On 24 February second contempt case against journalist and media company will start

On 8 September 2015 the contempt judge at the STL issued a verdict in the first contempt case at that tribunal. In this much-debated case, Al Jadeed TV broadcasting corporation and its deputy head of news, Ms Al Khayat, were charged with two counts of contempt of court. The television station produced a series of episodes on supposed witnesses of the tribunal. The two accused were charged with publishing information on purported confidential witnesses in the main case, thereby undermining public confidence in the STL’s ability to protect the confidentiality of information about, or provided by, (potential) witnesses. Al Jadeed TV and Ms Al Khayat were also charged with failure to comply with a court order to remove that particular information from Al Jadeed's website and its YouTube Channel. Al Jadeed TV was acquitted on both counts; Ms. Al Khayat was found guilty on the second count and sentenced to pay a fine of 10,000 euro. Appeal is still pending in this case. See our blog on International Justice Monitor for a commentary on the judgement. We've also published an article on the relationship between freedom of speech and the prosecution of journalists at the STL in the International Crimes Database of the Asser Institute.

[screenshot of Contempt Judge Lettieri in court - 18 September 2015]

On 24 February the second contempt case against another Lebanese journalist and medial company will start. In this second case, similar charges have been brought against Lebanese newspaper Akhbar Beirut and its editor-in-chief Mr. Al Amin. On 11 December 2015 a Pre-Trial Conference was held. The Amicus Curiae Prosecutor requested a postponement of the proceedings to await the outcome of the appeal pending in the first contempt case. This request for postponement was dismissed in a written decision of 18 December 2015. Further, the Amicus Curiae Prosecutor requested an amendment of the indictment, witness list and exhibit list, which requests were partly granted by the Contempt Judge (click here for the written decision allowing an amendment of the witness and exhibit list, and here for the decision denying an amendment of the indictment).

Further, during the Pre-Trial Conference the representation of the accused was discussed, as the accused refuse to participate in the proceedings. Mr Abou Kasm has been assigned by the Defence office to defend their rights and interests (see also our interview with him). Mr Abou Kasm requested the trial to be classified as a trial in absentia, which will allow the accused to have a retrial. Judge Letterie denied this request as the accused have appeared in court and subsequently refused to participate. The Prosecution takes the position that the accused Mr Al Amin should be summoned to appear in court, with a failure to appear leading to an arrest warrant.

Witnesses testify about accused Mr Badreddine

Background of Mr Badreddine

This blog post analyses the evidence that was brought forward by the Prosecution over the last few months specifically in relation to the accused Mustafa Amine Badreddine.

(Picture of accused Badreddine from STL official website) 

The Indictment (para. 3 under a) specifies that "BADREDDINE monitored and, together with AYYASH, coordinated: (i) the surveillance of HARIRI in preparation for the attack; and (ii) the purchase of the van which was used to perpetrate the attack. BADREDDINE monitored the physical perpetration of the attack. In addition, BADREDDINE monitored and, together with MERHI, coordinated the preparation of the false claim of responsibility."

In November and December, the Prosecution called several witnesses to testify about the role that Badreddine allegedly played in the attack on former Lebanese Prime Minister Rafik Hariri on 14 February 2005.

Witness Nicole Blanch (19 November, 16 December 2015)

Ms Blanch works as an associate analyst within the Prosecution section of the Lebanon Tribunal. Her witness statement is provided an MFI exhibit number, but since no summary of that was read onto the record, it was difficult to follow her narrative in the courtroom.

She was tasked to review the SMS content for a phone attributed to the accused Badreddine (a telephone called PMP 663). She located a number of SMS messages between Badreddine's phone and  a phone number ending with 432, addressed as 'Jad'. These messages concerned refueling of vehicles and meeting at particular times and places, with Jad using the term 'boss'.

The witness prepared a document about this for demonstrative purposes in court, and also a sheet with the phone contacts between these two numbers. This sheet shows that there is frequent but short contact between these phones, and that there is the shared phone number of witness PRH416 (who has still to appear as a witness in court). Further, on 21 January 2005, the phones attributed to Mr Badreddine and Jad were in the Jounieh area back to Beirut; this corroborates the evidence of PRH416. According to the witness, this shows that "Jad was present with Sami Issa in Jounieh, and this was part of his role as a bodyguard for Sami Issa," and that Jad was responsible for the vehicles.

The witness is cross-examined by Mr Edwards representing the accused Mr Badreddine, who challenged the witness's evidence, suggesting that she made a selection of SMS messages that was most persuasive to her purposes (to show that Jad was a driver for Mr Badreddine, and that these SMS messages support the evidence of PRH416) and that a lot of different conclusions--at least different from hers--can be drawn from the SMS content. He thus suggested the possibility of an alternative theory or theories to the Prosecution's theory.

PRH416 (1-4 and 7 December)

Witness PRH416 was an employee of someone he knew as Sami Issa, a proprietor of a jewelry store part of a company called Samino. According to the Prosecution, Sami Issa is the same person as the accused Badreddine. The Defence challenges this theory. The witness was a security guard in one of the jewelry shops owned by Issa in the summer of 2002, and then worked as a bodyguard for Sami Issa  from fall 2002 until late January 2005. 

The witness identifies the phone number of Mr Issa and various of his employees and bodyguards, and he identifies manager Chaker and Mr Issa on photos. Mr Issa had a team of four bodyguards who carried weapons, and together they would be in one car with very tinted glass and Mr Issa in another car with no or lightly tinted glass. The witness thinks Mr Issa had another team of bodyguards. Generally, the witness's team would work from 2pm until midnight, and would receive a phone call as to where to meet with Mr Issa and where to pick up a car. Cars were picked up and dropped off at parking lots. They always dropped off Mr Issa at highways or main roads. The witness went with Mr Issa to restaurants and bars in Beirut. They were instructed to prevent anybody of taking pictures of Mr Issa.  The witness does not know why Mr Issa needed bodyguards; he did not carry around jewelry or cash. The witness further comments on a number of phone records between Mr Issa and him between 24 and 26 September 2014, when they used to frequent the Jounieh area in Beirut, and describes various other locations he accompanied Mr Issa to. 

Mr Issa had a briefcase with several mobile phones. At one particular moment, the witness saw him carry five phones. Mr Issa made sure he never left finger prints, e.g. he would use a cloth to touch a handset in a shop, and would pick up his cutlery with tissues or clean his cutlery after usage. He would often wear a baseball cap or sunglasses. Mr Issa had something in his right knee and used to limp. He was registered at a university in Beirut. He had various license plates for each of the cars he used, and would instruct the witness and his fellow bodyguards which plate to put on the vehicle. This included a license plate used by the intelligence directorate and a military license plate. Upon Mr Issa's instructions, the witness also made sure nobody followed him by taking circuitous routes, different routes, or park far away from his home.

A large part of this witness's testimony was conducted in closed session, and the content thereof was shielded from the audience.

During cross-examination the witness agreed with the suggestion by counsel for Mr Badreddine that the security measures taken by Mr Issa would be quite normal and reasonable for a successful jeweler, in view of the risks of robbery and kidnapping. The witness was also questioned about his phone calls with Mr Issa in 2006 and 2007, that is, after he had left his job. He was questioned about a text message he had received from Mr Issa, stating 'today is off'. The witness denied being reemployed by Mr Issa after January 2005, although later on during cross-examination he did admit that he did some more work for Mr Issa in 2007 as a bodyguard, on perhaps ten to twelve occasions.

PRH306 (7, 8 and 9 December)

Again, for Witness PRH306 several statements have been made available to the parties and the judges that the audience does not have access to, nor was a summary thereof read out in court. The parties'  questions to this witness are however based on that undisclosed information, which makes it difficult for outsiders to understand the exact context of the testimony. This witness, as well as witnesses PRH264 and PRH089 below, all testified about a jewelry trader in Beirut, Mr Issa, and his likeliness to accused Mr Badreddine. 

This witness is currently working in a managerial position in a large jewelry business outside of Lebanon, and because of his experience he is supposed to have an understanding of both the business aspects and the sales aspects of the jewelry business. He worked for Mr Issa sometime in 2002 or 2003 in the latter's shop called Samino. The witness testifies that Mr Issa did not know much about the jewelry trade; Mr Issa did not seem to be very much interested in the jewelry shops or the details of the business. The witness and his colleagues did not understand why Mr Issa owned jewelry shops. 

When Mr Issa would visit the jewelry shop, he would always bring one of his girlfriends along, but at a later stage he would also bring his bodyguards. The witness testifies that the manager of all three jewelry shops was a man named Mohammed Chukr, also referred to as Estez Chaker. In the beginning he did not know much about the jewelry trade, but he began to learn on the job. In Mr Issa's office there was no computer, the witness recalls. Sometimes the witness would find a paper and a pen, but nothing much. The witness further recalls that the brother of Rustom Ghazaleh (Rustom Ghazaleh was the head of Syrian security in Lebanon) visited the shop on one occasion, but that Mr Sami said he should go to another shop; this was approximately late 2004. The witness further states that Mr Issa did not do any work in his office on the top floor of the jewelry shop. He did take naps in that particular place, though, and he would bring girls there. He said he wanted to take advertisement photos of the girls, but he never did. In March of 2005 the witness stopped working for this jewelry shop.

The witness is asked by counsel for the Prosecutor to identify several phone numbers that were used by Sami Issa at the time, and similarly for the aforementioned person Mohammed Chukr, as well as employees from the jewelry shop.

The witness is then asked more questions about this person Chukr, who was an accountant, according to the witness.

The witness concluded that Mr Issa belonged to the Shia sect of Islam, from his accent which was mostly that of a Shia Muslim, the fact that he did not specify to which confession he belonged, and that he wore a beard and black clothes during the Ashura festivities, which is a Shia religious occasion. The witness is also presented with photographs by the Prosecutor, and asked to identify the  building on those photos, which is the jewelry shop. He is further asked to indicate on a map the exact location of the shop. He further identifies other jewelry shop branches from the same owner.  The Bourj-Hammoud shop was closed on the day of the assassination of Rafik Hariri, and never reopened again. The witness had been told they wanted to keep that shop closed because the economy was going down, although the witness said the economic situation was good.

Mr Issa didn't like his pictures taken; the witness describes him as tall, thin, completely bald, and he walked with a limp. The witness and his colleagues all found him a mysterious person; he didn't say much about his family background. The witness further details that he found Mr Issa a calm, quiet and understanding person.

The witness had found a picture on the internet, and he had subsequently contacted the Office of the Prosecutor. The person looked like the Sami that witness knew, but in the picture he had hair, and he looked younger. But otherwise, the features were the same. And this photo was of Mr Badreddine on his application for the Lebanese American University. 

Mr Issa's girlfriend had sent text messages to Mr Issa from the witness's phone when she had forgotten her own phone, and some of these are read out in court.

In cross-examination by Mr Edwards, defending the interests of Mr Badreddine, the witness is lead to testify that Mr Issa was in fact more interested in the business aspects of the jewelry store than came out in his testimony-in-chief. Judge Akoum further questions the witness about his conversations with Mr Issa. They had many phone conversations, some of them lasting up to about an hour, but the witness does not recall the content of those conversations.

PRH264 (10, 14 December 2016)

On 10 and 14 December, witness PRH 264 testified in court for the Prosecution. This witness was a friend of witness PRH089, who testified on 15 December (see below for a summary of his testimony). Witness PRH264 was a friend of Mr Issa, and assisted the latter in his jewelry businesses.


[Screenshot of pixelated face of witness PRH264 testifying in court under protective measures.]

This witness currently works as an assistant to a relative of Rafik Hariri, as he did in 2004 and 2005; the witness is also befriended to that person. Sami Issa also formed part of this group of friends; they used to all go out together at that time and several of them attended university. Sami Issa was also referred to by Safi by his friends. The witness regarded Mr Issa as a close friend. Mr Issa never wanted his photographs taken, nor would he ever talk about his personal life or his family. They never talked about politics in their group when they went out, perhaps only superficially. They went out very often, perhaps four times a week. Witness PRH089 was not part of this group. The witness visited Mr Issa in his apartment on several occasions. The apartment had been mainly empty. The witness describes Mr Issa as neither fat, nor thin, had very little hair and had a whitish skin color, between 1.75 and 1.80 meter tall. Sometimes he wore glasses, sometimes he didn't. Like the former witness, this witness testifies that Mr Issa had a problem with his leg, that he had burnt it, though it wasn't a noticeable limp, he just walked slowly. Mr Issa was a Muslim of Shia confession. He had never told the witness that directly, but the witness concluded that from the Muslim festivities that he would celebrate, also referring to the Ashura festival, though unlike the former witness, this witness did not notice any difference in Mr Issa's appearance during that festival. "You don't need to be an expert to understand that", the witness added. Mr Issa was a calm and quiet man, the witness states.  Mr Issa would wear a baseball cap most of the time. When he wasn't wearing it, the witness would not notice anything, just his hair, of which he had rather little. The witness is presented a photograph, and the witness indicates that that person looks similar to Mr Issa, though indicating that the picture is not very clear. "So it looks like him but no 100 per cent."

After the attack on Mr Rafik Hariri they had all been upset and sad, including Mr Issa, though they didn't go into the details of what had happened in their discussions. On the day of the assassination, Mr Issa had sent a text message to the witness in which he had asked him to call him back, but the witness does not recall the content of that conversation, which lasted approximately three minutes.

When the witness knew Mr Issa in 2004-2005, he estimates the latter was between 35 to 40 years old. The friendship remained until 2010, after which they all lost contact with each other.  He stopped calling the witness and the others from their group and he disappeared. Nobody knew what had happened; his phone lines were disconnected.

PRH089 (15 December, cross-examination will follow)

This witness was the employer of witness PRH264, the previous witness summarized in this blog and also a friend of Mr Issa. In 2002, the witness had been a student at university in Beirut, and that is where he first met Mr Issa. The witness did not know this person as Safi Badr. In mid-2004 the witness left university to start his own company. This witness saw Mr Issa three to four times a week, in a group of friends. The witness does not know what Mr Issa had studied at university. They had active telephone contact during 2003 and mid-2005, after which it became increasingly less frequent. During their meetings they discussed general topics including cars, clothing, and phones. The witness recalls that, regarding political opinions, Mr Issa's opinions were quite different from the witness's. Whilst they followed the former Prime Minister's, i.e. Rafik Hariri's, Mr Issa was from the other political side. The witness knew nothing about Mr Issa's family, though he knew he had not been married at the time, nor did he have any children. Mr Issa had a boat named Samino.

Mr Issa used to bring several bodyguards with him, and in his car he had a machine gun. The witness was not scared by seeing the machine gun in the car, and he did not think it was strange for Mr Issa to have this kind of security. He was a jewelry businessman. Mr Issa had a luxury car and a luxury watch, the witness testified.

This witness also testifies that Mr Issa is a Shia Muslim, Mr Issa had told him that during a conversation. He had also informed the witness that he had traveled to Syria, though the witness couldn't say the reason for that. The witness described Mr Issa as being between 170 and 175 centimeters tall, in his early 30s. He used to shave his hair very short, and he used to wear a baseball cap most of the time. He would have a goatee, though he would change it, nothing was permanent. The witness describes Mr Issa as having average weight. The only distinctive feature was an injury in his leg, probably his right leg. It had happened during a car crash, according to this witness. On one occasion the witness had seen Mr Issa's legs, and he saw the injured leg was thinner than the other. When he walked, Mr Issa had a slight limp. The witness further describes the kind of glasses Mr Issa had been wearing, thin and dark, he thought they were prescription glasses. He wore them most of the time. Mr Issa did not have a particular accent, the witness states, though Mr Issa had told him he came from the south of the country.

After Rafik Hariri had been killed, the witness and Mr Issa had had a phone conversation during which Mr Issa had told the witness that Mr Hariri had been doing good, charitable work, and that he should not have been stopped.

The witness is shown a photograph, and he says "I could say that he looks like Sami Issa, but I couldn't swear to it."

This witness was not yet cross-examined during this session in December 2015, because the defence for Badreddine needed more time given that the Prosecution had provided more evidence on this witness's testimony at the last moment. The Chamber had ruled that the defence would be given more time, and cross-examination of this witness would be permitted to postpone until somewhere in the new year. This portion of this witness's evidence will be added to this blog at a later stage. 

Members of the OTP testify in court

During the last few months of 2015 the Prosecution called many of its own team members to give evidence, an unusual practice in (international) criminal proceedings (with the exception of investigators and actual experts working for the Prosecution, who appear more often in court). Some of these witnesses were primarily questioned by the judges and seem to be called to provide information on technical aspects of the Prosecution’s case, including the creation of call data records and databases. Other members of the Prosecution are extensively questioned by the defence, whilst especially the investigators hardly received any questions. Below a summary of the evidence given by these Prosecution members (and one expert), divided into three main topics.

1. CALL DATA RECORDS (DATABASE AND ANALYSIS)

Mr Spartak Mkrtchyan (14-15 September)

Mr Mkrtchyan is the Prosecution computer information systems officer and the database administrator. He and his team are responsible for the Prosecution's call data record structured query language (or SQL) database. This includes the design of the database, the upload of the call data records, and the design of the database's built-in analytical functions or stored procedures. The Chamber has ordered the Prosecution to call witnesses to provide further evidence about the production of the call sequence tables and the underlying data (see decision of 5 May 2015, para. 115). Mr Mkrtchyan provides evidence on the format in which the raw call data and SMS content was received by the Prosecution, the database he created and filled with the raw data, and the stored procedures he wrote to search the database, which enabled the creation of some of the call sequence tables.

Professor Peter Sommer (15 September)

Although not a member of the Prosecution, Professor Sommer was hired by the Prosecution to audit the work of Mr Mrktchyan and therefore his testimony is included in this blog. Professor Sommer appeared as an expert witness on computer and information systems and the storage and security of data, including digital evidence. He wrote a report called “STL-OTP: Audit of Telephone Database Administration Processes” dated 17 July 2012. Professor Sommer visited the STL three times, and during two of these visits he met with witness Mr Mkrtchyan. He did an audit of the database system as set up by Mr Mkrtchyan, that is how the data received from the mobile phone companies was converted into a database, and to “get a clear overview of what the system is supposed to do, and constantly ask oneself: What could possibly go wrong, what is being done to prevent those things from going wrong, and what tests can one apply afterwards to establish that nothing has gone wrong.”

Professor Sommer concluded in his report that the system in relation to the handling and storage of the call data and SMS records was very thorough, and included a detailed manual, records of particular activities, and a unique number for each entry (making it easy to track back to the material provided by the phone companies). Professor Sommer further concluded that because of the processes employed, significant errors in the upload of data or data corruption are manifest or immediately apparent. Further, the fact that separate and matching records for calls between Alfa and MTC phones can be seen, provides some confidence in the accuracy and completeness of the records produced by the two mobile phone companies.

During cross-examination by Defence Counsel Mr Roberts, Professor Sommer explained that he thought he was asked to the audit, because the work was considered something of a novelty and there was a need to reassure the Tribunal that the work was done properly. Further Professor Sommer agreed that the errors he analyses in his report will not reveal data manipulation by the mobile phone companies. The witness does not have any knowledge about the data provided by two additional Lebanese phone companies to the Prosecution, and did not review the hard disks with data received by the Prosecution from the mobile phone companies.

Mr Elvis Stana (28 October)

Mr Stana is an analyst with the Prosecution, who did a statistical analysis of the call data records to determine the extent of synchronisation between the clock recordings in the call data records of the providers Alfa and MTC Touch. He explained that the mobile switching centres in Lebanon - that are recording and routing the call - were not centrally synchronised. This means that there could be a slight variation in the time recorded in the call data records for the incoming and outgoing side of a call. Some difference are only a few seconds, but especially in relation to one specific switching centre, the witness recorded a time difference of around 75 seconds. The Prosecution expects that the telephone companies will provide evidence to explain these large differences.

[Screenshot of Mr Stana testifying in court on 28 October 2015]

Ms Kei Kamei (16-19 November 2015 - cross-examination only)

Ms Kamei, an analyst working for the Prosecution, appeared in court in July and has already been cross-examined about the creation of the call sequence tables (see our blog on the five witnesses responsible for the creation of CSTs). This cross-examination is about additional topics. Defence Counsel Mr Mettraux for the accused Mr Sabra questioned the witness about information she received whilst interviewing witnesses, especially in relation to the person who claimed responsibility for the attack, Mr Abu Adass. The questions cover Mr Abu Adass’s visits to the mosques, the persons who accompanied him and his relation to certain organisations (including Al-Ahbash), the information found at his place and on his computer (including material on jihadist sites, a list on Hariri’s properties and foundations in Lebanon, and a series of maps), and phone calls made with the landline of the family Abu Adass. This results in a lot of hearsay evidence from Ms Kamei, of which the value seems questionable. She also does not remember many of the details put to her and explained that her role at that time was to focus on communication analysis. Mr Mettraux explains that he will seek to tender the actual statements of the witnesses in the future, mostly to establish the truth of their contents.

[Screenshot of Ms Kamei testifying in court]

The witness is also asked to comment on the video with the claim of responsibility, and on an alternative scenario on whom bought the phone card that was used to call Reuters and Al-Jazeera. This alternative scenario is to challenge the Prosecution’s scenario that it was the accused Sabra that was involved in this. Mr Mettraux further explains that they are not actually putting a positive case, but just an alternative possibility for the person who called the media about the claim of responsibility. The Chamber requests Mr Metttraux to further explain their defence position on this matter, and Mr Mettraux gives a lengthy explanation in court (see transcript of 19 November, p.101 and further). The Defence for the accused Sabra agree with the Prosecution that Mr Abu Adass was not the suicide bomber and that the video and letter were used to shield the identity of the real perpetrators. The information in their possession suggests that Hariri has been killed by a very sophisticated group of high-ranking state officials who used associates to commit the crimes. This includes members of Al-Ahbash and the Syrian and Lebanese security apparatus. Mr Mettraux also presents their very detailed views on how Abu Adass was lured into this. The Defence for Sabra thus does seem to present a positive case, at least on this topic, which is an interesting position to take in a trial in absentia.

Defence Counsel Mr Larochelle questions Ms Kamei about the investigations into the links and contacts between Abu Adass and members of a group called Al-Qaeda 13, including her analysis of the calls made through the landline of the family Abu Adass. He also questions the witness about the methods she used in attributing phone numbers to certain persons.

2. ELECTRONIC PRESENTATION SYSTEM

Andrew Fahey (16-17 September, 27 October)

Mr Fahey is an analyst with the Prosecution, and since November 2012 the project manager of the development of the electronic presentation of evidence software. The evidence of Mr Fahey can be divided into three parts: (i) the electronic presentation of evidence system; (ii) the associated area of what choices he made in respect of the cell site data that he used; and (iii) the various locations that have been plotted into the presentation system. His testimony on 16-17 September 2015 only dealt with the first subject.

Mr Fahey was taken through a presentation of this system, that the Prosecution intends to use to present its telecommunication evidence. The system has a database that holds evidence that the Prosecution is tendering, and creates the ability to search that database and display and record selected aspects of evidence. During his testimony the following matters were discussed:

• the five types of evidence that can be displayed in the system: a) the map of Lebanon; b) relevant locations, including routes taken by Hariri; c) cell site information (mast location, orientation and coverage); d) telephone call information (taken from the CSTs); and e) attribution (assigning of short names) of telephone numbers to users (including the accused) or networks;
• how these types of evidence are shown together;
•  record keeping (creating pdfs with screenshots and log tables); and
• quality assurance.

This system enables the Prosecution to visualise complex patterns of telephone usage. The question arises why court time would be used to explain software used by the parties, something that could easily be explained through an internal training? If there are any challenges to this software, a more logical option would be to file a written motion, or to suggest the use of different software if needed. From the transcript it appears that the parties have already met 14 times on this topic, and there seem to be no challenges to the functioning of the system, only to the selection of material used by the Prosecution.

The evidence of Mr Fahey on 27 October dealt with the map coordinates established by the witness of eight residences associated with the accused. On the basis of his analysis of documents, Mr Fahey has created a number of maps. Mr Fahey also established the map coordinates for 144 places and landmarks relevant to the Prosecution case, both for the movement of Hariri and the phone networks allegedly used by the accused in undertaking surveillance of Hariri in preparation of the attack.

Bastiaan van der Laken (9-11 November)

Mr Van der Laken works within the Prosecution and explained the functionality of the electronic presentation of evidence system, including the data management tasks associated with uploading data to the software. Like witness Fahey he explained the type of evidence stored in the system, and that this data is uploaded using an excel workbook. The witness also explained how two sides of a phone call are paired using the differences in the time records as established by Mr Stana (see above). The Defence has located  mistakes and/or differences in comparing the evidence presentation system and the call sequence tables, and confronted the witness with these mistakes. The witness explained that the software is functioning as intended, but that there always has to be a manual check of the underlying (call) data before presenting anything in court. The data set is still in progress. The Defence also attacks the underlying data, but that seems an issue to be raised with the telecommunication providers.

[Screenshot of Mr Van der Laken testifying in court]

3. INVESTIGATORS

Toby Smith (27 October)

Mr Smith is an investigator working for the Prosecution. He explained some documentary evidence he reviewed to establish the location of property allegedly belonging to the accused Merhi or his family, one of which was subsequently confirmed by witness PRH647 (see our previous blog on evidence and phones owned by the accused). The witness also reviewed documents in relation to a property for which the accused Sabra had an electricity prescription. The witness provides comments on various documents. A less time-consuming approach would be to put these comment in a bar table motion, as this is the Prosecution's view and the Defence does not cross-examine the witness. The Prosecution explains that the location of the residences of the accused are relevant to establish which phones belonged to the accused.

Timothy Holford (28 October)

Mr Holford is an investigations coordinator in the STL Beirut office. He went into the field to establish the GPS coordinates of a number of landmarks in the Prosecution's case and explained the methodology used. The locations include the Mitsubishi canter van dealer in Tripoli, branches of Samino jewellery owned by the accused Badreddine, the office of witness PRH078, residences of Hariri and other places Hariri visited, cell shops were network phones were purchased, and the Al-Jazeera and Reuters offices.

Erich Karnberger (28 October)

Mr Karnberger is an investigator in the STL Beirut office who photographed a number of locations which were plotted by the previous witness Mr Holford.

Evidence on phones and property owned by the accused

During the last few months of 2015, the Prosecution presented various witnesses (and documents; see our previous blog) as evidence that certain phones or houses were owned by the accused. The testimonies of these witnesses were relatively short, with the witnesses mostly commenting on documents the Prosecution wanted to tender into evidence. There was also very limited cross-examination; this raises questions about the need to hear these witnesses in court, as their evidence seems largely unchallenged.

PRH067 (30 September) on Oneissi's phone

The evidence of PRH067 is to establish that the so-called purple phone was owned by Mr Oneissi. The witness came into contact with Mr Oneissi around 1999. Mr Oneissi was a client of the witness, and they had over 80 professional appointments, with the last appointment on 21 August 2004. PRH067 testified that Mr Oneissi - who he knew as Hussein Hassan Issa - provided his office with a contact number, and this number is the same as the purple phone appearing in the Prosecution's case. The phone number and the meetings were recorded in a client file and business records. The witness's two office numbers had repeated contacts with the phone number of Mr Oneissi, the last time being approximately two weeks before the attack of 28 January 2005.

Witness PRH371, an analyst, observed that the phone number of Mr Oneissi's purple phone activated cells providing coverage in the area of the PRH067's workplace on 40 occasions, 37 of which were on days Mr Oneissi had an appointment with this witness.

Mahmoud Assi (1 October) on Ayyash's phone

The witness's evidence is to establish that a personal mobile phone was owned by Mr Ayyash. The name of this witness appears on two insurance documents for a claim for an accident that took place on 20 November 2004. However, Mr Assi is not the person who prepared the expert report, but his colleague Mr Kalash did. The witness is a vehicle accident expert with an insurance company and testified about what happens when accidents occur in Lebanon and when experts get called. The insurance documents also contain Mr Ayyash's name, and the phone number that the Prosecution claims to be Mr. Ayyash's.

PRH651 (2 October) on Merhi's phone

This evidence is about the attribution of phones to Mr Merhi. Witness PRH651 is a a senior manager for a furniture manufacturer and seller. He testified about certain business documents on the delivery of furniture on 24 and 26 November 2004 to the Merhi family. One document is an order that the phone number that the Prosecution claims to be owned by Mr Merhi and his family; another document is signed by Mr Merhi. The furniture was sold through a retailer but directly delivered to the customer.

PRH647 (9 November 2015) on Merhi's house

Witness PRH647 describes the Gardenia building in Beirut. The witness was shown a photograph of a man who looked like someone who lived in the Gardenia building in 2010-2012 and whose family name is Merhi. The witness believes that the same man has two sons. He may have had some limited contact with Merhi but does not recall the contact specifically.

PRH688 (10 November 2015) on Merhi's father's house

This witness gave evidence about the lease of a real estate in Haret-Hreik by Mr Habib Ali Merhi in the period 2005-2008, which he used to run a cloth shop. Mr Merhi, the father of the accused Merhi, lived across the street from these business premises, although after the building was partially destroyed during the 2006 war they moved temporarily to Aley. Mr Merhi had children, including a son called Haidar, and another son identified by the witness in a picture. According to the Prosecution, this evidence is relevant because the location of the home of the father of the accused is relevant to establish that three phones used in (preparing) the bomb attack were owned or used by the accused Merhi.

In addition, in September there was a witness testifying about Abu Adass, the person who claimed the responsibility for the attack through a video message.

PRH087 (29 September) on Abu Adass

PRH087 lived nearby the Abu Adass family in February 2005. He described them as a conservative, religious and well-mannered family who had no problems in the neighbourhood. The witness did not have much contact with the family. Ahmad Abu Adass was introvert and became more religious from 2001 or 2002; he let his beard grow and wore religious clothes like a Salafist. The witness never heard Ahmad express any political views, although he had seen Ahmad’s elder brother working for the Hariri election campaign in 1996 and he thought the family supported Hariri. The witness saw Ahmad going to the Arab University mosque on Friday, andAhmad would be reserved and sitting alone. Once, about a week before Ahmad’s disappearance, the witness saw him talking to a young man with a dark skin in the mosque. PRH087 describes meeting Ahmad’s father Taysir, who told him Ahmad had been missing for a couple of days, and that they had received a phone call from someone saying that he was in the north and that the car had broken down and he couldn’t come home. The witness has seen the tape with Ahmad claiming responsibility for the attack. Ahmad looked very different from the person he had known before and the family of Ahmad was totally destroyed after this.

A large amount of documentary evidence presented in court (June-November 2015)

During various trial dates in the second half of 2015 the Prosecution presented documentary evidence that has been tendered into evidence by Trial Chamber’s decisions, including lengthy explanations of its relevance. This is a very time consuming process, and although it seems to be directed at making available evidence to the public, it would be a lot more effective to give the public access to these exhibits, and explain the relevance in a (bar table) motion, a well-established practice at the ICTY for example. Now many days in court are used to discuss things which could easily be dealt with in written form. Further, this way of summarising evidence in court gives the Prosecution a lot of time and space to make submission about its case and its interpretation of the evidence, to which the Defence rightly objected (see the transcript of 5 November). The Defence argued that the judges should evaluate all evidence at the end of the trial instead of being influenced by the Prosecution’s interpretation during trial. Also, this affects the expediency of the trial. The Defence indicated that they will put their objections in written form; this will be an interesting discussion to follow. Judge Re explained that the reason they were spending so much time in court on presenting exhibits is to publicly show the evidence they’re receiving, and that the amount of time spend on this matter will depend on the availability of witnesses.

Below a summary of the documentary evidence presented in the period June-November 2015.

On 18 June 2015, the Prosecution presented 10 mobile phone contracts relating to nine blue phones and one yellow phone (see also our blog of 13 July). According to the Prosecution these phones were purchased anonymously, sometimes with false documents; other times the shop owners recycled people's IDs to protect the identities of the phone users, because these phones were used to provide a support role for the planning and execution of the bomb attack of 14 February 2005. The evidence from the contracts is linked to the statements or testimony of various Prosecution witnesses, who deny having bought these mobile phones. On 27 August 2015 the Prosecution presented the summaries of witness statements on this issue, including subscribers of telephone lines that according to the Prosecution have been used by the accused in the planning and execution of the attack on 14 February 2005. The witnesses however deny having bought these SIM cards, and point out the many mistakes on the subscription forms. There are also witness statements about the import and distribution of handsets and SIM cards to the various shops that eventually sold the handsets and lines used by the various networks.

On 18 June 2015 the Prosecution also dealt with part of 99 business records from mobile phone companies, one group relating to red phones and another two groups relating to green phones. These documents show the delivery of SIM cards to specific dealers, the origin of the phones and how the phones were paid for.

On 22 July 2015, the Prosecution presented 262 United Nations Information Centre Beirut Press Reviews which are relevant to the movement of Rafik Hariri and political events, including the political climate in the months leading up to the resignation and assassination of the former prime minister. Further, 11 exit and entry records of Beirut airport of Hariri in the period 16 December 2004 - 7 February 2005 were tendered into evidence. This evidence is also related to the political witnesses who testified earlier in 2015.

On 23 July 2015 the Prosecution presented 11 other documents tendered into evidence, including a phone directory of the Quraitem palace, various passports of Hariri, photographs, copies of newspaper clippings, decrees, parliamentary meeting notes and UN documents in relation to Lebanon. This evidence is partly relevant to show the movement of Hariri in relation to the surveillance with the network phones allegedly done by the accused. There also documents that list the addresses of the telephone boots, and the telephone cards, that were used to call Al-Jazeera and Reuters to make the false claim of responsibility for the attack.

On 5 October the Prosecution presented a summary of a witness statement of an injured victim of the bomb attack. Further, the Prosecution presented photographs of various areas in Beirut, including photographs in and around Nejmeh Place and parliament, and photographs of various points along a route that would commonly be taken and expected to be taken by the Prime Minister on his way to his villa in Faqra. This includes a ramp that according to the Prosecution was one of the places considered by the accused as an assassination site. This can be concluded from various factors including the activity and interest that the users of the red phones had in that particular location on a number of days. The Prosecution further explains that in its view there is a connection between the times that the network phones are present in the Faraya area, and the presence of the Prime Minister in December 2004.

During part of the hearings held on 14-16 October the Prosecution summarised tendered documents relating to two properties associated with the accused Ayyash (in South Beirut and in the Nabatiyeh region), one property associated with Mr Oneissi, two properties associated with Mr Merhi and two properties associated with Mr Sabra. These include financial and legal documents, and witness statements. The Prosecution asserts that the locations of phones used by the accused, and the patterns of use, can be linked to the residences of the accused. In addition, some of the documents filled out by Mr Oneissi in relation to his property contain the phone number that is part of the purple phone network.

On 4 (and 12) November the Prosecution read out the summary of witness PRH078, who had in his business computer records the name of a relative of the accused Mr Ayyash, together with two contact numbers, and the date of her visit to the witness’ business. The Prosecution attributes these two phone numbers to Mr Ayyash. The Prosecution also read out the summary of a tendered statement by Prosecution investigator Toby Smith, who conducted the interview with witness PRH078 and marked the location of the witness’ office. The Prosecution uses this location to show that the two telephones of Mr Ayyash connect to specific cell towers in the neighbourhood on the days of the visits of the relative of Mr Ayyash to the witness’ office. On 12 November the Prosecution read out the summary of witness PRH678, a relative of PRH078 who confirmed his statement.

On 4 November the Prosecution summarised the documentary evidence relating to the delivery of household furniture to the Merhi family between 21 and 26 November 2004, which involved the use of the Merhi family phone and a personal phone of the accused Mr Merhi, Purple 231. The evidence includes subscriber notes for the various phones used in this delivery of furniture, extracts from a customer database, an ID application by Mr Merhi, and witness statements by an employee of the furniture manufacturer and supplier (PRH675), an OTP analyst (Adrian Kirwan) and two OTP investigators (PRH539 and Toby Smith) about the origin of (some of these) documents. The furniture wholesaler is witness PRH651 who gave evidence on 2 October 2015. On 9 November the Prosecution read out summaries of further witness statements in relation to this issue. Witness Kamal Ismail (PRH645) is the owner of a retail furniture business called Ismail Furniture in South Beirut, and was in contact with the Merhi family through a mobile number. Witness PRH650 is a delivery driver for the furniture wholesaler from which Mr Merhi made a purchase. The witness was shown copies of documentation relating to a delivery on 26 November 2004 and recognised his handwriting and initials. PRH650 further identified mobile phone numbers of the company. Witness PRH649 is another delivery driver for the furniture wholesaler and gave a similar statement to witenss PRH650. According to the Prosecution this evidence assists in attributing phone Purple 231 to the accused Mr Merhi.

On 5 November the Prosecution continued with summarising 37 documents relating to various insurance claims by Mr Ayyash for his motor vehicle. These claims were made in October 2003, November 2004 and May 2005, and are relevant for the attribution of two phone numbers to Mr Ayyash. On 6 November the Prosecution read out the summaries of six witness statements. Witnesses Ghassan Saab and Maria Frangieh work for a Lebanese insurance company and gave evidence about the provenance of the insurance documents. Also Prosecution investigator Mr Karnberger gave a statement about this issue. Witness PRH050 met the accused Mr Ayyash in 1996 and 1997, and once or twice a year occasionally, also on the street; Mr Ayyash had a small scooter, worked for civil defence and was a car dealer. The witness also knows some of the family members of Mr Ayyash and identifies some their telephone numbers. Witness PRH086 was a tow truck driver who transported vehicles involved in accidents, although he did not recall the specific accident in November 2004 (for which Mr Ayyash filed an insurance claim). Witness PRH539, a Prosecution investigator, gave a statement about his contact with Mr Al-Kalash, the author of a report dealing with the car accident of November 2004.

Evidence on the origin of the SIM cards allegedly used by those responsible for the bomb attack

During the beginning of September the Prosecution called various witnesses to present evidence on the origins and nature of the network phones and SIM cards allegedly used by the accused in preparing and organising the bomb attack. The Prosecution intends to show that all SIM cards were purchased anonymously. Further, in relation to the red network phones, it is the Prosecution's case that the SIM cards were sold by a mobile telephone distributor to witness PRH553 on 24 December 2004 and delivered to his shop in Tripoli. At some point between 24 December 2004 and 4 January 2005 witness PRH553 sold the eight red network cards, but the Prosecution cannot establish to whom these were sold. Attached to the forms for these SIM cards were identification documents of customers from the Tripoli area, all of whom had purchased their own SIM cards during the holiday period. On 4 January 2005 the eight red network SIM cards were activated.

Mr El-Ajouz (31 August, 1 and 2 September 2015)

Mr El-Ajouz is the owner of Power Group, a mobile telephone distributor. Power Group distributes pre-paid and post-paid SIM cards, scratch cards (to recharge pre-paid SIM card) and handsets to hundreds of dealers in Lebanon. Power Group is an authorised distributor of Alfa products. One of the businesses to which distribution took place was run by witness PRH553 (see further below).

Mr El-Ajouz testifies about the storage and documentation of the products, which, among others, can be tracked through their serial number or bar codes on a form. The witness is commenting on a number of records (including delivery notes, receipt vouchers, and purchase overviews of a particular point of sale) of pre-paid SIM cards for lines claimed to be part of the networks used by these accused. These lines were coming from Alfa and were on-sold to a distributor in Tripoli.

When Power Group sold a group of pre-paid lines, the dealer could fill out a form including a bar code, the subscriber's name and other personal information, and a copy of the purchaser’s ID; this was sent to Alfa. However, this form was only completed for about 20% of the telephone lines. The IDs were not checked by Power Group. For post-paid SIM cards the completion of a form, including a copy of an ID, is obligatory.

During cross-examination Defence counsel is confronting the witness with reports claiming a link between an organisation he’s involved in, the Islamic Charity Projects Association, and the Syrian intelligence, which link the witness denies. Unfortunately, the transcript of 1 September has not (yet) been published and therefore the remainder of the cross-examination remains unknown or unclear for the moment.

Mr Jihad Hassan Tannir (2 September)

Mr Tannir is the former general manager of a wholesale company called Celltec. This was a similar company to Power Group - about which previous witness Mr El-Ajouz testified - in that they distributed Alfa telecommunications products. Mr Tannir explained that Celltex purchased SIM cards and recharge cards from Alfa and distributed these products to its outlets. The witness explains the procedures in distributing telephone lines, which is again similar to evidence given by Mr El-Ajouz on the practices that existed within Power Group, although Celltext also sold products to end users in its own shop. The witness comments on a number of documents, including application forms and invoices, for SIM cards that went through his firm and are claimed to have been used by the accused. Payment options for post-paid cards included payment by the customer in a branch of a certain bank or directly to Alfa, and thus there was no need to provide banking information on the application forms.

PRH090 (2 September)

Witness PRH090 is listed as the subscriber of a pre-paid mobile phone number which was used from October 2004 until September 2005 as one of the blue network phone numbers and which was particularly important in the weeks preceding the bomb attack on Hariri according to the Prosecution. The witness explained in his statement that the application form for this phone number does not contain his handwriting and that most of the information is incorrect; moreover his signature is not on the form, but it is a copy of his ID that is attached to the application. PRH090 had previously purchased a telephone number and left a copy of his identity card at the shop; he has never lost his identity card.

PRH702 (3 September)

Witness PRH702 is another witness whose name is listed as the subscriber of a mobile telephone which the Prosecution allege was part of the blue network. The witness was shown the application form for this phone number and he does not recognise the telephone number; also some of his personal information, including the spelling of his name and his address, are incorrect. He also does not recognise the handwriting on the form nor the signature. PRH702 had purchased a new SIM card towards the end of 2004 and provided an identity card during the transaction.

PRH553 (8-10 September)

Witness PRH553 owned a small mobile phone shop in Tripoli, and was involved in the wholesale and retail of mobile phone products, including SIM cards, recharge cards, handsets and mobile phone accessories. PRH568, who was very experienced in this business and able to get good prices from the dealers, was the shop manager; he dealt with the suppliers and served the customers. The group of suppliers included Power Group, Alliance, Celltec and Kettaneh. They were re-selling Alfa and MTC products, also to other shops.

The witness did not keep any records of the products sold at this shop. It was up to the other shops to complete the application form for the pre-paid cards, although the shops would receive 3 dollar for each completed form for a line (and the shop owned by PRH553 even charged 5 dollar for not completing a form); this is why forms were completed with incorrect information; any ID they had or was given to them by a shop was attached. They were able to use the same ID for tens of pre-paid phone lines. The shop filled in the forms, and very rarely did the customer himself do this. Whenever a customer did not provide an ID card, the witness would fill in the form and put in an ID card in order to recover the money. Very rarely did the form match the identity of the buyer of the SIM card, and the witness would make up the names, addresses, dates and signatures. According to the witness “[t]here was nobody carrying a line with his own name unless we are talking about the post-paid cards or the fixed lines.” Therefore, the Prosecution's theory that all network telephone lines used by the accused were obtained anonymously, seems to apply to almost all (pre-paid) telephone lines in Lebanon at that time.

In September 2005, the witness was charged with having falsified personal papers, and using these falsified papers in relation to the activation forms for the eight SIM cards of the red network. He has been incarcerated for almost three years by the Lebanese authorities but no trial was ever held. The Defence confronts PRH553 with a number of possible contradictions between his previous statements and his testimony in court. However, some of the interrogation of the witness by the Lebanese authorities took place under very harsh conditions and without access to a lawyer.

Defence Counsel Mr Mettraux is questioning the witness about telephone calls between his shop manager, PRH568 (a dropped Prosecution witness), and the Tripoli sales person from Power Group around the date of purchase of the red network cards in December 2005; the Defence also claims to have evidence that shows contact between PRH568 and the Syrian military intelligence. There is also a small dealer, whose name is kept confidential in court ('number six’), about whom the witness and PRH568 remembered that PRH568 sold him ten lines in early January 2005, but they did not remember the exact date of the sale. Therefore it is unknown whether these were the same ten lines as used by the red network. The witness does not remember to whom he sold the red network lines. Further, the Defence has evidence of a number of phone calls between PRH568 and number six (and the assistant of number six) on 30 December 2004, so possibly the sale of these ten lines could have been on this date. The witness also explains that the dates on the forms are not necessarily accurate, with the date on the forms for the red network lines being 12 January 2005.

For the moment it remains unclear to whom these red network telephone lines were sold and if and how they came into the hands of the accused.

More evidence on telecommunication: Expert John Edward Philips

Prior to the recess the Prosecution already explained that the focus in the next months will be telecommunication. Mr Philips, who gave testimony from 18 until 26 August, is an expert witness in the area of cell site analyses, who will describe the technical working of mobile companies and networks. At the request of the Prosecution he wrote a report called “Cell Site Analyses as Applied to GSM Networks” dated 24 September 2012.

Mr Philips worked for Marconi Communication Systems for 15 years. During this time he was invited to publish numerous technical papers on the topic of mobile radio communications and he was active on a number of industry-wide technical committees in relation to mobile radio technology. Thereafter he became head of design and development at Multitone Electronics and he was the secretary of the European paging association. Subsequently he became an engineer at British Telecoms and worked as a cell site analyst. Because of his work he was invited to sit on the GSM specification committee.

His expertise in cell site analysis involves taking the data that is produced by the system and analysing it. He mainly worked in the UK and is not specifically an expert on Lebanese technology; however, the witness expects that the technology employed in the UK is similar to that employed in Lebanon. Defence Counsel Mr Korkmaz challenged the expertise of the witness in relation to GSM and the Lebanese GSM system, but the Trial Chamber was satisfied that Mr Philips has specialised knowledge, skill, or training that can assist the Chamber to understand or determine an issue in dispute; namely, he has expertise on the workings of GSM generally as applied to cell site analysis.

The Prosecution separated the evidence of the witness in three parts: (i) introduction to cell site analysis; (ii) mission phones; and (iii) single-user analysis of some of the SIM cards of key phones in the case. The Prosecution started with a PowerPoint presentation to explain the telecommunication at stake. The witness first explained some key definitions, including “call data records”, that is the data used for all analyses. This data is provided by mobile phone network providers, in the instant case Alfa and MTC. Mr Philips explains a lot of general technical details in the area of telecommunication, including what best server coverage is (the area over which a cell provides the strongest signal), geographical profiling, frequent number analysis and areas of potential manipulation of call data records.

Despite objections by the Defence, Mr Philips continues his evidence by talking about the situation of the providers MTC and Alfa in Lebanon in 2004-2005. The witness gave a very brief case-specific overview as to the interaction and association between mission phones. The mission phone groups are associated with the mission, and the mission is a crime. The Red phone group, the inner group, would appear to be associated with that particular crime, given their geographical location, timing and build-up in the period before the crime. The Blue group has, from a cell sites analyses perspective, no association with the crime but can be linked to the Red group; the same can be said for the Green group. There appears to be a common element between the Red, Blue and Green phone groups, as there is one single user who has a Blue, a Red and a Green phone. Mr Povas explains that it is the Prosecution’s case that this single user is Salim Ayyash.

Mr Courcelle-Labrousse, Defence Counsel for the accused Oneissi, cross-examined the witness about the lack of relevance of his report for the Lebanese situation, and his lack of specific knowledge about the Lebanese GSM configuration. Mr Philips accepted that when you implement a GSM network, the areas you need to cover may have different topographical specifics depending on the location. Defence Counsel Mr Young, for the accused Sabra, dealt with a very technical matter, namely congestion issues, the so-called "anomalies". Mr Philips has talked about the possibility that sudden heavy usage of cells causes an anomaly. Examples giving by the witness are football matches and sports events. Mr Young introduced the idea that the explosion on the 14 February could have caused such an anomaly, referring to previous witnesses who explained that there were problems using their phones after the explosion. The witness thinks that this is possible but only after the incident occurred and centered around that particular area. Judge Re requested the Prosecution to research the potential damage or destruction of cell sites in the area of the St. Georges Hotel, which could also be of influence on the cell site information.  

Further, Mr Young questioned the witness about the potential for manipulation of call data records. A former employee of the Prosecution told the witness in an earlier stage that some held the view that the phone evidence that was used in this case was false. At that moment the testimony was interrupted over a dispute about the disclosure of documents. A document relating to this conversation between the witness and the former employee of the Prosecution has not been disclosed by the Prosecution to the Defence. The Prosecution immediately disclosed the said document and, having read the document, the Defence made an application to adjourn the cross-examination of Mr Philips on the points covered in this particular document, including whether there have been manipulations of call data records. The Chamber granted the application and therefore the cross-examination was postponed.