Nov 18, 2015

Evidence on the origin of the SIM cards allegedly used by those responsible for the bomb attack

During the beginning of September the Prosecution called various witnesses to present evidence on the origins and nature of the network phones and SIM cards allegedly used by the accused in preparing and organising the bomb attack. The Prosecution intends to show that all SIM cards were purchased anonymously. Further, in relation to the red network phones, it is the Prosecution's case that the SIM cards were sold by a mobile telephone distributor to witness PRH553 on 24 December 2004 and delivered to his shop in Tripoli. At some point between 24 December 2004 and 4 January 2005 witness PRH553 sold the eight red network cards, but the Prosecution cannot establish to whom these were sold. Attached to the forms for these SIM cards were identification documents of customers from the Tripoli area, all of whom had purchased their own SIM cards during the holiday period. On 4 January 2005 the eight red network SIM cards were activated.

Mr El-Ajouz (31 August, 1 and 2 September 2015)

Mr El-Ajouz is the owner of Power Group, a mobile telephone distributor. Power Group distributes pre-paid and post-paid SIM cards, scratch cards (to recharge pre-paid SIM card) and handsets to hundreds of dealers in Lebanon. Power Group is an authorised distributor of Alfa products. One of the businesses to which distribution took place was run by witness PRH553 (see further below).

Mr El-Ajouz testifies about the storage and documentation of the products, which, among others, can be tracked through their serial number or bar codes on a form. The witness is commenting on a number of records (including delivery notes, receipt vouchers, and purchase overviews of a particular point of sale) of pre-paid SIM cards for lines claimed to be part of the networks used by these accused. These lines were coming from Alfa and were on-sold to a distributor in Tripoli.

When Power Group sold a group of pre-paid lines, the dealer could fill out a form including a bar code, the subscriber's name and other personal information, and a copy of the purchaser’s ID; this was sent to Alfa. However, this form was only completed for about 20% of the telephone lines. The IDs were not checked by Power Group. For post-paid SIM cards the completion of a form, including a copy of an ID, is obligatory.

During cross-examination Defence counsel is confronting the witness with reports claiming a link between an organisation he’s involved in, the Islamic Charity Projects Association, and the Syrian intelligence, which link the witness denies. Unfortunately, the transcript of 1 September has not (yet) been published and therefore the remainder of the cross-examination remains unknown or unclear for the moment.

Mr Jihad Hassan Tannir (2 September)

Mr Tannir is the former general manager of a wholesale company called Celltec. This was a similar company to Power Group - about which previous witness Mr El-Ajouz testified - in that they distributed Alfa telecommunications products. Mr Tannir explained that Celltex purchased SIM cards and recharge cards from Alfa and distributed these products to its outlets. The witness explains the procedures in distributing telephone lines, which is again similar to evidence given by Mr El-Ajouz on the practices that existed within Power Group, although Celltext also sold products to end users in its own shop. The witness comments on a number of documents, including application forms and invoices, for SIM cards that went through his firm and are claimed to have been used by the accused. Payment options for post-paid cards included payment by the customer in a branch of a certain bank or directly to Alfa, and thus there was no need to provide banking information on the application forms.

PRH090 (2 September)

Witness PRH090 is listed as the subscriber of a pre-paid mobile phone number which was used from October 2004 until September 2005 as one of the blue network phone numbers and which was particularly important in the weeks preceding the bomb attack on Hariri according to the Prosecution. The witness explained in his statement that the application form for this phone number does not contain his handwriting and that most of the information is incorrect; moreover his signature is not on the form, but it is a copy of his ID that is attached to the application. PRH090 had previously purchased a telephone number and left a copy of his identity card at the shop; he has never lost his identity card.

PRH702 (3 September)

Witness PRH702 is another witness whose name is listed as the subscriber of a mobile telephone which the Prosecution allege was part of the blue network. The witness was shown the application form for this phone number and he does not recognise the telephone number; also some of his personal information, including the spelling of his name and his address, are incorrect. He also does not recognise the handwriting on the form nor the signature. PRH702 had purchased a new SIM card towards the end of 2004 and provided an identity card during the transaction.

PRH553 (8-10 September)

Witness PRH553 owned a small mobile phone shop in Tripoli, and was involved in the wholesale and retail of mobile phone products, including SIM cards, recharge cards, handsets and mobile phone accessories. PRH568, who was very experienced in this business and able to get good prices from the dealers, was the shop manager; he dealt with the suppliers and served the customers. The group of suppliers included Power Group, Alliance, Celltec and Kettaneh. They were re-selling Alfa and MTC products, also to other shops.

The witness did not keep any records of the products sold at this shop. It was up to the other shops to complete the application form for the pre-paid cards, although the shops would receive 3 dollar for each completed form for a line (and the shop owned by PRH553 even charged 5 dollar for not completing a form); this is why forms were completed with incorrect information; any ID they had or was given to them by a shop was attached. They were able to use the same ID for tens of pre-paid phone lines. The shop filled in the forms, and very rarely did the customer himself do this. Whenever a customer did not provide an ID card, the witness would fill in the form and put in an ID card in order to recover the money. Very rarely did the form match the identity of the buyer of the SIM card, and the witness would make up the names, addresses, dates and signatures. According to the witness “[t]here was nobody carrying a line with his own name unless we are talking about the post-paid cards or the fixed lines.” Therefore, the Prosecution's theory that all network telephone lines used by the accused were obtained anonymously, seems to apply to almost all (pre-paid) telephone lines in Lebanon at that time.

In September 2005, the witness was charged with having falsified personal papers, and using these falsified papers in relation to the activation forms for the eight SIM cards of the red network. He has been incarcerated for almost three years by the Lebanese authorities but no trial was ever held. The Defence confronts PRH553 with a number of possible contradictions between his previous statements and his testimony in court. However, some of the interrogation of the witness by the Lebanese authorities took place under very harsh conditions and without access to a lawyer.

Defence Counsel Mr Mettraux is questioning the witness about telephone calls between his shop manager, PRH568 (a dropped Prosecution witness), and the Tripoli sales person from Power Group around the date of purchase of the red network cards in December 2005; the Defence also claims to have evidence that shows contact between PRH568 and the Syrian military intelligence. There is also a small dealer, whose name is kept confidential in court ('number six’), about whom the witness and PRH568 remembered that PRH568 sold him ten lines in early January 2005, but they did not remember the exact date of the sale. Therefore it is unknown whether these were the same ten lines as used by the red network. The witness does not remember to whom he sold the red network lines. Further, the Defence has evidence of a number of phone calls between PRH568 and number six (and the assistant of number six) on 30 December 2004, so possibly the sale of these ten lines could have been on this date. The witness also explains that the dates on the forms are not necessarily accurate, with the date on the forms for the red network lines being 12 January 2005.

For the moment it remains unclear to whom these red network telephone lines were sold and if and how they came into the hands of the accused.

Nov 3, 2015

More evidence on telecommunication: Expert John Edward Philips

Prior to the recess the Prosecution already explained that the focus in the next months will be telecommunication. Mr Philips, who gave testimony from 18 until 26 August, is an expert witness in the area of cell site analyses, who will describe the technical working of mobile companies and networks. At the request of the Prosecution he wrote a report called “Cell Site Analyses as Applied to GSM Networks” dated 24 September 2012.

Mr Philips worked for Marconi Communication Systems for 15 years. During this time he was invited to publish numerous technical papers on the topic of mobile radio communications and he was active on a number of industry-wide technical committees in relation to mobile radio technology. Thereafter he became head of design and development at Multitone Electronics and he was the secretary of the European paging association. Subsequently he became an engineer at British Telecoms and worked as a cell site analyst. Because of his work he was invited to sit on the GSM specification committee.

His expertise in cell site analysis involves taking the data that is produced by the system and analysing it. He mainly worked in the UK and is not specifically an expert on Lebanese technology; however, the witness expects that the technology employed in the UK is similar to that employed in Lebanon. Defence Counsel Mr Korkmaz challenged the expertise of the witness in relation to GSM and the Lebanese GSM system, but the Trial Chamber was satisfied that Mr Philips has specialised knowledge, skill, or training that can assist the Chamber to understand or determine an issue in dispute; namely, he has expertise on the workings of GSM generally as applied to cell site analysis.

The Prosecution separated the evidence of the witness in three parts: (i) introduction to cell site analysis; (ii) mission phones; and (iii) single-user analysis of some of the SIM cards of key phones in the case. The Prosecution started with a PowerPoint presentation to explain the telecommunication at stake. The witness first explained some key definitions, including “call data records”, that is the data used for all analyses. This data is provided by mobile phone network providers, in the instant case Alfa and MTC. Mr Philips explains a lot of general technical details in the area of telecommunication, including what best server coverage is (the area over which a cell provides the strongest signal), geographical profiling, frequent number analysis and areas of potential manipulation of call data records.

Despite objections by the Defence, Mr Philips continues his evidence by talking about the situation of the providers MTC and Alfa in Lebanon in 2004-2005. The witness gave a very brief case-specific overview as to the interaction and association between mission phones. The mission phone groups are associated with the mission, and the mission is a crime. The Red phone group, the inner group, would appear to be associated with that particular crime, given their geographical location, timing and build-up in the period before the crime. The Blue group has, from a cell sites analyses perspective, no association with the crime but can be linked to the Red group; the same can be said for the Green group. There appears to be a common element between the Red, Blue and Green phone groups, as there is one single user who has a Blue, a Red and a Green phone. Mr Povas explains that it is the Prosecution’s case that this single user is Salim Ayyash.

Mr Courcelle-Labrousse, Defence Counsel for the accused Oneissi, cross-examined the witness about the lack of relevance of his report for the Lebanese situation, and his lack of specific knowledge about the Lebanese GSM configuration. Mr Philips accepted that when you implement a GSM network, the areas you need to cover may have different topographical specifics depending on the location. Defence Counsel Mr Young, for the accused Sabra, dealt with a very technical matter, namely congestion issues, the so-called "anomalies". Mr Philips has talked about the possibility that sudden heavy usage of cells causes an anomaly. Examples giving by the witness are football matches and sports events. Mr Young introduced the idea that the explosion on the 14 February could have caused such an anomaly, referring to previous witnesses who explained that there were problems using their phones after the explosion. The witness thinks that this is possible but only after the incident occurred and centered around that particular area. Judge Re requested the Prosecution to research the potential damage or destruction of cell sites in the area of the St. Georges Hotel, which could also be of influence on the cell site information.  

Further, Mr Young questioned the witness about the potential for manipulation of call data records. A former employee of the Prosecution told the witness in an earlier stage that some held the view that the phone evidence that was used in this case was false. At that moment the testimony was interrupted over a dispute about the disclosure of documents. A document relating to this conversation between the witness and the former employee of the Prosecution has not been disclosed by the Prosecution to the Defence. The Prosecution immediately disclosed the said document and, having read the document, the Defence made an application to adjourn the cross-examination of Mr Philips on the points covered in this particular document, including whether there have been manipulations of call data records. The Chamber granted the application and therefore the cross-examination was postponed.