R248221 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
BEFORE THE TRIAL CHAMBER SPECIAL TRIBUNAL FOR LEBANON
Case No: STL-ll-OllPT/TC
Before: Judge David Re, Presiding Judge Janet Nosworthy Judge Micheline Braidy Judge Walid Akoum, Alternate Judge
Registrar: Mr. Daryl Mundis
Date: 31 October 2013 Filing Party: Prosecutor
Original language: English Classification: Public
THE PROSECUTOR v. SALIM JAMIL A YY ASH, MUSTAFA AMINE BADREDDINE, HUSSEIN HASSAN ONEISSI & ASSAD HASSAN SABRA
Redacted Version of the Prosecution's Updated Pre-Trial Brief, dated 23 August 2013
Office of the Prosecutor: Counsel for Mr. Salim Jamil Ayyash: Mr. Nonnan Farrell Mr. Eugene Q'Sullivan Mr. Emile Aoun
Legal Representatives of Victims: Counsel for Mr. Mustafa Amine Badreddine: Mr. Peter Haynes Mr. Antoine Korkmaz Mr. Mohammad F Mattar Mr. John Jones Ms. Nada Abdelsater-Abusamra Counsel for Mr. Hussein Hassan Oneissi: Mr. Vincent Courcelle-Labrousse ~----~ PUBLIC R248222 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
I. INTRODUCTION ...... 1 11. THE ACCUSED ...... 3
A. MUSTAFA AMINE BADREDDINE ...... 3 B. SALIM JAMIL AYYASH ...... 5 C. HUSSEIN HAS SAN ONEISSI...... 5 D. ASSAD HASSAN SABRA ...... 6 Ill. THE VICTIMS ...... 6
A. RAFIK HARIRI...... 6 B. OTHER VICTIMS ...... 6 IV. THE USE OF PHONE NETWORKS TO PREPARE AND EXECUTE THE ATTACK ...... 7
A. THE RED NETWORK ...... 7 B. THE GREEN NETWORK ...... 8 C. THE BLUE NETWORK ...... 9 D. THE YELLOW NETWORK ...... 10 E. THE PURPLE PHONES ...... 11 F. PERSONAL AND SEQUENTIAL MOBILE PHONES ...... 11 v. ATTRIBUTION OF PHONES ...... 12 A.BADREDDINE'sPHONES ...... 14 B. AYYASH's PHONES ...... 18 C. ONEISSI's PHONES ...... 20 D. SABRA's PHONES ...... 20 E. MERHI's PHONES ...... 20 VI. THE CONSPIRACY ...... 22 VII. PREPARATIONS FOR THE TERRORIST ATTACK ...... 22
A. OBSERVATIONS IN PREPARATION FOR THE ATTACK ...... 23 1. Observations between 20 October and 10 November 2004 ...... 24 2. Surveillance on 11 November 2004 ...... 25 3. Observations on 21 December 2004 ...... 25 4. Observations on 30 December 2004 ...... 25 5. Purchase of the Red Network Handsets and Phones ...... 26 6. Observations on 14 January 2005 ...... 26 7. Planned Surveillance on 20 January 2005 ...... 26 8. Observations on 28 January 2005 ...... 27 9. Surveillance and Observations on 31 January 2005 ...... 28 10. Topping up the credit on the Red Network phones ...... 30 11. Surveillance on 3 February 2005 ...... 30 12. Surveillance on 8 February 2005 ...... 32 13. Final preparations before the Attack ...... 34 14. Conclusion as to Observations and Surveillance ...... 35 B. THE PURCHASE OF THE MITSUBISHI CANTER VAN USED AS THE VBIED TO PERPETRATE THE TERRORIST ATTACK ...... 35 C. PREPARATIONS RELATED TO THE FALSE CLAIM OF RESPONSIBILITy ...... 38 VIII. THE TERRORIST ATTACK ...... 42
STL-11-01lPT/TC 31 October 2013 Public Redacted PUBLIC R248223 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
IX. THE DELIVERY OF THE VIDEO AFTER THE TERRORIST ATTACK ...... 47 X. [REDACTED] ...... 52
A. [REDACTED] ...... 52 B. ATTACKS IN KUWAIT ...... 54 C. CONCLUSION ...... 55 XI. CONCLUSION ...... 56
STL-11-01lPT/TC 2 31 October 2013 Public Redacted R248224 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
I. INTRODUCTION
1. On 14 February 2005, at 12:55 on Rue Minet el Hos'n in Beirut, as former Prime Minister Rafik Baha' eddine AL-HARIRI (HARIRI) and his security convoy were returning to his residence at Quraitem Palace from a session of Parliament, a suicide bomber detonated a large quantity of explosives concealed in a Mitsubishi Canter van parked along the side of the road. The resulting explosion killed HARIRI and 21 other persons and injured 226 persons.
2. Shortly after the terrorist attack, AI-Jazeera news network in Beirut received a video with a letter attached on which a man named Ahmad ABU ADASS (ABU ADASS) falsely claimed to be the suicide bomber on behalf of a non-existent fundamentalist group named "Nusra and Jihad Group in Greater Syria". AI-Jazeera broadcast the video.
3. The assassination of HARIRI was the culmination of extensive preparations by a select group of persons with either professional skills andlor experience, who acted together to commit this terrorist attack. The Accused, with others, used phones from five mobile phone groups to communicate while preparing and perpetrating this terrorist attack. On at least 50 days there was surveillance of HARIRI and observations of locations associated with him, beginning, at the latest on 20 October 2004 until the day of the attack, 14 February 2005.
4. The four Accused, Mustafa Amine BADREDDINE (BADREDDINE), Salim Jamil AYYASH (AYYASH), Hussein Hassan ONEISSI (ONEISSI), and Assad Hassan SABRA (SABRA) (collectively, the Accused) conspired with others, including MERHI, to commit this terrorist attack to assassinate HARIRI. BADREDDINE, AYYASH, and others also co-perpetrated the substantive offences of committing a terrorist act, intentional homicide of HARIRI and 21 others, and attempted intentional homicide of 226 others. ONEISSI, and SABRA are accomplices to these offences.
STL-11-01lPT/TC 31 October 2013 Public Redacted R248225 PUBLIC STL-ll-OIIPT/TC Fl 077IPRVl20 131 0311R248221-R248279IEN/nc
5. "Subjects",l including the Accused and MERHI, used phones from five interconnected mobile phone groups to coordinate and monitor the preparations for and perpetration of the terrorist attack. Four of these five phone groups operated as "Networks". A Network is a group of phones with a high frequency of contact amongst the phones within that group.
6. The phone groups, which are colour-coded for ease of reference, are: (i) the Red Network, which was used by, among others, AYYASH, SS, S6, S7, S8, and S9 (collectively, the Assassination Team) for preparing and carrying out the attack; (ii) the Green Network, a group of three phones, used by BADREDDINE, AYYASH, and MERHI to monitor and coordinate the preparations for and perpetration of the attack and the false claim of responsibility; (iii) the Blue Network, a group of 18 phones, 15 of which were used in preparations for the attack and six of which were also used by the Assassination Team; (iv) the Yellow Network, a group of 18 phones, four of which were used by AYYASH and three other members of the Assassination Team while preparing for the attack; and (v) the Purple phones, a group of three phones used by ONEISSI, SABRA and MERHI in preparing and putting into effect a false claim of responsibility for the attack. As described in detail below, these phones have been attributed to the Accused and MERHI based on a variety of established techniques.
7. BADREDDINE monitored and together with AYYASH coordinated the observations2 of HARIRI's residences, Parliament and the eventual crime scene and surveillance3 of HARIRI's movements. Further, BADREDDINE monitored and together with AYYASH coordinated the purchase of the Mitsubishi Canter, which was used as a Vehicle Borne Improvised Explosive Device (VBIED), carrying the equivalent of approximately 2,500 kg of TNT to perpetrate the attack. After these
A Subject is a person who used one or more relevant phones from these phone groups. In this filing, Subjects other than the Accused are identified by the letter "s" and numbers assigned to them by the Prosecution, for example, Subject S is identified as ss. 2 For the purposes of this filing, the Prosecution uses the term "observation" in situations where a specific location is being observed. For the purposes of this filing, the Prosecution uses the term "surveillance" where HARIRI or his movements are being observed.
STL-ll-OllPT/TC 2 31 October 2013 Public Redacted R248226 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
preparations, A YYASH coordinated the perpetration of the attack on HARIRI, which BADREDDINE monitored.
8. BADREDDINE monitored, and together with Hassan Habib MERHI, coordinated the preparation of the false claim of responsibility. AYYASH communicated with MERHI in relation to the false claim of responsibility. ONEISSI and SABRA, together with MERHI, prepared and carried out the false claim of responsibility. Specifically, ONEISSI, SABRA, and MERHI participated in identifying a suitable individual who would be used to make a video-taped false claim of responsibility for the attack, and ensure its dissemination to news agencies immediately after the attack.
9. The carrying out of these steps, either individually or cumulatively - observation, surveillance, the purchase of certain covert phones used by the Assassination Team,4 the purchase of the van suitable to carry the equivalent of approximately 2,500 kg of TNT by persons using false names, the selection of someone for use in making a false claim of responsibility, the coordination or monitoring of preparations and of the attack itself and the dissemination of a false claim of responsibility to shield the perpetrators from justice - shows the degree of participation by various members of the conspiracy, the level of coordinated action and the shared intent of the Accused.
11. THE ACCUSED
A. Mustafa Amine Badreddine
10. BADREDDINE was born on 6 April 1961 in AI-Ghobeiry, Beirut, Lebanon. He is the son of Amine Badreddine (father) and Fatima Jezeini (mother). He is a citizen of Lebanon with civil registration number 3411AI-Ghobeiry.5 He is a Shiite Muslim and a supporter of Hezbollah, 6 which is a political and military organization in Lebanon. 7
4 See paragraph 8, below. R91-801010; R91-801008 p. 60230562. 6 R91-801008 p. 60230562; R91-801009 pp. 60236242, 60236244; R91-801010; R91-300200 pp. 60236185,60236186. 7 R91-100040 paras. 36-82.
STL-11-01lPT/TC 3 31 October 2013 Public Redacted PUBLIC R248227 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
11. BADREDDINE operates under various aliases, including: "Sami (or Sam) IS SA", "Elias Fouad SAAB", and "Safi BADR".8 Two aliases, "Sami ISSA" and "Elias Fouad SAAB", are of particular relevance to this case.
12. A number of characteristics ascribed to 'Sami IS SA' are consistent with his being BADREDDINE. They share similar physical characteristics, such as having problems with their leg, both having burnt a leg on a heater as a result of lack of feeling, wearing special shoes, and having poor eyesight. They also share a birthday on 6 April, are Shiite Muslim, and are supporters of Hezbollah. 9 BADREDDINE was registered at the Lebanese American University (LAU) where he studied political sciences from 2002-2004, although those who knew him did not know him under his real name, but rather as 'Sami ISSA' or 'Safi BADR'. 'Sami ISSA' asked an LAU classmate to pick up the degree certificate of a friend named "Mustafa BADDREDINE", who was abroad and could not collect his degree certificate in person. Although the classmate had not known a "Mustafa BADDREDINE" at LAU, he collected the degree and handed it to Sami ISSA. lO
13. In addition, various telephones attributed to BADREDDINE and Sami ISSA provide further compelling evidence that the two are one and the same.
14. As "Sami ISSA", BADREDDINE owned a jewellery store called "Samino", a boat of the same name, and an apartment in Sahel Alma, an area in Jounieh, where he entertained friends. All these assets were registered in other people's names.!!
15. On 27 March 1984, BADREDDINE, was convicted in Kuwait as "Elias Fouad SAAB" for a series of terrorist attacks along with other individuals.!2 Just as
R91-801025 p. 60222602-60222605; R91-300094 pp. 60228566-60228573; R91-801027 pp. 60229603- 60229609; R91-300195 paras. 5-12; R91-801023 transcript pp. 1-35; R91-801024 transcript pp. 411; R91- 300193 transcript pp. 4f1; R91-801026 transcript pp. 11/1; R91-801028 p. 60222486 para. 20; R91-300260 p. 60269764 para. 8; R91-300232 pp. 60254598-60254607. R91-801010; R91-801008 p. 60230562; R91-801009 pp. 60236242, 60236244, transcript pp.28-30; R91- 300193 pp. 60223304-60223306; R91-300232 p. 60254602; R91-300200; R91-801028 pp. 60222483- 60222492; R91-801027 pp. 60229603-60229609. 10 R91-801025 pp. 60222600-60222605; R91-300094 pp. 60228566-60228573; R91-801027 pp. 60229603- 60229609; R91-300195 paras. 5-66; R91-801023 transcript pp. 1-35; R91-801024 transcript p. 8; R91- 300260 pp. 60296763-60296766; R91-300193 pp. 60223303-60223307; R91-801026 pp. 60228615- 60228619; R91-801027 pp. 60229603-60229609; R91-801028 pp. 60222483-60222492; R91-300257 pp. 60267198-60267202. 11 R91-300179; R91-801027, pp. 60229603-60229609; R91-300093, pp. 60220462-60220475.
STL-11-01lPT/TC 4 31 October 2013 Public Redacted R248228 PUBLIC STL-ll-OIIPT/TC Fl 077IPRVl20 131 0311R248221-R248279IEN/nc
BADDREDINE coordinated the preparations for the HARIRI attack, 'SAAB' coordinated the preparations for the series of attacks in Kuwait, including an attack in
which a suicide bomber drove a truck loaded with explosives into an embassy. 13 He was sentenced to death, but he escaped from prison when Iraq invaded Kuwait in 1990. One of the co-accused also convicted with 'SAAB' was Hussein El-Moussawi, another Lebanese national. BADREDDINE and "SAAB" share similar physical
characteristics, including a leg problem and poor eyesight. 14
B. Salim Jamil Ayyash
16. AYYASH was born on 10 November 1963 in Harouf, Lebanon. He is the son of
Jamil Dakhil Ayyash (father) and Mahasen Issa Salameh (mother). 15 He is a Lebanese citizen with civil registration number 197/Harouf. 16 His Hajj passport number is
059386, 17 and his social security number is 63/690790. 18 He is a Shiite Muslim and a
supporter of Hezbollah. 19
C. Hussein Hassan Oneissi
17. ONEISSI, a Shiite Muslim, was born HUSSEIN HASSAN ISSA on 11 February 1974 in Beirut, Lebanon, and he is also known by that name. He is the son of Hassan Oneissi (also known as 'Hassan Issa') (father) and Fatima Darwich (mother). He is a Lebanese citizen with civil registration number 7/Shhour.2o On 2 January 2004 HUSSEIN HAS SAN ISSA filed with the Civil Court of Jouaiya to change his
12 R91-300064. 13 R91-300282. 14 R91-300282 pp. 60274631, 60274775-60274776; R91-801009, pp. 60236244-60236245. 15 R91-801004. 16 R91-801136. 17 R91-801134. 18 R91-100615; R91-801122. 19 R91-100318; R91-100319; R91-801070 para. 39; R91-801112 p. 60147257; R91-100391; R91-801143; R91-801766 pp. 60217343-60217344. 20 R91-300006; R91-300068.
STL-II-01lPT/TC 5 31 October 2013 Public Redacted R248229 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
surname to ONEISSI. That application was granted on 12 January 2004.21 He is a supporter of Hezbollah. 22
D. Assad Hassan Sabra
18. SABRA, a Lebanese citizen, was born on 15 October 1976 in Beirut, Lebanon. He is a Shiite Muslim born to Hassan Taan Sabra (father) and Leila Saleh (mother). His Lebanese civil registration is 1339/Zqaq AI-Blat. 23 He is a supporter of Hezbollah.24
Ill. THE VICTIMS
A. Rajik Hariri
19. Rafik Baha'eddine AL-HARIRI (HARIRI) was born on 1 November 1944 in the city of Sidon, Lebanon. He was a Sunni Muslim.25 HARIRI served as Prime Minister of Lebanon in five governments from 31 October 1992 to 24 December 1998, and from 26 October 2000 until his resignation on 26 October 2004.26 After his resignation, HARIRI started preparing for parliamentary elections which were due to start in late May 2005.27 HA RI RI resided at Quraitem Palace in Beirut.28 He also spent time at a family home at Faqra, 29 in Faraya, an area northeast of Beirut.
B. Other Victims
20. Twenty one people were killed in addition to HARIRI30 including seven members of HARIRI's convoy/l Bassel Fuleihan, who was travelling in HARIRI's car/2 and thirteen bystanders. As a result of the attack, 226 people were injured. 33
21 R91-300007. 22 R91-300056 p. 60223025. 23 R91-300006. 24 R91-800969; R91-800972 p. 60185490; R91-800966. 25 R91-602957. 26 R91-400002. 27 R91-200081; R91-200098; R91-400003. 28 R91-200088. 29 R91-200129, para.36. 30 R91-602957; R91-100278; R91-400175; R91-600023; R91-606416
STL-11-01lPT/TC 6 31 October 2013 Public Redacted R248230 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
IV. THE USE OF PHONE NETWORKS TO PREPARE AND EXECUTE THE ATTACK
21. The Accused, MERHI, and other Subjects used phones from five mobile phone groups to communicate while preparing and perpetrating the terrorist attack against HARIRI.34 Four of these five phone groups operated as Networks.35 The Network phones were not used in the same way as personal mobile phones (PMPs). They are used for specific activities. As a result, the vast majority of calls from Network phones are made to other phones within the same Network in relation that activity.
22. Each phone group has been colour-coded for ease of reference. Where the term 'phone' is used below it indicates the relevant Subscriber Identification Module (SIM) which determines what is commonly referred to as the phone number.36 Where the International Mobile Equipment Identities (IMEIs), or handsets, are discussed, this is done specifically.
A. The Red Network
23. The Red Network consisted of eight phones which were activated on 4 January 2005 and operated from 14 January 2005, until they ceased all activity two minutes before the attack on 14 February 2005. 37 Red Network phone users communicated almost exclusively with each other and did not use Short Message Service (SMS).38 Subjects used Red Network phones to communicate while observing HARIRI, including his residences and movements, Parliament, the crime scene, and other locations between 14 January 2005 and 12 February 2005. In particular, AYYASH and the other
31 R91-100222, para. 9. 32 R91-100222, para. 9. 33 R91-400005; R91-400011-R91-400149, R91-400151-R91-400157; R91-400167-R91-400169; R91- 400171-R91-400172; R91-400178; R91-400182. 34 R91-200273; R91-200334 35 R91-200273 36 R91-800173, p. 26. 37 R91-200273, p. 39, para 151; R91-200334 p156, para 464. 38 R91-200273, p. 41, para 158 (excluding service numbers, 99.41 % of all Red Network communications were with each other).
STL-11-01lPT/TC 7 31 October 2013 Public Redacted PUBLIC R248231 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
members of the Assassination Team used SIX of the Red Network phones to
communicate while preparing and carrying out the assassination of HARIRI. 39 The Red Network phones are identified with their short-names in the table below:
Red Network 3292572 3125636 3129652 3478662 3129678 3123741 3129893 3127946 Number Short-name Red 572 Red 636 Red 652 Red 662 Red 678 Red 741 Red 893 Red 946
24. The Red Network phones were obtained through applications supported by
fraudulently-used identification documents. 40 They were activated on 4 January 2005 within 30 minutes of each other in the Tripoli area and each phone contacted a service number associated with handling phone credit.41 They were provided with additional credit within a 45 minute period in the Tripoli area on 2 February 2005.42 There was also handset (IMEI) swapping amongst the eight Red Network phones, which further demonstrates a relationship between the users of the Red Network phones.43
B. The Green Network
25. The Green Network consisted of three phones which were used from at least 30 September 2004 to 14 February 2005.44 From 13 October 2004 until they ceased all activity on 14 February 2005, about one hour before the attack, the users of the Green Network phones communicated exclusively with each other45 and did not use SMS.46 BADREDDINE, who monitored and coordinated the preparations of the attack and the false claim of responsibility and who monitored the attack, and AYYASH, who coordinated the preparations and the attack, communicated with each other using their Green Network phones.47 BADREDDINE and MERHI also communicated with each
39 R91-200334. 40 R91-801461, p. 3, para. 10. 41 R91-200273, p. 39, para. 152. 42 R91-200273, p. 39 para. 153. 43 R91-200273, p. 46 paras. 176, 180. 44 R91-200273, p. 73 para. 34; p 73 para. 345. 45 This statement does not include communication with service numbers. 46 R91-200273, p. 73 para. 340; p. 76 para. 361; p. 78 para. 377; p. 80 para. 394. 47 R91-200334.
STL-II-01lPT/TC 8 31 October 2013 Public Redacted R248232 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
other using their Green Network phones.48 The three Green Network phones are identified with their short-names in the table below:
Green Network 3140023 3150071 3159300 Number Short-name Green 023 Greeu 071 Green 300
26. The Green Network phones were part of a larger group of 18 Green Phones which were linked, through subscribers, activation dates and in some cases sequential order of phone numbers.49 False documents, belonging to nine individuals, were used to obtain the Green Phones. 50 All 18 Green Phones were deactivated by Alfa, a Lebanese telecommunications provider, in August 2005.51
C. The Blue Network
27. The Blue Network consisted of 18 phones which operated as a Network between 18 October 2004 and 1 October 2005. 52 Fifteen of these phones were used for preparations for the attack, including for surveillance of HARIRI between 18 October 2004 and 14 February 2005.53 These 15 phones communicated almost exclusively with each other54 and had almost no SMS use. AYYASH and the other members of the Assassination Team used six of these 15 phones.55 The 15 Blue Network phones used in relation to the attack are identified with their short-names in the table below:
Blue Network 3071233 3043585 3197610 3067324 3197817 3198864 3071235 3079501 Number Short-name Blue 233 Blue 585 Blue 610 Blue 324 Blue 817 Blue 864 Blue 235 Blue 501
48 R91-200334; ERN:D0327905-D0327910; R91-801452, p. 264, para. 758-759; D0327911-D0328017, pp. 48-72, paras. 114-192. 49 R91-200273, p. 72, para. 337. 50 R91-801461, pp. 3-10, paras 10-33 51 R91-200273, p. 73, para. 343. 52 R91-200273, p. 83, paras. 407-411 53 R91-200334. 54 From a high of 100% in October to a low of97.11 % in December. See R91-200273, p. 84, para 431. 55 R91-200273 p82-139.
STL-11-01lPT/TC 9 31 October 2013 Public Redacted PUBLIC R248233 STL-ll-OIIPT/TC Fl 077IPRVl20 131 0311R248221-R248279IEN/nc
Blue Network 3067322 3193428 3196742 3020967 3198940 3846965 3196813 Number Short-uame Blue 322 Blue 428 Blue 742 Blue 967 Blue 940 Blue 965 Blue 813
28. Blue Network phone users swapped handsets (IMEIs) with each other and with the users of certain Yellow Network phones, which further demonstrates the inter relationship of these users and a connection between the Networks. 56 No legitimate subscriber of any of the Blue Network Phones has been traced. 57
D. The Yellow Network
29. The Yellow Network consisted of 18 phones activated between 1999 and 2003 and operational until approximately 7 January 2005. Of these 18 phones, 13 were used between 1 September 2004 and 7 January 2005.58 AYYASH and three other members of the Assassination Team used four of the Yellow Network phones in preparations for the attack. 59 The call activity of these four phones involved contact with other Yellow Network phones almost exclusively.6o The four Yellow Network phones used in relation to the attack are listed below with their short-names:
Yellow Network 3205294 3345457 3971933 3712024 Number Short-name Yellow 294 Yellow 457 Yellow 933 Yellow 024
30. The users of certain Yellow Network Phones used the same handsets (IMEIs) as certain Blue Network phones and two of AYYASH's PMPs (PMP 165 and 170), demonstrating a relationship amongst the users.61 One of the Yellow Network phones
56 R91-200273, p. 85, para. 420-421 57 R91-801461, pp.10-25, paras. 34-88 58 R91-200273, pp. 144-150, paras. 722-749. 59 R91-200334. 60 R91-200273, pp. 144-150, paras. 722-749. 61 R91-200273, p. 149.
STL-11-01lPT/TC 10 31 October 2013 Public Redacted R248234 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
subsequently became an A YYASH PMP (Yellow 170).62 No legitimate subscriber of any of the Yellow Network phones has been traced.63
E. The Purple Phones
31. The Purple phones were a group of three personal mobile phones, which were used from at latest January 2003 until 16 February 2005.64 Purple phones were used to communicate amongst each other and to communicate with others outside the group. 65 ONEISSI, SABRA, and MERHI, who were involved in the false claim of responsibility, used Purple phones to communicate with each other. 66 The Purple phones are listed below with their short-names:
Purple Phoues 3598095 3419018 3575231 Number Short-name Purple 095 Purple 018 Purple 231
32. The named subscriber for Purple 095 and Purple 231 did not purchase either phone. 67
F. Personal and Sequential Mobile Phones
33. In addition to ONEISSI, SABRA, and MERHI, whose Purple phones were PMPs, BADREDDINE and AYYASH also used PMPs in addition to their network phones. AYYASH used PMPs for contact with MERHI, as well as for contact with friends and family.68 BADREDDINE used PMPs for contacting friends and family and for work/business purposes. In addition, BADREDDINE used nine 'sequential mobile phones' (SMPs) between January 2003 and August 2006.69 SMPs were used in sequential order, meaning that each phone was used for a period of weeks or months
62 R91-801194, p. 76, para. 182. 63 R91-801461 pp. 36-46. 64 R91-200334 pp. 59-367 ; R91-801568, p.3, para. 1; R91-801738, p.3 para. 1. 65 R91-800077; R91-800075; R91-800076; R91-801568, p. 12-14, para. 34; R91-801738, p. 13-14 para. 27. 66 R91-200334, pp. 59-367. 67 R91-801461, p. 46, para. 168. 68 R91-801194; ERN:D0327911- D0328017, para. 43; D0328018-D0328115, paras. 51, 105,352-353,369- 372. 69 R91-801452, p. 22-24, para. 64(b); p. 12 paras. 22-23.
STL-11-01lPT/TC 11 31 October 2013 Public Redacted PUBLIC R248235 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
and then replaced by another. The number of SMP phone contacts was limited and
SMS use was minimal. 70
v. ATTRIBUTION OF PHONES
34. The attribution of the phones to each subject relies on a variety of recognised attribution techniques including; witness evidence, documentary evidence, analysis of frequently called numbers and the links between the persons associated with those numbers and the user of the main phone, analysis of SMS content, IMEI swapping (ie analysing the use of different SIM cards, in the same handset) co-location, cell utilisation analysis and other additional attribution points that link an individual to one or more phones. 71
35. Co-location is a term used to describe two or more mobile phones utilising cell sites or cell towers (cells) in the same area as one another or travelling over the same route over the same time period such that the users of the mobile phones could be together. In other words the cell usage of the two phones is analysed and if they are using the same or closely located cells close in time or the cell usage analysis shows they travel
together, they can be said to be co-located. 72
36. Cell utilisation analysis involves companng the most common cells used by a phone/the pattern of cells used by a phone against the known geographical movements of a person or the cell utilisation by another phone. For example one might expect a person's mobile phone to use cells close to their work during the day time and close to their home at night (depending on their lifestyle and the user of the mamp. h one. ) 73
37. AYYASH and BADDREDINE along with certain other Subjects carried and used multiple phones from different networks.74 In addition, AYYASH also carried and
70 R91-801452, pp. 86-222. 71 R91-800173, pp. 133-156. 72 R91-800173, p. 143. 73 R91-800173, p. 150. 74 R91-200273, p. 5, para. 9.
STL-11-01lPT/TC 12 31 October 2013 Public Redacted PUBLIC R248236 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
used PMPs and BADDREDINE also carried and used PMPs and SMPs. MERHI used a Green Network phone and a Purple Phone.75
38. The table below sets out a list of all phones used by each of the Accused during the relevant period as well as relevant Yellow Network, Blue Network, Green Network, and Red Network phones, and Purple Phones used by Subjects. In cases where one individual used multiple phones, all phones attributed to that individual have been listed.76
Red Green Blue Yellow Purple PMPs/SMPs Network Network Network Network Phones BADREDDINE 3140023 3966663 (PMP 663 Green 023 3833354 (PMP 354) 3476683 (SMP 683) 3293944 (SMP 944) 3103195 (SMP 195) 3121486 (SMP 486) 3442593 (SMP 593) AYYASH 3123741 3159300 3071233 3205294 3767165 (PMP 165) Red 741 Green 300 Blue 233 Yellow 294 3523935 (PMP 935) 3831170 (PMP 170) 3020091 (PMP 091) ONEISSI 3598095 Purple 095 SABRA 3419018 Purple 018 MERHI 3150071 3575231 Green 071 Purple 231 S5 3125636 3043585 Red 636 Blue 585 S6 3129678 3197610 3345457 Red 678 Blue 610 Yellow 457 S7 3127946 3067324 Red 946 Blue 324 S8 3129893 3197817 3971933 Red 893 Blue 817 Yellow 933 S9 3129652 3198864 Red 652 Blue 864 S10 3478662 Red 662 Sl1 3292572 Red 572 S12 3071235 Blue 235 S13 3079501
75 ERN:D0327911-D0328017, pp. 48-72, paras. 114-192. 76 The table relies on R91-200273, R91-801194, R91-801452, R91-801568, and R91-801738.
STL-11-01lPT/TC 13 31 October 2013 Public Redacted PUBLIC R248237 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
Blue 501 S14 3067322 Blue 322 S18 3193428 Blue 428 S19 3196742 Blue 742 S23 3020967 Blue 967 n/a 3198940 Blue 940 n/a 3846965 Blue 965 n/a 3196813 Blue 813
A. BADREDDINE's Phones
39. BADREDDINE has two PMPs, nine SMPs and one Green Phone attributed directly to him, or via his alias 'Sami ISSA'.77
40. PMP 663 is attributed through witness statements, SMS content, cell utilisation analysis, contacts profile, and other additional attribution points. Witnesses attribute this telephone to 'Sami IS SA' or 'Safi BADR'.78 The user ofPMP 663 identified himself as 'Sami ISSA', Sami Samino or Samino in SMS messages.79 The user of PMP 663 received a total of seven text messages containing birthday greetings on 6 April 2004 and 2005, BADREDDINE's birthday.80 The user ofPMP 663 attended university at the same time BADREDDINE attended the LAU. PMP 663 contacts include known 'Sami IS SA' girlfriends, 'Sami ISSA' university friends, 'Sami ISSA' bodyguards and personal and business associates of 'Sami ISSA' as well as Badreddine family members and Hezbollah members. 81
41. PMP 354 is attributed to both 'Sami ISSA' and BADREDDINE. Witness evidence attributes PMP 354 to 'Sami ISSA' and 'Safi BADR'. Documentary evidence
77 R91-801452, R91-802650. 78 R91-801452, p. 15, para. 39. 79 R91-801452, p. 15, para. 40(a); R91-801016, p. 6, paras. 14-22. 80 R91-801016, p. 5, paras. 24-25. 81 R91-801452, pp. 56-84, paras. 129-203.
STL-11-01lPT/TC 14 31 October 2013 Public Redacted PUBLIC R248238 STL-ll-OIIPT/TC Fl 077IPRVl20 131 0311R248221-R248279IEN/nc
attributes PMP 354 to both 'Sami ISSA' and Mustafa BADREDDINE.82 The user of PMP 354 identified himself as either 'Sam' or 'Sami' with the exception of a short period of time when there was a clear change of usage profile where the user identified herself as Z or Zaza. This and other evidence demonstrate that the phone was used by Zahraa, BADREDDINE's daughter, during this period.83 The contacts profile for PMP 354 includes friends and associates of Sami ISSA as well as ten telephone numbers of known Badreddine family members, as well as the phone number of one Samar Badreddine, who worked at the Great Prophet Hospital. PMP 354 co-locates with PMP 663 and has a similar cell utilisation pattern as PMP 663, the two telephones also share a similar contacts profile. There are also several additional attribution points for PMP 354 linking it to BADREDDINE and the other phones attributed to him. 84
42. There are nine SMPs attributed to BADREDDINE.85 The first is SMP 128 which is attributed from 17 January 2003 to 4 March 2004.86 This telephone co-locates with PMP 663 and PMP 354.87 To give an example of what is meant by co-location, SMP 128 shares 406 days of common use with PMP 663 and 313 days of common use with PMP 354.88 On the days of collective common use, SMP 128 was used within 10 minutes of PMP 663 or PMP 354 a total of 3,869 times. 89 In half of these instances, SMP 128 activated the exact same cell as the PMPs, and overall the distance between the cells activated was less than 1000 metres for 80 percent of calls.9o SMP 128 was in contact with Samino Jewellery associated numbers, Hezbollah members and Badreddine family members. This SMP was also in contact with Salim AYYASH's PMP 165 and never contacted the two BADREDDINE PMPS. 91
82 R91-801452, pp. 56-84, paras. 129-203. 83 R91-801452, p. 250, paras. 711 -712. 84 R91-801452, p. 56-84, para 129-203 ; R91-802650. 85 R91-801452, p. 12 para. 22 86 R91-801452, p. 86 para. 205. 87 R91-801452, p. 86 para. 205. 88 R91-801452, p. 100 para. 250. 89 R91-801452, p. 98 para. 239. 90 R91-801452, p. 98 para. 239. 91 R91-801452, p. 92 para. 230.
STL-11-01lPT/TC 15 31 October 2013 Public Redacted PUBLIC R248239 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
43. The second SMP is SMP 944 and was used from 1 September 2004 to 9 March 2005, throughout the period relevant to the Indictment. This SMP has a similar contacts profile to SMP 128 and utilised similar cells to SMP 128 (although not the same cells as the two telephones were on different networks) and co-located with PMP 663 and PMP 354.92 SMP944 was never in contact with PMP 663 or PMP 354.93
44. Through co-location with the PMPs and the similarity of contacts and cell utilisation with the other SMPs, the subsequent seven SMPs are also attributed to BADREDDINE.94
45. Green 023 is attributed from 6 September 2004 to 14 February 2005 to the user of PMP 663, PMP 354 and SMP 944 through co-location, supported by cell utilisation analysis.95 Green 023's last call was at 11 :58 on 14 February 2005; after this it was never used again. It was deactivated in August 2005.96 Green 023 was used on 57 days. It shared all 57 days of use with PMP 663 and SMP 944 and 37 days with PMP 354.97 Green 023 was never in contact with the PMPs or SMPS.98 It co-located with the PMPs and SMP on all common usage days with no anomalies.99
46. The following telephone attribution evidence supports that 'Sami ISSA' and BADREDDINE are one and the same person:
(i) The two telephones attributable to the "Sami ISSA" alias, namely PMP663 and PMP354 are in contact throughout their attribution period with Badreddine family members'telephones;loo
(ii) the user ofPMP663 (Sami ISSA) received birthday greetings on 6 April which is the birthday of BADREDDINE;
92 R91-801452, p. 101 para. 255. 93 R91-801452, p. 101 para. 257. 94 R91-801452, p. 123-250. 95 R91-801452, p. 264 para. 758-759. 96 R91-801452, p. 264 para. 762. 97 R91-801452, p. 271 para. 783. 98 R91-801452, p. 271 para. 784. 99 R91-801452, p. 271-275.
100 R91-801452, p. 33 para 70; p. 69-70 para. 168
STL-11-01lPT/TC 16 31 October 2013 Public Redacted R248240 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
(iii) the user of PMP663 was at university at the same time BADREDDINE was studying at the LA U;
(iv) a Saudi number IS III contact with the user of PMP663 on the dates BADREDDINE's wife Fatima HARB and her son were in the Kingdom of Saudi A ra bla;· 101
(v) a top contact of the telephones that co-locate with PMP663 (and are therefore attributed to the same user) namely the SMPs, was at the Beirut International Airport on the days that Fatima HARB and her son departed for and returned from the Kingdom of Saudi Arabia;102
(vi) 'Sami ISSA' sent SMS messages mentioning the death of a family member at a time which coincided with the death of a BADREDDINE family member; 103
(vii) analysis of CDRs and SMS content show that there was a second user of PMP354 during the period 29 June 2007 to 9 January 2008, who refers to herself in SMS as Z and Zaza; BADREDDINE's daughter is called Zahraa, SMS content shows this second user of PMP 354 referring to her Dad, and these references correspond to the movements of the user ofPMP 663;104
(viii) the user of PMP 354 called a landline number 1833354, registered to BADREDDINE's sister Saada105 a total of 2,056 times and used call forwarding from PMP354 to her landline on 27 occasions, at a time when Sami ISSA said he was living with his sister;106 the last six digits of this landline match those ofPMP 354;
(ix) PMP 354, which is clearly attributed to "Sami ISSA" is also directly attributed to BADREDDINE107 and a Safi BADR;108
101 R91-801452, p. 10 para. 17(c).
102 R91-801452, p. 53 para. 116
103 R91-801452, p. 53, para. 118.
104 R91-801452, pp. 250-262, paras. 711-757.
105 R91-804366, pp. 10, 15, 17,48; R91-801749, pp. 2, 3.
106 R91-801452, p. 69, para. 168(a).
107 R91-801008 document, p.2.
STL-11-01lPT/TC 17 31 October 2013 Public Redacted PUBLIC R248241 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
(x) the telephone number PMP 354 and co-locating SMPs regularly called Hezbollah related numbers which would be consistent with the profile of BADREDDINE;109 and
(xi) these telephones also contacted the 'Sami ISSA' associated numbers such as Samino Jewellery. 11 0
47. The following telephone attribution supports the evidence that BADREDDINE and 'SAAB' are one and the same: PMP 354 is attributed to BADREDDINE. 'SAAB' was convicted with Hussein EL-Moussawi in Kuwait. Hussein Al Sayed AL MUSAWI is named on the Interpol Terrorism Notices Diffusion List and is currently 'Wanted' for crimes committed in Kuwait.1ll Hussein Al Sayed Youssef AL MU SA WI was the recorded subscriber of 3668280 which was in contact with PMP 354 on 9 occasions. 112 Hussein EI-Sayyed Youssef El-Kontar EI-Hussein EL MOUSSAWI, born in 1955, used the number 3668280 to submit a renewal for a passport in 2001.113 Fingerprint comparison from the passport application with the recorded fingerprints on Interpol confirmed the two to be one and the same person. 114
B. A YYASH's Phones
48. There are four PMPs and four network phones attributed to A YYASH. 115
49. PMP 165 stopped being used on 18 April 2004.116 This telephone is attributed to AYYASH through witness evidence, documentary evidence, contacts profile (family members and known associates), cell utilisation analysis, and additional attribution
108 R91-801452, p. 56. 109 R91-801452. 110 R91-801452, p. 66 para. 166 111 R91-300052, p.1. 112 R91-801806. 113 R91-801806. 114 R91-300091. 115 R91-801194, R91-802651. 116 R91-801194, p. 34 para. 66.
STL-11-01lPT/TC 18 31 October 2013 Public Redacted R248242 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
points. 117 In addition PMP 165 was used in the handset of a car purchased by AYYASH and used in two handsets that were also used by a total of six Yellow
Network phones. 118
50. PMP 935 is attributed to AYYASH between I September 2004 and 13 January 2005. 119 Documentary evidence, the contacts profile, cell utilisation analysis, and additional attribution points such as a car accident AYYASH had on 20 November 2004 and shared handset use demonstrate that this was AYYASH's phone. 120 PMP 935 used the same handset subsequently used by PMP 091 and also used a handset
installed in a vehicle that was purchased by A YYASH. 121
51. PMP 091 is attributed to AYYASH between 13 January 2005 and 6 March 2005. 122 It is attributed through documentary evidence, contacts profile, cell utilisation analysis and additional attribution points including shared handset use with PMP 935 and its contact with a medical clinic on a day that AYYASH's wife had an appointment
there. 123
52. PMP 170 is attributed to AYYASH from 7 January 2005 to 26 November 2005, through documentary evidence, contacts profile, cell utilisation analysis and additional attribution points such as a series of calls made around 25 May 2005 when A YYASH is known to have been involved in a car accident, resulting in the need for
his car to be repaired (and for AYYASH to make telephone calls to facilitate this). 124
53. Yellow 294, Blue 233, Green 300 and Red 741 are attributed through cell utilisation
analysis and co-location. 125
117 R91-801194, p. 50 para. 103.
118 R91-801194, p. 35 para. 69.
119 R91-801194, p. 50 para. 102
120 R91-801194, p. 50 para. 103
121 R91-801194, p. 51 para. 107; p. 53, para. 120.
122 R91-801194,p. 31 para. 59(c).
123 R91-801194, p. 64, para. 142; p73 para. 170.
124 R91-801194, p. 85, para. 212
125 R91-801194, p. 93 para 234; p.107, para. 285; p. 119, para. 324.
STL-11-01lPT/TC 19 31 October 2013 Public Redacted R248243 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
C. ONEISSI's Phones
54. ONEISSI is the user of Purple 095. This phone is attributed to him through witness evidence, documentary evidence, contact profile (multiple family members and known associates as well as the two other Purple phone users) and cell utilisation analysis (comparing the most frequently used cells with his home address ).126
D. SABRA's Phones
55. SABRA is the user of Purple 018. This is attributed to SABRA through SMS content, the contacts profile (multiple family members as well as the two other purple phone users) and cell utilisation analysis (compared with his home address ).127 In addition, the contacts and cell utilisation profile of two subsequent phones, both of which are directly attributed to SABRA or his family, were compared with the profile of Purple 018 and provide support for the attribution of this telephone to SABRA.128
E. MERHI's Phones
56. One Green Network phone and one Purple phone are attributed to MERHI. 129 An
additional PMP is attributed to MERHI's family. 130
57. Green 071 is attributed to MERHI from 24 September 2004 until it ceased being used on 7 February 2005. 131 This phone is attributed through its geographic profile and by co-Iocation. 132 Green 071, which was active on 23 days during the attribution period, co-located with Purple 231 throughout this period and was never in contact with
126 R91-801738, pp. 13-14.
127 R91-801568, pp. 12-14.
128 R91-801568,pp.17-38.
129 ERN:D0327911-D0328017.
130 ERN:D0327911-D0328017.
131 ERN:D0327911-D0328017, paras. 114-135; R91-804322.
132 ERN:D0327911-D0328017, paras. 142-184; D0327905-D0327910; R91-804322.
STL-11-01lPT/TC 20 31 October 2013 Public Redacted PUBLIC R248244 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
Purple 231. 133 The most frequently used cell sectors are consistent with Purple 231, and includes the cell that serves MERHI's residence. 134
58. Purple 231 is attributed to MERHI from 19 December 2002 until 15 February 2005, after which no more calls were made until the end of the subscription period on 11 March 2005. 135 Purple 231 is attributed to MERHI through its contact profile, its geographic profile, and further attribution points. 136 For example, the first ranked contact for Purple 231 is MERHI's [Redacted], and other top contacts include MERHI's [Redacted] and MERHI's [Redacted].137 With respect to the geographic profile, the most frequently used cell sector on nights and Sundays was BRAJNE2;
MERHI's residence lays within the predicted best server coverage for this cell. 138
59. PMP 3686091 is attributed to MERHI and other members of his family from 1 January 2003 until 31 December 2007. 139 This phone is attributed through documents, text messages, its contacts profile and geographic profile, as well as further attribution points. 140 PMP 3686091 is recorded as MERHI's contact number on a number of commercial and official documents, including his income tax form.141 SMS content demonstrates that PMP 3686091 was used by members of MERHI's immediate family.142 Top contacts include several of MERHI's family members. 143 The most frequently used cell sector of that phone is the cell that covers MERHI's residence. 144
133 ERN:D0327911-D0328017, para. 123 ; R91-804322.
134 ERN:D0327911-D0328017, paras. 44-53,142-145; R91-804322.
135 ERN:D0327911-D0328017, para. 22; R91-804318.
136 ERN:D0327911-D0328017, paras. 14-64; R91-804318.
137 ERN:D0327911-D0328017, paras. 31-43; R91-804318.
138 ERN:D0327911-D0328017, paras. 50-53,90-98; R91-804318.
139 ERN:D0327911-D0328017, paras. 65-70; ERN:D0317492-D0317832.
140 ERN:D0327911-D0328017, paras. 65-113; ERN:D0317492-D0317832.
141 ERN :60269579-60269617, at 60269594.
142 ERN:D0265589-D0265733.
143 ERN:D0327911-D0328017, para. 81; ERN:D0317492-D0317832.
144 ERN:D0327911-D0328017, paras. 87-88; ERN:D0317492-D0317832.
STL-II-01lPT/TC 21 31 October 2013 Public Redacted R248245 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
VI. THE CONSPIRACY
60. As demonstrated by their actions, which are described in detail below, the Accused and MERHI agreed amongst themselves and with unidentified others, including the Assassination Team, to commit a terrorist act by means of an explosive device in order to assassinate HARIRI. 145 The exact dates on which the Accused agreed to or joined the conspiracy are not certain. The Prosecution submits that their actions, described below, demonstrate that BADREDDINE, AYYASH, MERHI and the members of the Assassination Team were early members of the conspiracy, and that ONEISSI and SABRA subsequently joined the conspiracy.
61. Specifically, BADREDDINE and AYYASH agreed to commit a terrorist act by means of an explosive device in order to assassinate HARIRI between 11 November 2004 and the morning of 14 February 2005 prior to the attack. ONEISSI and SABRA joined the conspiracy between 22 December 2004 and the morning of 14 February 2005 prior to the attack. The evidence demonstrates that, at the latest, the Accused had all agreed to commit the terrorist act by the morning of 14 February 2005 prior to the attack.
VII. PREPARATIONS FOR THE TERRORIST ATTACK
62. The Accused were involved in acts taken in preparation for the terrorist attack. Specifically, BADREDDINE monitored and, together with AYYASH, coordinated observations of HARIRI's residences, Parliament, the eventual crime scene, surveillance of HARIRI's movements, and the purchase of the Mitsubishi Canter van used as a VB lED to perpetrate the terrorist attack. ONEISSI and SABRA participated in identifying a suitable individual, namely Ahmed ABU ADASS (ABU ADASS), who would be used to make a video-taped false claim of responsibility for the attack. In addition, ONEISSI was involved in the disappearance of ABU ADASS.
145 All four Accused are charged with Conspiracy aimed at committing a Terrorist Act. See Amended Indictment of21 June 2013, Count 1, paras. 53-54; see also Articles 2 & 3(1)(a) of the Statute of the Special Tribunal for Lebanon; Articles 188,212,213,270, and 314 of the Lebanese Criminal Code (LCC); Articles 6 & 7 of the Lebanese Law of 11 January 1958. The Appeals Chamber has identified the elements of conspiracy under Lebanese law. See STL, Prosecutor v. Ayyash et al., Case No. STL-II-01lI, Interlocutory Decision on the Applicable Law: Terrorism, Conspiracy, Homicide, Perpetration, Cumulative Charging, 16 February 2011 (Applicable Law Decision), para. 202.
STL-II-01lPT/TC 22 31 October 2013 Public Redacted PUBLIC R248246 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
BADREDDINE monitored, and together with MERHI, coordinated these preparations for the false claim of responsibility. AYYASH was in contact with MERHI in relation to preparations for the attack. There were at least 65 days of relevant phone activity in relation to the attack on HARIRI. 146
A. Observations in Preparation/or the Attack
63. Between 20 October 2004 and 14 February 2005, AYYASH, S5, S6, S7, S8, S9, S10, Sl1, S12, S14 and S23, communicating on their Blue Network phones, Yellow Network phones and, as of 14 January 2005, Red Network phones, conducted extensive observations and surveillance in preparation for the terrorist attack, including observations of key locations such as HARIRI's residences, Parliament, and the eventual crime scene, and surveillance ofHARIRI's movements. Beginning at the latest on 20 October 2004, the day of HARIRI's resignation as Prime Minister, and continuing until the day of the attack, there were at least 50 days involving
observations and surveillance. 147 By observing relevant locations, as well as HARIRI's movements and those of his security team, BADREDDINE, AYYASH and the Assassination Team determined the most suitable location and method for the attack, which they then executed on 14 February 2005.
64. HARIRI's security detail included a civilian close protection team and a close protection team from the Lebanese Internal Security Forces (ISF), each operating under separate team leaders. 148 Following his resignation as Prime Minister in
October 2004, HARIRI's ISF security team was reduced from forty to eight men. 149 HARIRI's convoy was usually made up of six or eight cars. 150 Generally, the ISF car was in the lead, followed by a Mercedes which was followed by HARIRI's armoured Mercedes. One Mercedes remained on either side of HARIRI's car. The ambulance
146 R91-200334.
147 R91-200334. The other identified observation and surveillance days are 20, 21, and 22 October, 1,2,3,4, 8,9,10,11,23,24,25, and 26, November 2004, 17,21,22,23,24,25,26,27,28,29,30, and 31 December 2004,1,7,8,12,14,22,27,28,29,30 and 31 January 2005, and 1,2,3,4,7,8,9,10,11,12 and 13 February 2005. See R91-200334.
148 R91-200282, para. 12.
149 R91-200282, para. 12.
150 R91-200282, para. 12. R91-200061, para.8.
STL-II-01lPT/TC 23 31 October 2013 Public Redacted PUBLIC R248247 STL-ll-OIIPT/TC Fl 077IPRVl20 131 0311R248221-R248279IEN/nc
was at the rear of the convoy. 151 The overall Chief of Security decided on the route to be taken and communicated it to the team leader of the ISF close protection team, who were in the lead car. 152 The three Mercedes were equipped with jamming devices. 153 The purpose of the jamming devices was to prevent any connection between the transmitter and receiver of wireless devices. 154
65. AYYASH was in frequent contact with BADREDDINE throughout the observation period. Between 1 January 2005 and 14 February 2005, often during observation activity by the Assassination Team and other Subjects, BADREDDINE on Green 023 was in contact 59 times with AYYASH on Green 300. 155 Prior to significant events related to the assassination of HA RI RI, the volume of calls between AYYASH and BADREDDINE increases. 156
66. AYYASH was also in contact with MERHI during this time period. l57 For these contacts, AYYASH used PMPs and MERHI used Purple 231. They were in contact eight times between 13 November 2004 and 6 February 2005. Seven of those calls took place between 23 January 2005 and 6 February 2005, with AYYASH on PMP 091 and MERHI on Purple 231. 158
1. Observations between 20 October and 10 November 2004
67. There were 10 days of observations of Quraitem Palace between 20 October, the day HARIRI tendered his resignation as Prime Minister, and IONovember 2004. 159
151 R91-200282, para. 12.
152 R91-200282, para. 19. R91-200059, p. 6 and 9.
153 R91-400176 para.66.
154 R91-602917 para.21.
155 R91-200334, p. 113-346.
156 R91-800098, R91-800099
157 A YYASH and MERHI have a history of contact. Specifically, between 4 December 2003 and 6 February 2005, AYYASH on PMP 165, PMP 935, and PMP 091 was in contact 32 times with MERHI on Purple 231. ERN:D0317027-D0317147, CST0226_3575231 with Pre Aug 04 Cell Site.
158 ERN:D0317027-D0317147, CST0226_3575231 with Pre Aug 04 Cell Site, at ERN:D0317141-D0317145.
159 R91-200151; R91-200334, pp. 23-43.
STL-11-01lPT/TC 24 31 October 2013 Public Redacted PUBLIC R248248 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
During that time period, on 6 November 2004, AYYASH on Green 300 and MERHI on Green 071 were in contact with BADREDDINE on Green 023. 160
2. Surveillance on 11 November 2004
68. On 10 November 2004, BADREDDINE and AYYASH were in contact twice on their Green Network Phones. 161 Following this contact, on 11 November 2004, surveillance of HARIRI's movements began. On this day, S5 and S7 used their Blue Network phones near Quraitem Palace in the morning until 12:02, and were at or near the airport by 12:19.162 HARIRI left Quraitem Palace after 11:57 and arrived at Beirut Airport by 12:20. This demonstrates that S5 and S7 observed HARIRI, including his security arrangements, as he travelled from Quraitem Palace to Beirut Airport.
3. Observations on 21 December 2004
69. On 21 December, S6, S8, S9 and the users of Yellow 120 and Yellow 170 conducted
observation at Quraitem Palace. 163 HARIRI had appointments at Quraitem throughout
the day. 164 During the evening, whilst observations continued, AYYASH, who was in South Beirut, called S6 at 19:38 on their Yellow Network phones. BADREDDINE called AYYASH on their Green Network phones twice around 19:45, with the first
call lasting five seconds and the second a little over four minutes. 165
4. Observations on 30 December 2004
70. On 30 December 2004, individuals using Blue Network phones observed HARIRI's Faqra residence and Quraitem Palace. HARIRI travelled from Faqra to Quraitem
Palace that day. 166
160 ERN:D0328018-D0328115, paras. 92-94.
161 R91-200334, p. 42-43, para. 77-86.
162 R91-200334, p. 44-48 para. 87-98.
163 R91-200334, p. 59-66 para. 128-158.
164 R91-200284, p. 183-184, R91-200283, p. 64.
165 R91-200334, p. 59-66 para. 128-158.
166 R91-200334, p. 98-104 para. 260-280; PRH 407; R91-200129, p.8 para.42; R91-200284, p.199.
STL-11-01lPT/TC 25 31 October 2013 Public Redacted PUBLIC R248249 STL-ll-OIIPT/TC Fl 077IPRVl20 131 0311R248221-R248279IEN/nc
5. Purchase of the Red Network Handsets and Phones
71. The phones were purchased separately from a shop in Tripoli on a day between 24 December 2004 and 4 January 2005. 167 On 30 December 2004, there was Yellow Network activity in Tripoli near the phone shop where on that same day five of the Red Network handsets were purchased. 168 On 4 January 2005, S6 and S9, while together, activated the eight Red Network phones in the Tripoli area over a period of
approximately 30 minutes. 169 Tripoli was chosen as the purchase location in order to divert attention away from the perpetrators, including the Accused, who were not from that area.
6. Observations on 14 January 2005
72. On 14 January 2005, Subjects began using Red Network phones while conducting
observations. On this day, while HARIRI had appointments at Quraitem Palace, 170 users of Red Network phones were in contact with each other on at least 32 occasions around Quraitem Palace, Parliament and Faqra. BADREDDINE and AYYASH were in contact after the end of the Red Network activity on their Green Network phones, demonstrating BADREDDINE's role in monitoring and their mutual coordination of
the observations. S6 and S8 also used their Blue Network phones on this day. 171
7. Planned Surveillance on 20 January 2005
73. Planning for surveillance of HARI RI on 20 January 2005 began in the preceding days. On 18 January 2005, there was significant Green Network activity, including a time when both AYYASH and BADREDDINE activated the same cell near the Grand Mosque (HARIRI's planned destination for Eid prayers on 20 January).I72 On 19 January, AYYASH and BADREDDINE were in contact on their Green Network
167 R91-200334, p. 124-130 para. 351-375.
168 R91-200259, p. 5 para. 16
169 R91-200334, p. 124-130 para. 351-375.
170 PRH066; R91-200123, para. 26. R91-200284, p. 223-225.
171 R91-200334, p. 156-160 para. 263-475.
172 R91-200334, p. 169-171 para. 524-536.
STL-11-01lPT/TC 26 31 October 2013 Public Redacted R248250 PUBLIC STL-ll-OIIPT/TC Fl 077IPRVl20 131 0311R248221-R248279IEN/nc
phones on five occaSIOns. AYYASH, usmg Blue 233, was also m contact with multiple Blue Network phone users. 173
74. On 20 January 2005, HARIRI was scheduled to attend the Grand Mosque of Beirut in
the morning. He attended the Imam Ali Mosque for Eid prayers. 174 AYYASH, on Red 741, and S5, S6, S7, S8, S9 and S1O, using their Red Network phones, were in contact for less than one hour in the vicinity of Quraitem Palace and the Grand Mosque. Prior to these observations, AYYASH and BADREDDINE were in contact on their Green Network Phones, and BADREDDINE was subsequently in contact with MERHI on 071. About an hour and a half after the cessation of Red Network activity A YYASH called BADREDDINE on their Green Network Phones. 175 This is demonstrative of AYYASH and BADREDDINE coordinating and monitoring the surveillance which they had planned for that day.
8. Observations on 28 January 2005
75. On 28 January 2005, the Assassination Team observed HARIRI's residences. On that day, HARIRI had appointments in Beirut, including at Quraitem Palace.176 The Assassination Team, using their Red Network phones, including AYYASH on Red 741, operated for more than six hours around Quraitem Palace, HARIRI's residence in Faqra, and the route between these two 10cations.177
76. Specifically, between 11:36 and 16:57, S6 and S8 were in the vicinity of Quraitem
Palace and Parliament. 178 Between 13:30 and 17:54, AYYASH, S5, S7 and S9 were in the Zouk Mosbeh area northeast of Beirut and along the route to Faqra. At 14:14, AYYASH contacted BADREDDINE on their Green Network phones. BADREDDINE was travelling north to the Zouk Mosbeh area. At 14:17, AYYASH, who was in the Zouk Mosbeh area, called S9, who was near the route to Faqra. Ten minutes later, BADREDDINE, now located in the Zouk Mosbeh area, contacted
173 R91-200334, p. 172-173 para. 537-545.
174 R91-200235; PRH066 ; R91-200123, para. 32 ; PRHOI7; R91-200108, para.37.
175 R91-200334, pp.174-177, para. 546-555 ; ERN:D0328018-D0328115, paras. 340-346
176 PRH066; R91-200123, para. 40 ; R91-200284, p. 261-265.
177 R91-200334, p. 189-193, para. 595-606.
178 R91-200334, p. 189 para 601.
STL-II-01lPT/TC 27 31 October 2013 Public Redacted PUBLIC R248251 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
AYYASH. The next call between the two was at 16:25. At the time of that call, AYYASH was still in the vicinity of Zouk Mosbeh, while BADREDDINE had travelled north. Following this call, AYYASH was involved in five Red Network calls. 179
77. At 16:46, AYYASH then called S6, who was in the vicinity of Quraitem palace. Within two minutes, AYYASH called BADREDDINE who was located in the Jounieh area, north of Beirut. This was the last Green Network call of the day. 180
78. Approximately one hour later, shortly before the end of Red Network activity, S9 called AYYASH via their Blue Network phones. AYYASH had returned to South Beirut. After Red Network activity ceased, AYYASH was in further contact with S6 on their Blue Network phones. At the time, they were both in South Beirut.!8!
79. In summary, throughout that day, AYYASH was in frequent contact with Subjects active at both HARIRI residences and along the route between the two. This is consistent with AYYASH coordinating the observations. Moreover, his contact with users of the Red and Blue Network and BADREDDINE indicates that AYYASH was an intermediary between them, and demonstrates that BADREDDINE monitored the observations.
9. Surveillance and Observations on 31 January 2005
80. On 31 January 2005, HARIRI was at Quraitem Palace before going to the Higher Shiite Counci1.!82 BADREDDINE, AYYASH, S5, S6, S7, S8, and S9 were active in the vicinity of the Quraitem Palace, the Higher Shiite Council, the Parliament area, and along routes between these venues for the period before, during and after HARIRI's movements, operating from at latest 09:35 to at least 12:42. They were located around Quraitem Palace and the Higher Shiite Council when HARIRI was present. AYYASH operated in both areas, making calls on Red 741, Blue 233 and Green 300. There were 11 Green Network calls between AYYASH and
179 R91-200334, p. 191 para. 602-606.
180 R91-200334, p. 191-192, para. 602-606.
181 R91-200334, p. 191-192, para. 602-606.
182 PRH066; R91-200123, para. 43 and 81; R91-200189
STL-II-01lPT/TC 28 31 October 2013 Public Redacted R248252 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
BADREDDINE, indicative of their monitoring and coordination of the surveillance. 183
81. At 09:54, while HARIRI was still at the Quraitem Palace, S6 contacted S8, using their Red Network phones. Both were in the vicinity of the Quraitem Palace. Two minutes later, AYYASH received a call from S8 on his Blue Network phone. AYYASH was located in South Beirut. At 09:58, S7 called S9 on their Red Network phones. They were in the vicinity of Parliament and the Beirut Port. 184
82. HARIRI left Quraitem Palace after 10:09. He was in the vicinity of the Higher Shiite Council by 10:55 and stayed there until approximately 11 :44, when he departed to return to the palace. At 11:44, BADREDDINE called AYYASH. At 11:47, S8 contacted AYYASH on their Red Network phones; both were close to the Higher Shiite Council. At 11 :48, AYYASH, moving north in the direction of Quraitem Palace, consistent with HARIRI's movements, called BADREDDINE, who immediately returned his call. Over the next twenty minutes, A YYASH was in frequent contact with BADREDDINE as well as Subjects near Parliament, travelling along the route to Quraitem Palace, and at Quraitem Palace. At 12:07, BADREDDINE called AYYASH, who, along with S6, was in the area of Quraitem Palace. By 12:08, HARIRI had returned to Quraitem Palace. 185
83. By 12:23, AYYASH had switched to using his Blue Network phone and had returned to South Beirut, from where he contacted S6, who was near the coastal road to the southwest of Quraitem Palace. The Red Network activity concluded at 12:42.186
84. By 15:28, Blue Network phone use resumed in South Beirut. Later that day, S5, S6, S7, and S8, in contact on their Blue Network phones, conducted observations in the vicinity of Quraitem Palace between 17:51 and 23:25. 187
183 R91-200334, p. 203-213, para. 633-663.
184 R91-200334, p. 203 para. 638-640.
185 R91-200334, p. 205-209 para. 645-660.
186 R91-200334, p. 208-210 para. 654-662.
187 R91-200334, p. 209-212 para. 662-663.
STL-11-01lPT/TC 29 31 October 2013 Public Redacted PUBLIC R248253 STL-ll-OIIPT/TC Fl 077IPRVl20 131 0311R248221-R248279IEN/nc
85. The activity of the Red, Green and Blue Network phone users on this day demonstrates surveillance of HA RI RI's movements. AYYASH figured prominently in the surveillance operation, making frequent calls to all the other users, and being present at all the key locations that day. This demonstrates that he coordinated the surveillance. BAD RED DINE was frequently updated by AYYASH while HARIRI travelled to and from the meeting. He spoke exclusively to AYYASH, doing so 11 times. This demonstrates BADREDDINE's role in monitoring and, together with A YYASH, coordinating the surveillance.
10. Topping up the credit on the Red Network phones
86. On 2 February 2005, S8 travelled to the greater Tripoli area and topped up the credit of the eight Red Network phones in the greater Tripoli area over a 45 minute period. In the same area, within 10 minutes of the top-up, S8 on Blue 817, called S6 on Blue 610. Later, while travelling back to Beirut, S8, on Blue 817, was in communication 3 times with AYYASH, who was in Beirut, on Blue 233. 188 As with the purchase of the Red Network phones in Tripoli, this was again intended to divert attention away from the perpetrators, including the Assassination Team.
11. Surveillance on 3 February 2005
87. On 3 February 2005, HARIRI had appointments in Beirut including at Quraitem Palace before going to the St. Georges Yacht Club for lunch and later returning to
Quraitem Palace. 189 Prior to his lunch, which was scheduled for 14:00, HARIRI was at the residence of [Redacted]. He departed [Redacted] residence at approximately 13:51. 190
88. AYYASH, S7, S8, and S10 were active in the vicinity of the St. Georges Marina before and during HARIRI's lunch. Around the same time period, SS, S6, and S9 were in the vicinity of Quraitem Palace. Red Network activity began in the vicinity of the St. Georges Marina at 12:58, approximately one hour prior to HARIRI's scheduled arrival. At 13:33, AYYASH, who was travelling towards the Marina, was
188 R91-200334, p. 217-221 para. 679-690.
189 PRH066; R91-200123, para. 46 ; R91-200284, p. 279-280.
190 R91-200334, p. 224, para. 701.
STL-11-01lPT/TC 30 31 October 2013 Public Redacted PUBLIC R248254 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
in contact with S8, who was at the Marina. At 13 :56, close to the time that HARIRI was scheduled to arrive for his lunch, BADREDDINE, who was in South Beirut, called AYYASH, who was now in the vicinity of the St. Georges Marina. At 14:05,
S8 called AYYASH. Both were near St. Georges Marina. 191
89. By 14:17, HARIRI had arrived at the St. Georges Marina. 192 Between 14:13 and 14:36, there were 10 Red Network calls among the Subjects, three involving AYYASH. At 14:42, BADREDDINE called AYYASH from South Beirut. Then, between 14:50 and 14:55, AYYASH made five Red Network calls: three to S8, east of the St. Georges Marina, one to S5, near Quraitem Palace, and one to S7. At 15:25, S10, in the same area of the Marina as AYYASH, called S5, who was west of Quraitem Palace. At 15:27, BADREDDINE, now also in the area of St. Georges Marina, called AYYASH. 193
90. HARIRI left St. Georges Marina after 15:30. Between 15:36 and 15:43, there were eight Red Network calls, four of which involved AYYASH. At 15:44, AYYASH called BADREDDINE while they were both in the vicinity of St. Georges Marina and activating the same cell. This final call indicates that they were close enough to meet in person. Between 15:44 and 15:58, there were eight Red Network calls, the
last being a call between S6 and S9 while both were south of Quraitem Palace. 194 HARIRI had arrived at Quraitem Palace by 16: 18. 195
91. In summary, AYYASH and BADREDDINE played significant roles in the surveillance. AYYASH was active in the area of the St. Georges Marina from 13:56 until 15:51, making 19 calls with other Red Network phone users and BADREDDINE. This is consistent with him coordinating the surveillance on HARIRI. BADREDDINE and AYYASH were in contact around the time that HARIRI was scheduled to arrive at St. Georges Marina, during the surveillance period, around the time HARIRI departed, and after HARIRI's departure. This
191 R91-200334, pp. 222-225 para. 692-702.
192 R91-200334, p. 224, para. 70l.
193 R91-200334, p. 225-226 para. 703-706.
194 R91-200334, p. 225-228 para. 702-714.
195 R91-200334, p. 227-228 para. 708.
STL-11-01lPT/TC 31 31 October 2013 Public Redacted PUBLIC R248255 STL-ll-OIIPT/TC Fl 077IPRVl20 131 0311R248221-R248279IEN/nc
demonstrates that BADREDDINE monitored and, together with AYYASH, coordinated the surveillance.
12. Surveillance on 8 February 2005
92. On 8 February 2005, HARIRI's movements and those of the Assassination Team are similar to their respective movements on 14 February 2005. HARIRI was at Quraitem Palace in the moming. 196 He left to attend Parliament sometime after 11 :44, arrived at the Parliament by 12:06, left this area after 13:10, and was back at Quraitem Palace by 13:45. 197 AYYASH and the other members of the Assassination Team were active on their Red Network or Blue Network phones around Quraitem Palace, Parliament, and routes between both locations. 198
93. On that day, AYYASH and SS, S6, S7, S8 and S9, using their Blue Network phones, were in key locations from 09:25 onwards. At 09:25, S9, near Quraitem Palace, called S6. Forty minutes later, S8 had arrived in the Quraitem Palace area, and received two calls from AYYASH. The Blue Network activity continued in these areas between
10:00 and midday. 199
94. HARIRI left Quraitem palace after 11:44. At 11:58, AYYASH, who was now in the vicinity of Parliament, received a call from S8 who was near Quraitem Palace, and then from S9, who was in the same area as S8. At 12:04, AYYASH telephoned S7, who was in South Beirut. At 12:05, S8, now in the Parliament area, telephoned AYYASH.200
95. By 12:06, HARIRI had arrived at Parliament. At that time, SS, who was in the Parliament area, received a call from S8, who was in the vicinity of the eventual crime scene, using their Blue Network phones. At 12:07, AYYASH called S9, and two minutes later he received a call from S6, who was in South Beirut. There were then a series of Blue and Red Network calls prior to HARIRI's departure from Parliament.
196 PRH066; R91-200123, para. 51; R91-200284, p. 285.
197 R91-200334, p. 251-266 para. 772-808.
198 R91-200334, p. 251-266 para. 772-808.
199 R91-200334, p. 251-252 para. 776-782.
200 R91-200334, p. 253-254 para. 783-787.
STL-11-01lPT/TC 32 31 October 2013 Public Redacted PUBLIC R248256 STL-ll-OIIPT/TC Fl 077IPRVl20 131 0311R248221-R248279IEN/nc
At 12:24, S5 called AYYASH, both of them using their Red Network phones and activating the same cell. AYYASH then used his Blue Network phone to call S8 and S9.201
96. AYYASH then switched to his Red Network phone to call S9 and then S5. Both AYYASH and S5 were in the vicinity of Parliament. S5 then called AYYASH. S9 then called S7 and then AYYASH. At this point, S5 called AYYASH again and, one minute later, S6 called S8 from the Parliament area. By the time of HARIRI's departure from the Parliament area, at approximately 13: 10, all six Red Network phones in use on that day were in the vicinity of Parliament. AYYASH was also in contact with S8 and S9 using their Blue Network Phones during this period.202
97. Following HARIRI's departure from Parliament, he returned to Quraitem Palace. A YY ASH and S9 also travelled from the Parliament area to the vicinity of Quraitem Palace. By 13:36, AYYASH was in the vicinity of Quraitem Palace calling S8. 203
98. AYYASH then called BADREDDINE at 13:40. Over the following 12 minutes there were nine Red Network calls, four involving A YYASH. During this period, HARIRI arrived at Quraitem Palace. In the next hour there were a further nine Red Network calls?04
99. At 15:05, BADREDDINE contacted AYYASH. Both were located in South Beirut. For over three hours, S5, S6, S8 and S9 on their Red and Blue Network phones remained in the vicinity of Quraitem Palace. After 18:36 there were no further Red Network calls. There was also a temporary cessation in the use of the Blue Network phones. Then, between 20:54 and 23:05, S5, S6, S7 and S8 used their Blue Network phones around Quraitem Palace. S5 and S6 were in contact with AYYASH, who was in South Beirut during this period.205
201 R9l-200334, p. 254-256 para. 786-789.
202 R9l-200334, pp. 253-258, paras. 788-79l.
203 R9l-200334, p. 259 para 792-793.
204 R9l-200334, p. 259-260 para. 794.
205 R9l-200334, p. 260-266 para. 759-800.
STL-ll-OllPT/TC 33 31 October 2013 Public Redacted PUBLIC R248257 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
100. Later, S5 and S6 were active on their Blue Network phones on the coastal road around the crime scene. This included one call from S6 to AYYASH and two calls from AYYASH to S6. AYYASH remained in South Beirut, around his Hadath residence. The last Blue Network call of the day was between AYYASH and S6 at 23:32. Both were in South Beirut.206
101. In summary, throughout the day, members of the Assassination Team operated around the Quraitem Palace and Parliament areas. Their movements were consistent with the movements of HA RI RI and his security team. AYYASH was a significant figure in the operation. He was in frequent contact with the other members of the Assassination Team during this period, demonstrating his role in coordinating the surveillance. While near the eventual crime scene and later in south Beirut, AYYASH was in contact with BADREDDINE. The first call with BADREDDINE was at a significant time, as shortly after the 13 :40 call with A YYASH, other members of the Assassination Team involved in the surveillance moved from the Parliament area to the vicinity of Quraitem Palace. The subsequent call at 15:05 is consistent with AYYASH updating BADREDDINE on the surveillance. Taken together, these calls demonstrate BADREDDINE's role in monitoring and coordinating the surveillance.
13. Final preparations before the Attack
102. On 13 February there was activity on Blue Network Phones and BADREDDINE and AYYASH's Green Network phones, which continued into the early hours of 14 February 2005. In addition, AYYASH used PMP170 from the vicinity of the crime scene to call S4. AYYASH again contacted S4 at 20:33, by which time AYYASH was in the vicinity of Parliament. By the time of his next contact with S4, AYYASH was back in South Beirut.207
103. At 23:07, BADREDDINE called AYYASH using the Green Network phones. There was then Blue Network activity, including S6 using his Blue Network phone in the same area of South Beirut that AYYASH was in. The Blue Network activity continued to 01 :05 on 14 February 2005. At 02:31, BADREDDINE sent an SMS
206 R91-200334, p. 264-266 para. 801-808.
207 R91-200334, p. 297-300 para. 809-829.
STL-11-01lPT/TC 34 31 October 2013 Public Redacted PUBLIC R248258 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
message on his PMP 663 to a female associate. The message read "Jfyou knew where
I have been you would be very upset. ,,208
14. Conclusion as to Observations and Surveillance
104. AYYASH's and BADREDDINE's extensive involvement in the surveillance of HARIRI's movements and observations of his residences, Parliament and the crime scene, among other locations, demonstrates that they had the intent to kill HARIRI. Their actions also show premeditation.209 Moreover, their choice of HARIRI as a target demonstrates their knowledge and intent to kill HARIRI.210
B. The Purchase ofthe Mitsubishi Canter van used as the VB/BD to perpetrate the terrorist attack
105. By 11 January 2005, BADREDDINE and AYYASH were coordinating an extensive observation and surveillance operation, which included at least 30 days of observations and surveillance. The Red Network phones, which would be used to execute the attack on 14 February 2005, had been purchased and activated. Moreover, as will be demonstrated below, ONEISSI and SABRA had taken significant steps to identify a suitable individual to make the false claim of responsibility. During this period, BADREDDINE and AYYASH were also taking steps to identify and purchase a vehicle suitable for use as a VBIED to carry out the attack.
106. On 11 January 2005, AYYASH visited the area of AI-Beddaoui in Tripoli where vehicle showrooms are located, including the showroom where the Mitsubishi Canter
208 R91-200334, p. 297-300 para. 809-829, R91-801535, p. 11. 209 AYYASH and BADREDDINE are charged with intentional homicide with premeditation pursuant to Count Three of the Amended Indictment of21 June 2013, paras. 57-58. Pursuant to Article 549 of the Lebanese Criminal Code (LCe), premeditation is an aggravating factor for the crime ofIntentional Homicide. The Appeals Chamber outlined the elements of premeditation as "(i) a calm and clear mind while planning and executing the crime, so that the perpetrator is shown to be emotionally detached, not acting upon rage or anger; and is therefore considered to be a dangerous criminal justifying the aggravating circumstance; (ii) the lapse ofa period of time before the commission of the crime, which should allow the perpetrator to think, and plan, and regain calmness." STL, Prosecutor v. Ayyash et al., Case No. STL-11- 0111, Interlocutory Decision on the Applicable Law: Terrorism, Conspiracy, Homicide, Perpetration, Cumulative Charging, 16 February 2012 (Applicable Law Decision), para. 132. 210 Knowledge and intent are elements of the crime of intentional homicide under Article 547 of the Lebanese Criminal Code, with the requisite knowledge being the knowledge that their act is aimed at a living person and that the tool he is using may cause the death of the person. See Applicable Law Decision, para. 162. The Accused must intend the death of the victim as well. See Applicable Law Decision, para. 163.
STL-11-0IlPT/TC 35 31 October 2013 Public Redacted R248259 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
van used as the VB lED was subsequently purchased.211 From there, AYYASH, contacted BADREDDINE twice at 14:30 and 14:55, both using their Green phones.212
107. On 15 January 2005, S8 travelled to Tripoli and was in the vicinity of the showroom.213 From there he called S6 on their Blue Network Phones. S6 was in contact with AYYASH, who was then in contact with BADREDDINE. The relevant calls were: (i) at 17:20 S8 called S6 (Blue Network Phones); (ii) at 18:51 MERHI called BADREDDINE (Green Network Phones); (iii) at 20:03 AYYASH called S6 (Blue Network Phones); (iv) at 20:22 AYYASH called BADREDDINE (Green Network Phones); (v) at 21:32, S8, who was in Tripoli, called S6 in South Beirut (Blue Network Phones); (vi) at 21:34, S6 called AYYASH (Blue Network Phones); (vii) from 22:13 to 22:53, S8 and S6 were involved in a series of calls (Blue Network Phones); and (viii) the last call of the day was from MERHI to BADREDDINE at 23:40 (Green Network Phones).214
108. On 25 January 2005, the Mitsubishi Canter van was purchased in Tripoli.215 Between 14:41 and 14:59, AYYASH, who was in Beirut was in contact three times with S6, who was in the Tripoli area.2I6 At 15:10, AYYASH called BADREDDINE.2I7 Between 15:30 and 16:00, S6 on Blue 610, with another unidentified person, both giving false names, purchased for $11,250 USD in cash a Mitsubishi Canter van with engine block number 4D33-J01926 from a vehicle showroom in the AI-Beddaoui area of Tripoli.218 At 15:37, during the negotiation of the purchase of the eventual VBIED, S6 called AYYASH, activating the cell which covers the showroom.219 Fragments of
211 R91-200002, p. 12.
212 R91-200334, pp. 150-151 paras. 442-451.
213 R91-200002 p12
214 R91-200334, pp. 161-164, paras. 481-506.
215 R91-200001, p. 12
216 R91-200334 p. 183, para. 577-584.
217 R91-200334 p. 183, para. 580.
218 R91-200001.
219 R91-200334, p.183, para. 581.
STL-11-01lPT/TC 36 31 October 2013 Public Redacted R248260 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
the Mitsubishi Canter van, including a fragment of the engme block bearing the
number 4D33-JOl926, were later recovered at the HARIRI crime scene. 220
109. By 25 January 2005, observations and surveillance had been ongoing for over three months. From 14 January 2005, the users of the Red Network phones, the Assassination Team, had been assigned and the Red Network began operating. From this point, the level, complexity, and intensity of observations and surveillance increased significantly. With the purchase of the van, the final stages of preparation were being completed, including the identification of a suitable individual to make the false claim of responsibility.
110. AYYASH's and BADREDDINE's involvement in the purchase of the Mitsubishi Canter van, together with their other actions described throughout this brief, is demonstrative of their status as conspirators pursuant to Count 1 of the Indictment and their criminal intent in relations to Counts 2 through 5 of the Indictment.
111. Specifically, the decision to use a van of this size in the attack demonstrates the intention to use a significant amount of explosives, and is evidence of A YYASH and BADREDDINE's agreement to commit a terrorist act in order to kill HARIRI,221 and demonstrates their intent to do so by means liable to create a public danger and their intent to cause a state ofterror.222 Their choice of means to commit the attack further demonstrates their intent to kill other individuals in HARIRI's convoy and in the vicinity of the crime scene, or at least that they foresaw that such deaths would occur
220 R91-200452; R91-602861; R91-200454; R91-606444; R91-607107. 221 AYYASH and BADREDDINE are charged with Conspiracy aimed at committing a Terrorist Act. See Amended Indictment of21 June 2013, Count 1, paras. 53-54; see also Articles 2 & 3(1)(a) of the Statute of the Special Tribunal for Lebanon; Articles 188,212,213,270 and 314 of the LCC; Articles 6 and 7 of the Lebanese Law of 11 January 1958. The Appeals Chamber has identified the elements of conspiracy under Lebanese law. See Applicable Law Decision, para. 202. These elements are: (i) two or more individuals who (ii) conclude or join an agreement; (iii) aimed at committing a crime against State security, which, before the Tribunal, must be a terrorist act; (iv) having agreed on the use of means liable to cause a public danger; and (v) the existence of a criminal intent. 222 A YYASH and BADREDDINE are charged with the commission of a terrorist act pursuant to Count 2 of the Amended Indictment of 21 June 2013. The volitional commission of an act by means liable to cause a public danger with the intent to cause a state of terror are the elements of the crime of committing a terrorist act by means liable to cause a public danger pursuant to Article 314 of the Lebanese Criminal Code. See Applicable Law Decision, para. 147. The Appeals Chamber has also recognized that the element of means liable to cause a public danger may result from an attack on a prominent political leader, like HARIRI, and that the means are closely interlinked with the intent to cause a state of terror. See Applicable Law Decision, paras. 127-128.
STL-11-01lPT/TC 37 31 October 2013 Public Redacted R248261 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
and accepted this risk.223 In addition, their involvement III the purchase of the Mitsubishi Canter van demonstrates premeditation.224
C. Preparations related to the False Claim ofResponsibility
112. While BADREDDINE and AYYASH were coordinating and monitoring the observation and surveillance operation and taking steps to purchase the vehicle to be used in the attack, ONEISSI and SABRA, together with MERHI, were taking steps to identify a suitable stranger to be used to make a false claim of responsibility for the attack. BADREDDINE used the Green Network to monitor, and together with MERHI, coordinate the preparation of the false claim of responsibility.
113. Between 6 November and 21 December 2004, there were 60 contacts between the Purple Phones, including 38 contacts between SABRA and MERHI, 16 contacts between ONEISSI and MERHI, and six contacts between ONEISSI and SABRA.225
114. As part of the preparations for the attack, between 22 December 2004 and 17 January 2005, ONEISSI and SABRA, together with MERHI, agreed to locate a suitable stranger who would be used to make a false claim of responsibility, on a video, for the attack against HARIRI. They chose ABU ADASS. ONEISSI also participated in ABU ADASS's disappearance. In addition, MERHI was involved in the preparation of the false claim of responsibility and acted as the liaison between BADREDDINE and ONEISSI and SABRA?26
223 AYYASH and BADREDDINE are charged with the intentional homicide of21 others killed in the terrorist attack, see Count 4 of the Amended Indictment of21 June 2013, paras. 59-60, as well as the Attempted Intentional Homicide of the 226 persons injured as a result of the terrorist attack, see Count 5 of the Amended Indictment of21 June 2013, paras. 61-62. Intentional homicide is a crime under Article 547 of the LCC, and the Appeals Chamber has recognized knowledge and intent as elements. See Applicable Law Decision, paras. 162-163. Articles 200 and 201 ofthe LCC criminalize attempt with respect to felonies, including intentional homicide. The Appeals Chamber has discussed the elements of attempt under the LCC. Applicable Law Decision, paras. 176, 180 and 182. Finally, Article 189 of the LCC recognizes dolus eventualis, which the Appeals Chamber also discussed. See Applicable Law Decision, para. 165. 224 See Amended Indictment of21 June 2013, Counts 3-5, Article 549(1) ofLCC; Applicable Law Decision, para. 168. 225 ERN:D0328018-D0328115, paras. 86, 111; ERN:D0317027-D0317147, CST0226_3575231_with Pre Aug 04 Cell Site, at D0317125-D0317136; ERN:D0322621-D0322922, Call Sequence Table for Phone 3419018 Date Range 22-11-01 to 16-02-05, at D0322901-D0322907.
226 R91-200334, p. 59-167.
STL-II-01lPT/TC 38 31 October 2013 Public Redacted R248262 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
115. ONEISSI and SABRA have a history of contact with each other and with MERHI, who used Purple 231. In particular, ONEISSI and SABRA were in contact with each other on their Purple phones 84 times between 12 January 2003 and 16 February 2005.227 SABRA has been in contact 212 times with MERHI on Purple 231 between 26 December 2002 and 14 February 2005,228 and ONEISSI 194 times with MERHI on Purple 231 between 25 June 2003 and 26 January 2005.229 Between 4 December 2003 and 6 February 2005, MERHI on Purple 231 was in contact 32 times with AYYASH on PMP 165, PMP 935, and PMP 091, and in particular seven times on PMP 091 between 23 January 2005 and 6 February 2005.230
116. ABU ADASS is [Redacted] of Palestinian origin, born on 29 August 1982, [Redacted].231
117. ABU ADASS often attended the Arab University Mosque of Beirut, also known as "the Al-Houry Mosque" (the "Arab University Mosque"), [Redacted], and where he would sometimes lead prayers.232 [Redacted].233
118. On 22,29,30, and 31 December 2004 and 3 and 7 January 2005, ONEISSI was in the vicinity of the Arab University Mosque.234 On two of those days, on 22 December 2004 and 7 January 2005, ONEISSI on Purple 095 was in contact with MERHI on Purple 23l. In addition, on three of those days, on 30 and 31 December 2004, and 7 January 2005, ONEISSI on Purple 095 was in contact with SABRA on Purple 018?35
119. On 30 and 31 December 2004 and 1,3,4,5,6, and 7 January 2005, SABRA was in the vicinity of the Arab University Mosque. On two of those days, 1 and 4 January 2005, SABRA on Purple 018 was in contact with MERHI on Purple 23l. In addition,
227 R91-800077.
228 ERN:D0317027-D0317147, CST0226_3575231..
229 ERN:D0317027-D0317147, CST0226_3575231..
230 ERN:D0317027-D0317147, CST0226_3575231..
231 R91-200275, p. 2.
232 R91-100274, paras. 74-76; R91-100284 para. 60.
233 R91-200275, p. 4.
234 R91-200334, p. 59-167
235 R91-200334, p. 59-167
STL-11-01lPT/TC 39 31 October 2013 Public Redacted PUBLIC R248263 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
on six of those days, 30 and 31 December 2004 and 1,4, 6 and 7 January 2005, SABRA on Purple 018 was in contact with ONEISSI on Purple 095.236
120. Between 14 and 15 January 2005, the days immediately preceding the disappearance of ABU ADASS, SABRA was in contact with MERHI three times and with ONEISSI twice.237
121. BADREDDINE, on Green 023, was in contact with MERHI on Green 071 during this time period when ONEISSI and SABRA were going to the vicinity of the Arab University Mosque. Specifically, they were in contact on 23 and 27 December, 2004, 2 January 2005, and then in contact six times between 12 and 15 January 2005, the days preceding the disappearance of ABU ADASS.238 On 16 January 2005, the day of ABU ADASS's disappearance, BADREDDINE was in contact with MERHI five times.239
122. At the beginning of January 2005, ABU ADASS met ONEISSI, who introduced himself as "Mohammed". He claimed to be a Muslim who was brought up in a Christian orphanage, and asked ABU ADASS to teach him how to pray. The two met on several occasions over the next few weeks.24o
123. Around the same time period, ONEISSI, acting as Mohammed, met another individual under strikingly similar circumstances. ONEISSI also asked this individual if he could teach him how to pray. The individual did not have time to teach ONEISSI, but he identified ABU ADASS as someone who could do so and offered to introduce ONEISSI to him. ONEISSI declined the offer of an introduction, and made arrangements to meet the individual on another day when he had time to teach ONEISSI how to pray. The individual was late for this appointment, and he never saw ONEISSI after his first meeting with him.241
236 R91-200334, p. 59-167
237 ERN:D0328018-D0328115, pp. 57-58.
238 ERN:D0328018-D0328115, pp. 32, 33,42,56-59.
239 ERN:D0328018-D0328115, pp. 59-61.
240 R91-200275, p. 3.
241 R91-100284. para. 76. R91-100329
STL-11-01lPT/TC 40 31 October 2013 Public Redacted R248264 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
124. [Redacted].242 [Redacted].243
125. On the same day, MERHI and BADREDDINE were in contact on five occasions between 06:19 and 09:00.244 BADREDDINE moved from the Faraya area to South Beirut between the first and second calls, while MERHI was in South Beirut during all the calls.245 Aside from one call by SABRA at 00:03 none of the three Purple phones were used on 16 January 2005. Save for SABRA's call at 00:03, this was the only day since 9 January 2003 when all three phones were inactive at the same time. They neither called each other nor other people. This is a significant anomaly in their phone usage, especially considering that it happened on the day ABU ADASS dIsappeare· d .246
126. [Redacted],247 [Redacted]. [Redacted].248 [Redacted].249
127. [Redacted].25o
128. On 17 January 2005, ONEISSI was in the vicinity of [Redacted]. [Redacted]on 17 January, ONEISSI was in contact with MERHI at 21:03. This is the last time any of the Purple phones activated cells in the vicinity of the Arab University Mosque.25l
129. [Redacted].252
130. ONEISSI's and SABRA's involvement in selecting ABU ADASS, and ONEISSI's involvement in his disappearance, demonstrate their volitional involvement in preparing the false claim of responsibility in order to shield the perpetrators from
242 R91-200275, p. 4.
243 R91-200275, p. 4.
244 R91-200334, paras. 512, 514 and 515.
245 ERN:D0328018-D0328115, pp. 59-61.
246 R91-800075; R91-800076; R91-800077.
247 R91-200275, p. 5; R91-100219p. 3.
248 R91-100343, para. 17.
249 R91-200275, p. 5.
250 R91-100327, paras. 20-23; R91-100343, para 20.
251 R91-800075; R91-800076; R91-800077; R91-200334, p. 167-168, paras. 516-523.
252 R91-200275, p. 5.
STL-11-01lPT/TC 41 31 October 2013 Public Redacted R248265 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
justice. It further demonstrates their knowledge of the criminal intentions of the perpetrators and their intent to assist the perpetrators in the commission of the cnmes.. 253
VIII. THE TERRORIST ATTACK
131. On 14 February 2005, AYYASH and the other members of the Assassination Team positioned themselves in locations where they were able to track and observe HARIRI's convoy at Quraitem Palace, Parliament, and his return as far as the area of the St. Georges Hotel, enabling them to execute the attack. That morning, beginning at 04:55, the Assassination Team operated using their Blue Network Phones in South Beirut and then moved to the vicinity of Parliament and the crime scene. 254
132. On 14 February 2005, HARIRI was at Quraitem Palace and had various meetings until he left for Parliament sometime after 10:30.255 He was due to return to the palace for a weekly scheduled lunch at around 13:00.256
133. HARIRI drove to Parliament in his armoured Mercedes as part of a six vehicle convoy. The first vehicle in the convoy was a Land Cruiser with four ISF close protection team members. The second vehicle was a Mercedes equipped with jamming devices and driven by and transporting civilian bodyguards. The third vehicle was HARIRI's armoured Mercedes. This was followed by two black Mercedes equipped with jamming devices and driven by and transporting civilian bodyguards. The final car in the convoy was an ambulance. 257 The jamming devices
253 ONEISSI and SABRA are charged with being accomplices to the felonies to commit a terrorist act by means of an explosive device and of intentional homicides with premeditation. See Amended Indictment of2l June 2013, Counts 6-9, paras. 63-70; see also Articles 188, 189,200,201,219(4) and (5), 314, 547, 549 of the Lebanese Criminal Code, and Article 6 of the Lebanese Law of 11 January 1958. The Appeals Chamber has identified the elements of complicity under Lebanese Law. See Applicable Law Decision, paras. 219 and 220.
254 R9l-200334, p. 303-313 para. 929-951. 255 R9l-200088, para. 48.
256 R9l-200088, para. 62.
257 R9l-200069, paras. 12 and 29; R9l-200059, p. 9.
STL-ll-OllPT/TC 42 31 October 2013 Public Redacted PUBLIC R248266 STL-ll-OIIPT/TC Fl 077IPRVl20 131 0311R248221-R248279IEN/nc
were working on the day of the attack and turned on. 258 They had been checked two days before the attack. 259
134. HARIRI had arrived at Parliament at 10:54.260
135. Red Network activity began at 11 :00, when S8, who was on the coastal road to the east of Quraitem Palace, called S6, who was in the vicinity of Quraitem Palace. S8 then called S9, who was also on the coastal road. There were 33 calls within the Red Network between 11:00 and 12:53, mostly in the vicinity of Parliament and the St. Georges Hotel.261 During this time frame there were also Blue Network calls as the Assassination Team continued to move from South Beirut to their positions. By 11 :48, all subjects had switched from their Blue Network Phones to Red Network phones and were in the vicinities of Parliament, the crime scene or the route in between. The Blue Network Phones were not used again that day until after the attack. 262
136. At around 11 :54, HARIRI left Parliament,263 and went to the Cafe Place de l'Etoile.264 As HARIRI walked to the cafe, S6, S8 and S9 exchanged calls on their Red Network phones. S8 and S9 were in the vicinity of Parliament. This demonstrates Red Network users informing each other of HARIRI's movements. At around 11 :56, a Mitsubishi Canter van is seen on CCTV cameras travelling through the President Solaiman Franjiye Tunnel, which is close to the crime scene. The Mitsubishi Canter van appears to pull off the main road on exiting the Tunnel. 265 At 11 :57 A YYASH received a call from S5, both were in the area of the crime scene.266
258 R91-200069, para. 67; R91-200061, para. 28.
259 R91-602917, para.37.
260 R91-200334, para. 942; R91-200126 ; R91-200132, p. 27 ; R91-200054.
261 R91-200334, p. 307-339 para 945-975.
262 R91-200334, p. 307-346 para. 945-993.
263 R91-200126; R91-200132, p. 160; R91-200054.
264 R91-200087, para. 2l.
265 R91-100050 para.163-165
266 R91-200334, p. 320, para. 959.
STL-11-01lPT/TC 43 31 October 2013 Public Redacted R248267 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
137. At 11 :58, AYYASH, on Green 300, while positioned close to the area of the St. Georges Hotel, contacted BADREDDINE on Green 023 for 14 seconds.267 The Green Network phones were never used again.268 BADREDDINE's phones all had been inactive for the three hours preceding this call. This inactivity is highly unusual for BADREDDINE. Between 11 :59 and 12:02, BADREDDINE made calls to unidentified phones using SMP 944. For the next two and a half hours BADREDDINE neither made nor received any calls and only received text messages. Again this was highly unusual for BADREDDINE.269
138. Between 12:00 and 12:16, there were 11 Red Network calls.27o During this time period, S5 moved from the vicinity of the crime scene to an area west of Parliament. AYYASH and S7 were in areas between the crime scene and Parliament. S8 was in the vicinity of Parliament, S6 was southwest of Parliament, and S9 moved from the vicinity of Parliament to an area southwest ofParliament.271
139. At approximately 12:25, HARIRI exited the cafe for a five minute conversation with an acquaintance before re-entering the cafe.272 At 12:26, there was one Red Network call between S9 and S6. At 12:43, AYYASH called S8. 273
140. At approximately 12:49, HARIRI left the cafe and returned to his armoured car.274 The lead vehicle was informed that the convoy should take the maritime road back to Quraitem palace.275 HARIRI's car followed the lead vehicle.276 The jamming devices
267 R91-200334, p. 325, para. 962.
268 R91-200334, p. 325, para. 962.
269 R91-800098.
270 R91-200334, p. 326, para. 964.
271 R91-200334, p. 326, para. 964.
272 R91-200061, para. 21. R91-200087, para.21.
273 R91-200334, pp. 332-333, para. 967-969.
274 R91-600059, p. 10; R91-200126; R91-200132, P 184 and 192; R91-200054.
275 R91-200059, p. 10.
276 R91-200059, p. 11.
STL-11-01lPT/TC 44 31 October 2013 Public Redacted PUBLIC R248268 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
were working as the convoy left Parliament. 277 The convoy formation was as described above.278
141. Immediately, the Red Network activity recommenced. At 12:49, S9 called S8. At 12:50:34, S8, located near Parliament, made a five second call to S7, located in the vicinity of the St. Georges Hotel. Immediately after, at 12:50:55, S8 made a 10 second call to AYYASH, who was still located between Parliament and the St. Georges Hotel. At 12:51:32, S8 called S9 for seven seconds. At 12:52:02, S9 called S5 for 20 seconds. At 12:52:09, S8 called S6 for 13 seconds.279 All members of the Assassination Team had been informed that HARIRI was on the move.
142. The Mitsubishi Canter van began moving towards the St. Georges Hotel. 280 At 12:53, S9, in the vicinity of Parliament, made the final Red Network call to S6, nearby.28l The Red Network phones were never used again.282
143. At 12:55,283 an unidentified male suicide bomber detonated the improvised explosive device contained in the Mitsubishi Canter van with engine block number 4D33- J01926 as HARIRI's convoy drove past.284
144. Based on the crater size, the physical damage to the surrounding environment, including buildings and cars, assessed with specifically designed computational models, the quantity of explosives was equivalent to approximately 2,500kg to 3,000kg ofTNT.285
145. Twenty one people were killed in addition to HARIRI286 including seven members of HARIRI's convoi87, Bassel Fuleihan, who was travelling in HARIRI's car,288 and
277 R91-400177, p. 4.
278 R91-606471, para. 6 and 19.
279 R91-200334, pp. 336-337, paras. 972-975.
280 R91-100050, para. 166-168
281 R91-200334, p. 338, para. 978.
282 R91-200334, p. 338, para. 978.
283 R91-60720 1.
284 R91-200452; R91-602861; R91-606444; R91-607107.
285 R91-606444, p. 4 ; R91-606444.
286 R91-602957; R91-100278; R91-400175 ; R91-600023 ; R91-606416.
STL-11-01lPT/TC 45 31 October 2013 Public Redacted PUBLIC R248269 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
thirteen bystanders. As a result of the attack, 226 people were injured. 289 Biological materials were collected from the crime scene. None of these materials came from ABU ADASS.29o
146. The perpetrators carefully chose the method of detonating the Improvised Explosive Device (lED) - the use of a suicide bomber - as it was the option most likely to succeed in the circumstances. The circumstances, including the speed of the convoy, the specific environment, and the complexity of the attack itself, did not allow for a margin of error despite the massive quantity of military explosives used. The perpetrators carefully prepared the attack including choosing the location - in the corridor between two tall buildings where the convoy had to slow down - and the specific setup of the lED concealed inside the loading platform of the Mitsubishi Canter. They also relied upon specific logistical support including the surveillance of HARIRI's convoy to report on both its timing and the position of the target vehicle
WIt. h·III t h e convoy. 291
147. AYYASH's actions on 14 February 2005 demonstrate that he coordinated the terrorist attack of 14 February 2005. BADREDDINE's actions demonstrate that he monitored the attack through contact with AYYASH. It follows from these acts and the well planned nature of the attack that they had agreed with others, including the members of the Assassination Team, to commit a terrorist act in order to kill HARIRI. Their actions also demonstrate their intent to commit the terrorist attack against HARIRI by means liable to create a public danger. Their choice of means to commit the attack further demonstrates their intent to kill other individuals in HARIRI's convoy and in the vicinity of the crime scene, or that they foresaw that such deaths would occur and accepted this risk. Furthermore, their choice of means and target demonstrate their intent to cause a state of terror. 292
287 R91-100222, para. 9.
288 R91-100222, para. 9.
289 R91-400005; R91-400182-R91-400157; R91-400167-R91-400169; R91-400171-R91-400172.
290 R91-606416, p. 60; R91-606417, p. 35 and R91-606976, p. 19.
291 R91-6071 07.
292 See, supra, footnotes 209, 210, 221, 222, 223, 253.
STL-11-01lPT/TC 46 31 October 2013 Public Redacted R248270 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
IX. THE DELIVERY OF THE VIDEO AFTER THE TERRORIST ATTACK
148. By 10 February 2005, the main preparations for the attack had been completed. Extensive observations of locations and surveillance of HARIRI's movements had been conducted over at least 46 days in order to decide on the best location and timing for the attack. Of particular note, on 8 February 2005, AYYASH and the Assassination Team had conducted surveillance of HARIRI while he traveled along the same route as on the day of the attack. The perpetrators had identified and chosen ABU ADASS, he had disappeared, and, presumably, the false claim of responsibility had been made. The Mitsubishi Canter van that was used in the attack had been purchased. The Parliamentary session of 14 February 2005 had been well publicized293 and if HARIRI were to attend the parliamentary session, his movements were likely to be the same as his movements on 8 February 2005. Phone card number 6162569 was purchased on or around 10 February 2005 at the Al Nahr Ministry of
Telecommunications branch in Beirut, 294 completing the final step necessary for the false claim of responsibility, and thus, for the attack.
149. After a decrease in communications among the Purple phones between 18 January and 13 February 2005, communications resumed on 14 February 2005.295 On 14
February 2005, ONEISSI and SABRA were in contact five times, 296 whilst SABRA and MERHI were in contact 7 times.297
150. Following the attack on 14 February 2005, four telephone calls to news agencies were made in connection with the false claim of responsibility. One call was made to
Reuters News Agency and three calls were made to AI-Jazeera. 298
293 R91-200093, para. 25 ; R91-200211.
294 R91-100237, p. 2; R91-100298, paras. 24,28 and 52.
295 R91-800075; R91-800076; R91-8000n
296 R91-800075; R91-800076; R91-8000n
297 R91-800075; R91-800076; R91-8000n
298 R91-200334, para. 1004.
STL-11-01lPT/TC 47 31 October 2013 Public Redacted PUBLIC R248271 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
151. The call to Reuters and the three calls to AI-Jazeera were made using the same phone card, serial number 6162569 from four different public payphones in Beirut.299
152. After the attack, SABRA was in South Beirut until at least 13:33 and ONEISSI until at least 13:46.300 They both then travelled in the direction of the payphone (First Payphone) from which the first call to Reuters was made.301 At 13:59, ONEISSI activated a cell south of the First Payphone and west of his location at 13 :46. At 14:01, SABRA activated a cell adjacent to the one activated by ONEISSI at 13:59. At 14:03, MERHI called SABRA who activated a cell approximately 1-2 km south of the First Payphone.302 SABRA and ONEISSl's phone activity between 13:33 and 14:03 shows that both travelled from South Beirut towards the First Payphone. Their location around 14:00 indicates that either of them could have travelled to the First Payphone by 14: 11 to make the first call to Reuters. During the 14: 11 call, ONEISSI or SABRA claimed responsibility for the attack on behalf of "Nusra and Jihad Group
in Greater Syria". 303
153. At 14:19, ONEISSI or SABRA made a phone call to AI-Jazeera from another payphone (Second Payphone), about 330 metres from the First Payphone.304 ONEISSI or SABRA claimed responsibility for the attack on behalf of "Nusra and Jihad Group in Greater Syria", reading a statement over the phone that was similar in content to what was on the videotape. 305 SABRA and ONEISSI's locations before the calls made from the First and Second Payphones, the distance between the two payphones and the time between the two calls indicate that either SABRA or ONEISSI made the 14:19 call. Further, some twenty minutes after the 14:19 call, SABRA and ONEISSI both activated the cell approximately 1-2 km south of the First and Second Payphones.306
299 R91-200334, para. 1004-1005. 300 R91-200334, para. 1006 and 1007. 301 R91-200334, para. 1008. 302 R91-200334, para. 1008-1009, 1018. 303 R91-200262, para. 38. 304 R91-200334, paras. 1011, 1018. 305 R91-200263, para. 42. 306 R91-200334, paras. 1015, 1018.
STL-11-01lPT/TC 48 31 October 2013 Public Redacted PUBLIC R248272 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
154. After the 14:19 call to AI-Jazeera, [Redacted] read the statement made over the phone on_air. 307 Following on from this, a second phone call to AI-Jazeera was made from a different payphone (Third Payphone) at 15:27.308 The caller, SABRA, advised of the location of a videotape in a tree in the ESCW A Square, also known as the Riad al Solh Square. SABRA stated that should the videotape not be picked up within 15 minutes, it would disappear.309 Shortly thereafter, at 15:54, ONEISSI and SABRA activated the cells in the vicinity of the tree and the Third Payphone respectively.310 This fact, in conjunction with the time constraints placed on the retrieval of the videotape by SABRA, indicates that whilst SABRA made the 15:27 phone call, ONEISSI watched the tree. The distance between the Third Payphone and the tree is over one kilometer. 311 In order to ensure that ONEISSI or SABRA could observe the pick up of the video and subsequently report on it, it was necessary for one to make the call, whilst the other watched over the tree.
155. [Redacted] retrieved the videotape. At 15:50, he sent a text to a colleague, telling her that he had the videotape. 312 The video tape was accompanied by a letter. 313
156. At 15:53, MERHI called SABRA, who was in the vicinity of the Third Payphone.314 Immediately after, at 15:54, SABRA called ONEISSI, who was in the vicinity of the tree in which the videotape had been placed. 315 At 15:55, SABRA called MERHI.316 ONEISSI had been watching the tree and confirmed to SABRA that the videotape had been picked up. SABRA reported to MERHI.
307 R91-200263, para. 42. 308 R91-200334. paras. 1004 and 1020. 309 R91-200263, para. 58. 310 R91-200334, para. 1026. 311 R91-200334, para. 1032 312 R91-200267, para.60. 313 R91-200263, para. 66. 314 R91-200334, para. 1025. 315 R91-200334, para. 1026. 316 R91-200334, para. 1027.
STL-11-01lPT/TC 49 31 October 2013 Public Redacted PUBLIC R248273 STL-ll-OIIPT/TC Fl 077IPRVl20 131 0311R248221-R248279IEN/nc
157. MERHI called SABRA at 16:00, as he was travelling towards Riad al Solh Square. 317 At 16:01 and 16:02, ONEISSI called SABRA, with both phones activating the same cell, near the tree. 318 ONEISSI and SABRA then returned to South Beirut.319
158. At 16:53, ONEISSI was active in South Beirut.32o At 16:55, SABRA was III Southwest Beirut, North of the airport. 321 At 17:04, ONEISSIor SABRA made the
fourth phone call to AI-Jazeera from a payphone (Fourth Payphone), 322 situated Northwest of SABRA's location at 16:55.323 Either ONEISSI or SABRA made the call, as either could have travelled from their previous locations. [Redacted] should
broadcast the video or he would regret it. 324
159. The video was broadcast on television by AI-Jazeera shortly after the 17:04 call. 325 When played, the video tape showed ABU ADASS dressed in black with a white
turban and a long beard, claiming responsibility for the attack against HARIRI. 326
160. On the video, ABU ADASS stated:
"In the name of Allah, Lord of the Worlds, Blessings and Peace be upon his Beloved Prophet and his family and all his companions. In support of our brothers, the Mujahedeen in the Land of the Two Holy Mosques, and to avenge their innocent martyrs, who were killed by the security forces of the infidel Saudi regime in the Land of the Two Holy Mosques, we have resolved, having placed our trust in God Almighty, to inflict just punishment upon the agent of that regime and its cheap tool in Greater Syria, the sinner and holder of ill-gotten gains Rafiq Hariri, through the execution of a surrounding martyrdom operation; such as to confirm our promise of 'Nusra' and 'jihad' and to herald numerous martyrdom operations against the infidels, apostates and tyrants in the Greater Syria. Praise to be Allah, Lord of the Worlds.,,327
317 R91-200334, paras. 1030 and 103l. 318 R91-200334, para. 1032. 319 R91-200334, paras. 1033-1035. 320 R91-200334, para. 1034. 321 R91-200334, para. 1035. 322 R91-200334, paras. 1036 and 1004. 323 R91-200334, para. 1039. 324 R91-200263, para. 72. 325 R91-200263, para. 82. 326 R91-50000l. 327 R91-500002.
STL-11-01lPT/TC 50 31 October 2013 Public Redacted PUBLIC R248274 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
161. The letter accompanying the video claimed responsibility for the attack, which it described as a martyrdom operation, on behalf of the group "Nusra and Jihad Group in Greater Syria" and named ABU ADASS as the suicide bomber.328
162. At 17:15, SABRA called MERHI, at which time SABRA was in the area of the Fourth Payphone.329 At 17:24, MERHI called SABRA, who was back in South
Beirut. 330 This was the last phone contact between the three Purple phones. 331
163. The attack on HARIRI occurred at approximately 12:55. Starting at 13:08 until 20:34, the complete Assassination Team except S5 was located in the same area of South Beirut.332 In particular, AYYASH was in this area in the early evening after the attack. BADREDDINE was also in this same area and had been there all day, until at least 22: 16. AYYASH and BADREDDINE activated the same cell tower within thirty minutes of each other, between 19:55 and 20:24. BADREDDINE was still at this location at least until 21: 19 when he activated the same cell tower again. 333
164. MERHI was also in the same area as the Assassination Team and BADREDDINE, and had been throughout the day. At 16:53 on the afternoon of the attack, ONEISSI was in South Beirut, activating a cell tower in the same area as the Assassination Team. By 21:01, SABRA was also in this area.334
165. The day after the attack, on 15 February 2005, MERHI's Purple 231 ceased being used?35 On 16 February 2005, ONEISSI's Purple 095 and SABRA's Purple 018 ceased being used.336
166. ONEISSI's and SABRA's actions demonstrate that they had joined the conspiracy to commit a terrorist act by assassinating HARIRI with the agreed role of participating
328 R91-S00002.
329 R91-200334, paras. 1037 and 1039.
330 R91-200334, para. 1038.
331 R91-200334, para. 1038.
332 R91-8000S1; R91-800042; R91-8000S0; R91-8000S4; R91-8000SS; R91-8000S7; R91-800098.
333 R91-8000S7; R91-800098.
334 R91-80007S; R91-800076; R91-8000n
335 R91-200334, para. 1044.
336 R91-200334, para. 1047 and 1049.
STL-11-01lPT/TC SI 31 October 2013 Public Redacted PUBLIC R248275 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
in the preparation and dissemination of a false claim of responsibility in order to shield the perpetrators from justice.337 The statements made in the phone calls to AI Jazeera and the contents of the video-tape demonstrate their knowledge of the crimes committed, including that HARIRI was the target and had been killed, the means used, and the intentions of the perpetrators.338
x. [REDACTED]
167. [Redacted].339 [Redacted].340
168. [Redacted]341 [Redacted],342 [Redacted].343
169. [Redacted]. 344
A. [RedactedJ
170. [Redacted]. [Redacted]. 345 [Redacted]. 346 [Redacted]. 347
171. [Redacted].348
172. [Redacted].349 [Redacted]. 350
337 See Amended Indictment of21 June 2013, Count 1, paras. 53-54; see also Articles 2 & 3(1)(a) of the Statute of the Special Tribunal for Lebanon; Articles 188,212,213,270, and 314 of the Lebanese Criminal Code; Articles 6 & 7 of the Lebanese Law of 11 January 1958; and Applicable Law Decision, para. 202. 338 See Amended Indictment of21 June 2013, Counts 6-9, paras. 63-70; see also Articles 2 & 3(1)(a) of the Statute of the Special Tribunal for Lebanon; Articles 188, 189,200,201,219(4) and (5),314,547,549 of the Lebanese Criminal Code, and Article 6 of the Lebanese Law of 11 January 1958. See Applicable Law Decision, paras. 219 and 220. 339 [Redacted]. 340 [Redacted]. 341 [Redacted]. 342 [Redacted]. 343 [Redacted]. 344 [Redacted]. 345 [Redacted]. 346 [Redacted]. 347 [Redacted]. 348 [Redacted]. 349 [Redacted].
STL-II-01lPT/TC 52 31 October 2013 Public Redacted R248276 PUBLIC STL-ll-OIIPT/TC Fl 077IPRVl20 131 0311R248221-R248279IEN/nc
173. [Redacted].351 [Redacted].352
174. [Redacted].353 [Redacted].354
175. [Redacted].355
176. [Redacted].356 [Redacted] ,357 [Redacted], 358 [Redacted].359 [Redacted].360 [Redacted].361
177. [Redacted].362 [Redacted].363 [Redacted], 364 [Redacted]. 365 [Redacted]/66 [Redacted], 367 [Redacted]. 368 [Redacted]. 369 [Redacted]. 370
178. [Redacted],371 [Redacted].372 [Redacted]373 [Redacted].374 [Redacted].375
350 [Redacted]. 351 [Redacted]. 352 [Redacted]. 353 [Redacted]. 354 [Redacted]. 355 [Redacted]. 356 [Redacted]. 357 [Redacted]. 358 [Redacted]. 359 [Redacted]. 360 [Redacted]. 361 [Redacted]. 362 [Redacted]. 363 [Redacted]. 364 [Redacted]. 365 [Redacted]. 366 [Redacted]. 367 [Redacted]. 368 [Redacted]. 369 [Redacted]. 370 [Redacted]. 371 [Redacted]. 372 [Redacted]. 373 [Redacted].
STL-11-01lPT/TC 53 31 October 2013 Public Redacted R248277 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
B. Attacks in Kuwait
179. On 27 March 1984, the State Security Court of Kuwait (Court of Kuwait) convicted the 23 years old "Elias Fouad SAAB" an alias of BADREDDINE, along with 16 other individuals for a series of terrorist attacks carried out in Kuwait on 12 December 1983.376 The preparation of and their commission on one day required a team of operators 16 of whom were convicted along with SAAB. The State Security Court of Kuwait established that SAAB and another accused developed and implemented the plan for execution377 and that roles were distributed among the other accused.378 To commit each attack, vehicles prepared with explosives were used. One attack consisted of a suicide bomber driving a truck loaded with explosives into the American embassy.379 The Court of Kuwait held that SAAB selected the cars380 and prepared the explosive devices381 which required "a broad technical experience in the make and use of explosives".382 The Court of Kuwait held that the night and early morning prior to the attacks, SAAB toured what would later become the crime scenes, set the timers, supervised and instructed the operatives.383
180. In its judgement, the Court of Kuwait found that 'SAAB' was an explosive expert, a trade he learned in his country Lebanon. The Court of Kuwait also found that 'SAAB'
374 [Redacted]. 375 [Redacted]. 376 Criminal court file - Kuwait State Security (Al-Dasmeh) No. 1938/4055, Public Prosecution No. 83/9, R9l-300596, ERN:60256036-60256430, at ERN:60256246
377 R9l-300596,. at ERN:60256250 378 R9l-300596, at ERN:6025624l
379 R9l-300596, at ERN:60256238 stating that the 26 th accused died in the mission; Witness statement of finger Printing expert Captain Abd al-Rahman Saqr al-saqr, R9l-300596,. at ERN:60256298; "Inspection of the Incident sites- with the authority of the Public Prosecution and Crime Scene Officers" R9l-300596, at ERN:60256313
380 R9l-300596, at ERN:60256249 381 R9l-300596, at ERN:60256242 382 Evidence derived from witness statement, Witness Lieutnant Hamad Abdallah AI-Sari, R9l-300596, at ERN :60256296. 383 Conviction of the 2nd defendant R9l-300596, at ERN:60256370; Confession of the 1 si accused AL-RIDA, R9l-300596, at ERN:60256256; Confession of the 2nd accused SAAB, at ERN:60256259-60256260
STL-ll-OllPT/TC 54 31 October 2013 Public Redacted PUBLIC R248278 STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
coordinated the purchase of vehicles and explosives, as well the perpetration of the attacks. 384
181. BADREDDINE as "SAAB" instructed that every car bomb driven to a site be followed by another car driven by a partner who should pick up the driver of the car bomb away from the explosion scene. 385
C. Conclusion
182. [Redacted]. [Redacted].386 [Redacted].387
183. [Redacted].
184. [Redacted]. [Redacted].
185. The series of terrorist attacks carried out in Kuwait on 12 December 1983 present similar or analogous features with the attack against HARIRI with regards to the participation of BADREDDINE, who coordinated and monitored the preparations for and perpetration of all these attacks just as he later did in relation to the HARIRI attack. Just as in the HARIRI attack, BADREDDINE, as 'SAAB' was involved in the observations of the crime scenes before the attacks and the selection of the vehicles that were used during the attacks. All these attacks were committed through the detonation of explosives stored in or under motorized vehicles in public streets, in broad day light. The evidence further demonstrates a consistent pattern of conduct probative to the charges against BADREDDINE in the Indictment.
384 R91-300282.
385 R91-300282, ERN:60274835-60274839.
386 [Redacted].
387 [Redacted].
STL-11-01lPT/TC 55 31 October 2013 Public Redacted R248279 PUBLIC STL-ll-01IPT/TC F1 077IPRVl20 131 0311R248221-R248279IEN/nc
XI. CONCLUSION
186. The Prosecution submits this pre-trial brief pursuant to Rule 91(G). Based on the evidence summarized above, the Prosecution submits that the Accused are responsible for the crimes for which they are charged in the Indictment.
Dated this 31 st day of October 2013 Leidschendam, The Netherlands
Word Count: 19,711
STL-11-01lPT/TC 56 31 October 2013 Public Redacted