R026503 PUBLIC STL-18-10/PT/PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

BEFORE THE PRE-TRIAL JUDGE SPECIAL TRIBUNAL FOR LEBANON

Case No: STL-18-10/PT/PTJ Before: Judge Daniel Fransen Registrar: Mr. David Tolbert, Acting Registrar Date: 15 December 2020 Filing Party: Prosecutor Original language: English Classification: Public

THE PROSECUTOR v. SALIM JAMIL AYYASH

Public Redacted Version of Annex G to F0257 "Prosecution's Submission Pursuant to Rule 91(Part 4) and the Corrigendum for the Annexes A and H to F0246 "Prosecution's Submission Pursuant to Rule 91"" - Corrected Version of the Pre-Trial Brief

Office of the Prosecutor: Counsel for Mr. Salim Jamil Ayyash: Mr. Norman Farrell Mr. Emile Aoun and Ms. Anta Guisse

Legal Representative of Participating Head of Defence Office: Victims (attack against Mr Hamade): Ms. Dorothee Le Fraper du Hellen Mr Nidal Jurdi

Legal Representative of Participating Victims (attack against Mr Hawi): Mr Antonios Abou Kasm

Legal Representative of Participating Victims (attack against Mr El-Murr): Mr Adel Nassar ,.,t•."l ~ ...

.. ~ \\.t) 11.. _I_ _I_ 11..U_I__I_ VVU.:') .:')l'V_l__l_.:')V_l_VU UJ _I__I_VL.JUV1-1-U1-_l_ ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••II c. BADREDDINE's ROLE IN HEZBOLLAH ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 45 1. BADREDDINE was a Hezbollah leader before, during and after the attacks ...... 45 2. BADREDDINE operated as a high level security operative in 2004-2005 ...... 47 3. BADREDDINE had ties to prominent Hezbollah members and to Hezbollah ...... 49

IV. THE USE OF COVERT TELEPHONE NETWORKS TO COMMIT THE ATTACKS •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 51

A. AYYASH, BADREDDINE, AND OTHERS, USED COVERT TELEPHONE NETWORKS TO FACILITATE THE PLANNING, PREPARATION AND PERPETRATION OF THE ATTACKS •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 51 1. Overview ...... 51

STL-18-1 O/PT /PTJ 1 of 185 15 December 2020 Public Redacted 3. Phone numbers used by BADREDDINE ...... 97 (a) Phone numbers leading to the attribution of Green 023 to BADREDDINE: BADREDDINE was the user of PMP 354, PMP 663 and Mobiles 128, 944, 195, 683 & 486 ...... 97 (b) BADREDDINE was the user of Network phone Green 023 ...... 100 D. OTHER UNIDENTIFIED PARTICIPANTS USED NETWORK PHONES, INCLUDING NETWORK PHONES INVOLVED IN THE ATTACKS •••••••••••••••••••••••••••••••••••••••••••••••••••••••• 101 VI. THE TERRORIST ATTACKS •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 103

A. THE HAMADE ATTACK •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 103 1. Overview ...... 103 2. The preparation of the attack ...... 104

STL-18-1 O/PT /PTJ 2of185 15 December 2020 Public Redacted STL-18-1 O/PT /PTJ 3 of 185 15 December 2020 Public Redacted R026507

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

I. INTRODUCTION

1. This Pre-Trial Brief sets out the Prosecution case and the evidence the Prosecution will lead to prove the allegations in the indictment, and the material facts therein.

2. As set out in the body of this document, the evidence encompasses different themes that cover a continuous period over four connected terrorist attacks extending from September 2004 to July 2005: the political context in Lebanon; the attribution of relevant phones; the nature and inter-connection of covert network and other mobile phones; and the chronology of, preparation for, and execution of the attacks, using these phones.

3. The entirety of the evidence is both inter-connected and cumulative and therefore, its ultimate weight, can only be evaluated holistically and in its entirety to determine whether the offences indicted are established beyond reasonable doubt. 1

4. The attacks targeted at Marwan Mohammed HAMADE, Georges Anis HA WI and Elias Michel EL-MURR, in addition to former Prime Minister Rafik HARIRI, are all inextricably connected by a series of factors, amongst them: the pervading political context; the common political stance adopted by the targeted victims; their temporal proximity; the use of an improvised explosive device (IED) and vehicle borne improvised explosive devices (VBIED); the same criminal group using the same inter­ connected covert network phones to facilitate planning and execution for the attacks; their recurrent focus and use in areas frequented by the targeted victim occurring only in the period prior to each attack; and the pivotal role of the Accused, SALIM JAMIL A YYASH, reflected by the recurring, sequential call flows between him, Mustafa Amine BADREDDINE, and the other co-perpetrators.

5. All four attacks took place amongst historic, tumultuous and polarised political tensions regarding Syria's ongoing role and influence in Lebanon. On the one hand, there were those, amongst them Hezbollah and the Syrian regime itself, who strongly supported maintenance of the status quo; on the other, there were those, including all four of the targeted victims, who supported and promoted change in favour of greater Lebanese sovereignty. It is in this context, that AYYASH and BADREDDINE, Hezbollah

E.g. ICC, Lubanga Dyilo Appeal Judgement, para.22; ICTRNchamihigo Appeal Judgement, para.213.

STL-18-1 O/PT /PTJ 4of185 15 December 2020 Public Redacted R026508

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

affiliates both, oversaw and coordinated the three attacks that underlie the five indicted counts.

6. HAMADE was attacked on 1 October 2004, between 09: 11 and 09: 13 on Henry Ford Street in Beirut. A VBIED exploded approximately one meter from his vehicle as he left his home travelling to Parliament. He and [Redacted] were seriously injured, and his security officer Ghazi ABOU-KARROUM, the other occupant of the car, was killed.

7. HARIRI was attacked on 14 February 2005, at 12:50, near the St George's Marina in the middle of downtown Beirut. A very large, suicide VBIED, directed into position moments before by (the ) covert network phones, exploded as his security convoy sped past the St George's hotel. HARIRI and 21 others were killed, 226 others were injured, and the smTounding infrastructure devastated.

8. HAWI was attacked on 21 June 2005 around 09:48 on Habib Abi Chahla Street in Beirut. An IED placed under his own vehicle, exploded shortly after he had left his home as he drove past the Zouhairi petrol station. HAWI was killed, and [Redacted] and [Redacted], an employee of the petrol station, were injured.

9. EL-MURR was attacked on 12 July 2005 at around 10: 18 on Second A venue in Rabieh. A VBIED exploded as EL-MURR drove to his office. The explosion injured EL­ MURR, [Redacted], [Redacted], 12 bystanders, and killed Khaled MOURA, a passing motorist.

10. Several phones used to plan and coordinate all of these attacks, many forming part of the inter-connected covert networks, are attributed to A YYASH. These phones are attributed through their call patterns and co-location with his personal phones, so frequent and over such an extended period of time, that any suggestion of the co­ location being coincidence can be readily dismissed.

11. The evidence demonstrates that AYYASH with BADREDDINE and other unidentified participants acting under their direction, were behind the three attacks against HAMADE, HAWI, and EL-MURR just as they were behind the HARIRI Attack. These attacks were all prepared, planned and executed by the same core group of participants: using the same inter-connected covert network phones and mobile phones; utilising surveillance and patterns of phone use adapted to the circumstances of each victim; all

STL-18-1 O/PT /PTJ 5 of 185 15 December 2020 Public Redacted R026509

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

of which was directed towards the effective placement and detonation of IED and VBIEDs.

12. The recurrent association, over a ten month period, of the same inter-connected covert network and mobile phones co-ordinated by A YYASH, with each of the victims' movements and crime scenes, and only within unique, specific periods preceding each of the four attacks, leaves no room for doubt that their association cannot sensibly be coincidence or innocent. Rather, this pattern of conduct points inexorably to the knowing involvement of the same criminal group in each of the series of connected terrorist attacks. Further, the degree of planning and sophistication, and the method of each attack, inter alia confirm the existence of a conspiracy or criminal association, the relevant intent to kill, the intent to create a state of terror and, ultimately, AYYASH's criminal responsibility for each of the five counts indicted.

II. POLITICAL CONTEXT

A. Overview

13. AYYASH, together with BADREDDINE and unidentified users of covert Network phones, planned, coordinated and executed the attacks against HAMADE, HARIRI, HAWI, and EL-MURR. This series of connected, targeted attacks were politically motivated and calculated to create a state of terror.

14. The political context in which the attacks occurred is relevant. First, the targeting of four prominent Lebanese politicians opposed to ongoing Syrian interference in Lebanon, by using VBIEDs on public streets that would maim and kill the targets and innocent bystanders alike, clearly reflects an intent to create a state of telTor.

15. Second, the common political position taken by each of the four is relevant to understanding the link between them and why they were targeted. All four came from different political parties with different constituents, but their opposition to Syria's role in Lebanon or their alignment with the Opposition is highly relevant to why they were targeted. In the same way that the involvement of AYYASH, BADREDDINE, and the core Subjects, as well as the same covert network phones, provides a common thread between the attacks, the political context evidence also demonstrates this nexus through the political stance of the targeted victims.

STL-18-1 O/PT /PTJ 6of185 15 December 2020 Public Redacted R026510

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

16. Third, the political context prior to and during 2004 and 2005 confirms that the interests of the Syrian regime and Hezbollah were firmly, and closely, aligned, in particular to maintain the influence and role of Syria in Lebanon. This is encapsulated by the invective of one of the most senior figures in the Hezbollah leadership which was levelled at the Opposition and HARIRI only days before his assassination. It was this degree of hostility and resolve towards those who dared to resist the Syrian will, echoing the threats of Syrian President Bashar AL-ASSAD, which formed the immediate backdrop to the series of targeted attacks overseen and coordinated by two Hezbollah affiliates, AYYASH and BADREDDINE.

17. In 2004-2005, in the months leading up to the attacks, HARIRI's, HAMADE's, HAWI's, and EL-MURR's advocacy for Lebanon's sovereignty contributed to the growing tension between prominent persons and groups opposed to the continued Syrian control, presence, and interference within Lebanon,2 and pro-Syrian loyalists,

including Hezbollah. 3 The actions of A YYASH and his co-conspirators in preparing and implementing the attacks targeted at these prominent figures, thereby correspond to political developments on the ground.

18. HAMADE was HARIRI's close friend and ally.4 He persistently opposed the extension of President Emile LAHOUD from six to nine years requiring a constitutional amendment, which the Syrian regime supported. 5 Following the Constitutional Amendment in 2004 pennitting extension of President LAHOUD's mandate to run

2 PCC060:60315057-60315089, paras.10-12; PCC060:20141119_STL-1 l-Ol_T_T96, p.28, lines 18-22, p.29, lines 12-19; PCC150:20150505_STL-l 1-0l_T_Tl47, p.15, lines 6-13.

PCC129:60315837-60315888, para.109; PCC149:20150428_STL-ll-Ol_T_Tl42, p.17, lines 20-25, p.18, linesl-6, p.23, lines 15-19, p.25, lines 2-13, p.27, lines 20-25; PCC150:20150505_STL-11- 0l_T_Tl47, p.5, lines 7-8, p.92, lines 14-16; PCC144:20150210_STL-1l-Ol_T_Tl15, pp.74- 75; PCC145:20150310_STL-1 l-Ol_T_Tl24, pp.28-29, p.30, lines 16-24; PCC145:20150320_STL-l 1- 0l_T_Tl32, p.40, lines 2-6; PCC147:20150527 _STL-1 l-Ol_T_Tl54, p.69, lines 10- 13; PCC060:20141ll9_STL-l l-Ol_T_T95, p.58, lines 23-25, p.59, lines 1-8; PCC060:20141209_STL­ l 1-0l_T_Tl00, p.49, lines 17-25; D0411305-D0411312, D0411309.

4 PCC060:20141209 _STL-1 l-Ol_T_Tl00, pp.28-30; PCC060:10001l72-10001176, 10001175.

60066859-60066912, 60066866; 60235629-60235642, 60235629-30; PCC150:20150504_STL-ll-Ol_T_Tl46. p.17, lines 8-20; PCC129:60315837-60315888, para.38.

STL-18-1 O/PT /PTJ 7of185 15 December 2020 Public Redacted R02651 l

STL-18-1 O/PT /PT J f 0257I A07/PRV /202012 l 5/R026503-R026688/EN/dm

from six to nine years (LAHOUD extension), HAMADE resigned in protest. 6 He was a forthright critic of the Syrian regime, and one of the leaders of the Opposition within the Bristol Group.7 The HAMADE Attack was the first of a series of violent attacks against Opposition leaders; it was perceived as a clear warning to HARIRI. 8

19. HAWI was a respected political figure who exerted influence over Lebanese politics. 9 He was a long-term, vociferous critic of Syria's presence and control in Lebanon and opposed the LAHOUD extension. Following HARIRI's assassination, HAWI's public criticism of the Syrian presence only intensified as he called for the withdrawal of Syrian troops and the replacement of LAHOUD. HAWI's capacity to build alliances within the Opposition against the Syrian regime 10 made him an extant threat to Syrian and Hezbollah's interests. 11

20. EL-MURR was Defence Minister and Deputy Prime Minister from April 2005 until he was attacked on 12 July 2005. 12 EL-MURR's political movement towards the Opposition when he was Interior Minister in September 2004 led to his subsequent replacement by a pro-Syrian candidate in October 2004. 13 Following HARIRI's

See II(C)(2).

PCC060:20141119_STL-ll-Ol_T_T95, p.13, lines 17-22, p.28, lines 20-22; PCC129:60315837-60315888, paras.39- 41; PCCl 43:20150115 _ STL-ll-Ol _ T_ Tl07, pp.77-78; PCC150:20150505 _ STL-ll-Ol _ T_Tl 47, pp.24-26; PCC060:60315057-60315089, paras.8-10; 60301191-60301232. 60301200.

PCC 146:201503 l 6 _STL-l l-Ol _ T_ Tl28, p.55, lines 10-21; PCC129:60315837-60315888, para.90; PCC 150:20150505 _STL-l l-Ol _ T_ Tl47, p.43, lines 20-25, p.44, lines 1-5; PCC060:603 l 5057-603 l 5089, para.24; PCC060:2014l120_ STL-l l-Ol _ T99, p.48, lines 10-24.

9 PCC060:60315057-60315089, para.79; PCC072:60332074-60332094, para.22; PCC129:60315837-

60315888, paras.12, 70; PCC130:60308701-60308716, para.44; PCCl 42:60311595-60311618, para.41; PCC 136:60307256-60307265, para.23; PCC 139:60311694-60311702, para.18.

10 See II(C)(3).

II PCC137:603l1667-603l1693, para.27; PCC060:60315057-60315089, para.73.

12 PCC141:60016929-60016936, 60016929-30; PCC141:201123-201132, 201124; PCC141:60321499-60321516, para.38; 60236171-60236172, 60236172.

13 PCC141:60028755Al_TS_D_EN, p.27; 60305503-60305505, 60305504; PCC141:60321499- 60321516, para. IO; PCC060:603 l 5057-60315089, para.31-33; See II(B).

STL-18-1 O/PT /PTJ 8of185 15 December 2020 Public Redacted R026512

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

assassination, EL-MURR aligned himself with the Opposition. 14 In the aftermath of the 2005 Parliamentary elections, it was widely anticipated that EL-MURR would be re­ appointed as Defence Minister in an Opposition-led government. 15 EL-MURR's attempted assassination-only five months after HARIRI's assassination-served as a further warning to those who prepared to oppose Syrian influence. 16

21. Hezbollah is a military and political organisation in Lebanon with strong ties to the Syrian regime. 17 They had a joint interest in ending the Israeli military occupation in southern Lebanon and for Hezbollah, close ties with Syria were essential. 18 The persisting close alignment between Hezbollah and Syria facilitated Syria's ongoing influence in Lebanon and solidified Hezbollah's interest in maintaining, as a minimum,

the status quo. 19

22. Described as "brothers in the resistance" by Secretary General of Hezbollah, Hassan NASRALLAH, AYYASH and BADREDDINE were affiliates of Hezbollah. This is reflected in the contact profiles of phones used to oversee planning for the HA WI and EL-MURR Attacks, which included prominent figures within Hezbollah. Significantly, both AYYASH and BADREDDINE used covert network phones ( ) during the planning and the execution of the HAMADE and HARIRI Attacks. NASRALLAH acknowledged these were used as a Hezbollah covert utility during the relevant time.20

14 PCC060:60315057-60315089, paras.31-33; PCCl 41:60016993-60016996, 60016994; 60016937-60016960, 60016949,60016953.

15 PCC141 :60321499-60321516,para.38; PCC141 :60028755Al_TS_D_EN, pp.14-16; PCC060:60315057- 60315089, para.54.

16 PCC129:60315837-6031588, para.120.

17 PCC150:20150505_STL-ll-Ol_T_Tl47, p.5, lines 7-8; PCC149:20150428_STL-ll-Ol_T_Tl42, p.17, lines 20-25, p.18, linesl-6; PCC060:20141ll9_STL-l l-O l _ T_ T95, p.56, lines 15-21.

18 PCC150:20150505_STL-l l-Ol_T_Tl47, p.5, lines 11-16; PCC149:20150428_STL-l l-Ol_T_Tl42, pp.16-18; PCC144:20150210_STL-l l-Ol_T_Tl 15, p.74, lines 16-20.

19 PCC149:20150428_STL-l l-Ol_T_Tl42, p.23, lines 15-19, p.25, lines 2-13, p.27, lines 20-25; PCC147:20150527_STL-ll-Ol_T_Tl54, p.69, lines 10-13.

20 PCC082:60263705_TS_O_EN_AR_Ol(FINAL RED), pp.86-87; D0277627_U_EN, p.3.

STL-18-1 O/PT /PTJ 9of185 15 December 2020 Public Redacted R026513

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

23. BADREDDINE, a Hezbollah operative, had extensive experience and knowledge to lead others in the preparation and execution of attacks such as those directed against HAMADE, HARIRI, HAWI, and EL-MURR. It was AYYASH who was trusted to coordinate the preparation and execution of these four attacks.

B. Lebanese historical political context

24. The civil war ended with the ratification of the Taif Agreement in 1989.21 The first step for an independent and sovereign Lebanon, it provided, inter alia, for the withdrawal of all foreign military forces and the disbandment of the militias.22 Nonetheless, Syria maintained its military presence in Lebanon in light of the Israeli occupation in southern Lebanon and continued exercising increasing influence over the Lebanese political, judicial, military, and security apparatus. 23

25. Following the Israeli withdrawal in 2000,24 prominent political figures, including HARIRI, HAMADE,25 and Walid Kamal JUMBLATT, former Minister of Economy and Trade and Druze and Progressive Socialist Party (PSP) leader, stressed the

21 D0412340-D0412349.

22 PCC060:20141117_STL-11-0l_T_T93, p.29, lines 24-25. p.30. lines 1-22; PCC150:20150505_STL-11-0l_T_Tl47, p.5, lines 11-16.

23 PCC060:20141117_STL-ll-Ol_T_T93, p.31, lines 14-20, p.54, lines 4-6, p.59, lines 1-14, pp.60-61,74,84- 85,93; PCC060:20141119 _STL-1 l-Ol_T_T95, pp.57-59; PCC150:20150504_STL-1 l-Ol_T_T146, p.15, lines 15-25, p.18, lines 6-7; PCC151:20150520_STL-ll-Ol_T_Tl51, p.32, lines 3- 17; PCCl 43:20150120_STL-11-01_T_Tl09, p.45; PCC060:20141120_STL-11-01 _T_ T96, p.8, lines 11-12; PCC147:20150323_STL-ll-Ol_T_Tl33, p.15, lines 5-18, p.24, lines 2-6; PCC147:20150324_STL-11- 0l_T_Tl34, p.54, lines 10-25, p.55, lines 1-7, p.56, lines 15-24; PCC147:20150325_STL-11-0l_T_Tl35, p.21, lines 23-25, p.22, lines 1-23, p.28, line 25, p.29, lines 1-21; PCC145:20150310_STL-1 l-Ol _ T_ T124, p.24, lines 24- 25, p.27, lines 1-14,p.28, lines 2-12.

24 PCC149:20150428 _STL-1 l-Ol _ T _ Tl42, pp.16-18; PCC144:2015021O_STL-11-01_T_Tl15, p.74, lines 16- 20; PCC060:20141118 _ STL-l l-O l _ T_ T94, p.20, lines 16-23; PCC060:20141209 _ STL-11-01 _ T_ TIOO, p.45.

25 PCC060:20141117_STL-1 l-Ol_T_T93, p.23; PCC060:60031499-60031549, 60031500.

STL-18-1 O/PT /PTJ 10of185 15 December 2020 Public Redacted R026514

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

importance of implementing the Taif Agreement and emerged as figureheads of an independent Lebanon in the 2000s.26

26. The succession by Bashar AL-ASSAD in 2000 caused a shift in the relationship between Lebanon and Syria. Internationally, UN Security Council resolutions pressured the Syrian regime to withdraw from Lebanon.27 Nationally, the Lebanese supporting sovereignty renewed their demands for the withdrawal of Syrian troops and Lebanon's independence from Syria. 28

27. The adoption of UNSCR 1559 and the LAHOUD extension were two significant political events amongst others that rapidly polarised the political debate around Syria's role in Lebanon and forced HARIRI to resign and join the Opposition in open defiance of the Syrian regime. This led to the formation of the Bristol Group, advocating for Lebanese sovereignty. This is also an issue that united the four victims; the Bristol Group included HAMADE, HAWI, and ultimately, HARIRI and EL-MURR too gradually aligned himself to the Opposition.29

C. The targeted victims' political backgrounds

1. HARIRI's political background

28. HARIRI was the Prime Minister of Lebanon from late 2000 until his resignation on 20 October 2004. He was a prominent Lebanese, Arab, and Sunni figure, and a quiet proponent of Lebanese sovereignty. 30 HARIRI was also closely affiliated to the Saudi

26 PCC150:20150504_STL-ll-Ol_T_Tl46, p.15, lines 14-25, p.16, lines 1-25; PCC129:60315837-6031588813, paras.36-38; D0407568-D0407570; D0412340-D0412349, D0412347.

27 D0410359-D04 l 0367, D0410359-60; D04 l 0368-D04 l 0377, D0410371; D04l1226-D0411232, D04l1230.

28 PCC150:20150504_ STL-ll-Ol _ T_Tl 46, pp.52-54; PCC150:20150507 _ STL-l l-O l _ T_ Tl49, p.19, lines 1-7; PCC 129:60315837-60315888, para.14; PCC060:20141ll9 _ STL-ll-Ol _ T_ T95, p.18, lines 13-25, p.19, lines 1-9.

29 See II(C).

30 PCC150:20150504_STL-ll-Ol_T_Tl46, p.42, lines 6-15; PCC060:20141209_STL-ll- Ol_T_Tl00, p.42, lines 14-21; PCC060:2014 l l l 9 _ STL-l l-Ol _ T _ T95, p.19, lines 10-18; 10001249-10001254, 10001253; PCC129:603 l 5837-60315888, para.94.

STL-18-1 O/PT /PTJ 11 ofl85 15 December 2020 Public Redacted R026515

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

monarchy.31 Significantly, HARIRI was perceived as a "bridge to the West" due to his strong relations with the Western world, particularly France and the United States.32

29. HARIRI's popularity in Lebanon was a source of concern for the Syrian regime. 33 The Syrian regime took steps to undermine HARIRI on several occasions including by replacing several of his ministers with pro-Syrian ministers, effectively eliminating HARIRI's majority government. 34 Additionally, in December 2003, the Syrian regime imposed the so-called "Damascus Protocol" on HARIRI, further limiting his political freedom, preventing him from inter alia, disagreeing with policies of LAHOUD,35 a staunch ally of Syria.36

30. HARIRI's position, as a leading symbol of Lebanese sovereignty and his growing international popularity made him a powerful influence and therefore, a threat.37 The Syrian regime and Hezbollah repeatedly marked his political actions as treacherous and subversive38 and believed HARIRI to be an ally of the West, hostile to their interests.39

31 PCC080:60180565-50180603, paras.31-33.

32 PCC129:60315837-60315888, para.94; PCC080:60180565-50180603, paras.31-33.

33 PCC150:20150504_ STL-1 l-01 _ T_ T146, p.42, lines 6-11,14-15; PCC060:20141209 _STL-11- 0l _ T_ T100, p.42, lines14-21; PCC060:60031499-60031549, 60031511; PCC 129:60315837-60315888, para.94.

34 PCC060:20141ll7_STL-l l-Ol_T_T93, p.76, lines 22-25, p.77, lines 1-2,7-18.

35 PCC151:20150520 _ STL-l l-Ol _ T_ Tl5 l,p.32; PCC060:20141ll8_ STL-l l-Ol _ T _ T94, p.59, lines7-13; PCC060:20141117 _ STL-1 l-Ol _ T_ T93, p.46; PCC060:20141209 _ STL-11-0l _ T_ TlOO, p.45.

36 PCC129:60315837-60315888, para.38.

37 PCC080:60180565-60180603, paras.32, 59; PCC060: 20141ll9_ STL-l l-Ol _ T_ T95, p.8, lines 8-13; PCCI 49:20150428 _ STL-11-0l _ T_Tl 42, pp.6-16; PCCl 43:20150116 _ STL-1 l-Ol _ T_ Tl08, pp.61-62; D0004568- D000458 l. D0004568.

38 PCC080:60180565-60180603, paras.32-34.

39 PCC080:60180565-60180603, paras.31-33; D0411370-D0411379, D0411374.

STL-18-1 O/PT /PTJ 12of185 15 December 2020 Public Redacted R026516

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

2. HAMADE's political background

31. In 1977, HAMADE joined the PSP led by his closest friend and associate, JUMBLATT.40 They were consistently on the same electoral list. 41 HAMADE was a leading figure in the Democratic Gathering and was considered to have "disobeyed most" of AL-ASSAD's orders.42

32. HAMADE was a Member of Parliament (MP) smce 1980,43 and held several Ministerial positions in Lebanon, 44 including in governments led by HARIRI. HAMADE served as Minister of Economy and Trade between 17 April 2003 and 9 September 2004.45

33. HAMADE had a brotherly relationship with HARIRI since the 1980s and could speak to him frankly. They were allies despite being from different parliamentary groups. 46

34. HAMADE had a complex relationship with Syrian officials. Despite being a minister in every government from 1990-2004, with positive relationships with some pro-Syrian politicians, he was viewed negatively by Syrian intelligence officers. 47

35. The relationship with senior politicians changed in the months leading up to the attack. HAMADE, together with HARIRI and JUMBLATT, deeply opposed the LAHOUD

40 PCC060:60072872A_TS_D_EN_AR, p.42, lines 33-34; PCC060:201411l7_STL-l l-Ol_T_T93, p.18, lines 11-15, p.24, lines 3-9; p.88, lines 17-18.

41 PCC060 :60031499-60031549, 60031520.

42 PCC060:60315057-60315089, para.24; PCC060:20141119_STL-11-0l_T_T95, p.28, lines 18-25, p.29, lines 1-8; see also, D0410762-D0410772, D0410762.

43 PCC060:201411l7_STL-ll-Ol_T_T93, pp.22-23, 60235619-60235621.

44 PCC060:20141117_STL-1 l-Ol_T_T93, p.22, lines 6-15, p.23.

45 PCC060:20141117 _STL-1 l-01 _ T _ T93, p.23; PCC060:60031499-60031549, 60031500; 60235619-60235621.

46 PCC060:2014l117 _STL-l l-Ol _ T_ T93, p.61, lines 21-25, p.62, lines 1-8; PCC060:20141209 _STL-1 l-01_T_Tl00, pp.28-30; PCC060:60031499-60031549, 60031520-23; PCC060:60072872A _TS_ D_EN_ AR, p.6, line 21; PCC146:20150316_STL-11-0l_T_Tl28. p. 55. lines 15-16. p.58. lines 23-25, p.59, line 1.

47 PCC060:60031499-60031549, 60031519-20; PCC060:60072872A_TS_D_EN_AR, p.39, lines 21-25.

STL-18-1 O/PT /PTJ 13 of 185 15 December 2020 Public Redacted R026517

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

extension. HAMADE became "openly critical of Syria's presence" in Lebanon,48 and was prominent amongst those who voted against the LAHOUD extension,49 in open defiance of the Syrian regime and Hezbollah, after which, he resigned.50

3. HAWI's political background

36. HAWI was a member of the Lebanese Communist Party (LCP) since the 1970s. HAWI was Secretary-General from 1979 until 1992,51 when he resigned from the LCP Leadership.52 Following his resignation, HAWI led a group of former dissidents who later formed the Democratic Left Movement (DLM),53 a movement promoting inter alia the Taif Agreement and Lebanese independence. 54 HAWI was perceived as the "big boss" in the DLM when it was registered in 2004. 55 HAWI was a respected political figure and considered one of LCP's most important leaders. 56

37. While HAWI was Secretary-General, the LCP allied with Syria in its resistance against

Israel, despite their differences. 57 However, following Israel's withdrawal from

48 D0412340-D0412349, D0412347; PCC060:60031499-60031520, 60031515; PC Cl 50:20150505 _ STL-1 l-01 _ T_ T147, p.38, lines24-25, p.39, lines 1-6.

49 PCC060:20141120_STL-1 l-Ol_T_T96, p.6; PCC060:201411l9_STL-l l-Ol_T_T95, pp.24-25,78-82; D0410512-D0410514; 60298546-60298563.

50 PCC060:20141120_STL-1 l-Ol_T_T96, p.3, lines 5-15.

51 PCC129:60315837-60315888, para.12; PCC072:60332074-60332094,60332082, para.22.

52 PCC 136:60307256-60307265, para.9; PCC072:60332074-60332094,60332082, para.22; PCC 132:60014872- 60014885, para.24; PCC129:60315837-60315888, para.14; PCC 142:60311595-60311618, para.17.

53 PCC060:60315057-60315089, paras.12,73; PCC153:60014058-60014070, para.68; PCC130:60308701- 60308716, para.15.

54 D041l749-D041l757, D0041l752.

55 PCC060:60315057-60315089, para.73; PCC130:60308701-60308716, para.15.

56 PCC139:60311694-603 ll 702, para.21.

57 PCC136:60307256-603072565, para.9.

STL-18-1 O/PT /PTJ 14of185 15 December 2020 Public Redacted R026518

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

southern Lebanon, HAWI believed that the Taif Agreement must be implemented. 58 Despite this, HAWI maintained positive relationships with prominent Syrian figures. 59

38. However, the relationship between HAWI and the pro-Syrian loyalists deteriorated, particularly after HARIRI's death. 60 HAWI intensified his public criticism of the Syrian regime and aligned himself with the Opposition. 61 He opposed the LAHOUD extension, accused the Syrian regime of HARIRI's death and demanded Syria's withdrawal from Lebanon. 62 HAWI publicly opposed Syria's influence in Lebanon63 and was critical of the LCP's pro-Syria stance. 64

39. HAWI had a good relationship with HARIRI65 and was close friends with HAMADE. 66 HAWI was considered very credible and sought to "unify most of the Lebanese against Syrian influence".67 He had good relationships with all parties, including Christian leaders, 68 and inspired the emergence of a new left, 69 actively participating in the Bristol

58 PCCI36:60307256-603072565, para.IO.

59 PCC136:6001l769-6001l788, paras.28,93; PCC134:60090141A, pp.51-52; PCC153:60014058-60014070, para.68; PCC072 :60332074-60332094,60332085. para.44.

60 PCC060:60315057-60315089, para.78; PCC136: 60011769-60011788. paras.28,93; PCC134:60090141A. pp.51-52; PC Cl 53:60014058-60014070, para.68; PCC072:60332074-60332094,60332085-86. para.44.

61 PCCI36:600I I 769-600I I 788, para.38.

62 PCC133 :60332885-60332906,60332897, para.38; PCC060:60315057-603 l 5089, para.78; PCC136:60307256-60307265, para. IO. See also PCCI36:60011769-6001l788, paras.28,38; PCC072:60332074-60332094,60332085, para.42; PCCI29:603 I5837-603 I5888, para. I 7; PCCI36:600I I 769-600I I 788, para.22.

63 PCC136:600I l 769-600 l I 788, paras.36-38.

64 PCCI29:60315837-60315888, paras.71-72; PCC060:603 I5057-60315089, para.74; PCC133: 60332885- 60332906,60332895, para.32; PCC137:603ll667-603l1693, para.16; PCC136:60307256-60307265, para.9; PC Cl 42:60311595-60311618, para.20; PCC135 :603lI619-603l166, para.15.

65 PCC06I :60333366-60333687, 60333379-80.

66 PCC062:60331 I33-6033 I235,6033 l l 92, para. 88.

67 PCC060:603 I5057-60315089, para.79.

68 PCC136:600I l 769-6001I788, para.110.

69 PCC060:603 I5057-603 I5089, para.73.

STL-18-IO/PT /PTJ 15 ofI85 I 5 December 2020 Public Redacted R026519

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

Group and 14 March Movement. 70 HAWI' s public views carried particular weight in Lebanon 71 and his public criticism of the Syrian presence in Lebanon was harmful to

the Syrians.72

40. HAWI's political position disturbed the security forces and his move to join the DLM to create a broader left was a threat to the LCP leadership as well as Hezbollah and Syria's control over Lebanon.73

41. In 2004, HAWI openly expressed his support for the ideas of the DLM at speaking engagements, mainly against the LAHOUD extension.74 HAWI supported the DLM candidate during the 2005 elections. 75

4. EL-MURR's political background

42. EL-MURR was a prominent politician in Lebanon and LAHOUD's son-in-law at the time of his attack.76 He held ministerial posts, including in governments led by HARIRI, 77 wherein he served as Minister of the Interior and Municipalities. 78

43. EL-MURR described his relationship with HARIRI as friendship, which became increasingly political over time. EL-MURR sometimes discussed matters with LAHOUD on behalf of HARIRI. Their relationship deepened after HARIRI resigned

70 PCC133:60332885-60332906.60332895-96. para.34; 60316100-60316100 (Part 4/4); PCC136:6001l769-6001l788. para.85. See ll(B).

71 PCC136:6001l769-6001l788, para.110; PCC139:603l1694-603 l l 702, para.18.

72 PCC132:60014872-60014885, para.34.

73 PCC129:60315837-6031588, para.83; PCC136:60011769-6001l788, para.110.

74 PCC129:60315837-60315888, para.16.

75 PCC151:60000860-60000884, para.88; PCC129:60315837-60315888, para.82. See also PCC129:60315837-60315888, 60315882-60315888.

76 PCC141:60321499-60321516, para.14; 60016929-60016936, 60016929-30.

77 60016929-60016936, 60016929-30; PCC141 :201123-201132, 201124.

78 60016929-60016936, 60016929-30; PCCl 41:201123-201132, 201124; 60242908-60242920, 60242920; 60242915- 60242917. 60242916.

STL-18-1 O/PT /PTJ 16ofl85 15 December 2020 Public Redacted R026520

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

and both were forced to leave the government. The two were "very close" at the time of HARIRI' s assassination. 79

44. EL-MURR viewed himself as an independent politician who based his political decisions on his ideals and desire for an open and united Lebanon. 80 While EL-MURR served as the Interior Minister between 2000 and 2004, he had a positive relationship with AL-ASSAD, and his family ties to LAHOUD shielded him from interference from Syrian intelligence officers. 81

45. The positive relationship with the Syrian President degenerated in September 2004 following the Majdel-Anjar incident, 82 as it cemented EL-MURR's conviction that Syria should withdraw its troops from Lebanon and cease its interference with Lebanese affairs. 83 This relationship deteriorated further when EL-MURR sought to investigate HAMADE's attempted assassination. Following these events, EL-MURR resigned.84 In the months leading up to the attack against him, EL-MURR, became opposed to the continuing Syrian presence in Lebanon. 85

46. Following HARIRI's resignation, EL-MURR and HARIRI grew much closer. 86 They met several times in Geneva. 87 Before Christmas 2004, HARIRI and EL-MURR discussed forming an alliance, HARIRI offering him the position oflnterior Minister if HARIRI was elected. 88

79 PCC141 :201123-201132, 201125. 80 PCC141 :60094653A_TS_D_EN, p.88; PCC058:60331035-60331092,60331061, para.76. 81 PCC 141:201123-201132, 201124-25; E.AL-BAISSAIRI:6033092 l (RED)-60330995(RED ), 60330957, para.34.

82 PCC141:60321499-60321516, para.18; PCC141:60028755Al_TS_D_EN, p.36.

83 PCC141 :60028755Al _TS_D _EN, p.36; PCC141:60094653A_ TS_D_EN, p.70-71.

84 PCC060:60315057-60315089, paras.32-33.

85 PCC141:60028755A1 _TS_ D_EN, p.41; PCC060:60315057-60315089, paras.31-33; PCC129:60315837-6031588, para.120.

86 PCC060:60315057-60315089, para.33; PCCl 41:60321499-60321516, para.23; PCC141:201123-201132, 201125.

87 PCC141:201123-201132, 201125.

88 PCC141 :60321499-60321516, para.23.

STL-18-1 O/PT /PTJ 17 of185 15 December 2020 Public Redacted R026521

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

47. In January 2005, HARIRI warned EL-MURR to be vigilant because, in his view, EL­ MURR's resignation in October 2004 would be viewed by AL-ASSAD as an act of defiance.89 In HARIRI's words, EL-MURR had "said no to God". 90 EL-MURR also shared the view that his departure from government was perceived by AL-ASSAD as "taking a stand against Syria."91

D. Timeline ofthe Political Events in Lebanon and the Targeted Attacks

48. HARIRI was publicly against the Constitutional amendment and the LAHOUD extension. He expressed his opposition openly to then Syrian Vice President Abdel Halim KHADDAM, and conveyed publicly to the Lebanese media that "I will cut my

hand and will not sign a decree to extend Lahoud's mandate."92 In September 2004, HARIRI opposed the LAHOUD extension, as he had enough MPs to do so. 93 But later, AL-ASSAD threatened HARIRI demanding that he support the LAHOUD extension. 94

49. HAMADE opposed the LAHOUD extension, and eventually resigned as Minister. 95

50. HAWI was also publicly against the LAHOUD extension.96 He was so vocal in his opposition that friends no longer wanted to be seen with him in public. 97 Following

89 PCC141 :60028755Al_TS_D_EN, p.37, p.43; PCC141 :60321499-60321516, para.48. But See PCC151:60000860-60000884, 60000871-72; 60094567- 60094648, 60094580; PCC141:60094653A_TS_D_EN, p.93.

90 PCC141 :60321499-60321516, para.48.

91 PCC141 :60321499-60321516, para.48.

92 PCC060:20141118_STL-11-0l_T_T94, p.72, lines 12-25, p.73, lines 1-5.

93 PCC150:20150506_STL-11-0l_T_Tl48, p.61, lines 9-12. 94 PCC150:20150504_ STL-l l-Ol _ T _Tl 46, p.82, lines 13-17; PCC060:2014 l ll 9_ STL-11-0l _ T_ T95, p.7, lines 14- 15, p.4, lines 12-25, p.5, lines 1-25.

95 PCC060:20141120_STL-1 l-Ol_T_T96, p.3, lines 2-15.

96 PCC142:60332303-60332326,603323 l 6-17, para.SO; PCC136:60011769-6001l788, para.28; PCC133:60332885- 60332906,60332895-96, para.34; PCC 135 :60311619-60311666, para. I 0. See also PCC076:60332095- 60332131,60332123-25,60332127; 60317109-60317111; 60316102-60316103.

97 PCC132:60014872-60014885, para.32; PCC129:60315837-60315888, para.16.

STL-18-1 O/PT /PTJ 18of185 15 December 2020 Public Redacted R026522

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

discussions of the LAHOUD extension, HAWI started to develop a political plan to oppose it, create a national unity government, and work on a new electoral law. 98

51. EL-MURR was at the time Minister of the Interior and Municipalities.99 Prior to the discussions surrounding the LAHOUD extension, on occasions, EL-MURR acted as a mediator between LAHOUD and HARIRI. 100

52. In anticipation of the LAHOUD extension, Rustom GHAZALEH, head of the Syrian Military Intelligence in Lebanon, invited Lebanese personalities for meetings. As a prominent figure who was well respected as the face of the LCP-although by then, he was no longer a member of the LCP-HAWI was invited to speak to AL-ASSAD. HAWI declined because he believed that AL-ASSAD would pressure him to support the LAHOUD extension, since he had heard about the 26 August 2004 meeting between HARIRI and AL-ASSAD. 101

1. 26 August 2004: Meeting in Damascus between AL-ASSAD and HARIRI

53. GHAZALEH invited HARIRI to Damascus to meet with AL-ASSAD to persuade HARIRI to support the LAHOUD extension. 102 During the meeting,103 AL-ASSAD threatened HARIRI after he expressed his reservations 104 stating "Lahoud is me and I am Lahoud"105 and "if you contradict me I will destroy Lebanon over yours and Jumblatt's head". 106 Significantly, the nature of this reaction to HARIRI's resistance to

98 PCC 133 :60332885-60332906,60332895-96, para.34.

99 60016929-60016936, 60016929-30; PCC 141:201123-201132, 201124; 60242908-60242920, 60242920; 60242915- 60242917, 602429l6.

100 PCC141:60094653A_TS_D_EN, p.86, lines. 13-17.

IOI PCC132:60014872-60014885, para.32.

102 PCC060:20141118_STL-1 l-Ol_T_T94, pp.77-79,81.

103 PCC060:20141ll9_STL-11-0l_T_T95, pp.3-4; PCC147:20150323 _STL-11-0l_T_Tl33, p.57; PCC145:20150310_STL-1 l-Ol_T_T124, p.59.

104 PCC060:20141l19_STL-l l-Ol_T_T95, pp.4-5; PCC060:20141118_STL-1 l-Ol_T_T94, p.87.

105 PCC150:20150504_STL-11-0l_T_Tl46, p.82, lines 13-17.

106 PCC060:20141119 _STL-11-01 _T _ T95, p. 4, p.5, lines 12-20, p.6; PCC 150:20150504_ STL-ll-01 _T _ T146, p.82, lines 13-17, p.84, lines 3-11; PCC146:201503 l 6_STL-ll-Ol _ T_ T128, pp.38-40; PCC 143: 20150115 _STL-11-

STL-18-1 O/PT /PTJ 19of185 15 December 2020 Public Redacted R026523

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

Syrian control would later be echoed by the Hezbollah leadership, when Hussein KHALIL, political advisor to NASRALLAH, responding to HARIRI's refusal to adopt the Syrian candidate on his electoral list in February 2005, threatened to "tum Lebanon upside down" if HARIRI handed political control to the "Christians."107

54. GHAZALEH also invited JUMBLATT to meet with AL-ASSAD to discuss the extension, but JUMBLATT refused. 108 HARIRI immediately returned to Beirut and informed HAMADE and JUMBLATT. 109 HAMADE and JUMBLATT understood this to be a threat against HARIRI to compel him to approve the LAHOUD extension. 110 They advised HARIRI to vote in favour of the LAHOUD extension to safeguard HARIRI's security; whereas they would vote against it. 111

55. Thereafter, HARIRI supported the LAHOUD extension. 112 Portions of HAMADE's

opposition speech were published in newspapers on 29 August 2004. 113

56. On 1 September 2004, HAMADE attended a meeting with the Democratic Gathering, followed by a press conference announcing their opposition to the LAHOUD extension. 114 The next day, HAMADE joined the Democratic Gathering and made a

Ol _ T_ Tl07, p.25, lines 17-25; PCC144:201502 IO_STL-11-0l _T _Tl 15, p.54, lines 7-11; PCC151 :20150519 _STL-11- 0l _ T_ Tl50. p.38, lines 5-12; PCC147:20150323 _ STL-ll-Ol _ T_ Tl33, p.58, lines 7-11.

107 PCC080:60180565-50180603, para.43; PCC151:20150520_STL-ll-Ol_T_Tl51, p.26, lines 18-25, p.27, lines 2-11, p.28, lines 1-4.

108 PCC060:20141l18_STL-l l-Ol_T_T94, p.79, lines 3-15; PCC150:20150504_STL-l l-Ol_T_Tl46, pp.64- 66, p. 79, lines 18-25, p.80, lines 1-6.

109 PCC060:20141120_STL-l l-Ol_T_T96, p.6; PCC150:20150504_STL-l l-Ol_T_Tl46, pp.82-83.

110 PCC060:20141119 _ STL-l l-Ol _ T _ T95, p.22, lines 4-16; PCC060:10001l72-10001176, 10001174; PCC150:20150504_STL-ll-Ol_T_Tl46, p.84, lines 22-25. p.85. lines 1-11.

111 PCC060:20141120_STL-l l-Ol_T_T96, p.6, p.25, lines 9-18, p.26, lines 5-10.

112 PCC060:20141119 _STL-l l-Ol _ T_ T95, pp.34-38, 75-77; 6005001 l-60050050A, 60050015.

113 PCC060:20141119_STL-ll-Ol_T_T95, p.35, lines 8-12, p.40, lines 1-8; 60235629-60235642, 60235630; see also PCC060:60315057-603 l 5089, paras.12,24; 60050011-60050050, 60050015; 60235629-60235642, 60235630; D0500035-D0500036, D0500035.

114 PCC130:60095609A, p.22.

STL-18-1 O/PT /PTJ 20of185 15 December 2020 Public Redacted R026524

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

public plea to MPs to respect the will of the people who elected them and to vote against the extension. 115

57. The LAHOUD extension was widely considered as an effort to retain Syrian control and influence over the internal affairs of Lebanon. When discussions arose over the electoral law and the LAHOUD extension, Hezbollah remained loyal to the Syrian regime: 116 "Hezbollah's position was very clear: it was supportive of Syria's position."117

58. HAMADE and JUMBLATT unified a coalition against the control and influence of the Syrian regime in Lebanon, which emerged as the Bristol Group118 and included: (1) the Democratic Gathering lead by JUMBLATT and HAMADE; (2) the Quornet Shehwan; 119 and (3) the DLM that HAWI was instrumental in forming. 120

2. 2 September 2004: Adoption ofUNSCR 1559

59. One day before Parliament's vote on the constitutional amendment for the LAHOUD extension, the UN Security Council passed UNSCR 1559, calling for the withdrawal of non-Lebanese forces from Lebanon and the disarmament of all militias, including Hezbollah. UNSCR 1559 also underlined the importance of a "free and fair" process in the upcoming elections, without "foreign interference or influence", and in "strict respect" of Lebanon's sovereignty and political independence. 121 UNSCR 1559 was a

115 D0410503-D0410511, D0410504; D0485720-D0485724, D0485723-24.

116 PCC147:20150527_STL-1 l-Ol_T_T154, p.68, lines 12-25, p.69, lines 11-13, p.77, lines 4-6, lines 18-20, p.86, lines 21-22.

117 PCC147:20150527_STL-11-0l_T_Tl54, p.77, lines 5-6,18-20, p.86, lines 21-22.

118 PCC060:60315057-60315089, paras.10-12; PCC060:20141ll9_STL-l l-Ol_T_T95, p.28, lines 18-25, p.29, lines 1-8,12-19, p.29, lines 12-19; PCC150:20150505_STL-1 l-Ol_T_T147, p.15, lines 6-13.

119 60301198-60301198.

120 PCC060:60315057-60315089, paras.10-12,24,73; See II(C)(3). PCC060:60315057-60315089; PCC153:60014058-60014070, para.68.

121 60242046-60242047; PCC060:201411l9 _STL-l l-Ol_T_T95, p.60, lines 12-25, p.65, lines 4-20; see also, D0410940-D0410951; D0410140-D0410149.

STL-18-1 O/PT /PTJ 21 of185 15 December 2020 Public Redacted R026525

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

clear message to Syria-as well as Hezbollah-particularly in light of the upcoming vote on the LAHOUD extension. 122

60. The pro-Syrian politicians campaigned against UNSCR 1559, and Hezbollah organised pro-Syrian demonstrations in Beirut. 123 AL-ASSAD condemned UNSCR 1559 as an illegitimate and dangerous interference in Lebanese-Syrian affairs and said the calls to disarm Lebanese militias targeted Hezbollah. 124 NASRALLAH adamantly rejected UNSCR 1559, defending the presence of Syrian forces in Lebanon. 125 Pro-Syrian loyalists and AL-ASSAD accused HAMADE and HARIRI of being directly involved in drafting UNSCR 1559. 126 Hezbollah leaders believed that the Syrians would have to withdraw from Lebanon because of UNSCR 1559. 127

3. 3 September 2004: The LAHOUD extension

61. The Parliament approved the LAHOUD extension. 128 HAMADE, together with other MPs, voted against the amendment129 and their names were published in what became known as the Honour List. 130 Some MPs who voted against the amendment received

122 60242046-60242047; PCC150:20150507 _ STL-ll-Ol _ T_ Tl49, p.107. lines 7-9; PCCl 43:20150116 _ STL-ll- Ol _ T_ 108, p.38. lines 1-12, p.40, lines 8-20. p.45. lines 13- 25. p.46. lines 1-24; PCC144:20150210_T-ll­ Ol_T_Tl 15, p.54, lines 21-24; PCC060:20141l19 _STL-l l-Ol _ T_ T95, p.53, lines 2-19, p.60, lines 9-24, pp.48-50, p.59, p.65-66; D0410503- D04105 l l.

123 D0410762-D0410772, D0410763-64; D0411016-D04l1025, D04l1016-l 7; PCC129:603 l 5837-60315888, para.56; D0410810-D04 l 0824, D0410816-l 7; PCC060:60315057-60315089, para.41.

124 D0411215-D0411225, D0411215-16; D0407566-D0407567.

125 D0410762-D0410772, D0410763-64.

126 PCC060:20141208_STL-ll-Ol_T_T99, p40, lines 10-24, p.42, lines 11-25, p.43, lines l-7;PCC150:20150505_STL­ ll-O l _Tl 47, p.92, lines 4-7,18-19; PCC129:60315837-60315888, para.90; PCC060:2014ll19_ STL-l l-Ol _ T_ T95, p.68, lines 10-19. p.66. lines 16-25, p.56, lines 23-25; PCC060:60031499-60031549.60031505.

127 60242046-60242047; PCC080:60180565-60180603, para.33; PCC060:20141ll9_ STL-l l-Ol _ T_ T95, p.61, lines 13- 22.

128 PCC060:2014 l l l 9 _ STL-l l-Ol _ T _ T95, pp.79-82; PCCl 43:20150115 _ STL-ll-Ol _ T_ Tl07, p.19, lines 14-25.

129 PCC060:20141l19_STL-l l-Ol_T_T95, pp.78-82; PCC060:20141120_STL-l l-Ol_T_T96, p.6; PCC060:20141ll9_STL-l l-Ol_T_T95, pp.80-82; D0410512-D0410514; 60298546-60298563.

130 60315081-60315084; PCC060:20141l19_STL-l l-Ol_T_T95, pp.81-82.

STL-18-1 O/PT /PTJ 22of185 15 December 2020 Public Redacted R026526

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

threats. MP Ghattas EL-KHOURY, for example, was subject to concerted contact from GHAZALEH and Nasser KANDIL, a pro-Syria MP. 131 His wife received threatening,

anonymous phone calls saying that EL-KHOURY would return to her in a coffin. 132 KANDIL called for the dissolution of the UN Security Council and dubbed the 29 MPs who voted against the LAHOUD extension as belonging to a list of shame. 133

62. EL-MURR would later declare in a press release that he was declining to participate in the government. 134

63. Following the LAHOUD extension and the adoption of UNSCR 1559, HAWI grew more confrontational, publicly demanding LAHOUD's resignation. 135 HAWI sent a message to AL-ASSAD that it was "high time for the redeployment of Syrian troops outside of Lebanon and you should ask LAHOUD to resign."136

4. 7 September 2004: HAMADE's Resignation

64. HAMADE, together with four Ministers, resigned in protest against the LAHOUD extension, accusing Syria of undue pressure over Lebanese politics. 137 HAMADE explained that he resigned from the Council of Ministers but not from the Council of Deputies because LAHOUD presided over the former. 138 HAMADE published his

131 PCC143:20150115_STL-1 l-Ol_T_T107, p.40, lines 10-20, p.45, lines 6-17, p.57, lines 2-18.

132 PCC143:20150115 _STL-1 l-01_T_Tl07, p.46, lines 2-22. See also, PCC060:20141119 _STL-1 l-01 _ T_ T95, p.82, lines 22-25.

133 D0411215-D0411225, D0411220-21; D0410952-D0410959, D0410952-53.

134 PCCI4I :6032I499-6032I5I6, para. I I; D0574982-D0574983.

135 PCC 133 :60332885-60332906,60332895-96, para.34.

136 PCC132:60014872-60014885, para.32. See also PCC071:60332327-60332380,60332352, paras.71,75.

137 60236170-60236170; 60235629-60235642,60235637-38; PCC060:20141120_STL-1 l-01 _ T _ T96, p.2, lines 21- 25, p.3, lines 1-15; D000461 O-D0004613; D0410854-D0410861; PCC 150:20150504_STL-1 l-01 _ T_ T146, p. 88, lines 5-11; D0485720-D0485722,D0485721; D0004590-D0004593, D000459 l.

138 PCC060:20141120_STL-1 l-Ol_T_T96, p.6, lines 24-25; p.7, lines 8-25.

STL-18-1 O/PT /PTJ 23 of 185 15 December 2020 Public Redacted R026527

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

resignation letter in An Nahar, in which he reiterated his opposition to the LAHOUD extension. 139

65. Following HAMADE's resignation, HARIRI stepped down, announcmg that the Government's resignation would be tendered after the issuance of the UNSG Report. 140 HARIRI worked towards the formation of a widely publicised, new national unity government to last until the 2005 elections. 141

66. On 21 September 2004, the Democratic Gathering published its Ten Points Document, which inter alia condemned the Syrian power over Lebanon. 142 The Ten Points Document represented the common ground between the parties that convened the first Bristol Group meeting. 143

5. Majdel-Anjar Incident

67. In late September 2004, EL-MURR announced the arrest of an alleged terrorist network in Majdel-Anjar that allegedly planned to bomb the Italian embassy. 144 The death of one of the suspects in custody sparked riots in Majdel-Anjar and compromised the security in the area, and near GHAZALEH's office,145 which infuriated him. 146

139 60235629-60235642,60235637.

140 D0411627-D0411633, D0411630; D0004568-D0004581, D0004568; PCC060:20141120_STL-l l­ Ol_T_T96, pp.19, lines 20-25, 20, lines 1-5; D0410952-D0410959, D0410955; D0004625-D0004627.

141 PCC060:20141120_STL-1 l-Ol_T_T96, p.16, lines 20-25, p.17, lines 1-25, p.18, lines 1-2; PCC060:20141208_STL-1 l-Ol_T_T99, p.6,lines 21-25, p.7, lines 1-2, lines 11-19; D0004788-D0004790; D0004687-D0004688, D0004687; PCC060:60315057-60315089, para.27.

142 D0412049-D0412057, D0412054; 60301568-60301577; see also, D0485666-D0485670, D0485667.

143 D0412131-D0412139; PCC 150:20150505 _STL-1 l-01 _ T_ T147, p.20, linesl 8-19; 60301191-60301232; 60235641- 60235642; D0413620-D0413620; PCC143:20150115_STL-1 l-Ol_T_T107, p.76, lines 24-25, p.77, lines 1-5.

144 PCC141:60321499-60321516, para.18; PCC141:60028755Al_TS_D_EN, p.31; 60016937-60016960, 60016958. See also D0412049-D0412057 at D0412053.

145 PCC141:60321499-60321516, para.18; PCC141:60094653A_TS_D_EN, pp.70- 71; PCC141:60028755Al_TS_D_EN, p.59; 60016937-60016960,60016948, 60016958; PCC141:60321499- 60321516, para.17-18.

146 60016937-60016960, 60016958; PCC141:60321499-60321516, paras.19-20; PCC141: 60028755Al_TS_D_EN, p.59.

STL-18-1 O/PT /PTJ 24of185 15 December 2020 Public Redacted R026528

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

GHAZALEH blamed the Majdel-Anjar riots on EL-MURR147 and demanded the immediate release of the detainees. 148 After the Majdel-Anjar incident, EL-MURR was convinced that the "Syrians" must leave Lebanon. 149

6. 22 September 2004: First Bristol Group meeting

68. The first Bristol Group meeting brought together diverse groups 150 opposmg the LAHOUD extension and Syria's presence in Lebanon, 151 including HAMADE and JUMBLATT. 152 HARIRI never attended the Bristol Group's meetings, but sent members of his Parliamentary bloc and close political associates, George KHOURY and the late Bassel FULEIHAN, to represent him. 153

69. A banner was prominently displayed bearing the slogan of the Bristol Group: "In Defence of freedoms and protection of the Constitution." 154 HAMADE stated to the press that the gathering was a united opposition, with an important message to the new Cabinet, which cannot be easily formed without considering the c01Tection of the current crisis. 155

147 PCCI4 I :6032 I499-6032 I 5 I 6, paras. I 9-20.

148 PCC141:6032I499-6032I516, para.20; PCC141:60028755Al_TS_D_EN, p.59.

149 PCC141:60028755AI_TS_D_EN, p.36. See also, D0559496-D0559498, D0559497.

150 PCCI29:603 I5837-603 I5888, paras.39-4I; PCCI43:20I50I I5 _STL-I I-OI_T_T107, pp.77-78; PCCI50:20I50505_STL-I I-OI_T_T147, pp.24-26; PCC060:603 I5057-603 I5089, para. IO.

151 PCC 129:603 I5837-603 I5888, paras.39-41; PCCI 43:20I501 I5 _ STL-I I-OI _ T_Tl 07, pp.77-78; PCC150:20150505_STL-ll-Ol_T_Tl47, p.21, lines 6-8, pp.24-26; PCC060:60315057-60315089, para.IO.

152 PCC060:60315057-60315089, para.9; D0412I3 I-D04I2139,D0412I35;

153 PCCI50:20150505 _ STL-l l-Ol _ T _Tl 47, p.64, lines 5-I2; PCC l 43:20I50 l I5 _ STL-ll-OI _ T_Tl 07, pp.74- 77; D0412131-D0412139, D0412135; PCC084:20150108 _STL-I I-01_T_Tl05, p.42, lines 9-23; PCC060:2014I208_STL-ll-Ol_T_T99, p.5, lines 9-22; PCC060:603I5057-603I5089, paras.10-11; see also, D0500043-D0500043.

154 PCC150:20I50505_STL-11-0I_T_Tl47, p.21, lines 4-8. See also D04I3620.

155 603I9099-603I9IOI,603I9IOO.

STL-18-IO/PT /PTJ 25 of I85 I 5 December 2020 Public Redacted R026529

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

70. On 26 September 2004, HAMADE and JUMBLATT attended a large "gathering of anti-Syrian groups" at KHO UR Y's residence in Chouf. 156

7. 1October2004: HAMADE Attack

71. HAMADE' s attempted assassination, a few days later was the first of a series of violent retaliations against the Opposition. As described in detail below, 157 the HAMADE Attack took place in daylight on a public street, killed his bodyguard Ghazi ABOU­ KARROUM, severely injured HAMADE and [Redacted], and caused damage to nearby vehicles and surrounding buildings. This attack was calculated to create a state of terror, and to destabilise Lebanon generally. It was perceived as a warning towards HARIRI, JUMBLATT and others, that the Syrian regime and Hezbollah would not tolerate the Opposition. 158

72. EL-MURR immediately instructed the Internal Security Forces of the Lebanese Republic (ISF) to investigate the attack notwithstanding attempts by GHAZALEH to diminish the apparent motive for the attack. 159

8. UNSG Report

73. HAMADE's attempted assassination was the same day as the UNSG Report's scheduled release, 160 which ultimately found that the requirements of UNSCR 1559 were not fulfilled, 161 and noted concerns that the LAHOUD extension resulted from Syrian government intervention. 162 The timing of this attack is unlikely to have been a coincidence, given that the UNSG's finding of non-compliance with UNSCR 1559

156 D0502045-D0502046, D0502045; PCC060:60072872C_TS_ D _EN_AR, p.24. See Vl(A).

157 See Section VI.

158 PCC l 46:20150316 _ STL-l l-Ol _ T_ Tl28, p.55; PCC129:60315837-60315888, para.90; PCC150:20150505 _ STL- 1 l-01 _ T_ Tl47, p.43, lines 20-25, p.44, lines 1-5; PCC060:60315057-60315089, para.24; PCC060:20141120_STL-1 l-Ol_T99, p.48, lines 10-24.

159 PCC141:60321499-60321516, para.22; PCC141:60028755Al_TS_D_EN, p.54.

160 D0410359-D0410367, D0410359.

161 60211763-60211771, 602117670.

162 60211763-60211771, 60211769, para.27; PCC151:20150519 _ STL-11-0 l _ Tl50, pp.50-55; D0407554-D0407554.

STL-18-1 O/PT /PTJ 26of185 15 December 2020 Public Redacted R026530

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

would have been widely anticipated by those who opposed to it. This assertion gains further strength in light of the vehement opposition to the stance of the international community evident from the mass pro-Syrian/Hezbollah protests that followed, and the defiance that pervades the subsequent attacks against HARIRI and the other Opposition figures.

74. Following the release of the UNSG Report, pro-Syrian loyalists intensified their attacks, and AL-ASSAD condemned UNSCR 1559 as an illegitimate and dangerous interference in Lebanese-Syrian affairs. 163 Hezbollah dismissed the report as biased and "aimed at putting pressure on Syria."164 NASRALLAH rejected UNSCR 1559, defending the presence of Syrian forces in Lebanon. 165

75. After HARIRI resigned, 166 LAHOUD appointed pro-Syrian loyalist Omar KARAM! as Prime Minister and formed an overwhelmingly pro-Syrian Cabinet. 167 Key ministries were assigned to supporters of the Syrian regime. EL-MURR was replaced with one of the aims of his replacement being to have a pro-Syrian minister in charge of the upcoming Parliamentary elections, which HARIRI was widely expected to win. 168

163 D0411215-D0411225, D0411215-16; D0407566-D0407567.

164 D0410600-D0410613, D0410606.

165 D0410762-D0410772, D0410763-64; D0410600-D0410613, D0410606.

166 PCC060:20141208_STL-ll-Ol_T_T99, p.16, lines 11-25, p.17, lines 1-4; PCC150:20150505_STL-11-0l_T_Tl47, p.54, lines 7-17, p.73, lines 1-6; D04 l 0683-D0410692, D0410688-69; D0004809-D0004817.

167 60305503-60305505, 60305504; D0412058-D0412064, D0412058-59; D0411226-D0411232, D0411229- 30; PCC060:60315057-60315089, para.22.

168 PCC060:20141208_STL-11-0l_T_T99, p.76, lines 12-14, p.77, lines 1-11; PCC146:20150316_STL-ll­ Ol_T_Tl28, p.70, lines 11-25, p.71, lines 1-2; D0411226-D0411232, D0411229-30; PCC060:60315057- 60315089, para.31; D0004568-D0004581, D0004952-53; see also, PCC141:60321499-60321516, para.9.

STL-18-1 O/PT /PTJ 27of185 15 December 2020 Public Redacted R026531

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

76. EL-MURR was replaced as Interior Minister. 169 The next day, he travelled to Switzerland. 170

77. In November 2004, NASRALLAH reiterated his commitment to the military role of Hezbollah in Lebanon and to "defending Syria just like Syria has defended us."171 Hezbollah's staunch defence of the role of the Syrian regime in Lebanon was echoed in a mass demonstration in Beirut on 30 November 2004. 172

9. Second Bristol Group meeting and HARIRI's rejection of Syrian Deposits

78. The HAMADE Attack accelerated the formation and diversity of the Opposition and expanded the Bristol Group. 173 On 13 December 2004, the Bristol Group adopted a Charter calling for the end of Syria's interference in Lebanese affairs, the dismissal of KARAMI's government, and the implementation of the Taif Agreement. 174

79. On 9 January 2005, HARIRI conveyed to GHAZALEH175 his ultimate rejection of the electoral reform and the alliances imposed by the Syrian regime. 176 He would stand for

169 PCC141:60028755Al_TS_D_EN, p.27, lines 15-19; 60305503-60305505; PCC141:60321499- 60321516, para.IO; PCC060:60315057-60315089, para.31-33; See ll(B).

170 PCC141:60028755Al_TS_D_EN, p.14, lines 11-12; 60305503- 60305505, 60305504; PCC141:60028755Al_TS_D_EN, p. 29, lines 6-9; 60094649-60094658, 60094651.

171 D0411305-D0411312, D0411309.

172 D0410453-D0410458, D0410455-56; D0410378-D0410385, D0410380-83.

173 PCC060:60315057-60315089, para.21; see also, D0410453-D0410458; see also, PCC129:60315837-60315888, para.43.

174 D04 l 1388-D0411396, D0411389; D04 l 1481-D0411489, D041148 l-83; 60301191-60301232, 60301198- 24, 6031210; see also, 60301226-60301230, 60301226-28.

175 D0004921-D0004921; D0380523-D0380905, D0380844; PCC144:2015021 l STL-l l- Ol_T_Tll6, p.6, lines 1-25; PCC073:D0510861-D0511297, D0511090-93; PCC151:20150519_STL-ll­ Ol_T_T150, pp.83-85; PCC145:201503 l l_STL-1 l-Ol_T_T125, pp.23-25, 28, 51, 53, 54, 55- 117; PCC143:20150116_STL-1 l-Ol_T_T108, p.80,85-86; PCC143:20150120_STL-1 l-Ol_T_T109, p.19; 40000843D_Side A_U_EN; 40000843D_Side B_U_EN; 40000843C_Side A_U_EN; 40000843C_Side BU EN.

176 40000843C _SideA _U _EN, pp.8, 15-19; PCC 144:20150211 _STL-1l-Ol_T_Tl16, p.3, lines 1-25, p.9; PCC143 :20150116 _ STL-1 l-Ol _T _ Tl08, pp.66-70; PCC 145:201503 l l _ STL-l l-Ol _T _ Tl25, pp.113-116;

STL-18-1 O/PT /PTJ 28of185 15 December 2020 Public Redacted R026532

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

the elections in all the Lebanese districts. Unlike in the past when HARIRI had three pro-Syrian candidates imposed on him by the Syrians, the so-called Syrian Deposits, 177 this election HARIRI did not accept Syrian Deposits. 178 Instead, HARIRI sought a majority government with the Opposition that would free Lebanon of Syrian interference. 179 His refusal was a significant turning point. Upon leaving their meeting, GHAZALEH immediately contacted Wafiq SAFA, head of the Central Unit for Liaison and Coordination in Hezbollah, and travelled to Dahyieh. 180

10. Third Bristol Group Meeting: 2 February 2005

80. At the third heavily publicised meeting, the Bristol Group demanded the withdrawal of Syrian forces and the dismantling of Lebanese-Syrian intelligence networks. 181 FULEIHAN attended the Bristol Group meeting for the first time. 182 He participated in the name of HARIRI183 signalling HARIRI's irrevocable decision to join the

PCC060:20141120 _STL-l l-Ol _ T_ T96, pp.12-15, p.17, linesl 7-23; PCC150:20150505 _STL-l l-Ol _ T147, pp.50-51. See also, D0410124-D0410131, D0410129.

177 PCC060:20141120_STL-l l-Ol_T_T96, pp.12-14; PCC084:20150108_STL-l l-Ol_T_Tl05, p.44.

178 PCC143:20150116_STL-l l-Ol_T_Tl08, p.66, lines 6-18; PCC144:2015021 l_STL-l l-Ol_T_Tl 16, p.8, lines 1-25; PCC151:20150519_STL-1 l-Ol_T_Tl50, pp.84-85.

179 PCC144:201502 l l _STL-1l-Ol_T_Tl16, pp.5, lines 1-25; PCC080:60180565-60180603, pp.11, para.43.

180 D0386446-D0387036, D038781 l, lines 10241-10242; D0144309-D0144442, D0144362; D0567763- D0567826, paras.121-123; D0380523-D0380905_D_EN_Ol, D0380844, line 15599.

181 PCC150:20150506_STL-l 1-0l_T_Tl48, pp.100-101, p.105, lines 2-7; D0429677-D0429683; D0410470- D0410476, D0410471.

182 PCC143:20150120_STL-1 l-Ol_T_Tl09, p.56, lines 21-23, p.57, lines 11-17; PCC146:20150316_STL-11- 0l_T_Tl28, p.52, lines 6-16.

183 PCC151:20150519_STL-11-0l_T_T150. p.74. lines 6-14; PCC143:20150116_STL-ll-Ol_T_Tl08, p.31, lines 18-22; D0429677-D0429683. D0429678; PCC084:20150108 _ STL-11-0l _T _Tl 05. p.42. lines 1-23; PC Cl 46:20150316 _ STL- 1 l-Ol _ T_ T128, p.72, lines 12-18.

STL-18-1 O/PT /PTJ 29of185 15 December 2020 Public Redacted R026533

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

Opposition 184 and a clear message to the Syrian regime: "I am officially against you."185 HARIRI's absence was intentional to allow himself"a wider margin of manoeuvre". 186

81. Following this meeting, pro-Syrian loyalists issued verbal attacks and warnings against the Opposition. KARAM! asserted that the Opposition had "crossed all the lines." 187

82. HARIRI's alliance with the Opposition and his steadfast refusal to bow to Syrian demands also resulted in ever-increasing tensions between HARIRI and those interested in maintaining Syrian influence and control. The pro-Syrian Lebanese Interior Minister Suleiman FRANJIEH accused HARIRI "of being the tutor of the opposition."188 On 4 February 2005, after HARIRI had personally informed KANDIL-a key Syrian deposit used by the Syrians to exercise their control over HARIRI-of his decision to not include him on his electoral list, 189 KAND IL immediately called SAFA. 190 That evening, KHALIL, NASRALLAH's most senior aide, invited a journalist, trusted by Hezbollah and HARIRI, to a meeting in Dahyieh

to protest. 191

83. What followed 1s significant because it offers a rare and direct insight into the perception of HARIRI and the Opposition by Hezbollah and, on the eve ofHARIRI's assassination, at a crucial time. It illustrates the strength, passion and rationale behind the Syria-Hezbollah alignment and provides the backdrop for BADREDDINE and AYYASH, as Hezbollah affiliates, targeting prominent figures opposed to ongoing

184 PCC143:20150116_STL-ll-Ol_T_Tl08, p.29, lines 18-25. p.30. lines 1-2; PCC151:20150519_STL-ll-Ol_T_Tl50, p.74, lines 6-14, p.76, lines 3-25, p.77, lines 1-16; PCCI 50:20150505 _STL-l l-Ol _T _ Tl47, p.63.

185 PCC150:20150505_STL-l l-Ol_T_Tl47, p.64, lines 5-19.

186 PCC143T:20150116_STL-ll-Ol_T_l08, p.31, lines 1-4.

187 D0004974-D0004975; D0410548-D0410555, D0410551-52.

188 D0410548-D0410555, D0410551.

189 D0380523-D0380905, D0380891, entry 17866; PCC149:20150428_STL-ll-Ol_T_Tl42, pp. 46-48, 50- 51.

190 D0542289-D0543 l 83,D0542624; PCC025:D0567763-D0567826, paras.121-123; D0144309-D0144442, D0144384.

191 PCC080:60180565-60180603, para.43; PCC151:20150520_STL-ll-Ol_T_Tl51, p.26, lines 17-25, p.27, lines 2-11, p.28, lines 1-4.

STL-18-1 O/PT /PTJ 30of185 15 December 2020 Public Redacted R026534

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

Syrian influence. Echoing the violent threats made by AL-ASSAD in August 2004, regarding the fate of Lebanon, KHALIL conveyed an angry warning to HARIRI:

HARIRI will accept with his foot over his neck[ ... ] if [I] was in HARIRI's shoes [I] would grant Rustom [GHAZALEH] eight seats [on his electoral list] instead[ ... ] even Hasan Abd Al-Karim NASRALLAH couldn't refuse such a demand from the Syrians [ ... ] if HARIRI thinks he can hand the country over to the Christians we'll not allow it and we'll turn the country upside down [ ... ] [we] did not fight for 25 years simply to see HARIRI hand over the country to the Christians. 192

11. 14 February 2005: HARIRI's assassination

84. Ten days later, HARIRI was brutally murdered, along with 21 others, and 226 others injured, by the detonation of a huge VBIED. 193 Most were simply innocent bystanders who had no connection with HARIRI's convoy. The massive explosion caused colossal damage to proximate buildings and vehicles and ignited fires. 194 This attack was calculated to create a state of terror, and to destabilise Lebanon.

12. Independence Intifada and 14 March Movement

85. Following HARIRI's assassination, the Bristol Group declared the formation of the Independence Intifada, which later evolved into the 14 March Movement. 195 The Movement's demands included resignations of the heads of security in Lebanon, an international investigation into HARIRI' s assassination, and the withdrawal of the Syrian troops in compliance with the Taif Agreement. 196

192 PCC080:60180565-60180603, para.43; PCC151:20150520_STL-ll-Ol_T_Tl51, p.26, lines 17-25, p.27, lines 2-11, p.28, lines 1-4.

193 PCC234:20150226_STL-l l-Ol_T_Tl21, p.98, lines 1-8; PCC234, PCC233:D0254550-D0254650, D0254650; Fl492, Disposition, Agreed Fact (ii); F3839, paras.1006,1416,1448.

194 PCC224:50011349-50011370, 50011355-56; F3839, paras.1006-1016,1036-1041.

195 PCC130:60308701-60308716, para.10; 60315620-60315629, 60315623; PCC129:60315837-60315888, paras.45- 46-48; see also. D0411413-D0411416; D0411581-D0411587, D0411582-84.

196 PCC129:60315837-60315888, paras.47,49.

STL-18-1 O/PT /PTJ 31 ofl85 15 December 2020 Public Redacted R026535

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

86. The strong speeches in Parliament by Opposition MPs, including HAMADE, led to KARAMI's resignation on 28 February 2005. 197 Massive anti-Syria demonstrations flooded the streets in the weeks that followed. 198

87. On 8 March 2005, before the Syrian troops' withdrawal from Lebanon, thousands participated m a pro-Syria march organised following the directive of NASRALLAH, 199 leading to the formation of the 8 March Movement, a pro-Syrian Parliamentary bloc.200

88. The largest anti-Syria demonstrations took place on 14 March 2005, the 14 March Movement. HAMADE and HAWI attended these demonstrations. 201 HAWI joined the 14 March Movement,202 calling on leftist supporters to participate. 203

89. Although not a part of the 14 March Movement,204 EL-MURR shared most of its objectives including an independent Lebanon. 205 On 20 March 2005, EL-MURR sent a letter to LAHOUD, advising him to support the Opposition demands to support an international investigative commission into the HARIRI Attack and hold Parliamentary elections with international observers,206 posing a clear threat to Syria and its close allies including Hezbollah. EL-MURR urged LAHOUD to accept this proposal or

197 PCC060:60315057-60315089, para.48.

198 PCC060:60315057-60315089, paras.23,42; D0411659-D0411665, D0411660-61; D0411924-D0411933; D0410908-D0410914, D041091 l.

199 D0411016-D0411025, D0411016-18; PCC129:60315837-60315888, para.56; D0410810-D0410824, D0410816-17; PCC060:60315057-60315084, paras.41-42; PCC145:2015031 l_STL-1 l-Ol_T_T125, p.46, lines 10-22; PCC151 :20150520_STL-1 l-Ol_T_T151, p.52, lines 1-14.

200 PCC060:20141209_STL-11-0l_T_Tl00, p.32, linesl2-15; PCC129: 60315837-60315888, para.71.

201 D0411511-D0411518, D0411513-14; PCC060:60315057-60315089, para.42.

202 PCC129:60315837-60315888, para.53. See also PCC137:60311667-60311693, para.13.

203 PCC133:60332885-60332906,60332896-97, para.36; PCC060:60315057-60315089, para.47. See also PCC129:60315837-60315888, paras.46,48.

204 PCC141:60028755Al_TS_D_EN, pp.77,99; See ll(C).

205 PCC141:60028755Al_TS_D_EN, pp.77,99; See ll(C).

206 PCC141 :60016993-60016996, 60016994.

STL-18-1 O/PT /PTJ 32of185 15 December 2020 Public Redacted R026536

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

resign. 207 EL-MURR publicly asserted that the Syrian withdrawal is "excellent for the country. "208

90. HAWI continued being an outspoken supporter of the Opposition, which further eroded his relations with Syria. HAWI publicly presented his 5-point political plan based on the withdrawal of Syrian troops from Lebanon, the removal of Syrian Intelligence presence from Anjar, LAHOUD's resignation, the establishment of new electoral law, and the resignation of the four generals.209 On 20 March 2005, HAWI met with GHAZALEH in Majdel-Anjar and presented his plan to replace LAHOUD. 210 That same day, HAWI participated in a political debate on Future TV where he asked LAHOUD to resign and presented his political plan.211

91. Between late March and April 2005, HA WI met with JUMBLA TT, representatives of Hezbollah, including NASRALLAH, and other political figures. 212 At these meetings, HAWI presented his political plan and criticised Syria.213 Ultimately, either NASRALLAH himself, or his representative, refused to replace LAHOUD. 214

207 PCC141 :60016993-60016996, 60016995.

208 PCC141:60321499-60321516, para.32; 60016937-60016960, 60016949, 60016953.

209 PCCI 42:60332303-60332326,60332316-17, para.50; PCCI 42:60311595-60311618, para.22; D0227278- D0227278; D0227278 _ D _EN. See also PCC136:6001l769-60011788, para.28; PCC133:60332885- 60332906,60332895-96, para.34; PCC 135:60311619-60311666, para. IO; PCC076:60332095-60332 l 31, 60332123-25, 60332127; 60317109-60317111; 60316102-60316103.

210 PCC134:60090141A, pp.45-4 7, 64; PCC062:6033l133-60331235.6033l189, para.60; PCC135:603l1619-603l1628, para.23.

211 60100680A,01:12:02,01:12:37; D0227278_D_EN, pp.50-51.

212 PCC072:60332074-60332094,60332086, para.46; PCC132:60014872-60014885, para.32; see also, PCC134:60090141A, pp.53,59-60,64; but see, PCC142:60311595-603l1618, paras.23-24; PCC136:60011769- 60011788, para.28; See PCC062:6033l133-60331235,6033188-89, para.56.

213 60315254-60315256, 60315254(Part2/3).

214 PCC134:60090141A, p.64; PCC 132:60014872-60014885, para.32; PCC136:60011769- 60011788, paras.28,40; PCC06 l :60333366-60333687 ,603333 75; PCC 142:60311595-60311618, paras.23-24.

STL-18-1 O/PT /PTJ 33 of 185 15 December 2020 Public Redacted R026537

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

92. During this period, HAWI continued to advocate publicly for LAHOUD's replacement.215 He also criticised LAHOUD in the media,216 blaming him and the joint Lebanese-Security apparatus for each explosion or assassination. 217

93. The 14 March Movement crystallised around May 2005, ahead of the 2005 elections. 218 HAMADE and HAWI both played an important role in the 2005 elections. HAMADE was one of the main faces of the Opposition's leadership, and in command of the 14 March Movement that represented all Opposition parties. 219 HAWI actively lobbied for the DLM and the anti-Syrian coalition,220 leading to the election of the DLM candidate in the north, on the eve ofHAWI's assassination. 221

13. EL-MURR as Minister of Defence and investigation of the HARIRI Attack

94. On 19 April 2005, EL-MURR was appointed Minister of Defence and Deputy Prime Minister within the caretaker government led by then Prime Minister Najib MIKATI.222 On 28 April 2005, EL-MURR announced the appointment of KHOURY as Director of Military Intelligence, 223 and designated him to follow up on the Lebanese Military Intelligence (LMI) investigation into the HARIRI assassination. 224 EL-MURR stated

215 60317109-60317111,60317110.

216 PCC132:60014872-60014885, para.32; PCC071 :60332327-60332380,60332352, para.71.

217 PCC 132:60014872-60014885, para.32; PCC071 :60332327-60332380,60332352, para. 71; PCC 133 :60332885- 60332906,60332897, para.38; PCC060:60315057-60315089, para.78; PCC136:60307256-60307265, para. IO; See also PCC136:60011769-6001l788, para.28, para.38. See also PCC072:60332074-60332094,60332085, para.42; PCC129:60315837-60315888, para.17; PCC131:60332907-60332916,60332914, para.15.

218 PCC129:60315837-60315888, para.50.

219 PCC060:20141ll9 _ STL-11-0 l _ T_ T95, p.28, lines 18-25; PCC060:60315057-603 l 5089, paras.38-39.

220 PCC060:60315057-60315089, para.38; See II(C)(3). 221 See ll(C)(3).

222 60236171-60236172, 60236171; PCC141:60321499-60321516, para.38; PCC141:201123- 201132, 201124; 60236171-60236172, 60236172; PCC141 :60230953- 60231103, para.153; PCC141:60321499-60321516, paras.37-38.

223 60066859-60066912,60066873; PCC141 :60321499-60321516, para.45; PCC141 :201123-201132, 201129.

224 PCC141 :60321499-60321516, para.45; PCC141 :201123-201132, 201129.

STL-18-1 O/PT /PTJ 34of185 15 December 2020 Public Redacted R026538

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

before the Council of Ministers that it was the State's duty to cooperate with the United Nations International Independent Investigation Commission.225

14. 2005 Parliamentaiy elections

95. The Parliamentary elections were the first elections held since the Syrian withdrawal, and took place in May and June 2005. Saad HARIRI and JUMBLATT's coalition secured an absolute majority in Parliament. 226

96. According to HAMADE, EL-MURR gradually distanced himself from supporting LAHOUD and the Syrians, and aligned himself closer to the Opposition. 227 In the aftermath of the Parliamentary Elections, it was widely reported that EL-MURR was expected to be re-appointed as Deputy Prime Minister and Defence Minister in an Opposition-led government. 228

97. In April 2005, and throughout the electoral campaign, HAWI remained an outspoken critic of the Syrian regime,229 and his views on the Syrian presence in Lebanon were uncompromising.230 On 22 May 2005, HAWI publically blamed231 Refaat AL­ ASSAD, Hafez AL-ASSAD's brother, and "one of the pillars of the regime" for killing Walid JUMBLATT's father, Kamal JUMBLATT. 232

225 60066859-60066912, p.60; See Also D0410924-D0410933.

226 60217573-60217643,60217606.

227 PCC060:60315057-60315089, para.33.

228 60311829-60311838,60311830.

229 PCC061 :60333366-60333687 ,603333 83; PCC 142:60332303-60332326,60332316- 17, para.50; PCC071:600385 l 7-6003853 l, para.73.

230 PCC132:60014872-60014885, para.34; PCC07 l :60038517-60038531, para.71; PCC130:60308701-60308716, para.47; PCC 132:60014872-60014885, para.34.

231 D0499769-D0499781; D0549732-D0549930, D0549815.

232 PCC 136:60307256-60307265, para.25; D0499769-D049978 l, D049977 l; PCC06 l :60333366- 60333687,60333374-75; PCC 130:6009561 lA_TS_ D _EN, p.44. See also PCC 133 :60332885- 60332906,60332899-900, para.50.

STL-18-1 O/PT /PTJ 35 of 185 15 December 2020 Public Redacted R026539

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

98. On 26 May 2005, HAWI agam condemned the Syrian presence in Lebanon.233 Promotional clips of two of HAWI's most controversial statements aired intensively days before the broadcast: HAWI condemned the Syrian presence in Lebanon and called on Syria to "retreat" from Lebanon.234

99. On 2 June 2005, the day of prominent left-wing activist, Samir KASSIR's assassination, HAWI attended the crime scene, accused the Lebanese-Syrian security apparatus,235 and demanded the President's resignation. He also declared the attacks on KASSIR and the Opposition, were "parallel acts aimed at stopping the process of democratic change in the country."236

15. 21June2005: HAWI's assassination

100. On 20 June 2005, HAWI met with former LCP members to discuss a plan to form a new political gathering of democrats. 237 HAWI believed that the Syrian regime would react negatively against Elias ATALLAH's victory since many of those who did not succeed were pro-Syrian loyalists.238 ATALLAH was the first Secretary-General of the DLM, known to be against the Syrian regime and supporting the independence of Lebanon.239 HAWI planned to meet with ATALLAH the next day to discuss the upcoming role of the DLM, but was killed before their meeting.240

233 D0276256-D0276256, 00:43:04; D0276256_TS_EN, p.17; PCC131:60332907-60332916,60332913-14, paras.4-15.

234 D0276256, 00: 13:59; D0276256_ TS_ EN, p.5; PCC062:6033l133-60331235,60331189, para.60; PCC131:60332907- 603329l6,603329l4, para.15; 60013491-60013515.

235 D0227280-D0227280, 00:00:00 - 00:02:59; D0227280_D_EN_O1, p. l; PCC072:60332074- 60332094,60332088, para.61.

236 D0227280-D0227280, 00:00:00 -00:02:59; D0227280 _D _EN_ 01, p.1; D0564652, 00:00:00; D0564652 _D _EN.

237 PCC072:6033207 4-60332094,60332087, para.52; PCC 142:60332303-60332326,60332312-13, paras.34,36.

238 PCC132:60014872-60014885, para.26.

239 PCC129:60315837-6031588, paras.21,22,25,44,46. See ll(C)(3).

240 PCC130:60308701-60308716, para.46.

STL-18-1 O/PT /PTJ 36of185 15 December 2020 Public Redacted R026540

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

101. On 21 June 2005, [Redacted], [Redacted], met HAWI near his residence and they departed in HAWI's car. [Redacted] [Redacted] and HAWI was seated in the front passenger seat. The remote detonation of the IED under HAWI' s car killed HAWI, and caused injuries to [Redacted] and [Redacted] a bystander. The explosion took place on a public street during daylight hours. 241 This attack was calculated to create a state of terror, and to destabilise Lebanon generally. HAWI's opposition to the hegemony of Syria, common to the other three targeted victims, is relevant to the fact that he was targeted.

16. EL-MURR's attempted assassination

102. On 12 July 2005, EL-MURR and others left his summer residence in Halat-Sur-Mer. The remote detonation of the VBIED on a public street during daylight hours killed Khaled MOURA, a passing motorist, and severely injured EL-MURR, [Redacted], and [Redacted], as well as injured twelve other bystanders. Nearby vehicles and buildings were damaged. 242

103. EL-MURR represented yet another prominent figure, though previously pro-Syrian, targeted for his promotion of Lebanese sovereignty free of Syrian interference.243 This attack occurred only five months after HARIRI's assassination and less than one month following HAWI's assassination.

104. Despite this attack,244 EL-MURR formally joined the Opposition after re-appointment in July 2005.245 As HAMADE observed, EL-MURR, "behaved as one ofus."246

241 See Section VI.

242 L0046048-L0046076; PCC 166:60321708-60321716, paras.18, 23-24; PCC206:60324497-60324518, paras.14-18, 60324507-60324510.

243 PCC129:60315837-6031588, para.120.

244 PCC141:60094653A_TS_D_EN, pp.5,15; 60236167-60236169, 60236168.

245 PCC060:60315057-60315089, para.33.

246 PCC060:60315057-60315089, para.33.

STL-18-1 O/PT /PTJ 37of185 15 December 2020 Public Redacted R026541

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

E. The Relationship between Hezbollah and Syria

105. Hezbollah and the Syrian regime shared "existential ties"247 since the Israeli invasion of southern Lebanon in the 1980s. 248 These ties were evidenced by Hezbollah being installed as a military presence in Lebanon. 249

106. By the beginning of the 1990s, the Syrian regime asserted significant control over Hezbollah,250 which was permitted and empowered to operate as the sole militia in Lebanon.251 The Syrian regime supported Hezbollah even at the expense of other resistance movements252 as their relationship became ever closer. 253

107. The political cooperation between Syria and Hezbollah deepened under Bashar AL­

ASSAD. 254 Syrian interference skewed Lebanese elections in favour of Hezbollah candidates, as Hezbollah promoted pro-Syrian candidates,255 and it was noted as a consequence that Hezbollah and the Syrian regime were "a continuation of the other in terms of the political arena."256

247 PCC129:60315837-60315888,60315887; PCC145:20150310_STL-ll-Ol_T_Tl24, p.30, lines 9-19.

248 PCCI44:20I502IO_STL-I I-OI_T_Tl I5, p.74, lines I6-20; PCCI45:20I503IO_STL-I I-OI_T_Tl24, p.30, lines 9-I9.

249 PCC060:20I41ll9_STL-ll-OI_T_T95, p.56, lines 13-21; PCC145:60147027-60I47136, para.IO; PCCI50:20I50505_STL-11-0I_T_Tl47, p.5, lines 7-9,22-24; PCCI29:603I5837- 60315888, paras.74-75; PCC060:603 l 5057-603 l 5089, para.71; PCCI49:20I50428_STL-I I-OI _ T_ Tl42, p.17, line 20-25, p.18, lines 1-6.

250 PCC129:603 I5837-60315888, paras.74-75.

251 PCC060:60315057-60315089, para.71.

252 PCC145:60147027-60147136, para.IO.

253 PCC060:20I4I209_STL-I I-OI_T_Tl00, p.49, lines I 7-2I, 22-23.

254 PCC060:20I4I I I9_STL-I I-OI_T_T95, p.58, lines I5-25, p.59, lines I-I I; PCCI44:20I502IO_STL-I I­ Ol_T_Tll5, p.74, lines 16-25.

255 PCC060:20141208_STL-I I-Ol_T_T99, p.62, lines I-8; PCC145:20150310_STL-I I-Ol_T_T124, p.18 lines I-18, p.28, lines 8-25. p.29. lines l-I9; PCC151:20I50520_STL-11-0I_T_Tl51, p.30, lines 21-25, p.31. lines l-I8.

256 PCCI45:60I47027-60I47136, para.IO.

STL-18- IO/PT /PTJ 38 of I85 I 5 December 2020 Public Redacted R026542

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

108. In August 2000, Ghazi KANAAN, head of 257 asked HARIRI to remove candidates from his list for Beirut's second constituency,258 and "keep that seat vacant for [ ... ] the Hezbollah candidate."259 Hezbollah was then primarily represented in southern Lebanon and the Bekaa Valley. 260 Obtaining seats in the capital expanded Hezbollah's representation and increased Syrian influence in Beirut.261

109. Hezbollah and the Syrian regime remained close in the autumn of 2004 and into 2005.262 This is evident from the series of public rallies, events and proclamations fiercely supportive of each other, that pervaded this period, as set out above in the timeline.263 After the assassination of HARIRI, and before Syria's withdrawal, the two became ever closer. Hezbollah organised farewell demonstrations in support of Syria,264 and a farewell meeting with GHAZALEH. 265 On 8 March 2005, hundreds of thousands of people attended a mass rally led by Hezbollah to thank Syria ahead of its withdrawal from Lebanon. 266 Hezbollah had "wanted the Syrian army to remain",267 and the demonstration was perceived as a "message of allegiance to the Syrians and Bashar Al-Assad."268 Banners reading "Thank you Syria, no to foreign interference"

257 PCC145:20150310_STL-1 l-Ol_T_T124, p.18, lines 1-5.

258 PCC145:20150310_STL-1 l-Ol_T_Tl24, pp.28-29.

259 PCC145:20150310_STL-1 l-Ol_T_Tl24, p.28, lines 22-23.

260 PCC145:20150310_STL-11-0l_T_Tl24, p.29, lines 14-15.

261 PCC145:2015031 O_STL-1 l-01 _T _ T124, pp.28-29; PCC145:60147027-60147136, para.I 0.

262 PCC144:20150210_STL-11-0l_T_Tl 15, p.75, lines 11-15.

263 See ll(D).

264 PCC145:2015031 l_STL-ll-Ol_T_Tl25, p.46, lines 10-15; PCC151:20150520_STL-ll-Ol_T_Tl51, p.52, lines 1- 14; D0411016-D0411025, pp.1-2; PCC060:60315057-60315089, p. l 0, para.42.

265 PCC151 :20150520_STL-1 l-Ol_T_T151, pp.56-58.

266 PCC145:201503 l l_STL-11-0l_T_Tl25, p.46, lines 6-15; PCC151:20150520_STL-ll-Ol_T_Tl51, p.52, lines 1-14.

267 PCC060:60072872A_TS_D_EN_AR, p.41, lines 25-26.

268 PCC151 :20150520_STL-1 l-Ol_T_T151, p.52, lines 2-4.

STL-18-1 O/PT /PTJ 39of185 15 December 2020 Public Redacted R026543

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

were raised, along with portraits of AL-ASSAD and NASRALLAH,269 who spoke to thank Syria. 270

110. The close relationship between the Syrian regime and Hezbollah was evident through the activities of Syrian Intelligence and its officials in Lebanon, including having a presence in Dahyieh to facilitate liaison with Hezbollah.271

111. Ultimately, the symbiotic relationship that persisted in 2004-2005, and the reason why AYYASH and BADREDDINE, as senior members ofHezbollah, orchestrated a series of terrorist attacks, is captured by the reaction of one of the Hezbollah leadership (KHALIL) to HARIRI's refusal to continue to obey Syrian interference:

"HARIRI will accept with his foot over his neck [ ... ] if [I] was in HARIRI's shoes [I] would grant Rustom [GHAZALEH] eight seats [on his electoral list] instead[ ... ] even Hasan Abd Al-Karim NASRALLAH couldn't refuse such a demand from the Syrians [ ... ]if HARIRI thinks he can hand the country over to the Christians we'll not allow it and we'll turn the country upside down[ ... ] [we] did not fight for 25 years simply to see HARIRI hand over the country to the Christians." 272

III. RELATIONSHIP OF AYYASH & BAD REDDINE WITH HEZBOLLAH

A. AYYASH and BADREDDINE were acknowledged by the Secretary General of Hezbollah as "Brothers in the Resistance"

112. NASRALLAH acknowledged and confirmed during the course of STL-11-01 proceedings that AYYASH and BADREDDINE were brothers of the resistance.

113. On 11November2010, prior to the completion of the indictment against the four Accused in the STL-11-01 case, NASRALLAH stated "[m]istaken is he who believes that we will allow the arrest or detention of any of our mujahedeen. The hand that

269 D0411016-D0411025, pp.1-4.

270 PCC060:60315057-60315089, p.10, para.42.

271 PCC145:2015031 l_STL-1 l-Ol_T_T125, p.40 lines 1-10, p.47 lines 17-19.

272 PCC080:60180565-60180603, para.43; PCC151:20150520_STL-11-0l_T_Tl51, p.26, lines 17-25, p.27, lines 2-11, p.28, lines 1-4.

STL-18-1 O/PT /PTJ 40of185 15 December 2020 Public Redacted R026544

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

attempts to reach them will be cut off. "273 On 2 July 2011, NASRALLAH, in response to the confirmation of the STL-11-01 indictment, stated that it had been issued "against brothers in the resistance."274 Further, on 17 August 2011, during a speech, NASRALLAH reiterated his reference inter alia to AYYASH and BADREDDINE as "honourable resistance men". 275 The veracity of those statements was supported by the information provided on BADREDDINE after his death. 276

B. AYYASH's role in Hezbollah

114. AYYASH together with senior Hezbollah commander BADREDDINE and unidentified users of covert network phones, planned, coordinated and executed attacks against HAMADE, HARIRI, HAWI and EL-MURR.277 AYYASH's role required a high level of trust and confidence in the specialised skills demanded by such attacks; A YYASH met such expectations as evidenced by his coordination in preparing and executing the attacks. AYYASH's direct access to high-ranking Hezbollah actors also demonstrates a greater role in the organisation than one of mere political affiliation.

1. AYYASH's access and use of high level Hezbollah resources and information

115. The attacks could not have been carried out without operational support, expertise, skill and a commonality of purpose. BADREDDINE, with his seniority in Hezbollah, had the capacity to provide leadership, expertise and skill. AYYASH and BADREDDINE as affiliates of Hezbollah were able to carry out sophisticated preparation including through covert observations and surveillance.

116. These attacks required covert communication networks, one such network used by AYYASH and BADREDDINE was the (comprising

273 D0506 l 99-D05062 l 3, D05062 l 1. Prospective witnesses were protected from being interviewed by referral to the Hezbollah security committee. See PCC002:60316105-60316134; PCC002:60282425- 60282470; PCCOOl :60283679-60283687.

274 60223020-60223123,60223025.

275 60236173_D_EN, p.5.

276 See lll(C).

277 See Section VI.

STL-18-1 O/PT /PTJ 41 of185 15 December 2020 Public Redacted la) ft I I ftk)II uau UH lt:\.,l i:l\.,\.,t;~~ lU ~t::IUUI Ulll\.,li:ll~ 111 IJXLUUlli:tll

119. AYYASH was in contact with BADREDDINE, through network and non-network mobile phones. The fact that A YYASH cmTied a phone used for the sole purpose of

278 PCC082:60263705_TS_O_EN_AR_Ol(FINAL RED), pp.86-87; D0277627_U_EN, 00:05:43, p.3.

279 See VI(B) and VI(D). PCC073:D0568651-D0568907, para.1084.

STL-18-1 O/PT /PTJ 42of185 15 December 2020 Public Redacted R026546

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

directly accessing a senior Hezbollah commander demonstrates AYYASH's role in the organisation. 280

120. AYYASH was also in direct contact with SAFA,281 who was head of Hezbollah's central unit for liaison and coordination, 282 a high ranking role within the organisation. 283

121. AYYASH has a high volume of contacts with Abdallah Ali SAFIEDDINE across personal and non-personal mobiles phones.284 SAFIEDDINE is Hezbollah's representative in Iran285 and NASRALLAH's cousin. 286 SAFIEDDINE shares a remote family connection with AYYASH and provided his name as a contact for an insurance policy.287 SAFIEDDINE is the brother of Hachem SAFIEDDINE288 who is in charge ofHezbollah's Executive Council and the likely successor ofNASRALLAH.289

122. AYYASH had numerous one way calls290 via his network and non-network mobile phones to phone numbers subscribed to Protel and five one way calls to Great Prophet Hospital,291 both of which were commercial telephone lines belonging to Hezbollah.292 Other and network phones, contacts of both A YYASH and

280 See Section IV. PCC025:D0568187-D0568339, para.301.

281 PCC025:D0568187-D0568339, paras.144(y),238(i).

282 60177667-60177668; D0530004-D0530006, D0530004; PCC080:60180565-60180603, para.75.

283 PCC025:D0567763-D0567826, paras.121-123; D0326164-D0326168.

284 PCC025 :DOS 06541-D0507009, para. 92(g).

285 PCC080:60180565-60180603, para. 72.

286 PCC080:60180565-60180603,60180580; 60144964-60144990, 60144978, 60144986-87; 60254171-60254171.

287 PCC025:D0506541-D0507009, para.92(g); 60144964-60144990, 60144978, 60144986-87; 60254171-60254171.

288 60254171-60254171.

289 PCC080:60180565-60180603, 60180580, para.72.

290 PCC073:20160406_STL-11-0l_T_T252, p.47, lines 1-15.

291 PCC025 :D0506541-D0507009, paras.231,254,335.

292 60327043-60327083; 60326568-60326575, 60326569; PCC025:D0567763-D0567826, paras.68-69, 117.

STL-18-1 O/PT /PTJ 43 of 185 15 December 2020 Public Redacted 297 PCC080:60180565-60180603, para.72.

298 60180565-60180603,60180580; 60144964-60144990,60144978,60144986-87; 60254171-60254171.

299 60144964-60144990, 60144978,60144986-87; 60254165-60254193, 60254171; PCC025 :D0567763-D0567826, para.125.

300 PCC023 :60255938-60255956, paras.40,47-50.

301 60255958-60256013,60255967-69;60255963-60255963; 60223020-60223123,60223025.

STL-18-1 O/PT /PTJ 44of185 15 December 2020 Public Redacted R026548

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

126. AYYASH's application to perform the Hajj in 2004 describes him as an 'MPs companion' .302 The Office of the Head of the Loyalty of Resistance Bloc had provided a letter dated 30 December 2003 to the Head of the Pilgrimage Affairs Committee stating that AYYASH would be escorting one of the Party's MPs.303

127. For the 2005 Hajj period, AYYASH's application states that it was requested as a courtesy to the Loyalty to the Resistance Bloc.304 The letter dated 23 December 2004 to the Head of the Pilgrimage Affairs Committee listing the "brothers" for which assistance was required to obtain a visa to perform the pilgrimage includes AYYASH's name. 305

C. BADREDDINE's role in Hezbollah

128. BADREDDINE was an experienced operative with the necessary skills, knowledge and ability to train and to lead others in the sophisticated preparation and execution of the HAMADE, HAWI, and EL-MURR Attacks. His status within Hezbollah explains how he was able to operate using a covert phone network belonging to Hezbollah. The fact that BADREDDINE was a confirmed senior Hezbollah commander and he was the attributed user of a phone strongly corroborates the acknowledgement by NASRALLAH that the was a Hezbollah covert network.

1. BADREDDINE was a Hezbollah leader before, during and after the attacks

129. BADREDDINE was, as publicly stated by NASRALLAH, a semor military commander of Hezbollah, one of "its best leaders" "in charge of leading and commanding the Hezbollah military and security units inside Syrian territories."306

302 60251933-60251934,60251934.

303 60255963-60255963.

304 60196219-60 l 96233A.

305 60255958-60256013,60255967-69.

306 60317985-60317985, 00:09:42; 603 l 7985[005106-020148]_D_EN_Ol, p.3.

STL-18-1 O/PT /PTJ 45 of 185 15 December 2020 Public Redacted R026549

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

BADREDDINE was a member of Hezbollah, engaged in Hezbollah's activities continuously until his death,307 before, during and after the attacks.

130. BADREDDINE had been a member of and involved in the Resistance from its "first moments and hours,"308 being "one of the first believers in Lebanon who founded jihad in its religious form" and having spent his "entire life in the jihadist field in Hezbollah, particularly in the field of security and military affairs. "309 NASRALLAH refelTed to him as "one of the senior men of the Islamic Resistance in Lebanon, one of its major minds, and one of its pioneer founders."310

131. In 1995, BADREDDINE assumed the leadership of the Military Central Command in Hezbollah until mid-1999. 311 After the end of the conflict in southern Lebanon in 2000, BADREDDINE continued his work leading jihadi activity in Hezbollah,312 assuming the responsibility of very sensitive dossiers.313 BADREDDINE was Hezbollah's lead negotiator in prisoner exchange negotiations from the late 1990s until 2008, alongside Imad MUGHNIYEH and NASRALLAH,314 demonstrating his prominence in Hezbollah's hierarchy at the relevant time. SAF A's retelling of BADREDDINE's tactics used in 2004-2008 demonstrates BADREDDINE's cold and calculating disposition as well as his disregard for human life. 315 BADREDDINE was one of Hezbollah's military leaders in the July 2006 War. BADREDDINE succeeded his brother-in-law, MUGHNIYEH, in many roles following his death in February 2008.316

307 603 l 7985[005106-020148]_D _EN_Ol, p.3; D0501347-D0501350, D0501348; D0501354-D0501355, D0501354.

308 60317985-60317985, 51 :06-01 :00:45; 60317985 [005106-020148]_D _EN_Ol, p.2; D0501354-D0501355, D0501354; D0501351-D0501353, D0501352; D0498865-D0498871, D0498865

309 D0568932-D0568932; D0568933-D0568933; D0568934-D0568947.

310 60317985-60317985_D_EN_Ol, p.4.

311 60317985-60317985_D_EN_Ol, p.2.

312 60317985-60317985_D_EN_01, p.3.

313 D0568932-D0568932; D0568933-D0568933; D0568934-D0568947, D0568936.

314 D0501369_D_EN, pp.2-3; D0530004-D0530006, D0530004.

315 D0530004-D0530006, D0530004.

316 603 l 7985-603 l 7985_D _EN_Ol, p.3; 60230112-60230123,60230121.

STL-18-1 O/PT /PTJ 46of185 15 December 2020 Public Redacted R026550

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

From 2008, BAD RED DINE was managmg Hezbollah 's Jihad Council with NASRALLAH. 317 At the time of his death, BAD RED DINE was "in charge ofleading and commanding the Hezbollah military and security units inside Syrian territories."318

132. Unlike MUGHNIYEH'S passing which is commemorated alongside others on "Hezbollah Martyrs Leaders Day,"319 the anniversary of the death of BADREDDINE continues to be commemorated in a ceremony lead by Hezbollah's senior members, including NASRALLAH.320 On the first anniversary of his death, BADREDDINE was also described as a "hero of the nation's heroes" and brought "to the rank of the apostles and prophets."321

133. In light of his senior commander position in Hezbollah and his experience in carrying out terrorist attacks, BADREDDINE would have been in a position to plan, direct and coordinate operations within Hezbollah. This supports how he could have lead and coordinated the actions of others in the sophisticated preparation and execution of the attacks. The preparation and execution of the attacks, in the political context at the relevant time corresponded to what BADREDDINE was handling for Hezbollah: "leading jihadi activity" in "very sensitive dossiers."322

2. BADREDDINE operated as a high level security operative in 2004-2005

134. BADREDDINE's use ofHezbollah's covert facilities, such as the , was part of his role as a Hezbollah security operative in 2004-2005. This became clear after

317 D0501347-D0501350, D0501348.

318 60317985-60317985_D_EN_Ol, p.3; D0501347-D0501350, D0501348; D0501354-D0501355, D0501354.

319 D0506 l 99-D05062 l 3, D0506201.

320 D0568931, at 3:30; D0568932-D0568932; D0568933-D0568933; D0568934-D0568947, D0568935- D0568936. The ceremony in 2020 was affected by the measures in place due to COVID-19. D0568931, at 0:44.

321 D0520137-D0520137.

322 60317985 [005106-020148]_D _EN_01, p.3.

STL-18-1 O/PT /PTJ 47of185 15 December 2020 Public Redacted R026551

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

his death when his real name was revealed, and eight witnesses recognised photographs of BAD RED DINE as being the person they knew as Sarni ISSA and/or Safi. 323

135. Further, NASRALLAH acknowledged the practice that after martyrdom, Hezbollah almost always goes back to using the real names of its members. 324 It was therefore only upon his death that the true identity of BADREDDINE was openly acknowledged. 325

136. BADREDDINE used an alias during the relevant time, in line with Hezbollah's policy to conceal the real name and image of its military operatives.326 Sarni ISSA was a persona adopted by BADREDDINE to erase an obvious link to his history and enable him to operate covertly across a wide cross-section of Lebanese society for gathering human intelligence.

137. As Sarni ISSA, BADREDDINE was the owner of three jewellery shops,327 despite not knowing much aboutjewellery.328 He used multiple phones,329 employed two teams of

323 PCC026:603l9201-60319212, 60319202; PCC026:20151201 _ STL-l l-Ol _ T_ T220, p.36; PCC026:20151203 _ STL­ l l-Ol _ T_ T222, pp.42,45,45-47; PCCOl 4:60319057-60319068, 603190558; PCCO 14:20151207_ STL-l l- Ol _ T_ T224, pp.92-93; PCC014:20151208 _STL-1 l-01 _ T_ T225, pp.7,65-66,72-73; PCC027:6031902 l- 603 l 9032,60319022; PCC027:2015121 O_STL-1 l-Ol _ T_ T227,_pp.19-21,89-91; PCC031 :60314116- 60314219, 60314175-77, 60319311-22,60319312; PCC004:60306043-60306112, 60318998-9008, 60318073- 136, 60318074, 60318078; PCC028:60309962-60310210, 60309998, 60310198, 60310199, 60310042-45, 60310053-55, 60319009-9020, 60319010, 60315197-5204; 60315198-5199; PCC054:60305133- 60305194, 60305168-69,60305175; PCC054:60319189-603 l 9200, 60319190; PCC054:60315239- 60315245; PCC029:60305 l 95-60305208, 60305202-04; PCC029:603 l 9069-603 l 9079, 60319070; D04988 l 9- D0498825, D0498819.

324 D0568934-D0568947, D0568934.

325 60317985-60317985, 51 :06-01 :00:45; 60317985 [005106-020148]_D_EN_Ol, pp.1-2.

326 60317985 [005106-020148]_D _EN_01, p.3.

327 PCC025:D0568340-D0568447, paras.99-101, 345.

328 PCC026:20151207_STL-1 l-Ol_T_T224, p.99, lines 3-6; PCC014:20151208_STL-1 l-Ol_T_T225, p.4, lines 12-22.

329 PCC025:D0568340-D0568447, para.177.

STL-18-1 O/PT /PTJ 48of185 15 December 2020 Public Redacted R026552

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

armed bodyguards330 and kept weapons on his person. 331 BADREDDINE avoided leaving fingerprints behind, ensured the identity of the people calling him remained hidden332 and changed license plates on cars he was using.333 Similarly, Sarni ISSA always refused to have his photo taken334 and offered little personal information. 335 All of this demonstrates BADREDDINE's ongoing status in 2004-2005 as a high level Hezbollah operative functioning in the progressive continuum that culminated in his elevated status upon his death.

138. BADREDDINE had, during the relevant time and whilst operating under cover, extensive contacts with high-ranking Hezbollah officials, including Wafik SAFA, Ali AMMAR and Amine SHERRI, on his non-network phones. 336 BAD RED DINE was also in recurrent contact with Hezbollah numbers, for example the landline for the Great Prophet Hospital, through his non-personal mobile phones. 337

3. BADREDDINE had ties to prominent Hezbollah members and to Hezbollah

139. BADREDDINE is of Muslim Shiite confession.338 There are no records of property owned by BADREDDINE.339 However, the analysis of the top MTC and Alfa Cell Sectors used by all of BADREDDINE's personal phones show that the primary

330 PCC025 :D05 68340-D05 6844 7, paras.33 7-341.

331 PCC027: 20151210_STL-ll-Ol_T_T227, p.92, lines 9-25.

332 PCC026:20151202_STL-l l-Ol_T_T221, pp.76-78.

333 PCC026:20151202_STL-l l-Ol_T_T221, pp.90-99.

334 PCC026:20151202_STL-ll-Ol_T_T221, p.69, lines 17-23; PCC004:60306043-60306112, 60306075; PCC014:20151208_ STL-l l-Ol _ T _ T225, p.61, lines 3-9.

335 PCC028:60254553_TS_D_EN_AR_Ol, pp.31-33.

336 PCC025:D0568340-D0568447, paras.119( d)( e )(f), 170( d),206(g)(h); PCC025:D0567763-D0567826, paras.5-7, 121-123, 139-142.

337 PCC025 :D05 68340-D05 6844 7, para.190.

338 60242731-60242741,60242738.

339 60243961-60243976,60243975.

STL-18-1 O/PT /PTJ 49of185 15 December 2020 Public Redacted R026553

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

residence of BADRED DINE would have been located within the Dahyieh area, an area strongly associated with Hezbollah.340

140. Mohammed Amine BADREDDINE, BADREDDINE's brother, is the brother-in-law

of AYYASH.341 BADREDDINE's sister was maITied to MUGHNIYEH,342 the head of Hezbollah's security structures until his death in February 2008.343 BADRED DINE was also affiliated to other senior Hezbollah actors, including NASRALLAH's son who is married to BADREDDINE's niece.344

141. Hezbollah announced the death ofBADREDDINE on 13 May 2016345 and on the same day, several senior members ofHezbollah including SAFA, AMMAR, Nairn QASSEM and SHERRI, attended a condolence ceremony for BADREDDINE, with a large attendance. 346 His coffin was draped in the flag of Hezbollah and the ceremony featured a military band and a guard of honour wearing military fatigues and cmTying Hezbollah flags.347

142. A military ceremony honouring BADREDDINE was held in Damascus on 18 May 2016. Family members of BADREDDINE, alongside religious leaders were prominent in a large crowd including militia members with Hezbollah flags. The murals of MUGHNIYEH, BADREDDINE, NASRALLAH and Ayatollah KHAMENEI were on the background wall of the shrine.348 The family of BADREDDINE met with the

340 PCC025:20170705_STL-1 l-Ol_T_T379, p.47, lines 13-15; PCC025:D0519236- D0519310,D0529272,slide.37.

341 60144964-60144990,60144968; 60252252-60252261,60252255-57;60144964-60144990,60144966.

342 D0073952-D0073952.

343 60181651-60181651; 60211518-60211523; 60184321-60184321;60230112-60230123.

344 D0073952-D0073952.

345 D0498819-D0498825.

346 D0499896-D0499896, 00:42; 60318155-60318163; D0499891-D0499891.

347 D0499899-D0499899.

348 D0498848-D0498852.

STL-18-1 O/PT /PTJ 50of185 15 December 2020 Public Redacted R026554

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

Ayatollah KHAMENEI in Tehran on 27 May 2016 further demonstrating the importance and rank of BAD RED DINE in Hezbollah.349

IV. THE USE OF COVERT TELEPHONE NETWORKS TO COMMIT THE ATTACKS

A. A YYASH, BADRED DINE, and others, used covert telephone networks to facilitate the planning, preparation and perpetration of the attacks

1. Overview

143. AYYASH, BAD RED DINE, and others, used groups of mobile phones that operated as covert Networks to facilitate the planning, preparation and perpetration of the attacks against HAMADE, HAWI and EL-MURR. The same phone Networks were used in the assassination of HARIRI.350 The telephone Networks shared common characteristics and were interconnected. The locations and patterns of use of the phones demonstrate that they had a common purpose linked to the four intended targets of the terrorist attacks. The call patterns across all four attacks establish that A YYASH coordinated and directed the activity of the users of the Network phones.

144. Over the indictment period, AYYASH, BADREDDINE, and the unidentified participants used mobile phones from four interconnected mobile phone networks. Each Network has been assigned a colour for ease of reference. AYYASH was the user of phones from the and Networks. BADREDDINE used a phone from the . Several of the unidentified participants, used phones from the and Networks. In the evidence, the unidentified participants, are referred to as users of the Network phones or Subjects.

145. AYYASH, BADREDDINE and Subjects 8 and 9 used the and Networks in the attack against HAMADE. AYYASH and BADREDDINE used their Green Network phones to supervise and coordinate the attack. While AYYASH, and Subjects 8 and 9 used the Yellow Network phones to communicate with each other to plan, prepare and execute the attack.

349 D0499904-D0499906.

350 F3839, paras.2423-2426.

STL-18-1 O/PT /PTJ 51 ofl85 15 December 2020 Public Redacted R026555

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

146. AYYASH and BADREDDINE used the same phones to orchestrate the assassination of HARIRI. AYYASH and Subjects 6, 8 and 9 also used their phones in the planning and preparation of the assassination of HARIRI. Thereafter, AYYASH, Subjects 6, 8 and 9, and others, used phones from the and Networks to communicate with each other to prepare and carry out HARIRI's assassination. In particular, AYYASH communicated with Subjects 5, 6, 7, 8 and 9 on phones from the and Networks. The phones were used by AYYASH, and the aforementioned Subjects in the preparations of the attack including surveillance of HARIRI. 351 The network phones were used to carry out the attack. AYYASH, Subjects 5, 6, 7, 8 and 9 used their phones moments before HARIRI's assassination and then never used them again. 352 Similarly, AYYASH called BADREDDINE, from the vicinity of the crime scene, using their phones approximately one hour before HARIRI's assassination for the final time. 353

147. AYYASH and Subjects 5, 6, 7, 8 and 9 and other members of the continued to use their phones after HARIRI's assassination and this Network was used for the planning, preparation and execution of the attacks against HAWI and EL-MURR.354 Similar to the way they used the phones in the assassination of HARIRI, AYYASH and the Subjects communicated with each other to surveil their intended targets and suitable locations for the attacks.

148. AYYASH and BADREDDINE continued to communicate with each other to authorize and coordinate the attacks against HAWI and EL-MURR, however, having dropped the phones, they communicated with each other on mobile phones that were not part of a Network. Although the phones used had changed, the hierarchy of communication remained the same. In relation to the HAWI and EL-MURR attacks, AYYASH and BADREDDINE communicated only with each on their mobile phones and AYYASH communicated with the Subjects on the ______.. ____ phones.

351 PCC073 :D0568996-D0569028, para.24.

352 PCC073 :D0540969-D054 l l 93, paras.488,521; PCC02 l :D0346171-D0346243, pp.16,67.

353 PCC073:D0540969-D0541l93, para.695; PCC02l:D0455633-D0455715, p.56.

354 PCC073 :D0568996-D0569028, paras.16-18.

STL-18-1 O/PT /PTJ 52of185 15 December 2020 Public Redacted 355 PCC073 :D0540969-D054 l l 93, paras. I 0, 1215-1216.

356 PCC073:20160405_STL-1 l-Ol_T_T251, p.56, lines 13-16; PCC073:20160404_STL-1 l-Ol_T_T250, p.94, lines 10-

21; PCC02 l :20150821 _STL-1l-O1 _ T_ Tl82, p.94, lines 1-25, p.95, lines 16-25.

357 PCC073:D0540969-D0541193, paras.1215-1216; PCC073:20160404_ STL-1 l-01 _ T_ T250, p.94, lines 10- 21; PCC073:20160405 _STL-1 l-Ol _ T _ T25 l, p.14, lines 12-17; PCC073:20160414_STL-1 l-01 _ T_ T253, p.18, lines 20-25. p.19. lines 1-5. p.20, lines 8-17. p.44. lines 13-24, p.46. lines 4-19; PCC02 l :D0455633-D04557 l 5, p.13-14.

358 PCC073 :D0568651-D0568907, para.41; PCC073 :D0540969-D054 l 193, para.1107.

STL-18-1 O/PT /PTJ 53 of 185 15 December 2020 Public Redacted R026557

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

remained operational until 7 January 2005. 359 Over that period, the number of phones in the varied. By 1 August 2004, there were 13 phones in the Network.360 These 13 phones communicated primarily with each other until the shutdown on 7 January 2005. 361

151. The had a number of features that establish that it was a covert mobile phone Network. No subscriber details were provided for eight of the phones. The other ten phones had subscribers who could not be traced or where traced denied being the user of the phone, or false identification documents were used to purchase the phones.362

152. The phones were pay-as-you-go and required monthly re-crediting. 363 Several of the phones were re-credited by recharge cards. The recharge cards were often sequential suggesting a coordinated payment system and level of organisation. 364 Cards from the same sequential batch were used to credit phones and phones that were later part of the .365 The financing of the Network did not identify the users. 366

153. From 1August2004 to 7 January 2005, approximately 71 % of the calls and SMS were exclusively between phones.367

359 PCC073 :D056865 l-D0568907, paras.41,44,51; PCC073:D0540969-D054 l l 93, para.1108; PCC073:20160406_STL-l l-Ol_T_T252, p.27, lines 1-3.

360 PCC073 :D056865 l-D0568907, para.44.

361 PCC073:D0568651-D0568907, paras.47,51.

362 PCC073:D0568651-D0568907, para.43; PCC073:20160406_ STL-l l-Ol _ T_ T252, p36, lines 18-25.

363 PCC073:D0568651-D0568907, para.42; PCC073:20160406_STL-l l-Ol_T_T252, p37, lines 5-9.

364 PCC073:D0568651-D0568907, para.50, Annex B; PCC073:20160406_STL-l l-Ol_T_T252, p.19, line 25, p.20, lines 1-2.

365 PCC073 :DOS 68651-DOS 68907, para.5 0, Annex B; PCC073 :D0540969-D054 l l 93, paras. 777-779.

366 PCC073 :D056865 l-D0568907, para.95.

367 PCC073:D0568651-D0568907, para.47.

STL-18-1 O/PT /PTJ 54of185 15 December 2020 Public Redacted R026558

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

154. The phones had common contacts. All 13 of the phones were in contact with used by AYYASH,368 and the majority of phones were in contact with PROTEL (1545361, 1545362) and Al-Rassoul Al-Aazam Hospital, known as The Great Prophet Hospital, ( 1451206). 369 These contacts, external to the Network, were also common contacts of phones and of A YYASH and BADREDDINE, using their non-network mobile phones.370

155. The phones swapped handsets with other phones, phones and two mobile phones used by AYYASH: Mobile 170 and Personal Mobile Phone (PMP) PMP 165. 371

156. The shutdown of the was coordinated and coincided with the expansion of the from three phones in October 2004 to 15 phones by 12 January 2005.372

157. AYYASH, Subject 8 and Subject 9 used phones in the attack against HAMADE. 373 These phones, and their users, are identified with their short-names in the table below:

User AYYASH Subject 8 Subject 9

Phone Number 3205294 3971933 3712024

Short name

158. phones, specifically [AYYASH], (Subject 6), (Subject 8) and (Subject 9) were also used in the early preparations of the attack against HARIRI before the expansion of the

368 PCC073:D0540969-D0541193, para.1116.

369 PCC073:D0540969-D0541193, paras.1119-1120; PCC073:20160406_STL-1 l-Ol_T_T252, p.47, lines 1- 15.

370 PCC073 :D0540969-D054 l l 93, paras.954,980,996; PCC073 :D0568651-D0568907, paras.38-40.

371 PCC073 :D0540969-D054 l l 93, paras.1122-1124.

372 PCC073:D0568651-D0568907, para.52.

373 PCC073 :D0568651-D0568907, paras.99, 153, 155.

STL-18-1 O/PT /PTJ 55 of 185 15 December 2020 Public Redacted 378 PCC073 :D0568651-D0568907, paras.99,466, 1029.

379 PCC073 :D0568651-D0568907, paras.53,64; PCC073 :D0540969-D0541193, paras. 752,761.

380 PCC073:D0568651-D0568907, paras.56-57; PCC073:D0540969-D0541193, para.752; PCC021 :D0374474- D0374710, pp.3-4.

381 PCC073 :D056865 l-D0568907, paras.56-57; PCC073 :D0540969-D0541193, para.752.

382 PCC073:D0568651-D0568907, paras.61,64.

STL-18-1 O/PT /PTJ 56of185 15 December 2020 Public Redacted R026560

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

162. Operating within the , from January 2005, were six principal phones that formed a sub-group.383 These core six phones, were used by AYYASH, ( ), Subject 5 ( , Subject 6 ( ), Subject 7 ( ), Subject 8 ( ) and Subject 9 ( ). 384

163. Like its predecessor the , the had a number of features that establish that it was a covert mobile phone Network. No subscriber details were supplied for seven of the phones. For the other 11 phones, the named subscriber was either untraced, or where traced, denied being the actual user of the phone, or false identification cards were used. 385

164. Like the , the phones were pay-as-you-go and required monthly re-crediting. 386 The set-up and financing of the Network was coordinated. 387 Credit was added to several phones via recharge cards which were frequently from the same sequentially numbered batch. 388 The re-crediting often took place at the same time and in the same area of south Beirut, consistent with the re-crediting being done by one person. 389 The financing of the Network did not identify the users. 390

165. The was substantially more covert than its predecessor and an almost 100% closed user group. Between 18 October 2004 and 21 September 2005, approximately 97% of the 6132 calls and seven SMS, were exclusively between phones.391

383 2016083l_STL-ll-Ol_T_T285, p.88, lines 17-25, p.89, lines 2-23, p.99, lines 12-18.

384 PCC02 l :D0368634-D0369059, pp.3-4; PCC073 :D0568996-D0569028, para.24.

385 PCC073 :D056865 l-D0568907, para.55.

386 PCC073:D0568651-D0568907, para.54.

387 See IV.B.1.

388 PCC073 :DOS 68651-DOS 68907, para.59, Annex B; PCC073 :D0540969-D054 l l 93, paras. 777-779.

389 PCC073 :D056865 l-D0568907, para.59; PCC073:D0540969-D0541l93, paras.766-776.

390 PCC073 :D056865 l-D0568907, para.95.

391 PCC073 :D0568651-D0568907, paras.60-61; PCC073 :D0568996-D0569028, para.17.

STL-18-1 O/PT /PTJ 57of185 15 December 2020 Public Redacted R026561

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

166. The phones had common contacts. All of the phones were in contact with used by A YYASH, 392 and like the phones some of the phones, had contact with PROTEL (1545362) and The Great Prophet Hospital (1451206).393

167. AYYASH and Subjects 5, 6, 8, 9, 12, 18 and 19 used phones in the attack against HA WI. 394 AYYASH and Subjects 5, 6, 7, 8 and 9 (Core Six) used phones in the attack against EL-MURR. 395 These phones, and their users, are identified with their short-names in the tables below:

User AYYASH Subject 5 Subject 6 Subject 7 Subject 8 Subject 9

Phone 3071233 3043585 3197610 3067324 3197817 3198864 Number Short Name

User Subject 12 Subject 18 Subject 19

Phone Number 3071235 3193428 3196742

Short Name

168. In the period, February to September 2005, these phones used by AYYASH and eight other users of the phones, operated as a core team within the . The majority of calls were between these users. 396

392 PCC073:D0540969-D0541193, para.783.

393 PCC073 :D0540969-D054 l l 93, paras. 784-785.

394 PCC073 :D056865 l-D0568907, paras.99,466,468.

395 PCC073:D0568651-D0568907, paras.99,1029,1031.

396 PCC073 :D0568996-D0569028, para.27.

STL-18-1 O/PT /PTJ 58of185 15 December 2020 Public Redacted 400 PCC073 :D0540969-D054 l l 93, para.821.

401 PCC073 :D0568651-D0568907, para.64.

402 PCC073 :D0540969-D054 l l 93, paras. 802-803.

403 PCC073:D0568651-D0568907, para.67.

404 PCC073:D0568651-D0568907, para.67; PCC02l:D0455633-D0455715, pp.22-23.

405 PCC02 l :D0455633-D0455715, pp.23,68.

STL-18-1 O/PT /PTJ 59of185 15 December 2020 Public Redacted R026563

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

173. AYYASH used between 30 September 2004 and 14 February 2005.406 During that period, AYYASH communicated almost exclusively with attributed to BADREDDINE.407

174. BADREDDINE used between 6 September 2004 and 14 February 2005.408

175. Between 30 September 2004 and 14 February 2005, the phones made 124 voice calls and no SMS. Approximately 96% of those calls and were exclusively between phones.409 The phones were switched off when not in use. 410

176. On 13 October 2004, five days before the began, the became a fully closed user group and and communicated exclusively with each other. 411

177. was the focal point of the Network and was in contact with both the other

phones in what can be described as an open triangle412- and contacted BADREDDINE on -but never each other.413 The open triangle formation of contact is indicative of a disciplined hierarchical structure. 414

178. Unlike the other Networks, the phones were ALFA post-paid phones.415 Fraudulent identification documents were used to purchase the phones. 416 Their set up

406 PCC025:D0568187-D0568339, paras.285-286,417.

407 PCC025 :D0568 l 87-D0568339, paras.296-299,301.

408 PCC025 :D0568340-D0568447, paras.241-242,346.

409 PCC073 :D056865 l-D0568907, paras.80-81.

410 PCC073:20160414_STL-l l-Ol_T_T253, p.44, lines 2-12.

411 PCC073:D0540969-D0541l93, paras.673-674; PCC02l:D0455633-D0455715, pp.3,63.

412 PCC02 l :D0455633-D0455715, p.63.

413 PCC073:D0568651-D0568907, para.74; PCC02l:D0455633-D0455715, p.63.

414 PCC02l:D0457446-D0457616, p.53; PCC073:20160414_STL-l l-Ol_T_T253, p.34, lines 16-22.

415 PCC073 :D056865 l-D0568907, para.69; PCC073:D0540969-D054 l l 93, para.686.

416 PCC073:D0568651-D0568907, para.70.

STL-18-1 O/PT /PTJ 60of185 15 December 2020 Public Redacted R026564

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

and financing was coordinated.417 Between August 2004 and May 2005, the payments for the phones were made in cash, at the same Alfa customer centre at Furn-El-Chebbak, Beirut and, except for two instances, the payments were made sequentially on the same days and at the same time. 418

179. Between 30 September and 1October2004, AYYASH and BADREDDINE used their phones in the attack against HAMADE.419 These phones, and their users, are identified with their short-names in the table below:

User AYYASH BAD RED DINE

Phone Number 3159300 3140023

Short Name

180. and were used to oversee the planning and execution of the assassination of HARIRI. 420 The same call patterns are evident. A YYASH using at a location in the immediate vicinity of the HARIRI crime scene, called BADREDDINE's approximately one hour before the attack.421 That was the final call.422

181. The shutdown of the was coordinated. The phones were on a yearly contract with monthly payments, which were due to continue until July 2005. The payments, however, ceased without notice after 28 May 2005. 423 Consequently, all the

417 See IV.B.l.

418 PCC073:D0540969-D054l193, paras.684.687; PCC073:D0568651-D0568907, paras.75-76; PCCl 18:60315780- 60315 822. para.21.

419 PCC073 :D0568651-D0568907, paras.99, 153-154.

420 See Vl.B.l.

421 PCC073:D0540969-D0541193, para.695; PCC02l:D0455633-D0455715, page 56.

422 PCC073 :D0540969-D054 l l 93, para.695.

423 PCC073:D0568651-D0568907, para.78; PCC073:D0540969-D0541193, para.696.

STL-18-1 O/PT /PTJ 61 of 185 15 December 2020 Public Redacted !'CCU/ .J :UU'.:lb~b'.:l 1-UU'.:lb~YU/, paras.~2-~.J; !'CCU/ .J :UU'.:l4UYbY-UU'.:l4 l l Y.J, paras. lb,4~4.

427 PCC073 :D0568651-D0568907, paras.99,382-383. See VI.B.1.

428 PCC073:D0568651-D0568907, para.83; PCC073:D0540969-D0541193, paras.483,489; PCC073:20160415_STL-11-0l_T_T254, p.55, lines 17-25, p.56, lines 1-8; PCC021:D0457446- D0457616, p.140.

429 PCC073 :D056865 l-D0568907, para.84.

430 PCC073:D0568651-D0568907, para.85; PCC073:D0540969-D0541193, paras.509-511.

STL-18-1 O/PT /PTJ 62of185 15 December 2020 Public Redacted 432 PCC073 :D056865 l-D0568907, paras.87-88; PCC073 :D0540969-D054 l l 93, paras.496-497.

433 PCC073 :D056865 l-D0568907, paras.87-88.

434 PCC02l:D0346171-D0346243, p.59.

435 PCC073 :D056865 l -D05 68907, paras. 82-83, 99 ,3 82-3 83.

436 PCC073 :D0540969-D054 l l 93, paras.488,521; PCC02 l :D0346171-D0346243, pp.16,67.

437 PCC073:D0540969-D0541193, paras.495.

STL-18-1 O/PT /PTJ 63 of 185 15 December 2020 Public Redacted R026567

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

respectively.438 They used these mobiles phones to oversee and coordinate the attacks against HA WI and EL-MURR. 439 In relation to the attacks, like with the , AYYASH communicated with BADREDDINE only using Mobile 170.440 Likewise, BADREDDINE's Mobile 683 and Mobile 486 were never in contact with A YY ASH's or other phones from the 441

191. Although not part of a Network, these Mobiles were covert and had specific characteristics distinguishing them from personal mobile phones. 442 A YYASH' s Mobile 170 served a separate purpose than his PMPs, the contact profile of this phone was largely composed of senior figures within Hezbollah, their associates, and landlines belonging to Hezbollah.443 AYYASH's PMPs were overt and used for ordinary purposes to contact family members, business associates in the car trade and in relation to his employment within the civil defence. 444

192. Similarly, BADREDDINE's Mobile 195, Mobile 683 and Mobile 486 were part of an identified series of phones that were each used for a short period of time between March 2005 and September 2005. These phones had a distinct contact profile when compared to his PMPs.445 These mobile phones had a significantly smaller number of contacts, low level of SMS content, contact with Members of Parliament and officials associated with Hezbollah, no identifiable business records associated with the number and reoccurring contacts with switchboard numbers, for example the landline for the Great

438 PCC073:D0568651-D0568907, para.29,31,99; PCC025:D0568187-D0568339, paras.177-178, 218, 238; PCC025:D0568340-D056844 7, paras.192,203,206.

439 PCC073:D0568651-D0568907, para.99.

440 PCC025:D0568187-D0568339, paras.178,238,247,453; PCC025:D0568340-D0568447, paras.262-263; D0049247-D0049299.

441 PCC025:D0568340-D0568447, paras.190,206; D0059913-D0059954; D0059955-D0059986.

442 PCC025:D0568187-D0568339, para.177.

443 PCC025:D0568187-D0568339, paras.178,220,238.

444 PCC025:D0568187-D0568339, paras.50-51.

445 PCC025:D0568340-D0568447, paras.188,190,203.

STL-18-1 O/PT /PTJ 64of185 15 December 2020 Public Redacted R026568

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

Prophet Hospital.446 BADREDDINE's Mobiles were used much more discretely than the PMPs. 447

4. The hierarchy of communication

193. Over the indictment period, the calls between Network phones, and A YYASH' s Mobile 170 and BADREDDINE's Mobile 195, Mobile 683 and Mobile 486 established a pattern of communication.

194. In the HAMADE and HARIRI Attacks, AYYASH, communicated with BADREDDINE using only the and A YYASH communicated with the Subjects using his and Network phones.

195. Similarly, in the attacks against HAWI and EL-MURR, A YYASH, communicated with BADREDDINE using only their non-personal and covert Mobile Phones and AYYASH communicated with the Subjects using his phone. The hierarchy of communication and the key phones used in the attacks are depicted in the diagram below:448

446 PCC025 :D0568340-D056844 7, paras.188-190.

447 PCC025 :D0568340-D0568447, para.191.

448 PCC073 :DOS 68651-DOS 68907, para. 99.

STL-18-1 O/PT /PTJ 65 of 185 15 December 2020 Public Redacted R026569

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

BAD RED E BADREDDi E E

J AYYA.SH AYYASH A.YYASH AYYASH

_l SUB.iECT 6 BJECT 6

ECT 5 SUBJECT 5 SU ECT 6

SUBJECT 8 BJECT 5 SUBJECT 7 SUBJECT 8 BJECT 9 SUBJECT 7 SU ECT 9 SUB.iECT 8 SUBJECT 12 SU ECT 8

BJECT 18 SU ECT 9

SUB.iECT 9 SUBJECT 19

B. The four telephone networks were interconnected and operated by one organised group with a common purpose

1. The Networks had a common purpose linked to the intended victims of the attacks and coordinated by A YYASH

196. The four Networks were not only controlled by one group but they were also engaged in a series of connected missions. The locations and patterns of use of the phones demonstrate that they had a common purpose linked to the four intended victims of the

STL-18-1 O/PT /PTJ 66of185 15 December 2020 Public Redacted 1367-1369.

450 PCC073:D0568651-D0568907, paras.330,378, 687,961,980, 1068-1069.

451 PCC073 :D056865 l-D0568907, paras.224, 325-333, 959-970, 1336-1342.

452 PCC073 :D056865 l-D0568907, paras.332,967, 1341.

453 PCC073 :D056865 l-D0568907, paras.326.

454 PCC073:D0568651-D0568907, para.325.

STL-18-1 O/PT /PTJ 67of185 15 December 2020 Public Redacted R026571

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

2004), or in the three-month period afterwards (2 October to 20 December 2004).455 Over that period, the three days-29 September to 1 October 2004 -were the only days AYYASH, Subject 8 and Subject 9 used cells near HAMADE's residence and the crime scene.456 Moreover, their activity on those days occurred at unusual times. On 29 September 2004, the activity occurred in the late evening, on 30 September 2004, in the morning and on 1 October 2004, in the early hours of the morning. 457

200. Similarly, the phones' activity in areas relevant to the attacks against HAWI and EL-MURR was unusual and unique to the periods immediately preceding the attacks.458 When compared to their normal geographic profiles, the activity of AYYASH, Subjects 5, 6, 8, 9, 12, 18 and 19 in the vicinity of the locations connected to HAWI during the period 2 June 2005 to 20 June 2005, was extremely unusual.459 There is no evidence of any regular call activity by A YYASH or these other users in these areas prior to this period or subsequent to it. 460 Likewise, the call records of Subjects 5, 6, 7, 8 and 9, between 1 May 2005 and 21 September 2005, indicates that their usual call activity was primarily in south Beirut and southern Lebanon.461 Their presence near the EL-MURR crime scene between 29 June 2005 and 8 July 2005 was unusual and was the only time they were active in that area in the months preceding and following the attack. 462

201. Similar patterns exist in the attack against HARIRI, with the and Network activity focused on specific locations associated with HARIRI, his movements and the crime scene.

455 Apart from 28 November 2004, when the Riviera_A cell was activated by Subject 9. PCC073:D0568651- D0568907, para.327; PCC073:D0568996-D0569028, paras.12-13,15.

456 PCC073:D0568651-D0568907, para.328.

457 PCC073:D0568651-D0568907, para.331.

458 PCC02 l :D0528351-D0528940, p.8.

459 PCC073 :D056865 l-D0568907, para. 965; PCC073 :D0568996-D0569028, paras. 77-78.

460 PCC073 :D056865 l-D0568907, para. 966.

461 PCC073:D0568651-D0568907, para.1336.

462 PCC073:D0568651-D0568907, paras.1337-1338; PCC073:D0568996-D0569028, paras.84-85.

STL-18-1 O/PT /PTJ 68of185 15 December 2020 Public Redacted R026572

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

(ii) Contact between AYYASH and the users of the Networks increased before each attack

202. Prior to the attack against HAMADE there was very little contact between Subject 9 and AYYASH, and no contact between Subject 8 and AYYASH, on their phones.463 Then between 27 September and 1 October 2004, AYYASH was involved in 22 calls with the Subjects, with 11 of these calls occurring on 1 October 2004.464 After the HAMADE attack, the level of contact dramatically decreased,465 and, the pattern, and level of contact between A YYASH and users of the , was not repeated until January 2005, when all three were involved in surveillance of HARIRI.466

203. AYYASH first used his phone to contact BADREDDINE the day before the attack against HAMADE. 467 After being active in the vicinity ofHAMADE's residence AYYASH used to contact BADREDDINE ( ) in the late afternoon. This call sparked a series of calls between A YYASH and BADREDDINE on their phones which continued until immediately after the attack the following day. 468

204. Likewise, before the HARIRI attack, call activity on the phones increased substantially leading up to the attack, culminating in their last call shortly before the attack. 469 As did the call activity of phones, which intensified in February with peaks on 8 and 12 February 2005. 470

463 PCC073 :D056865 l-D0568907, paras.334-337.

464 PCC073:D0568651-D0568907, para.338.

465 PCC073:D0568651-D0568907, para.339.

466 PCC073 :D056865 l-D0568907, para.341.

467 PCC073 :D056865 l-D0568907, paras.168-169.

468 PCC073 :D056865 l-D0568907, paras.249-250,256-258,263,270-277,270-274,294-296.

469 PCC02l:D0455633-D0455715, pp.35,Graph03, 37,Graph04, 41,Graph05.

470 PCC073:D0540969-D0541193, paras.497-500.

STL-18-1 O/PT /PTJ 69of185 15 December 2020 Public Redacted R026573

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

205. Contacts between phones increased before each of the four attacks. 471 From October 2004 to September 2005, phones made their highest number of calls in January 2005, the month preceding the HARIRI attack, in June 2005, with a peak on 20 June, the day before the attack against HAWI and in July 2005, with a peak on 11 July, the day before the attack against EL-MURR.472 June and July 2005 were the two highest months for calls during the 12-month operating period of the Network.473

206. Conversely activity declined immediately following the assassination of HARIRI.474 And, In August 2005, the call volume reduced significantly in comparison to the two previous months, and continued to decline in September when the Network ceased to operate.475

(iii) Contact between AYYASH and BADREDDINE increased before each attack

207. Proximate to each Attack was contact between AYYASH and BADREDDINE. The first contact between them on the , occurred the day before the HAMADE attack,476 followed by extensive contact leading up to the attack and culminating in a call from AYYASH to BADREDDINE ten minutes after the explosion that seriously injured HAMADE and his driver, and killed his security officer.477 After an extended period of inactivity of the the contact between AYYASH and BADREDDINE again increased in the period before the HARIRI attack, with peaks

471 PCC02 l:D052835 l-D0528940, pp.8, 5 l,Graph07 /01, 536-537; PCC02 l:D0368634-D0369059, p.279, Graphl3, 280-281,Graphl4.

472 PCC073:D0540969-D0541193, para.781; PCC021 :D052835 l-D0528940, pp.8,194-195,344-347,373- 374,427,437; PCC073:D0568996-D0569028, para.23.

473 PCC073 :D0568996-D0569028, para.21.

474 PCC073 :D05 68996-D05 69028, para.19.

475 PCC073 :D0568996-D0569028, paras.22-23.

476 PCC073 :D056865 l-D0568907, paras.256,355.

477 PCC073 :D056865 l-D0568907, para.295,367.

STL-18-1 O/PT /PTJ 70of185 15 December 2020 Public Redacted R026574

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

m late January 2005, and on 12 February 2005-two days before HARIRI's assassination -with their final call just an hour before the explosion. 478

208. AYYASH and BADREDDINE's contact increased before the attacks against HAWI and EL-MURR and declined dramatically after the attack against EL-MURR.479 During the period leading up to, and during the surveillance of HAWI, there was a significant increase in contact between AYYASH and BADREDDINE.480 The timing and location of calls between them in the period, 2 June 2005 to 21 June 2005, suggests that AYYASH was reporting to BADREDDINE and coordinating the activity of the users of the .481 In particular, the early morning contact between AYYASH and BADREDDINE, at 02:45:10 and 03:14:41, on 21June2005, the day of the attack, was unusual. Between 1 September 2004 and 21 June 2005, they were only in contact between 02:00 and 09:00 on one other day -1 October 2004 -the day of the HAMADE attack. 482 And just like on the day of the HAMADE attack, after being inactive on their phones at the time of the attack, AYYASH called BADREDDINE within an hour of the explosion.483

209. In the days after the HAWI attack there was only one call between AYYASH and BADREDDINE.484 The contact between them then resumed on 28 June 2005, the day before EL-MURR meet with NASRALLAH. 485 Thereafter they remained in almost daily contact until the day of the EL-MURR attack486 and similar to the other attacks,

478 PCC02l:D0455633-D045571, pp.31,GraphOl, 37,Graph04, 41,Graph05, 51,Graph08, 56,Graph09; PCC073:D0540969-D0541193, para.695.

479 PCC073 :D0568651-D0568907, paras.971, 1349; PCC073:D0568996-D0569028, paras.68-72.

480 PCC073 :D056865 l-D0568907, para.971.

481 PCC073:D0568651-D0568907, para.972.

482 PCC073:D0568651-D0568907, para.973.

483 PCC073:D0568651-D0568907, para.974.

484 PCC073 :D056865 l-D0568907, paras. l 035-1039.

485 PCC073 :D056865 l-D0568907, paras. l 046-104 7.

486 PCC073 :D0568651-D0568907, paras. l 080,1108,1121,1162,1171,1202,1209,1219,1232,1234,1240, 1249, 1296, 1306-1308.

STL-18-1 O/PT /PTJ 71 ofl85 15 December 2020 Public Redacted 487 PCC073:D0568651-D0568907, paras.1306-13077.

488 PCC073 :D0568651-D0568907, paras.329,703,377,385,728,959,980, 1075, 1070-1071, 1268-1271, 1340, 1367-1369.

489 See IV.A.4.

490 PCC073:D0568651-D0568907, paras.329, 1421-1424.

491 PCC073:D0568651-D0568907, para.1421.

STL-18-1 O/PT /PTJ 72of185 15 December 2020 Public Redacted See V .A-H.

494 See V.A and D.

495 PCC073:20160406_STL-1 l-Ol_T_T252, p.81, lines 14-25, p82, lines 1-25, p.83, lines 1-16, p.90, lines 1- 14; PCC073:20160415_STL-l 1-0l_T_T254, p.71, lines 16-25, p.72, lines 1-9.

496 PCC073:D0540969-D0541193, paras.492-494; PCC073:20160415_STL-1 l-Ol_T_T254, p.71, lines, 8-25.

497 PCC073 :D0540969-D054 l l 93, paras.684-687; PCC073:20 l 60406_STL-l1-0l _ T_ T252, p.81, lines 14- 25, p.82, lines 1-25, p.83, lines 1-16.

STL-18-1 O/PT /PTJ 73 of 185 15 December 2020 Public Redacted 501 PCC073:20160406_STL-1 l-Ol_T_T252, p.60, lines 20-25, p.61, lines 1- 9; PCC073:20160406_STL-11- 0l_T_T252, p.91, lines 23-25, p.92, lines 1-6.

502 PCC073:20160414_STL-11-0l_T_T253, p.82, lines 3-17; PCC02l:D0457446-D0457616, p.140.

503 PCC073 :D0540969-D054 l l 93, paras.802-803;PCC073 :D0540969-D054 l l 93, paras.495.

504 PCC073 :DOS 68651-DOS 68907, para. 77.

505 PCC073:20160726_STL-1 l-Ol_T_T282, p.70, lines 24-25, to page 71, lines 1-19.

STL-18-1 O/PT /PTJ 74of185 15 December 2020 Public Redacted R026578

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

were purchased from a mobile phone shop in Tripoli between 24 December 2004 and 4 January 2005. 506 On 28 December 2004, and (Subject 6), and (Subject 9) used cells in the vicinity of the shop. 507 One of those calls was from Subject 6 to AYYASH ( ). Immediately following that call AYYASH called BADREDDINE using their phones. 508

220. Similarly, when five Phone handsets were purchased from a mobile phone shop in Tripoli on 30 December 2004,509 (Subject 9) and (Subject 8) used cells in the close vicinity of the shop at the time the handsets were purchased. 510

221. When the phones were initialized in Tripoli between 14: 15 and 14:30 on 4 January 2005,511 again and (Subject 6), and (Subject 9), were in Tripoli around that time. 512 On 5 January 2005, when the unidentified male who purchased the five handsets on 30 December 2004, returned to the mobile shop in Tripoli to report a faulty handset,513 Subject 8 was again in the vicinity of the shop. 514 The shop owner tested the handset with his own SIM card, making service calls in the process and returned the handset to the unidentified male. 515 Shortly after, (Subject 8) called (Subject 6) from that location. 516 And when credit was

506 PCC073:D0530014-D0530470, para.499; PCC073:20160726_STL-1 l-Ol_T_T282, p.53, lines 3-18.

507 PCC073:20160726_STL-11-0l_T_T282, p.53, lines 3-18; PCC073:D0540969-D0541193, paras.103-105; PCC073 :D0530014-D0530470, paras.369.

508 PCC073 :D0530014-D0530470, paras.371-372.

509 PCC073:D0530014-D0530470, para.393; PCC078:302282-302287A, paras.15-19.

510 PCC073:20160726 _ STL-l l-Ol _ T_ T282, p.53, lines 19-25. p.54. lines 1-8; PCC073:D0530014-D0530470, para.393.

511 PCC073 :D0540969-D054 l l 93, paras.23,485; PCC073:D05300 l 4-D0530470, para.498.

512 PCC073:D0530014-D05304 70, paras.497-507; PCC073 :D0540969-D0541193, paras.129-133.

513 PCC073:D0530014-D05304 70, paras.517-518; PCC078:302282-302287 A, paras.38-44; PCC073 :D0530014- D05304 70, paras.517-519; PCC078:40005819-40005826, 40005820.

514 PCC073:D0530014-D0530470, paras.521-522; PCC073:20160726_STL-1 l-Ol_T_T282, p.57, lines 8-25, p.58, lines 1-21.

515 PCC073 :D0530014-D0530470, paras.517-519; PCC078:400058 l 9-40005826, 40005820.

516 PCC073:D0530014-D05304 70, paras.521-522.

STL-18-1 O/PT /PTJ 75 of 185 15 December 2020 Public Redacted 521 PCC073:20160726_STL-1 l-Ol_T_T282, p.53, lines 10-25, p.62, lines 23-25, p.63, lines 1-9; PCC021 :D0368634-D0369059, pp. 113-114,117-119, 133-134, Table 67, p.141, 158-159, Table 85.

522 See Vl.B.2.

523 PCC073: 20160726_STL-1 l-Ol_T_T282, p.47, lines 6-22; PCC073:D0540969-D0541193, paras.788-790.

524 PCC073 :D0540969-D054 l l 93, paras.1122-1124.

525 PCC073:20160415_STL-1 l-Ol_T_T254, p.80, lines 1-25, p.81lines1-16

STL-18-1 O/PT /PTJ 76of185 15 December 2020 Public Redacted 529 PCC073 :D056865 l-D0568907, paras.38-40; PCC073 :D0540969-D054 l l 93, paras.1119-1120; PCC073:D0540969-D0541193, paras.954,980,996; PCC073:20160406_STL-l l-Ol_T_T282, pp.45-47; PCC025:D0568187-D0568339, para.197.

530 PCC073:D0540969-D0541l93, paras.784-785,1102,1119-1120; PCC073:20160726_STL-l l­ Ol_T_T282, p.45, lines 11-25, p.46, lines 1-22.

531 PCC073 :D056865 l-D0568907, paras.38,96.

532 PCC073:D056865 l-D0568907, para.96; PCC073:20160726 _STL-l l-Ol _ T_ T282, p.45, lines 4-10.

STL-18-1 O/PT /PTJ 77of185 15 December 2020 Public Redacted J:'CCU/.J:UU'.:lb~b'.:ll-UU'.:lb~YU/, para.'.:l2; J:'CCU/.J:2UlbU/2b_SlL-l l-Ul_l_T2~2, p ..Jb, lmes 14-22; PCC073:D0568651-D0568907, para.83.

536 PCC073:20160726_STL-l l-Ol_T_T282, p.36, lines 23-25; PCC073:D0530014-D0530470, para.1140.

537 PCC02l:D0457446-D0457616, pp.4-5,64-65; PCC073:20160726_STL-ll-Ol_T_T282, p.8, lines 6- 13; PCC073:20160414_STL-ll-Ol_T_T253, p.20, lines 8-23.

538 PCC073 :D0540969-D054 l l 93, paras.488,521; PCC02 l :D0346171-D0346243, pp.16,67.

539 PCC073 :D0540969-D054 l l 93, para.695; PCC02 l :D0455633-D0455715, p.56.

STL-18-1 O/PT /PTJ 78of185 15 December 2020 Public Redacted R026582

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

231. The Network was shut down in September 2005, with approximately $5160 of unclaimed credit remaining. 540 The shut-down was hastily completed. 541 For example, (Subject 6) was recharged only four days before it was last used, despite the phone already having existing credit from a previous recharge. This suggests the user of (Subject 6) was not in control of the recharge process and may not have been aware of the Network's imminent shutdown. 542 The timing of the shutdown of the coincides with the discovery of the Networks and the investigation into them. 543

V. PHONES INVOLVED IN THE ATTACKS WERE USED BY AYYASH & BADREDDINE

A. Introduction

232. AYYASH and BADREDDINE, and the unidentified participants, carried and used multiple mobile phones from different Networks. AYYASH and BADREDDINE each used several other mobiles phones to contact family members and acquaintances or non-personal contacts. The use of personal and non-personal mobile phones in sequence assists in the attribution of the Network mobile phones to AYYASH and BADREDDINE. Through the evidential process of attribution, both AYYASH and BADREDDINE can be seen using over a time period numerous mobile telephones, simultaneously and in sequence. Placing these phones into the hands of A YYASH and BAD RED DINE allows for the network and chronological analysis of their patterns of movements and contacts establishing their criminal conduct.

233. The attribution of a phone number is the association of that phone number with use by a particular person during a specific period (the Attribution Period). It relies on the

540 PCC073:D0568651-D0568907, paras.64-65; PCC073:D0540969-D0541l93, paras.760-761,794-798, 799- 803.

541 PCC073:20160415_STL-l l-Ol_T_T254, p.22, lines 6-25.

542 PCC02 l :D0368634-D0369059, pp.348-349,408.

543 PCC082:60263705 _TS_ O_EN_ AR_ Ol(FINAL RED), pp.79-81,85-88,90,92-94; D0570627-D0570887, D0570859,row.6740; D056954 7-D057014 l, D05701 l O,row.16913, D0570114,row .17028; D0570l42-D0570163; PCC073:D056865 l-D0568907, para.1402.

STL-18-1 O/PT /PTJ 79of185 15 December 2020 Public Redacted R026583

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

analysis of a variety of sources, including witness statements, documentary evidence, text messages sent and received, the handset( s) used with the relevant SIM card, the contact and geographic profiles of the phone number, single-user analysis, and other attribution points linking an individual to a particular phone. 544 Attribution analysis, through the superimposition of the results of these various examinations, place mobile phones, even covert ones, into the hands of individuals, in this case, AYYASH and BADREDDINE.

234. The contact profile of a phone number refers to the analysis of frequently called numbers of the main phone and the links between the persons associated with those numbers (referred to as third party contacts) and the user of the main phone, for example, family members, acquaintances, associates and service providers. 545

235. The geographic profile or cell-usage analysis refers to the most commonly used Cell Sectors of a given mobile phone number. These most commonly used Cell Sectors can be compared against locations associated with an individual to assist in the attribution of this given mobile phone. For example, a person will frequently use a mobile phone in Cell Sectors providing coverage in the area of residence.

236. Single-user analysis is the study of the geographical use in time and patterns of calls of mobile phones to determine if they are consistent with being used by a single person. When two or more mobile phones used close in time are consistently cell sited in the same area, or within a distance that could be travelled with the time separation between the calls, they could be used by one person. In the case of a single mobile phone number, consistency in its patterns of use (contact and geographic profiles) could indicate that this mobile phone number had a single user during the relevant period.

237. The table below sets out a list of all the mobile phones that the Prosecution attributes to AYYASH, BADREDDINE and the unidentified participants during the relevant period:

544 The evidence attributing phone numbers to AYYASH and BADREDDINE is listed and analysed in the following reports: Evidence of telephone attribution -AYY ASH (PCC025 :D0568187-D0568339) and Evidence of telephone attribution -Badreddine (PCC025:D0568340-D0568447).

545 The attribution of phone numbers to all relevant third party contacts, including for both A YYASH and BADREDDINE, is detailed in a distinct report (PCC025:D0567763-D0567826).

STL-18-1 O/PT /PTJ 80of185 15 December 2020 Public Redacted R026584

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

Mobiles PMPs

AYYASH 3071233 3159300 3468669 3123741 3937709 3767165 ( ) ( ) ( ) ( ) (Mobile (PMP 165) 709) 3067322 3205294 3197259 ( ) ( ) 3831170 (PMP 259) (Mobile 170) 3523935 (PMP 935)

3020091 (PMP 091)

BAD RED DINE 3140023 3833354 ( ) (PMP 354) 3816128 (Mobile 3966663 128) (PMP 663)

3293944 (Mobile 944)

3103195 (Mobile 195)

3476683 (Mobile 683)

3121486 (Mobile 486)

Subject 5 3043585 3125636 (nm~ :')l):')) (K~U 0--'0)

Subject 6 3197610 3345457 3129678 (Blue 610) (Yellow 457) (Red 678)

Subject 7 3067324 3127946 (Blue 324) (Red 946)

Subject 8 3197817 3971933 3129893 (Blue 817) (Yellow 933) (Red 893)

STL-18-1 O/PT /PTJ 81 ofl85 15 December 2020 Public Redacted R026585

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

Mobiles PMPs

Subject 9 3198864 3712024 3129652 ( ) ( ) ( )

Subject 12 3071235 ( )

Subject 13 3079501 ( )

Subject 18 3193428 ( )

Subject 19 3196742 ( )

STL-18-1 O/PT /PTJ 82of185 15 December 2020 Public Redacted R026586

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

B. Attribution-AYYASH

1. Overview

238. The following table illustrates the Attribution Period of the mobile phones attributed to AYYASH and their sequence in time:

(("', (·-: r.-, ~ !....""; L-, _;, ~-I 1--; 1--: _,, c, <:t ,._,,- l r··• ,- I ct L-1 •::<: G'< _, ('·i I' I ·~'l <:'.!" 1..-1 --tD ''J' ,_,C• ~ c1 0 El C• Ci c; 0 Ci 0 Ci 0 Ci 0 Ci C• Ci Ci ~

rv1obilc 709 r·1Jobilc 17CI

PFv1P PM P 165 PfV1P 091 259

239. The mobile phones used by AYYASH are labelled as PMPs, non-personal mobile phones (Mobiles) or Network phones, depending on the nature of each phone's contacts.

240. A YYASH overtly used his PMPs to contact family members, acquaintances, business associates in the car trade, and employment within the Civil Defence. 546 Three of these PMPs were given as contact number to third parties in relation to AYYASH or his family. 547 The overt nature of these PMPs means that they would more easily reveal the identity of their user. 548

546 PCC025 :D0568 l 87-D0568339, para.50.

547 PCC025:D0568187-D0568339, para.51.

548 PCC025:D0568187-D0568339, para.51.

STL-18-1 O/PT /PTJ 83 of 185 15 December 2020 Public Redacted R026587

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

241. AYYASH's Mobiles served a different purpose than his PMP's, as demonstrated by the different nature of their contact profile, which was largely composed of senior figures within Hezbollah, their associates and landlines belonging to Hezbollah ('non­ personal contacts').549 Other associates of AYYASH feature in the contact profile of the Mobiles, but as a more incidental component than seen with the PMPs. 550

242. The nature of some of AYYASH's phones has evolved over time. PMP 165 was initially used by A YYASH to communicate with personal, non-personal and Yellow Network contacts. 551 After he started using in December 2003, AYYASH used PMP 165 for personal contacts only, and he used for his non-personal and Network contacts. 552 On 29 May 2004, two days after he stopped using , A YYASH started using Mobile 709 and , from which point AYYASH's non-personal contacts were transferred to Mobile 709, and his Network contacts were transferred to 553

243. The consecutive use of AYYASH's PMPs and Mobiles, with little to no lapse of time in between changing phones, and the manner in which the purpose of some of these mobiles phones has evolved over time are illustrated in the table below: 554

549 PCC025:D0568187-D0568339, para.178.

550 PCC025:D0568187-D0568339, para.178.

551 PCC025 :D0568 l 87-D0568339, paras.53-56.

552 PCC025:D0568187-D0568339, paras.195,197.

553 PCC025:D0568187-D0568339, para.238.

554 PCC025:D0568187-D0568339, para.453.

STL-18-1 O/PT /PTJ 84of185 15 December 2020 Public Redacted (i) AYYASH's residence in Hadath and Landline 696

246. A YYASH owned a residence near the JamowvSte-Therese Street in Hadath, between 2002 and 2007. 556 AYYASH applied for the activation of Landline 5467696 at this

555 PCC025:20170718_STL-l l-Ol_T_T382, pp.12-31; PCC025:D0529566-D0529838, slides:7-l l.

556 PCC025:D0568187-D0568339, paras.38-43.

STL-18-1 O/PT /PTJ 85 of 185 15 December 2020 Public Redacted 562 PCC025:D0568187-D0568339, para.35.

563 PCC025:D0568187-D0568339, para.36.

564 PCC025:D0568187-D0568339, para.37.

565 PCC025:D0568187-D0568339, paras.62-65; PCC025:20170718_STL-l l-Ol_T_T382, pp.31-60.

566 PCC025:D0568187-D0568339, para.70.

567 PCC025:D0568187-D0568339, para.71.

STL-18-1 O/PT /PTJ 86of185 15 December 2020 Public Redacted R026590

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

AYYASH,568 geographic profile,569 and single-user analysis with another mobile phone attributed to AYYASH. 570 AYYASH used PMP 165 to make calls to service providers' phone numbers and activated cell towers adjacent to the offices of the service providers, including on days where an appointment was recorded for A YYASH or his family members. 571

249. AYYASH used PMP 165 in a handset he subsequently used with PMP 259,572 and in a handset installed in his vehicle. 573 AYYASH also used PMP 165 in two handsets that were used by five phones. 574 PMP 165 was in contact 110 times with nine different phone numbers. 575

(ii) PMP 259

250. AYYASH was the user of PMP 259, an Alfa phone number, from 13 April 2004 to 4 June 2004. 576 PMP 259 is attributed to A YYASH through its frequent contacts with family members and known associates of AYYASH,577 its geographic profile,578 and

568 PCC025:D0568187-D0568339, paras.72-76; PCC025:20170718_STL-l l-Ol_T_T382, pp.39-45,49-51.

569 A change in PMP 165's most frequently used cell towers occurred around February 2003. While the exact circumstances are unknown, this change appears to correspond to the acquisition of the Hadath residence in March 2002 and the commencement of electricity and landline services there a year after in April 2003. From this point onwards, the most frequently used cell towers were located in the area of the Hadath residence. PCC025:D0568187-D0568339, paras.77-92; PCC025:20170718_STL-l l-Ol_T_T382, pp.53- 57.

570 PCC02 l :D0550905-D055 l 037.

571 PCC025:D0568187-D0568339, paras.93-94,310-323.

572 PCC025:D0568187-D0568339, para.68.

573 PCC025 :D0568187-D0568339, para.66.

574 PCC025 :D0568 l 87-D0568339, para.67.

575 PCC025: 20170718_STL-ll-Ol_T_T382, pp.45-48.

576 PCC025:D0568187-D0568339, para.95.

577 PCC025:D0568187-D0568339, para.106.

578 PCC025:D0568187-D0568339, paras.107-110.

STL-18-1 O/PT /PTJ 87of185 15 December 2020 Public Redacted R026591

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

single-user analysis with mobile phones attributed to A YYASH. 579 Additionally, AYYASH used PMP 259 in the handset installed in his vehicle and in a handset previously used by PMP 165.580

(iii) PMP 935

251. AYYASH was the user of PMP 935, an Alfa phone number, from 31May2004 to 13 January 2005,581 as attributed through documentary evidence,582 frequent contacts with family members and known associates of A YYASH, 583 geographic profile, 584 and single-user analysis with mobile phones attributed to A YYASH. 585 A YYASH used PMP 935 in the same handset subsequently used with PMP 091, as well as a handset installed in his vehicle. 586

252. On 20 November 2004, AYYASH was involved in an accident with that vehicle. AYYASH used PMP 935 to make and receive a series of calls in relation to the accident, and listed PMP 935 as his contact number in documents generated by an insurance company, an accident expert and a car towing company in relation to that accident. 587

(iv) PMP091

253. On the day that he stopped using PMP 935 on 13 January 2005, AYYASH started using PMP 091, an MTC/Touch phone number, and used it until 6 March 2005. 588 PMP 091

579 PCC021 :D0550905-D0551037.

580 PCC025:D0568187-D0568339, paras.103-104.

581 PCC025:D0568187-D0568339, paras.123-135; PCC025:20170718_STL-1 l-01 _ T_ T382, pp.78-82; PCC025:20170719 _ STL-11-0 l _ T_T383, pp.5-33.

582 PCC025 :D0568187-D0568339, paras.139-143.

583 PCC025:D0568 l 87-D0568339, para.144; PCC025:201707 l 9_ STL-1 l-Ol _ T_ T383, pp.15-30.

584 PCC025:D0568187-D0568339, paras.145-147; PCC025:20170719 _STL-1 l-01 _ T_ T383, pp.30-33.

585 PCC021:D0550905-D055l037.

586 PCC025 :D0568187-D0568339, paras.136-137.

587 PCC025 :D0568187-D0568339, paras.148-149,341-369.

588 PCC025:D0568187-D0568339, paras.153-164; PCC025:20170822 _STL-1 l-01 _ T_ T385, pp.18-34.

STL-18-1 O/PT /PTJ 88of185 15 December 2020 Public Redacted 594 PCC025:D0568187-D0568339, paras.174,316-323.

595 PCC025:D0568187-D0568339, paras.184-194.

596 PCC025:D0568187-D0568339, para.197.

597 PCC025:D0568187-D0568339, paras.198-202.

598 PCC02 l :D0550905-D055 l 037.

599 PCC025:D0568187-D0568339, para.195.

STL-18-1 O/PT /PTJ 89of185 15 December 2020 Public Redacted R026593

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

256. While it is labelled as a 'Yell ow' phone, as the majority of its contacts were phones numbers, 600 is included in the group of AYYASH's Mobiles, as it represents a bridge between AYYASH's PMP 165 and his Mobiles for his contacts linked to Hezbollah. These Hezbollah related contacts, representing a minority of use with PMP 165, were transferred to , where they increased their presence, to then be transferred to Mobile 709 (and eventually to Mobile 170), where they again increased to become the majority of contacts. 601 The Hezbollah linked contacts of include SAFA (Head of the Hezbollah Coordination and Liaison Unit), SAFIEDDINE (Hezbollah's representative in Iran), SHERRI (former Hezbollah MP for Beirut), AMMAR (Hezbollah MP), landlines associated with Hezbollah, and unattributed numbers that were themselves contacts of high profile Hezbollah representatives. 602

(ii) Mobile 709

257. AYYASH was the user of Mobile 709, an MTC/Touch phone number, from 29 May 2004 to 4 January 2005.603 AYYASH started using Mobile 709 two days after he

stopped using ,604 and the Hezbollah related contacts of AYYASH's were transferred to Mobile 709. 605 Mobile 709 is also attributed to AYYASH through its geographic profile,606 and single-user analysis with AYYASH's other mobile phones numbers. 607

600 PCC025:D0568187-D0568339, para.197.

601 PCC025:D0568187-D0568339, para.179.

602 PCC025:D0568187-D0568339, para. l 97(f).

603 PCC025 :D0568 l 87-D0568339, paras.206-212.

604 PCC025 :D0568187-D0568339, paras.181,203.

605 PCC025:D0568187-D0568339, para.214.

606 PCC025 :D0568187-D0568339, paras.215-216.

607 PCC021 :D0550905-D0551037.

STL-18-1 O/PT /PTJ 90of185 15 December 2020 Public Redacted R026594

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

258. Moreover, AYYASH used Mobile 709 to make a series of calls on 20 November 2004 in relation to his car accident and activated cell towers in the area of the accident. 608

(iii) Mobile 170

259. AYYASH was the user of Mobile 170, an MTC/Touch phone number, from 7 January 2005 to 26 November 2005. 609 A YYASH started using Mobile 170 three days after the

end of the Attribution Period of Mobile 709. 610 As with and Mobile 709

previously, Mobile 170 had a distinct purpose compared to AYYASH's PMPs. 611 Mobile 170 was primarily used to contact high profile figures of Hezbollah and some of their associates. 612 AYYASH used Mobile 170 to communicate with BAD RED DINE on Mobile 683 for the coordination, preparation and execution of the HAWI Attack,613 and to communicate with BADREDDINE on Mobiles 683 and 486 for the coordination, preparation and execution of the EL-MURR Attack.614

260. Mobile 170 is attributed to A YYASH through its contact615 and geographic profiles, and single-user analysis with AYYASH's other mobile phones. 616 Another user used Mobile 170 as a until 7 January 2005. 617 From that date, Mobile 170 was used with IMEI 35252200022555, a handset previously used with AYYASH's

618

608 PCC025:D0568187-D0568339, paras.217,341-369.

609 PCC025:D0568187-D0568339, paras.221-229; PCC025:20170822 _STL-1 l-01 _ T_ T385, pp.80-85; PCC025:20170823 _ STL-1 l-01 _T _ T386, pp.17-27.

610 PCC025 :D0568 l 87-D0568339, paras.203,218.

611 PCC025:D0568187-D0568339, para.220; PCC025:20170823_STL-11-0l_T_T386, p.21, lines 2-23.

612 PCC025:D0568187-D0568339, para.178.

613 See Vl(C).

614 See VI(D).

615 PCC025 :D0568 l 87-D0568339, paras.239-241; PCC025:20 l 70823 _ STL-1 l-Ol _ T_ T386, pp.23-24

616 PCC021:D0550905-D055l037.

617 PCC025 :D0568 l 87-D0568339, para.222.

618 PCC025:D0568187-D0568339, paras.230; PCC025:20170822_STL-1 l-Ol_T_T385, pp.82-83.

STL-18-1 O/PT /PTJ 91 of185 15 December 2020 Public Redacted 622 PCC025:D0568187-D0568339, paras.252-258; PCC025:20170719_STL-l l-Ol_T_T383, pp.33-44.

623 See VI(A).

624 See Vl(B).

625 PCC025:D0568187-D0568339, paras.261-262; PCC025:20170719_STL-l l-Ol_T_T383, pp.34-39.

626 PCC025 :D05 68 l 87-D05 68339, paras.263-265.

627 PCC021 :D0550905-D0551037.

STL-18-1 O/PT /PTJ 92of185 15 December 2020 Public Redacted R026596

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

many of which were contacts of PMP 165 and , phone numbers previously used by A YYASH. 628 Two of the most contacted numbers are landlines subscribed to the company Protel, which were also contacts of AYYASH's PMP 935, PMP 165, Mobile 170 and other phone numbers of the and Networks. 629

264. AYYASH used to make a series of calls seemingly related to his car accident on 20 November 2004, strengthening the attribution of to him. 630 Additionally, the profile of geographical use of , just as AYYASH'S PMP 935, shifted in accordance with AYYASH transferring his place of employment from the Markaba station to the Al-Doueir Civil Defence station on 1 November 2004. From that date, neither and PMP 935, nor any other phone attributable to AYYASH, ever used again the cell towers providing predicted coverage in the town of Markab a. 631

(ii)

265. AYYASH was the user of , an Alfa phone number, from 30 September 2004 to 14 February 2005.632 Between 30 September and 1 October 2004, AYYASH used to communicate with BADREDDINE on for the coordination and preparation of the attack against HAMADE. 633 A YYASH also used phones to communicate with BADREDDINE on for the coordination, preparation and execution of the attack against HARIRI. 634

628 PCC025 :D0568 l 87-D0568339, paras.261-262.

629 PCC025:D0568187-D0568339, paras.261-262; PCC025:20170719_STL-l l-Ol_T_T383, pp.34-39.

630 PCC025:D0568187-D0568339, paras.266,341-371.

631 PCC025:D0537160-D0537577, paras.324-330; PCC025:20170719_STL-1 l-Ol_T_T383, pp.59-61.

632 PCC025:D0568187-D0568339, paras.292-299; PCC025:20170823_STL-l1-0l_T_T386, pp.64-74.

633 See Vl(A).

634 See VI(B).

STL-18-1 O/PT /PTJ 93 of 185 15 December 2020 Public Redacted R026597

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

266. is attributed to AYYASH through its geographic profile635 and single-user analysis with AYYASH's other mobile phones numbers. 636 The most frequently used cell tower of , SFEIR2, provides the predicted best server coverage for A YYASH' s residence in Hadath, 637 and is identical to the top cell tower of PMP 935 and , two other Alfa phones numbers used by A YYASH. 638 A YYASH used almost exclusively for contacts with BADREDDINE's 639

(iii)

267. AYYASH was the user of , an MTC/Touch phone number, from 10 January 2005 to 21 September 2005. 640 Between 22 May and 21 June 2005, AYYASH used to communicate with Subjects 5, 6, 8, 9, 12, 18 and 19 on their phones numbers for the coordination, preparation and execution of the attack against HAWI. 641 Between 28 June and 12 July 2005, AYYASH used to communicate with Subjects 5, 6, 7, 8 and 9 on their phones numbers for the coordination and preparation of the attack against EL-MURR.642 AYYASH also used to communicate with phones numbers for the coordination and preparation of the HARIRI Attack. 643

268. is attributed to AYYASH through its geographic profile644 and single-user analysis with other phones attributed to AYYASH.645 was almost exclusively

635 PCC025 :D0568 l 87-D0568339, paras.304-307.

636 PCC021 :D0550905-D0551037.

637 PCC025:D0568187-D0568339, para.307.

638 PCC025 :D0568187-D0568339, paras.145-146,254.

639 PCC025 :D0568 l 87-D0568339, paras.299-302.

640 PCC025:D0568187-D0568339, paras.271-276; PCC025:20170823_STL-l1-0l_T_T386, pp.27-64.

641 See VI(C).

642 See Vl(D).

643 See Vl(B).

644 PCC025 :D0568 l 87-D0568339, paras.282-283.

645 PCC021 :D0550905-D0551037.

STL-18-1 O/PT /PTJ 94of185 15 December 2020 Public Redacted R026598

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

used for contacts with other phone numbers.646 Of the two contacts external to the , one 1s a common contact to A YYASH' s landline 5467696, PMP 165 and PMP 935. 647

269. Additionally, activated cell towers in the vicinity of a service provider on a day when AYYASH's wife had an appointment. 648

(iv)

270. AYYASH was the user of , an Alfa phone number, from 14 January 2005 to 14 February 2005. 649 AYYASH used to communicate with phones used by Subjects 5, 6, 7, 8, and 9 for the coordination, preparation and execution of the HARIRI Attack. 650

271. is attributed to A YYASH through single-user analysis with other phone numbers attributed to AYYASH,651 which is supported by 's geographic profile. 652 AYYASH never used in the area of his residences. It nevertheless shows strong similarities with the geographic profile of , as certain cell towers near the crime scene and its surrounding area appear high on the list of frequently used cells, 653 providing additional evidence that both these phone numbers had a single user. 654 Moreover, the manner in which the and phones

646 PCC025:D0568187-D0568339, paras.279-281.

647 PCC025:D0568187-D0568339, para.280; PCC025:20170823 _STL-1 l-Ol_T_T386, pp.28-31;

648 PCC025:D0568187-D0568339, paras.284,316-323.

649 PCC025:D0537160-D0537577, paras.528-535; PCC025:20170823 _STL-1 l-01 _ T_ T386, pp.72-80; PCC025:20170824_STL-l 1-0l_T_T387, pp.14-25.

650 See VI(B).

651 PCC021:D0550905-D055l037; PCC021 :D0429236-D0429520.

652 PCC025 :D0537 l 60-D0537577, paras.545-549.

653 PCC025:D0537160-D0537577, paras.545-549; PCC025:20170823_STL-l1-0l_T_T386, pp.76-80.

654 PCC025: D0537160-D0537577, paras.546-547.

STL-18-1 O/PT /PTJ 95 of 185 15 December 2020 Public Redacted R026599

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

operated further demonstrates that these phones were used by AYYASH, as calls made within these networks only occurred in specific patterns and not randomly. 655

(v)

272. AYYASH was the user of , an MTC/Touch phone number, from 18 October 2004 to 27 December 2004. 656 is attributed to A YYASH through single-user analysis with other phone numbers attributed to A YYASH. 657

C. Attribution-BADREDDINE

1. Overview

273. BAD RED DINE was the user of two PMPs, five Mobile phone numbers and one phone. 658

2. Profile of BAD RED DINE and his use of the alias 'Sarni ISSA' and 'Safi BADR'

274. There are very few official records kept in the name of Mustafa Amine BADREDDINE.659 BADREDDINE used the alias Sarni ISSA and Safi BADR.660 BADREDDINE owned a jewellery store, Samino Jewellery, under the alias Sarni ISSA. 661 Contacts of PMP 663, which includes girlfriends, university friends and Samino employees, knew the user of that phone as Sarni Issa. SMS messages refer to the user of PMP 354 as 'Sarni', 'Sam' or 'Safi', and the user of PMP 663 as 'Sarni Issa', 'Sarni' or 'Sarni Samino'.662 Evidence in relation to Sarni ISSA corresponds to

655 PCC021: 20170424_STL-1 l-Ol_T_T360, pp.88, lines 1-11.

656 PCC021:D0537160-D0537577, p.5.

657 PCC021 :D0374474-D0374710; PCC021 :D0429521-D0429667.

658 The underlying evidence attributing phone numbers to BADREDDINNE is referred to and analysed in PCC025 :D0568340-D056844 7.

659 PCC025:20170705 _STL-1 l-Ol_T_T379, pp.19-24.

660 PCC025 :D0568340-D0568447, paras.15-53.

661 PCC025 :D0568340-D0568447, paras.20-21,26.

662 PCC025:D0568340-D0568447, para.15.

STL-18-1 O/PT /PTJ 96of185 15 December 2020 Public Redacted 665 PCC025:D0568340-D0568447, paras.38-44.

666 PCC025 :D0568340-D056844 7, paras.52-53.

667 PCC025:D0568340-D0568447, para.48.

668 PCC025:D0568340-D0568447, para.19.

669 PCC025 :D0568340-D0568447, paras.20-28.

670 PCC025:D0568340-D0568447, paras.64-74; PCC025:20170704_STL-l l-Ol_T_T378, pp.28-71.

STL-18-1 O/PT /PTJ 97of185 15 December 2020 Public Redacted R026601

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

documentary671 and witness evidence,672 text messages review,673 geographic674 and contact675 profile, and single-user analysis with BADREDDINE's other phones. 676

(ii) PMP663

277. BADREDDINE was the user of PMP 663, an MTC/Touch phone, from at least 26 February 2001 to 31 December 2005. 677 PMP 663 is attributed to BADREDDINE through witness evidence, 678 text messages review,679 geographic680 and contact681 profile, and single-user analysis with other phones attributed to BADREDDINE.682 BADREDDINE also used PMP 663 to contact a Saudi phone number when his wife and daughter travelled to Saudi Arabia. 683 Additionally, messages relating to the death of a family member of Sarni Issa were sent to PMP 663, coinciding with the death of a family member ofBADREDDINE. 684

671 PCC025:D0568340-D0568447, para.75.

672 PCC025 :D0568340-D056844 7, para. 76.

673 PCC025:D0568340-D0568447, paras.77-84; PCC025:20170704_STL-1 l-Ol_T_T378, pp.72-74.

674 PCC025 :D0568340-D0568447, paras.85-108.

675 PCC025:D0568340-D0568447, paras.109-125.

676 PCC025 :D0568340-D05 6844 7, paras.17 6-186,210-23 8; PCC02 l :D022 l 699-D022194 3.

677 PCC025:D0568340-D0568447, para.126; PCC025:20170705 _STL-11-0l_T_T379, pp.55-67.

678 PCC025 :D0568340-D0568447, para.141.

679 PCC025 :D0568340-D0568447, paras.142-159.

680 PCC025:D0568340-D0568447, paras.172-175.

681 PCC025 :D0568340-D0568447, paras.160-171.

682 PCC025 :D0568340-D05 6844 7, paras.210-23 8; PCC02 l :D022 l 699-D022194 3.

683 PCC025 :D0568340-D0568447, paras.187,291-295.

684 PCC025 :D0568340-D056844 7, paras.187 ,306-316.

STL-18-1 O/PT /PTJ 98of185 15 December 2020 Public Redacted R026602

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

(iii) Mobiles 128, 944, 195, 683 & 486

278. BADREDDINE was the user of Mobiles 128, 944, 195, 683 and 486. All Mobiles were

Alfa phones with the exception of Mobile 128, which was an MTC/Touch phone.685 The following table illustrates the Attribution Period and their sequential use in time of Mobiles 128, 944, 195, 683 and 486: 686

ob le ob fie ob le

1 ,_, 09-0 3-1)4 3-05 18-0 3-05 2::1-06-0:,

04-0 3-1)4 CJ'?-0 3-05 16-0 3-(15 27-06-1)~, 28-1)9-1)5

4 12 Do\'5 ~i65 Da'~'S ::.::: 91 Oa~~,S 95

279. These five Mobiles had a distinct profile and were used much more discreetly than BADREDDINE's PMPs; they had a significantly lower number of contacts, had a low level SMS content, top three contact numbers were anonymous pre-paid numbers with nearly sequential numbers, and no business records could be identified in relation to

these numbers.687 They were in contact with members of Parliament and officials associated with Hezbollah, switchboard numbers (for example the Great Prophet Hospital landline), and Samino associates that had a proximity to BADREDDINE that would have allowed them to know his real identity. 688 Four of these five Mobiles were in contact with phone numbers attributed to A YYASH. 689 BAD RED DINE used Mobile 683 to contact A YYASH on Mobile 170 for the coordination, preparation and

execution of the attack against HAWI,690 and BADREDDINE used Mobiles 486 and

685 PCC025:D0568340-D0568447, para.199.

686 PCC025 :D0568340-D056844 7, paras.201-203.

687 PCC025:D0568340-D0568447, para.190.

688 PCC025 :D0568340-D0568447, paras.57,169,190.

689 PCC025 :D05 68340-D05 6844 7, para.190.

690 See VI(C).

STL-18-1 O/PT /PTJ 99of185 15 December 2020 Public Redacted J:'CCU2) :LJU) b~J4U-LJU) 6~44 I, paras.2)2-2) ~.

697 PCC025:D0568340-D0568447, paras.268-269; PCC025:20170717 _STL-1 l-01 _ T_ T38L pp.21-34; PCC025:20170705 _ STL-1 l-01 _ T _ T379, p.55, lines 12-lS.

698 PCC02S :DOS 68340-DOS 6844 7, paras.210-23 8; PCC02 l :D022 l 699-D022 l 94 3; PCC02l:2017071 7_ STL­ l l -O l _ T _ T38 l, pp.38-94. See also PCC021: 20170424_STL-l l-Ol_T_T360, pp.73-74, p.7S, lines 3-7.

699 PCC02S :DOS 68340-DOS 6844 7, paras.262-267.

700 PCC073 :DOSS9030-DOS59495, paras.99, 1S3-l S4.

STL-18-1 O/PT /PTJ 100ofl8S l S December 2020 Public Redacted R026604

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

located and moved in concert with these three mobile phones on all common usage days. 701 Additionally, 's most frequently used cells sectors were similar to the most frequently used cells of PMP 944 for the equivalent period, both mobiles showing particular links with the areas of Jounieh, where BADREDDINE had a residence, 702 and Dahieh. 703

D. Other unidentified participants used network phones, including network phones involved in the attacks

284. Although some Network phone numbers remam unattributed to date, single-user analysis shows that some Network phone numbers had a unique user during their relevant periods of use. These unidentified unique users are referred to as Subjects. They respectively used the following Network phone numbers:

• Subject 5 was the single user of , an MTC/Touch phone, and , an Alfa phone; 704

• Subject 6 was the single user of and , all three Alfa phones;705

• Subject 7 was the single user of , an MTC/Touch phone, and , an Alfa phone; 706

701 PCC025 :D0568340-D0568447, paras.279-280.

702 PCC025 :D0568340-D0568447, paras. 94-98.

703 PCC025 :D0568340-D0568447, paras.268-280.

704 PCC02 l:D0345943-D0346170; PCC021 :D042952 l-D0429667; PCC02 l:D055 l 038-D0551277. See also PCC021:20170424_STL-l l-01 _ T _ T360, pp. 76-78; PCC02 l :D05l8013-D0528528, slides 508-511.

705 PCC02 l :D0345943-D0346 l 70; PCC02 l :D0429521-D0429667; PCC02 l :D0551038-D0551277. See also PCC02 l :20170424_STL-l l-01 _ T _ T360, pp.76-78; PCC02 l :D05 l 8013-D0528528, slides 508-511.

706 PCC02l:D0345943-D0346170; PCC02l:D0429521-D0429667; PCC02l:D0551038-D0551277. See also PCC021: 20170424_STL-l l-01 _ T_ T360, pp.76-78; PCC02 l :D05 l 8013-D0528528, slides 508-511.

STL-18-1 O/PT /PTJ 101of185 15 December 2020 Public Redacted R026605

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

• Subject 8 was the single user of , an MTC/Touch phone, and , both Alfa phones; 707

• Subject 9 was the single user of , an MTC/Touch phone, and , both Alfa phones. 708

285. Not only does single-user analysis point clearly to the six core users of the phones holding the six phones, but the exceptional nature of common call patterns being shared by two sets of Network phones demonstrate that these recurrent instances of co­ location pointing to single use could not sensibly have occurred by coincidence. 709 From late January to 14 February 2005, HARIRI's movements were systematically tracked concurrently by six core users (of eight) and six core users (of 15). 710 These six phones are demonstrated by expert evidence to be the alternate phones of the same six users which were used to make calls, such as to, from and in south Beirut, 711 so that their base area would not be forensically associated with the execution of the Hariri attack as the phones ultimately were.712 Four of those six users were members of the 713 These patterns,

707 PCC02l:D0345943-D0346170; PCC02l:D0429521-D0429667; PCC02l:D0551038-D0551277. See also PCC021: 20170424_STL-l l-Ol _ T_ T360, pp.76-78; PCC02 l:D0518013-D0528528, slides 508-511.

708 PCC02 l:D0345943-D0346 l 70; PCC02 l :D042952 l-D0429667; PCC02 l :D055 l 038-D0551277. See also PCC02 l: 20170424_ STL-l l-Ol _ T_ T360, pp.76-78; PCC02l:D0518013-D0528528, slides 508-511.

709 PCC02 l :D0568020-D0568183, slide:7 l in particular; also 72,74; PCC021 :D0457446-D0457616, paras.5.3.3, 5.6.2.13, 5.8.1.37-5.8.1.39; PCC021:20150825 _ STL-ll-O l _ T _Tl 84, pp.77-79; PCC021: 20160901 _STL-l l-Ol _ T_ T286, pp.90-91,96.

710 See VI(B).

711 PCC073 :DOS 68651-DOS 68907, para. 97.

712 PCC021 :D0568020-D0568183, slides:l3 l-133; PCC02l:D0457446-D0457616, paras.5.4.6.1,6.1.4; PCC021: 20160906_STL-ll-Ol_T_T289, pp.9-16.

713 PCC073:D0540969-D0541193, para.1103.

STL-18-1 O/PT /PTJ 102ofl85 15 December 2020 Public Redacted R026606

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

independently of traditional single-user analysis, verify that the recurrent instances of co-location amongst the six and phones could not occur by coincidence. 714

286. Other Network phones involved m the attacks are associated to unidentified participants: (Subject 18), (Subject 19), (Subject 12) and (Subject 13).715

VI. THE TERRORIST ATTACKS

A. The HAMADE Attack

1. Overview

287. On 1 October 2004, between 09: 11 and 09: 13 on Henry Ford Street in Beirut, an attempt was made to assassinate Marwan HAMADE, when a VBIED exploded approximately one metre from HAMADE's vehicle which was heading to the Parliament. The explosion seriously injured HAMADE and [Redacted], [Redacted], and instantly killed HAMADE's security officer, Ghazi ABOU-KARROUM.

288. In the months leading up to the attack, HAMADE publicly voiced his opposition to the Syrian presence in Lebanon and was opposed to the extension of the mandate of President Emile LAHOUD, who was supported by the Syrian regime. 716 After the extension of LAHOUD's mandate, HAMADE resigned from his position as Minister

in protest against the extension. 717 HAMADE also joined the Bristol Group, which opposed the Syrian presence in Lebanon and was critical of the Syrian regime. 718

289. AYYASH, BADREDDINE, Subject 8 and Subject 9 used two phone networks with covert characteristics to communicate in order to prepare and perpetrate the attack on HAMADE. AYYASH used the in his communication with

714 PCC02 l :D0568020-D0568 l 83, slide:7 l in particular; also 72, 74; PCC02 l :D0457446-D04576 l 6, paras.5.3.3, 5.6.2.13, 5.8.1.37-5.8.1.39; PCC02 l :20150825 _STL-l l-Ol _ T_ Tl84, pp.77-79; PCC02 l: 20160901 _ STL-11-0 l _T _T286, pp.90-91,96.

715 See IV(A)(3)(b).

716 See II(C)(2).

717 See ll(C)(2) and ll(D)(4).

718 See ll(B) and ll(D)(6).

STL-18-1 O/PT /PTJ 103ofl85 15 December 2020 Public Redacted PCCU I J:UU'.lbl)b'.l 1-UU'.lbl)lJU /,para. L!.l).

724 PCC073 :D0568651-D0568907, paras.142,344.

725 PCC073:D0568651-D0568907, paras.191,198,210,251,344.

726 PCC060:60235586-60235642, paras.29-31; PCC060:60072872A_TS_D _EN_AR_Ol, p.11, lines 3-18; PCC 170:60330859-60330920, 60330885, para.76; PCC073:D0568651-D0568907, para.140.

727 PCC060:60072872A _TS_ D _EN_ AR_01, p.16, lines 15-22; PCC 170:60330859-60330920, 60330880, para.40; PCC073:D0568651-D0568907, para.129.

STL-18-1 O/PT /PTJ 104ofl85 15 December 2020 Public Redacted 728 PCC060:6003 l 499-60031549, 60031541; PCC060:60235586-60235642, para.68; PCC060:60072872A_TS_D_EN_AR_Ol, pp.11-12, lines 36-8; PCC060:60001087-60001090,

60001088; PCCl 70:60330859-60330920, 60330882, para.62, 60330885, para.76; PCC073:D0568651- D0568907, paras.134-138.

729 PCC073 :D056865 l-D0568907, paras.205,347.

730 PCC073 :D056865 l-D0568907, paras.214,216.

731 PCC073 :D056865 l-D0568907, para.350.

STL-18-1 O/PT /PTJ 105of185 15 December 2020 Public Redacted R026609

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

around HAMADE's residence. 732 Their presence in this area was exceptional, as they had not frequented that area in the two month-period prior to the attack and three month­ period after the attack.733

296. In the evening, AYYASH and Subject 8 continued the surveillance of HAMADE's residence. At 18:58, AYYASH contacted Subject 8 and then, at 19:33, Subject 8 contacted A YYASH. This was the first time Subject 8 had ever contacted A YYASH. 734 After these calls, Subject 8 travelled towards HAMADE's residence and, by at least 20:50, was conducting surveillance of HAMADE's residence and the crime scene - activating cell Riviera A - when receiving a call from Subject 9. 735 After his contact with Subject 8 at 19:33, AYYASH also travelled to the east of HAMAD E's residence, where he was located at 20:34, consistent with surveying the area in preparation for further surveillance the next day. 736

(ii) Surveillance on 30 September 2004

297. On 30 September 2004, AYYASH and Subject 9 conducted surveillance of HAMADE's residence and of the crime scene after HAMADE left his apartment at approximately 09: 15. 737 At 10:06, AYYASH called Subject 9. During this call they activated MANARAl and Riviera B cell, which provide best server coverage to the immediate vicinity ofHAMADE's residence and the crime scene.738

732 PCC073:D0568651-D0568907, paras.221-223,225,347-349.

733 Apart from 28 November 2004, when the Riviera_A cell was randomly activated by Subject 9. PCC073 :D056865 l-D0568907, paras.224,327-328; PCC073:D0568996-D0569028, paras.12-13, 15.

734 PCC073 :D056865 l-D0568907, paras.230-231.

735 PCC073:D056865 l-D0568907, paras.234-241,347-352; PCC073 :D0568996-D0569028, para. l O,map.2.

736 PCC073:D0568651-D0568907, paras.237-238,243-345,347-352.

737 PCC073 :D056865 l-D0568907, para.251.

738 PCC073 :D056865 l-D0568907, paras.249,251-254,353-354; PCC073:D0568996-D0569028, paras.10- 11,maps. l-3.

STL-18-1 O/PT /PTJ 106of185 15 December 2020 Public Redacted 741 PCC073 :D056865 l-D0568907, paras.263-264.

742 PCC073 :D056865 l-D0568907, para.265.

743 PCC073 :D056865 l-D0568907, para.269.

744 PCC073:D0568651-D0568907, para.270.

745 PCC073 :D056865 l-D0568907, paras.271-272.

746 PCC073 :D056865 l-D0568907, paras.359-363.

STL-18-1 O/PT /PTJ 107of185 15 December 2020 Public Redacted 753 PCC073:D0568651-D0568907, para.329.

754 PCC 170:60330859-60330920, 60330867, 60330883, para.68; PCC060:60001087-60001090, 60001087; PCC073:D056865 l-D0568907, paras. l 04,288-289.

755 PCCl 70:60330859-60330920, 60330867,60330883, para.68.

756 PCC060:6003 l 499-60031549, 60031540; PCCl 70:60330859-60330920, 60330867, 60330880, para.38, 60330883, para.68; PCC060:60072872A_TS_D_EN_AR_Ol, p.14, lines 32-33; PCC073 :D056865 l-D0568907, paras. l 04,289.

STL-18-1 O/PT /PTJ 108of185 15 December 2020 Public Redacted R026612

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

has done in the previous days before the attack,757 and ABOU-KARROUM was in the right rear passenger seat. 758

304. After departing the garage, [Redacted] the usual route along Hem-y Ford Street towards the Corniche.759 He slowed down after approximately 100 meters due to a speedbump and an oncoming vehicle.760 Between 09: 11 and 09: 13,761 the explosives concealed in the VBIED parked on Henry Ford Street near the speedbump was remotely detonated as HAMADE's vehicle drove past.762

(i) Results of the forensic investigation

305. HAMADE's car was approximately one meter away from the VBIED when the explosion occurred. 763 The explosives were located on the left side of the VBIED, between the back of the seat and the trunk, 764 which was the nearest point to oncoming

757 PCC060:60001087-60001090, 60001088-89.

758 PCC060:60001087-60001090, 60001088; PCCI 70:60330859-60330920, 60330883, para.68; PCC073:D0568651-D0568907, para.290.

759 PCC060:60235586-60235642, para.68; PCCl 70:60330859-60330920, 60330883, para.68, 60330885, para.76.

760 PCC060:60001087-60001090, 60001088; PCC073:D0568651-D0568907, para.285; PCCI 70:60330859- 60330920, 60330883,para.68; PCC 180:6004 7739-6004 7753, para.29; PCC060:60031499-60031549, 60031538.

761 PCC074:60324920-60324933, paras.10,13,17; PCC181:60045085-60045 l 46, paras.95-96; PCC 170:60330859-

60330920, 60330883, para.68; PCCl 83:60332917-60332968, 60332939, para.88, 60332949, paras.215-220, 60332951,paras.24 7-248; PCC073 :D056865 l-D0568907, paras. I 08-114,293.

762 PCC073 :D056865 l-D0568907, paras.291-292; PCC254:D055 l 823-D055 l 937, D055 l 869-D055 l 888; PCC 180:60001133-60001135; PCC060:6003 l 499-60031549, 60031538; PCC 171 :60235643- 60235656, paras.14,16,25; PCC248:60238835-60238856, paras.25,28, and 60238849-50; PCC260:60324934- 60324949, 60324946; PCCI 92:60323327-60323354, paras.37-38,41.

763 PCC192:60323327-60323354, para.41and60323343; PCC060:20141208_STL-1 l-Ol_T_T99, p.22, lines 14-16.

764 PCC192:60323327-60323354, para.38.

STL-18-1 O/PT /PTJ 109ofl85 15 December 2020 Public Redacted R026613

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

traffic. 765 The explosives were assembled to direct the explosion towards the roadway and to target the upper part of the body of the intended victim. 766

306. The quantity of explosives was estimated to weigh between approximately 2 and 10 kg of TNT equivalent. 767 High explosives were used in the attack. 768 Tests conducted with a portable device indicated the presence of C-4 and RDX. 769 Additionally, there were

indications that metal pellets were added to the directional charge. 770 The severity of the explosion was increased by the detonation causing a fire and the explosion of the fuel tanks of both the VBIED and HAMADE's car. 771

307. No component of the IED's ignition mechanism was retrieved. 772 However, as HAMADE's car was in motion at the time of the attack, and given the layout of the crime scene, as well as the placement of the VBIED next to a speedbump and an aiming marker, the charge was detonated using a remote-controlled command initiation

system.773

765 PCC248:60238835-60238856, 60238851; PCC250, PCC25 l, PCC252, PCC253:60328939-60328976, 60328946.

766 PCC192:60323327-60323354, paras.38-40,46,48; PCC248:60238835-60238856, para.27 and 60238851. See also PCC250, PCC25 l, PCC252, PCC253:60328939-60328976, 60328952.

767 PCC192:60323327-60323354, paras.45-47; PCC248:60238835-60238856, paras.20-21; PCC250. PCC251, PCC252. PCC253:60328939-60328976. 60328950.

768 PCC250, PCC251, PCC252, PCC253:60328939-60328976, 60328950; PCC248:60238835-60238856, 60238850.

769 PCC 192:60323327-60323354, paras.49-53 and 60323343; PCC 167 :60322494-60322521, paras.17-18 and 60322502,60322504.

770 PCC248:60238835-60238856, paras.24,27 and 60238849-50; PCC248:60322783-60322859, para.12 and 60322804-06.

771 PCC248:60238835-60238856, 60238850.

772 PCC192:60323327-60323354, para.54; PCC248:60238835-60238856, para.28; PCC250, PCC251, PCC252, PCC253 :60328939-60328976, 60328952.

773 PCC254:D0551823-D0551937, D0551869-D0551888.

STL-18-1 O/PT /PTJ 110ofl85 15 December 2020 Public Redacted R026614

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

(ii) The victims and material damages to surroundings

308. The rear of HAMADE's Mercedes, where ABOU-KARROUM was sat, was directly hit by the explosion. 774 The force of the explosion hit ABOU-KARROUM's head and upper body, and he was killed instantly. 775 His body was charred by the ensuing fire. 776

309. Both HAMADE and [Redacted] were severely injured by the blast and shrapnel.777 HAMADE suffered from facial cuts and burns, as well as a perforated right eardrum, a hemorrhage in his right eye, and a cerebral concussion. 778 He was admitted to intensive care and remained at the hospital for 12 days. 779 In the months that followed the attack, HAMADE suffered multiple complications, including a brain hem01Thage and paralysis of the limbs, which forced him to stay in critical care, after which he was restricted to a wheelchair and walker. 780

310. In addition to the human victims of the explosion, material damage was caused to several vehicles.781 Windows were shattered, doors and windows dislodged, and buildings up to 300 meters from the explosion site showed damage. 782

774 PCC250, PCC251, PCC252, PCC253:60328939-60328976, 60328945,60328947-48; PCCl 70:60330859- 60330920, 60330871-72, 60330883, para.68; PCC 192:60323327-60323354, 60323343.

775 PCC241 :60324969-60324982, 60324978; 60118400-60118405, 60118401-02; PCC 192:60323327-60323354, para.46 and 60323343; PCC060:20141208 _ STL-11-0l _ T_ T99, p.22, lines 17-19.

776 PCC241 :60324969-60324982, 60324978.

777 PCC241 :60324969-60324982, 60324976-77; 60072875-60072898A; PCC060:60141028- 60142050, paras.7-11; PCC060:20141208_STL-ll-Ol_T_T99, p.26, lines 10-22; PCCl 70:60330790- 60330796, paras. 9-10.

778 PCC241 :60324969-60324982, 60324976.

779 PCC060:60141028-60142050, paras.7-8.

780 PCC060:60141028-60142050, paras.7-11; PCC060:20141208_STL-1 l-Ol_T_T99, pp.26-27, lines 10-2.

781 PCC180:60047739-60047753, paras.35,39; PCCl 71 :60001138-60001141; PCCl 71 :60001626-60001629, 60001627; PCC261 :60324950-60324968, 60324958-59; PCC248:60238835-60238856, 60238849-50.

782 PCC248:60238835-60238856, 60238849-50; 60051695-60051712, 60051696; PCC250, PCC251, PCC252, PCC253:60328939-60328976, 60328947.

STL-18-1 O/PT /PTJ 111 of 185 15 December 2020 Public Redacted 785 PCC073 :D056865 l-D0568907, paras.294-296.

786 PCC073 :D056865 l-D0568907, paras.295,367-369.

787 PCC073 :D056865 l-D0568907, paras.297-299.

788 PCC073 :D056865 l-D0568907, paras.295-300.

789 PCC073 :D056865 l-D0568907, paras.298-300.

790 PCC073 :D056865 l-D0568907, paras.299-300.

STL-18-1 O/PT /PTJ 112ofl85 15 December 2020 Public Redacted R026616

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

reflects their coordinated activity and is consistent with the three of them travelling south from the crime scene. 791

314. After 1 October 2004, AYYASH's contact with BADREDDINE, Subject 8, and Subject 9 decreased significantly, while the activity at locations relevant to the attack stopped. 792 The call patterns, locations and unusual intensity of contact from 29 September until 1 October 2004 demonstrate the existence of a common purpose, namely the attack on HAMADE, and the necessity for AYYASH to be in regular contact with Subject 8 and Subject 9 over this three day period, as in the five-month period, between 1 August and 20 December 2004, A YYASH, Subject 8 and Subject 9 were not active at the crime scene area on their attributed phones, either as a group or individually, except on these three days. 793 These call patterns and intense level of contact was not repeated until January 2005, when AYYASH, Subject 8 and Subject 9 were involved in the surveillance of HARIRI. 794

B. The HARIRI Attack

1. Overview

315. On 14 February 2005, at 12:55 on Rue Minet el Hos'n in Beirut, as former Prime Minister of Lebanon, HARIRI, and his convoy were travelling from the Lebanese Parliament to his residence at Quraitem Palace, a suicide bomber detonated more than two tonnes of TNT equivalent high-grade explosives, specifically RDX, concealed in a Mitsubishi Canter Van parked along the side of the road near the St. Georges Hotel. The explosion killed HARIRI and 21 other victims and injured 226 people.

316. The assassination of HARIRI, in proportion to the degree of security he maintained, was the result of extensive preparations by a core group of highly-skilled and organised perpetrators, who acted in a very disciplined and coordinated manner to execute what

791 PCC073 :D0568651-D0568907, para.3 70.

792 PCC073:D0568651-D0568907, paras.225,313-318,339-341,375,1417.

793 Apart from 28 November 2004, when the Riviera_A cell was randomly activated by Subject 9. PCC073 :D056865 l-D0568907, para.328; PCC073 :D0568996-D0569028, paras.12-13, 15 .

794 PCC073 :D0568651-D0568907, para.341.

STL-18-1 O/PT /PTJ 113ofl85 15 December 2020 Public Redacted R026617

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

was, and needed to be, a sophisticated terrorist attack. It was members of this same core group who, again led by AYYASH and overseen by BADREDDINE, were at the forefront of the other three indicted attacks. AYYASH with BADREDDINE and other unidentified participants used four telephone networks with covert characteristics, namely , and Networks, to communicate while preparing and perpetrating this terrorist attack.795

317. Specifically, AYYASH and five unidentified participants used the (the Assassination Team) for prepanng and carrying out the attack. AYYASH and BADREDDINE used the to monitor and coordinate the preparations for and perpetration of the attack. A YYASH and other unidentified participants, including the five unidentified users, used the m preparations for the attack, and for the purchase of the vehicle used as a VBIED. A YYASH and other unidentified participants, including three unidentified users, used the for conducting surveillance in preparations for the attack.

318. Between 16 October 2004 and 14 February 2005, AYYASH, BADREDDINE and five unidentified participants, who later formed the Assassination Team with AYYASH, used the following phones, at various dates and times, for preparing and executing the attack on HARIRI:

1) AYYASH: , PMP 935, PMP 091, Mobile 709 and Mobile 170;

2) BADREDDINE: , PMP 663, PMP 354 and Mobile 944;

3) Subject 5: and

4) Subject 6: Yellow 457, Hlue blU and Keet b78;

5) Subject 7: Blue 324 and Red 946;

6) Subject 8: Yellow Blue 817 and Red 893;

795 PCC073:D0568651-D0568907, para.381.

STL-18-1 O/PT /PTJ 114ofl85 15 December 2020 Public Redacted 796 PCC073 :D0568651-D0568907, paras.382-383.

797 PCC073 :D0568651-D0568907, paras.384-385.

STL-18-1 O/PT /PTJ 115ofl85 15 December 2020 Public Redacted R026619

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

(i) Surveillance from 20 October to 19 December 2004

322. Between 20 October 2004 and 19 December 2004, two users, namely Subject 5 and Subject 7, conducted regular, low-level preliminary surveillance of HARIRI and Quraitem Palace, with A YY ASH coordinating their activity. During this period, BADREDDINE monitored the surveillance operation through his exclusive communication with A YYASH using the

323. On 20 October 2004, when HARIRI announced his resignation, 798 Subject 5 and Subject 7 began the surveillance around Quraitem Palace, with AYYASH coordinating the operation and receiving regular updates on the progress of the operation from Subject 5. 799 Surveillance of Quraitem Palace continued on another 15 days, namely on

798 D0004761-D0004762.

799 PCC073:D0530014-D0530470, paras.85,88-91,table.2; PCC073:201701l9_STL-l l-Ol_T_T325, pp.5-13, lines 7-7, in particular pp.9-11, lines 6-25.

STL-18-1 O/PT /PTJ 116ofl85 15 December 2020 Public Redacted R026620

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

21 October 2004· 800 1 to 5 801 and 9 to 11 November 2004 802 23 to 26 803 and 29 ' ' ' ' November 2004; 804 and on 17 December 2004. 805

324. In addition, the relevant users also conducted surveillance ofHARIRI's movements when he visited HAMADE's residence on 22 October 2004806 and 8

800 PCC073:D0530014-D0530470, paras.97,100-101,table.4,map.2; PCC073:20170119 _ STL-1 l-01 _ T_ T325, pp.30-40, lines 19-23.

801 PCC073:D0530014-D0530470, para.115,table.6,map.4; PCC073:20170119 _ STL-11-0l _ T_ T325, pp.70-75, lines 7- 13 (1 November 2004); PCC073:D0530014-D0530470, para.125,table.7,map.5; PCC073:20 l 70119 _ STL-11- 0l _ T_ T325, pp.78-80, lines 19-2 (2 November 2004); PCC073:201701l9 _ STL-l l-Ol _ T_ T325, pp.82-86, lines 8-2 (3 November 2004); PCC073:D0530014-D0530470, paras.130-132, table.8, map.6; PCC073:20170119 _ STL-11- 0 l _ T_ T325, pp.87-103, lines 11-24 (4 November 2004); PCC073:D0530014-D0530470, paras.135, 137-138, table.9,map.7; PCC073:20170119 _ STL-1 l-01 _ T_ T325, pp.104-106, lines 1-6 (5 November 2004).

802 PCC073:D0530014-D0530470, paras.159,162,table.13,map.9; PCC073:20170124_STL-1 l­ Ol_T_T326, pp.25-28, lines 1-10 (9 November 2004); PCC073:D0530014- D0530470, paras.172,174, 176,table.14,map.10; PCC073:20170124_STL-1 l-Ol_T_T326, pp.28- 29, lines 19-19, pp.33-39, lines 5-18, pp.46-47, lines 16-11 (10 November 2004); PCC073:D0530014- D0530470, paras.182, 184-186, table.15, map.11; PCC073:20170124_STL-ll-Ol_T_T326, pp.47-49, lines 12-19 (11 November 2004 ).

803 PCC073:D0530014-D0530470, paras.198,201-203,table.18,map.13; PCC073:20170124_STL-1 l-01 _ T_ T326, pp.102-104, lines 24-24 (23 November 2004); PCC073:D0530014-D0530470, paras.208,212,table.19,map.14; PCC073:20 l 70124_ STL-l l-Ol _ T _ T326, pp.104-105, lines 25-22 (24 November 2004); PCC073:D0530014- D0530470, paras.218-221,table.20,map.15; PCC073:20170124_STL-11-0 l _ T_ T326, pp.l 05-107, lines 23-10 (25 November 2004); PCC073:D0530014-D0530470, paras.224, 226-228, table.21, map.16; PCC073:20170124_ STL-1 l-01 _ T_ T326, pp.108-110, lines 15-16 (26 November 2004).

804 PCC073:20170125_STL-1 l-Ol_T_T327, pp.13-15, lines 2-10.

805 PCC073:D0530014-D0530470, paras.233,235-236,table.22,map.17; PCC073:20170125 _STL-11- 0l_T_T327, pp.29-30, lines 13-25.

806 PCC073:D0530014-D0530470, paras. l 06,109,table.5; PCC073:201701l9 _ STL-11-0l _ T_ T325, pp.40-47, lines 24- 7; PCC060: 20141208_STL-1 l-01 _ T_ T99, pp.41-42, lines 14-1.

STL-18-1 O/PT /PTJ 117 of 185 15 December 2020 Public Redacted R026621

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

November 2004,807 and of the route taken by HARIRI when he travelled from Quraitem Palace to the Airport on 11 November 2004. 808

325. Significantly, AYYASH and BADREDDINE were also in contact on five occasions using their phones, namely on 19, 809 20810 and 28 811 October2004 and on 1812 and 10 November 2004,813 which reflects a periodic monitoring by BAD RED DINE of this initial surveillance conducted by the users with A YYASH coordinating the operation.

(ii) Surveillance from 20 December 2004 to 8 January 2005

326. AYYASH and BADREDDINE resumed their activity on 20 December 2004 following an extended period of inactivity over five weeks, 814 after which the frequency in use and of surveillance on HARIRI intensified significantly and expanded from two users, namely Subject 5 and Subject 7 supervised by AYYASH, to all six members of the future Assassination Team using and phones.

a. Surveillance ofHARIRI's visit to NASRALLAH in Haret Hreik

327. On 21December2004, the perpetrators using their and phones conducted surveillance of HARIRI and his security convoy during a meeting

807 PCC073:D0530014-D0530470, paras.151,153-155,tables. l l-12; PCC073:20170124_STL-l l­ Ol_T_T326, pp.14-24, lines 2-25.

808 PCC073:D0530014-D0530470, paras.182,186-191, tables.16-17, map.12; PCC073:20170124_STL-11- 0l_T_T326, pp.47-59, lines 12-11.

809 PCC073:D0530014-D0530470, para.SI; PCC073:20170118_STL-l 1-0l_T_T324, pp.89-90, lines 4-15.

810 PCC073:D0530014-D0530470, paras.86,93,table.3; PCC073:20170119_STL-l l-Ol_T_T325, pp.14-21, lines 24-4.

811 PCC073:D0530014-D0530470, para.113; PCC073:20170119_STL-1 l-Ol_T_T325, pp.52-56, lines 15-8.

812 PCC073:D0530014-D0530470, paras.117,120,table.6.

813 PCC073:D0530014-D0530470, paras.169,173,175,table.14; PCC073:20170124_STL-1 l-Ol_T_T326, pp.29-33, lines 20-4, pp.40-46, lines 9-15.

814 PCC073:D0530014-D0530470, paras.237,243,249,275,tables.24,26; PCC021:20160831 _ STL-1 l-O l _ T_ T285, p.97, lines 1-20; PCC02 l :D0455633-D0455715, paras.7.5 .1.1-7 .5 .1.3, 7.5.4.1-7 .5 .4.3, 7.5 .4.7-7 .5.4.8, graphs.O 1,07.

STL-18-1 O/PT /PTJ 118ofl85 15 December 2020 Public Redacted R026622

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

with Hassan NASRALLAH, the Secretary-General of Hezbollah, at a covert Hezbollah location in Haret Hreik.

328. The day before this meeting, Wafik SAFA, head of the Central Unit for Liaison and Coordination in Hezbollah,815 was in contact with BADREDDINE twice,816 consistent with SAFA informing BAD RED DINE about the meeting between HARIRI and NASRALLAH on the following day. On 21 December 2004, two hours before the meeting, BADREDDINE exchanged two calls with AYYASH, the second one lasting over four minutes. At the time of this call AYYASH was using a cell in the vicinity of the location where HARIRI was to meet NASRALLAH. 817 Throughout the meeting A YYASH remained in the same area using one of two adjacent cells. 818

329. Prior to HARIRI's arrival to the meeting, the and Networks converged in the vicinity of the meeting venue, with Subjects 5, 6, 7, 8 and 9 joining AYYASH in the same area. This activity was initiated and coordinated by AYYASH's contact with Subject 6, who in turn contacted the other unidentified participants in an immediate succession of calls. AYYASH, together with these subjects, followed HARIRI back to Quraitem Palace after the meeting. 819

330. This pattern of conduct and organised activity was repeated agam during the surveillance of EL-MURR on 29 June 2005 when he attended a meeting with NASRALLAH in south Beirut. 820

b. Surveillance around Quraitem Palace and route to Fagra

331. Between 23 December 2004 and 1 January 2005, all six members of the future Assassination Team led by AYYASH, using their and network phones,

815 PCC141 :60230953-60231103, 60230962, para.69; 60177667-60177688, 60177667.

816 D0388914-D0389045, rows.2862-2863.

817 PCC073:D0530014-D0530470, paras.243,249; PCC073:20170125_STL-1 l-Ol_T_T327, pp.59-63, lines 21-19.

818 D0381119-D0381123, rows.68-69, D0378920-D0378977, rows.1498-1501.

819 PCC073:20170125_STL-11-0l_T_T327, pp.72-78, lines 7-17, pp.87-101, lines 14-19.

820 PCC073:D0568651-D0568907, paras.1368-1369.

STL-18-1 O/PT /PTJ 119ofl85 15 December 2020 Public Redacted R026623

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

conducted regular static surveillance around Quraitem Palace and Faqra, where HARIRI had his villa, and mobile surveillance of HARIRI along the route in-between. This enabled the perpetrators to gather information about HARIRI's convoy and security measures in place, as well as observe his regular routes and assess suitable locations to execute the attack.

332. The relevant and network phones used cells along this route on six days during this period, namely on 25, 821 26,822 27,823 29,824 30825 and 31 December 2004. 826 The unusual and simultaneous focus of the two network phones along the same route and in a specific area which HARIRI visited in winter when residing at his Faqra Villa827 demonstrates the common purpose of the two networks, which was the surveillance of HARIRI in preparation for his assassination. This sudden and common focus on an area previously unfrequented, mirrors similar patterns in the lead up to all three indicted, connected attacks.

333. After this period of intense and almost daily surveillance of HARIRI, all the unidentified subjects led by AYYASH ceased the surveillance activity on 1 January

821 PCC073:D0530014-D0530470, paras.313-321,table.33,map.25; PCC073:20170126_STL-11-01 _ T_ T328, pp.85-89, lines 25-21, pp.91-98, lines 9-8.

822 PCC073:D0530014-D0530470, paras.327-332 ,tables.34-35,maps.26-27; PCC073:20170127_STL-l1-0l _ T_ T329, pp.8-1Llines20-21, pp.14-16, lines 21-7, pp.21-28. lines 5-3.

823 PCC073 :D0530014-D0530470, paras.33 8,340-345 ,349-3 50,3 55-3 56,3 5 9-3 61,tables.3 6-40,maps.28,30- 31; PCC073:20170127_STL-ll-Ol_T_T329, pp.38-41, lines 6-15, pp.44-51, lines 19-19, pp.58-67, lines 11-1, pp.69-74, lines 9-22, p.80, lines 4-22; PCC02 l:D0368634-D0369059, para.6.9.8.

824 PCC073:D0530014-D0530470, paras.376-377,379-380, table.42,map.34; PCC073:20170127_STL-l1-0l _ T_ T329, pp.100-101, lines 15-21.

825 PCC073:D0530014-D0530470, paras.394-401,tables.45-47,map.37; PCC073:20170206_STL-l 1- 0l_T_T330, pp.61-62, lines 7-12.

826 PCC073:D0530014-D05304 70, paras.406-408,410-427, tables.49-51, maps.39-40; PCC073 :20 l 70206 _ STL-11- 0 l _ T_ T330, pp.98-100, lines 15-17, p.109, lines 11-24; PCC073:20170207 _STL-1 l-01 _ T _ T331, pp.9-11, lines 25- 24; pp.20-25, lines 22-4, pp.27-28, lines 14-24; pp.33-39, lines 7-19, pp.41-49, lines 22-10.

827 PCC087:60295561-60295583, 60295577, para.65A.

STL-18-1 O/PT /PTJ 120ofl85 15 December 2020 Public Redacted R026624

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

2005 when HARIRI left Lebanon in the afternoon, 828 resuming it upon his return on 7 January 2005 829 and lasting only until 8 January 2005. 830

334. From 9 to 26 January 2005, mobile surveillance of HARIRI was entirely suspended and static surveillance was negligible. 831 During this period, after the shutdown of the on 7 January 2005, 832 the expanded from six principal phones to a network of 18 phones. 833 Also, on 7 January 2005, A YYASH stopped using and started using Mobile 170, previously a phone,834 which continued to be used by AYYASH to communicate with BADREDDINE during the coordination of the attacks on HAWI and EL-MURR.

335. Another significant indication of the elevation in preparatory activity for the attack during this period was the purchase of the SIM Cards835 and the handsets. 836 Although the used by the Assassination Team on 14 February 2005 were

828 PCC073:D0530014-D0530470, paras.437-439,441-452, tables.53-55, maps.42-43; PCC073:20170207 _STL-11- 0l _T _ T33 l, pp.70-76. lines 16-21, pp.86-91, lines 4-16; PCC073:20170208_STL-l1-0l _T _ T332, pp.10-11, lines 11- 11, pp.18-19, lines 4-25.

829 PCC02 l :D0368634-D0369059, para.6.9.20; PCC073:D0530014-D0530470, paras.463,478,487,513,531,539- 540,543-564; PCC073:20170208 _STL-1 l-01 _ T_ T332, pp.97-104, lines 13-17, in particular pp.99-100, lines 6-16.

830 PCC021 :D0368634-D0369059, para.6.9.21; PCC073:D0530014-D0530470, paras.574-576,578-582; PCC073:20170209_STL-11-0l_T_T333, pp.33-38, lines 17-22.

831 The exception was the Red Network activity in the area around the Al-Omari mosque on 20 January 2005 during early morning prayers which was aborted after 40 minutes. See PCC073:20170209_ STL-11- 0 l _ T _ T333, p.38, lines 2-22; PCC073:2017022l_STL-1 l-Ol_T_T338, pp.14-15, lines 7-9; PCC02 l:D0368634-D0369059, para.6.9.40; PCC073 :D0530014-D0530470, paras.771-777.

832 PCC073:20160406_STL-1 l-Ol_T_T252, p.34, lines 11-20, p.36, lines 4-10; PCC073:D0540969- D0541193, para.1126. See IV(A)(3)(a).

833 PCC073:20160414_STL-1 l-Ol_T_T253, p.89-90, lines 9-21. See IV(A)(3)(b).

834 D0049247-D0049299; PCC073:20170208_STL-1 l-Ol_T_T332, pp.93-97, lines 12-12.

835 PCC073:D0540969-D0541193, para.509; PCC073:20160415_STL-1 l-Ol_T_T254, pp.56-58, lines 12- 1, p.67, lines 6-25; PCC02l:D0457446-D0457616, para.6.1.2.1. See IV(B)(l)(c).

836 PCC073:20160415 _STL-11-0l_T_T254, p.56, lines 20-24; PCC073:20160726_STL-l 1-0l_T_T282, pp.53-54, lines 19-6; PCC02 l :D0457446-D0457616, para.6.1.2.1. See Section IV(B)(l )( c).

STL-18-1 O/PT /PTJ 121of185 15 December 2020 Public Redacted R026625

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

purchased and already set up for use, 837 they started being used regularly only from 28 January 2005,838 leaving a deliberate and anonymous forensic trail of their surveillance of HARIRI in the last weeks preceding the attack.

(iii) The purchase of the vehicle used as the VB/ED

a. The Mitsubishi Canter was sold in Tripoli on 25 January 2005

336. The Mitsubishi Canter - later used as the VBIED - was imported into Lebanon by [Redacted],839 and placed for sale in the showroom of his business partner [Redacted] in [Redacted] near Tripoli. 840 The sale receipt although undated, 841 appeared in the receipt book between two dated receipts from 17 January and 26 January 2005. 842 On the day of the sale, [Redacted] called [Redacted] twice within around 5-10 minutes to discuss the price of the Mitsubishi Canter. 843 The possible dates of sale are thus 17 January 2005 (calls at 13:07 and 13: 12) and 25 January 2005 (calls at 15:24 and 15:36).844 From the evidence it can be inferred that the most likely date of the sale was 25 January 2005. 845

837 PCC02 l :D034617 l-D0346243, para.6.3.2; PCC021 :D0368634-D0369059, paras.6.9.17, in particular 6.9.17.8; PCC02l:D0457446-D0457616, paras.6.1.2.2, 6.1.4.1; PCC021:20160906_STL-ll-Ol_T_T289, pp.19-23, lines 13-8; PCC073:20160726 _STL-1 l-01 _ T_ T282, pp. 54-57, lines 9-7. See IV(A)(3)(d) and IV(B)(l )(c).

838 The Red Network phones were used on 14 January 2005 as a settling in day and as a testing day 20 January 2005, when the Red Network appear to have travelled to the Grand Al-Omari Mosque where HARIRI used to go on Eid, but HARIRI decided to change the mosque he attended on 20 January 2005. PCC021 :D0457446-D0457616, graph.01, para.5.3.1.3; PCC021 :2016083 l_STL-l l-Ol_T_T285, pp.117- 118, lines 22-18.

839 60014199-60014199; PCC236:20150615 _STL-l l-Ol_T_Tl61, pp.19,33-35.

840 PCC077:20150604_STL-l l-01 _ T_ T158, pp.68,75-77,80-81; PCC077:60032697-60032703, para.18.

841 60136496-60136497; PCC077:20150604_ STL-l l-Ol _ T_ Tl58, pp.86,92.97-98; PCC236:20150615 _ STL-l l­ Ol _ T_ T161, pp.51.

842 L0012446-L0012493, L0012487-91.

843 PCC236:20150615 _STL-l l-Ol_T_Tl61,pp.40-41,66; PCC077:20150604_STL-l l-Ol_T_Tl58, pp.83-85.

844 PCC236:20150615_STL-l l-Ol_T_Tl61, pp.65-67; D0568964-D0568964; D0568965-D0568965.

845 PCC236:20150615_STL-l l-Ol_T_Tl61, pp.45-46, 55, 65-67, 73-74,76, lines 7-13;

PCC236:20150616_STL-ll-Ol_T_Tl62, pp.108-109, lines 13-17; PCC077:20150605_STL-ll-

STL-18-1 O/PT /PTJ 122ofl85 15 December 2020 Public Redacted R026626

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

b. Network activity in Tripoli surrounding the sale of the Mitsubishi Canter

337. On 11 January 2005, AYYASH using his contacted BADREDDINE on at 14:30 and 14:55, activating cell towers in the general area of the showroom from where the Mitsubishi Canter was sold. 846 In the two weeks before the sale, Subject 8 was also active in Tripoli, using cells some of which are in the direct vicinity of the showroom, and communicating with Subject 6 on four separate dates: 12 January 2005; 847 14 January 2005; 848 15 January 2005; 849 and 22 January 2005. 850

338. At 15:37 on 25 January 2005, only one minute after the call between [Redacted] and [Redacted] that confirmed the sale of the Van,851 Subject 6 used connecting to a cell in the immediate vicinity of the showroom from which the Mitsubishi Canter was purchased. 852 That call was made to A YYASH on his .853 This was one of four calls Subject 6 had with AYYASH whilst in Tripoli that afternoon. 854 Approximately ten minutes after their penultimate call, at 15: 10, A YYASH called

BADREDDINE using the 855

Ol_T_T159, pp.9-10; PCC077:20150610_STL-1 l-Ol_T_Tl60, pp.69, lines 8-22, 72-73, lines 22-11; PCC238:20150617_STL-11-0l_T_Tl63, pp.99-100, lines 25-13; D0004918-D0004918.

846 PCC073:D0530014-D0530470, paras.595-596; D0417182-D0417613, D0417514,rows.9973-9974.

847 PCC073 :D0530014-D0530470, paras.600,603-604; D0549687-D054973 l, D0549691,rows.121-123.

848 PCC073 :D0530014-D0530470, para.629; D0549687-D0549731, D0549691,rows.130-133.

849 PCC073 :D05300 l 4-D05304 70. paras.636-637,652-653 .658,660; D0549687-D054973 l, D0549691,rows.134-l 40.

850 PCC073 :D05300 l 4-D0530470, para.730; D0549687-D0549731, D0549692,rows. l 46-l 47.

851 PCC236:20150615_ STL-ll-Ol _ T _ Tl61, pp.40-41; D0568965-D0568965.

852 PCC073:2017022 l _STL-1 l-01 _ T _ T338, pp.93-94, lines 11-10; D0551564-D0551626, D0551574,row.292; PCC073:D0530014-D05304 70, para.759,table.94.

853 PCC073:20 l 70221 _ STL-l l-Ol _ T _ T338, pp.93-94, lines 11-10; D0551564-D0551626, D0551574,row.292; PCC073:D0530014-D05304 70, para.759,table.94.

854 PCC073 :D05300 l 4-D05304 70. paras. 745, 755-757. 759; D055 l 564-D055 l 626. D0551574, rows.288-289.291-292.

855 PCC073:D0530014-D0530470, paras.746,758; D0417182-D0417613, D0417527, row.10369.

STL-18-1 O/PT /PTJ 123ofl85 15 December 2020 Public Redacted R026627

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

339. 11 January 2005 was the only date that AYYASH activated cell towers in the Tripoli area during the period for which records of AYYASH's multiple phones are available, a period of over three and a half years. 856

(iv) Surveillance from 27 January to 7 February 2005

340. From 27 January 2005 the Assassination Team of six led by AYYASH resumed their nearly daily surveillance of HARIRI's movements and locations associated with him. This surveillance occurred almost every day up to the eve of the assassination on 14 February 2005. For this purpose they used their phones and from this moment, significantly, they also started using their phones for regular and frequent surveillance.

341. The began its regular and frequent activity on 28 January 2005, 857 which intensified incrementally up to its peak only minutes before HARIRI' s assassination. The principal purpose of the regular and frequent use of the phones in the 18 days leading up to the attack was to conduct surveillance whilst leaving an obvious forensic trail to the attack associated with HARIRI's surveillance858 and mitigate the risk of the other covert networks being suspected, searched for, and discovered. 859

342. From 28 January 2005, the hierarchical call flows, which had occurred up to the moment of the purchase of the VBIED, and the hierarchical call flows, which had occmTed shortly before the attack on HAMADE, transformed into regular hierarchical call flows, 860 with the main focus of the surveillance

856 D0417182-D0417613, D0417514, rows.9973-9974; PCC073:20170209_STL-1 l-Ol_T_T333, pp.76-77; see also PCC073:D0530014-D0530470, para.598.

857 PCC021 :D0346171-D0346243, para.6.3.5.1-6.3.5.15; PCC021 :2016083l_STL-l1-0l_T_T285, p.118, lines 5-18.

858 PCC021:D0457446-D0457616, para.6.1.5.3; PCC021:20160905_STL-1 l-Ol_T_T288, pp.81-82, lines 20- 12.

859 PCC02l:20160905_STL-11-01 _ T _ T288, pp. 77-82, lines 2-12; PCC073:20170224_STL-11-01 _ T _ T341, pp.59-60, lines 8-13; PCC073 :D0568996-D0569028, para.18.

860 PCC021:20160906_STL-11-0l_T_T289, pp.27-43, lines 1-25; PCC073:20170222_STL-l l-Ol_T_T339, pp.57-58, lines 16-5, pp.63-64, lines 19-8.

STL-18-1 O/PT /PTJ 124ofl85 15 December 2020 Public Redacted R026628

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

activity coordinated by AYYASH and monitored by BADREDDINE on final, mostly mobile, surveillance of HARIRI, his security convoy, and also on the potential crime scene(s ). This pattern of monitoring behaviour, illustrated by sequential calls between BADREDDINE and AYYASH and, in turn, AYYASH and the Assassination Team, was repeated throughout the four attacks. Whilst the content of these calls is not available, the recurrence of these patterns cannot sensibly be explained other than as BADREDDINE overseeing all four attacks, through AYYASH.

343. Between 27 January and 7 February 2005, the and phones held by the six members of the Assassination Team used cells around Quraitem Palace on every one of the nine days that HARIRI was at his residence. 861 Moreover, on seven days they conducted mobile surveillance of HARIRI, moving in tandem with HARIRI and his security convoy. Specifically, the Assassination Team used cells in concert with HARIRI's security detail indicative of surveilling HARIRI's travel and/or his visits

861 PCC073:D05300I4-D0530470, paras.767,774-777, table.97; D0380523-D0380905, D0380876-78, entries 17183-17257 (27 January 2005); PCC073 :D05300 l 4-D05304 70, paras. 778-779, 784-786, table.98, map.72; PCC073:20170222_STL-l l-Ol_T_T339, pp.52-53, lines 3-14; D0380523-D0380905, D0380878-80, entries 17258-17367 (28 January 2005); PCC073:D0530014-D0530470, paras.792- 793,796-799,802-806,812,817-821,825-826, tables.99, 101, map. 75; D0380523-D0380905, D0380880-8 l, entries l 7368-l 74I4 (29 January 2005); PCC073:D05300I4-D0530470, paras.828-829, 831, 833-837, 840, tables.I02-103, maps.76-77; D0380523-D0380905, D0380881-82, entries 17415-17466 (30 January 2005); PCC073:D0530014-D0530470, paras.841-843, 846, 852-853, 861,864-868, 871, tables.104,106-I08, map.80; D0380523-D0380905, D0380882-84, entries 17467-I7554 (3I January 2005); PCC073 :D05300 I 4-D0530470, paras.872-873,875-878,880,883, table. I 09, map.8 I; D0380523- D0380905, D0350884-87, entries 17555-17686 (1February2005); PCC073:D0530014-D0530470, paras.884-885,890-895, table. I 11, map.82 (2 February 2005); PCC073:D0530014-D0530470, paras.900,902,907,911,913-914,919,921,923, tables.115,117,119, maps.85-86; D0380523-D0380905, D0380888-90, entries 17761-17842 (3 February 2005); PCC073:D0530014-D0530470, paras.924- 925,929-93I,935-937,939,941-944, tables. I20-12I,123, maps.87-89; D0380523-D0380905, D0380890- 9 I, entries I 7843-I 7908(4 Februaiy 2005); PCC073:D0530014-D0530470, paras.952-953, 959, 96I, 967, 972-975, 978-982, tables.125, 127-I29, maps.90-93; D0380523-D0380905, D0380892, entries l 79 I 4- 17951 (7 February 2005).

STL- I 8-1 O/PT /PTJ I25ofI85 15 December 2020 Public Redacted R026629

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

to/from: Parliament on 27 January 2005; 862 HAMADE's residence on 29-30 January863 and 4 February 2005;864 the Airport on 4865 and 7 February 2005; 866 Naameh Villa on 29 January 2005; 867 Sheikh QABALAN at the Higher Shiite Council on 31 January 2005; 868 and Deputy Prime Minister Issam FARES's yacht moored in St. Georges's Marina on 3 February 2005. 869

344. Significantly, during this period, three days were permeated by three hierarchical call flows out of seven that occurred up to the attack, as BADREDDINE continued to monitor and coordinate the preparations for the attack through A YYASH, who was leading the Assassination Team. During all three days, the perpetrators used cells in the area of the crime scene (on 31 January and 3 February 2005) and near the Zouk Mosbeh turn-off to Faraya (on 28 January 2005). 870 Both locations were places through which HARIRI's convoy was known or expected to pass while travelling between Quraitem Palace and the Parliament/Faqra.871 In addition, both locations were

862 PCC073:D0530014-D0530470, paras.767-768,771-774; PCC073:20170222_STL-1 l-Ol_T_T339, pp.14- 15, lines 22-4, pp.19-20, lines 20-11, pp.28-29, lines 3-21.

863 PCC073 :20170222_ STL-1 l-Ol _ T _ T339, pp.83-90, lines 19-1 O; PCC073:20170223 _ STL-l l-Ol _ T _ T340, pp.7-12, lines 6-4.

864 PCC073:20170306_STL-1 l-Ol_T_T342, pp.4-13, lines 23-5.

865 PCC073:20170306_STL-ll-Ol_T_T342, pp.21-24, lines 5-16, p.28, lines 2-13; PCC073:D0530014-D0530470, paras.937-941.

866 PCC073:20170307_ STL-ll-Ol _ T_T343, pp.6-10, lines 11-9, pp.13-16, lines 2-22; PCC073:D0530014- D0530470, paras.953,959,961,968-971,975.

867 PCC073:20170222_STL-ll-Ol_T_T339, pp.90-93, lines 11-5, 94-97, lines 24-22; PCC073:D0530014-D0530470, paras.823-825.

868 PCC073 :D05300 l 4-D05304 70, paras.842,849-854,858-861,864,866.

869 PCC073 :D05300 l 4-D05304 70, paras. 900-901,904-906,908-922.

870 PCC073:D0530014-D0530470, paras.780,782,788,table.98; PCC073:20170222 _STL-1 l-01 _ T_ T339, pp.66-71, lines 16-21 (28 January 2005); PCC073 :D0530014-D05304 70, paras.842,845,853,856-857,861-867, tables. I 06-107; PCC073:20170223 _ STL-1 l-01 _ T_ T340, pp.90-93, lines 1-10 (31January2005); PCC073:D0530014-D0530470, paras.901-902,906,912-913,918-922,tables.115,117,119 (3 February 2005).

871 PCC073:20170222 _ STL-11-0l _ T_ T339, pp.69-70, lines 25-16, p.72, lines 14-22; PCC073:20170223 _ STL-11- 0l _ T_ T340, pp.84-85, lines 2-17; PCC073:20170224_STL-1 l-01 _ T_ T341, p.8, lines 22-25, pp.81-82, lines 21-6.

STL-18-1 O/PT /PTJ 126ofl85 15 December 2020 Public Redacted R026630

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

part of routes which limited the speed of road traffic and thereby tended to be potential sites to detonate a suicide bomb on a moving target. 872

(v) Surveillance from 8 February to 13 February 2005

345. This was the final week of surveillance conducted by AYYASH and other members of the Assassination Team under his coordination. The users conducted static and mobile surveillance on five of these six days including, significantly, on 8 February 2005, an apparent rehearsal of many of their movements repeated on the actual day of the attack, during HARIRI's visit to Parliament.

346. On 8 February 2005, HARIRI attended a parliamentary session during which it was announced that the next session would be held on 14 February 2005 at 11:00. 873 On this day, all three covert networks, namely and Networks, were active. The behaviour of the and phones in particular was very similar to their activity on the day of the attack, with a high intensity of calls among the users, conducting surveillance of HARIRI's convoy travel from Quraitem Palace to Parliament and back, and switching from to phones as two members of the Assassination Team simulated the movement of the VBIED from Dahyieh towards the crime scene. 874 Moreover, as this was a key day in their preparations, AYYASH followed the convoy back to Quraitem Palace, where upon alTival he immediately

updated BADREDDINE using the . 875 This was an important opportunity for the perpetrators to practice the coordination of the attack, as it was the last time HARIRI attended Parliament before 14 February 2005.

347. From 9 to 12 February 2005, surveillance continued on all four days as final preparations for the attack were conducted. The first three days the perpetrators

872 PCC073:20170224_STL-ll-Ol_T_T341, pp.78-79, lines 14-23.

873 10012110-10012113, 10012111-13; PCC073:D0530014-D0530470, para.984.

874 PCC073 :D0530014-D0530470, paras.985,988-1000, 1003-1004, 1006-1007, 1009-1012, 1014-1019; PCC073 :20170307 _ STL-l l-Ol _ T _ T343, pp.61-66, lines 6-21, pp.68-69, lines 13-5, pp. 70-75, lines 19-14, pp.79-96, lines 1-8, pp.100-109, lines 3-8.

875 PCC073:D0530014-D0530470, para.1005,table.136; PCC073:20170307_STL-l l-Ol_T_T343, pp.109- 110, lines 2-5.

STL-18-1 O/PT /PTJ 127ofl85 15 December 2020 Public Redacted R026631

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

conducted static surveillance around Quraitem Palace. 876 During the operation, AYYASH was regularly updating BADREDDINE using the , as part of the typical I pattern. 877

348. On 12 February, AYYASH coordinated mobile surveillance ofHARIRI's visit to Sacre Coeur Church and the Mar Michael Church for two funerals, 878 which was closely monitored in sequential call flows by BADREDDINE using the . On this day, the were operational for over eight and a half hours, from 10:08 to 18:48, conducting surveillance of HARIRI and relevant locations in the Faraya and Zouk Mosbeh areas,879 with AYYASH regularly updating BADREDDINE as part of the I hierarchical call flow. 880 This was the last day of surveillance and call activity until the attack, and one of the busiest days of activity between AYYASH and BADREDDINE.

349. In the late evening of 13 February 2005, BADREDDINE made a penultimate call to AYYASH,881 immediately after being in contact twice with SAFA. 882

350. This penultimate call led to unusual activity through the early hours of 14 February 2005 between AYYASH and Subject 6, and in turn others within

876 PCC073:20170308_STL-l l-Ol_T_T344, pp.30-52, lines 24-1, in paiiicular pp.30-31, lines 24-5, p.39, lines 10-20, pp.42-43, lines 25-6, pp.47-49, lines 2-5(9 February 2005); PCC073:20170308_STL-l l­ Ol_T_T344, pp.61-64, lines 20-19(10 February 2005); PCC073:20170308_STL-l l-Ol_T_T344, pp.89- 92, lines 10-17; PCC073:20170309_STL-ll-Ol_T_T345, pp.5-10, lines 1-5(11Februaiy2005).

877 PCC073:20 l 70308 _ STL-l l-Ol _T _ T344, pp.35-36, lines 11-5; PCC073:20170308 _ STL-l l-Ol _ T_ T344, pp.93-94, lines 8-11; PCC073:20170309 _STL-l l-01 _ T_ T345, pp.5-7, lines 9-4.

878 PCC145 :20150312 _ STL-l l-Ol _ T _ Tl26, pp. l 09-111, lines 11-25; 60142062-60142516, 60142137- 60142180, 60142173; PCC149:20150428_STL-ll-Ol_T_Tl42, pp.54-55, lines 18-9; PCC073:20170309 _STL-ll-Ol_T_T345, pp.18-23, lines 23-9.

879 PCC073:20170309 _STL-ll-Ol_T_T345, pp.15-67, lines 10-3; PCC073:D0530014-D0530470, paras.1081-1082,1086,1088,1093,1095-1099,1101-1103,1105-1112,1114-1118.

880 PCC073 :20170309_ STL-l l-Ol _ T _ T345, p.35, lines 1-18, pp.52-54, lines 17-4, pp.59-60, lines 15-13.

881 PCC073:D0530014-D0530470, para.1131,table.156; PCC073:20170309 _STL-l l-Ol_T_T345, pp.98-100, lines 8-8, in particular p.99, lines 19-21.

882 PCC073:D0530014-D0530470,para.1130,table.156; PCC073:20170309_STL-l l-Ol_T_T345, p.100, lines 9-18.

STL-18-1 O/PT /PTJ 128ofl85 15 December 2020 Public Redacted para.1146.

887 10012110-10012113, 10012113T; PCC073:D0530014-D0530470, paras.1147-1148.

888 10012110-10012113, 10012113T; D0004248-D0004320, D0004288-90.

889 PCC073:D0530014-D0530470, para.1156,table.161,maps.118-119; PCC073:20170313 _STL-1 l-01 _ T_ T346, pp.43-44, lines 15-13.

890 D000345 l-D0003855, D0003477-84; PCC073:D0530014-D0530470, paras.1148,1152-1153; PCC073:20170313_STL-11-01 _ T _ T346, p.42, lines 1-13.

STL-18-1 O/PT /PTJ 129ofl85 15 December 2020 Public Redacted R026633

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

devices, HARIRI's armoured Mercedes (the third vehicle in the convoy), and an ambulance at the end. 891

353. At 11:33, while HARIRI was still in Parliament, AYYASH was in the vicinity of

Parliament and called Subject 6 using the , 892 consistent with updating Subject 6 of his arrival to the Parliament area and giving new instructions. After this call AYYASH proceeded directly to the crime scene area, while Subjects 6, 8 and 9 travelled to the vicinity of Place de l'Etoile, where HARIRI was expected to arrive after the parliamentary session. 893 This organised activity demonstrates AYYASH's coordination role, who was making sure that the members of the Assassination Team would be well placed to update him on HARIRI's movements after he exited Parliament.

354. AYYASH, using the , also called Subject 5 twice, at 11:35 and 11:47, from the Parliament area and on route to the crime scene area. After the first call with AYYASH, Subject 5 immediately contacted Subject 7 using the and by the time of the second call with AYYASH, Subject 5 was in the Ras Nabah area ready

to switch to his . 894 These were the last calls prior to the explosion. 895 Three minutes later, at 11 :50, Subject 5 and Subject 7 turned on their and

891 PCC228:20140924_STL-1 l-Ol_T_T76, pp.68-69, lines 8-16, pp.71-72, lines 14-22; PCC228:60036751- 6003 7100, 60037040-41,paras.1-6; PCC225 :D0345687-D0345835, D0345832.

892 PCC073:D0530014-D0530470, para.1161,table.163; PCC073:20170313 _STL-l l-Ol_T_T346, pp.49-51, lines 6-3; D0003451-D0003855, D0003545; PCCl 16:60282577-60282585, 60282579-80.

893 PCC073:D0530014-D0530470, paras.1161, 1163-1164, 1166-l 167,tables.163,165-166; PCC073:20170313 _STL-11-0l_T_T346, pp.49-51, lines 6-3, pp.56-57, lines 20-12.

894 PCC073:D0530014-D0530470, para.1162, table.164, map.124; PCC073:20170313_STL-1 l-Ol_T_T346, pp.59-60, lines 8-11.

895 PCC02l:D0457446-D0457616, para.5.4.7;PCC021:20160902_STL-l l-Ol_T_T287, pp.62-65, lines 3-24; PCC073 :D0530014-D0530470, para.1163; PCC073:20 l 70313 _ STL-ll-Ol _ T_ T346, pp.61-62, lines 10- 12.

STL-18-1 O/PT /PTJ 130ofl85 15 December 2020 Public Redacted R026634

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

contacted each other using the same cells as shortly before on their in the Ras N abah area. 896

355. Between 11 :49 and 11:53, Subject 9 and Subject 6, who were in the Parliament area, exchanged two calls with A YYASH, consistent with informing A YYASH that HARIRI was still in Parliament. 897 HARIRI exited Parliament at 11 :54 and went to Cafe Place de l'Etoile.898 Approximately three minutes later (11:56:57 real time), the Mitsubishi Canter Van was recorded on closed-circuit television (CCTV) cameras travelling through the President Suleiman Frangieh Tunnel, which is close to the crime scene. 899 The movement of the Van through the tunnel corresponded to a call from Subject 5, using a cell in the vicinity of the same tunnel, to AYYASH at 11:57:01, consistent with AYYASH directing the movements of Subject 5 who was escorting the VBIED to the crime scene. By the end of the call, Subject 5 was using the same cell (PHENMB 1) as A YYASH, placing them within metres of the crime scene. 900

356. Immediately after his contact with Subject 5, AYYASH contacted BADREDDINE at 11 :58, using the , to update him that the suicide VBIED had mTived in the immediate vicinity of the crime scene prior to HARIRI's expected arrival. 901 This hierarchical call flow is the last hierarchical call flow, between the

896 PCC021 :20160902_STL-1 l-Ol_T_T287, p.64, lines 2-6; PCC073:D0530014-D0530470, paras.1163- 1164,table.165; PCC073:20170313_STL-11-0l_T_T346, p.90, lines 7-23.

897 PCC073 :D05300 l 4-D0530470, table.165; PCC073:20170313 _ STL-11-0 l _ T_ T346, pp.64-65, lines 1-19.

898 PCC073 :D05300 l 4-D0530470, paras.1165,1168; PCC073 :20170313 _ STL-11-0l _ T _ T346, p.49, lines 15- 21, p.91, lines 1-14, p.92, lines 17-25; PCC116:60282577-60282585, 60282579-81.

899 PCC073:D0530014-D0530470, paras.1171-1172,maps.133-134; PCC218:60276079-60276126, paras.140,146,163-165; D0350281-D0350281, Camera 6 at CCTV footage time 11:55:00-11:55:15.

900 PCC073:20170313_STL-ll-Ol_T_T346, pp.93-95, lines 4-17; PCC073:20170314_STL-ll-Ol_T_T347, pp.6-7, lines 5-20.

901 PCC021:20160902_STL-ll-Ol_T_T287, p.68, lines 2-12, p.69, lines 14-19; PCC073:D0530014-D0530470, para.1173,table.168; PCC073:20170314_STL-1 l-Ol _ T_ T347, pp.7-8, lines 9-10, pp.20-22, lines 5-24.

STL-18-1 O/PT /PTJ 131of185 15 December 2020 Public Redacted R026635

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

and Networks as this was the last ever call, indicating that the attack and completion of the mission was imminent. 902

357. Between 12:00 and 12:49 when HARIRI was at Cafe Place de l'Etoile,903 Subjects 6, 8 and 9 conducted surveillance of this location, where they were joined by Subject 5 at around 12: 12, Subject 5 having moved away from the crime scene area. AYYASH, who remained in the vicinity of the crime scene, kept in contact with them. 904

358. After his last call to BADREDDINE at 11:58, AYYASH was twice in contact with Subject 7, both of them using a cell (ZOUKAKl) providing predicted Cell Coverage to the east of the President Suleiman Frangieh Tunnel,905 where the Van pulled off when exiting the tunnel and by necessary inference must have been awaiting the final signal to move to the crime scene. 906 At 12:09, 12: 16 and 12:43, AYYASH had three further calls using the same cell, all of them with Subject 8 who was monitoring HARIRI and his convoy, and who was ready to give a signal the moment he left the cafe. 907

359. Once HARIRI's convoy started making final preparations to leave, Subject 8, in a 5 seconds call at 12:50, gave the signal to Subject 7, who was monitoring the VBIED,

902 PCC021:20160902_STL-ll-Ol_T_T287, pp.69-70, lines 14-4, pp.73-76, lines 7-13; PCC021:20160906_STL-ll­ Ol_T_T289, p.43, lines 16-25; PCC02 l:D0457446-D0457616, paras.5.8.1.46,5.8.1.48.

903 PCC073:D0530014-D0530470, paras.1168,1181-1182; PCC073:20170314_STL-1 l-Ol_T_T347, p.47, lines 13-21; PCCl 16:60282577-60282585, 60282579-81.

904 PCC073:D0530014-D0530470, paras.1175,1178,1180,tables.169-l 71; PCC073:20170314_STL-l l­ Ol_T_T347, pp.40-43, lines 25-9, pp.46-47, lines 1-12.

905 PCC073:D0530014-D0530470, paras.1175,1268,table.169.

906 PCC073:20170314_STL-ll-Ol_T_T347, pp.14-15, lines 6-6; D0350281-D0350281, Camera 6 at CCTV footage

time 11:55:00-11:55: 15; PCC218:60276079-60276126, paras.148,150; PCC218:20140122 _STL-1 l-01 _ T _ T32,

pp.62-63, lines 19-1, p.64, lines 20-22.

907 PCC073:D0530014-D0530470, paras.1175,1180,tables.169,l 7 l; PCC073:201703 l 4_ STL-l l-Ol _ T_ T347, pp.40- 42, lines 25-7, p.43, lines 4-9, pp.45-46, lines 19-20, p.47, lines 4-12.

STL-18-1 O/PT /PTJ 132ofl85 15 December 2020 Public Redacted PCC073:D0530014-D0530470, paras.1181-1182,1185; PCC073:20170314_STL-l l-Ol_T_T347, p.47, lines 13-21.

911 PCC073:D0530014-D0530470, paras.1183,1187-1190,table.172; PCC073:20170314_STL-1 l-01 _ T_ T347, pp.48- 49, lines 5-12, pp.56-59 lines 14-8; PCC021 :20160906 _ STL-l l-Ol _ T_ T289, pp.86-87, lines 5-5; PCC02 l :D0457446-D0457616, para.6.11.4,maps.27 A-32A,table.30A.

912 PCC217:50002768-50002793, 50002773,50002782.

913 F1492, Disposition, Agreed Fact (i); F3839, paras. I 006, 1416, 1448, 1452-1453.

STL-18-1 O/PT /PTJ 133ofl85 15 December 2020 Public Redacted D0254650; F3839, paras.1250, 1448.

920 PCC234:20150226_STL-1 l-Ol_T_T121, p.98, lines 1-8; PCC234,PCC233:D0254550-D0254650, D0254650; F3839, paras.1250, 1448.

921 PCC225:20140828 _ STL-11-0l _ T_ T66, pp.90-91, lines 23-1; PCC225:D0345687-D0345835, D0345754,para.4.7, D0345759,para.4.7.1, D0345775,para.5.2; PCC224:50011349-50011370. 50011367-68; PCC223:20140716 _ STL-11- 0l _ T_ T60, pp.54-68,71-74,76-89; PCC223:201407 l 7_ STL-l l-Ol _ T_ T6L pp.8-63; 60220294-60220299; D0567693- D0567698; F3839, paras.1308-1316,1448.

STL-18-1 O/PT /PTJ 134ofl85 15 December 2020 Public Redacted R026638

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

phones,926 left an unavoidably clear forensic impression of their direct involvement in the attack. 927

365. and phones were never used again after the explosion. 928 The members of the Assassination Team were only involved in five inter- calls for the rest of the day after the explosion. This substantial decrease in call activity and the subsequent, near absolute absence of such in west and central Beirut, thereafter in February,929 illustrates the unequivocal connection, as for the other attacks, between the core users of the covert networks and the attack itself. The mission having been fulfilled, the focus and the purpose of the calls in that area dissipated and moved back to their base area in south Beirut.

922 CS-0010292; PCC226:2014091 l_STL-1 l-Ol_T_T74, pp.27-28; PCC225:D0345687-D0345835, D0345800; 60014199-60014199. See VI.B.2.(a)(iii).

923 PCC225 :D0345687-D0345835, D0345769,para.4.10.1, D0345775-76,para.5.4; PCC228:60036751- 60037100, 60037033-34; F3839, paras.1371-1375, 1448.

924 PCC225:D0345687-D0345835, D0345832-35; PCC230:201351-201355, 201351-52; F3839, para.1356.

925 PCC021 :D0457446-D0457616, paras.5.2.5.3, 5.2.19.8,5.2.19.11,5.8.1.45,6. l l,maps.28A-32A; PCC021 :20160902_STL-1 l-Ol_T_T287, pp.56-57, lines 20-11; PCC021 :20160905_STL-11- 0l_T_T288, pp.83-89, lines 11-11, 91-92, lines 12-12; PCC073:D0530014-D0530470, paras.1183- 1184,1187-1190,1192,table.172; PCC073:201703 l 4_STL-1 l-Ol _ T _ T347, pp.48-49, lines 5-12, pp.57-59, lines 22-8.

926 PCC02 l:D0457446-D0457616, paras.5.2.5.3-5.2.5.4, 5.2.19.8, 5.2.19.11, 5.7.1.5; PCC073:D0530014-D0530470, paras.1183-1184,1187-1190,1192,table.172; PCC073:20170314_STL-ll-Ol_T_T347, pp.48-49, lines 5-12, pp.57- 59.lines 22-8.

927 PCC021:20160905_STL-ll-Ol_T_T288, pp.77-78. lines 2-20, pp.81-82, lines 9-12; PCC02l:D0457446-D0457616, para.6.1.5.3.

928 PCC02 l :D0457446-D0457616, paras.5.2.5,5.2.11,6.10.2.1; PCC073:D0530014-D0530470, para.1190,table. l 72; PCC073:20170314_STL-1 l-01 _ T_ T347, pp.62-63, lines 16-23, pp.65-66, lines 17-4; PCC073:D0568996-D0569028, para.16.

929 PCC073:D0530014-D0530470, paras.1195-1198,1200-1201; PCC073:20170314_STL-l 1-0l_T_T347, p.66, lines 6-14, pp.67-68, lines 9-3; PCC073:D0568996-D0569028, paras.19,40-41.

STL-18-1 O/PT /PTJ 135ofl85 15 December 2020 Public Redacted R026639

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

C. The HA WI Attack

1. Overview

366. On 21 June 2005, at around 09:48 on Habib Abi Chahla Street in Beirut, HAWI was assassinated when an IED attached to the underside of his Mercedes S420L was detonated as his vehicle drove past the Zouhairi petrol station, heading to the Gondole Cafe on Corniche-El-Mazraa, where he used to hold various meetings and professional appointments. The explosion killed HAWI and injured his [Redacted], [Redacted], and [Redacted], an employee at the Zouhairi petrol station.

367. At the time of the attack, HAWI was a long-term opponent of the Syrian presence in Lebanon and was opposed to the extension of the mandate of President Emile LAHOUD. 93 ° Following HARIRI's assassination, HAWI's public criticism of the Syrian presence intensified. 931 He sought widespread support of all parties for his political project,932 striving to unify the Lebanese against Syrian influence in Lebanon. 933 HAWI repeatedly called for LAHOUD's resignation. 934 He was also active in the Bristol Group935 and in the Independence Intifada Movement.936 Throughout May and June 2005, HAWI actively supported and campaigned for the opposition ahead of the Parliamentary Elections. 937

368. AYYASH, BADREDDINE and other unidentified participants used mobile phones (Mobile) and Network mobile phones with covert characteristics to facilitate the planning, preparation and perpetration of the attack on HAWI. Specifically, AYYASH used his Mobile 170 to communicate and regularly update BADREDDINE on Mobile

930 See ll(C)(3) and ll(D)(3).

931 See ll(C)(3).

932 See ll(C)(3).

933 See II(C)(3).

934 See ll(C)(3) and ll(D)(3).

935 See ll(C)(3).

936 See ll(C)(3) and ll(D)(l2).

937 See II(C)(3) and II(D)(14).

STL-18-1 O/PT /PTJ 136ofl85 15 December 2020 Public Redacted 941 PCC062:6033l133-60331235, 60331198, para.I I; PCC071:60332327-60332380, 60332360, para.7; PCC073 :D056865 l-D0568907, paras.451-453.

942 PCC199:60328670-60328719, 60328698; PCC071 :60332327-60332380, 60332334,6033234 7,para.34; PCC062:60331133-60331235, 60331184,para.32; PCC073:D0568651-D0568907, paras.447-448.

943 PCC071 :60332327-60332380, 60332347,para.38.

944 PCC062:6033l133-60331235, 60331140, 60331184-85,paras.30,33-34; PCC071 :60332327-60332380, 60332335-36, 60332347,para.32, 60332360,para.7.

STL-18-1 O/PT /PTJ 137ofl85 15 December 2020 Public Redacted !'CCU/ .J :lJU)b~b) 1-lJU'.:lb~YU/, para.4bU.

949 PCC073 :D0568651-D0568907, paras.950-958,975,981, 1408-1410, 1422, 1425.

950 PCC021 :D0528351-D0528940, para.7.1.1.6; PCC073:D0568651-D0568907, paras.942,1417; PCC073 :D0568996-D0569028, paras.21 ,33.

951 PCC02l:D0528351-D0528940, paras.7.1.2.4, 8.3.20.6, graphs07/03, 07/04; PCC073:D0568651- D0568907, paras.861-899,942.

952 PCC073 :D0568651-D0568907, paras.942,971-973, 1417.

STL-18-1 O/PT /PTJ 138ofl85 15 December 2020 Public Redacted R026642

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

demonstrates that, between 2 and 20 June 2005, AYYASH, Subject 5, Subject 6, Subject 8, Subject 9, Subject 12, Subject 18, and Subject 19, conducted the surveillance of HAWI and his residence, Gondole cafe, and crime scene, with A YYASH coordinating the operation and regularly consulting and updating BADREDDINE on the progress of the operation.

(i) Phone activity and Surveillance between 1 May and 1June2005

373. In May 2005, AYYASH and BADREDDINE were in contact only twelve times on four days between 1 and 11 May, followed by an absence of calls until 22 May. 953 Their contact resumed from 22 May 2005,954 resulting in 36 contacts from 22 May until the morning of the attack on 21 June 2005. 955 Significantly, their contact intensified simultaneously with an increase in the activity of the relevant phones using cells around HAWI's residence. 956

374. In May 2005, AYYASH had 101 contacts with other phone users, including the subjects who later participated in the coordinated and regular surveillance of HAWI and the locations relevant to the attack starting with 2 June 2005. This included 40 calls with Subject 6 and regular contact with Subject 8 and Subject 9 (three members of the HARIRI Assassination Team). 957

375. Notably, AYYASH was also in contact on four occasions with Subject 18 in the period between 20 May and 24 May 2005,958 after which Subject 18 and Subject 19 were active in the vicinity ofHAWI's residence on 26 May, 29 May and 1 June 2005, activating cell towers covering HAWI's residence. 959 On 29 May 2005, Subject 18 made three calls within nine minutes in the vicinity of HAWI's residence and, on 1 June 2005,

953 PCC073:D0568651-D0568907, para.476.

954 PCC073 :D056865 l-D0568907, paras.476-477.

955 PCC073:D0568651-D0568907, paras.477,971, 1417.

956 PCC02 l :D052835 l-D0528940, paras.7.1.1.5,7.1.2.6,graphs 07/01,07 /02,07 /03,07/04.

957 PCC073 :D056865 l-D0568907, para.4 75; PCC073 :D0568996-D0569028, para.4 7.

958 PCC073 :D056865 l-D0568907, para.4 75; PCC073 :D0568996-D0569028, para.4 7

959 PCC073 :D056865 l-D0568907, paras.472-485,505.

STL-18-1 O/PT /PTJ 139ofl85 15 December 2020 Public Redacted R026643

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

Subject 19 contacted Subject 18 from the same area. 960 Prior to the call on 1June2005, Subject 19 had never activated cells in the vicinity of HAWI' s residence. 961 The activity on these days suggests possible surveillance ofHAWI's residence conducted by Subject 18 and Subject 19, initiated by AYYASH between 20 May and 24 May 2005, in preparation for further sustained surveillance starting on 2 June 2005. 962

(ii) Surveillance from 2 to 4 June 2005

376. On 2 June 2005, the users of the phones involved in the surveillance operation on HAWI and locations related to him started regular surveillance ofHAWI's movements, his residence, crime scene, and the Gondole cafe, acting in an organised and coordinated manner until 20 June 2005. 963

377. Between 2 and 4 June 2005, Subjects 5, 8, 9, 18, and 19 conducted static surveillance of HAWI's movements during his departure and return to his residence and surveillance oflocations relevant to the attack. 964 Subjects 8, 18, and 19 conducted surveillance on all three days. 965

378. On 3 and 4 June 2005, they were joined by Subjects 5 and 9. 966 Over these days, Subjects 5, 8, and 9 were cell sited together in the relevant locations, as were Subjects 18 and 19. 967 Furthermore, the surveillance on 3 and 4 June 2005 followed the same pattern, with Subjects 5, 8, and 9 ceasing their surveillance activity when HAWI left

960 PCC073 :D0568651-D0568907, paras.4 73,483.

961 PCC073 :D0568651-D0568907, para.485.

962 PCC073 :D056865 l-D0568907, paras.473,485.

963 PCC073 :D056865 l-D0568907, paras.486-508; PCC021 :D052835 l-D0528940, para.14.3.2.1.

964 PCC073 :D056865 l-D0568907, paras.489,492,498-501,510,514-526,529,532-534,540,546-559,568,571; PCC02 l :D0528351-D0528940, para.14.3 .2.1.

965 PCC073 :D0568651-D0568907, paras.489,492,498,500-501,510,517,524,529,532-534,540,568,571; PCC021 :D0528351-D0528940, para.14.3.2.1.

966 PCC021 :D0528351-D0528940, para.14.3.2.1; PCC073:D0568651-D0568907, paras.510,514-518,524- 526,540,546-559.

967 PCC02 l :D0528351-D0528940, para.14.3 .2.4.

STL-18-1 O/PT /PTJ 140ofl85 15 December 2020 Public Redacted R026644

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

his residence. 968 Similarly, Subjects 18 and 19 conducted surveillance when HAWI returned to his residence, also ceasing their activity when HA WI left the residence. 969

379. As previously mentioned, in May 2005, AYYASH and Subject 6 were in contact on 40 occasions using their phones. 970 In turn, between 2 June and 4 June 2005, Subject 6 was in regular contact with the users who were conducting the surveillance of HAWI's residence and the locations relevant to the attack. Specifically, from 2 to 4 June 2005, Subject 6 was in constant contact with Subject 8, and on 3 June also with Subject 9, while they were conducting surveillance of HAWI's residence. 971 Moreover, on 3 and 4 June, both Subject 8 and Subject 9 ceased the surveillance of HAWI's movements and residence after their contact with Subject 6. 972 The call pattern and organised activity of Subjects 8 and 9 during these days after being in contact with Subject 6 demonstrates the coordination role played by Subject 6 in the surveillance operation.

380. On 4 June at 12:09, AYYASH had his first contact with BADREDDINE since 31 May 2005. 973 AYYASH's next call at 12:35 was to Subject 6, their first contact since 27 May 2005. 974

(iii) Surveillance from 6 to 9 June 2005

381. Between 6 and 9 June 2005, AYYASH coordinated the surveillance of the relevant locations to the attack, informing BADREDDINE on the progress of the operation.

382. On 6 June, Subject 6 was twice in contact with Subject 8 at 08:50 and 11:21 while both were in south Beirut,975 after which Subject 6 travelled to the vicinity of the Gondole

968 PCC073 :D056865 l-D0568907, paras.511 ,526-530,542,560-563.

969 PCC073 :D056865 l-D0568907, paras.492-495,529-536,569-572.

970 PCC073:D0568651-D0568907, para.475.

971 PCC073 :D056865 l-D0568907, paras.499,515,518-521,525-526,548-551,555-559.

972 PCC073 :D056865 l-D0568907, paras.514-527,546-562.

973 PCC073:D0568651-D0568907, para.564.

974 PCC073:D0568651-D0568907, para.565.

975 PCC073:D0568651-D0568907, para.581.

STL-18-1 O/PT /PTJ 141of185 15 December 2020 Public Redacted R026645

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

cafe at 12:23, conducting surveillance of the area during which HAWI was present in the same location. 976 By 12:48, Subject 6 was back in south Beirut. 977 Subject 6's next contact was with AYYASH at 14:01,978 consistent with Subject 6 reporting on the surveillance operation conducted earlier during the day.

383. At 14:24, AYYASH called Subject 8, 979 who was in contact with Subject 6 before he conducted surveillance of the Gondole cafe, and immediately after, at 14:25, AYYASH received a call from BADREDDINE. 980 An hour later, AYYASH's next call was again to Subject 8, during which both were located in south Beirut. 981

384. Between 17:46 and 18:08, Subject 19 was in contact on three occasions with Subject 18 while conducting surveillance of HAWI' s residence and the Gondole cafe. The pattern of activity and call flows between Subjects 18 and 19 on 6 June is consistent with their previous surveillance activity between 2 and 4 June, when one of them, or both, were active in the relevant area in the evening, communicating exclusively with each other and ceasing the surveillance activity when HAWI departed his residence. 982

385. On 7 June, Subjects 9 and 5 conducted surveillance of HAWI's residence and the Gondole cafe respectively. Specifically, at 12:07, Subject 9 called Subject 6 from the vicinity of HAWI's residence. 983 Subject 9 then returned to south Beirut and was in contact with Subjects 5 and 6, both of whom were also located there. 984 After the last call at 14:42 with Subject 9, Subject 5 conducted surveillance of the Gondole cafe

976 PCC073:D0568651-D0568907, paras.582,584-587.

977 PCC073:D0568651-D0568907, para.583.

978 PCC073:D0568651-D0568907, para.589.

979 PCC073:D0568651-D0568907, para.590.

980 PCC073 :D056865 l-D0568907, para.591.

981 PCC073:D0568651-D0568907, para.590.

982 PCC073 :D056865 l-D0568907, paras.593-597.

983 PCC073 :D056865 l-D0568907, para.606.

984 PCC073 :D056865 l-D0568907, paras.607-608.

STL-18-1 O/PT /PTJ 142ofl85 15 December 2020 Public Redacted R026646

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

activating cell towers covering that area at 15:51. 985 In addition, at 15:21 on this day, Subjects 6 and 18 were in contact for the first time since 26 May. 986

386. In the morning of 8 June, Subjects 9 and 5 were in contact twice, at 10:01 and 11:09, while conducting surveillance of the Gondole cafe. During the first call they were both in the vicinity of the Gondole cafe and during the second call Subject 5 was back in south Beirut, with Subject 9 continuing the surveillance. 987 Several minutes after the second call with Subject 5, Subject 9 was already conducting surveillance of HAWI's residence.988 Later during the day, Subject 9 was in contact with Subject 6. 989 AYYASH was also in contact with Subject 6 at 23:41,990 consistent with Subject 6 updating AYYASH on the surveillance activity of the day. Furthermore, AYYASH was in contact with Subject 18 several times on this day, this being their first contact since 24 May and the beginning of an increased activity between them. 991

387. On 9 June, there was an increased level of contact between AYYASH and BADREDDINE in comparison to the previous days. They were in contact on three occasions, every time AYYASH calling BADREDDINE. 992 After 9 June, they were in contact every day for the subsequent nine days. 993 In the afternoon, AYYASH also called Subject 18 and, immediately after this call, Subject 18 contacted Subject 19 twice, which demonstrates the coordination of their activities for the following day when both Subject 18 and Subject 19 conducted surveillance of HAWI's residence. 994

985 PCC073 :D0568651-D0568907, paras.610,614.

986 PCC073 :D056865 l-D0568907, paras.612-613.

987 PCC073 :D056865 l-D0568907, paras.622-623,626.

988 PCC073 :D056865 l-D0568907, para.624.

989 D0551627-D0551664, D0551653.

990 PCC073 :D0568651-D0568907, para.631.

991 PCC073:D0568651-D0568907, paras.611,627-629,632.

992 PCC073 :D056865 l-D0568907, paras.636,650-651,654.

993 PCC073 :D056865 l-D0568907, para.654.

994 PCC073 :D0568651-D0568907, paras.638-640,655.

STL-18-1 O/PT /PTJ 143of185 15 December 2020 Public Redacted R026647

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

388. Significantly, in the evening on 9 June 2005, AYYASH and BADREDDINE, both located in south Beirut, were in contact twice at 19:35 and 20: 11, during the time that HAWI was travelling to the Al-Manar building,995 a television station affiliated with Hezbollah.996 Thereafter, between 20:09 and 20:41, AYYASH travelled and was in the same area as HAWI, namely Haret-Hreik area in south Beirut, when HA WI was in the vicinity of the Al-Manar building for a possible meeting with Hezbollah's representatives between 20:40 and 21:31. 997

(iv) Surveillance from JO to 12 June 2005

389. Between 10 and 12 June, AYYASH coordinated the activity of Subjects 18 and 19, who conducted surveillance of the locations relevant to the attack, and conducted surveillance of HAWI's residence himself, informing BAD RED DINE on the progress of the operation.

390. On 10 June, there was significant activity around HAWI's residence and in west Beirut between 15:35 and 18: 17. Before that, AYYASH, from south Beirut, called BADREDDINE at 15:11,998 while Subject 18 was in contact with Subject 19 at 15:19 and 15:23, both were located in close proximity to each other and to AYYASH in south Beirut. This is indicative of three of them possibly being together during AYYASH's call to BADREDDINE.999

391. Shortly after, at 15:35, Subjects 18 and 19 were already in the vicinity of HAWI's residence starting the surveillance operation of the day. 1000 While Subjects 18 and 19 were conducting surveillance of HAWI' s residence, A YYASH called Subject 18 at

995 PCC073 :D056865 l-D0568907, paras.646,650-651,656.

996 PCC073 :D056865 l-D0568907, para.644.

997 PCC073 :D056865 l-D0568907, paras.64 7-649,652,656.

998 PCC073 :D056865 l-D0568907, paras.667-668.

999 PCC073 :D056865 l-D0568907, para.669,683.

1000 PCC073 :D056865 l-D0568907, paras.669-671.

STL-18-1 O/PT /PTJ 144ofl85 15 December 2020 Public Redacted R026648

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

16:45. 1001 Shortly after this call, at 16:54, AYYASH called BADREDDINE, consistent with informing him about the ongoing surveillance. 1002

392. Between 17:08 and 17:11, Subjects 18 and 19 ceased the surveillance activity and travelled to Manara area of west Beirut. 1003 While moving away from HAWI's residence, Subject 18 exchanged a call with AYYASH at 17:09, who was in south Beirut. 1004 Following this call, AYYASH left south Beirut and joined Subjects 18 and 19 in Manara area at 17: 14. 1005 By 17:59, AYYASH was back in south Beirut calling BADREDDINE and immediately after, AYYASH called Subject 18, who had also returned to south Beirut. 1006 Subject 18 and Subject 19 continued being in contact throughout the evening. 1007 The pattern of hierarchical call flows and movements on 10 June of AYYASH, Subjects 18 and 19 reflect the central role of AYYASH in the coordination of activity of Subjects 18 and 19 and regularly updating BADREDDINE on the surveillance operation.

393. On 11 June, there were 18 calls involving AYYASH, BADREDDINE, Subjects 6, 18, and 19, with A YYASH coordinating the activity of users in preparation for the surveillance operation for the next day and regularly updating BADREDDINE on its progress. 1008

394. Thus, on 12 June m the afternoon, AYYASH, Subjects 18 and 19 conducted surveillance of HAWI's residence, with AYYASH coordinating the operation. At 12:23, Subject 18 exchanged a call with Subject 19, after which AYYASH contacted BADREDDINE at 13:11. 1009 After AYYASH's call to BADREDDINE, the relevant

1001 PCC073 :D056865 l-D0568907, para.670.

1002 PCC073 :D056865 l-D0568907, paras.671,684-685.

1003 PCC073 :D056865 l-D0568907, paras.672,674.

1004 PCC073:D0568651-D0568907, para.672.

1005 PCC073 :D056865 l-D0568907, paras.673-676.

1006 PCC073 :D056865 l-D0568907, paras.676-677,686-688.

1007 PCC073:D0568651-D0568907, para.680.

1008 PCC073 :D056865 l-D0568907, paras.693-704.

1009 PCC073:D0568651-D0568907, paras.711-712.

STL-18-1 O/PT /PTJ 145ofl85 15 December 2020 Public Redacted R026649

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

users exchanged four calls within 13 minutes. Specifically, between 13:44 and 13:57, Subject 6 called Subject 18, then Subject 6 was twice in contact with

Subject 7, followed by a call from Subject 18 to AYYASH. 1010 As on previous occasions, AYYASH called BADREDDINE at 14:05 to update him accordingly. 1011

395. The surveillance started shortly after 15:30, with Subject 19 travelling towards HAWI's residence and making two calls to Subject 18 during his travel. 1012 By the time of their third call at 16:34, Subject 18 and Subject 19 were both using the MAZRAA2 cell in the vicinity ofHAWI's residence. 1013 AYYASH conducted the evening surveillance of HAWI's residence in person, calling BADREDDINE at 18:05 during the surveillance operation. He was back in south Beirut at 20:42. 1014 While in south Beirut, AYYASH called again BAD RED DINE at 21:33, 1015 consistent with another update from AYYASH after the completion of his surveillance activity. At 21:51, Subject 18 contacted A YYASH, calling Subject 19 immediately after. 1016 The call pattern and movements of AYYASH and the Subjects on this day again demonstrate the leading role played by A YYASH in the surveillance operation and the reporting process with BAD RED DINE.

(v) Surveillance on 13 June 2005

396. On 13 June, AYYASH conducted and coordinated surveillance ofHAWI's movements and of the relevant locations to the attack, informing BAD RED DINE on the progress of the operation.

1010 PCC073:D0568651-D0568907, para.713.

IOI I PCC073:D0568651-D0568907, para.714.

1012 PCC073:D0568651-D0568907, para.716.

1013 PCC073 :D056865 l-D0568907, paras.718,729-730.

1014 PCC073 :D056865 l-D0568907, paras.722-723,729-730,964.

1015 PCC073:D0568651-D0568907, para.726.

1016 PCC073:D0568651-D0568907, para.727.

STL-18-1 O/PT /PTJ 146ofl85 15 December 2020 Public Redacted R026650

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

397. On this day, shortly after midnight, AYYASH and BADREDDINE were in contact twice. 1017 The surveillance operation started with A YYASH and Subject 6 conducting surveillance ofHAWI's residence from 15:41 until 17:23, after which they both moved to Manara area as a result of Subject's 6 call to AYYASH at 17:23. 1018 Significantly, after being in contact with Subject 6, AYYASH immediately called Subject 19, who was located south of the Gondole cafe. 1019 At 17:36, AYYASH returned to his previous position and conducted surveillance of HAWI's residence, while Subject 19 was conducting surveillance of the Gondole cafe. 1020 At 18:01, AYYASH exchanged a call with Subject 6, who was now in the vicinity of the Gondole cafe, while AYYASH was back in the Manara area. 1021

398. At 18:04, AYYASH travelled to the St. Georges Marina area where HAWI was located and, between 18:12 and 18:48, conducted surveillance of HAWI. 1022 At 18:35, AYYASH was joined by Subject 6, conducting surveillance together. 1023 By 18:48, AYYASH was back at HAWI's residence and called BADREDDINE, 1024 consistent with AYYASH informing BADREDDINE on the outcome of the surveillance operation. 1025 Shortly after this call, AYYASH, Subjects 6 and 19 ceased the surveillance and returned to south Beirut. 1026

1017 PCC073:D0568651-D0568907, paras.733 ,767.

1018 PCC073 :D056865 l-D0568907, paras.740-742,745.

1019 PCC073 :D056865 l-D0568907, paras.741,743.

1020 PCC073 :D056865 l-D0568907, paras.746-747.

1021 PCC073:D0568651-D0568907, para.748.

1022 PCC073 :D0568651-D0568907, paras. 737,750-752,766,768.

1023 PCC073:D0568651-D0568907, para.755.

1024 PCC073:D0568651-D0568907, para.757.

1025 PCC073:D0568651-D0568907, para.768.

1026 PCC073 :D0568651-D0568907, paras. 756,758,763-766,768.

STL-18-1 O/PT /PTJ 147ofl85 15 December 2020 Public Redacted R026651

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

(vi) Surveillance from 14to18 June 2005

399. Between 14 and 18 June, AYYASH conducted and coordinated surveillance of HAWI' s residence, coordinating the activity of users and informing BADREDDINE on the progress of the operation.

400. On 14 June, AYYASH conducted surveillance of HAWI's residence in the late afternoon, exchanging a call with Subject 12 at 16:46, with whom he conducted surveillance of HAWI's residence the following day. 1027 Two hours after the surveillance operation had ceased, AYYASH was in contact with BADREDDINE at 18:48, when he was back in south Beirut. 1028 This pattern of activity was repeated again the following day after the cessation of the surveillance operation. 1029

401. On 15 June, AYYASH again conducted surveillance ofHAWI's residence in the late afternoon, at around 16:52, this time together with Subject 12. 1030 Shortly before this, they were in contact on three occasions in south Beirut. 1031 At 17:03, AYYASH and Subject 12 ceased the surveillance and left the area. 1032 However, at 18:06, AYYASH returned and continued surveillance ofHAWI's residence until 18:54, exchanging four calls with Subject 12. 1033 As on the previous day, two hours later, AYYASH called BAD RED DINE from south Beirut, 1034 as a regular part of the reporting process after the cessation of the surveillance operation. 1035

1027 PCC073 :D056865 l-D0568907, paras.775,778-779.

1028 PCC073:D0568651-D0568907, para.776.

1029 PCC073 :D056865 l-D0568907, paras.801-802.

1030 PCC073:D0568651-D0568907, para.788.

1031 PCC073 :D056865 l-D0568907, paras. 786, 799-800.

1032 PCC073 :D056865 l-D0568907, paras.788-790.

1033 PCC073 :D056865 l-D0568907, paras. 792,802.

1034 PCC073 :D056865 l-D0568907, paras.796,801-802.

1035 PCC073 :D056865 l-D0568907, paras.SO 1-802.

STL-18-1 O/PT /PTJ 148of185 15 December 2020 Public Redacted R026652

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

402. On 17 June, at 18:14, AYYASH and Subject 6 conducted surveillance of HAWI's residence, both located in the vicinity of his residence 1036 while HAWI was there. 1037 Shortly after the conclusion of the surveillance operation, AYYASH called BAD RED DINE, 1038 as he had done on previous occasions.

403. On 18 and 19 June, there was no activity around the locations related to the attack. However, AYYASH remained in regular contact with BADREDDINE and users involved in the surveillance operation during the previous three weeks. 1039

(vii) Surveillance on 20 June 2005

404. On 20 June, there was a peak in the activity of phones involved in the surveillance operation of HAWI. 1040 On this day, the users conducted surveillance of HAWI, his residence and the Gondole cafe.

405. Shortly after midnight, AYYASH contacted Subject 8. 1041 Between 06:26 and 07:40, Subject 8 was in contact with AYYASH again, as well as with Subject 5, Subject 6, and Subject 7. 1042 At 10:01, Subject 8 conducted surveillance ofHAWI as he departed his residence, exchanging calls with AYYASH, Subject 6 and Subject 7. 1043

406. From 11 :26 until 11 :37, there was an important series of calls between the relevant users, with Subject 6 coordinating the communication between Subjects 8, 5, 7, and 9. 1044 In the afternoon, at 14:50, Subject 5 was in the vicinity of HAWI's

1036 PCC073:D0568651-D0568907, para.838.

1037 PCC073 :D056865 l-D0568907, paras.828-829,848.

1038 PCC073 :D056865 l-D0568907, paras.842-845,851.

1039 PCC073 :D056865 l-D0568907, paras.854-860.

1040 PCC02 l :D052835 l-D0528940, paras.8.3.20.1-8.3.20.7; PCC073 :D056865 l-D0568907, paras.928-929.

1041 PCC073 :D056865 l-D0568907, paras.866-867.

1042 PCC073 :D056865 l-D0568907, paras.869-870.

1043 PCC073 :D056865 l-D0568907, paras.872-875,929.

1044 PCC073 :D056865 l-D0568907, paras.877-881.

STL-18-1 O/PT /PTJ 149of185 15 December 2020 Public Redacted 1047 PCC073 :D056865 l-D0568907, para.882.

1048 PCC073 :D056865 l-D0568907, paras.888-890.

1049 PCC073 :D056865 l-D0568907, paras.892-899,930.

1050 PCC073 :D056865 l-D0568907, paras.897-899,930.

1051 PCC073 :D056865 l-D0568907, paras.901-902,931-932; D0048989-D0049013, D0049001.

1052 PCC073 :D056865 l-D0568907, para.902.

STL-18-1 O/PT /PTJ 150ofl85 15 December 2020 Public Redacted R026654

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

409. Between 02:00 and 02:30, HAWI returned home and parked his car on the street near his residence. 1053

410. Subsequently, AYYASH contacted BADREDDINE at 02:45 and 03:14. 1054 The only other time they were in contact between 02:00 and 04:00 from 1 September 2004 to 21 June 2005 was on 1 October 2004, the day of the attack on HAMADE. 1055 Three minutes after AYYASH's second call to BADREDDINE, their last contact until after the attack, A YYASH called Subject 6, 1056 a pattern of activity also observed in the hours before the execution of other attacks. 1057

411. The final phone activity of the Core Six users before the execution of the attack was between Subjects 5, 6 and 8, with Subject 8 calling Subject 5 at 07:21 and Subject 6 calling Subject 8 at 07:33. 1058

412. Considering that during the four hours between 03: 17 and 07:21 AYYASH and the users were inactive on their phones and that the area around HAWI' s residence becomes much busier after 06:00, it is most probable that it was during this time when the IED was attached under the front passenger seat of HAWI's car. 1059

1053 PCC062:6033l133-60331235, 60331144; PCC059:60327497-60327529, 60327510, 60327514, para.15; PCC073 :D0568651-D0568907, paras.903-904,914-915,933-936.

1054 PCC073 :D056865 l-D0568907, paras.905-907,973.

1055 PCC073:D0568651-D0568907, para.907.

1056 PCC073 :D056865 l-D0568907, paras.908-909,931-932,974.

1057 See Vl(B)(2)(a)(v).

1058 PCC073:D0568651-D0568907, paras.910-911.

1059 PCCl 99:60328670-60328719, 60328698; PCC270:60323398-60323423, 60323410; PCC27 l :60322976-60322994, para.21; PCCl 92:60323327-60323354, paras.77-79; PCC059:60327497-60327529, 60327510, 60327514,para.15; PCC061:60333366-60333687,60333403-04; PCC073:D056865 l-D0568907, paras.903- 904,914-915,933-936.

STL-18-1 O/PT /PTJ 151of185 15 December 2020 Public Redacted 1064 PCC272:60323 l 89-60323226, paras.27-29 and 60323226; PCC020:D0548204-D0548288, para.22; PCC073:D0568651-D0568907, para.916.

1065 PCC269:60323300-60323326, 60323320; PCC062:6033l133-60331235, 60331186-87, para.44 and 60331196;

PCC073 :D056865 l-D0568907, paras.423,916.

1066 PCC062:6033l133-60331235, 60331215, para.48; PCC270:60323398-60323423, 60323410; PCCl 99:60328670- 60328719, 60328698; PCC271 :60322976-60322994, para.21; PCC254:D0551823-D055 l 937, D0551890-D05519l1; PCC073:D0568651-D0568907, paras.423,916.

STL-18-1 O/PT /PTJ 152ofl85 15 December 2020 Public Redacted R026656

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

(i) Results of the forensic investigation

415. The explosives were attached beneath the front passenger seat HAWI's car with a magnet. 1067 This was done at an earlier time when the car was parked. 1068 The IED was specifically assembled to direct the explosion upwards, 1069 and concentrate the damage to the front passenger seat. 1070 The explosion tore through the bottom of the car and forced the passenger seat upwards. 1071 It also caused a small-scale crater in the asphalt of the Main Street, from which magnet fragments were recovered. 1072

416. The quantity of explosives was estimated at approximately 300 to 450 grams of TNT equivalent, and contained traces of RDX, TNT, and NITR0. 1073 No component of the IED's ignition mechanism was retrieved from the crime scene and identified. 1074 Considering that HAWI's car was in motion at the time of the attack, 1075 and given HAWI' s irregular schedule, the layout of the neighborhood, the location of the attack, and the use of magnets to attach the IED to HAWI's car, the only reasonable inference is that the charge was detonated using a remote-controlled command initiation system. 1076

1067 PCC270:60323398-60323423, 60323410; PCC 199:60328670-60328719, 60328698; PCCl 92:60323327-60323354, paras.77-79; PCC269:60323300-60323326, para.41 and 60323321; PCC27 l :60322976-60322994, para.21.

1068 PCC269:60323300-60323326, para.41and 60323321; PCC073:D0568651-D0568907, paras.933-936.

1069 PCCl 92:60323327-60323354, paras.74,89,92.

1070 PCCl 99:60328670-60328719, 60328701; PCCl 92:60323327-60323354, paras.91-92.

1071 PCC199:60328670-60328719, 60328701; PCC271 :60322976-60322994, para.21; PCC269:60323300- 60323326, 60323320.

1072 PCC270:60323398-60323423, 60323409; PCC 192:60323327-60323354, paras.74-77; PCC269:60323300- 60323326, para.41; PCC271:60322976-60322994, para.17.

1073 PCC 199:60328670-60328719, 60328698, 60328706-07; PCCl 92:60323327-60323354, para.85 and 60323352; PCC269:60323300-60323326, para.34 and 60323320-21; PCC270:60323398-60323423, 60323409-1 O; PCC271 :60322976-60322994, para.22.

1074 PCCl 99:60328670-60328719, 60328698; PCCl 92:60323327-60323354, 60323352; PCC269:60323300-60323326, 60323320-21; PCC270:60323398-60323423, 60323409.

1075 PCC269:60323300-60323326, para.39 and 60323320; PCC270:60323398-60323423, 60323409-10.

1076 PCC254:D0551823-D0551937, D0551890-D0551911; PCC199:60328670-60328719, 60328698.

STL-18-1 O/PT /PTJ 153of185 15 December 2020 Public Redacted R026657

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

(ii) The victims and material damages to surroundings

417. The explosion killed HAWI. 1077 The explosion beneath his seat caused severe concentrated damage to his posterior pelvis area and his body was torn apart. 1078 Despite this, HA WI was still conscious for a few moments after the explosion. 1079 Parts of HAWI' s car seat were recovered from inside his body by the medical examiner. 1080

418. The explosion injured [Redacted]. 1081 He lost hearing in his right ear for several months after the attack, and suffered minor burns to his right hand and arm. 1082 The explosion also injured [Redacted], a worker at the Zouhairi service station who was attending to a customer when the explosion occurred. 1083 [Redacted] suffered minor injuries and lost hearing temporarily. 1084

419. In addition to the human victims of the explosion, the Zouhairi petrol station was also damaged, with the aluminium ceiling cladding falling down, and doors and windows broken. 1085

1077 PCCI87:60323253-60323287, para.I I and 60323259-60; 60I2I969-60I2I969; PCC269:60323300- 60323326, 60323320-21; PCCl 92:60323327-60323354, 60323352.

1078 PCC I 87 :60323253-60323287, 60323260,6032328 I; PCC I 99:60328670- 603287I9, 60328702; PCC208:60323376-60323397, 60323392, para.I3.

1079 PCC062:6033I133-60331235, 6033I186-87, para.44, 60331215, para.48; PCC208:60323376-60323397, 60323392,para.13; PCC I 87 :60323253-60323287, 6032326 I.

1080 PCC I 87 :60323253-60323287, 60323260,60323264-69; PCC I 89:60323227-60323252, paras. I 0, I2 and 60323234.

1081 PCC062:6033I133-6033 I235, 6033 I I 86-87, para.44, 6033 I2 I 5, para.48; PCC I 92:60323327-60323354, 60323352; 60323777-60323788, 60323783-84; PCC269:60323300-60323326, 60323321.

1082 PCC062:6033I133-6033 I235, 6033 I I86-87, para.44, 6033 I215, para.48; 60323777-60323788, 60323783.

1083 PCC2I4:60325505-60325538, paras.I,l I-I2 and 603255I 7-18, paras.I,l I,I6.

1084 PCC2 I 4:60325505-60325538, paras. I I-12.

1085 PCC268:6032569I-60325700, paras. I4-I 5.

STL-18-IO/PT /PTJ 154of185 I 5 December 2020 Public Redacted 1086 PCC073 :D0568651-D0568907, paras.918,938.

1087 PCC073 :D0568651-D0568907, paras.919,940.

1088 PCC073:D0568651-D0568907, para.920.

1089 PCC073:D0568651-D0568907, paras.941, 1036-1039, 1045-1046; PCC073 :D0568996-D0569028, para.34.

1090 PCC073 :D056865 l-D0568907, paras.941-942,965-966,969,971,976-978,1417; PCC073 :D0568996- D0569028, paras.73,77-79.

STL-18-1 O/PT /PTJ 155ofl85 15 December 2020 Public Redacted 1091 See II(D)(13).

1092 See II(C)( 4) and II(D)(13).

1093 PCC141 :60230953-60231103, paras.17, 19; PCC213:60328003-60328019, paras.20-21 and 60328018; PCC073:D0568651-D0568907, paras. I 000-1003.

1094 PCC141:60230953-60231103, para.97; PCCl 98:60302942-60303011, 60302961, para.89; PCC073:D0568651-D0568907, para.1161.

STL-18-1 O/PT /PTJ 156ofl85 15 December 2020 Public Redacted R026660

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

approximately 09:45 and 11:00, 1095 and travelled to his office on First Street in Rabieh, near the Turkish Embassy. 1096 From Halat-Sur-Mer, he travelled south along the highway towards Beirut and exited at the Antelias Bridge, from where he could use two routes to reach his office. 1097 In the days prior to the attack, EL-MURR usually drove the shorter route, through Second Avenue. 1098 In addition, although EL-MURR had a driver, 1099 in the weeks leading up to the attack he drove himself. 1100

427. In July 2005, EL-MURR owned a Porsche Cayenne and several other cars, none of which had any security features. 1101 In the weeks preceding the attack, EL-MURR drove only his new Porsche Cayenne. 1102 Whether at one of his residences or at his office, EL-MURR's vehicles were always parked in secure locations.11°3 His office and summer residence were also closely monitored by security guards. 1104

1095 PCC141 :60230953-60231103, paras.19-23, 104, 108,112, 118, 123, 130, 134; PCC058:60331035-60331092, 60331078,para.16; PCC073:D056865 l-D0568907, paras.1185-1186,1205,1223,1246,1257,1300,1313,1332.

1096 PCC141:60230953-6023l103, para.17; PCCl 98:60302942-60303011, 60302950, para.9; PCC073 :D056865 l-D0568907, paras.997-999.

1097 PCC198:60328020-60328030, paras.11-13 and 60328026-28; PCC198:60302942-60303011, 60302954,paras.32-34 and 60302968; PCC058:6033 l 035-60331092, 60331085, para. 78; PCC073 :D056865 l-D0568907, paras. I 025-1026.

1098 PCC058:60331035-60331092, 60331085, para.78; PCCl 98:60302942-60303011, 60302954, paras.32-33; PCC 198:60328020-60328030, para.13; PCC073 :D056865 l-D0568907, paras. I 025-1027.

1099 PCC058:60331035-60331092, 60331077, paras.5,7-8; PCC073:D056865 l-D0568907, paras.1014-1019.

1100 PCC198:60330921-60330995, 60330959, para.58; PCC073:D0568651-D0568907, para.1014.

I IOI PCCl 41:60230953-60231103, para.133; PCCl 98:60330921-60330995, 60330959, paras.50-54; PCC073 :D056865 l-D0568907, paras. l 012, 1016.

1102 PCCl 98:60330921-60330995,60330959, para.58; PCCl 98:60302942-60303011, 60302951, para.13; PCC 141 :60028755Al _TS_ D_EN_ 01, p.70, lines 42-48; PCC073:D0568651-D0568907, paras.1014, 1019.

1103 PCC 198:60302942-60303011,60302953, paras.24-26; PCC058:6033 l 035-60331092, 60331078, para.17; PCC2l3:60328003-60328019, paras.22-24 and 60328011-12; PCC073 :D056865 l-D0568907, paras.993,998,1002,1015.

1104 PCC073 :D056865 l-D0568907, paras.996,998-999, 1001, 1021, 1391.

STL-18-1 O/PT /PTJ 157ofl85 15 December 2020 Public Redacted 1109 PCC184:60332530-60332553, 60332539, 60332548-49,paras.5-6,l l-14, 60332553; 60002123-60002165, 60002131; PCC073 :D056865 l-D0568907, para.402.

1110 PCC 184:60332530-60332553, 60332539; 60002123-60002165, 60002142; PCC073 :D056865 l-D0568907, para.402.

1111 60002123-60002165, 60002130,60002142,60002157; PCC263 :60302558-60302616, 60302611; D055 l 349- D055 l 475, D055 l 462; PCC184:60332530-60332553, 60332539; PCC073:D056865 l-D0568907, para.403.

1112 60002123-60002165, 60002157; PCC073 :D056865 l-D0568907, para.403.

STL-18-1 O/PT /PTJ 158ofl85 15 December 2020 Public Redacted R026662

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

430. License place [Redacted] was printed for a [Redacted] in the name of [Redacted], listed as residing in [Redacted]. 1113 [Redacted] owned a [Redacted] with license plate [Redacted] at the time, 1114 but the license plate [Redacted] license plate printed on 7 April 2005 .1115 Neither was [Redacted] [Redacted] at the crime scene at the time of the attack on EL-MURR. 1116

431. [Redacted]. 1117 At the time of the purchase of the license plate, [Redacted], which had [Redacted]. 1118 At the time of the attack on EL-MURR, [Redacted]. 1119 [Redacted], [Redacted], [Redacted]. 1120 This piece of evidence thereby tends to reinforce and confirm, in addition to other nexi such as the activity of the , that those who had attacked EL-MURR and HARIRI, led by AYYASH, were one and the same. Additionally, the attachment of the license plate to a VBIED, [Redacted], [Redacted].

(ii) Network activity in the vicinity of[Redacted] shop

432. At 16:25 and 17:31 on 7 April 2005, Subject 5 using was involved in two calls activating a cell in the vicinity of the [Redacted]. 1121 Consequently, the phone

1113 PCC184:60332530-60332553, 60332539,60332553; PCC185:60306585-6030661 l, para.29 and 60306597.

1114 60002123-60002165, 60002130; PCC185:60306585-6030661 l, paras.22,26 and 60306610-11.

1115 PCC185:60333116-60333130,60333125; PCC185:60306585-6030661 l, para.29; PCCl 75:60325109- 60325156, para.12.

1116 60002123-60002165, 60002130; PCC185:60306585-6030661 l, paras.12-13,31; PCC 175 :60325109-60325156, para.12.

1117 60002123-60002165, 60002130; PCC185:60306585-60306611, para.26 and 60306610-11; PCC185:60333116- 60333130.60333126.

1118 PCC186:60333050-60333115,60333061; PCC185:60333116-60333130, 60333127; PCC275:60332969- 60333023, paras. I 0, 13-14.

1119 PCC186:60333050-60333l15,60333060; PCC185:60333116-60333130, 60333127; 60002123-60002165, 60002130.

1120 60002123-60002165, 60002157; PCC186:60333050-60333l15, 60333062.

1121 PCC073:D0568651-D0568907, para.405.

STL-18-1 O/PT /PTJ 159ofl85 15 December 2020 Public Redacted R026663

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

activity of Subject 5 located him in the vicinity of the shop around the time the license plate was ordered and collected. 1122

(iii) The purchase of the vehicle used as a VBIED

433. The VBIED in the EL-MURR attack was a Mitsubishi Montero motor vehicle with Vehicle Identification Number JA4MT31H9XP014327. 1123 The Mitsubishi Montero was sold by [Redacted] at his car showroom in Tripoli. 1124 The exact date of sale for the Mitsubishi Montero is not known. 1125

434. [Redacted] placed the sale of the Mitsubishi Montero in the timeframe March - May 2005.11 26 [Redacted] [Redacted] [Redacted] was present in the showroom during the sale of the Mitsubishi Montero. 1127 Exit and entry records for [Redacted] show that he was in Lebanon between 6 March 2005 and 16 May 2005. 1128

435. A considerable portion of the money from the sale of the Mitsubishi Montero was deposited at the Tripoli [Redacted] branch of [Redacted] Bank a few days after the sale according to [Redacted]. 1129 [Redacted] bank account statement shows significant cash deposits on several dates between 18 April and 16 May 2005. 1130 Therefore, it is most

1122 PCC073 :D0568651-D0568907, para.406.

1123 PCC205 :60324442-60324464, 60324457; PCC 194:60327216-60327253, para.11 and 60327224; L0045929-L0045935,L0045929;L0046314-L0046323,L0046317; 60002123-60002165,60002131; PCC073 :D0568651-D0568907, para.407.

1124 PCC069 :60332417-60332529, 60332466,para. 7, 60332468,para.24; PCC073 :D0568651-D0568907, para.408.

1125 PCC073 :D056865 l-D0568907, para.411.

1126 PCC073:D0568651-D0568907, paras.411-413; PCC069:60332417-60332529, 60332427- 28,60332434,60332440.

1127 PCC068:60332396-60332416, 60332407, paras.44-45; PCC069:60332417-60332529, 60332470, paras.42-45.

1128 60326198-60326207,60326201.

1129 PCC069 :60332417-60332529, 60332436, 60332457 ,para.31; PCC073 :D0568651-D0568907, para.410.

1130 60145104-60145105; PCC069:603324 l 7-60332529, 60332471,paras.52-62; PCC073:D0568651-D0568907, para.412.

STL-18-1 O/PT /PTJ 160ofl85 15 December 2020 Public Redacted !'CCU/ .J :UU'.:lb~b'.:l 1-UU'.:lb~YU/, para.41'.:l.

1133 D0058495-D0058526; D0049079-D0049110; D0551564-D0551626; D0049049-D0049078; D0549687- D0549731; D0551627-D0551664.

1134 D0049079-D0049 l l 0, D0049098,row.578.

1135 See VI.D.2.(b )(i)-(ii).

1136 PCC058:6033 l 035-60331092, 60331085,para.78; PCCI 98:60302942-60303011, 60302954, paras.32-33; PCC 198:60328020-60328030, para.13; PCC073:D0568651-D0568907, paras. I 025-1027.

STL-18-1 O/PT /PTJ 161of185 15 December 2020 Public Redacted R026665

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

Avenue is to the east of Antelias junction and runs from Rabieh Rise. 1137 The El-Zalka area is south of Antelias junction on the coastal highway and leads towards north-east Beirut. 1138

(ii) Phone Activity from 22 June to 28 June 2005

439. Following HAWI's assassination, the activity of AYYASH, BADREDDINE, and the phones decreased significantly. 1139 Between 22 June and 27 June 2005, AYYASH was in contact with BADREDDINE only once, on 25 June, 1140 and had no contacts with any of the five users who were later involved in the surveillance operation ofEL-MURR. 1141

440. On 27 June 2005, EL-MURR hosted a meeting at his residence in Rabieh with Wafilc SAFA, 1142 head of the Central Unit for Liaison and Coordination in Hezbollah, to discuss his upcoming meeting with NASRALLAH scheduled for 29 June 2005. 1143

441. On 28 June 2005, AYYASH called BADREDDINE at 09:58, their first contact since 25 June, 1144 which triggered a period of intense activity with 26 interconnected calls in the next two hours. 1145 Immediately after contacting BADREDDINE, AYYASH called Subject 6 at 09:59, 1146 who in tum was in continuous

1137 PCC073 :D056865 l-D0568907, para. l 004.

1138 PCC073:D0568651-D0568907, para.1372.

1139 PCC073 :D056865 l-D0568907, paras.941-942, 1036-1039, 1046, 1073; PCC02 l :D052835 l-D0528940, paras.8.3.31.264,8.3.31.273,8.3.31.281, and graphs 16/01, 16/02.

1140 PCC073 :D056865 l-D0568907, paras. l 037, 1050.

1141 PCC073 :D056865 l-D0568907, paras. l 036, 1039.

1142 PCC141:60230953-6023l103, paras.65,69,71; PCCl 98:60302942-60303011, 60302957-58, paras.57,61; PCC073 :D056865 l-D0568907, paras. l 040-1041.

1143 PCC141 :60230953-60231103, paras.69,77,80; PCC073:D0568651-D0568907, paras.1040-1043.

1144 PCC073:D0568651-D0568907, para.1050.

1145 PCC073:D0568651-D0568907, paras.1046,1051, 1059-1061,1069, 1073; PCC021 :D0528351-D0528940, paras.8.3.31.320-8.3.31.330.

1146 PCC073 :D056865 l-D0568907, paras. l 045, 1052, 1069.

STL-18-1 O/PT /PTJ 162of185 15 December 2020 Public Redacted R026666 STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

contact with Subject 8 and Subject 9 throughout the day. 1147 This hierarchical call flow pattern was also observed during the preparatory activities of other attacks, in particular after A YYASH's last call to BAD RED DINE before the attack on HAWI. 1148 Notably, Subjects 6, 8 and 9 conducted surveillance of EL-MURR the following day. This resurgence of intense activity preceding the start of the surveillance operation on EL­ MURR the following day demonstrates the organised activity of the Subjects, with AYYASH playing a key role in its coordination.

(iii) Surveillance of EL-MURR's meeting with NASRALLAH on 29 June 2005

442. This was the first day of both static and mobile surveillance of EL-MURR conducted by Subjects 6, 8 and 9. A YYASH coordinated the operation through his communication with BADREDDINE and Subject 6. Significantly, the activity and coordinated movements of the users on this day replicated the surveillance operation conducted on HARIRI when he attended a meeting with NASRALLAH on 21 December 2004, with A YYASH coordinating the surveillance operation and reporting to BADREDDINE, who was in regular contact with AYYASH and SAFA on that day.1149

443. On 29 June 2005, EL-MURR met with NASRALLAH at 16:00 in south Beirut. 1150 Ahead of the meeting, AYYASH with BADREDDINE coordinated the activity of Subject 6 related to the surveillance of EL-MURR and his travel to the meeting venue. Specifically, AYYASH called BADREDDINE at 11:26. 1151 Then, BADREDDINE and SAFA, who was involved in arranging the meeting between EL-MURR and NASRALLAH, were in contact twice, at 11 :48 and 13:38, the second time for almost

1147 PCC073:D0568651-D0568907, paras.1058,1064, 1067, 1069-1070.

1148 See VI(C)(3)(a). PCC073:D0568651-D0568907, paras.906-908.

1149 See Vl(B)(2)(a)(ii)(a); PCC073:D0568651-D0568907, paras.1367-1369.

1150 60094800-60094859,60094833; PCC141:60230953-60231103, paras.77 ,80-85; PCC 198:60302942-60303011, 60302959-60, paras.70-7 5; PCC073 :D056865 l-D0568907, paras. I 077-1078.

1151 PCC073 :D0568651-D0568907, paras. I 080-1081.

STL-18-1 O/PT /PTJ 163of185 15 December 2020 Public Redacted R026667

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

14 minutes. 1152 During this time, AYYASH was in contact with Subject 18 at 12:06, who then exchanged three calls with Subject 6, the first one immediately after his

contact with AYYASH. 1153

444. After his last calls with Subject 18, who was earlier in contact with AYYASH, and during the next two calls with AYYASH at 15:07 and 15:42, which was before the start of EL-MURR's meeting with NASRALLAH, Subject 6 was already in the vicinity of the meeting venue. 1154 Within seconds after the second call, AYYASH contacted BADREDDINE, 1155 consistent with an update from AYYASH concerning the status of the operation. While in the vicinity of the meeting venue, Subject 6 exchanged two more calls, one with Subject 7 at 15:45 and another one with AYYASH at 15:46. 1156

445. Shortly before 16:00, EL-MURR, accompanied by his [Redacted], [Redacted],1157 met SAFA at a petrol station near St. Mikhael Church in south Beirut, who escorted them to the meeting with NASRALLAH. 1158 Upon their arrival, SAFA made a quick sequence of three calls to BADREDDINE, all between 16:03 and 16:05, consistent with SAFA informing BADREDDINE of EL-MURR's arrival. 1159 Shortly after, at 16:13, AYYASH called BADREDDINE. 1160 Then, at 16:45 and 17:01, AYYASH exchanged two calls with Subject 6 who was still in the vicinity of the meeting venue. 1161 At 17: 16, Subject 6 made a call to Subject 9, during which they both were in the vicinity of the

1152 PCC073 :D056865 l-D0568907, paras. l 082-1084,1091-1092.

1153 PCC073 :D056865 l-D0568907, paras. l 086-1087.

1154 PCC073:D0568651-D0568907, para.1094.

1155 PCC073:D0568651-D0568907, para.1095.

1156 PCC073 :D056865 l-D0568907, paras. l 097-1098.

1157 PCC 198:60302942-60303011, 60302950, paras.7-8, 60302959, paras.72-73; PCC073:D056865 l-D0568907, para.1017.

1158 PCC 141:60230953-60231103, paras.80-83; PCC 198:60302942-60303011, 60302959,para.72; PCC073 :D0568651- D0568907, paras.1099-1104,1109.

1159 PCC073 :D056865 l-D0568907, paras.1105-1107.

1160 PCC073:D0568651-D0568907, para.1108.

1161 PCC073:D0568651-D0568907, para.1110.

STL-18-1 O/PT /PTJ 164ofl85 15 December 2020 Public Redacted R026668

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

meeting venue. 1162 After the meeting, at around 17:30, SAFA escorted EL-MURR and [Redacted] out ofHezbollah area. 1163

446. By 17:37, EL-MURR was travelling towards Rabieh1164 through Tahwitat, Karantina, El-Zalka and Antelias. 1165 During this time, Subjects 6, 8 and 9 conducted surveillance of EL-MURR's movements as he returned to his residence in Rabieh. Specifically, at 17:45, Subject 6, who was still in the vicinity of the meeting venue, called Subject 8, who in turn was in the Karantina area of north Beirut1166 through which EL-MURR travelled five minutes later, arriving at his residence in Rabieh shortly after 18:00. 1167 At 17:47, AYYASH contacted Subject 6, who was already moving north from the meeting venue. 1168

447. Significantly, at 18:11, SAFA called BADREDDINE, after which BADREDDINE called A YYASH at 18: 14, consistent with BAD RED DINE passing on to A YYASH the information received from SAFA regarding EL-MURR. 1169

448. Between 18:22 and 18:45, Subjects 6, 8 and 9 were still located in the El-Zalka and Antelias areas. 1170 Specifically, at 18:22, Subject 8 exchanged a call with Subject 9, which placed both subjects in the El-Zalka area on the coastal highway, leading to

Antelias junction. 1171 This activity is consistent with Subject 9 following EL-MURR from the Hezbollah meeting venue and with Subject 8 following him from the Karantina

1162 PCC073:D0568651-D0568907, para.1111.

1163 PCC141 :60230953-60231103,para.85; PCC198:60302942-6030301 l,60302960, para.74; PCC073:D0568651-D0568907, paras.1104,1109,1112.

1164 PCC073:D0568651-D0568907, paras.1112-1113.

1165 PCC141:60230953-6023l103, para.85; PCCl 98:60302942-60303011,60302960, para.74; PCC073:D0568651-D0568907, para.1112.

1166 PCC073:D0568651-D0568907, paras.1114,1116.

1167 PCC073:D0568651-D0568907, para.1116.

1168 PCC073:D056865 l-D0568907, para.1115.

1169 PCC073:D0568651-D0568907, paras.1121-1122.

1170 PCC073 :D056865 l-D0568907, paras.1117-1120,1123-1125,1130-1131, 1366.

1171 PCC073:D0568651-D0568907, paras.1117-1120.

STL-18-1 O/PT /PTJ 165of185 15 December 2020 Public Redacted R026669

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

area, through which EL-MURR travelled back to his residence in Rabieh, both subjects eventually meeting in the El-Zalka area. 1172 During their next contact at 18:39, Subject 8 was in the same position while Subject 9 had moved away and was in the vicinity of Antelias junction. 1173 Immediately after, at 18:40 and 18:45, Subject 6, who had travelled from south Beirut, exchanged two calls with Subject 8, which placed them both in the El-Zalka area in close proximity to each other. 1174

449. Their activity in this area ceased shortly after 19:00, with all three subjects returning to south Beirut and continuing their communication. 1175 Notably, Subject 6 was also in contact with AYYASH twice, first making a call to AYYASH at 19:49 and then receiving one from A YYASH at 20:34, 1176 consistent with Subject 6, first, reporting to A YYASH regarding the surveillance operation of the day and, during their second call, receiving additional instructions from AYYASH in preparation for further surveillance on the following day.

(iv) Surveillance from 30 June to 8 July 2005

450. On 30 June 2005, Subjects 6, 8 and 9 conducted surveillance oflocations related to EL­ MURR and to the attack, including the crime scene, with A YYASH coordinating the activity of the users through Subject 6. The organized activity on the coastal road south of Antelias and around the crime scene area on this day, as well as the coordinated activity in these areas miIToring EL-MURR's movements on the following days, while EL-MURR was travelling between his summer residence in Halat-Sur-Mer and his office in Rabieh, is significant and extremely unusual, as the only other period when this type of activity occuITed, involving the same subjects, was in December 2004 and January 2005, when they conducted surveillance of HARIRI's

1172 PCC073:D0568651-D0568907, paras.1117-1120, 1130 .

1173 PCC073:D0568651-D0568907, para.1123.

1174 PCC073:D0568651-D0568907, paras.1124-1125.

1175 PCC073:D0568651-D0568907, para.1126.

1176 PCC073:D0568651-D0568907, para.1126.

STL-18-1 O/PT /PTJ 166ofl85 15 December 2020 Public Redacted R026670 STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

movements between Beirut and Faqra, observing his regular routes and assessing suitable locations to execute the attack. 1177

451. On 30 June 2005, at 09:38, AYYASH called Subject 6, who was in the area of the crime scene. 1178 They were in contact again at 10:00 and 10:01, at which time Subject 6 had moved away from the crime scene and was in central Beirut. 1179 At 10:53, Subject 6 was back to the area of the crime scene and called Subject 8, who was also in the vicinity of the crime scene. 118°Following this call, Subject 8 was twice in contact with Subject 9 at 10:54 and 10:56, after which Subject 9 called Subject 5 at 10:58. 1181 During these calls, all of them were conducting surveillance of locations relevant to the attack, with Subject 8 and Subject 9 in the vicinity of the crime scene and Subject 5 on the coastal road area south of Antelias. 1182 Shortly after, Subject 8 called Subject 7 at 11: 12, during which they both were in the coastal highway area. 1183 In the evening, A YYASH and the Subjects continued their communication ahead of further surveillance on the following day. 1184

452. On the evening of 1 July 2005, EL-MURR moved to his summer residence at Halat­ Sur-Mer.1185 On this day, the Subjects conducted coordinated surveillance of the coastal highway area south of Antelias junction aimed at gathering information about EL­ MURR's travel routine and identifying suitable locations for further surveillance on EL-MURR. In the morning, Subjects 5, 6, 8, and 9 were all present in this area. Specifically, at 07:49, Subject 9, while in the coastal highway area, contacted Subject

1177 See VI(B)(2)( a)(ii)(b ). PCC073 :D0568651-D0568907, para.1158; PCC073:D0568996-D0569028, para.25.

1178 PCC073:D0568651-D0568907, paras.1136-1138.

1179 PCC073:D0568651-D0568907, paras.1139-1140.

1180 PCC073:D0568651-D0568907, para.1142.

1181 PCC073:D0568651-D0568907, paras.1143-1144.

1182 PCC073:D0568651-D0568907, paras.1145,1370-1375.

1183 PCC073 :D056865 l-D0568907, paras.1148-1149.

1184 PCC073:D0568651-D0568907, paras.1151-1155.

1185 PCC141 :60230953-60231103,para.97; PCC198:60302942-6030301 l,60302961, para.89; PCC073:D0568651-D0568907, para.1161.

STL-18-1 O/PT /PTJ 167ofl85 15 December 2020 Public Redacted R026671

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

5, who was in south Beirut. 1186 Then, at 08:31, Subject 5 was in contact with Subject 8, during which they both were in the El-Zalka area south of Antelias junction.11 87 At 11 :58, Subject 6 joined the others in the El-Zalka area and contacted Subject 8, who had moved east along the coastal road. 1188 In the evening, the Subjects and AYYASH continued their communication, 1189 AYYASH called BADREDDINE at 22:35. 1190

453. The surveillance operation was resumed on 4 July 2005 after a break in surveillance activity over the weekend on 2 and 3 July 2005. The suspension of the operation during the weekend is consistent with AYYASH and the Subjects possibly revising their surveillance plan and making new preparations for the forthcoming surveillance due to the radical changes in EL-MURR's travel routine from 1July2005, after he had moved to his summer residence at Halat-Sur-Mer.

454. On 4 July 2005, AYYASH, through Subject 6, coordinated the activity of the relevant users who conducted surveillance of EL-MURR' s movements while he was travelling between his summer residence in Halat-Sur-Mer and his office in Rabieh. At approximately 10: 15, EL-MURR left his summer residence, driving through Antelias junction at 10:38, and arrived at his office in Rabieh by 10:46. Thus, between 10:38 and 10:46, EL-MURR drove through the eventual crime scene at Rabieh Rise before reaching his office. 1191 During this time, Subject 8 conducted surveillance of EL­ MURR's travel route. Specifically, at 10:40, Subject 8, located at the crime scene area, called Subject 6, who was travelling from south Beirut towards the coastal highway area.11 92 Shortly after, they exchanged two more calls at 10:44 and 10:56, and by the time of the second call both Subject 8 and Subject 6 were located in close proximity to

1186 PCC073:D0568651-D0568907, para.1165.

1187 PCC073:D0568651-D0568907, para.1166.

1188 PCC073:D0568651-D0568907, paras.1167-1168.

1189 PCC073:D0568651-D0568907, paras.1169-1170.

1190 PCC073 :D056865 l-D0568907, para.1171.

1191 PCC073:D0568651-D0568907, paras.1185-1186,1376.

1192 PCC073 :D056865 l-D0568907, paras.1187-1189, 1197-1199.

STL-18-1 O/PT /PTJ 168of185 15 December 2020 Public Redacted R026672

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

each other in the Antelias junction area. 1193 In the evening, at 20:52, Subject 6 called Subject 7 and immediately after contacted AYYASH at 20:53.11 94 This is consistent with AYYASH coordinating the activity of the relevant users m preparation for further surveillance, as the following day Subject 7 conducted surveillance in the coastal road area south of Antelias junction.

455. On 5 July 2005, the Subjects conducted surveillance of EL-MURR's movements through the crime scene area, with A YYASH coordinating the activity of the relevant users via Subject 6. The coordinated activity of the relevant users in the vicinity of EL-MURR's crime scene and the surrounding area was exceptional and very similar to their organised activity at the crime scene areas of the HAMADE, HARIRI and HAWI Attacks, as in the two-month period before and after the attack on EL-MURR there was no regular activity in these areas by the Subjects involved in the surveillance operation of EL-MURR.11 95

456. Before the start of the surveillance operation on this day, AYYASH exchanged three calls with Subject 6 at 07:09, 07: 16, and 08:33. 1196 At approximately 10:00, EL-MURR left Halat-Sur-Mer, driving through the eventual crime scene at approximately 10:25, and arrived at his office by 10:27. 1197 Shortly after, Subject 5 exchanged two calls with Subject 7 at 10:55 and 11 :03, during which both were located south of Antelias junction, consistent with them having moved away from the crime scene after observing EL­ MURR travelling through that area at 10:25. 1198 At 12: 19, Subject 6 also travelled to the coastal road area south of Antelias junction and contacted Subject 8, who was in south Beirut. 1199 Shortly after, AYYASH called BADREDDINE at 12:44,1200

1193 PCC073:D0568651-D0568907, paras.1190-1191,1199.

1194 PCC073 :D056865 l-D0568907, paras.1194-1196,1200.

1195 PCC073 :D056865 l-D0568907, paras.1336-1342.

1196 PCC073:D0568651-D0568907, paras.1203,1216.

1197 PCC073:D0568651-D0568907, para.1205.

1198 PCC073 :D056865 l-D0568907, para.1206.

1199 PCC073 :D056865 l-D0568907, paras.1207-1208.

1200 PCC073:D0568651-D0568907, para.1209.

STL-18-1 O/PT /PTJ 169of185 15 December 2020 Public Redacted R026673

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

consistent with an update on the surveillance operation, while Subject 6 called Subject 8 at 13:59, during which both Subjects were already in south Beirut. 1201 At 17:58, A YYASH called Subject 6, 1202 which triggered a series of calls between the users who were earlier involved in the surveillance operation of EL-MURR, including three calls involving Subject 6. 1203

457. On 6 July 2005, Subjects 5, 6 and 8 conducted surveillance oflocations relevant to the attack, including, for the first time, of EL-MURR's office, with Subject 6 coordinating the operation. The Subjects conducted surveillance in Antelias and Rabieh between 07:33 and 11 :35. Specifically, at 07:33, Subject 8 activated the ANTELI2 cell covering the crime scene when calling Subject 6, who was south of Antelias junction. 1204 At 07:48, Subject 5, who was also south of Antelias junction, called Subject 9 in south Beirut. 1205 At approximately 09:45, EL-MURR left Halat-Sur-Mer, driving through the eventual crime scene at approximately 10: 10, and mTived at his office by 10: 15. 1206 At 10:41, Subject 8 was in the vicinity of EL-MURR's office and conducted surveillance of the location. 1207 Between 11 :02 and 11 :35, Subjects 5, 6, 7, and 8 exchanged a series of calls, with Subjects 5, 7 and 8 in close proximity to each other near the Antelias junction and with Subject 6 back in south Beirut from El-Zalka area. 1208 At 12:08,

Subject 9 called AYYASH,1209 while Subject 6 continued his communication with the Subjects involved in the surveillance operation and later in the evening with Subject 9, 1210 who was earlier in contact with AYYASH. At 21:05, 23:59, and 00:29, AYYASH

1201 PCC073:D0568651-D0568907, para.1210.

1202 PCC073:D0568651-D0568907, para.1212.

1203 PCC073 :D056865 l-D0568907, paras.1213-1214.

1204 PCC073:D0568651-D0568907, para.1221.

1205 PCC073:D0568651-D0568907, para.1222.

1206 PCC073 :D0568651-D0568907, para.1223.

1207 PCC073 :D056865 l-D0568907, paras.1224, 1237.

1208 PCC073 :D056865 l-D0568907, paras.1225-1229.

1209 PCC073:D0568651-D0568907, para.1230.

1210 PCC073:D0568651-D0568907, paras.1230-1231,1236.

STL-18-1 O/PT /PTJ 170of185 15 December 2020 Public Redacted R026674

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

was in contact with BADREDDINE, 1211 consistent with further coordination between them related to the operational details of the surveillance operation.

458. On 7 July 2005, the Subjects were not active in the locations relevant to the attack. However, Subjects 5, 6, 7, 8 and 9 were in frequent contact throughout the day 1212 and AYYASH called BADREDDINE shortly before midnight, 1213 consistent with them coordinating their activity for the surveillance due to take place the next day.

459. On 8 July 2005, the Subjects conducted surveillance ofEL-MURR's movements, routes and vehicle used, with A YYASH coordinating the operation. On this day, at approximately 10:30, EL-MURR left Halat-Sur-Mer, driving through the eventual crime scene at approximately 11:00, and arrived at his office by 11:05. 1214 Ten minutes after EL-MURR drove through the crime scene, there was a significant sequence of calls involving AYYASH and the users conducting the surveillance. Specifically, at 11 :09, Subject 8 called Subject 9, during which they both were south of Antelias junction and moving in the direction of south Beirut, consistent with Subject 8 and Subject 9 returning to south Beirut after conducting surveillance ofEL-MURR's travelling route through the crime scene. 1215

460. Within one minute after the call between Subject 8 and Subject 9, Subject 8 contacted Subject 6 at 11: 10, consistent with informing Subject 6 on EL-MURR's movements. 1216 Immediately after, Subject 6 called AYYASH at 11:12. 1217 The call with AYYASH triggered two other calls between Subject 6 and Subject 8 at 11: 17 and 11: 18, after which Subject 6 contacted A YYASH again at 11 :20 and made two other calls to Subject 8 at 11 :24 and 11 :26. 1218 This sequence of calls demonstrates the coordination role of

1211 PCC073 :D056865 l-D0568907, paras.1232, 1234-1235.

1212 PCC073 :D056865 l-D0568907, paras.1242-1245,1247-1248, 1250-1252, 1379.

1213 PCC073:D0568651-D0568907, paras.1249,1252-1253.

1214 PCC073:D0568651-D0568907, para.1257.

1215 PCC073 :D056865 l-D0568907, paras.1258, 1261-1267.

1216 PCC073 :D056865 l-D0568907, paras.1258, 1268.

1217 PCC073 :D056865 l-D0568907, paras.1258, 1269-1271, 1379-1380.

1218 PCC073:D0568651-D0568907, paras.1258,1379-1380.

STL-18-1 O/PT /PTJ 17lofl85 15 December 2020 Public Redacted 1219 PCC073 :D056865 l-D0568907, paras.1278, 1381.

1220 PCC073 :D056865 l-D0568907, paras.1279-1281.

1221 PCC073 :D056865 l-D0568907, para.1280.

1222 PCC073 :D056865 l-D0568907, paras.1283, 1381.

1223 PCC073 :D056865 l-D0568907, paras.1284-1287,1381-1382.

1224 PCC073:D0568651-D0568907, paras.1290-1292,1295.

STL-18-1 O/PT /PTJ 172of185 15 December 2020 Public Redacted R026676

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

final calls in the morning of this day. Specifically, Subject 7 called Subject 5 at 07: 13 and Subject 8 called Subject 9 at 08:36. 1225

464. EL-MURR, as during the previous week, travelled from Halat-Sur-Mer to his office in Rabieh. He left Halat-Sur-Mer at about 09:50, drove through the eventual crime scene at approximately 10:20, arriving at his office by 10:27. 1226

465. In the evening of 11 July and in the early hours of 12 July 2005, AYYASH coordinated the final preparations before the execution of the attack with BADREDDINE and Subject 6. Specifically, AYYASH was in contact with Subject 6 twice, at 17:00 and then at 21:54, 1227 after which AYYASH stopped using his phone until after the attack. 1228 Similarly, Subject 6 stopped using his phone at 22:34 until after the attack. 1229 About an hour later, AYYASH, using his Mobile 170, called BAD RED DINE, 1230 after which BAD RED DINE travelled towards A YY ASH's location in south Beirut, consistent with a final meeting to coordinate the last details before the execution of the attack. 1231 At 00:37, BADREDDINE, while already in close proximity to A YYASH, made a call to A YYASH which lasted only eight seconds, consistent with BADREDDINE updating AYYASH about his arrival. This was their last call until the day after the attack. 1232

1225 PCC073:D0568651-D0568907, para.1298.

1226 PCC073:D0568651-D0568907, para.1300.

1227 PCC073 :D056865 l-D0568907, paras.1301, 1303, 1385-1386.

1228 PCC073:D0568651-D0568907, paras.1304,1322-1327,1386-1387, 1417.

1229 PCC073 :D056865 l-D0568907, paras.1305, 1322, 1326-1327,1386-1387.

1230 PCC073:D0568651-D0568907, para.1306.

1231 PCC073:D0568651-D0568907, paras.1306-1310.

1232 PCC073:D0568651-D0568907, paras.1307-1310.

STL-18-1 O/PT /PTJ 173 of 185 15 December 2020 Public Redacted para.19; PCC073:D056865 l-D0568907, para.1312.

1239 PCC141:60230953-6023l103, para.134; PCC073:D0568651-D0568907, paras.985,1313.

1240 PCC198:60330921-60330995, 60330929; PCC058:60331035-60331092, 60331047; PCC141:60230953- 60231103, para.133; PCC073:D0568651-D0568907, paras.985,1311-1313.

1241 PCC 141:60230953-60231103, para.135; PCCl 98:60328020-60328030, paras.11-13 and 60328026-28; PCC058:6033 l 035-60331092, 60331087-88, para. I 07; PCC073:D056865 l-D0568907, paras.986,1004- 1011,1314.

STL-18-1 O/PT /PTJ 174of185 15 December 2020 Public Redacted R026678

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

before the attack site, EL-MURR noticed a red jeep parked irregularly. 1242 He did not slow down and maintained his normal speed as he reached the speedbump, 1243 and at approximately 10: 18, 1244 the explosives concealed in the rear of the VBIED were remotely detonated as EL-MURR drove past. 1245

(i) Results of the forensic investigation

469. The explosives were concealed in the rear of the VBIED, a wine-coloured Mitsubishi Montero, 1246 which was the red jeep EL-MURR had noticed. 1247 The VBIED was parked on the side of, and parallel to, the road next to a wall. 1248 The wall next to the VBIED increased the force of the explosion and directed the blast towards the road. 1249 EL-MURR's vehicle came to a stop seven meters from the crater, which indicates where the VBIED had been parked. 1250

1242 PCC 141:60230953-60231103, para.136; PCC 141 :60321499-60321516,para.66; PCC073:D056865 l-D0568907, para.1315.

1243 PCC141:60028755Al_TS_D_EN_Ol, p.49, lines 16-19; PCC263:60302558-60302616, 60302575; PCCl 74:60325073-60325108, 60325086; PCC073:D056865 l-D0568907, para.1315.

1244 D0506163-D0506163; 60002123-60002165, 60002124; PCC073:D0568651-D0568907, para.1318.

1245 PCC073:D056865 l-D0568907, para.1317; PCC254:D055 l 823-D0551937, D0551922-26, paras.27,33-38; PCC250, PCC251, PCC252, PCC253:60326099-60326139, 60326112.

1246 PCC210:60322716-60322736, paras.12,15-19; PCC194:60327216-60327253, para.11; PCC205:60324442-60324464, 60324457; PCC250, PCC251, PCC252, PCC253:60326099-60326139, 60326106,60326112; PCC073:D0568651-D0568907, para.1317.

1247 PCC141 :60230953-60231103, para.136.

1248 PCC250, PCC251, PCC252, PCC253:60326099-60326139, 60326109,60326112; PCC194:60327216- 60327253, 60327223,60327225; 60002123-60002165, 60002127.

1249 PCC250, PCC251, PCC252, PCC253:60326099-60326139, 60326109.

1250 PCC250, PCC25 l, PCC252, PCC253 :60326099-60326139, 60326107; PCC263 :60302558-60302616, 60302567; PCC194:60327216-60327253, 60327223; 60002123-60002165, 60002125.

STL-18-1 O/PT /PTJ 175of185 15 December 2020 Public Redacted R026679

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

470. The exact composition of the explosives is unclear, but High Explosives were used and tests indicated the presence of TNT and RDX. 1251 The estimated quantity of explosives ranged from 35-40 kg 1252 to 65 kg1253 of TNT equivalent. The detonation mechanism remains undetermined as no evidence of the trigger system was recovered. 1254 However, as EL-MURR's car was in motion at the time of the attack, 1255 and given the layout of the crime scene, as well as the placement of the VBIED next to a speedbump and an aiming marker, the charge was detonated using a remote-controlled command initiation system. 1256

471. License plate number [Redacted] was recovered at the crime scene on 12 July 2005. 1257 It did not belong to vehicles damaged by the explosion and was assessed as having been attached to the VBIED. 1258 As seen above, this license plate was pressed on 7 April 2005 when Subject 5 was active in the vicinity of the [Redacted]. 1259

1251 PCC250, PCC251, PCC252, PCC253:60326099-60326139, 60326112, para.5.1.3; PCC194:60327216- 60327253, 60327224,60327238, paras.11,14; 60002123-60002165, 60002129; PCC247:60332842- 60332879, 60332870.

1252 PCC247:60332842-60332879, 60332870; PCC 194:60327216-60327253, 60327224,60327239, paras.16-18.

1253 PCC245:60015868-60015869, 60015869; PCC245 :60253840-60253854, para.21; PCC250, PCC251, PCC252, PCC253:60326099-60326139, 60326112, para.5.1.2.

1254 PCC245:60015868-60015869, 60015869; PCC245 :60253840-60253854, para.25. See also PCC250, PCC251, PCC252, PCC253:60326099-60326139, 60326112, para.6.b.ii.

1255 PCC206:60324497-60324518, para.18 and 60324510.

1256 PCC254:D0551823-D055 l 937, D055 l 913-D055 l 932; PCCl 94:60327216-60327253, 60327224, 60327239, para.21; PCC247:60332842-60332879, 60332870; PCC250, PCC251, PCC252, PCC253:60326099-60326139, 60326112.

1257 PCCl 75:60325109-60325156, para.14; 60002123-60002165, 60002130,60002142,60002157; PCC263:60302558-60302616, 60302611; D0551349-D0551475, D0551462.

1258 PCC 175 :60325109-60325156, paras.12-13; 60002123-60002165, 60002130,60002157; PCC256, PCC257, PCC249:60307870-60307897, 60307888.

1259 PCC184:60332530-60332553, 60332539, 60332549, paras.11-14, 60332553; 60002123-60002165, 60002131; PCC073:D056865 l-D0568907, paras.402-406. See VI.D .2.(b )(i)-(ii).

STL-18-1 O/PT /PTJ 176of185 15 December 2020 Public Redacted R026680

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

(ii) The victims and material damages to surroundings

4 72. The explosion instantly killed Khaled MOURA, 1260 a passing motorist. 1261 MOURA suffered severe burns and fractures to his legs and right forearm. 1262 His body was entirely burnt as a result of the explosion. 1263

473. The explosion seriously injured EL-MURR. 1264 He suffered various second degree burns to his left arm and face, as well as third degree burns to his back. 1265 Both of EL­ MURR's hands were severely injured, 1266 and he lost feeling in both hands. 1267 Pieces of glass were embedded in EL-MURR's body as a result of the explosion, some of which was not removed. 1268 After the attack, EL-MURR spent one week in hospital, followed by two months of care at his home and treatment in Switzerland, and he had additional surgeries. 1269

1260 60121096-60121096; PCC 176:60326597-60326605, paras.15-20, and 60326603; PCC244:60332203- 60332232, 60332212-14,paras.5,16-20,25; PCC266:60332 l 88-60332202, 60332196-97, paras.6-7,9-16.

1261 PCC244:60332203-60332232, 60332213-14, paras.15,21-22,25; PCCl 94:60327216-60327253, 60327223; 60002123-60002165,60002124.

1262 PCCl 76:60326597-60326605, para.21, and 60326603.

1263 60121096-60121096; PCCl 76:60326597-60326605, 60326603; PCC266:60332188-60332202, 60332197, para.15.

1264 PCC141:60230953-60231103, paras.147-150 and 60230979-60231103.

1265 PCC141 :60230953-60231103, para.147 and 60230985.

1266 PCC141 :60230953-60231103, para.147,150 and 60230983-85; PCC141:60028755A 1_TS_ D_EN_ 01, p.50, lines 15-22.

1267 PCCl 41:60230953-60231103, paras.147,150.

1268 PCC141:60230953-60231103, para.147and 60230985.

1269 PCC141 :60230953-60231103, para.148; PCC141 :60028755Al_TS_D_EN_Ol, p.52, lines 6-8.

STL-18-1 O/PT /PTJ 177of185 15 December 2020 Public Redacted R026681

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

474. [Redacted] 1270 and [Redacted] 1271 were also seriously injured by the explosion. [Redacted] suffered first and second degree burns to his head and face, as well as burns to his hand, forearm, stomach, back, and legs. 1272 He also suffered a ruptured right eardrum, and a punctured ribcage caused by shrapnel. 1273 After the attack, he spent approximately three weeks in hospital and underwent surgery. 1274

475. [Redacted] suffered a severe cut to his face and head, as well as fractures of the cheek bone and nose. 1275 His right eye was out of place, and his hearing was also damaged. 1276 After the attack, he spent approximately two weeks in hospital where he underwent surgery for his eye and hearing, and he then recovered at home for several months after that.1277

476. The explosion also injured twelve others. Specifically:

• [Redacted], a [Redacted], suffered a fracture of the kneecap, as well as bruising in his neck, and long-term complications in his neck; 1278

1270 PCCl 98:60302942-60303011, 60302965, para.128; PCCl 98:60330819-60330824, paras. I 0-13; PCC 176:60326597-60326605, 60326601.

1271 PCC058:60331035-6033 I092,6033 I088, para. I08; PCC058:60330797-60330808, paras.9-I I; PCCl 76:60326597-60326605, 60326602.

1272 PCC 198:60302942-60303011, 60302965, para.128; PCC 198:60330819-60330824, para.IO; PCC 176:60326597- 60326605. 60326601.

1273 PCC I 98:60302942-60303011, 60302965, para.128; PCC I 98:60330819-60330824, para. IO; PCC I 76:60326597- 60326605, 6032660 I.

1274 PCCI 98:60302942-60303011, 60302965, para.128; PCCI 98:60330819-60330824, para. I I.

1275 PCC058:6033 I 035-6033 I 092,6033 I 088, para. I 08; PCC058:60330797-60330808, para.9; PCCI 76:60326597-60326605, 60326602.

1276 PCC058:60331035-6033 I092,6033 I088, para. I08; PCC058:60330797-60330808, para.9; PCCl 76:60326597-60326605, 60326602.

1277 PCC058:60331035-6033 I092,6033 I088,para. I08; PCC058:60330797-60330808, para.IO.

1278 PCCI 78:6033 IOI 8-6033 I 034, 6033 I 029-30, paras.8-I 6; PCCI 78:60330777-60330782, paras.8-9.

STL-18-IO/PT /PTJ 178 of 185 I 5 December 2020 Public Redacted R026682

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

• [Redacted], a [Redacted], suffered superficial injuries caused by shattered glass; 1279

• [Redacted], a [Redacted], suffered cuts in her back and injuries to her nose; 1280

• [Redacted], who was in the car with [Redacted], suffered cuts on her hand, face, and leg from shattered glass; 1281

• [Redacted], [Redacted] was being renovated at the time of the attack, suffered minor injuries to his head; 1282

• [Redacted], a [Redacted], suffered bruises on his neck and shoulders from falling

debris· 1283 '

• [Redacted], a [Redacted], suffered bruises on his neck and shoulders accompanied by long-term discomfort, as well as long-term complications in his right hand; 1284

• [Redacted], a [Redacted], suffered injuries to his leg caused by flying shrapnel, hearing damage in both ears, as well as long-term medical issues with his digestion, and regular headaches and dizziness, as a result of the explosion; 1285

• [Redacted], a [Redacted], suffered injuries to his left arm after the explosion caused him to fall off scaffolding, which led to long-term handicap of that arm. He was also

1279 PCC165:60330740-60330761, 60330750-52, paras.7-10,13,16,33; PCC165:60330762-60330768, para.8.

1280 PCC204:60327254-60327270, paras.12-14,23 and 60327260, 60327262-63; PCC204:60330832-60330840, paras.9- 10; 60327481-60327496, 60327482-83.

1281 PCC169:60331661-60331667, paras.8-13 and 60331666; PCC204:60327254-60327270, paras.12-14,22 and 60327260, 60327262-63; PCC204:60330832-60330840, paras.9,11.

1282 PCC267:6033l107-60331132, 60331117-18, paras.7,13-14; PCC267:60330825-6033083 l, paras.8-9.

1283 PCC162:6033084 l-60330858, 60330851-53, paras.7,16-17,26-32; PCCl 62:60330783-60330789, paras.8-10.

1284 PCCl 77:60330547-60330563, 60330556-58, paras.6-7,11-13,20-24,29; PCC 177:60330564-60330570, paras.8-13.

1285 PCCl 64:60330722-60330739, 60330731-33, paras.9,13-14; PCC 164:60330715-60330721, paras.8-12.

STL-18-1 O/PT /PTJ 179of185 15 December 2020 Public Redacted 60302567-70, 60302574-16; PCC194:60327216-60327253, 60327223-24; PCC206:60324497-60324518, paras.17-18 and 60324508-10; PCC162:60330841-60330858, 60330852, paras.20-21; PCCl 79:60330571-60330583, 60330579, para.16; PCC2 l l :60331093-60331106, 60331101- 02,paras.7,23; PCC164:60330722-60330739, 60330733, para.13; PCC195:60330590- 60330620, 60330600,paras.19-20; PCCl 65 :60330740-60330761, 60330751-52, paras.14, 18,32; PCC267:6033 l l 07-60331132, 60331117-18, paras.11, 13; PCC267:60330825-6033083 l, para.10.

1291 PCC073 :D056865 l-D0568907, paras.1319-1321.

STL-18-1 O/PT /PTJ 180of185 15 December 2020 Public Redacted R026684

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

location and identify could not be discovered. 1292 The same pattern of conduct was applied in the attack on HAWI when the phones of A YYASH and other relevant Subjects were inactive in the hours leading up to the attack, and when the attack occurred. 1293

479. After 12 July 2005, AYYASH's contact with BADREDDINE and with the users decreased significantly, while the activity at locations relevant to EL­ MURR stopped completely. 1294 The activity of Subjects 5, 6, 7, 8, and 9 between 29 June 2005 and 8 July 2005 in the vicinity of EL-MURR's crime scene and the surrounding area was exceptional, as in the two-month period before and after the attack there was no regular activity in these areas by those involved in the surveillance operation and in the eventual execution of the attack. 1295 This geographical signature pervades and recurs through all the attacks and is the unequivocal verification that these network users could only be responsible for all the attacks. Any other explanation, based on coincidence, is neither reasonable nor sensible.

480. The call pattern and regular coordinated movements of the Subjects at the locations relevant to EL-MURR from 29 June 2005 to 8 July 2005 reflect the surveillance activity conducted by the Subjects, with A YYASH coordinating the operation through his communication with BADREDDINE and Subject 6, while the cessation of this activity at the relevant locations after the attack demonstrates the end to the operational necessity to be in the relevant areas after the execution of the attack on EL-MURR.

1292 PCC073:DOS686Sl-DOS68907, paras.1322-1328.

1293 PCC073:DOS686Sl-DOS68907, para.1327.

1294 PCC073:DOS686Sl-DOS68907, paras.1344,1349,1400-140S, 1417; PCC073:DOS68996-DOS69028, para.61.

1295 PCC073 :DOS686S l -DOS 68907, paras.13 3 6-1342; PCC073 :DOS 68996-DOS 69028, paras. 84-8S.

STL-18-1 O/PT /PTJ 181of18S l S December 2020 Public Redacted R026685

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

VII. INDIVIDUAL CRIMINAL RESPONSIBILITY OF AYYASH

481. The Prosecution gives notice of its intent to lead evidence of a consistent pattern of conduct through evidence of the HARIRI attack. It may be recalled that the Tribunal's jurisdiction over the Connected Cases is founded upon the connectivity between the attacks, with respect to the nature and gravity of the crimes and the elements enumerated in Article 1 of the Statute, namely: criminal intent (motive); the purpose behind the attacks; the nature of the victims targeted; the pattern of the attacks (modus operandi) and the perpetrators. 1296

482. Like other evidence presented before the Tribunal, evidence of a consistent pattern of conduct is admissible under Rule 149 when it is relevant and probative, so long as its probative value is not outweighed by its prejudicial effect. 1297 The Lebanese Criminal Code of Procedure likewise does not exclude the admission of evidence of consistent pattern of conduct. 1298 This also accords with the admissibility of consistent pattern of conduct evidence, on a case by case basis, at the ad hoc tribunals and the ICC. 1299

483. The evidence is relevant and probative of the crimes charged in the Indictment for several reasons. First, as contextual or background evidence to place the charged offending in its proper context; second, as probative of the identity of the perpetrators of the crimes and to rebut coincidence or innocent association; third as probative of an agreement between the alleged perpetrators; and finally, as probative of AYYASH's knowledge and intent.

484. It is necessary to lead evidence of the attack against HARIRI to place the charged offending in its full and proper context. 1300 The evidence is required to demonstrate the

1296 Article 1 of the Statute.

1297 Rules 149(C)-(D). See e.g. STL, F3 l 96, para.27; STL, F0774, para.15; STL, F3697, para.55; STL, FOl 73, para.27.

1298 See Lebanese Code of Criminal Procedure, Art.179. See also Lebanon, Court of Cassation, Criminal Chamber 6, Decision No. 33/99, 16 February 1999.

1299 See e.g. Rule 114 of the MICT Rules and Rule 93 of the ICTY, ICTR and SCSL Rules; ICTR, Bagosora Evidence Decision, para.13; ICTR, Bagosora Admissibility Decision, para.38.

1300 See e.g. ICTR, Separate Opinion of Judge Shahabuddeen, para.21

STL-18-1 O/PT /PTJ 182of185 15 December 2020 Public Redacted R026686

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

continuum of events from the first attack against HAMADE to the final one against EL­ MURR. It would be artificial and incomplete for the Prosecution to present its case at trial without reference to this evidence, especially having regard to the victims targeted and the political context in which all four of these fundamentally similar attacks were perpetrated. 1301 Furthermore, it is alleged that the crimes charged were perpetrated though the use of the same inter-connected covert telephone Networks that were used in the HARIRI attack. Without the evidence of the patterns and locations of use of these Networks and their inexorable link to the execution of the HARIRI Attack, the evidence of the crimes indicted could not be accurately understood.

485. Significantly, evidence of the HARIRI attack is relevant and probative of the identity of the perpetrators of the attacks against HAMADE, HAWI and EL-MURR and is admissible to rebut coincidence or innocent association. The continuum and pattern of evidence across all four attacks demonstrates that AYY ASH was the user of multiple phones used within inter-connected covert Networks which are attributed to him through frequent and repeated co-location with his personal mobile phones. The recurrent association of the same inter-connected phones and covert Networks with each of the victims movements and in connection with the eventual crime scenes over a ten month period, and only within specific periods prior to each attack, leaves no doubt that their association cannot sensibly be coincidence or innocent.

486. In addition, the consistent pattern of conduct across the four attacks also demonstrates the degree of coordination, common purpose, and cooperation evidencing that these attacks could not have been the premediated acts of just one person. 1302 The extent of coordination, including surveillance, use of High Explosives, and sequential call flows points to the existence of a conspiracy or multiple conspiracies aimed at committing a series of terrorist acts by the same group of perpetrators.

487. Finally, the evidence is relevant and probative of AYYASH's knowledge and intent in relation to the charged offences including that IED or VBIEDs would be used in each attack. In particular the evidence of the inter-connectivity of the Networks and

1301 See e.g. ICTR, Separate Opinion of Judge Shahabuddeen, para.21; ICC, Katanga and Chui Decision, para.228.

1302 See e.g. ICTY, Seselj Appeal Decision, paras.24-25.

STL-18-1 O/PT /PTJ 183of185 15 December 2020 Public Redacted R026687

STL-18-1 O/PT /PTJ F0257/A07/PRV/20201215/R026503-R026688/EN/dm

AYYASH's use of the Red Network, necessary to direct the suicide VBIED into position as HARIRI made his way home from Parliament, is probative of his knowledge and the purpose of the targeted surveillance in the subsequent attacks.

488. The totality of the evidence, which is both inter-connected and cumulative, when evaluated holistically and in its entirety, will demonstrate that A YYASH with BADREDDINE and other unidentified participants acting under their direction, were criminally responsible for the attacks against HAMADE, HAWI, and EL-MURR. These attacks, as well as the HARIRI attack, were all prepared, planned and executed by the same core group of participants: using the same inter-connected covert Network and mobile phones; utilising surveillance and patterns of phone use adapted to the circumstances of each victim; all of which were directed towards the effective placement and detonation of IED or VBIEDs. The degree of planning and sophistication, and the method of each attack, inter alia confirm the existence of a conspiracy or criminal association, the relevant intent to kill, the intent to create a state of terror and, ultimately, AYYASH's criminal responsibility for each of the five crimes indicted.

STL-18-1 O/PT /PTJ 184ofl85 15 December 2020 Public Redacted It*\ ~·~ -...... STL-18-1 O/PT /PTJ 185of185 15 December 2020 Public Redacted