mosque on Friday, andAhmad would be reserved and sitting alone. Once, about a week before Ahmad’s disappearance, the witness saw him talking to a young man with a dark skin in the mosque. PRH087 describes meeting Ahmad’s father Taysir, who told him Ahmad had been missing for a couple of days, and that they had received a phone call from someone saying that he was in the north and that the car had broken down and he couldn’t come home. The witness has seen the tape with Ahmad claiming responsibility for the attack. Ahmad looked very different from the person he had known before and the family of Ahmad was totally destroyed after this.

A large amount of documentary evidence presented in court (June-November 2015)

During various trial dates in the second half of 2015 the Prosecution presented documentary evidence that has been tendered into evidence by Trial Chamber’s decisions, including lengthy explanations of its relevance. This is a very time consuming process, and although it seems to be directed at making available evidence to the public, it would be a lot more effective to give the public access to these exhibits, and explain the relevance in a (bar table) motion, a well-established practice at the ICTY for example. Now many days in court are used to discuss things which could easily be dealt with in written form. Further, this way of summarising evidence in court gives the Prosecution a lot of time and space to make submission about its case and its interpretation of the evidence, to which the Defence rightly objected (see the transcript of 5 November). The Defence argued that the judges should evaluate all evidence at the end of the trial instead of being influenced by the Prosecution’s interpretation during trial. Also, this affects the expediency of the trial. The Defence indicated that they will put their objections in written form; this will be an interesting discussion to follow. Judge Re explained that the reason they were spending so much time in court on presenting exhibits is to publicly show the evidence they’re receiving, and that the amount of time spend on this matter will depend on the availability of witnesses.

Below a summary of the documentary evidence presented in the period June-November 2015.

On 18 June 2015, the Prosecution presented 10 mobile phone contracts relating to nine blue phones and one yellow phone (see also our blog of 13 July). According to the Prosecution these phones were purchased anonymously, sometimes with false documents; other times the shop owners recycled people's IDs to protect the identities of the phone users, because these phones were used to provide a support role for the planning and execution of the bomb attack of 14 February 2005. The evidence from the contracts is linked to the statements or testimony of various Prosecution witnesses, who deny having bought these mobile phones. On 27 August 2015 the Prosecution presented the summaries of witness statements on this issue, including subscribers of telephone lines that according to the Prosecution have been used by the accused in the planning and execution of the attack on 14 February 2005. The witnesses however deny having bought these SIM cards, and point out the many mistakes on the subscription forms. There are also witness statements about the import and distribution of handsets and SIM cards to the various shops that eventually sold the handsets and lines used by the various networks.

On 18 June 2015 the Prosecution also dealt with part of 99 business records from mobile phone companies, one group relating to red phones and another two groups relating to green phones. These documents show the delivery of SIM cards to specific dealers, the origin of the phones and how the phones were paid for.

On 22 July 2015, the Prosecution presented 262 United Nations Information Centre Beirut Press Reviews which are relevant to the movement of Rafik Hariri and political events, including the political climate in the months leading up to the resignation and assassination of the former prime minister. Further, 11 exit and entry records of Beirut airport of Hariri in the period 16 December 2004 - 7 February 2005 were tendered into evidence. This evidence is also related to the political witnesses who testified earlier in 2015.

On 23 July 2015 the Prosecution presented 11 other documents tendered into evidence, including a phone directory of the Quraitem palace, various passports of Hariri, photographs, copies of newspaper clippings, decrees, parliamentary meeting notes and UN documents in relation to Lebanon. This evidence is partly relevant to show the movement of Hariri in relation to the surveillance with the network phones allegedly done by the accused. There also documents that list the addresses of the telephone boots, and the telephone cards, that were used to call Al-Jazeera and Reuters to make the false claim of responsibility for the attack.

On 5 October the Prosecution presented a summary of a witness statement of an injured victim of the bomb attack. Further, the Prosecution presented photographs of various areas in Beirut, including photographs in and around Nejmeh Place and parliament, and photographs of various points along a route that would commonly be taken and expected to be taken by the Prime Minister on his way to his villa in Faqra. This includes a ramp that according to the Prosecution was one of the places considered by the accused as an assassination site. This can be concluded from various factors including the activity and interest that the users of the red phones had in that particular location on a number of days. The Prosecution further explains that in its view there is a connection between the times that the network phones are present in the Faraya area, and the presence of the Prime Minister in December 2004.

During part of the hearings held on 14-16 October the Prosecution summarised tendered documents relating to two properties associated with the accused Ayyash (in South Beirut and in the Nabatiyeh region), one property associated with Mr Oneissi, two properties associated with Mr Merhi and two properties associated with Mr Sabra. These include financial and legal documents, and witness statements. The Prosecution asserts that the locations of phones used by the accused, and the patterns of use, can be linked to the residences of the accused. In addition, some of the documents filled out by Mr Oneissi in relation to his property contain the phone number that is part of the purple phone network.

On 4 (and 12) November the Prosecution read out the summary of witness PRH078, who had in his business computer records the name of a relative of the accused Mr Ayyash, together with two contact numbers, and the date of her visit to the witness’ business. The Prosecution attributes these two phone numbers to Mr Ayyash. The Prosecution also read out the summary of a tendered statement by Prosecution investigator Toby Smith, who conducted the interview with witness PRH078 and marked the location of the witness’ office. The Prosecution uses this location to show that the two telephones of Mr Ayyash connect to specific cell towers in the neighbourhood on the days of the visits of the relative of Mr Ayyash to the witness’ office. On 12 November the Prosecution read out the summary of witness PRH678, a relative of PRH078 who confirmed his statement.

On 4 November the Prosecution summarised the documentary evidence relating to the delivery of household furniture to the Merhi family between 21 and 26 November 2004, which involved the use of the Merhi family phone and a personal phone of the accused Mr Merhi, Purple 231. The evidence includes subscriber notes for the various phones used in this delivery of furniture, extracts from a customer database, an ID application by Mr Merhi, and witness statements by an employee of the furniture manufacturer and supplier (PRH675), an OTP analyst (Adrian Kirwan) and two OTP investigators (PRH539 and Toby Smith) about the origin of (some of these) documents. The furniture wholesaler is witness PRH651 who gave evidence on 2 October 2015. On 9 November the Prosecution read out summaries of further witness statements in relation to this issue. Witness Kamal Ismail (PRH645) is the owner of a retail furniture business called Ismail Furniture in South Beirut, and was in contact with the Merhi family through a mobile number. Witness PRH650 is a delivery driver for the furniture wholesaler from which Mr Merhi made a purchase. The witness was shown copies of documentation relating to a delivery on 26 November 2004 and recognised his handwriting and initials. PRH650 further identified mobile phone numbers of the company. Witness PRH649 is another delivery driver for the furniture wholesaler and gave a similar statement to witenss PRH650. According to the Prosecution this evidence assists in attributing phone Purple 231 to the accused Mr Merhi.

On 5 November the Prosecution continued with summarising 37 documents relating to various insurance claims by Mr Ayyash for his motor vehicle. These claims were made in October 2003, November 2004 and May 2005, and are relevant for the attribution of two phone numbers to Mr Ayyash. On 6 November the Prosecution read out the summaries of six witness statements. Witnesses Ghassan Saab and Maria Frangieh work for a Lebanese insurance company and gave evidence about the provenance of the insurance documents. Also Prosecution investigator Mr Karnberger gave a statement about this issue. Witness PRH050 met the accused Mr Ayyash in 1996 and 1997, and once or twice a year occasionally, also on the street; Mr Ayyash had a small scooter, worked for civil defence and was a car dealer. The witness also knows some of the family members of Mr Ayyash and identifies some their telephone numbers. Witness PRH086 was a tow truck driver who transported vehicles involved in accidents, although he did not recall the specific accident in November 2004 (for which Mr Ayyash filed an insurance claim). Witness PRH539, a Prosecution investigator, gave a statement about his contact with Mr Al-Kalash, the author of a report dealing with the car accident of November 2004.

Evidence on the origin of the SIM cards allegedly used by those responsible for the bomb attack

During the beginning of September the Prosecution called various witnesses to present evidence on the origins and nature of the network phones and SIM cards allegedly used by the accused in preparing and organising the bomb attack. The Prosecution intends to show that all SIM cards were purchased anonymously. Further, in relation to the red network phones, it is the Prosecution's case that the SIM cards were sold by a mobile telephone distributor to witness PRH553 on 24 December 2004 and delivered to his shop in Tripoli. At some point between 24 December 2004 and 4 January 2005 witness PRH553 sold the eight red network cards, but the Prosecution cannot establish to whom these were sold. Attached to the forms for these SIM cards were identification documents of customers from the Tripoli area, all of whom had purchased their own SIM cards during the holiday period. On 4 January 2005 the eight red network SIM cards were activated.

Mr El-Ajouz (31 August, 1 and 2 September 2015)

Mr El-Ajouz is the owner of Power Group, a mobile telephone distributor. Power Group distributes pre-paid and post-paid SIM cards, scratch cards (to recharge pre-paid SIM card) and handsets to hundreds of dealers in Lebanon. Power Group is an authorised distributor of Alfa products. One of the businesses to which distribution took place was run by witness PRH553 (see further below).

Mr El-Ajouz testifies about the storage and documentation of the products, which, among others, can be tracked through their serial number or bar codes on a form. The witness is commenting on a number of records (including delivery notes, receipt vouchers, and purchase overviews of a particular point of sale) of pre-paid SIM cards for lines claimed to be part of the networks used by these accused. These lines were coming from Alfa and were on-sold to a distributor in Tripoli.

When Power Group sold a group of pre-paid lines, the dealer could fill out a form including a bar code, the subscriber's name and other personal information, and a copy of the purchaser’s ID; this was sent to Alfa. However, this form was only completed for about 20% of the telephone lines. The IDs were not checked by Power Group. For post-paid SIM cards the completion of a form, including a copy of an ID, is obligatory.

During cross-examination Defence counsel is confronting the witness with reports claiming a link between an organisation he’s involved in, the Islamic Charity Projects Association, and the Syrian intelligence, which link the witness denies. Unfortunately, the transcript of 1 September has not (yet) been published and therefore the remainder of the cross-examination remains unknown or unclear for the moment.

Mr Jihad Hassan Tannir (2 September)

Mr Tannir is the former general manager of a wholesale company called Celltec. This was a similar company to Power Group - about which previous witness Mr El-Ajouz testified - in that they distributed Alfa telecommunications products. Mr Tannir explained that Celltex purchased SIM cards and recharge cards from Alfa and distributed these products to its outlets. The witness explains the procedures in distributing telephone lines, which is again similar to evidence given by Mr El-Ajouz on the practices that existed within Power Group, although Celltext also sold products to end users in its own shop. The witness comments on a number of documents, including application forms and invoices, for SIM cards that went through his firm and are claimed to have been used by the accused. Payment options for post-paid cards included payment by the customer in a branch of a certain bank or directly to Alfa, and thus there was no need to provide banking information on the application forms.

PRH090 (2 September)

Witness PRH090 is listed as the subscriber of a pre-paid mobile phone number which was used from October 2004 until September 2005 as one of the blue network phone numbers and which was particularly important in the weeks preceding the bomb attack on Hariri according to the Prosecution. The witness explained in his statement that the application form for this phone number does not contain his handwriting and that most of the information is incorrect; moreover his signature is not on the form, but it is a copy of his ID that is attached to the application. PRH090 had previously purchased a telephone number and left a copy of his identity card at the shop; he has never lost his identity card.

PRH702 (3 September)

Witness PRH702 is another witness whose name is listed as the subscriber of a mobile telephone which the Prosecution allege was part of the blue network. The witness was shown the application form for this phone number and he does not recognise the telephone number; also some of his personal information, including the spelling of his name and his address, are incorrect. He also does not recognise the handwriting on the form nor the signature. PRH702 had purchased a new SIM card towards the end of 2004 and provided an identity card during the transaction.

PRH553 (8-10 September)

Witness PRH553 owned a small mobile phone shop in Tripoli, and was involved in the wholesale and retail of mobile phone products, including SIM cards, recharge cards, handsets and mobile phone accessories. PRH568, who was very experienced in this business and able to get good prices from the dealers, was the shop manager; he dealt with the suppliers and served the customers. The group of suppliers included Power Group, Alliance, Celltec and Kettaneh. They were re-selling Alfa and MTC products, also to other shops.

The witness did not keep any records of the products sold at this shop. It was up to the other shops to complete the application form for the pre-paid cards, although the shops would receive 3 dollar for each completed form for a line (and the shop owned by PRH553 even charged 5 dollar for not completing a form); this is why forms were completed with incorrect information; any ID they had or was given to them by a shop was attached. They were able to use the same ID for tens of pre-paid phone lines. The shop filled in the forms, and very rarely did the customer himself do this. Whenever a customer did not provide an ID card, the witness would fill in the form and put in an ID card in order to recover the money. Very rarely did the form match the identity of the buyer of the SIM card, and the witness would make up the names, addresses, dates and signatures. According to the witness “[t]here was nobody carrying a line with his own name unless we are talking about the post-paid cards or the fixed lines.” Therefore, the Prosecution's theory that all network telephone lines used by the accused were obtained anonymously, seems to apply to almost all (pre-paid) telephone lines in Lebanon at that time.

In September 2005, the witness was charged with having falsified personal papers, and using these falsified papers in relation to the activation forms for the eight SIM cards of the red network. He has been incarcerated for almost three years by the Lebanese authorities but no trial was ever held. The Defence confronts PRH553 with a number of possible contradictions between his previous statements and his testimony in court. However, some of the interrogation of the witness by the Lebanese authorities took place under very harsh conditions and without access to a lawyer.

Defence Counsel Mr Mettraux is questioning the witness about telephone calls between his shop manager, PRH568 (a dropped Prosecution witness), and the Tripoli sales person from Power Group around the date of purchase of the red network cards in December 2005; the Defence also claims to have evidence that shows contact between PRH568 and the Syrian military intelligence. There is also a small dealer, whose name is kept confidential in court ('number six’), about whom the witness and PRH568 remembered that PRH568 sold him ten lines in early January 2005, but they did not remember the exact date of the sale. Therefore it is unknown whether these were the same ten lines as used by the red network. The witness does not remember to whom he sold the red network lines. Further, the Defence has evidence of a number of phone calls between PRH568 and number six (and the assistant of number six) on 30 December 2004, so possibly the sale of these ten lines could have been on this date. The witness also explains that the dates on the forms are not necessarily accurate, with the date on the forms for the red network lines being 12 January 2005.

For the moment it remains unclear to whom these red network telephone lines were sold and if and how they came into the hands of the accused.

More evidence on telecommunication: Expert John Edward Philips

Prior to the recess the Prosecution already explained that the focus in the next months will be telecommunication. Mr Philips, who gave testimony from 18 until 26 August, is an expert witness in the area of cell site analyses, who will describe the technical working of mobile companies and networks. At the request of the Prosecution he wrote a report called “Cell Site Analyses as Applied to GSM Networks” dated 24 September 2012.

Mr Philips worked for Marconi Communication Systems for 15 years. During this time he was invited to publish numerous technical papers on the topic of mobile radio communications and he was active on a number of industry-wide technical committees in relation to mobile radio technology. Thereafter he became head of design and development at Multitone Electronics and he was the secretary of the European paging association. Subsequently he became an engineer at British Telecoms and worked as a cell site analyst. Because of his work he was invited to sit on the GSM specification committee.

His expertise in cell site analysis involves taking the data that is produced by the system and analysing it. He mainly worked in the UK and is not specifically an expert on Lebanese technology; however, the witness expects that the technology employed in the UK is similar to that employed in Lebanon. Defence Counsel Mr Korkmaz challenged the expertise of the witness in relation to GSM and the Lebanese GSM system, but the Trial Chamber was satisfied that Mr Philips has specialised knowledge, skill, or training that can assist the Chamber to understand or determine an issue in dispute; namely, he has expertise on the workings of GSM generally as applied to cell site analysis.

The Prosecution separated the evidence of the witness in three parts: (i) introduction to cell site analysis; (ii) mission phones; and (iii) single-user analysis of some of the SIM cards of key phones in the case. The Prosecution started with a PowerPoint presentation to explain the telecommunication at stake. The witness first explained some key definitions, including “call data records”, that is the data used for all analyses. This data is provided by mobile phone network providers, in the instant case Alfa and MTC. Mr Philips explains a lot of general technical details in the area of telecommunication, including what best server coverage is (the area over which a cell provides the strongest signal), geographical profiling, frequent number analysis and areas of potential manipulation of call data records.

Despite objections by the Defence, Mr Philips continues his evidence by talking about the situation of the providers MTC and Alfa in Lebanon in 2004-2005. The witness gave a very brief case-specific overview as to the interaction and association between mission phones. The mission phone groups are associated with the mission, and the mission is a crime. The Red phone group, the inner group, would appear to be associated with that particular crime, given their geographical location, timing and build-up in the period before the crime. The Blue group has, from a cell sites analyses perspective, no association with the crime but can be linked to the Red group; the same can be said for the Green group. There appears to be a common element between the Red, Blue and Green phone groups, as there is one single user who has a Blue, a Red and a Green phone. Mr Povas explains that it is the Prosecution’s case that this single user is Salim Ayyash.

Mr Courcelle-Labrousse, Defence Counsel for the accused Oneissi, cross-examined the witness about the lack of relevance of his report for the Lebanese situation, and his lack of specific knowledge about the Lebanese GSM configuration. Mr Philips accepted that when you implement a GSM network, the areas you need to cover may have different topographical specifics depending on the location. Defence Counsel Mr Young, for the accused Sabra, dealt with a very technical matter, namely congestion issues, the so-called "anomalies". Mr Philips has talked about the possibility that sudden heavy usage of cells causes an anomaly. Examples giving by the witness are football matches and sports events. Mr Young introduced the idea that the explosion on the 14 February could have caused such an anomaly, referring to previous witnesses who explained that there were problems using their phones after the explosion. The witness thinks that this is possible but only after the incident occurred and centered around that particular area. Judge Re requested the Prosecution to research the potential damage or destruction of cell sites in the area of the St. Georges Hotel, which could also be of influence on the cell site information.  

Further, Mr Young questioned the witness about the potential for manipulation of call data records. A former employee of the Prosecution told the witness in an earlier stage that some held the view that the phone evidence that was used in this case was false. At that moment the testimony was interrupted over a dispute about the disclosure of documents. A document relating to this conversation between the witness and the former employee of the Prosecution has not been disclosed by the Prosecution to the Defence. The Prosecution immediately disclosed the said document and, having read the document, the Defence made an application to adjourn the cross-examination of Mr Philips on the points covered in this particular document, including whether there have been manipulations of call data records. The Chamber granted the application and therefore the cross-examination was postponed.

The five witnesses responsible for the creation of call sequence tables

On 20-22 July the Prosecution presented the evidence of five members of the Prosecution who were responsible for the creation of call sequence tables (CSTs). The telephone numbers in the CSTs include the numbers of the various networks that, according to the Prosecution, were used by the accused in preparation of the bomb attack. These five witnesses all produced very similar evidence.

The Prosecution explains in court that a CST “presents a chronological and complete sequence of calls relating to a particular phone number referred to as the target number over a specified period of time. The CSTs detail each call including the other telephone number the target number was in contact with; the date and time of the call; the type of call, either voice or short message service, or SMS; its duration; information on the handset used by the target number; and cell information on the cell sector used by the target number at the start of the call. The CST occasionally also may include information on the cell sector used at the end of the call, which is referred to as end cell data.”

There are also CSTs for SMS (text messages), which present the SMS content sent and received by a phone over a relevant data range in a consistent accessible format. The SMS CST provides the data and time of the SMS; the other telephone number involved; the direction of the SMS and its content.

The Chamber, in its decision of 6 May in relation to call sequence tables, witness statements and the legality of the transfer of call data records to UNIIIC and the Prosecution, has deferred its decision on the admissibility of CSTs (and related witness statements) until at least one witness has testified about the provenance of the call data records and the production of the CSTs.

Ms. Kei Kamei

The first witness, Ms. Kei Kamei, has been working as an analyst with the Office of the Prosecutor since 9 November 2009, and previously worked for UNIIIC. She has personally produced numerous (SMS) CSTs and coordinated the standardisation of CSTs within the office. Ms. Kamei gives evidence on the source materials she used to produce the CSTs, which are (i) files for one particular phone number or interest; and (ii) bulk data for multiple numbers on a specific day. Ms. Kamei explains the various component parts of call data records. The Prosecution received this data by making a request for assistance to the Lebanese telecommunications service provider in relation to a specific number of interest. The Prosecution requested the bulk call data records for the period September 2004-December 2005 - which was later even extended - that is all phone calls made in Lebanon between these dates. Ms. Kamei further explains the functioning of the SQL database which was used to analyse the bulk data. Further, for the SMS CSTs only bulk data was used, although not all content of the SMS messages appeared to be available in the call data records. In addition, a list with cell tower names received from the telecommunication companies was used to replace the cell IDs in the CSTs.

Ms. Kamei continues to explain how she created the CSTs out of the available data, which involved quite some manual handling. The Judges express their concern as to the accuracy and reliability of the CSTs produced. Ms. Kamei explains the content of various CSTs shown to her. The amount of errors located and the validation and peer review processes are discussed as well.

During cross-examination Mr. Edwards questions the witness about the creation of her statement, and about spot-checks and quality control of the CSTs. If another analyst checks the CST, usually that person would go to the raw source and extract a few, do spot-checks on certain rows.  There was not a formal protocol. No record was kept of the errors that were found. Ms. Kamei admits that it is possible that some of the CSTs contain mistakes that were not detected.

Mr. Andrew Donaldson

The next witness, Mr. Donaldson has been a Prosecution analyst since March 2009. He produced 45 CSTs, and in his statements he describes the components of the CSTs, as well as the sources, and the creation and double-checking of the CSTs. Mr. Donaldson would give his work a 9.9 on a scale of 10 regarding accuracy. The witness estimates that almost all of the CSTs that the Prosecution intends to rely upon as exhibits have been peer reviewed.

Ms. Helena Habraken

Ms. Habraken is the next analyst of the Office of the Prosecutor giving testimony about the CSTs. In her statement of 18 December 2014 she describes having produced 27 CSTs, and she also describes the work methods and sources of the CSTs. Ms. Habraken states that she thinks that the CSTs she made are highly accurate representations of the call data records. According to her, and generally speaking, most errors in the CSTs are formatting errors, when a number would not be properly displayed or a problem in a date or time format.

Mr. Lachlan Christie

Mr. Christie also is an analyst with the Office of the Prosecutor who produced CSTs. He testifies about the same topics as the previous witnesses. Again his confidence level is high that the CSTs he produced are accurate representations of the call data records.

Mr. Christian Carnus

Another Prosecution analyst who produced SMS CSTs, Mr. Carnus describes the method he used to create the SMS CSTs: the SMS contents records were provided by MTC Touch to the Prosecution in the form of large text files for multiple numbers. Mr. Carnus queried the data through the stored procedures in the SQL database and copied the results into an Excel spreadsheet. Mr. Carnus then formatted the SMS CST. Also Mr. Carnus was asked about his confidence level and he is very confident that the SMS CSTs accurately reflect the SQL database. He confirms that the errors he detected were mainly cosmetic in nature. He also confirms that there was no formal peer review process. There was no cross-examination by the Defence.

Ms. Nadine Stanford

Ms. Stanford is another Prosecution analyst and her statement tendered into evidence contains similar evidence as the previous witnesses.

More evidence about the claim of responsibility for the bomb attack

On 14-16 July another two witnesses testified before the STL about the allegedly false claim of responsibility. The first witness was an employee of Reuters News Agency and received a telephone call claiming responsibility on the day of the attack. The second witness is Matthew Barrington, an analyst working for the STL Prosecution, who reviewed the tape with video footage from Al-Jazeera of 14 February 2005.

Employee of Reuters in Beirut (14 July)

Witness PRH012, testifying with protective measures, worked for Reuters News Agency in Beirut in February 2005. The day of the assassination the witness was working at her office, and after the explosion occurred, she decided to visit the crime scene with a colleague. They hailed a taxi which took them close to the event, as at the scene of explosion cars were still exploding. There were still flames and people were trying to save the injured and victims.

As soon as the witness heard that the target was Hariri’s convoy, the witness went back to the office and watched the details of the event on the news; then the phone rang. The witness picked up and a man told her to keep quiet and write down a statement, which included the words: “We are El-Nusra-wal-Jihad group in Greater Syria. We announce and claim our responsibility for killing this criminal, Rafik Hariri, this infidel.’’ The caller concluded by saying a Quranic verse. He had an authoritative voice, speaking classic Arabic with an unnatural and unusual accent, exaggerating for example the pronunciation of the J. It wasn’t a Lebanese accent. If the accused Sabra and/or Oneissi will ever appear and speak before the Tribunal, it would be very interesting to compare their accents and/or dialects to the evidence given by this and other witnesses. For the moment, the Prosecution’s indictment reveals that both accused are claimed to be Lebanese citizens born in Beirut.

After receiving the call she immediately went to see her supervisor who told her that they should not give such phone calls any importance because they seem to be unreliable. Reuters did not broadcast or report the news based on the phone call they received. However, after they saw the declaration at Al-Jazeera, they reported the news based on what Al-Jazeera had broadcast. The witness explained that the content was similar, even though the wording was different. The Prosecution tendered the call sequence table of the public phone number of Reuters that was used for the claim of responsibility; 110 calls were made to this phone number on 14 February 2005.

Mr Haynes, the legal representative of the victims, questioned the witness about civilians who were trying to reach the centre of the blast in order to rescue the victims. Mr Mettraux, defence counsel appearing on behalf of the accused Sabra, questioned the witness about the fact that, although they had not informed the Lebanese authorities about this call, she was interrogated about this call by the Lebanese security services. She also further clarified that the man who called Reuters might have called the administration and asked to speak to the editorial desk, and the call had then been transferred to them.

OTP analyst Matthew Barrington (15-16 July)

Mr Matthew Barrington is an analyst working for the Office of the Prosecutor. He has analysed the video footage from Al-Jazeera of 14 February 2005. The purpose of this review was to determine, as far as possible, the times when the events on the tape occurred, and thus (or at least so it seems) the timing of the phone calls with the claim of responsibility. The witness prepared a chart of the timing of the events on the tape.

In cross-examination defence counsel Mr Mettraux challenges the witness' findings as to the timing of the events on the tape. The Defence takes the position that in fact Mr Barrington could not in any way verify the times that he asserts from an analytical point of view. The witness explains that this was an ad hoc task that he was approached with and was asked to complete. He did not know the background or the investigative avenues that were being pursued by the investigative team at the time. The witness further states that he was unaware of the fact that the footage received from Al-Jazeera was only four hours instead of the unabridged twelve hours that the Prosecution had asked for. Further, the witness was confronted with the fact that another analyst of the Prosecution had concluded that "The footage examined did not contain any material which could assist in determining the exact broadcast time of either news of the claim of responsibility or the confessional tape." The witness confirmed that whilst this person was unable to put times on these events, he was able to do so. When further asked about the methods he used in establishing the timing of the events on the tape - using a particular video-clip to estimate the timing of both the claim of responsibility and the confirmation of Hariri's death - the witness confirms that his conclusions are based on quite a few uncertain assumptions.

Witness Lorenzo Lanzi on the creation of photo-boards of the accused

Mr Lorenzo Lanzi, who gave evidence in court on 14-15 July, is a Swiss national. He is a criminalist at the Geneva police in Switzerland and a former associate forensic expert with the Office of the Prosecution. Mr Lanzi is specialised in forensic imaging, and was asked to create photo-boards which were to include images of the accused Sabra and Oneissi. An investigator of the Prosecution asked Mr Lanzi to create these photo-boards in order to allocate the use of certain telephones to Mr Sabra and to Mr Oneissi. In order to create these photo-boards, Mr Lanzi performed an assessment of various images contained in Lebanese passport application forms. The aim of the assessment was to retrieve images of  Mr Sabra and Mr Oneissi, and to retrieve images of faces of individuals with similar visual characteristics referred to as 'fillers'.

The statement of the witness is tendered into evidence and the witness is cross-examined by defence counsel Mr Courcelle-Labrousse. Mr Lanzi confirms that he was not trained to create photo-boards. At the time of creation he was not aware of the existence of specific forensic rules (from police practice guides for example) on the creation of photo-boards, including that (i) the investigator who is going to show a photo-board to a witness should act in such a way as not to be aware of who is the suspect on the photo-board; (ii) the investigator who is to show the photo-board should not have been involved directly or indirectly in the preparation of such a photo-board; and (iii) the pictures in a photo-board should be presented to the witness in a sequential fashion, that is, one at a time, rather than simultaneously or not all at the same time. The Prosecution confirms that there existed no formal policies on the compilation of photo-boards within its office.

The witness further explains that he chose those individuals whilst trying to avoid including the brothers and relatives for each one of the photo-boards. The Defence however points the witness to various family members (of co-accused) and accused before the STL included in the photo-boards. The witness does not remember out of how many photos he made the selection for the photo-boards or what criteria he exactly used to select faces similar to the accused, as some of the faces show very little similarity.

Hopefully there will soon be more evidence in court about the use of these photo-boards.