Legal Representatives of Victims: Counsel for Mr. Hassan Habib Merhi: Mr. Peter Haynes, Mr. Mohammad F Mattar Mr. Mohamed Aouini, Ms. Dorothee Le Fraper & Ms. Nada Abdelsater-Abusamra du Hellen & Mr. Jad Youssef Khalil
Counsel for Mr. Assad Hassan .,llll~-..... ~ Mr. David Young, Mr. Geoffrey o~~~~ Ms.Sarah Bafadhel R305221
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
NARRATIVE OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
Contents
Sunday, 22 August 2004 ...... 21 A. Growing Opposition to Syrian Control in Lebanon ...... 21 Tuesday, 24 August 2004 ...... 21 A. President Lahoud Announced that He Was Seeking to Extend his Mandate ...... 21 Wednesday, 25 August 2004 ...... 22 A. Rustom Ghazaleh Summoned Prime Minister Hariri to Damascus ...... 22 Thursday, 26 August 2004 ...... 22 A. Prime Minister Hariri Met with President Al-Assad in Damascus ...... 22 B. The December 2003 Meeting: Prime Minister Hariri, President Al-Assad and the "Damascus Protocol" ...... 23 Saturday, 28 August 2004 ...... 24 A. Prime Minister Hariri Initiated President Lahoud's Extension ...... 24 Wednesday, 1 September 2004 ...... 25 A. Growing Calls for Syrian Withdrawal from Lebanon ...... 25 B. Syrian and Lebanese Representations to UN Security Council ...... 25 Thursday, 2 September 2004 ...... 26 A. UNSC Resolution 1559 Adopted ...... 26 Friday, 3 September 04 ...... 26 A. President Lahoud's Term Extended ...... 26 Saturday, 4 September 2004 ...... 27 A. Qornet-Chehwan Gathering Held an Extraordinary Meeting Condemning the Constitutional Amendment ...... 27 Monday, 6 September 2004 ...... 27 A. Green Network Activity: First Use of Green 023 by Mustafa Badreddine ...... 27 Tuesday, 7 September 2004 ...... 28 A. Marwan Hamade and Other Ministers Resigned ...... 28 Monday, 13 September 2004 ...... 28 A. Prime Minister Hariri Announced that his Government Would Resign by the End of the Month ...... 28 B. Democratic Gathering Announced Preparation of "Ten Point" Document ...... 28 Wednesday, 15 September 2004 ...... 29 R305222
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
A. Prime Minister Hariri Agreed to Postpone his Resignation ...... 29 Thursday, 16 September 2004 ...... 30 A. Salim Ayyash travelled to Anjar/ Syrian Border Area ...... 30 B. Contact with Wafik Safa and S9 en-route to Anjar/ Syrian Border area ...... 30 C. Selected Attribution Points for Salim Ayyash ...... 31 D. Prime Minister Hariri Met President Chirac in Paris ...... 31 Wednesday, 22 September 2004 ...... 32 A. First Bristol Group Meeting ...... 32 B. Prime Minister Hariri Met with Hassan Nasrallah ...... 32 C. Rustom Ghazaleh Travelled to Haret Hreik Following the Hariri/Nasrallah Meeting ...... 33 D. Hussein Khalil visited Quraitem Palace after Meeting Rustom Ghazaleh & Wafik Safa ...... 34 Friday, 24 September 2004 ...... 35 A. Prime Minister Hariri at Quraitem Palace ...... 35 B. Green Network Activity: First Day of Hassan Merhi's Green Phone and First Contact between Hassan Merhi and Mustafa Badreddine ...... 35 C. Wafik Safa in contact with the Green Phone Subscriptions Contact Number ...... 35 Saturday, 25 September 2004 ...... 37 A. Prime Minister Hariri's Activity: Meeting with Maronite Patriarch in Bkirki ...... 37 Monday, 27 September 2004 ...... 38 A. Prime Minister Hariri Met with Hassan Nasrallah ...... 38 Tuesday, 28 September 2004 ...... 39 A. Prime Minister Hariri 's Activities ...... 39 B. Second Visit of Rustom Ghazaleh to Haret Hreik in Six Days ...... 39 C. Salim Ayyash Travelled to the Anjar/ Syrian Border Area ...... 40 D. Selected Attribution Points for Salim Ayyash: PMP 935 Switched to Salim Ayyash's BMW Handset Again ...... 40 Wednesday, 29 September 2004 ...... 41 A. Prime Minister Hariri Met President Chirac in France ...... 41 B. Salim Ayyash and S9 Briefly Travelled to Eastern Lebanon Again ...... 41 C. Hassan Merhi in Rare Contact with Salim Ayyash ...... 41 D. Selected Attribution Points for Hassan Merhi ...... 42 Thursday, 30 September 2004 ...... 43 A. Prime Minister Hariri in Paris ...... 43 B. First Day of Salim Ayyash's Green Phone Use and Green/Yellow Inter-connectivity ...... 43 C. Mustafa Badreddine in Contact with the Green Phone Subscription Contact Number ...... 43 D. Selected Attribution Points for Salim Ayyash ...... 44 E. Selected Attribution Points for Mustafa Badreddine ...... 44
2 R305223
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 1 October 2004 ...... 45 A. Prime Minister Rafik Hariri Abroad ...... 45 B. UN Secretary General's Report on UNSC Resolution 1559 Released ...... 45 C. Attempted Assassination of Marwan Hamade ...... 45 D. Green and Yellow Network lnterconnectivity ...... 45 E. Selected Attribution Points for Salim Ayyash ...... 46 F. Selected Attribution Points for Mustafa Badreddine ...... 46 Saturday, 9 October 2004 ...... 4 7 A. President Al-Assad Condemned UNSC Resolution 1559 ...... 47 Sunday, 10 October 2004 ...... 48 A. Nasser Kandil Launched Heavy Attack on UNSC Resolution 1559 and the Opposition ...... 48 Wednesday, 13 October 2004 ...... 49 A. Green Network Tightened Operational Security ...... 49 Saturday, 16 October 2004 ...... 50 A. Prime Minister Hariri Met with US Ambassador ...... 50 Sunday, 17 October 2004 ...... 51 A. Prime Minister Rafik Hariri Met with Hussein Khalil...... 51 Monday, 18 October 2004 ...... 52 A. Prime Minister Hariri at Quraitem Palace ...... 52 B. First Day of Blue Network Activity ...... 52 Tuesday, 19 October 2004 ...... 53 A. Prime Minister Rafik Hariri Attended Parliament and Discussed his Imminent Resignation and Later Met with Hussein Khalil ...... 53 B. Green and Blue Network Activity: Second Day of Closed-User Group Activity for Both Networks ...... 53 C. President of UN Security Council Expressed Concern at Non-Implementation ofUNSC Resolution 1559 ...... 53 Wednesday, 20 October 2004 ...... 55 A. Prime Minister Rafik Hariri Resigned ...... 55 B. Rafik Hariri met with Hussein Khalil and Nasser Kandil...... 55 C. First Day of Blue Network Surveillance around Quraitem Palace ...... 55 D. Green Network Activity: Mustafa Badreddine and Salim Ayyash Meeting ...... 56 E. Selected Attribution Points for Salim Ayyash ...... 56 F. Selected Attribution Points for Mustafa Badreddine ...... 56 Thursday, 21 October 2004 ...... 57 A. Rafik Hariri at Quraitem Palace ...... 57 B. Omar Karami Appointed Prime Minister of Lebanon ...... 57 C. Blue Network Phones: Surveillance of Quraitem Palace ...... 57
3 R305224
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 22 October 2004 ...... 58 A. Blue Network Activity: First Day of Mobile Surveillance ofRafik Hariri ...... 58 B. Selected Attribution Points for Salim Ayyash ...... 58 Saturday, 23 October 2004 ...... 59 A. Rafik Hariri at Quraitem Palace ...... 59 B. Blue Network Activity in Dahyieh ...... 59 Sunday, 24 October 2004 ...... 60 A. Rafik Hariri Travelled to Paris ...... 60 B. No Network Activity ...... 60 Monday, 25 October 2004 ...... 61 A. Rafik Hariri Abroad ...... 61 B. Blue Network Activity: Only One Call...... 61 Tuesday, 26 October 2004 ...... 62 A. Rafik Hariri in Paris ...... 62 B. Prime Minister Hariri's Resignation became Official ...... 62 C. Limited Blue Network Activity ...... 62 Wednesday, 27 October 2004 ...... 63 A. Rafik Hariri Returned to Lebanon and met with Beirut Decision Bloc and with "Syrian Deposits" ...... 63 B. Limited Blue Network Activity in Dahyieh ...... 63 Thursday, 28 October 2004 ...... 64 A. Rafik Hariri at Quraitem Palace ...... 64 B. Blue Network Activity: Only One Call...... 64 C. Green Network Activity: Green Phone Bills Paid and Salim Ayyash and Mustafa Badreddine in Contact ...... 64 D. Selected Attribution Points for Salim Ayyash ...... 64 Friday, 29 October 2004 ...... 65 A. Rafik Hariri at Quraitem Palace ...... 65 B. Limited Blue Network Activity ...... 65 Saturday, 30 October 2004 ...... 66 A. Rafik Hariri at Quraitem Palace ...... 66 B. Limited Blue Network Activity ...... 66 C. Rustom Ghazaleh Visited Haret Hreik ...... 66 Sunday, 31 October 2004 ...... 67 A. Rafik Hariri at Quraitem Palace ...... 67 B. No Green or Blue Network Activity ...... 67 Monday, 1 November 2004 ...... 68
4 R305225
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
A. Rafik Hariri at Quraitem Palace ...... 68 B. Blue Network Activity: Surveillance of Quraitem Palace ...... 68 C. One Green Network between Salim Ayyash and Mustafa Badreddine ...... 68 Tuesday, 2 November 2004 ...... 69 A. Rafik Hariri at Quraitem Palace ...... 69 B. Blue Network Activity: Surveillance of Quraitem Palace ...... 69 Wednesday, 3 November 2004 ...... 70 A. Rafik Hariri Travelled to Italy at Mid-Day ...... 70 B. Blue Network Activity: Surveillance of Quraitem Palace ...... 70 C. Selected Attribution Points for Salim Ayyash ...... 70 Thursday, 4 November 2004 ...... 71 A. Rafik Hariri Returned to Lebanon Briefly before Travelling to Abu Dhabi ...... 71 B. Blue Network Activity: Continued Daily Surveillance ofQuraitem Palace ...... 71 Friday, 5 November 2004 ...... 72 A. Rafik Hariri Returned to Beirut ...... 72 B. Blue Network Activity: Surveillance of Quraitem Palace ...... 72 Saturday, 6 November 2004 ...... 73 A. Rafik Hariri at Quraitem Palace ...... 73 B. Green Network Activity: Hassan Merhi (Only Contact until23 December) and Salim Ayyash both called Mustafa Badreddine ...... 73 C. Limited Blue Network Activity in Dahyieh ...... 73 Sunday, 7 November 2004 ...... 74 A. Rafik Hariri at Quraitem Palace ...... 7 4 B. No Green or Blue Network Activity ...... 74 Monday, 8 November 2004 ...... 75 A. Rafik Hariri at Quraitem Palace and Visited Marwan Hamade ...... 75 B. Blue Network Activity: Surveillance at Quraitem Palace and Marwan Hamade's Residence .... 75 Tuesday, 9 November 2004 ...... 76 A. Rafik Hariri at Quraitem Palace and Met with UN Secretary General's Representative in Lebanon, Staffan de Mistura ...... 76 B. Blue Network Activity: Surveillance ofQuraitem Palace ...... 76 C. Purple Phone Activity: Hussein Oneissi and Hassan Merhi's First Contact in Over Two Weeks ·························································································································································· 76 Wednesday, 10 November 2004 ...... 77 A. Rafik Hariri Attended Iftar Ceremony and Gave a Speech on the New Electoral Law ...... 77 B. Blue Network Activity: Surveillance of Quraitem Palace ...... 77 C. Green Network Activity: Last Green Contact between Salim Ayyash and Mustafa Badreddine until 20 December ...... 77
5 R305226
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. Purple Phone Activity: First Contact between Hassan Merhi and Assad Sabra in Almost Three Weeks ...... 78 E. Selected Attribution Points for Mustafa Badreddine and Salim Ayyash ...... 78 Thursday, 11 November 2004 ...... 79 A. Rafik Hariri Travelled to Saudi Arabia in the Afternoon ...... 79 B. Blue Network Surveillance of Rafik Hariri at Quraitem Palace and the Airport ...... 79 C. Purple Phone Activity ...... 79 Friday, 12 November 2004 ...... 80 A. Rafik Hariri Abroad ...... 80 B. Blue Network Activity: No Blue Activity around Quraitem Palace in Rafik Hariri's Absence .. 80 C. Hassan Nasrallah Affirmed Alliance with Syria and Rejected UNSC Resolution 1559 in Speech ·························································································································································· 80 D. Purple Phone Activity ...... 81 Saturday, 13 November 2004 ...... 81 A. Rafik Hariri Returned to Beirut ...... 81 B. Hassan Merhi and Salim Ayyash Unusually in Contact ...... 81 Sunday, 14 November 2004 ...... 82 A. Rafik Hariri at Quraitem Palace ...... 82 B. No Blue or Green Network Activity ...... 82 Monday, 15 November 2004 ...... 83 A. Rafik Hariri at Quraitem Palace ...... 83 Tuesday, 16 November 2004 ...... 84 A. Rafik Hariri at Quraitem Palace ...... 84 B. No Blue Network Activity ...... 84 Wednesday, 17 November 2004 ...... 85 A. Rafik Hariri at Quraitem Palace ...... 85 B. US Ambassador Underscored Importance oflmplementing UNSC Resolution 1559 ...... 85 Thursday, 18 November 2004 ...... 86 A. Rafik Hariri Travelled to France ...... 86 Friday, 19 November 2004 ...... 87 A. Rafik Hariri in Paris ...... 87 B. No Blue Network Activity ...... 87 Saturday, 20 November 2004 ...... 88 A. Rafik Hariri Abroad ...... 88 Sunday, 21 November 2004 ...... 89 A. Rafik Hariri Abroad ...... 89 Monday, 22 November 2004 ...... 90
6 R305227
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
A. Rafik Hariri Abroad ...... 90 B. Blue Network Activity: First Contact in Ten Days ...... 90 Tuesday, 23 November 2004 ...... 91 A. Rafik Hariri Abroad ...... 91 B. Blue Network Activity: Surveillance ofQuraitem Palace ...... 91 Wednesday, 24 November 2004 ...... 92 A. Rafik Hariri Returned to Beirut in the Afternoon ...... 92 B. Blue Network Activity: Surveillance of Quraitem Palace ...... 92 Thursday, 25 November 2004 ...... 93 A. Rafik Hariri at Quraitem Palace ...... 93 B. Blue Network Activity: Surveillance of Quraitem Palace ...... 93 Friday, 26 November 2004 ...... 94 A. Rafik Hariri at Quraitem Palace and Met with Mr. Roed-Larsen ...... 94 B. Blue Network Activity: Surveillance of Quraitem Palace ...... 94 Saturday, 27 November 2004 ...... 95 A. Rafik Hariri Confirmed He Would Run in Elections ...... 95 B. Rafik Hariri Met with Hassan Nasrallah ...... 95 C. Contact between Wafik Safa, Rustom Ghazaleh & the "Hassan Nasrallah" Subscribed Landline in Advance of the Hariri/Nasrallah Meeting ...... 95 D. No Blue or Green Network Activity ...... 96 Sunday, 28 November 2004 ...... 97 A. Rafik Hariri Received Visitors at Quraitem Palace and Travelled to Egypt and Monte Carlo ... 97 B. No Blue or Green Network Activity ...... 97 Monday, 29 November 2004 ...... 98 A. Rafik Hariri Abroad ...... 98 B. Blue Network Activity: Last Day of Activity around Quraitem Palace until 17 December Coinciding with Rafik Hariri Absence Abroad for All but Three Days ...... 98 Tuesday, 30 November 2004 ...... 99 A. Rafik Hariri Abroad ...... 99 B. Large Demonstration Denouncing UNSC Resolution 1559 and Supporting Syria Led by Hezbollah and Hosted by Nasser Kandil ...... 99 C. Heavy Contact between Syrian Military Intelligence and Hezbollah Officials ...... 99 D. Blue Network Activity ...... lOO Wednesday, 1 December 2004 ...... 101 A. Rafik Hariri Abroad ...... 10 1 B. Limited Blue Network Activity ...... 101 Thursday, 2 December 2004 ...... 102 A. Rafik Hariri Abroad ...... 102
7 R305228
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
B. Limited Blue Network Activity ...... 102 Friday, 3 December 2004 ...... 103 A. Rafik Hariri Abroad ...... 103 Saturday, 4 December 2004 ...... 104 A. Rafik Hariri Abroad ...... 104 B. Limited Blue Network Activity ...... 104 Sunday, 5 December 2004 ...... 105 A. Rafik Hariri Abroad ...... 105 Monday, 6 December 2004 ...... 106 A. Rafik Hariri Abroad ...... 106 B. Limited Blue Network Activity ...... 106 Tuesday, 7 December 2004 ...... 107 A. Rafik Hariri Abroad ...... 107 B. Limited Blue Network Activity ...... 107 Wednesday, 8 December 2004 ...... 108 A. Rafik Hariri Abroad ...... 108 Thursday, 9 December 2004 ...... 109 A. Rafik Hariri Returned to Lebanon for Three Days ...... 109 Friday, 10 December 2004 ...... 110 A. Rafik Hariri at Quraitem Palace ...... 110 B. Limited Blue Network Activity ...... 110 Saturday, 11 December 2004 ...... 111 A. Rafik Hariri at Quraitem Palace ...... Ill B. Almost No Network Phone Activity ...... Ill Sunday, 12 December 2004 ...... 112 A. Rafik Hariri Travelled to Dubai in the Evening ...... 112 B. No Blue Network Activity ...... 112 Monday, 13 December 2004 ...... 113 A. Rafik Hariri Abroad ...... 113 B. No Blue Network Activity ...... 113 C. Second Bristol Group Meeting Took Place ...... 113 D. Rustom Ghazaleh Visited Haret Hreik for the First Time in Six Weeks Following the Second Bristol Group Meeting ...... 114 E. First Contact between Mustafa Badreddine and Wafik Safa in Around Three Weeks ...... 115 F. Purple Phones: First of Four Days Assad Sabra Travelled to Tripoli ...... 115 Tuesday, 14 December 2004 ...... 116 A. Rafik Hariri Commented on Bristol Group Meeting and Supported Walid Jumblatt ...... 116
8 R305229
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
B. Appointment ofTerje Rod-Larsen as UN Special Envoy on Implementation ofUNSC Resolution 1559 Announced ...... 116 C. Limited Blue Phone Activity ...... 116 Wednesday, 15 December 2004 ...... 118 A. Rafik Hariri Abroad ...... 118 B. Purple Phone Activity: Second Day Assad Sabra Travelled to Tripoli ...... 118 Thursday, 16 December 2004 ...... 119 A. Prime Minister Rafik Hariri Returned to Beirut with Mustafa Nasser who went Directly to Haret Hreik and Contacted Hezbollah Officials ...... 119 B. Rustom Ghazaleh Visited Haret Hreik & Contacted the Syrian Presidential Palace ...... 119 C. Purple Phone Activity ...... 120 Friday, 17 December 2004 ...... 121 A. Rafik Hariri at Quraitem Palace, Attended Prayers with Mufti Qabbani, then Travelled to Paris ························································································································································ 121 B. Blue Phone Activity: First Surveillance ofRafik Hariri in Almost Three Weeks ...... 121 Saturday, 18 December 2004 ...... 122 A. Rafik Hariri Abroad ...... 122 B. Blue Phone Activity: First Blue Contact on the Route to Faqra ...... 122 C. Purple Phone Activity ...... 122 D. Continuation of Unusually Intensive Contact between Mustafa Badreddine and Wafik Safa .. 122 Sunday, 19 December 2004 ...... 124 A. Rafik Hariri Abroad ...... 124 Monday, 20 December 2004 ...... 125 A. Rafik Hariri Returned to Beirut and Met with Mustafa Nasser Who Was in Contact with Hezbollah Officials ...... 125 B. New Phase of Green Network: Beginning ofMarked Escalation in Green Call Activity Amidst the Escalating Threat to Syrian Control in Lebanon ...... 125 C. End of a Week of Unusually Frequent Contact between Mustafa Badreddine & Wafik Safa ... 127 D. Purple Phones: Third Day Sabra Travelled to Tripoli ...... 127 Tuesday, 21 December 2004 ...... 128 A. Rafik Hariri Met with Hassan Nasrallah ...... 128 B. Overview ofNetwork Activity: First "Principal Six" Surveillance ofRafik Hariri ...... 128 C. Green Network Activity: Salim Ayyash's Presence in the Vicinity Before and Throughout the Hariri/Nasrallah Meeting ...... 129 D. Blue and Yellow Network Activity: Surveillance ofRafik Hariri around Quraitem Palace & the Meeting with Hassan Nasrallah in Haret Hreik ...... l29 E. Salim Ayyash Coordinated Yellow and Blue Activity ...... 130 F. Selected Attribution Points for Salim Ayyash ...... 131 G. Selected Attribution Points for Mustafa Badreddine ...... 131
9 R305230
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 22 December 2004 ...... 132 A. Rafik Hariri Met with Patriarch Sfeir and Confirmed their Joint Support for the Taif Agreement and Non-Confessionally Based Electoral Divisions ...... 132 B. Green Network Activity: Mustafa Badreddine Contacted Salim Ayyash Once ...... 132 C. Blue Network Activity: Surveillance at Quraitem Palace ...... 132 D. Purple Phone Activity: First Call Activity Near the Arab University Mosque ...... 133 E. Selected Attribution Points for Salim Ayyash ...... 133 F. Selected Attribution Points for Mustafa Badreddine ...... 134 Thursday, 23 December 2004 ...... 135 A. Rafik Hariri at Quraitem Palace and the Constitutional Council...... 135 B. Green Network Activity: First Green 071 [Merhi] Activity for Seven Weeks ...... 135 C. Blue Network Activity: Expansion of the Blue Network to Six Phones, which Became the Principal Six Members of the Blue & Red Networks ...... 135 D. Blue Network Activity: Surveillance of Quraitem Palace ...... 135 E. Selected Attribution Points for Salim Ayyash ...... 135 F. Selected Attribution Points for Mustafa Badreddine ...... 136 Friday, 24 December 2004 ...... 13 7 A. Rafik Hariri at Quraitem Palace and Travelled to Faqra Villa in the Evening ...... 137 B. Blue and Yellow Network Activity: Surveillance ofQuraitem Palace ...... 137 C. Purple Phone Activity: Final Day Assad Sabra Travelled to Tripoli ...... 137 D. Salim Ayyash's Activity and Selected Attribution Points ...... 137 Saturday, 25 December 2004 ...... 138 A. Rafik Hariri Met with Ahmad Nassir Al-Asaad and Mustafa Nasser at Faqra Villa ...... 138 B. Blue and Yellow Network Activity: First Day of Surveillance in Faraya ...... 138 C. Purple Phones: Hassan Merhi Successive Contact with Assad Sabra and Hussein Oneissi ...... 139 D. Selected Attribution Points for Salim Ayyash ...... 139 E. Mustafa Badreddine Travelled to Faraya ...... 139 Sunday, 26 December 2004 ...... 140 A. Rafik Hariri at Faqra Villa ...... 140 B. Blue and Yellow Phone Activity: Surveillance ofRafik Hariri in Faraya ...... 140 C. Purple Phone Activity: Contact between Hassan Merhi and Hussein Oneissi ...... 141 D. Selected Attribution Points for Salim Ayyash ...... 141 Monday, 27 December 2004 ...... 142 A. Rafik Hariri Returned to Quraitem Palace from Faqra ...... 142 B. Green Network Activity: Hassan Merhi & Salim Ayyash Proximate Calls to Mustafa Badreddine ...... 142 C. Green Network Activity: Salim Ayyash and Mustafa Badreddine Meeting & Hierarchical Green Yellow Call Flow ...... 142
10 R305231
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. Blue and Yellow Network Activity: Surveillance at Faqra en-route to Quraitem Palace ...... 143 E. No Purple Phone Contact ...... 144 Tuesday, 28 December 2004 ...... 145 A. Rafik Hariri at Quraitem Palace ...... 145 B. Hierarchical GreenlY ell ow Call Flow and Purchase of Red SIM Cards in Tripoli ...... 145 C. Blue Network Surveillance ofQuraitem Palace ...... 146 D. Purple Phone Activity: Hassan Merhi and Hussein Oneissi Cotnact...... 146 E. Selected Attribution Points for Salim Ayyash ...... 146 F. Select Attribution Points for Mustafa Badreddine ...... 146 Wednesday, 29 December 2004 ...... 147 A. Rafik Hariri at F aqra ...... 14 7 B. Blue and Yellow Network Active around Faraya and Quraitem Palace ...... 147 C. Purple Phones: First Day of 10 Day Period of Almost Daily Activity around Arab University Mosque ("COLA Phase") ...... 147 D. Mustafa Badreddine Travelled to Faraya ...... 148 E. Selected Attribution Points for Salim Ayyash ...... 148 Thursday, 30 December 2004 ...... 149 A. Rafik Hariri Returned to Quraitem Palace ...... 149 B. Yellow Network Activity: Purchase of Red Handsets in Tripoli (S8 and S9) ...... 149 C. Blue and Yellow Network Activity: Surveillance ofRafik Hariri's Return from Faraya ...... 149 D. Purple Phone Activity: Second Day of 10 Day "COLA Phase" of Almost Daily Activity around Arab University Mosque ...... 150 Friday, 31 December 2004 ...... 152 A. Rafik Hariri at Quraitem Palace then Faqra Villa ...... 152 B. Green, Blue and Yellow Phone Activity: Surveillance ofRafik Hariri's travel to Faqra ...... 152 C. Purple Phone Activity: Third Day of 10 Day "COLA Phase" of Almost Daily Activity around Arab University Mosque ...... 153 Saturday, 1 January 2005 ...... 155 A. Rafik Hariri Returned from Faqra, Visited Marwan Hamade and Travelled to Paris ...... 155 B. Blue Network Activity: Surveillance of Rafik Hariri around Faraya, Quraitem Palace and Marwan Hamade's Residence ...... 155 C. Purple Phones: Fourth Day of 10 Day "COLA Phase" of Almost Daily Activity around the Arab University Mosque ...... 156 D. Selected Attribution Points for Salim Ayyash ...... 157 Sunday, 2 January 2005 ...... 158 A. Rafik Hariri in Paris ...... 158 B. No Blue Network and Limited Green & Yellow Network Activity ...... 158 C. Purple Phones: Only Day Purple Phones Not in Arab University Mosque Area in 10 Day "COLA Phase" ...... 158
11 R305232
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. Selected Attribution Points for Mustafa Badreddine ...... 159 Monday, 3 January 2005 ...... 160 A. Rafik Hariri Abroad ...... 160 B. Limited Blue Network Activity ...... 160 C. Purple Phone Activity: Sixth Day of 10 Day "COLA Phase" of Almost Daily Activity around Arab University Mosque ...... 160 Tuesday, 4 January 2005 ...... 162 A. Rafik Hariri Abroad ...... 162 B. Red Network Activity: Set-Up in Tripoli ...... 162 C. Blue & Yellow Network Activity: S6/S9 in Tripoli when Red Phones Activated and Limited Blue Activity ...... 162 D. Purple & Yellow Network Activity: Indirect Link between Salim Ayyash/ Assad Sabra ...... 163 E. Purple Phone Activity: Seventh Day of 10 Day "COLA Phase" of Almost Daily Activity around Arab University Mosque ...... 163 Wednesday, 5 January 2005 ...... 164 A. Rafik Hariri Abroad ...... 164 B. Blue & Yellow Network Activity: Repair ofRed Handset in Tripoli (S8) ...... 164 C. Purple Phone Activity: Eighth Day of 10 Day "COLA Phase" of Almost Daily Activity around Arab University Mosque ...... 164 D. Rustom Ghazaleh Visited Haret Hreik and Wafik Safa Contact with Mustafa Badreddine ...... 164 E. Selected Attribution Points for Mustafa Badreddine ...... 165 Thursday, 6 January 2005 ...... 166 A. Rafik Hariri Abroad ...... 166 B. Limited Blue Network Activity ...... 166 C. Purple Phone Activity: Ninth Day of 10 Day "COLA Phase" of Almost Daily Activity around Arab University Mosque ...... 166 Friday, 7 January 2005 ...... 167 A. Rafik Hariri Returned to Lebanon ...... 167 B. Expansion of Blue Network from Principal Six and Increase in Activity Coincident with Rafik Hariri's Return ...... 167 C. Final Day ofYellow Network: Mr. Ayyash Stopped Using Yellow 294 and Started Using Semi- Covert PMP 170 ...... 167 D. Blue and Yellow Network Surveillance ofRafik Hariri at Airport and Quraitem Palace ...... 168 E. Purple Phone Activity: Final Day of 10 Day "COLA Phase" of Almost Daily Activity around Arab University Mosque ...... 168 Saturday, 8 January 2005 ...... 170 A. Rafik Hariri Met with Two Syrian Deposits at Quraitem Palace ...... 170 B. Blue Network Continued to Expand ...... 170 C. Blue Network: Surveillance of Quraitem Palace ...... 170
12 R305233
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. No Inter-Purple Phone Activity Following End of"COLA Phase" ...... 170 Sunday, 9 January 2005 ...... 171 A. Rafik Hariri Had Final Meeting with Rustom Ghazaleh and Refused to Accept Any Syrian Deposits on his Electoral List ...... 171 B. Before Meeting Rafik Hariri, Rustom Ghazaleh in Contact with Hezbollah and Syrian Presidential Palace ...... 171 C. After Meeting Rafik Hariri, Rustom Ghazaleh Went Directly to Haret Hreik ...... 171 D. After Rustom Ghazaleh's Visit: Contact with Syrian Presidential Palace and Wafik Safa Contact with Mustafa Badreddine ...... 172 E. Rafik Hariri Met with Hassan Nasrallah ...... 173 F. Blue Network Continued to Expand ...... 173 G. No Inter-Purple Phone Activity Following End of"COLA Phase" ...... 173 H. Selected Attribution Points for Mustafa Badreddine ...... 173 Monday, 10 January 2005 ...... 174 A. Rafik Hariri Met with Ali Jaber and Hani Hammond (Warning of Threat from Syrian Regime) ...... 174 B. Rafik Hariri's Alliance with Walid Jumblatt ...... 174 C. Blue Network: First Use of Blue 233 ...... 174 D. Limited Purple Phone Activity following the End of the "COLA Phase" ...... 175 Tuesday, 11 January 2005 ...... 176 A. Rafik Hariri Met with Ahmad Nassir Al-Asaad (Warning from President ofHezbollah's Political Committee) ...... 17 6 B. First Day of the Primary Phase of Green Network Activity ...... 176 C. Green Network Activity: Salim Ayyash Travelled to the Vicinity of the Tripoli Vehicle Dealership ...... 177 D. Salim Ayyash Applied to Travel to the Hajj before Unusually Travelling to Tripoli ...... 177 E. Limited Blue Network Activity ...... 178 F. Selected Attribution Points for Mustafa Badreddine ...... 178 Wednesday, 12 January 2005 ...... 179 A. Rafik Hariri Met with Mufti Qabbani ...... 179 B. Beginning of Escalation in Green 071 and Purple Call Activity in Lead-Up to Abduction of Ahmad Abu Adass (The "False Claim Set-Up Phase") ...... 179 C. Blue Network Activity: Final Blue Phone was Set Up ...... 180 D. Blue Network Activity: Blue 817 [S8] in Tripoli near Vehicle Dealership (Contact with Blue 610 [S6]) ...... 180 E. Selected Attribution Points for Salim Ayyash ...... 180 F. Selected Attribution Points for Mustafa Badreddine ...... 180 Thursday, 13 January 2005 ...... 181 A. Rafik Hariri Meeting with Nasser Kandil...... 181
13 R305234
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
B. Green & Purple Networks: Longest Ever Green Call between Hassan Merhi and Mustafa Badreddine with Three Days until Ahmad Abu Adass's Abduction ...... 181 C. Purple Call Inactivity Preceding Green Call ...... 181 D. Salim Ayyash: Blue 233's First day of Contact with Other Principal Six Blue Network Users, First Use ofPMP 091 and Last Use ofPMP 935 ...... 182 E. Selected Attribution Points for Mustafa Badreddine ...... 182 Friday, 14 January 2005 ...... 183 A. Rafik Hariri at Quraitem Palace ...... 183 B. First Day of Red Network Contact ...... 183 C. Blue Network Activity: Blue 817 [S8] Travelled to Tripoli (Contact Blue 610 [S6]) ...... 184 D. Final Blue Phone Joins Network: Blue Base Phone ...... 184 E. Two Days until Ahmad Abu Adass's Abduction: Hassan Merhi and Purple Associates Unusually Travelled to Anjar Area ...... l84 F. Two Days until Ahmad Abu Adass's Abduction: Green-Purple Hierarchical Call Flow ...... 185 Saturday, 15 January 2005 ...... 186 A. Rafik Hariri at Quraitem Palace ...... 186 B. Day before Abduction of Ahmad Abu Adass: Hierarchical Green & Purple Call Flow ...... 186 C. Green & Blue Call Activity: Blue 817 [S8] in Tripoli near Vehicle Dealership (Contact Blue 610 [S6]) ...... 187 D. Selected Attribution Points for Salim Ayyash: Wife & Child fly to Saudi Arabia (Hajj) ...... 188 E. Selected Attribution Points for Mustafa Badreddine ...... 188 Sunday, 16 January 2005 ...... 190 A. Ahmad Abu Adass Abducted ...... 190 B. Purple Activity: Unusual Silence on All Purple Phones All Day ...... 190 C. Heavy Green 071 [Merhi] Activity around Time of Ahmad Abu Adass's Disappearance ...... 190 D. Rafik Hariri at Quraitem Palace ...... 192 E. Hassan Nasrallah Denounced UNSC Resolution 1559 and the Opposition ...... 192 F. Blue Network Activity: Light Activity in Dahyieh ...... 192 G. Other Network Activity: No Red Network Calls and No Green Calls Involving Salim Ayyash ...... 192 Monday, 17 January 2005 ...... 193 A. Abduction of Ahmad Abu Adass & Continued Purple Inactivity: Ahmad Abu Adass Did Not Return as Expected and Purple Phones Activity Coincident with Calls to Ahmad Abu Adass's Family ...... l93 B. Second Consecutive Day of Extended Call Inactivity by Mustafa Badreddine ...... 194 C. Rafik Hariri at Quraitem Palace ...... l95 D. Rustom Ghazaleh visited Haret Hreik and Contact between Wafik Safa and Mustafa Badreddine ...... 195 E. Green Network Activity: Contact/Meeting between Salim Ayyash and Mustafa Badreddine .. 195 F. Blue Network Activity in Dahyieh and South Lebanon ...... l96
14 R305235
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
G. Selected Attribution Points for Mr. Ayyash ...... 196 Tuesday, 18 January 2005 ...... 197 A. Rafik Hariri Announced Rejection of Electoral Law Project and Met with Hussein Khalil ..... 197 B. Beginning of "The Mission Set-Up Phase": Integrated Blue Network Activity Hierarchical Green & Blue Call Flow Linked to Exceptional Blue Call Activity ...... 197 C. Green Network Activity: Second Consecutive Mustafa Badreddine & Salim Ayyash Meeting and Sequential Green-Blue call to Blue Base Phone ...... 198 D. Blue Network Activity: Unusual Travel of Blue 864 [S9] to Baalbek/ Bekaa valley ...... 199 E. First Call Activity between Salim Ayyash and Subject 816 ...... 199 F. Hierarchical Green-Blue Call Flow Activity, Exceptional Travel of Blue 742 [S19] to Anjar & Unusual Green Call Activity ...... 200 G. No Inter-Purple Phone Activity but Purple Associates 744 and 375 Became Active Again ..... 201 H. Selected Attribution Points for Salim Ayyash ...... 201 I. Selected Attribution Points for Mustafa Badreddine ...... 201 Wednesday, 19 January 2005 ...... 202 A. Rafik Hariri at Quraitem Palace and Discussed Election Law ...... 202 B. Network Phone Activity: Second Day of Sequential Green & Blue Calls and Beginning of Network Activity at "East of Airport Cells" ...... 202 C. Hierarchical Green-Blue Call Flow Activity: Exceptional Travel of Blue 742 [Sl9] to Anjar.203 D. Blue Network Activity: First Day of Blue 864 [S9]'s Extended Activity at "East of Airport" Cells and Subject 816 ...... 203 E. Hierarchical Green-Blue Sequential Call Flow: S9 & the East of Airport Activity and Heavy Green Network Activity ...... 204 F. No Inter-Purple Phone Activity ...... 205 G. Ahmad Abu Adass Reported Missing ...... 205 H. Selected Attribution Points for Salim Ayyash ...... 205 I. Selected Attribution Points for Mustafa Badreddine ...... 205 Thursday, 20 January 2005 ...... 207 A. Rafik Hariri Attended Prayers at AI Imam Ali bin Abi Taleb Mosque Instead of the Al-Omari Mosque ...... 207 B. Red Network Activity: Intense Morning Activity Near Al-Omari Mosque/Parliament...... 207 C. Green Network Activity: Penultimate Green Contact for Hassan Merhi ...... 208 D. Blue Network Activity: Blue 864 [S9] at "East of Airport" Cells ...... 208 E. Selected Attribution Points for Salim Ayyash ...... 208 F. Selected Attribution Points for Mustafa Badreddine ...... 209 Friday, 21 January 2005 ...... 210 A. Rafik Hariri Met with Hassan Nasrallah ...... 210 B. Hussein Khalil and Wafik Safa Travelled to Anjar/Syria whilst Contacting Rustom Ghazaleh & Wafik Safa' s Subsequent, Lengthy Contact with Mustafa Badreddine ...... 210 C. Green Network Activity: One Call between Salim A yyash and Mustafa Badreddine ...... 211
15 R305236
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. Blue Network Activity: Blue 864 [S9] at East of Airport Cells ...... 211 E. Selected Attribution Points for Salim Ayyash ...... 211 F. Selected Attribution Points for Mustafa Badreddine ...... 211 G. One Inter-Purple Phone Call...... 212 Saturday, 22 January 2005 ...... 213 A. Rafik Hariri at Quraitem Palace ...... 213 B. Blue Network Activity: Blue 817 [S8] travelled to Tripoli and Contacted Blue 610 [S6] on the retumjoumey ...... 213 C. Blue Network Activity: Salim Ayyash, S6 & S9 ...... 213 Sunday, 23 January 2005 ...... 215 A. Rafik Hariri Met with Walid Jumblatt...... 215 B. No Red or Green Network Activity ...... 215 C. Blue Network Activity: Late Night Call from Blue 864 [S9] to Salim Ayyash from an East of Airport Cell ...... 215 D. Salim Ayyash (PMP 170), Subject 816, and Blue 864 [S9] Sequential Contact...... 216 E. Salim Ayyash (PMP 091) and Hassan Merhi (Purple 231) Unusually in Contact...... 216 Monday, 24 January 2005 ...... 217 A. Rafik Hariri at Quraitem Palace ...... 217 B. Green Network Activity: One Call between Salim Ayyash and Mustafa Badreddine ...... 217 C. Blue Network Activity: Second Principal Day of"East of Airport" Activity involving Blue 864 [S9], Salim Ayyash, and Sequential Contact with Subject 816 ...... 217 D. Purple Phone Activity ...... 218 E. Selected Attribution Points for Salim Ayyash ...... 219 F. Selected Attribution Points for Mustafa Badreddine ...... 219 Tuesday, 25 January 2005 ...... 220 A. Rafik Hariri Discussed Electoral Law ...... 220 B. Hierarchical Green & Blue Network Call Flows: Canter Van Purchased (S6 in Tripoli) ...... 220 C. Blue Network Activity Following Purchase ofVan: Contact between S6 and S9 and Sequential Calls between SalimAyyash, S9 and Subject 816 ...... 221 D. Purple Phone Activity: Assad Sabra Unusually in Vicinity of Parliament and Al-Jazeera's Offices and his First Inter-Purple Contact since Abduction of Ahmad Abu Adass ...... 221 E. Selected Attribution Points for Salim Ayyash ...... 222 F. Selected Attribution Points for Mustafa Badreddine ...... 222 Wednesday, 26 January 2005 ...... 223 A. Rafik Hariri Attended Parliament and Threatened to Resign from Parliament if the Electoral Law Passed ...... 223 B. Network Phone Activity: End of the "Mission Set-Up Phase" ...... 223 C. Blue Network Activity: Third and Final Principal Day of Blue 864 [S9] Activity at "East of Airport" Cells and Related Salim Ayyash and Subject 816 Contact...... 223
16 R305237
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. Purple Phone Activity: Final Calls between Hassan Merhi and Hussein Oneissi ...... 225 Thursday, 27 January 2005 ...... 226 A. Rafik Hariri at Quraitem Palace and Parliament...... 226 B. Electoral Law Passed ...... 226 C. Beginning of the "Execution Phase": Intensified "Principal Six" Blue Phone Activity & Resumption of Regular Surveillance Up to the Attack...... 226 D. Blue Network Activity: Surveillance ofRafik Hariri at Parliament...... 227 E. Salim Ayyash, Subject 816 & S9 ...... 227 Friday, 28 January 2005 ...... 228 A. Rafik Hariri at Quraitem Palace ...... 228 B. Beginning of the Red Network Primary Phase: Hierarchical Green-Red Sequential Call Flow & Associated Surveillance of Rafik Hariri ...... 228 C. Blue Network Activity: Principal Six Blue Phones Used for Contact to/from Dahiyeh during Red Phone Operational Activity ...... 229 D. Selected Attribution Points for Salim Ayyash ...... 229 E. Selected Attribution Points for Salim Ayyash: Wife Returns from Hajj ...... 230 F. Selected Attribution Points for Mustafa Badreddine ...... 230 Saturday, 29 January 2005 ...... 231 A. Rafik Hariri Met Ghattas El Khoury and Basel Fuleihan at his Naameh Villa and Later Informed the "Syrian Deposits" they would not be on his Electoral List ...... 231 B. Network Phone Activity: No Red or Green Activity ...... 231 C. Blue Network Activity: Surveillance of Rafik Hariri in the Early Afternoon ...... 231 D. Blue Network Activity: Co-ordinated Activity & Continued Surveillance at Quraitem Palace232 E. Hassan Nasrallah Condemns UNSC Resolution 1559 ...... 232 Sunday, 30 January 2005 ...... 233 A. Rafik Hariri Met with Marwan Hamade and Walid Jumblatt ...... 233 B. Blue Network Activity: Surveillance ofRafik Hariri at Quraitem Palace and Marwan Hamade's Residence ...... 23 3 C. Selected Attribution Points for Salim Ayyash ...... 233 Monday, 31 January 2005 ...... 234 A. Rafik Hariri Visited Higher Shiite Council and Announced He Would Run for the Elections. 234 B. Red, Green & Blue Network Activity: Hierarchical Red/Green Sequential Call Flow and Surveillance of Rafik Hariri' s Convoy to Higher Shiite Council ...... 234 C. Green Network Activity: Heavy Contact During Surveillance & Subsequent Meeting between Mustafa Badreddine and Salim Ayyash ...... 236 D. Blue Network Activity: Afternoon and Evening Surveillance ofRafik Hariri at Quraitem Palace and his Dinner in Ain El Tineh ...... 236 E. Selected Attribution Points for Salim Ayyash ...... 237 F. Selected Attribution Points for Mustafa Badreddine ...... 237
17 R305238
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 1 February 2005 ...... 238 A. Rafik Hariri Met with Syrian Vice President Khaddam and Syrian Deputy Foreign Minister El- Moallem ...... 238 B. Final Meeting between Rafik Hariri & Hassan Nasrallah ...... 238 C. Network Phone Activity: No Red Phone Activity ...... 238 D. Blue Network Activity: Surveillance of Rafik Hariri at Quraitem Palace ...... 239 E. Green Network Activity: Only One Call between Salim Ayyash and Mustafa Badreddine ...... 239 F. Selected Attribution Points for Salim Ayyash ...... 239 Wednesday, 2 February 2005 ...... 240 A. Rafik Hariri Met with Walid Jumblatt...... 240 B. Third Bristol Group Meeting ...... 240 C. Network Phone Activity: No Red or Green Phones in Contact with Each Other ...... 240 D. Red Network Activity: Topping Up in Tripoli ...... 240 E. Blue Network Activity: Surveillance of Quraitem Palace ...... 241 Thursday, 3 February 2005 ...... 243 A. Rafik Hariri Visited Mufti Qabbani and Lunched with Deputy Prime Minister Fares at St. Georges Marina ...... 243 B. Green Network Activity: Mustafa Badreddine and Salim Ayyash in Vicinity of Crime Scene/St George's Marina and Hierarchical Red/Green Phone Call Flow ...... 243 C. Red Network Activity: Surveillance ofRafik Hariri at St. George's Marina ...... 244 D. Selected Attribution Points for Salim Ayyash ...... 245 E. Selected Attribution Points for Mustafa Badreddine ...... 245 Friday, 4 February 2005 ...... 247 A. Rafik Hariri Met with Nasser Kandil to Discuss his Non-Inclusion in his Electoral List, then Travelled to Bahrain ...... 24 7 B. Rustom Ghazaleh and Wafik Safa Took a Close Interest in Nasser Kandil's Meeting with Rafik Hariri ...... 247 C. Hussein Khalil Told Ahmad Nassir Al-Assaad to Convey Threat to Rafik Hariri That he would be forced to Include "Syrian Deposits" in his Electoral List...... 248 D. Blue Network Activity: Surveillance ofRafik Hariri at Marwan Hamade's Residence, Quraitem Palace and the Airport ...... 248 E. Purple Phone Activity: Finallnter-Purple Call before 14 February ...... 249 Saturday, 5 February 2005 ...... 250 A. Rafik Hariri Abroad ...... 25 0 B. Network Phone Activity: Quiet Day Coinciding with Rafik Hariri's Absence ...... 250 C. Hassan Merhi (Purple 231) & Salim A yyash (PMP 091) in Rare Contact ...... 250 D. Rustom Ghazaleh's Final Visit to Haret Hreik ...... 251 E. Selected Attribution Points for Salim Ayyash ...... 251 Sunday, 6 February 2005 ...... 252
18 R305239
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
A. Rafik Hariri Abroad ...... 252 B. Contact ofRustom Ghazaleh & Wafik Safa with Nasser Kandil ...... 252 C. Network Phone Activity: Quiet Day Coinciding with Rafik Hariri's Absence ...... 252 D. Hassan Merhi (Purple 231) & Salim Ayyash (PMP 091 ): Second Consecutive Day & Last of their Unusual Contact before Attack ...... 253 Monday, 7 February 2005 ...... 254 A. Rafik Hariri Returned to Lebanon and Ahmad Nassir Al-Assaad Informed him of Hussein Khalil's Threat ...... 254 B. Hussein Khalil Visited Rafik Hariri to Reiterate that Mr. Hariri Should Include the Syrian Deposits on his Electoral List ...... 254 C. Final Call between Wafik Safa & Rustom Ghazaleh ...... 255 D. Green Network Activity: Final Green Call of Hassan Merhi ...... 255 E. Blue Network Activity: Surveillance ofRarfik Hariri at Airport and Quraitem Palace ...... 255 F. Hassan Nasrallah, Syria & UNSC Resolution 1559 ...... 256 G. Selected Attribution Points for Salim Ayyash ...... 256 Tuesday, 8 February 2005 ...... 258 A. Rafik Hariri Went to Parliament, Met with UN Special Envoy Roed-Larssen & Marwan Hamade ...... 258 B. Red, Green & Blue Network Activity: Rehearsal for the Attack ...... 258 C. Blue Surveillance of Rafik Hariri: Visit to Marwan Hamade ...... 261 D. Subject 6 Travelled to South Lebanon During Rehearsal...... 261 E. Selected Attribution Points for Salim A yyash ...... 261 F. Selected Attribution Points for Mustafa Badreddine ...... 262 Wednesday, 9 February 2005 ...... 263 A. Rafik Hariri at Quraitem Palace ...... 263 B. Green, Red & Blue Network Activity: Surveillance of Rafik Hariri at Quraitem Palace ...... 263 C. Subject 5 & Subject 7 Leave Red Surveillance to Visit Mraijeh_A ...... 264 D. Selected Attribution Points for Salim Ayyash ...... 264 E. Selected Attribution Points for Mustafa Badreddine ...... 264 Thursday, 10 February 2005 ...... 266 A. Rafik Hariri at Quraitem Palace and Visited Maronite Archbishop in Achrafiyeh ...... 266 B. UN Special Envoy Roed-Larsen Visited President Al-Assad in Damascus ...... 266 C. Red & Blue Network Activity: Surveillance of Rafik Hariri at Quraitem Palace ...... 266 D. Salim Ayyash Unusually Inactive on his Network Phones ...... 266 E. Last Contact between Salim Ayyash & Subject 816 Before Night of 13 February ...... 267 F. "False Claim ofResponsibility" Activity: Telecarte Purchased ...... 267 Friday, 11 February 2005 ...... 268 A. Rafik Hariri Met with UN Special Envoy Roed-Larsen who Warned Rafik Hariri of President Al-Assad's Threats ...... 268
19 R305240
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
B. Green Network Activity: Salim Ayyash and Mustafa Badreddine in Multiple Contact ...... 268 C. Red Network Activity: Surveillance ofRafik Hariri at Quraitem Palace; Salim Ayyash at Crime Scene/ Parliament area ...... 269 D. Red Phones Travelled to Tripoli ...... 269 E. Mustafa Badreddine at Unusual Mraijeh_A Cell ...... 269 F. Selected Attribution Points for Salim Ayyash ...... 269 G. Selected Attribution Points for Mustafa Badreddine ...... 270 Saturday, 12 February 2005 ...... 271 A. Rafik Hariri Attended Funerals at Sacre Coeur and Mar Michael Churches then Visited the Beirut Association for Social Development ...... 271 B. Green & Red Network Activity: Last Day of Red Activity before Attack and Hierarchical Red/Green Call Activity during Surveillance of Rafik Hariri ...... 271 C. Selected Attribution Points for Salim Ayyash ...... 272 D. Selected Attribution Points for Mustafa Badreddine ...... 273 Sunday, 13 February 2005 ...... 274 A. Rafik Hariri Met with Basel Fuleihan who Warned him of Threats from the Syrian Regime .. 274 B. Yahya Al-Arab Made an Exceptional Additional Payment to Rustom Ghazaleh and Became Very Concerned for Rafik Hariri' s Life ...... 2 7 4 C. Blue and Red Network Activity: No Red Activity and Limited Blue Activity ...... 274 D. Subject 816 contacted Salim Ayyash from the "East of Airport Cells" on the Eve of the Attack ...... 275 E. Sequential Call Flow between Wafik Safa, Mustafa Badreddine and Salim Ayyash on the Eve of Attack (the Penultimate Green call) ...... 276 F. Purple Network Activity: No Inter-Purple Activity ...... 276 G. Selected Attribution Points for Salim Ayyash ...... 277 H. Selected Attribution Points for Mustafa Badreddine ...... 277 Monday, 14 February 2005 ...... 278 I. THE ATTACK ...... 278 A. The Period Preceding Rafik Hariri's Arrival at Parliament at 10:54 ...... 278 B. The Period Preceding Rafik Hariri 's Exit from the Parliament Building ...... 279 C. The Period from Rafik Hariri's Departure to the Time of the Explosion ...... 281 D. The Period following the Explosion ...... 282 II. THE FALSE CLAIM OF RESPONSIBILITY ...... 283 A. The Period Preceding the Explosion ...... 284 B. The Period Following the Explosion (at 12:55) ...... 285 III. 15-17 February 2005 ...... 288 A. Final Purple Phone Calls ...... 288 B. Principal Six Network Users: Significant Drop in Call Activity ...... 288
20 R305241
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
Sunday, 22 August 2004
A. Growing Opposition to Syrian Control in Lebanon
1. Maronite Patriarch Nasrallah Boutros Sfeir publicly criticised consultations between President Bashar Al-Assad and Lebanese politicians regarding the proposed extension of President Emile Lahoud' s term of office as being contrary to Lebanese sovereignty and independence. He stated that "Consultations in anticipation of the great political event, which is the presidential election, are taking place outside the Lebanese border. It is as if we have completely lost sovereignty of our territory and our independence and freedom in choosing our rulers and deciding our own affairs."'
2. Other parties, including the Qomet Chehwan Gathering, were also outspoken in their . . 2 oppos1t1on.
Tuesday, 24 August 2004
A. President Lahoud Announced that He Was Seeking to Extend his Mandate
3. President Lahoud announced that he was seeking to renew his six-year Presidential mandate. 3
1 Exhibit P532, UNIC Press Review, 23 August 2004, ERN D0412124-D0412130, at D0412129. See also Exhibit P532, UNIC Press Review 24 August 2004, ERN D0412200-D0412206, at D0412205; Exhibit P532, UNIC Press Review, 25 August 2004, ERN D0412289-D0412296, at D0412296. 2 Exhibit P532, UNIC Press Review, 23 August 2004, ERN D0412124-D0412130, at D0412129. See also Exhibit P532, UNIC Press Review 24 August 2004, ERN D0412200-D0412206, at D0412205. 3 Exhibit P532, UNIC Press Review, 25 August 2004, ERN D0412289-D0412296, at D0412295.
21 R305242
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 25 August 2004
A. Rustom Ghazaleh Summoned Prime Minister Hariri to Damascus
4. Prime Minister Rafik Hariri was summoned to Damascus by the Head of Syrian Military Intelligence in Lebanon, Rustom Ghazaleh to meet with Syrian President Al Assad.4 President Al-Assad's purpose of the meeting was to ensure a quorum and majority vote for the extension of President Lahoud's mandate.5
5. Prior to the meeting, Mr. Ghazaleh demanded that Mr. Hariri agree to the extension of President Lahoud's term of office but agreed that he could go to Damascus without giving a final answer. 6 According to Marwan Hamade, Mr. Hariri was hoping he could convince President Al-Assad otherwise. 7
6. Mr. Ghazaleh cancelled Walid Jumblatt's invitation to Damascus after being informed that he would oppose President Lahoud' s proposed extension. 8
Thursday, 26 August 2004
A. Prime Minister Hariri Met with President AI-Assad in Damascus
7. Prime Minister Hariri met with Syrian President Al-Assad in Damascus in the presence of Syrian Security officials. 9 The meeting lasted less than 15 minutes and Prime Minister Hariri was not permitted to sit down. 10
4 Testimony ofMarwan Hamade, Transcript of 18 November 2014, pp.78-80, 87; Testimony ofWalid Jumblatt. Transcript of 4 May 2015, p. 64; Exhibit P422, Transcript of the Cassette Tapes from Al-Hassan Wissam, ERN 40000843E Side A U EN. 5 Testimony-ofM-;n~an-Hamade, Transcript of 18 November 2014, p.79. 6 Testimony ofMarwan Hamade, Transcript of 18 November 2014, pp.79-80. 7 Testimony ofMarwan Hamade, Transcript of 18 November 2014, p.87. R Testimony of Marwan Hamade, Transcript of 18 November 2014, pp.79-80; Testimony of Walid Jumblatt. Transcript of 4 May 2015, pp. 64-66. 9 Testimony ofMarwan Hamade, Transcript of 19 November 2014, pp. 4-5; Testimony ofHani Hammoud of 19 May 2015, p. 36; Testimony ofGhattas Khoury, Transcript of 15 January 2015, pp. 20, 36; Testimony ofFouad Siniora, Transcript of 23 March 2015, p. 57; Testimony of Salim Diab, Transcript of 22 January 2015, p. 69; Testimony ofGhaleb El-Chammaa, Transcript of 10 February 2015, pp. 50-52; Testimony ofGhazi El-Youssef, Transcript of 10 March 2015, p. 59.
22 R305243
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
8. Mr. Al-Assad told Mr. Hariri that it would be Syria, and not France or the United States, who selected the next Lebanese President. 11 He further stated that President Lahoud represented Syria in Lebanon and would be President for another term. 12
9. President Al-Assad also told Mr. Hariri that "No, it will be Lahoud. And if you try to contradict me, I will destroy Lebanon over yours and Jumblatt's head." 13
B. The December 2003 Meeting: Prime Minister Hariri, President Al-Assad and the "Damascus Protocol"
10. Prime Minister Hariri had previously met President Al-Assad in Damascus in December 2003 in the presence of the three senior members of the Syrian Military Intelligence apparatus: General Ghazi Kanaan, General Rustom Ghazaleh and General Mohammed Khallouf. 14 The three generals took turns throwing accusations at Prime Minister Hariri. 15
11. At that December 2003 meeting, Prime Minister Hariri was accused of conspiring against the Syrian regime, being a traitor, and using the An Nahar newspaper to incite a policy of opposition to the Syrian regime. 16 He was directed to cut all ties with An Nahar, withdraw his people from the Board, and sell his shareholding within 48 hours. 17
10 Testimony of Walid Jumblatt, Transcript of 4 May 2015, p. 83; Testimony of Ghattas Khoury, Transcript of 15 January 2015, p. 36. 11 Testimony of Marwan Hamade, Transcript of 19 November 2014, p. 5; Testimony of Bassem El-Sabeh, Transcript of 16 March 2015, pp. 38-39. 12 Testimony ofWalid Jumblatt, Transcript of4 May 2015, p. 84. 13 Testimony of Marwan Hamade, Transcript of 19 November 2014, p. 5; Testimony of Walid Jumblatt, Transcript of 4 May 2015, p. 82; Testimony of Fouad Siniora, Transcript of23 March 2015, p. 58; Testimony of Bassem El-Sabeh, Transcript of 16 March 2015, p. 40. 14 Testimony of Hani Hammoud, Transcript of 19 May 2015, pp. 25-27; Testimony of Marwan Hamade, Transcript of 18 November 2014, p. 52; Testimony of Walid Jumblatt, Transcript of 4 May 2015, p. 58; Testimony ofGhaleb El-Chammaa, Transcript of 10 February 2015, pp. 31, 33; Testimony ofBassem El-Sabeh, Transcript of 18 November 2014, pp. 23-24. 15 Testimony ofBassem El-Sabeh, Transcript of 18 November 2014, pp. 24-25 16 Testimony ofHani Hammoud, Traknscript of 19 May 2015, p. 28; Testimony ofMarwan Hamade, Transcript of 18 November 2014, p. 26. 17 Testimony of Marwan Hamade, Transcript of 18 November 2014, pp. 27, 39; Testimony of Hani Hammoud, Transcript of 19 May 2015, p. 28; Testimony ofWalid Jumblatt, Transcript of 4 May 2015, p. 59; Testimony of
23 R305244
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
12. President Al-Assad, in the presence of Prime Minister Hariri, instructed Mr. Ghazaleh to ensure the sale of the shares and provide him (Al-Assad) with a copy of the contract (which he later did). 18
13. The requirements set out at the December 2003 meeting came to be known as the "Damascus Protocol". 19 Prime Minister Hariri was prohibited from, amongst other things:
• Disagreeing with the policies of President Lahoud;
• Organising political rallies;
• Holding public gatherings in support of Prime Minister Hariri around Quraitem Palace; and
• Attending Friday prayers in public places. 20
14. Prime Minister Hariri was so distressed when he left the meeting he hit his head on the front car window and got a bleeding nose. 21
Saturday, 28 August 2004
A. Prime Minister Hariri Initiated President Lahoud's Extension
15. Contrary to his original, publicly stated position, Prime Minister Hariri initiated the constitutional process at the Council of Ministers to pave the way for the extension of President Lahoud' s term. 22
Ghaleb El-Chammaa, Transcript of 10 February 2015, pp. 31, 32; Testimony ofBassem El-Sabeh, Transcript of 18 November 2014, p. 25. 18 Testimony ofMarwan Hamade, Transcript of 18 November 2014, pp. 39-42, 56. 19 Testimony ofHani Hammoud, Transcript of 19 May 2015, pp. 32-33. 20 Testimony ofHani Hammoud, Transcript of 19 May 2015, p. 32; Testimony ofMarwan Hamade, Transcript of 18 November 2014, p. 56. 21 Testimony ofMarwan Hamade, Transcript of 18 November 2014, p. 58. 22 Exhibit P309, An-Nahar Newspaper Article Ten minutes in Council of Ministers meeting when the extension was approved; final vote on Wednesday, dated 29.08.2004, ERN 60235629-60235642; Testimony of Marwan
24 R305245
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
16. During the sessiOn, Marwan Hamade formally addressed the Council of Ministers strongly opposing the proposed extension. 23
Wednesday, 1 September 2004
A. Growing Calls for Syrian Withdrawal from Lebanon
17. The Council of Maronite Bishops issued a statement m response to the intended extension of President Lahoud's term calling for Syrian withdrawal, accusing it of widespread interference and manipulation, and treating Lebanon as a Syrian Province. 24
B. Syrian and Lebanese Representations to UN Security Council
18. Syria made formal representations to the UN Security Council objecting to the draft Resolution 1559. 25 It made direct reference to the formal representations sent by Lebanon to the UN Security Council the previous day which:
• Condemned the draft resolution as a US-French attempt to illegitimately interfere in and manipulate Lebanese domestic affairs using the UN Security Council as its tool;
• Defended the continued Syrian presence in Lebanon as lawful and serving the common interest; and
• Dismissed allegations that Syria supports terrorist organisations in Lebanon as untruthful. 26
Hamade, Transcript of 19 November 2014, pp. 34-42; Testimony ofGhazi El-Youssef, Transcript of 10 March 2015, p. 60. 23 Testimony of Marwan Hamade, Transcript of 19 November 2014, pp. 36, 39; Exhibit P309, An-Nahar Newspaper Article Ten minutes in Council of Ministers meeting when the extension was approved; final vote on Wednesday, dated 29.08.2004, ERN 60235629-60235642. 24 Exhibit P364, UNIC Beirut Press Review, 2 September 2004, ERN D0410435-D0410444 at D0410437; Testimony of Bassem El-Sabeh, Transcript of 16 March 2015, pp. 44-46; Testimony of Ghattas El-Khoury, Transcript of 15 January 2015, pp. 52-55. 25 Exhibit P310.3, Identical letters dated 1 September 2004 from the Permanent Representative of the Syrian Arab Republic, A/58/833-S/20041706, ERN D0407566-D0407567. 26 Exhibit P310.2, Identical letters dated 30 August 2004 from the permanent Represtntative of Lebanon, A/58/879-S/2004/699, ERN D0407564-D0407565.
25 R305246
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 2 September 2004
A. UNSC Resolution 1559 Adopted
19. UN Security Council Resolution 1559, submitted by the United States and France, was adopted. It:
• Called for withdrawal of "foreign forces" from Lebanon and free, independent elections within Lebanon;
• Expressed grave concern at the "continued presence of armed militias in Lebanon which prevent the Lebanese Government from exercising full sovereignty over all Lebanese territory"; and
• Called for the disbanding and disarmament of all Lebanese and non-Lebanese militias. 27
20. The urgency of the call was emphasised by the requirement that the UN Secretary General report to the Security Council on its implementation within 30 days. 28
Friday, 3 September 04
A. President Lahoud's Term Extended
21. Lebanese Parliament approved the constitutional amendment extending the term of President Lahoud.29 Twenty-nine Members of Parliament voted against the
27 Exhibit P310.1, UN Security Council Resolution 1559 (2004), ERN 60242046-60242047. See also Exhibit P310.4, Security Council Declares Support for Free, Fair Presidential Election in Lebanon, ERN D0410140- D0410149; Exhibit P364, UNIC Beirut Press Review, 2 September 2004, ERN D0410435-D0410444; Exhibit P532, UNIC Beirut Press Review, 03 September 2004, ERN D0410503-D0410511. 28 Exhibit P310.1, UN Security Council Resolution 1559 (2004), ERN 60242046-60242047. 29 Exhibit P532, UNIC Beirut Press Review, 03 September 2004, ERN D0410503-D0410511; Testimony of Marwan Hamade, Transcript of 19 November 2014, p. 43; Testimony of Ghattas El-Khoury, Transcript of 15 January 2015, p. 67.
26 R305247
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
amendment including Walid Jumblatt, Marwan Hamade, Pierre Gemayel, Antoine Ghanem and Ghattas El-Khoury. 30
22. Ghattas El-Khoury, a well-known objector to the proposed extension, was the subject of concerted attempts to contact him before the vote by key pro-Syrian actors m Lebanon: Rustom Ghazaleh and Nasser Kandil MP. 31
Saturday, 4 September 2004
A. Qornet-Chehwan Gathering Held an Extraordinary Meeting Condemning the Constitutional Amendment
23. Qomet-Chehwan Gathering held an extraordinary meeting at the summer residence of the Maronite Patriarch. It issued an Accord, as part of a new national pact, condemning the constitutional amendment to extend the Presidential term. 32
Monday, 6 September 2004
A. Green Network Activity: First Use of by Mustafa Badreddine
24. While had been used on four days since its first use on 18 August 2004, this was the first day it was attributable to Mustafa Badreddine when it made one call to
30 Exhibit P406, An-Nahar Newspaper Article dated 4 September 2004, ERN 60298546-60298563; Exhibit P532, UNIC Beirut Press Review, 03 September 2004, ERN D0410512-D0410514; Testimony of Marwan Hamade, Transcript of 19 November 2014, pp. 80-82; Testimony of Ghattas El-Khoury, Transcript of 15 January 2015, p. 48. 31 Testimony ofGhattas El-Khoury, Transcript of 15 January 2015, pp. 56-57, 66 32 Exhibit P423, Qomet Shehwan Statement dated 4 September 2004, ERN 60301198-6030 1198; Testimony of Walid Jumblatt, Transcript of 4 May 2015, pp. 93-95.
27 R305248
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 7 September 2004
A. Marwan Hamade and Other Ministers Resigned
25. A number of Ministers from Walid Jumblatt's Democratic Gathering Bloc, including MPs Marwan Hamade, Ghazi Aridi, and Abdullah Farhat, resigned in protest at the extension of President Lahoud' s term. 33
Monday, 13 September 2004
A. Prime Minister Hariri Announced that his Government Would Resign by the End oftheMonth
26. Mr. Hariri stated that he and his government would resign before the end of the month during the question period following an awards ceremony in Barcelona where he received a UN-HABITAT award for his reconstruction of Lebanon. 34
B. Democratic Gathering Announced Preparation of "Ten Point" Document
27. Walid Jumblatt's Democratic Gathering bloc publicly announced that it is preparing a "Ten Point" document directed, amongst other issues, at the Syrian interference in Lebanese affairs. 35
33 Exhibit P303, Press Release of 07.09.2004, Democratic Gathering Ministers Resign, ERN D0004610- D0004613; Exhibit P312, The Prime Minister meetings with the American and European Ambassadors. Hamadeh, Aridi and Farhat tender their resignations, ERN 60235629-60235642; Testimony of Marwan Hamade, Transcript of20 November 2014, pp. 6-9. 34 Exhibit P470, Press Release of 13.09.04, Hariri receives UN Prize for Reconstruction in Barcelona. Hariri announces he will resign, ERN D0004568-D0004581; Exhibit P303, Press Release of 13.09.2004, The Democratic Gathering Prepares a Paper Comprising "Ten Points", ERN D0004625-D0004627; Exhibit P532, UNIC Beirut Press Review, 10 September 2004, ERN D0411120-D0411127. 35 Exhibit P303, Press Release of 13.09.2004, The Democratic Gathering Prepares a Paper Comprising "Ten Points", ERN D0004625-D0004627; Exhibit P425, UNIC Beirut Press Review, 13 September 2004, ERN D0411370 at D0411373.
28 R305249
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 15 September 2004
A. Prime Minister Hariri Agreed to Postpone his Resignation
28. Prime Minister Hariri agreed to postpone the resignation of his government until after UN Secretary General Kofi Annan had reported to the UN Security Council on the implementation ofUNSC Resolution 1559 (1 October 2004). 36
36 Exhibit P532, UNIC Beirut Press Review, 16 September 2004, ERN D0411627-D0411633, at D0411630.
29 R305250
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 16 September 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Salim Ayyash travelled to Anjar/ Syrian Border Area
29. In the late morning, Salim Ayyash ( and PMP 935) travelled towards the Lebanese/Syrian border where he used a cell in the Anjar area.
30. Mr. Ayyash's phones were subsequently inactive for almost seven hours on the Lebanese network. In the evening, his call activity restarted in the Chtaura area of eastern Lebanon and soon after he travelled back to Beirut.
31. This was unusual activity for Mr. Ayyash and for the other Network users from 1 September 2004 to 14 February 2005. Mr. Ayyash (and S9) also used cells in the Anjar/ Syrian Border area on 28/29 September 2004.
32. Aside from that, there were only two other occasions when a "Subject" Network (Green, Red, Blue or Yellow) user connected to cells in the Masnaa/Anjar area near the Syrian border:
(i) [S21]'s travel to Anjar on 22 November 2004 (during which he only called Mr. Ayyash ( )); and
(ii) [S19]'s travel in the early hours of 19 January 2005 (when he had a unique series of calls with Mr. Ayyash) at the start of the "Mission Set-Up Phase".
B. Contact with Wafik Safa and S9 en-route to Anjar/ Syrian Border area
33. Immediately prior to his movement to the Anjar area, Mr. Ayyash (PMP 935) exchanged calls with Wafik Safa, a senior Hezbollah security official, using a cell in the Baabda area.
34. This was the first contact between Mr. Ayyash and Mr. Safa since April 2004 and they were not in contact again until April2005.
30 R305251
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
35. Around the time of his calls with Wafik Safa, Salim Ayyash ( ) was also in contact with [S9]; both were in contact with
36. Around the time that Salim Ayyash (PMP 935) restarted his call activity in the Chtaura area after several hours of call inactivity, [S9] also used a cell in the same area to have contact with
C. Selected Attribution Points for Salim Ayyash
37. Just prior to his travel to the Anjar area, Mr. Ayyash switched the SIM card of his PMP 935 to the handset of his BMW car. PMP 935 had contact with Salim Ayyash's home landline in Haddath from the Chtaura area en-route back to Beirut.
D. Prime Minister Hariri Met President Chirac in Paris
38. Mr. Hariri was in Brussels and Paris and met with French President Jacques Chirac. 37
37 Exhibit P346, Logbook record ofRafik Hariri's trips abroad, ERN 60004129-600004136, at 60004132.
31 R305252
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 22 September 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. First Bristol Group Meeting
39. The first Bristol Group meeting was held on 22 September 2004. 38
40. The day before, on 21 September 2004, a press conference had been held to publically announce what became known as the Bristol Group's "Democratic Gathering Declaration for Freedoms and the Protection of the Constitution and the Democratic Regime, Beirut, 21 September 2004".39
B. Prime Minister Hariri Met with Hassan Nasrallah
41. The call activity of Prime Minister Hariri's security detail is consistent with him having met with Hassan Nasrallah in Dahyieh a short distance from the Hezbollah General Secretariat between 19:36 and 20:55.
42. Shortly before Mr. Hariri's meeting with Mr. Nasrallah, the call activity between
Hussein Khalil, Mustafa Nasser (PRH476), and Wissam Al Hassan (PRH680) IS consistent with Mr. Khalil being involved in its arrangement.
43. At 20:36, Mr. Khalil called Walid Jumblatt (PRH684) for approximately four minutes and connected to a cell providing coverage which overlapped with a cell being connected to by Mr. Hariri's security detail near the end of the meeting. This is consistent with Mr. Khalil's presence near the meeting place.
38 Testimony ofGhattas Khoury, 15 January 2015, pp.74, 76, 77; Exhibit P427, "UNIC Beirut Press Review, 23 September 2004, ERN D0412131-D0412139, at p. D0412135; Testimony ofWalid Jumblatt, 5 May 2015, pp. 20-26. 39 Testimony ofMarwan Hamade, 19 November 2014, p. 25,20 November 2014, pp. 35, 37, 38; Exhibit P314, "Democratic Gathering Declaration for Freedoms and Protection of the Constitution and the Democratic Regime", Beirut, 21 September 2004, ERN 60301568-60301577.
32 R305253
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
C. Rustom Ghazaleh Travelled to Haret Hreik Following the Hariri/Nasrallah Meeting
44. At 20:47, very close to the time of Mr. Hariri's departure from the meeting back to Quraitem Palace, Mr. Khalil called Mr. Ghazaleh twice. Within ten minutes, Mr. Ghazaleh, who was in west Beirut, had called him back and also contacted W afik Safa in successive calls.
45. There followed a lengthy period of call inactivity on Mr. Ghazaleh's phone (21:09- 22:59) at the end of which he was sited connecting to a cell which provided predicted coverage to the immediate vicinity of the Hezbollah General Secretariat.
46. Mr. Khalil's phone was similarly inactive over the same period (21: 13 - 23: 17) at the end of which he connected to a cell which overlapped with Mr. Ghazaleh' s last used cell in Haret Hreik at 22.59. Mr. Safa's phone connected to an adjacent cell at 22:14.
4 7. The circumstances are consistent with Mr. Ghazaleh travelling to Haret Hreik for a meeting in the vicinity of the Hezbollah General Secretariat.
48. Prior to this day, the movement of Rustom Ghazaleh's phone to use cells in Haret Hreik following calls with Hussein Khalil and/or Wafik Safa consistent with a visit to the area was exceptional.
49. Since 1 January 2004, it had only occurred on two previous occasions: on 29 April 2004 and 1 June 2004 when on both occasions Mr. Ghazaleh had made contact with Hussein Khalil shortly beforehand. These visits straddled May 2004 when there had previously been escalating tension between Rafik Hariri and Rustom Ghazaleh.
50. In his testimony, Atef Majdalani (PRH491) noted that, prior to the period of the assassination, the previous occasion when the threat level had escalated against Rafik Hariri had been in May 2004. This had been when Rustom Ghazaleh attempted to interfere in the make-up of the electoral lists for the municipal elections in Beirut. He had visited Mr. Hariri at his residence and made "some kind of threat". 40
40 Testimony of AtefMajdalani, Transcript of29 April2015, p. 6.
33 R305254
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
51. This day, the day of the first Bristol Group meeting, marked the beginning of a period of several such visits by Mr. Ghazaleh to Haret Hreik up to the date of the assassination. The regularity of those visits escalated markedly in the month following the second Bristol Group meeting (13 December 2004- 17 January 2005).
D. Hussein Khalil visited Quraitem Palace after Meeting Rustom Ghazaleh & Wajik Safa
52. Hussein Khalil travelled from Dahyieh to the vicinity of Quraitem Palace between approximately 23:48 and 00:04 which is consistent with him having visited Prime Minister Hariri after the Hariri/Nasrallah meeting, and after the movement of Rustom Ghazaleh to Haret Hreik.
53. At 00:19, following his departure from the Quraitem area, Mr. Khalil called Mr. Ghazaleh once again by which time the latter had returned to his home area in Chtaura in eastern Lebanon.
54. Throughout this day (from 01:15) and the following day, the telephone contact between Mr. Khalil and Mr. Ghazaleh was unusually heavy (8 calls out of a total of 43 for September 2004 to 14 February 2005).
34 R305255
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 24 September 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO the CASE FOR THE PROSECUTION
A. Prime Minister Hariri at Quraitem Palace
55. Prime Minister Hariri received visitors at Quraitem Palace throughout the day. 41
B. Green Network Activity: First Day of Hassan Merhi's Green Phone and First Contact between Hassan Merhi and Mustafa Badreddine
56. [Merhi] called [Badreddine] once in the evening using the cell that provided predicted coverage to the immediate vicinity of his home. The Prosecution's case is that this was the first occasion that was used by Hassan Merhi. The Prosecution attributes to Mustafa Badreddine from 6 September 2004.
C. Wafik Safa in contact with the Green Phone Subscriptions Contact Number
57. The phone 3 731777 called the senior Hezbollah security official Wafik Safa twice during the afternoon. This was the only contact that Mr. Safa had with this number between 1 September 2004 and 14 February 2005.
58. The phone number 3731777 was listed as the contact number on the post-paid contract forms for two Green phones ( and ). 42
59. The phone number 3 731777 was subscribed to in the name of Amal Kamel Haidar, 43 the wife of Samir Ali Hodroj. 44 Mr. Hodroj was the named subscriber of Mr.
41 Exhibit P301, Visitor's Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380743- D0380745; Exhibit P303, Press Release of24.09.04, Feltman congratulated Lebanon, ERN D0004697-D0004698. 42 Exhibit P405, Original Contrat D'Abonnement au Service Cellis in the name of Kamel Taleb in relation to mobile 3140048 dated 9 July 2004, ERN 60105074-60105080; Exhibit P405, Original Contrat D'Abonnement au Service Cellis in the name ofKamel Taleb in relation to mobile 3140030 dated 9 July 2004, ERN 60105081- 60105087. 43 Exhibit P1106, Libancell GSM Cellular Service Agreement and a copy of a Lebanese Civil Extract identification document for Amal Kamal Haidar, ERN SI-0001706. 44 Exhibit P 1043, Family Personal Extract Status of Samir Ali Hodroj and his parents, spouse, siblings and children, ERN 60254653-60254680, at 60254667.
35 R305256
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Badreddine's PMP 663 and PMP 354, and payments for these phones were initially made through Mr. Hodroj 's bank account. 45
45 Exhibit P1103, MTC Touch Invoice for Samir Ali HEDROJ for May 2004 [EXTRACT], ERN 60182410- 60182411; Exhibit P 1104, MTC Monthly Invoice, with Invoice no. 200405106887, dated 7 June 2004 in the name ofSamir HODROJ, ERN 60182421-60182422.
36 R305257
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 25 September 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Prime Minister Hariri's Activity: Meeting with Maronite Patriarch in Bkirki
60. Prime Minister Hariri received visitors at Quraitem Palace and met with the Maronite Patriarch Nasrallah Boutros Sfeir in Bkirki where they discussed the governmental situation. 46
46 Exhibit P303, Press Release of 26.09.2004, After meeting Sfeir and Jumblatt in past two days, ERN D0004672-D0004672.
37 R305258
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 27 September 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Prime Minister Hariri Met with Hassan Nasrallah
61. Prime Minister Hariri received visitors at Quraitem Palace during the day. 47
62. Mr. Hariri's go-between with Hezbollah, Mustafa Nasser (PRH476), was in contact with Hezbollah officials Khalil Farhat and Hussein Khalil multiple times during the day as well as with Wissam Al Hassan (PRH680), Yahya Al Arab (PRH289), and Quraitem Palace. It is a reasonable inference that this was to arrange a meeting between Hassan Nasrallah and Mr. Hariri. During the afternoon, Mr. Nasser travelled first to Haret Hreik in Dahyieh and then to Quraitem Palace.
63. Phone activity of Mr. Hariri's security detail is consistent with him meeting Hassan Nasrallah in Haret Hreik, near to the Hezbollah General Secretariat, from the late evening (approximately 23:11) and until approximately 00:25 on 28 September 2004.
64. Shortly before the meeting, a three and a half minute call took place between Rustom Ghazaleh and Quraitem Palace. On returning to the Palace after the meeting, both Mr. Al-Arab and Mr. Al-Hassan's phones were in contact with him again.
47 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380747-D0380748.
38 R305259
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 28 September 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Prime Minister Hariri's Activities
65. After Prime Minister Hariri's late night meeting with Hassan Nasrallah the night before, he spent much of the day receiving visitors at Quraitem Palace. 48
66. Prime Minister Hariri was due to travel to France for a meeting with President Chirac the next day. 49 The first report of the implementation of UNSC Resolution 1559 was due to be issued three days later, on Friday, 1 October 2004. 50
B. Second Visit ofRustom Ghazaleh to Haret Hreik in Six Days
67. In mid-afternoon, Rustom Ghazaleh, the Syrian Military Intelligence Commander in Lebanon, exchanged calls with senior Hezbollah security official, Wafik Safa who, in tum, exchanged calls with the "Hassan Nasrallah" subscribed landline over the same period.
68. By 21:20, as Rustom Ghazaleh arrived in Greater Beirut from Anjar, he was called by Wafik Safa once again. Four minutes later, he returned the call lasting just 11 seconds. Their phones were both in Haret Hreik in the immediate vicinity of the Hezbollah General Secretariat. For over an hour both of their phones were inactive and, on their next activity, connected to cells in the same vicinity consistent with there being a meeting.
69. This was the second trip by Mr. Ghazaleh to Haret Hreik consistent with a meeting within six days, both had occurred in the same location, and both had followed meetings between Mr. Hariri and Mr. Nasrallah. The flurry of calls between Quraitem Palace, Hezbollah officials, and Mr. Ghazaleh over the same period indicates the occurrence of mutual matters of concern.
48 Exhibit P301, Quraitem Palace Visitors Logbook, ERN D0380523-D0380905, at D0380748-D0380749. 49 Exhibit P303, Press Release of29.09.04, Rafik Hariri meets with Chirac, ERN D0004690-D0004691. 50 Exhibit P450, Press Release of 30.09.04, Implementation of SC Resolution 1559, ERN D0004692-D0004694.
39 R305260
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
70. Shortly after the meeting, Mr. Safa received a further call from the "Hassan Nasrallah" subscribed landline.
C. Salim Ayyash Travelled to the Anjar/ Syrian Border Area
71. Mr. Ayyash spent the morning using his and his PMP 935 from the cell that provided predicted coverage to the immediate vicinity of his residence (SFEIR2). He called [S21] three times; S21 was located in and around the Anjar area near the Syrian border.
72. By 14:10, PMP 935 [Ayyash] was also in the Anjar area on the Syrian border. After 14:34, there was no further call activity at all on the Lebanese network on any of Mr. Ayyash's phones for 12 hours until 02:34 when a service text was received on PMP 935 connecting to the same cell on the border. This is consistent with him travelling into Syria and returning back into Lebanon in the early hours.
73. Later in the morning of 29 September, Mr. Ayyash ( ) very briefly travelled to the Zahle area, just north of Anjar, and was in contact with [S9] which was also in the Anjar area again (see also 16 September 2004).
D. Selected Attribution Points for Salim Ayyash: PMP 935 Switched to Salim Ayyash 's BMW Handset Again
74. During his journey, Mr. Ayyash switched his PMP 935 SIM card from its regular handset to the handset in his BMW, as he had done on 16 September.
40 R305261
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 29 September 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Prime Minister Hariri Met President Chirac in France
75. Prime Minister Hariri met with President Chirac in France. 51 This was their second meeting within a fortnight. The first report of the implementation of UNSC Resolution 1559 was due in two days: on Friday, 1 October 2004. 52
B. Salim Ayyash and S9 Briefly Travelled to Eastern Lebanon Again
76. Mr. Ayyash (PMP 935), who had used a cell in the Anjar/ Syrian border area at 02:34 after his phones had been inactive for the previous 12 hours, was back in south Beirut by 10:00 and had switched his PMP 935 SIM card back from the handset in his BMW to its regular handset.
77. However, by 10:38, [Ayyash] had again travelled east of Beirut, this time to the Chtaura/Zahle area, just north of Anjar, where he was in contact with [S9] who was again in the Anjar area. By 11:39, Mr. Ayyash had returned to Dahyieh when he unusually received a call from Hassan Merhi.
78. In the afternoon and evening, Mr. A yyash ( ) had further contact with [S9] and both were also in contact with [S8].
C. Hassan Merhi in Rare Contact with Salim Ayyash
79. [Merhi] called Salim Ayyash on his PMP 935. Contact between these two Accused was very rare: there were only four other days from this day through February 2005 when their phones were in contact (13 November 2004, 23 January 2005 and 5-6 February 2005).
51 Exhibit P303, Press Release of29.09.04, Rafik Hariri meets with Chirac, ERN D0004690-D0004691. 52 Exhibit P450, Press Release of 30.09.04, Implementation of SC Resolution 1559, ERN D0004692-D0004692.
41 R305262
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. Selected Attribution Points for Hassan Merhi
80. From 17:20 to 17:26, when Mr. Merhi and Hussein Oneissi exchanged calls on their Purple phones, Mr. Merhi was sited connecting to cells providing predicted coverage to the immediate vicinity of the airport. At 18:16, Mr. Merhi's wife and son passed through the security control at Departures at the airport. 53 By 18:28, [Merhi] had returned to Haret Hreik.
81. In the hour preceding its presence in the vicinity of the airport, [Merhi] had contact with its first and eighth most frequent contacts: Y ahya Beydoun [Redacted] (Mr. Merhi's brother-in-law and a mutual contact of Salim Ayyash) and Samer Atwi (the father of Mr. Merhi's daughter-in-law).
53 Telephone Attribution- Hassan Habib Merhi, V.4, ERN D0481043- D0481215, para. 288.
42 R305263
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 30 September 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Prime Minister Hariri in Paris
82. Prime Minister Hariri was in Paris meeting with French President Jacques Chirac. 54
B. First Day ofSalim Ayyash 's Green Phone Use and Green/Yellow Inter-connectivity
83. This is the first day that is attributable to Salim Ayyash.
84. [Badreddine] was m contact with [Ayyash] three times. Immediately after his last call with Mustafa Badreddine on their Green phones at 22: 19, Mr. Ayyash used his phone to call [S9]. There then followed seven more calls with S9 through the early hours of the following morning until 05:26.
C. Mustafa Badreddine in Contact with the Green Phone Subscription Contact Number
85. Following Salim Ayyash's first use of to contact Mustafa Badreddine ( ), Mr. Badreddine (SMP 944) immediately called a phone number 3 731777 which is listed as the contact number on two of the Green phone subscription
forms. 55
86. This was the same number that Wafik Safa had been in contact with (for the only time during the September 2004- 14 February 2005 period) on 24 September 2004 prior to Hassan Merhi' s first use of his (see 24 September 2004).
54 Exhibit P346, Logbook Record for Rafik Hariri's Trips Abroad, ERN 60004129-600004136, at 60004133; Exhibit P450, Press Release of 30.09.04, Implementation of SC Resolution 1559, ERN D0004692-D0004694. 55 Exhibit P405, Original Contrat D'Abonnement au Service Cellis in the name of Kamel Taleb in relation to mobile 3140048 dated 9 July 2004, ERN 60105074-60105080; Exhibit P405, Original Contrat D'Abonnement au Service Cellis in the name of Kamel Taleb in relation to mobile 3140030 dated 9 July 2004, ERN 60105081- 60105087.
43 R305264
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. Selected Attribution Points for Salim Ayyash
87. In the late evening, Mr. Ayyash's and both connected to SFEIR2, the cell that provided predicted coverage to the immediate vicinity of his home in Hadath.
E. Selected Attribution Points for Mustafa Badreddine
88. In the evening, PMP 663, SMP 944 and spent over two hours in the area of Samino Mar Elias and then an hour in the area of Samino Fum El Chebbak (PMP 663, SMP 944) before returning to south Beirut where the phones (PMP 663, SMP 944 and ) were connected on the same cell or in the same area for the rest of the evening. Throughout the day, SMP 944 and PMP 663 were in contact with a variety of people connected to Mr. Badreddine including university acquaintances, [Redacted] (PRH416), Jad, Zeina [Redacted], [Redacted] (PRH306) and Mohamed Shukr (the Samino manager).
44 R305265
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 1 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Prime Minister Rafik Hariri Abroad
89. Prime Minister Hariri was in Paris. 56
B. UN Secretary General's Report on UNSC Resolution 1559 Released
90. As originally scheduled, UN Secretary General Kofi Annan submitted his Report on the implementation of UNSC Resolution 1559 finding that the requirements set out in the Resolution had not been fulfilled. 57
C. Attempted Assassination ofMarwan Hamade
91. A VBIED exploded near to the car of Marwan Hamade in the immediate vicinity of his home in west Beirut in the morning. 58
D. Green and Yellow Network Interconnectivity
92. In the early hours of the morning, [Ayyash] was in contact with [S9] twice and then half an hour later, [Ayyash] called [Badreddine].
93. [Ayyash] and [Badreddine] were m contact three times between 01:12 and 02:13. Following the calls, [A yyash] was in contact with [S9] four times between 02:39 and 05:26.
94. Later in the morning, ureen -'UU [Ayyash] again called ureen u~"' [Badreddine]. A few minutes later, Yellow [Ayyash] called Yellow 933 [S8].
56 Exhibit P346, Logbook Record for Rafik Hariri's Trips Abroad, ERN 60004129-600004136, at 60004133. 57 Exhibit P451, Report of the Secretary General pursuant to Security Council Resolution 1559 (2004), ERN 602117 63-60211771. 58 Testimony ofMarwan Hamade, Transcript of 8 December 2014, p. 21.
45 R305266
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
E. Selected Attribution Points for Salim Ayyash
95. At 15:22, Mr. Ayyash's connected to a cell that provided predicted coverage to his Hadath home. Nine minutes earlier, his PMP 935 had connected to the same cell to receive a SMS text from a Syrian number. At 17:55 and 17:58, respectively, [S8] and [S9] called Mr. Ayyash's At 18:01, Mr. Ayyash's connected to the same cell as his had used three minutes before.
F. Selected Attribution Points forMustafa Badreddine
96. PMP 663, SMP 944, and connected to cells in the Jounieh area in the early hours of the morning until 01:59. By 02:13, Mr. Badreddine ( ) had returned to Beirut. PMP 663, SMP 944, and spent the morning and afternoon connecting to cells in Dahyieh (Ghobeiry and Haret Hreik). Between 15:45 and 16:23, PMP 663 [Badreddine] called [Redacted] (PRH416) five times and travelled from Haret Hreik to the area of Samino Jewellery Fum El Chebbak. While in the area of Fum El Chebbak, PMP 663 was in contact with [Redacted] (PRH089) twice.
97. PMP 663 [Badreddine] then returned to Jounieh, where it remained until at least 22:29. While in the Jounieh area, it was in contact with his close female friend, Zeina [Redacted], and [Redacted].
46 R305267
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 9 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. PresidentAl-Assad Condemned UNSC Resolution 1559
98. President Bashar Al-Assad delivered a speech in Damascus defending the Syrian presence in Lebanon. He condemned UNSC Resolution 1559 as an illegitimate and dangerous interference in Lebanese-Syrian affairs. He further condemned the "superpowers" for using the UN as their tool. He referred to Hezbollah and the Resistance as being the target of calls to disarm Lebanese militia. 59
59 Exhibit P432, UNIC Beirut Press Review, 11 October 2004, ERN D0411215-D0411225.
47 R305268
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 10 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Nasser Kandil Launched Heavy Attack on UNSC Resolution 1559 and the Opposition
99. MP Nasser Kandil, one of the "Syrian deposits", speaking at a Baath Party rally in Lebanon passionately defended Syrian involvement in Lebanon. He bifurcated the Lebanese political divide as either supporting "the nationalistic option endorsed by the Syria or those who back UNSCR 1559". He accused the 29 Lebanese MPs who voted against the extension of President Lahoud's mandate as belonging to a "list of shame". He further besmirches Walid Jumblatt as a pro-Israeli collaborator. 60
100. Three days before, Mr. Kandil had also called for the dissolution of the UN Security Council as it met in New York to determine the implementation ofUNSCR 1559. 61
60 Exhibit P432, UNIC Beirut Press Review, 11 October 2004, ERN D0411215-D0411225, at D0411220. 61 Exhibit P532, UNIC Beirut Press Review, 08 October 2004, ERN D0410952-D0410959, at D0410953.
48 R305269
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 13 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Green Network Tightened Operational Security
101. Salim Ayyash ( ) made a short call to Mustafa Badreddine ( ). Whilst the Green Network had been operating as a closed user group of three phones since Salim Ayyash joined the network on 30 September, it was from this day that it became 100% closed.
49 R305270
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 16 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Prime Minister Hariri Met with US Ambassador
102. Prime Minister Hariri met with US Ambassador Jeffrey Feltman to discuss US Congressional Proposals regarding the freezing of Lebanese/ Syrian officials' assets as a means to exercise pressure on Lebanon and Syria. 62
62 Exhibit P303, Press Release of 16.10.04- Hariri informs Feltman about his opposition Syrian and Lebanese officials' assets frozen, ERN D0004730-D0004730; Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905 at 00380769.
50 R305271
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 17 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Prime Minister Rafik Hariri Met with Hussein Khalil
103. Prime Minister Hariri received visitors at Quraitem Palace throughout the day. 63 In the evening, there were a series of calls between Mustafa Nasser (PRH476) and Quraitem Palace, and Hezbollah officials Khalil Farhat and Hussein Khalil. In the late evening, Mr. Nasser visited Quraitem Palace. 64 Hussein Khalil's call activity is consistent with him being present at their meeting at Quraitem Palace between about 23:07 and midnight.
104. Mr. Khalil called Syrian Brigadier General Rustom Ghazaleh at 00:32 upon his return to Haret Hreik following the meeting.
63 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380769-D0380770. 64 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at 00380770.
51 R305272
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 18 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Prime Minister Hariri at Quraitem Palace
105. This was two days before Mr. Hariri's resignation as Prime Minister on 20 October 2004. He received visitors at Quraitem Palace from 07:30 until the early hours of the following morning at 01:30. 65
B. First Day ofBlue Network Activity
106. This was the first day of communication between the initial closed user group of three Blue phones composed of [S5], [S7] and [A yyash]. This was the start of the formation of the Blue Network.
107. The three phones were set-up by contacting the network provider in quick succession just after two in the afternoon. It is a reasonable inference that this was performed by a single user due to the consecutive times and close proximity of the cell towers in Dahyieh they connected with which would become associated with the heaviest Blue Network Phone activity. Later in the evening, [S5] had contact with both [Ayyash] and [S7].
65 Exhibit P30 1, Quraitem Palace visitors Log Book, ERN D0380523-D0380905 _ D_EN.
52 R305273
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 19 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Prime Minister Rafik Hariri Attended Parliament and Discussed his Imminent Resignation and Later Met with Hussein Khalil
108. Mr. Hariri and over 100 MPs and Ministers attended a parliamentary session, which was held at 10:45. The main topic of discussion was the timing of the government's resignation and the consultation process for formation of the next government. 66 Mr. Hariri resigned the following day.
109. Journalist Mustafa Nasser (PRH476) met with Mr. Hariri at Quraitem Palace in the very late evening/early morning of 20 October 2004 and Hassan Nasrallah's political Secretary Hussein Khalil's phone activity in the area at the same time is consistent with him also participating in the meeting.
B. Green and Blue Network Activity: Second Day of Closed-User Group Activity for Both Networks
110. [Ayyash] called [Badreddine] once during the afternoon and their phones connected with adjacent cell towers in south Beirut.
111. [Ayyash], [S5], and [S7] were active in the afternoon. There were five calls all in Dahyieh, with one exception. This was their second day of activity since becoming a closed-user group of three phones the day before, 18 October.
C. President of UN Security Council Expressed Concern at Non-Implementation of UNSC Resolution 1559
112. The President of the United Nations Security Council issued a statement following a meeting of the Security Council on the situation in the Middle East. He noted with
66 Exhibit P303, Press Release of 19.10.04 -Parliament renews the formation of its office in a short session chaired by Berri and attended by Hariri, ERN D0004809-D0004817, see D0004810.
53 R305274
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
"concern that the requirements set out in resolution 1559 (2004) have not been met
[ 00 0] and urge[ d] relevant parties to implement fully all provisions of this
67 resolution" 0
67 Exhibit P542, Statement of the President of the Security Council, S/PRST/2004/36 dated 19 October 2004, ERN D0407554-D04075540
54 R305275
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 20 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Prime Minister Rafik Hariri Resigned
113. Prime Minister Hariri travelled to Baabda Palace at around 14:30 to present his resignation to President Lahoud. 68 Following Mr. Hariri's resignation, he received visitors at Quraitem Palace from 14:55 to 23:30. 69
B. Rafik Hariri met with Hussein Khalil and Nasser Kandil
114. Mr. Nasser (PRH476) visited Mr. Hariri at Quraitem Palace twice (13:45-16:15 and 21:10-00:20). 70 During the first visit, Mr. Nasser was in contact with Hezbollah official Khalil Farhat.
115. The call activity during the second visit is consistent with Hezbollah official Hussein Khalil having joined Mr. Nasser and Mr. Hariri shortly before midnight as he did on the evenings of 17 and 19 October 2004. Shortly before Mr. Khalil travelled there, he called the Head of Syrian Military Intelligence in Lebanon, Rustom Ghazaleh.
116. Immediately before Mr. Nasser's second meeting, Mr. Hariri received MP Nasser Kandil, a "Syrian deposit", at Quraitem Palace.71 Immediately after he was logged out of Quraitem Palace, Mr. Kandil phoned Mr. Ghazaleh.
C. First Day ofBlue Network Surveillance around Quraitem Palace
117. This was the first day of Blue Network phone activity around Quraitem Palace. In the mornmg, [S5] called [S 7], while both were in the area of Quraitem Palace. By that time Mr. Hariri had already travelled to Parliament. In the afternoon and evening when Mr. Hariri was at his residence, Blue 324 [S7] and Blue 585 [S5]
68 Exhibit P452, Press Releases from Quraitem Palace Press Office, 20 October 2004 (Al Mustaqbal Newspaper, Thursday 21st October 2004), ERN D0004761-D0004762_D_EN_Ol, pp. 1, 2; Transcript of 10 March 2015, p. 70. 69 Exhibit P301, Visitor Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380772- D0380774. 70 Exhibit P301, Visitor Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380772, D0380774. 71 Exhibit P301, Visitor Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380773.
55 R305276
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
were located around Quraitem Palace, while [Ayyash] remained in south Beirut.
D. Green Network Activity: Mustafa Badreddine and Salim Ayyash Meeting
118. Mr. Badreddine ( ) was also in contact with [Ayyash] four times within half an hour.
119. For their final two Green calls of the day at 21:10 and 21:19, [Badreddine] and [Ayyash] connected first to adjoining cells and then to the same cell tower (CHIAH2), the location of their phones having converged since their first Green calls twenty minutes before. This is consistent with them having met in south Beirut.
E. Selected Attribution Points for Salim Ayyash
120. Immediately before the penultimate Green call, PMP 935 [Ayyash] connected to the same cell as his consistent with single use. PMP 935 had been in contact with a phone attributable to Mr. Ayyash's brother earlier in the afternoon.
F. Selected Attribution Points for Mustafa Badreddine
121. Between 20:48 and 20:54, Mr. Badreddine's phones (PMP 663, SMP 944, and ) were in the area of Parliament and Minet Al Hosn while in contact with [Redacted] (PRH306), [Redacted] (PRH416) and Zeina [Redacted] and [Ayyash]. Between 20:54 and 21:10, his phones (PMP 663, SMP 944, and ) then returned to south Beirut where they co-located; PMP 663 received a call from Mr. Badreddine's close female friend Zeina [Redacted].
56 R305277
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 21 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
122. This was the day following former Prime Minister Hariri's resignation. He received visitors at Quraitem Palace throughout the day and appears to have left the Palace twice, including once to visit Marwan Hamade (PRH038) (16:53-17:20). 72
B. Omar Karami Appointed Prime Minister ofLebanon
123. President Emile Lahoud appointed Omar Karami as Lebanon's Prime Minister.73
C. Blue Network Phones: Surveillance ofQuraitem Palace
124. [S5] and [S7] called each other twice in the vicinity of the east side of Quraitem Palace during the afternoon. On the first occasion, Mr. Hariri appeared to be away from the Palace, based on his bodyguards' phone activity. However, [S5] and [S7] were again active in the area in the late afternoon, when Mr. Hariri was at the Palace. In the evening, when the Blue phones had returned to Dahyieh, [S5] and [Ayyash] exchanged three calls.
72 Exhibit P301, Visitor Logbook for Quraitem Palace dated 02.01.2004 to 14.02.2005, ERN D038053- D0380905, at ERN D0380774-D0380777. 73 Exhibit P532, UNIC Beirut Press Review, 22 October 2004, ERN D0412058-D0412064; Testimony ofGhazi El-Youssef, Transcript of 10 March 2015, p. 64.
57 R305278
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 22 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Blue Network Activity: First Day ofMobile Surveillance ofRafik Hariri
125. This is the first day that the Blue Network phones conducted mobile surveillance on Mr. Hariri, following him away from Quraitem Palace.
126. Mr. Hariri was at Quraitem Palace for most of the day. 74 However, at around 16:25, three of Mr. Hariri' s bodyguards' phones connected to cell towers in the vicinity of Marwan Hamade's (PRH038) residence, consistent with Mr. Hariri visiting Mr. Hamade. At the same time, [S7] called [S5]. [S7] connected to cell tower Riviera_B, in the vicinity ofMr. Hamade's residence, which is the same cell that one ofMr. Hariri's bodyguards connected to. [S5] was in vicinity of Quraitem Palace for this call. This was the only activity of the Blue phones in west Beirut that day.
127. Shortly after Mr. Hariri's return to Quraitem Palace, [S5] returned to south Beirut and called [Ayyash]. [S7] and [S5] exchanged further calls in south Beirut.
B. Selected Attribution Points for Salim Ayyash
128. Mr. Ayyash used PMP 935 in and around the immediate vicinity of his Hadath residence throughout the day and was in contact with a number of his regular contacts including his brother Ali Ayyash and the Civil Defence Station in Nabatiyeh. Shortly after his call from [S5], PMP 935 connected to a nearby cell in Dahyieh.
74 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380777-D0380780.
58 R305279
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 23 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
129. Former Prime Minister Hariri received visitors at Quraitem Palace throughout the d ay. 75
B. Blue Network Activity in Dahyieh
130. [S5] was in contact with [S7] in the morning and [Ayyash] in the afternoon. All were in located Dahyieh.
75 Exhibit P301, Visitor Logbook for Quraitem Palace dated 02.01.2004 to 14.02.2005, ERN D0380523- D0380905, at ERN D0380780-D0380781.
59 R305280
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 24 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Travelled to Paris
131. Former Prime Minister Hariri departed for Paris at around 10:30. He remained abroad until Wednesday, 27 October 2004. 76
B. No Network Activity
132. There were no Green or Blue Network calls and no inter-Yellow Network calls.
76 Exhibit P346, Logbook ofRafik Hariri's trips abroad, ERN 60004129- 600004136, at 60004133.
60 R305281
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 25 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
133. Former Prime Minister Rafik Hariri was abroad in Paris between 24 and 27 October 2004. 77
B. Blue Network Activity: Only One Call
134. There was only one Blue Network phone call between [S5] and [Ayyash] in Dahyieh.
77 Exhibit P346, Logbook of Rafik Hariri's trips abroad, ERN 60004129- 600004136, at 60004133.
61 R305282
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 26 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri in Paris
135. Former Prime Minister Hariri was in Paris, France and Riyadh, Saudi Arabia; he returned to Lebanon on the following day. 78
B. Prime Minister Hariri's Resignation became Official
136. Prime Minister Hariri's resignation became officiaC9 and Prime Minister Omar Karami announced the formation of the new Cabinet.
C. Limited Blue Network Activity
13 7. There were two phone calls between [S7] and [S5]. [S5] was in the vicinity of Quraitem Palace on the first call.
78 Exhibit P346, Logbook record of Rafik PM Hariri trips abroad 12 May 04 to 05 Feb 05, ERN 60003993- 60004136, at ERN 60004133T, p. 5; Exhibit P536, Rafik Hariri's passport of 2004, ERN 60242298- 60242323_D_EN, at ERN 60242320, p. 23; Exhibit P303, Press Releases from Quraitem Palace Press Office, 27 October 2004, ERN D0004791-D0004791. 79 Exhibit P539, Decree relating to the resignation of Prime Minister Hariri, ERN 60219164; Exhibit 3D00126, Extrait Site Internet de la Presidence du Conseil des ministers libanais, ERN 1DT3-0020-1DT3- 0027_0AR_T_EN, at 1DT3-0020.
62 R305283
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 27 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Returned to Lebanon and met with Beirut Decision Bloc and with "Syrian Deposits"
138. This was the day following Omar Karami's new government being sworn in and former Prime Minister Hariri returned from Saudi Arabia in the late afternoon. 80
139. Mr. Hariri held the Beirut Decision bloc meeting at Quraitem Palace 81 and met with the three "Syrian deposits", MPs Bassem Yammout, Adnan Arakji, and Nasser Kandil during the evening. 82 Mr. Arakji was logged out from the Palace at 21:00. Just over half an hour later, he had an eight minute telephone conversation with Rustom Ghazaleh.
B. Limited Blue Network Activity in Dahyieh
140. There were two calls involving the three active Blue Network phones with all three located in south Beirut. [S5] called [S7] in the morning and then [Ayyash] in the afternoon.
Ro Exhibit P346, Logbook record of Rafik PM Hariri trips abroad 12 May 04 to 05 Feb 05, ERN 60003993- 60004136, at ERN 60004133T, p. 5; Exhibit P536, Rafik Hariri's passport of 2004, ERN 60242298- 60242323_D_EN, at ERN 60242320, p. 23. 81 Exhibit P303, Press Releases from Quraitem Palace Press Office, 27 October 2004, ERN D0004791- D0004791. 82 Exhibit P301, Visitor Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380782.
63 R305284
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 28 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
141. Former Prime Minister Hariri received visitors at Quraitem Palace throughout the day, including Mustafa Nasser (PRH476). 83
B. Blue Network Activity: Only One Call
142. The only Blue phone contact occurred in the morning when [S5] in Jnah called [S7] in south Beirut.
C. Green Network Activity: Green Phone Bills Paid and Salim Ayyash and Mustafa Badreddine in Contact
143. The invoices for all 18 Green phones were paid at the Alfa service centre in Fum El Chebback. 84 Mustafa Badreddine and Salim Ayyash received their consequent service texts at their most dominant cells: ROUEIS3 (in Haret Hreik) and SFEIR2 (in Hadath), respectively. SFEIR2 provided predicted coverage to the vicinity of Mr. Ayyash's home in Hadath.
144. There was one call between [A yyash] and [Badreddine].
D. Selected Attribution Points for Salim Ayyash
145. Mr. Ayyash ( ) connected to a cell in the vicinity of the airport to call to Mr. Badreddine. He also used his PMP 935 from the same cell four minutes later. Prior to that, he had used his PMP 935 in south Beirut, including SFEIR2, to call his car sales associate Ghaleb Jaber, among others.
R3 Exhibit P301, Visitor Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380782- D0380783. 84 Exhibit P796 MFI, Network Analysis Report, ERN D0486921-D0487145, paras. 284-287; Exhibit P486, Copies of receipts K584100 to K584106, dated 28/10/2004, ERNs staring 60179889 through 60179932; See also Exhibit P795, Network Phone Power Point Presentation of Gary Platt, slide 44.
64 R305285
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 29 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
146. Rafik Hariri received visitors at Quraitem Palace throughout the day, including Mustafa Nasser (PRH476) between 23:15 and 23:48. 85
B. Limited Blue Network Activity
147. [S7] and [S5], the two Blue phones primarily active at this time, were involved in three calls with each other. [S5] was located in west Beirut at 09:53.
85 Exhibit P301, Visitor Logbook for Quraitem Palace, ERN 00380523-00380905, at 00380783-00380785.
65 R305286
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 30 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
148. There were no visitors recorded for Rafik Hariri at Quraitem Palace. 86
B. Limited Blue Network Activity
149. There were four calls between [S5] and [S7] in south Beirut.
C. Rustom Ghazaleh Visited Haret Hreik
150. Senior Hezbollah official Wafik Safa and Rustom Ghazaleh were in phone contact four times during the late afternoon/evening, by which time Mr. Ghazaleh made his way into Beirut from Anjar. Shortly before the last three of those calls (all made within 10 minutes of each other), Mr. Safa had also contacted the "Hassan Nasrallah" subscribed landline.
151. At 22:41, Mr. Ghazaleh's phone connected to a cell site in the heart ofHaret Hreik in the immediate vicinity of the Hezbollah General Secretariat. His phone had been inactive for two hours beforehand (before which he was located just east of Haret Hreik) and was also inactive two hours thereafter (after which he moved away to Chtaura area). Between 22:00 and 22:42, Mr. Safa's phone was also inactive. Either side of those times he had also connected to cell sites in the vicinity of the Hezbollah General Secretariat before moving away to the Ouzaii area.
152. The circumstances are consistent with Mr. Ghazaleh meeting Hezbollah officials at or near the Hezbollah General Secretariat.
86 Exhibit P301, Visitor Logbook for Quraitem Palace, ERN D0380523-D0380905, at 00380785.
66 R305287
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 31 October 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
153. Former Prime Minister Rafik Hariri received visitors at Quraitem Palace for much of the dal7 and his bodyguards' phones indicate he visited Marwan Hamade (PRH038) midday.
B. No Green or Blue Network Activity
154. No Green or Blue Network phones were active today.
87 Exhibit P301, Visitor Logbook for Quraitem Palace, ERN 00380523-00380905, at 00380785-00380786.
67 R305288
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 1 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
155. Former Prime Minister Hariri received a number of visitors at Quraitem Palace throughout the day. 88
B. Blue Network Activity: Surveillance ofQuraitem Palace
156. Blue Network phones [S7] and [S5] were in contact near Quraitem Palace at 10:00 and 16:40. [Ayyash] called [S5] at the end of the day.
C. One Green Network between Salim Ayyash and Mustafa Badreddine
157. [Ayyash] and [Badreddine] were in contact once.
88 Exhibit P303, Press Releases from Quraitem Palace Press Office, 1 November 2004, ERN D0004836- D0004837; Exhibit P301, Visitor Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380786- D0380788.
68 R305289
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 2 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
158. Former Prime Minister Hariri was at Quraitem Palace rece1vmg visitors for the majority of the day. 89
B. Blue Network Activity: Surveillance of Quraitem Palace
159. Two of the three Blue phones that had formed an initial closed network ( [S5] and [S7]) continued to exchange calls in the immediate vicinity of Quraitem Palace.
89 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN 00380523-00380905, at 00380788-00380789.
69 R305290
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 3 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Travelled to Italy at Mid-Day
160. Former Prime Minister Hariri had visitors registered at Quraitem Palace in the morning. 90 He then travelled from Beirut International airport to Italy around midday. 91
B. Blue Network Activity: Surveillance of Quraitem Palace
161. Blue Network phones [S5] and [S7] were active in the area of Quraitem Palace both in the morning and the afternoon. [A yyash] called [S5] while in the vicinity of the Palace twice during the afternoon.
C. Selected Attribution Points for Salim Ayyash
162. The activity of PMP 935 and is consistent with their common use by Mr. Ayyash and him travelling to the Bekaa Valley. Both phones connected to cell sites one minute apart providing overlapping predicted coverage on the road to Zahle. Throughout the day, PMP 935 had contact with a number of Mr. Ayyash's associates including a call made from a cell in the vicinity of Zahle to his home in Hadath.
90 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380789. 91 Exhibit P346, Logbook Record ofHariri's trips abroad, ERN 60003993-60004136, at ERN 60004133.
70 R305291
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 4 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Returned to Lebanon Briefly before Travelling to Abu Dhabi
163. Former Prime Minister Hariri returned from Italy to Lebanon. 92 Mr. Hariri arrived at Beirut International Airport at approximately 13:25 and immediately travelled to the Lebanese Parliament area where he stayed less than an hour. Thereafter, Mr. Hariri returned to Quraitem Palace. The Prime Minister was only briefly at his residence before returning to the Beirut International Airport shortly before 15:00 to travel to Abu Dhabi in the United Arab Emirates.
164. Prime Minister Hariri travelled to Abu Dhabi to offer condolences on the death of Sheikh Zayed Bin Sultan Al Nahayan. 93
B. Blue Network Activity: Continued Daily Surveillance of Quraitem Palace
165. [S5] exchanged several calls with [S7]. Both were active around the Quraitem Palace area between 10:16 and 14:55 consistent with their movements on previous days. Salim Ayyash did not use his Blue phone, but was active on his Yell ow phone.
92 Exhibit P346, Logbook record of Rafik Hariri's trips abroad 12 May 2004 to 5 Feb 2005, ERN 60004129- 60004136,at60004133. 93 Exhibit P303, Press Releases from Quraitem Palace Press Office, 4 November 2004, ERN D0004863- D0004863; Exhibit P346, Logbook record of Rafik Hariri's trips abroad 12 May 2004 to 5 Feb 2005, ERN 60004129-60004136,at60004133.
71 R305292
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 5 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Returned to Beirut
166. Former Prime Minister Hariri had returned to Lebanon from Abu Dhabi. A number of visitors registered at Quraitem Palace to meet Mr. Hariri between 08:00 and 10:00.94 He then attended a ceremony at the Dar El Fatwa at 10:00 where he and Grand Mufti Qabbani laid the foundation stone for the construction of a headquarters for the Zakat fund. 95 Thereafter, Mr. Hariri returned to his residence for more meetings.
167. Rafik Hariri attended Iftar at the Phoenicia Hotel between approximately 16:50 and 18:15. During the dinner, Mr. Hariri stated that if the people of Beirut wanted him to continue to represent them, he would be at their disposal. 96
B. Blue Network Activity: Surveillance ofQuraitem Palace
168. [S5] was active in the area of Quraitem Palace both in the morning and early afternoon. [Ayyash] called [S5] in the early afternoon.
94 Exhibit P301, Visitor's Logbook for Quraitem Palace, ERN D0380523- D0380905, at D0380790. 95 Exhibit P303, Press Releases from Quraitem Palace Press Office, 5 November 2004, ERN D0004861- D0004862_D_EN, (p.l). 96 Exhibit P303, Press Releases from Quraitem Palace Press Office, 20 October 2004, ERN D0004824 - D0004828 D EN.
72 R305293
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 6 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
169. Former Prime Minister Hariri received visitors at Quraitem Palace during the day. 97
B. Green Network Activity: Hassan Merhi (Only Contact until 23 December) and Salim Ayyash both called Mustafa Badreddine
170. [Merhi] and [Ayyash] both called [Badreddine] within 20 minutes of each other from different locations in south Beirut.
171. This was the first Green call between Hassan Merhi and Mustafa Badreddine for a month, and it was after this weekend that regular calls between Mr. Merhi, Assad Sabra and Hussein Oneissi resumed after two weeks of non-contact.
172. The next Green call between them would not take place until 23 December 2004, only days before Mr. Sabra and Mr. Oneissi' s phones began to connect with the cells in the immediate vicinity of the Arab University Mosque.
C. Limited Blue Network Activity in Dahyieh
173. [S7] and [S5] were in contact with each other twice in south Beirut.
97 Exhibit P301, Visitor's Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380791-D0380792.
73 R305294
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 7 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
174. Former Prime Minister Rafik Hariri met visitors at Quraitem Palace throughout the d ay. 98
B. No Green or Blue Network Activity
175. The Green and Blue Network phones were not active on this day.
98 Exhibit P301, Visitors Logbook for Quraitem palace, ERN D0380523-D0380905, at D0380792-D0380793.
74 R305295
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 8 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECTION
A. Rafik Hariri at Quraitem Palace and Visited Marwan Hamade
176. Former Prime Minister Hariri met with a number of visitors at Quraitem Palace throughout the day. 99 Between 13:07 and 14:07, the phone of one of Mr. Hariri's security detail, Talal Nasser, was located in the vicinity of Marwan Hamade's (PRH038) residence consistent with one of Mr. Hariri's regular visits there. By 14:27, he had returned to the vicinity of Quraitem Palace.
B. Blue Network Activity: Surveillance at Quraitem Palace and Marwan Hamade's Residence
177. Between 13:22 and 13:50, [S7] connected to cells in the vicinity of Mr. Hamade's residence consistent with surveillance of Mr. Hariri. By 14:18, [S5] was in the Quraitem Palace area connecting to an adjacent cell to the one connected to by Talal Nasser at 14:27. There were further calls in that area between these Blue phones from 16:44 to 16:46. By 20:03, both phones had returned to the Haret Hreik area of Dahyieh.
99 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380793- D0380794.
75 R305296
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 9 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace and Met with UN Secretary General's Representative in Lebanon, Staffan de Mistura
178. Former Prime Minister Hariri met with a number of visitors at Quraitem Palace throughout the day. 100 One of these visitors was the UN Secretary General's personal representative in Lebanon, Staffan de Mistura, who commended Mr. Hariri for his assistance in establishing good relations between Lebanon and the international commumty.. 101
B. Blue Network Activity: Surveillance of Quraitem Palace
179. [S5] and [S7] were in contact twice. On the second occasion in the mid-afternoon, both phones connected to the same cell in the immediate vicinity of Quraitem Palace. This was the eleventh day these phones were active in the Quraitem Palace area since they started contacting each other on 18 October.
C. Purple Phone Activity: Hussein Oneissi and Hassan Merhi's First Contact in Over Two Weeks
180. [Oneissi] and [Merhi] were in contact twice. This was their first contact since 21 October 2004. This pattern of contact and non-contact was very similar to that of Hassan Merhi and Assad Sabra. The following day was the first contact between them since 23 October 2004.
100 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380794-D0380796. 101 Exhibit P303, Press Releases from Quraitem Palace Press Office, 09 November 2004, ERN D0004840- D0004841 D EN.
76 R305297
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 10 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Attended lftar Ceremony and Gave a Speech on the New Electoral Law
181. Former Prime Minister Hariri met with a number of visitors at Quraitem Palace during the day. 102
182. Mr. Hariri attended an lftar ceremony at the Sheraton Coral Beach Hotel. There the former Prime Minister gave a speech on the importance of the new elections law and the impact that it would have on Lebanon. He stated he would give his opinion on the law once it had been submitted to Parliament. 103
B. Blue Network Activity: Surveillance of Quraitem Palace
183. [S5] and [S7] were in contact on eight occasions during the day. While they started and finished the day in south Beirut, they were active in the area of Quraitem Palace over five and half hours, between at least 10:58 and 16:31. In the evenmg, [Ayyash], who connected to cells in Haret Hreik, called [S5].
C. Green Network Activity: Last Green Contact between Salim Ayyash and Mustafa Badreddine until 20 December
184. Salim Ayyash called Mustafa Badreddine twice using their Green Network phones. On the second occasion, their short call connected to a common cell, ROUEIS3, by far the most dominant cell used by Mr. Badreddine's Alfa phones (SMP 944, Green 023) consistent with them meeting.
102 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380796- D0380798. 103 Exhibit P303, Press Releases from Quraitem Palace Press Office, 10 November 2004, ERN D0004848- D0004851 D EN.
77 R305298
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
185. These were the last two of only four calls between the men in November, and the last ones for 40 days until 20 December 2004 after which the surveillance of Rafik Hariri began to be conducted by all six of the network users ("The Principal Six") that would go on to co-ordinate the assassination using Red phones (rather than merely two of the six).
D. Purple Phone Activity: First Contact between Hassan Merhi and Assad Sabra in Almost Three Weeks
186. [Merhi] and [Sabra] were in contact with each other five times. In a similar fashion to the contact between Hassan Merhi and Hussein Oneissi, this was the first time that the two men had telephone contact since 23 October 2004.
E. Selected Attribution Points for Mustafa Badreddine and Salim Ayyash
187. Shortly before and after both of the Green calls, Mr. Badreddine (PMP 663, SMP 944) and Mr. Ayyash (PMP 935, ) made calls that connected to the same cells or those with overlapping predicted coverage as their Green Phones. Before the first call, Mr. Ayyash had called his wife's cousin from his phones' most dominant cell providing predicted coverage to his residence.
188. The contact profile of Mr. Badreddine and Mr. Ayyash's PMP and SMP phones throughout the day accorded with their usual or familial associates. In the evening, Mr. Badreddine (PMP 663 and SMP 944) was active in the area of the Bourj Hammoud branch of Samino Jewellery and shortly before midnight, in the area of [Redacted]. [Redacted] (PRH089) was active in the area [Redacted] during the same period, consistent with them having met there.
78 R305299
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 11 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Travelled to Saudi Arabia in the Afternoon
189. Former Prime Minister Hariri met with a number of visitors to Quraitem Palace between 08:00 and 12:00. 104 Mr. Hariri conveyed his condolences to the Palestinian people for the death of President Y asser Arafat. 105
190. Around noon, Rafik Hariri travelled to Beirut International Airport and departed for Saudi Arabia to perform the Umrah pilgrimage and Eid al Fitr prayers in Mecca. 106 Mr. Hariri remained in Saudi Arabia for three days.
B. Blue Network Surveillance ofRafik Hariri at Quraitem Palace and the Airport
191. The phone activity of [S5] and [S7] is consistent with them conducting their now almost daily surveillance on Quraitem Palace and following the Rafik Hariri convoy to Beirut International Airport.
C. Purple Phone Activity
192. There were five calls between [Merhi] and [Sabra] and one call between [Merhi] and [Oneissi]. Following that call, at 20:58, Yahya Beydoun [Redacted], Hassan Merhi's brother-in-law, made a succession of eight calls over the course of only 40 minutes: five with Hussein Oneissi and three with Mr. Merhi.
104 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380798; Exhibit P303, Press Releases from Quraitem Palace Press Office, 11 November 2004, ERN D0004835- D0004835 D EN. 105 Exhibit-P303, Press Releases from Quraitem Palace Press Office, 11 November 2004, ERN D0004822- D0004822_D_EN_01, at ERN D0004822, (p.1). 106 Exhibit P346, Logbook record of Rafik HARIRI trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D _EN_01, at ERN 60004134T, (p.6).
79 R305300
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 12 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
193. Former Prime Minister Hariri was in Saudi Arabia to perform the Umrah pilgrimage and Eid al Fitr prayers in Mecca. 107 He travelled to Cairo to attend Yasser Arafat's funeral. He then returned to Saudi Arabia. 108
B. Blue Network Activity: No Blue Activity around Quraitem Palace in Rafik Hariri's Absence
194. In contrast to the near daily surveillance of Quraitem Palace and/or Mr. Hariri since the beginning of November, there was only one Blue call when he was absent, which was between [S7] and [S5]. This occurred in the morning while both were in south Beirut and was the last time they called each other for 10 days until22 November 2004.
C. Hassan Nasrallah Affirmed Alliance with Syria and Rejected UNSC Resolution 1559 in Speech
195. Hassan Nasrallah, speaking to a televised mass rally in Baalbek, rejected UNSC Resolution 1559 as serving Israeli interests. He also stressed that Hezbollah was committed "to standing by Syria and to defending Syria just like Syria has defended
us".1o9
107 Exhibit P346, Logbook record of Rafik Hariri trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_01, at ERN 60004134T, (p.6). Exhibit P303, Press Releases from Quraitem Palace Press Office, 11 November 2004, ERN D0004835-D0004835 D EN. 108 Exhibit P303, Press Releases from Quraitem Pala;;-e Press Office, 12 November 2004, ERN D0004823- D0004823 _ D _EN; Exhibit P346, Logbook record of Rafik Hariri trips abroad 12 May 04 to 05 Feb 05, ERN 60004129-60004136_0 _EN_01, at 60004134T, (p.6). 109 Exhibit P532, UNIC Press Review of 12 November 2004, ERN D0411305-D0411215 at 00411309.
80 R305301
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. Purple Phone Activity
4. [Merhi] and [Sabra] were m contact five times m the afternoon and evening.
Saturday, 13 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Returned to Beirut
196. This was the final day of Ramadan. Former Prime Minister Hariri returned in the evening from performing Omrah Pilgrimage and Eid Al-Fitr Prayers in Saudi Arabia. 110 Thereafter, Mr. Hariri received visitors at Quraitem Palace including, between 20:50 and 22:05, Mustafa Nasser (PRH476). 111
B. Hassan Merhi and Salim Ayyash Unusually in Contact
197. Hassan Merhi ( ) called Salim Ayyash (PMP 935). This was the first contact between them on attributed telephones since 29 September 2004. There would be no further telephone contact between them until23 January 2005.
110 Exhibit P346, Logbook record of Rafik HARlRI trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 600004136,at60004134. 111 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380799.
81 R305302
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 14 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
198. Former Prime Minister Rafik Hariri remained at Quraitem Palace throughout the d ay. 112
B. No Blue or Green Network Activity
199. There was no further Blue phone activity until 17 November and no Green phone activity until 20 December.
112 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN 00380523-00380905, at 00380799-00380801.
82 R305303
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 15 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
200. Former Prime Minister Rafik Hariri spent the maJonty of the day in his Beirut residence. 113 Mr. Hariri met Walid Jumblatt (PRH684) and Ghazi Aridi at Quraitem P a 1ace m. t h e evenmg. . 114
113 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380801-D0380804. 114 Exhibit P303, Press Releases from Quraitem Palace Press Office, 15 November 2004, ERN D0004833- D0004833 D EN.
83 R305304
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 16 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
201. Former Prime Minister Hariri spent the majority of the day in Quraitem Palace receiVmg. . visitors. . . 115
B. No Blue Network Activity
202. There was no Blue Network phone activity for the fifth consecutive day out often.
115 Exhibit P301, Visitor's Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380804 - D0380806.
84 R305305
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 17 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
203. Former Prime Minister Hariri received visitors at Quraitem Palace. 116
204. At midday, Mr. Hariri's security detail, including Wissam AI Hassan (PRH680), was in the area of Marwan Hamade's (PRH038) residence (consistent with Mr. Hariri's presence there).
B. US Ambassador Underscored Importance ofImplementing UNSC Resolution 1559
205. US Ambassador Jeffrey Feltman underscored the importance of implementing UN Security Council Resolution 1559 during a visit to Maronite Patriarch Nasrallah Sfeir in Bkirki. 117
116 Exhibit P301, Visitor's Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380806-D0380808. 117 Exhibit P532, UNIC Beirut Press Review, 18 November 2004, 18-11-2004, ERN D0411758-D0411764.
85 R305306
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 18 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Travelled to France
206. Former Prime Minister Rafik Hariri travelled to France around midday for seven days.118
118 Exhibit P346, Logbook record ofRafik Hariri's trips abroad, ERN 60004129-600004136, at 60004134.
86 R305307
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 19 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri in Paris
207. Former Prime Minister Rafik Hariri was in Paris. He had left Beirut for Paris the prevwus. d ay. 119
B. No Blue Network Activity
208. There was no Blue call activity for the seventh consecutive day.
119 Exhibit P346, Logbook record of Rafik Hariri's trips abroad, ERN 60004129-600004136, at 60004134; Exhibit P303, Press Releases from Quraitem Palace Press Office, 18 November 2004, ERN D0004856- D0004856 D EN.
87 R305308
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 20 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
209. Former Prime Minister Rafik Hariri was in Paris and Switzerland on a personal trip between 18 and 24 November 2004. 120
120 Exhibit P346, Logbook record of Rafik Hariri's trips abroad, ERN 60004129-600004136, at 60004134; Exhibit P303, Press Releases from Quraitem Palace Press Office, 18 November 2004, ERN D0004856- D0004856 D EN.
88 R305309
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 21 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
210. Former Prime Minister Hariri left Paris and travelled to Geneva. 121
121 Exhibit P346, Logbook record of Rafik Hariri trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_01, at ERN 60004134T, (p.6).
89 R305310
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 22 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
211. Former Prime Minister Hariri was in Geneva. 122
B. Blue Network Activity: First Contact in Ten Days
212. [S5] called [S7] while both were in Dahyieh. This was the first time they had been in contact since 12 November 2004.
122 Exhibit P346, Logbook record of Rafik Hariri trips abroad 12 May 04 to 05 Feb 05, see English translation, ERN 60004129-60004136_D_EN_01, at ERN 60004134T, (p.6).
90 R305311
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 23 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
213. Former Prime Minister Rafik Hariri was in Geneva. 123
B. Blue Network Activity: Surveillance of Quraitem Palace
214. [S7] and [S5] were in contact three times in the afternoon; the majority of cells they used were in the vicinity of Quraitem Palace.
123 Exhibit P346, Logbook record of Rafik Hariri trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_01, at ERN 60004134T, (p.6).
91 R305312
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 24 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Returned to Beirut in the Afternoon
215. Former Prime Minister Rafik Hariri was in Geneva. 124 Mr. Hariri returned to Lebanon in the late afternoon.
B. Blue Network Activity: Surveillance of Quraitem Palace
216. [S7] and [S5] were in contact four times during the day. They both started and ended the day connecting to cell towers in south Beirut but at midday, prior to the arrival of Mr. Hariri, they were in contact in the vicinity of Quraitem Palace.
124 Exhibit P346, Logbook record of Rafik Hariri trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_01, at ERN 60004134T, (p.6).
92 R305313
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 25 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
217. Former Prime Minister Rafik Hariri received visitors in Quraitem Palace throughout the day. 125
B. Blue Network Activity: Surveillance ofQuraitem Palace
218. [S5] and [S7] were active in the area of Quraitem Palace in the morning and afternoon. The phones returned to their home areas in south Beirut by the evening.
125 Exhibit P301, Visitor's Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380810-D0380811.
93 R305314
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 26 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace and Met with Mr. Roed-Larsen
219. Former Prime Minister Rafik Hariri received visitors at Quraitem Palace throughout the day, including Marwan Hamade (PRH038), Walid Jumblatt (PRH684), and UN Special Coordinator for the Middle East Peace Process, Terje Roed-Larsen. 126
B. Blue Network Activity: Surveillance of Quraitem Palace
220. [S5] and [S7] were in contact on three occasions and were active in the area ofQuraitem Palace between 10:00 and 17:02.
126 Exhibit P301, Visitor's Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380811- D0380813; Exhibit P303, Press Releases from Quraitem Palace Press Office, 26 November 2004, ERN D0004834- D0004834_D_EN; Exhibit P303, Press Releases from Quraitem Palace Press Office, 26 November 2004, ERN D0004842-D0004842_ D _EN; Exhibit P303, Press Releases from Quraitem Palace Press Office, 26 November 2004, ERN D0004843-D0004843_D_EN _T_EN.
94 R305315
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 27 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Confirmed He Would Run in Elections
221. Former Prime Minister Hariri received visitors at Quraitem Palace from 08:35 to 14:45 and from 17:30 to 23:15. 127 He attended the annual Ramgavar dinner at the Biel Centre where he stated that the elections were overshadowing all meetings and interviews, and confirmed that he would run the elections "despite the circumstances and pressures". 128
B. Rafik Hariri Met with Hassan Nasrallah
222. In the afternoon, there were a series of calls within one hour between Quraitem Palace, Yahya Al-Arab, Wissam AI Hassan (PRH680), and the political Secretary to Hassan Nasrallah, Hussein Khalil. This, and the presence of Mr. Al-Arab's phone in the immediate vicinity of the Hezbollah General Secretariat in Haret Hreik at 01: 11 the following morning, leads to the inference that Mr. Hariri and Hassan Nasrallah met that evening.
C. Contact between Wafik Safa, Rustom Ghazaleh & the "Hassan Nasrallah" Subscribed Landline in Advance of the Hariri/Nasrallah Meeting
223. In the morning, Syrian Brigadier General Rustom Ghazaleh called senior Hezbollah official Mr. Safa. Between 13:00 and 18:30, Mr. Safa was in contact with the "Hassan Nasrallah" subscribed landline six times. This was an unusually high frequency of contact in one day between the two numbers. At 20:13, Mr. Safa called Mr. Ghazaleh then immediately called the "Hassan N asrallah" subscribed landline once again. Forty minutes later, Hussein Khalil contacted Mr. Ghazaleh.
127 Exhibit P301, Visitor's Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380813-D0380815. 128 Exhibit P303, Press Release from 27.11.04 - Ramgavar at their annual dinner asserted their alliance with Hariri, ERN D0004844-D0004844.
95 R305316
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. No Blue or Green Network Activity
224. There was no Green phone activity or Blue activity beyond service SMS.
96 R305317
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 28 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Received Visitors at Quraitem Palace and Travelled to Egypt and Monte Carlo
225. Former Prime Minister Hariri received a number of visitors at Quraitem Palace in the morning until almost 12:50. 129 Shortly thereafter, Mr. Hariri travelled to Cairo in the afternoon to meet with President Mubarak. 130 He returned to Lebanon in the early evening and, at approximately 19:00, he was escorted back to Beirut airport from where he travelled to Monte Carlo. 131 Mr. Hariri remained abroad until 9 December 2004. 132
B. No Blue or Green Network Activity
226. There was no Green or Blue Network activity.
129 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380815- D0380816. 130 Exhibit P346, Logbook record of Rafik Hariri trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_Ol, at ERN 60004134T, (p.6). 131 Exhibit P303, Press Releases from Quraitem Palace Press Office, 27 November 2004, ERN D0004845- D0004845 D EN. 132 Exhibit-P346, Logbook record of Rafik Hariri trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_01, at ERN 60004134T, (p.6).
97 R305318
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 29 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
227. Former Prime Minister Rafik Hariri was in Monte Carlo. He remained abroad until 9 December 2004. 133
228. While Mr. Hariri was in Monte Carlo, he was informed that it had been decided that his ISF security detail would be reduced. 134
B. Blue Network Activity: Last Day of Activity around Quraitem Palace until 17 December Coinciding with Rafik H ariri Absence Abroad for All but Three Days
229. [S5] called [S7] twice and [Ayyash] called [S5] once. [S5] was in the area of Quraitem Palace for the first of those three calls, before returning to Haret Hreik. This was first time that [Ayyash] had called another Blue phone since 10 November 2004.
230. This was the last day the Blue phones were active in the area of Quraitem Palace until 17 December 2004 which coincides with Mr. Hariri being out of the country for all but three days between 28 November and 16 December 2004.
133 Exhibit P346, Logbook record of Rafik Hariri trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_01, at ERN 60004134T, (p.6). 134 Testimony ofHani Hammoud, Transcript of 19 May 2015, pp. 77-79.
98 R305319
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 30 November 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
231. Former Prime Minister Rafik Hariri was in Monte Carlo. Mr. Hariri remained abroad until 9 December 2004. 135
B. Large Demonstration Denouncing UNSC Resolution 1559 and Supporting Syria Led by Hezbollah and Hosted by Nasser Kandil
232. A demonstration sponsored by the Karami government, led by Hezbollah, and hosted by "Syrian deposit" Nasser Kandillabelled "the march of the one million" took place in Beirut. 136 The demonstrators, the majority of whom were reported to be Hezbollah supporters and were estimated to be between 100,000 and 200,000, denounced United Nations Security Council Resolution 1559 and expressed support for Syria and the Resistance. 137
233. The 1 December 2004 UNIC Beirut Press Review states that protesters" ... brandished pictures of Syrian President Bashar Assad, President Emile Lahoud and Lebanese flags also carried banners which read 'No to resolution 1559 and No to international interference in Lebanese affairs and yes to national resistance"'. 138
C. Heavy Contact between Syrian Military Intelligence and Hezbollah Officials
234. The Head of Syrian Military Intelligence, Rustom Ghazaleh had six calls with senior Hezbollah security official Wafik Safa. After one call from Mr. Ghazaleh, Mr. Safa called the "Hassan Nasrallah" subscribed landline. This was the heaviest day of
135 Exhibit P346, Logbook record of Rafik Hariri trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_01, at ERN 60004134T, (p.6). 136 Exhibit P532, UNIC Beirut Press Review, 01 December 2004, ERN D0410378-D0410385, at D0410381; Exhibit P438, UNIC Beirut Press Review, 02 December 2004, ERN D0410453-D0410458; Testimony ofWalid Jumblatt, Transcript of5 May 2015, pp. 91, 92. 137 Exhibit P532, UNIC Beirut Press Review, 01 December 2004, ERN D0410378-D0410385. 138 Exhibit P532, UNIC Beirut Press Review, 01 December 2004, ERN D0410378-D0410385.
99 R305320
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
contact between Mr. Safa and Mr. Ghazaleh m the five months preceding the assassination.
235. Two of the "Syrian deposits" MPs Nasser Kandil and Adnan Arakji were in contact with Rustom Ghazaleh multiple times throughout the day, mostly in the evening. Mr. Kandil was also unusually contacted by Ali Ammar, the Hezbollah MP who was also a common contact of Mustafa Badreddine and Hassan Merhi. Mr. Merhi ( ) also called Hezbollah MP Ali Ammar twice: once in the morning and once in the evenmg.
D. Blue Network Activity
236. There was one call from [S5] to [S7] in Dahyieh in the morning.
100 R305321
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 1 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
237. Former Prime Minister Rafik Hariri was m Monte Carlo and was abroad until 9 December 2004. 139
B. Limited Blue Network Activity
238. [S5] and [S7] were in contact once during the morning while both connected to cells in south Beirut.
139 Exhibit P346, Logbook record of Rafik Hariri trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_01, at ERN 60004134T, (p.6).
101 R305322
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 2 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
239. Former Prime Minister Rafik Hariri was abroad m France and Switzerland until 9 December 2004. 140
B. Limited Blue Network Activity
240. There was one call between [S5] and [S7] in the evening. Both were in south Beirut.
140 Exhibit P346, Logbook record of Rafik Hariri trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_01, at ERN 60004134T, (p.6).
102 R305323
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 3 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
241. Former Prime Minister Rafik Hariri travelled to Paris from Geneva. He remained abroad until 9 December 2004. 141
141 Exhibit P346, Logbook record of Rafik HARlRl trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_01, at ERN 60004134T, (p.6).
103 R305324
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 4 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
242. Former Prime Minister Rafik Hariri travelled to Geneva from Paris. He remained abroad until 9 December 2009. 142
B. Limited Blue Network Activity
243. [S5] and [S7] were in contact once while both were in south Beirut.
142 Exhibit P346, Logbook record of Rafik PM HARlRI trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_01, at ERN 60004134T, (p.6).
104 R305325
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 5 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
244. Former Prime Minister Rafik Hariri travelled to Paris from Geneva. He remained aboard until 9 December 2004. 143
143 Exhibit P346, Logbook record of Rafik Hariri trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_01, at ERN 60004134T, (p.6).
105 R305326
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 6 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
245. Former Prime Minister Rafik Hariri travelled from Paris to London. He returned to Paris later the same day. Mr. Hariri remained abroad until 9 December 2004. 144
246. While Mr. Hariri was in London, Ghazi El-Youssef met with Ghassan Salameh, Advisor to the UN Secretary General. Mr. Salameh asked Mr. El-Youssef to tell Mr. Hariri to be careful. He said: "Let him be very careful. The Syrians want his political assassination or the otherwise." 145 Mr. El-Youssef conveyed the message to Mr. Hariri the next day on his return to Paris and Mr. Hariri subsequently met with Mr. Salameh.
B. Limited Blue Network Activity
24 7. There was one call between [S5] and [S7] while both were located in south Beirut.
144 Exhibit P346, Logbook record of Rafik PM HARlRI trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_01, at ERN 60004134T, (p.6). 145 Testimony ofGhazi El-Youssef, Transcript of 10 March 2015, pp. 78-79.
106 R305327
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 7 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR PROSECUTION
A. Rafik Hariri Abroad
248. Former Prime Minister Rafik Hariri was in Paris. 146
B. Limited Blue Network Activity
249. [S7] and [S5] were in contact on one occasion while both were in south Beirut. There was no Blue contact again until 10 December 2004.
146 Exhibit P346, Logbook record of Rafik PM HARlRI trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_01, at ERN 60004134T, (p.6).
107 R305328
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 8 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
250. Former Prime Minister Rafik Hariri was m Paris. He remained abroad until 9 December 2004. 147
147 Exhibit P346, Logbook record of Rafik PM HARlRI trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_01, at ERN 60004134T, (p.6).
108 R305329
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 9 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Returned to Lebanon for Three Days
251. Former Prime Minister Rafik Hariri left Paris and returned to Beirut. 148 A number of visitors registered at the Palace to meet the Prime Minister at Quraitem Palace between 20:35 and 23:15. 149
148 Exhibit P346, Logbook record of Rafik HARIRI trips abroad 12 May 04 to 05 Feb 05, ERN 60004129- 60004136_D_EN_Ol, at ERN 60004134T, (p.6). Exhibit P536, Rafik HARIRI's Passport of 2004, ERN 60242298-60242323, at ERN 60242319, (p.22 (p.40 of passport)). 149 Exhibit P301, Visitor Logbook for Quraitem Palace for 2004 to 2005, ERN D0380523-D0380905, at ERN 00380818, (p.296).
109 R305330
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 10 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
252. Former Prime Minister Rafik Hariri met with visitors at Quraitem Palace throughout the day. 150 He announced that he would confirm his position with regard to the elections after the Electoral Law had been issued. 151
B. Limited Blue Network Activity
253. [S7] and [S5] were in contact once in south Beirut.
150 Exhibit P30 1, Visitor's Logbook for Quraitem Palace, ERN D0380523-D0380905, at 00380818- 00380821. 151 Exhibit P303, Press Releases from Quraitem Palace Press Office, 10 December 2004, ERN D0004900- D0004901_D_EN, (p.1).
110 R305331
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 11 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
254. Former Prime Minister Rafik Hariri received a number of visitors at Quraitem Palace throughout the day. 152 Mustafa Nasser (PRH476), Mr. Hariri's go-between with Hezbollah, visited Quraitem Palace at 17:30 and 20:00, respectively.
B. Almost No Network Phone Activity
255. There was no Blue or Green Network phone activity. There were also no inter-Purple phone calls.
152 Exhibit P301, Visitor's Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380821-D0380822.
111 R305332
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 12 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Travelled to Dubai in the Evening
256. Former Prime Minister Hariri received visitors at Quraitem Palace during the morning and afternoon. 153 He then travelled to the United Arab Emirates in the evening to attend the Arab Strategic Forum. He remained in Dubai until 15 December 2004 before travelling to Bahrain. 154
B. No Blue Network Activity
257. There was no Blue Network activity.
153 Exhibit P301, Visitor's Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380823. 154 Exhibit P346, Logbook Record ofRafik Hariri's trips abroad, ERN 60004129-600004136, at 600004135.
112 R305333
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 13 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
258. Former Prime Minister Rafik Hariri was in the United Arab Emirates. He attended the Arab Strategy Forum in Dubai between 12 and 15 December 2004. 155
B. No Blue Network Activity
259. There was no Blue Network activity for the third consecutive day.
C. Second Bristol Group Meeting Took Place
260. The second Bristol Group meeting of a wide coalition of opposition groups, including for the first time close associates of Mr. Hariri's block in parliament, including Ghattas Khoury (PRH 242), was held at the Bristol Hotel where they publicly adopted a joint position supporting the Taef Agreement and rejected continued Syrian interference in and control over Lebanese domestic affairs. 156
261. MP Walid Jumblatt (PRH684) explicitly emphasised his commitment to the historic alliance and his personal and political unity with Mr. Hariri on the issue. 157 Mr. Jumblatt stood beside his historically bitter opponent, Amine Gemayel, whilst the Lebanese national anthem was played, symbolising the breadth of the alliance against continued Syrian control. 158
262. During an interview later on this day, Mr. Hariri stated that everybody at the Bristol Group meeting was supporting the Taif Agreement and asserted that the
155 Exhibit P303, Press Release of 13.12.04, Hariri met with Crown Prince ofDubai, Clinton and Albright, ERN D0004893- D0004893; Exhibit P303, Press Releases from Quraitem Palace Press Office, ERN D0004857- D0004858. 156 Exhibit P440, UNIC Beirut Press Release Review, ERN D0411388-D0411396; Testimony of Ghazi El Youssef, Transcript of 10 March 2015, p. 67; Testimony ofFaisal Salman, Transcript of8 January 2015, p. 42. 157 Exhibit P441, UNIC Beirut Press Review, 14 December 2004, ERN D0411481-D0411489; Testimony of Walid Jumblatt, Transcript of5 May 2015, p. 107. 158 Testimony ofWalid Jumblatt, Transcript of5 May 2015, pp. 102-104.
113 R305334
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Parliamentary Elections next year would be "decisive and essential". He also re affirmed his alliance with his ally and brother, MP Walid Jumblatt (PRH684). 159
D. Rustom Ghazaleh Visited Haret Hreik for the First Time in Six Weeks Following the Second Bristol Group Meeting
263. Mr. Ghazaleh had four calls with the Syrian Presidential Palace. After the first call, he travelled from Anjar to Beirut. By the time of the fourth call, at 20:06, Mr. Ghazaleh was in central Beirut.
264. Shortly after Mr. Ghazaleh's arrival in Beirut, he contacted Wafik Safa who immediately contacted the "Hassan Nasrallah" subscribed landline. Within four minutes of that call, Mr. Safa called Mr. Ghazaleh again who, within fifteen minutes, was connecting to a cell in the immediate vicinity of the Hezbollah General Secretariat. Another (very short) call from Mr. Safa to the "Hassan Nasrallah" subscribed landline occurred immediately before Mr. Ghazaleh's arrival in the area.
265. Mr. Ghazaleh's phone was inactive from 20:48 to 22:01 when his phone connected to the same cell in Haret Hreik, and moved away shortly after. Mr. Safa's phone also connected to cells with small areas of predicted coverage in the immediate vicinity of the Hezbollah General Secretariat during this period but was active throughout.
266. The circumstances, particularly the sequence of calls and the subsequent movement of his phone, are consistent with Mr. Ghazaleh travelling to Haret Hreik for a meeting with Hezbollah officials. This was the first occasion that Mr. Ghazaleh had visited Haret Hreik after contact with Mr. Safa (or Hussein Khalil), consistent with a meeting, since 30 October 2004.
267. Mr. Ghazaleh's calls shortly before and after the meeting included calls to the "Syrian deposit" MP Nasser Kandil. Mr. Safa also called Mr. Ghazaleh shortly after his departure.
159 Exhibit P303, Press Release of 14.12.04 -Bristol Meeting: The opposition endorses the Taef Agreement, ERN D0004868-D0004876.
114 R305335
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
E. First Contact between Mustafa Badreddine and Wafik Safa in Around Three Weeks
268. In mid-afternoon prior to his meeting in Haret Hreik, Rustom Ghazaleh received a call from Hussein Khalil, the political Secretary to Hassan N asrallah, who then called Wafik Safa shortly afterwards.
269. An hour later, Mr. Safa made the first of three calls to Mr. Badreddine (SMP 944) all within a period of fifty minutes. The third call occurred almost immediately after Mr. Safa had finished a conversation with Hussein Khalil.
270. There had been no contact between Mr. Safa and Mr. Badreddine for approximately three weeks. The calls on this day were the start of their most intense period of contact when almost 25% of their calls (43) in the five months preceding the assassination took place from 13 December to 22 December before ceasing once again for a further ten days.
F. Purple Phones: First ofFour Days Assad Sabra Travelled to Tripoli
271. This was the first of four days in December 2004 on which [Sabra] was in Tripoli. [Sabra] was used in the Tripoli area between 14:29 and 15:57. There were no calls amongst the Purple phones but [Sabra] had contact twice with Purple Associate 375, a phone of significance in the narrow period around the disappearance of Mr. Abu Adass.
115 R305336
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 14 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Commented on Bristol Group Meeting and Supported Walid Jumblatt
272. Former Prime Minister Rafik Hariri was in Dubai attending the second day of the Arab Strategy Forum. 160 This was the day following the second Bristol Group meeting when a wide coalition of opposition groups, including close associates of Mr. Hariri, publicly united in support of the Taif Agreement and an end to Syrian interference and control over Lebanese affairs.
273. During an interview the previous evening, Mr. Hariri stated that everybody at the Bristol Group meeting was supporting the Taif Agreement and asserted that the Parliamentary Elections next year would be "decisive and essential". He had also re affirmed his alliance with his ally and brother, MP Walid Jumblatt (PRH684). 161
B. Appointment of Terje Rod-Larsen as UN Special Envoy on Implementation of UNSC Resolution 1559 Announced
274. The United Nations Secretary-General announced the appointment of Terje Rod Larsen as his Special Envoy for the implementation of Security Council Resolution 1559, effective 3 January 2005. 162
C. Limited Blue Phone Activity
275. [S7], [Ayyash] and [S5] all received service SMS within half an hour of each other. Whilst the other two Blue phones were sited in south Beirut, Salim Ayyash's Blue 322 connected to a cell that provided predicted coverage in the Harouf area. PMP 935 [Ayyash] used HAROUF3 for the afternoon and much
160 Exhibit P346, Logbook Record ofRafik Hariri's trips abroad, ERN 60004129- 600004136, at 600004135; Exhibit P303, Press Release of 14.12.04 Hariri made a speech and had a dialogue with the Participants at the Arab Strategy forum in Dubai, ERN D0004895-D0004896. 161 Exhibit P303, Press Release of 14.12.04 -Bristol Meeting: The opposition endorses the Taef Agreement, ERN D0004868-D0004876. 162 Exhibit P322, UN Press Release SG/A/897, Secretary-General names Rod-Larsen to New Appointment as Special Envoy, dated 14 December 2004, ERN D0407555-D0407555.
116 R305337
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
of the evening. It was a cell that provided predicted coverage near to Mr. Ayyash's residence in Harouf.
117 R305338
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 15 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
276. Former Prime Minister Rafik Hariri was in Dubai until 10:00 when he travelled to Bahrain where he met with Bahrain's Prime Minister Sheikh Khalifa Bin Salman Al Khalifa and Bahraini King Hamad Bin Issa Al-Khalifa. 163
B. Purple Phone Activity: Second Day Assad Sabra Travelled to Tripoli
277. This was the second of four days in December 2004, prior to the commencement of repeated use of the COLA cells in the vicinity of the Arab University Mosque, on which [Sabra] was in Tripoli. [Sabra] was in Tripoli between at least 13:01 and 15:35. While there, he was called by [Merhi] at 13:09. By the evening, [Sabra] had returned to south Beirut and called [Merhi] at 18:22.
278. Later in the evening, [Merhi] and [Oneissi] both received calls within minutes of each other at NICOLAI cell tower in the Ashrafieh area of Beirut. They were called by Hassan Merhi's top contact and brother-in-law (also a contact of Wafik Safa) and Hussein Oneissi's mother, respectively. This was an unusual area of Beirut for their phones to be located in, and the coincident cell siting in that location is consistent with them having met.
163 Exhibit P346, Logbook record ofRafik Hariri's trips abroad, ERN 60004129-600004136, at 600004135.
118 R305339
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 16 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Prime Minister Rafik Hariri Returned to Beirut with Mustafa Nasser who went Directly to Haret Hreik and Contacted Hezbollah Officials
279. Mr. Hariri returned to Beirut from Manama, Bahrain around midday. 164
280. Mustafa Nasser (PRH476) arrived at Beirut airport from Bahrain at the same time as Mr. Hariri and went directly to Haret Hreik (connecting to a cell in the immediate vicinity of the Hezbollah General Secretariat) where he contacted Khalil Farhat, the Hezbollah official who acted as an intermediary for contact with the Political Secretary to Hassan N asrallah, Hussein Khalil. Later in the afternoon, there was contact between Mr. Nasser and Quraitem Palace interspersed with a call Mr. Nasser received directly from Mr. Khalil.
B. Rustom Ghazaleh Visited Haret Hreik & Contacted the Syrian Presidential Palace
281. After midday, Rustom Ghazaleh, who was in Anjar, exchanged calls with semor Hezbollah official W afik Safa over the course of ten minutes following which he travelled to Haret Hreik. They were in contact three times on this day: by the time of their third call at 13:44, Mr. Ghazaleh was just outside Beirut.
282. Between 13:44 and 14:57, Mr. Ghazaleh's phone was inactive immediately after which he connected to cells in the immediate vicinity of the Hezbollah General Secretariat. One of his calls in that area was to the Syrian Presidential Palace for about three minutes. Mr. Safa's phone connected to cells in the same vicinity within minutes of Mr. Ghazaleh becoming active again.
283. This was the second of four days immediately following the second Bristol Group meeting that featured proximate or related calls between Mr. Ghazaleh, the Syrian
164 Exhibit P346, Logbook record of Rafik Hariri 's trips abroad, ERN 60004129- 600004136, at 60000413 5.
119 R305340
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Presidential Palace, and Mr. Safa coinciding around a visit by Mr. Ghazaleh to the immediate area of the Hezbollah General Secretariat.
284. This pattern recurred during another time of significance, on 9 January 2005, following the final meeting between Mr. Ghazaleh and Mr. Hariri. That too preceded a significant escalation in conspiratorial activity.
C. Purple Phone Activity
285. This was the day after the second of four days in December 2004 on which [Sabra] was used in Tripoli. At 15:26, [Sabra] called [Merhi]. They connected to adjoining cells in Hadath; Mr. Sabra's phone connected to a cell that provided predicted coverage in the vicinity of his residence.
120 R305341
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 17 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace, Attended Prayers with Mufti Qabbani, then Travelled to Paris
286. Former Prime Minister Rafik Hariri met with a number of visitors at Quraitem Palace 165 and attended a meeting with the Mufti Qabbani at Dar El Fatwa. They both attended prayers at the Al-Omari Mosque followed by the Mohammed El-Amine Mosque during the late morning/ early afternoon. 166
287. Mr. Hariri had returned to Quraitem Palace by 13:00, and departed Beirut for Paris at around 19:00. 167
B. Blue Phone Activity: First Surveillance ofRafik Hariri in Almost Three Weeks
288. This was the first time since 29 November 2004 that the Blue phones had been used in the area of Quraitem Palace, and that Salim Ayyash had been involved in a Blue call. In fact, Mr. Ayyash had engaged in only one such call since 10 November 2004 (although he had been active on his Yell ow phone on a near daily basis). Almost all of the intervening period coincided with Mr. Hariri's absence from Lebanon.
289. All three Blue Phones were active in the afternoon. [Ayyash] remained in south Beirut and contacted [S5] in central Beirut at 12:13. During this call, [S5] was located mid-way between Quraitem palace and the Al-Omari Mosque, where Mr. Hariri was. At 13:52, [S5] called [S7] while both were located in the vicinity of Quraitem Palace.
165 Exhibit P30 1, Visitor's Logbook for Quraitem Palace, ERN D0380523-D0380905, at 00380825 -00380826. 166 Exhibit P303, Press Release of 17.12.04 Hariri visits Qabbani at Dar El Fatwa, ERN 00004866-00004867. 167 Exhibit P346, Logbook Record ofRafik Hariri's trips abroad, ERN 60004129-600004136, at 600004135.
121 R305342
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 18 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
290. Former Prime Minister Rafik Hariri was abroad in Paris until 20 December 2004. 168
B. Blue Phone Activity: First Blue Contact on the Route to Faqra
291. [S5] and [S7] were in contact in and beyond the area of Zouk Mosbeh on the route to Faraya in the afternoon. This was the first time they were active along the route to Faraya. They then returned to south Beirut and [S5] was in contact with both [Ayyash] and [S7].
C. Purple Phone Activity
292. [Merhi] was in contact once with both [Oneissi] and [Sabra].
D. Continuation of Unusually Intensive Contact between Mustafa Badreddine and WafikSafa
293. This was the second of three days when Mr. Badreddine and semor Hezbollah security official Mr. Safa had three calls with each other during the week that led up to the resumption of Green Network activity: their most intensive period of contact in the five months preceding the assassination.
294. Mr. Badreddine made the first call to Mr. Safa at 14:52 on his SMP 944. Immediately after that call, Mr. Safa called the "Hassan Nasrallah" subscribed landline, and within ten minutes Mr. Badreddine called Mr. Safa back once again this time using his PMP 354. That call lasted over twelve minutes. Almost two-thirds of their 43 calls in the five months preceding the assassination lasted less than a minute, but this was the second longest one of all.
168 Exhibit P346, Logbook record ofRafik Hariri's trips abroad, ERN 600041290-600004136, at 600004135.
122 R305343
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
295. The last of their three contacts occurred in the last hour of the day when Mr. Safa sent a SMS text to Mr. Badreddine (SMP 944). Earlier that night, Mr. Safa had received a call from Hussein Khalil, the political Secretary to Hassan Nasrallah, which lasted eighteen minutes. This was their longest call in the months preceding the assassination.
123 R305344
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 19 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
296. Former Prime Minister Rafik Hariri was abroad in Paris until20 December 2004. 169
169 Exhibit P346, Logbook record ofRafik Hariri's trips abroad, ERN 600041290-600004136, at 600004135.
124 R305345
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 20 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Returned to Beirut and Met with Mustafa Nasser Who Was in Contact with Hezbollah Officials
297. Former Prime Minister Rafik Hariri returned from Paris in the evening. 170 He received visitors at Quraitem Palace from 21:55 until 01:45, including Mustafa Nasser (PRH476) (22:00-22:30). 171
298. Much earlier in the day and prior to his visit, Mr. Nasser had been in contact with Hezbollah officials Khalil Farhat and Hussein Khalil, members of Rafik Hariri's entourage, and Quraitem Palace. In the afternoon, his phone also spent some time in Haret Hreik.
299. At the very end of his visit to Quraitem Palace and afterwards Mr. Nasser engaged in a number of further and interleaving calls with Hussein Khalil and Quraitem Palace consistent with him conveying messages between Mr. Hariri and Hezbollah officials. Hassan Nasrallah and Mr. Hariri met late the following night.
B. New Phase of Green Network: Beginning of Marked Escalation in Green Call Activity Amidst the Escalating Threat to Syrian Control in Lebanon
300. [Ayyash] called [Badreddine] in the afternoon while both were located in south Beirut.
301. This was the first contact between any of the Green Network phones smce 10 November 2004.
302. This resumption marked the beginning of a new phase of Green call activity marked by an obvious escalation in its regularity and frequency of use which continued for around two weeks until the second of January 2005.
170 Exhibit P346, Logbook record ofRafik Hariri's trips abroad, ERN 600041290-600004136, at 600004135. 171 Exhibit P30 1, Visitor's logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380827.
125 R305346
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
303. It also marked the beginning of an acceleration of conspiratorial activity and the preparatory steps being taken to advance the plot by those operatives under the command of the Green network.
304. Significantly, the following evening was the first day (continuing to the day of the assassination) that the "Principal Six" network users conducted surveillance on Rafik Hariri as a complete group (previously it was just S5 and S7).
305. The day after that was the first use of the COLA cells by the Purple phones as the "false claim" preparations began to develop.
306. The following days also saw an intensification of surveillance as the "Principal Six" network users began following Rafik Hariri to and from his Faqra villa. The Red phone SIM cards and handsets were also purchased.
307. All of this followed a week in which the threat to ongoing Syrian control in Lebanon had also accelerated markedly.
308. The week began with the Second Bristol Group meeting which had revealed an ever stronger, broader and more powerful political alliance opposed to ongoing Syrian control. It was followed by the appointment of the UN Special Envoy to ensure the implementation ofUNSCR 1559.
309. Both events were followed respectively by two visits to Haret Hreik in three days by Rustom Ghazaleh consistent with meetings with senior Hezbollah figures (whereas
there had been only one other in the previous 2 ~months).
310. After this two week phase, there was a further lull (nine days of inactivity) before the inception of the Green network's primary and final phase (11 January to 14 February 2005) and a further and final level of acceleration in conspiratorial activity (Purple, Blue and Red phones) extending through to the assassination.
311. The inception of that final phase also followed hot on the heels of another substantial and pivotal escalation in the threat to Syrian control in Lebanon: Rafik Hariri's direct refusal, at his final meeting with Rustom Ghazlaeh, to accept the "Syrian deposits" on his electoral list and their demands to contain his electoral participation.
126 R305347
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
312. That too was followed immediately by a visit to Haret Hreik and, by inference, a meeting between Rustom Ghazaleh and senior Hezbollah figures.
C. End of a Week of Unusually Frequent Contact between Mustafa Badreddine & WafikSafa
313. This was the end of a week beginning on 13 December 2004, during which Mr. Badreddine and senior Hezbollah security official, Wafik Safa, had unusually frequent contact.
314. Late in the afternoon, Mr. Badreddine (SMP 944) received two calls from Mr. Safa. The first did not appear to connect but the second, immediately after, did. Within four minutes of the call ending, Mr. Safa made a four second call to the "Hassan Nasrallah" subscribed landline. This sequence had also occurred two days before.
D. Purple Phones: Third Day Sabra Travelled to Tripoli
315. This was the third of four days between 13-24 December 2004 when [Sabra] was in Tripoli. This pattern ceased shortly before the regular presence of Purple phones in the vicinity of the Arab University Mosque began on 29 December 2004.
316. On each of these visits to Tripoli, the only times a Purple phone connected to a cell in the Tripoli area during the indictment period, Mr. Sabra's phone connected to TRIPOLI. [Sabra] was in Dahyieh in the morning when it was in contact with his father's landline but was in Tripoli by 14:18. He had returned to Beirut by 16:38.
127 R305348
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 21 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met with Hassan Nasrallah
317. Former Prime Minister Rafik Hariri received visitors at Quraitem Palace throughout the day until21:25. 172
318. The phone activity of Mr. Hariri's bodyguards, Mustafa Nasser (PRH476), and also the political Secretary to Hassan Nasrallah, Hussein Khalil over the course of the afternoon and evening, are consistent with Mr. Hariri meeting with Mr. N asrallah in the area around the Hezbollah General Secretariat in Haret Hreik from 21 :40 until after midnight, returning to Quraitem Palace by 00:25.
319. The cell activity of Mr. Khalil and Mr. Nasser is consistent with them being in the vicinity during the meeting, and Mr. Nasser returning to Quraitem Palace with Mr. Hariri' s entourage.
B. Overview ofNetwork Activity: First "Principal Six" Surveillance ofRafik Hariri
320. Significantly, this was the first day (continuing to the day of the assassination) that the "Principal Six" network phone users conducted surveillance on Rafik Hariri as a group (previously it was just S5 and/or S7).
321. It coincided with the beginning of a marked phase of escalating Green call activity which encompassed not only an intensification of surveillance activity, but also the development of the false claim preparations (Purple call activity in the vicinity of the Arab University Mosque), and the purchase of the Red phones.
172 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380827- D0380829.
128 R305349
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
C. Green Network Activity: Salim Ayyash 's Presence in the Vicinity Before and Throughout the Hariri/Nasrallah Meeting
322. [Badreddine] called [Ayyash] twice in the evening, two hours before the meeting. The second call lasted over four minutes. The vast majority of their Green calls lasted less than a minute, but this was the longest Green call they ever had.
323. The cell in Haret Hreik connected to by Mr. Ayyash's was equally unusual: BIRABD2. It was in the immediate vicinity of the Hezbollah General Secretariat and was also a cell connected to more than once by Hussein Khalil during the Hariri/ N asrallah meeting a short while later.
324. With one exception, every other call that Mr. Ayyash ( ) made from this time onwards to the end of the meeting either connected to BIRABD 1 or BIRABD2 before his phones moved away shortly afterwards. Those two cells provided predicted overlapping coverage to those connected to by Mr. Hariri's security detail during the meeting. Out of the hundreds of calls made by Mr. Ayyash's phones throughout the entire indictment period, his phones only connected to one of these two cells nine other times over four other days.
D. Blue and Yellow Network Activity: Surveillance of Rafik Hariri around Quraitem Palace & the Meeting with Hassan Nasrallah in Haret Hreik
325. [S5] and [S7] were active in the area of Quraitem Palace for over seven hours between 13:16 and 20:31. While they were in that area, between 15:14 and 15:20, [Ayyash] exchanged calls with [S5] whilst connecting to a cell in the Hadath part of Dahyieh.
326. Blue 585 [S5] and Blue 324 [S7] returned to Dahyieh in the evening where they exchanged calls shortly after 20:30 in Haret Hreik connecting to cells in the immediate vicinity of the Hezbollah General Secretariat. Their use of these cells coincided with the movement of Yell ow [S6], Yellow 933 [S8] and Yellow 024 [S9] from the Quraitem area to connect to cells in the same area of Haret Hreik.
129 R305350
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
327. Between 19:38 and 20:29, five Yellow phones ( [S6], [S8], and [S9]) were connecting to cells in the area of Quraitem Palace. During this time, [Ayyash], who was in Haret Hreik, was in contact with [S6] who, in tum, was in contact with the other four Yell ow phones in immediately successive calls.
328. After 20:30, the cell use of those Yellow phones converged in Haret Hreik at around the same time as the two Blue phones also began to use cells in the immediate vicinity of the Hezbollah General Secretariat in the same area. It was not until after 00: 16, coincident with the timing and movement of Mr. Hariri's security detail away from Haret Hreik to Quraitem Palace, that Yell ow call activity also moved back to the area around the Palace.
329. This Yell ow movement also coincided with a reactivation of Blue activity at 00: 18 when [S5] and [S7] called each other as they moved from Haret Hreik to the vicinity of Quraitem Palace. They remained in the area until 00:31 when Mr. Ayyash ( ), who had also moved to their general vicinity in west-central Beirut, received a call from [S7] from the vicinity of the Palace. By 00:36 and 00:37, Yellow and Blue activity respectively had returned to Dahyieh.
E. Salim Ayyash Coordinated Yellow and Blue Activity
330. This day is a good example of Mr. Ayyash using three network phones ( and ) to coordinate conspiratorial activity between the Command unit and the "Principal Six" Network phone users.
331. In mid-afternoon, Mr. Ayyash exchanged calls on his with [S5] which immediately contacted [S7]. Similarly, while the Yellow phones were in the area of Quraitem Palace and within 25 minutes of his Green calls with Mr. Badreddine, Mr. Ayyash used his Yellow 294 to contact Yellow 457 [S6]. Shortly after that, [S6] was involved in a close succession of calls with the other Yell ow phones in the area of Quraitem Palace. It was then that the Yell ow phones converged upon Haret Hreik in the vicinity of the meeting between Mr. Hariri and Mr. Nasrallah.
130 R305351
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
F. Selected Attribution Points for Salim Ayyash
332. During the day, Mr. Ayyash was active on his PMP 935 throughout the day and afternoon calling among others his brother Mohammed Ayyash and his relative and business associate, Hussein Zaarour. PMP 935, , and all connected to cells in the Hadath area of Dahyieh throughout this period. From 19:13 to 00:13, , and all connected to cells in the same part of Haret Hreik. The last two calls of the early hours (00:37-00:47) involved and , both phones connected to cells in the vicinity of Mr. Ayyash's home in Hadath.
G. Selected Attribution Points forMustafa Badreddine
333. In the evening, SMP 944, PMP 663 and were all used within four minutes of each other in the same area on the road to Jounieh close to Mr. Badreddine's Sahel Alma apartment: their sequential movement is consistent with single use. PMP 663 subsequently called [Redacted] (PRH416) whose phone was also in the area.
334. Earlier, in the afternoon (16:01 - 18:58) following a call between PMP 663 and [Redacted] (PRH416), SMP 944 was active in the area of Samino Jewellery Mar Elias Branch. SMP 944 had been in contact earlier with Mr. Badreddine's Samino associate Mohammed Shukr.
131 R305352
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 22 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met with Patriarch Sfeir and Confirmed their Joint Support for the TaifAgreement and Non-Confessionally Based Electoral Divisions
335. Former Prime Minister Hariri received visitors at Quraitem Palace during the day. 173 Around midday, Mr. Hariri travelled to Bkirki (Mount Lebanon) and met with Maronite Patriarch Mar Nasrallah Boutros Sfeir. They discussed the electoral law and after their meeting, Mr. Hariri spoke to the press and reiterated his support for the Taif Agreement and stated that: "Should the electoral law be tailored as it is said, in a way to serve the interests of one side, as we hear, we shall adopt a clear position. I believe that such a law will further complicate the problems in the country." 174
336. Ministers in Omar Karami's government were, by this time, openly referring to the "opposition" coalition as "threats to the country", and to Mr. Hariri as "the snake of Quraitem" .175
B. Green Network Activity: Mustafa Badreddine Contacted Salim Ayyash Once
337. At 13:37, [Badreddine] called [Ayyash] from Haret Hreik connecting to the cell (ROUEIS3) most familiar to his Alfa phones.
C. Blue Network Activity: Surveillance at Quraitem Palace
338. On the previous day and in the first hour of this day, Yellow and Blue Network activity was consistent with surveillance around Quraitem Palace and of Mr. Hariri' s security detail on its return journey from the meeting with Hassan Nasrallah in Haret
173 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380829- D0380831. 174 Exhibit P303, Press Release 22.12.04, Hariri in Bkirki, ERN D0004907-D0004910, at D0004908; Exhibit P366, Al Mustaqbal article dated 23 December 2004, Rafik Hariri holds a closed meeting with the Maronite Patriarch Safir at Bkirki, ERN 60302902-60302904; Exhibit P352, Photographs of Rafik Hariri at Bkirki, ERN D0119158-D0119204; Testimony ofGhattas El-Khoury, Transcript of 16 January 2015, pp. 52-53, 57. 175 Exhibit P366, Al Mustaqbal article dated 23 December 2004, Rafik Hariri holds a closed meeting with the Maronite Patriarch Safir at Bkirki, ERN 60302902-60302904; Testimony of Ghattas El-Khoury, Transcript of 16 January 2015, pp. 61-62.
132 R305353
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Hreik. For the remainder of this day the use of Yell ow phones by Subjects 6, 8, 9, who were yet to acquire or use their Blue phones, and also Salim Ayyash, was limited and confined to south Beirut.
339. During the day, [S5] and [S7] were in contact with each other from the vicinity or area of Quraitem Palace between 10:21 and 16:43. The last Blue call was from [Ayyash] to [S5] when S5 had returned to south Beirut.
D. Purple Phone Activity: First Call Activity Near the Arab University Mosque
340. This was the first day that any of the Purple phones connected to the COLA cells in the immediate vicinity of the Arab University Mosque during the indictment period. The phone concerned, [Oneissi], had connected to these cells on only five previous occasions since the end of 2002. The next time a Purple phone was active in this area was one week later, on 29 December 2004.
[Oneissi] was in south Beirut in the morning. In the afternoon, [Oneissi] connected to COLA cells situated in the immediate vicinity of the Arab University Mosque at 14:00 and 15:09. Shortly afterwards, [Oneissi] called [Merhi] as he returned to south Beirut.
342. Shortly after that, [Oneissi] and [Merhi] had calls with their brothers, Ahmad Oneissi and Abbas Merhi, respectively.
E. Selected Attribution Points for Salim Ayyash
343. Mr. Ayyash was active in south Beirut on his , PMP 935 and . PMP 935 was used to call Mr. Ayyash's regular associates including his brother Mohammed Ayyash.
133 R305354
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
F. Selected Attribution Points forMustafa Badreddine
344. In the early afternoon, PMP 663 [Badreddine] sent an SMS to [Redacted] (PRH243), a university friend, which stated "Good morning [Redacted]". Shortly after, PMP 663 received a SMS in return from [Redacted] stating "Hey Mr Issa. Or is it Badr ;)". 176
345. Very shortly before and after Mr. Badreddine's was used to contact Salim Ayyash, PMP 663 connected to cells that provided overlapping predicted coverage in that part ofDahyieh. The second call was made to Mr. Badreddine's Samino associate [Redacted] (PRH306).
176 Exhibit P1294, ECT-SMS-0047 Complete SMS Content for Phone Number 3966663 (BADREDDINE PMP 663) from 01.02.2004 to 16.06.2009, ERN 60259745-60263521, at 60259745.
134 R305355
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 23 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace and the Constitutional Council
346. Former Prime Minister Rafik Hariri received visitors at Quraitem Palace throughout the day, 177 and attended a meeting at the Constitutional Council at 13:00.
B. Green Network Activity: First Green 071 [Merhi] Activity for Seven Weeks
347. [Ayyash] and [Merhi] both called [Badreddine] within three minutes of each other.
C. Blue Network Activity: Expansion of the Blue Network to Six Phones, which Became the Principal Six Members of the Blue & Red Networks
348. This was the day that the Blue Network expanded from three phones to six. It was the first day that [S6], [S8], and [S9] started communicating with each other and also with [S5] and [S7]. These would later become the "Principal Six" users of the Red Network used to execute the assassination of Mr. Hariri.
D. Blue Network Activity: Surveillance of Quraitem Palace
349. [S8], [S9], [S5] and [S7] were all active in the vicinity of Quraitem Palace in the morning and afternoon consistent with surveillance. [Ayyash] and [S6] remained in south Beirut.
E. Selected Attribution Points for Salim Ayyash
350. Mr. Ayyash was active on his PMP 935, Yellow 294, Blue 322 and Green 300 in south Beirut. At 15:49, PMP 935 connected to a cell in Haret Hreik to contact Mr.
177 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380831- D0380833.
135 R305356
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Ayyash's landline. Around a quarter of an hour before, and a few minutes after, and connected to cells in that same part of Haret Hreik.
F. Selected Attribution Points forMustafa Badreddine
351. Before Mr. Badreddine's first Green call, PMP 663 called [Redacted] (PRH338), a university associate, connecting to a cell in Haret Hreik that provided predicted overlapping coverage with the cell connected to by . [Redacted] recalled that when called for attendance while in class "Sami Issa" would answer to a different name. 178
352. Less than a minute before Mr. Badreddine's second Green call, SMP 944 connected to the same cell as to receive a call from Mr. Badreddine's Samino associate, Mohammed Shukr.
178 Witness Statement of[Redacted], ERN 60306043-60306112.
136 R305357
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 24 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace and Travelled to Faqra Villa in the Evening
353. Former Prime Minister Rafik Hariri had visitors registered at Quraitem Palace during the day. 179 Mr. Hariri travelled to Faqra in the afternoon arriving around 17:00.
B. Blue and Yellow Network Activity: Surveillance of Quraitem Palace
354. For three hours in the morning and early afternoon, one or more of [S5], [S6], [S6], [S7] and [S9] were active in the vicinity or area of Quraitem Palace while Prime Minister Hariri was there.
C. Purple Phone Activity: Final Day Assad Sabra Travelled to Tripoli
355. This was the last of the four days in December that [Sabra] went to Tripoli. [Sabra] repeatedly connected to a cell in Hadath, around 09:00, which provided predicted coverage to the area around Mr. Sabra's home when it contacted his brother-in-law. By 12:52, he was in central Tripoli when he received a call from [Oneissi] who was in south Beirut. [Sabra] was back in south Beirut by 16:57 when he again was in contact with his brother-in-law, connecting to the same cell in Hadath as in the morning.
D. Salim Ayyash 's Activity and Selected Attribution Points
356. PMP 935 [Ayyash] started the day in south Beirut but connected to a cell in south
Lebanon in the afternoon. ~·~~ ~-- [Ayyash] connected to a cell in the same part of south Lebanon around the same time. Upon its return to Beirut, PMP 935 connected to a cell in Hadath to call Mr. Ayyash's car sales associate, Ghaleb Jaber. Mr. Ayyash did not use Yellow 294 on this day and received only one call on Blue 322.
179 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380834-D0380835.
137 R305358
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 25 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met with Ahmad Nassir Al-Asaad and Mustafa Nasser at Faqra Villa
357. Former Prime Minister Rafik Hariri was at his Faqra residence all day.
358. Mustafa Nasser [Redacted] and journalist Ahmad Nassir Al-Asaad [Redacted] met with Rafik Hariri at his Faqra residence between approximately 12:00 and 16:00. [Redacted], Mr. Hariri confronted Mr. Nasser about conflicting versions of information he had provided him regarding Hezbollah and the elections. 180
359. Prior to travelling to Faqra, Mr. Nasser was in contact with the political Secretary to Hassan Nasrallah, Hussein Khalil and Mr. Khalil's assistant, Khalil Farhat. Mr. Nasser also called Mr. Farhat after the meeting.
360. Upon his return to Beirut, Mr. Al-Asaad received a call of over 12 minutes from Mr. Khalil. Contact between Mr. Khalil and Mr. Al-Asaad was unusual and occurred on only eight other days in the five months prior to the attack.
B. Blue and Yellow Network Activity: First Day ofSurveillance in Faraya
361. This was the first day that Blue and Yellow Network phones were active in the Faraya area. Salim Ayyash ( and PMP 935), S6 ( and ), S5 ( ), and S7 ( ) all travelled to the Faraya area and were in contact with one another.
362. At 10:36, • -·w.. ·~, [S6] connected to cells in Zouk Mosbeh on the way to Faraya. By 11:09, S6 (Yellow 457 and Blue 610) was connecting to cells in the Faraya area and, shortly thereafter, so was Mr. Ayyash (Yellow 294 and PMP 935). They continued to do so for over an hour before returning to Beirut. On his return, Mr.
180 [Redacted].
138 R305359
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Ayyash used his to contact [S5] from a cell in the immediate vicinity of Quraitem Palace; S5 was connecting to a cell in Faqra.
363. Between 16:16 and 17:02, [S7] and [S5] were in contact seven times, this coincided with Mr. Nasser's departure from Faqra for Beirut.
364. Mr. Ayyash, S6 and S8 used their Yellow phones to communicate with each other, but their Blue phones to communicate with S5 and S7.
C. Purple Phones: Hassan Merhi Successive Contact with Assad Sabra and Hussein Oneissi
365. In the evening at 18:57, [Merhi] called [Sabra]. Later, at 20:44, [Merhi] called [Oneissi] and then shortly afterwards he called [Sabra] at 20:46. All three phones made contact with family members during the day.
D. Selected Attribution Points for Salim Ayyash
366. PMP 935 was used sparingly throughout the day in Faraya and also in Beirut. It was in contact with Hussein Zaarour twice, a relative and business associate and regular contact of Mr. Ayyash. The first of those calls connected to the same cell in Faraya that had connected to less than a minute later. Later, it connected to a cell near Quraitem Palace which provided predicted overlapping coverage to a cell connected to by [Ayyash] two minutes before.
E. Mustafa Badreddine Travelled to Faraya
367. Mr. Badreddine's phones (PMP 663 and SMP 944) connected to cells in south Beirut throughout the day, mainly in their familiar area of Haret Hreik and PMP 663 was in contact with [Redacted] in Faraya. Mr. Badreddine (PMP 663 and SMP 944) then departed for F ara ya around 22: 15. He continued to [Redacted] . He returned to south Beirut around 05:30 the next day.
139 R305360
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 26 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Faqra Villa
368. Former Prime Minister Rafik Hariri was at his Faqra residence near Faraya.
B. Blue and Yellow Phone Activity: Surveillance ofRafik Hariri in Faraya
369. Between 09:58 and 19:48, the following Blue and Yellow Phones were active in the Faraya area:
• [S5] • [S6] and [S6] • [S7] • [ ] and [S8] • [S9] • [Ayyash]
370. [S9] was already in the Faraya area for its first activity at 09:58 when it received a call from [S6] in south Beirut. By 11: 10, [S5], [S6] and [S7] were also connecting to cells in the Faraya area for their first calls of the day.
371. [Ayyash], who was in south Beirut, contacted [S5] at 11 :07 and had joined the four other phones in that area by 13:08. This was the final call that Salim Ayyash made on . He continued to use until 7 January, and subsequently acquired his ultimate Blue phone ( ) shortly before the Blue Network group was fully formed and fully active.
372. Blue 585 [S5] had left the area of Faraya by 14:37 en route to Beirut. Yellow 170 connected with the same tower as Blue 585 [S5] (Amarat_Chalhoub_A). Mr. Ayyash (Yellow & PMP 935) had also left Faraya by 14:57 on his way south to Harouf where both phones connected to the same cell in the evening.
373. S8 (Blue 817 and Yellow 933), S6 (Blue 610 and Yellow 457) and Blue 324 [S7] all returned to Beirut later in the afternoon.
140 R305361
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
C. Purple Phone Activity: Contact between Hassan Merhi and Hussein Oneissi
374. In the morning at 11:10, [Merhi] called [Oneissi] for almost four minutes. They were in contact twice more in the next half hour. Earlier in the mornmg, [Oneissi] contacted a number associated with his brother. [Merhi] called [Oneissi] again in the evening. The previous call of had been with Mr. Merhi's brother-in-law.
375. [Sabra] also called [Oneissi] in the early afternoon.
D. Selected Attribution Points for Salim Ayyash
376. Mr. Ayyash used PMP 935 and in the Faraya area just after 13:00. This was the last occasion he used
377. After this time, Mr. Ayyash's and PMP 935 travelled south to Harouf where they connected to the same cell in the evening. That cell provided predicted coverage not far from his Harouf residence. PMP 935 connected to that cell to contact a number associated with his sister and brother-in-law.
141 R305362
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 27 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Returned to Quraitem Palace from Faqra
378. Former Prime Minister Rafik Hariri departed Faqra and had returned to Quraitem Palace by 10:12. A number of visitors registered at Quraitem Palace to meet Mr. Hariri between 10:35 and 13:45 and again between 17:30 and 21:40. 181
B. Green Network Activity: Hassan Merhi & Salim Ayyash Proximate Calls to Mustafa Badreddine
3 79. In the morning, [Merhi] and [Ayyash] both called [Badreddine] within three minutes of each other from different locations in south Beirut.
380. Their calls into Mr. Badreddine had also coincided within a short time frame on 6 November 2004 and 23 December 2004.
381. This was the last occasion that Mr. Merhi was active on until 2 January 2005.
C. Green Network Activity: Salim Ayyash and Mustafa Badreddine Meeting & Hierarchical Green Yellow Call Flow
382. Early in the afternoon, [Badreddine] called [Ayyash] from SFEIR3 in Hadath. When Salim Ayyash called Mustafa Badreddine back for only seven seconds, less than 15 minutes later, they connected to the same cell (SFEIR3). There were no voice calls or other initiated activity using their phones for over 20 minutes before they both became active again at the same time connecting to the same cell (MIKAEL2).
181 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380835- D0380836.
142 R305363
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
383. Mr. Ayyash's next call 20 minutes after the period of call inactivity was using to contact [S6] who had just travelled to the Faraya area. The following day, S6 travelled to Tripoli and connected to cells in the vicinity of the Nejmeh phone shop from where, over this period, the Red SIM cards were purchased.
D. Blue and Yellow Network Activity: Surveillance at Faqra en-route to Quraitem Palace
384. Between 07:57 and 15:59, the following Yellow and Blue Phones were active in the Faraya area, along the route of travel between Beirut and Faraya, and in the vicinity of Quraitem Palace:
• [Ayyash] • • [S6] and [S6] • [S7] • [ ] and [S8] [S9]
385. During the day, [Ayyash] was only in contact with [S6] while S6 was in tum in contact with S5, S7, S8, and S9. Mr. Ayyash and S6 were the most dominant Blue phone users of the principal six sub-group that went on to execute the assassination using their six Red phones.
1. Blue and Yellow Surveillance ofMr. Hariri's Return from Faqra to Quraitem
386. At 09:19, who was also in Faraya called [S6] who was in Hadath in south Beirut. Immediately following this call, S6 switched to to call [S5], who also connected to a cell in the Faraya area. They had five sequential phones calls between 09:20 and 09:24. This coincided with the approximate time at which Mr. Hariri' s convoy would have been preparing to return to Beirut.
387. Blue 610 [S6] then called Blue 817 [S8], who was north of Beirut in the area of Dbayeh along the return route from Faraya. Blue 817 [S8] in tum immediately called Blue 585 [S5] in Faraya. S8 who had moved north to the Zouk Mosbeh Tunnel area then switched to his Yellow 933 to call Yellow 457 [S6] at 09:34.
143 R305364
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
388. Ten minutes later, at 09:54, S8 had returned south and was entering north Beirut on the coastal road as he was called by [S6] who was connecting to a cell providing coverage along the same coastal road in west-central Beirut. Between 10:03 and 10:10, [S7], [S6], and [S8] were again in contact along the coastal road in west Beirut.
389. Mr. Hariri's convoy arrived back at Quraitem Palace by 10:12.
390. At 10:52, [S6] called [Ayyash] with both connecting to cells in the vicinity of Quraitem Palace. Shortly after, Mr. Ayyash called S6 twice more while both remained in the west Beirut area.
2. S6 Returned to Faraya in the Early Afternoon
391. After connecting to cells in the area of Quraitem Palace shortly after Mr. Hariri returned there, S6 then travelled to the Faraya area for the first time that day where he had calls with [S8] using (three times), and with [S7] using (three times). As S6 travelled up to Faraya, S7 was returning from the Faraya area to south Beirut. [S6] continued to connect to cells in that area until 13:20.
392. By 14.02, approximately an hour after arriving in the Faraya area, S6 was travelling back to Beirut when he was called by [Ayyash].
E. No Purple Phone Contact
393. The Purple phones were not in contact with each other.
144 R305365
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 28 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
394. Former Prime Minister Rafik Hariri received visitors at Quraitem Palace between 07:50 and 19:00. 182
B. Hierarchical Green/Yellow Call Flow and Purchase ofRed SIM Cards in Tripoli
395. Subject 6 was active on both and in the Tripoli area between 11:12 and 14:17. He connected to cells in that area to have contact with Salim Ayyash ( ), S5 ( ), S8 ( ) and S9 ( ). S9 ( ) was also connecting to a cell in the same area of Tripoli between 13:34 and 14:04.
396. The cells connected to by S6 and S9 between 13:11 and 14:17 were in the vicinity of the Nejmeh mobile phone shop from where the Red Network phone SIM cards were purchased sometime between 24 December 2004 and 4 January 2005.
397. Less than three minutes after [S6] called [A yyash] from Tripoli at 13:11, [Ayyash] called [Badreddine]. The timing and direction of the calls is consistent with there being a direct relationship between the command element and the principal six operatives.
398. A similarly close relationship between the command element (Green phones) and principal six operatives Blue and Red phones is also seen during other activity key to the conspiracy e.g. the purchase of the Mitsubishi Canter van, Red phone surveillance of Rafik Hariri, the arrival of the LVB lED at the crime scene shortly before the assassination etc.
182 Exhibit P301, Visitor's Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380836-D0380838.
145 R305366
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
C. Blue Network Surveillance of Quraitem Palace
399. Between 12:54 and 15:15, [S5], [S7], and [S8] connected to cells in the vicinity of Quraitem Palace or along the coastal road nearby. While in the area, they were in contact with each other and with [S6] in Tripoli. By 16:46, the Blue phones of S6, S 7 and S8 had returned to south Beirut.
D. Purple Phone Activity: Hassan Merhi and Hussein Oneissi Cotnact
400. [Merhi] called [Oneissi] once at 15:53.
401. The next day, [Oneissi] would connect to the COLA cells in the immediate vicinity of the mosque. It would be the start of a ten day period (the "COLA Phase") when [Oneissi] and/ or [Sabra] connected to the COLA cells on all but one day.
E. Selected Attribution Points for Salim Ayyash
402. [Ayyash] and [Ayyash] connected to the same cell (PORT1) in the port area of Beirut for both these calls. PMP 935 [Ayyash], which had earlier made contact with the phones of Mr. Ayyash's sister-in-law and her husband, also connected to the same cell some seven minutes before.
F. Select Attribution Points forMustafa Badreddine
403. PMP 663 [Badreddine], which was in contact throughout the day with Mr. Badreddine's [Redacted] associates (including [Redacted] (PRH416), and [Redacted] (PRH089)) received a network SMS text less than three minutes after [Badreddine] received its call from [Ayyash]. It connected to a cell in Haret Hreik that provided predicted overlapping coverage with ROUEIS3, the cell connected to by Green 023 three minutes before, and the cell most connected to by all of Mr. Badreddine' s Alfa phones.
146 R305367
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 29 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Faqra
404. Former Prime Minister Rafik Hariri spent the day at his Faqra Villa. While there, he met with the American Ambassador Jeffrey Feltman. They discussed Mr. Hariri's meeting with the Maronite Patriarch a week earlier as well as the electorallaw. 183
B. Blue and Yellow Network Active around Faraya and Quraitem Palace
405. [Ayyash] called [S6] in the morning at 10:36 while both of them were in south Beirut. Two hours later, at 12:38, [S6] had travelled north and received a call from [S9] connecting to a cell along the road leading to Faraya. By the time of their next call, at 15:47, S6 had returned to Beirut and connected to a cell on the coastal road near the crime scene to contact [S9] which was connecting to a cell located in the vicinity of Quraitem Palace. Y ahya Al-Arab, Mr. Hariri's Chief of Security, had returned to west Beirut from Faqra between 15:12 and 16:14.
406. [S7] and [S5] were in contact four times around south Beirut during the afternoon and evening.
C. Purple Phones: First Day of 10 Day Period of Almost Daily Activity around Arab University Mosque ("COLA Phase'')
407. This was the first day of ten consecutive days (except one) that Hussein Oneissi (Purple 095) and/or Assad Sabra (Purple 018) connected to the COLA cells ("COLA Phase").
408. Purple 095 [Oneissi] was active in south Beirut from 08:01 until 12:38 during which time it was in contact with Hussein Oneissi's sister and mother. The phone was then
183 Exhibit P303, Press Release of29.12.04, Hariri's position on divisions, ERN D0004894-D0004894.
147 R305368
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
inactive for three hours until it received two service SMS texts at 15:26 and a call at 15:27, which connected to the COLA3 and COLA2 cells, respectively, which are in the area of the Arab University Mosque. The two inbound SMS within seconds of each other are consistent with them being "pent-up" texts received after a phone has been turned on after a period of unavailability to the network provider. [Oneissi] had returned to south Beirut by 15:43.
409. [Sabra] called [Merhi] in the afternoon. This was the only inter-Purple Phone contact. Later that afternoon, both phones had contact with telephone numbers attributable to close relations, Assad Sabra's wife and Hassan Merhi's brother, respectively.
410. This "COLA Phase" spanning from 29 December 2004 to 7 January 2005 coincided [Redacted] . 184
D. Mustafa Badreddine Travelled to Faraya
411. At 15:56, received a service SMS connecting to its most frequently used cell ROUEIS3 in Haret Hreik. Several minutes later, PMP 663 also connected to a cell situated in close proximity that provided overlapping predicted coverage.
412. In the evening, Mr. Badreddine (PMP 663) exchanged a series of calls with [Redacted] By 23:08, Mr. Badreddine had also travelled to the Faraya area and PMP 663 also connected to cells in that area. Mr. Badreddine had returned to south Beirut by 05: 14 the next morning.
E. Selected Attribution Points for Salim Ayyash
413. In the afternoon and early evening, PMP 935 [Ayyash] had contact with his brother, Mohammed Ayyash, and then a series of contacts with his Hadath home landline connecting to a cell in the Borj Rahhal area of southern Lebanon. Both his 294 and Green 300 connected to that same cell in close proximity of time.
184 [Redacted].
148 R305369
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 30 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Returned to Quraitem Palace
414. Former Prime Minister Rafik Hariri departed from his Faqra residence back to Quraitem Palace around 14:00, travelling via the coastal route. By reference to the cell siting of his security detail's phones, he arrived back at the Palace by 15:30. Mr. Hariri was recorded as receiving visitors at Quraitem Palace for the rest of the . 185 a f1temoon an d evemng.
B. Yellow Network Activity: Purchase ofRed Handsets in Tripoli (S8 and S9)
415. Five mobile handsets were purchased by a male at the Echo Phone shop in Tripoli. 186 [S8] and [S9] were in central Tripoli by 10:14, and connected with cells located in close proximity to the Echo shop between 11:18 and 11 :20. This was the first time that [S8] had connected to cells in the Tripoli area during the indictment period, while [S9] had connected to cells in Tripoli two days earlier, in the area of the N ejmeh phone shop.
416. While in Tripoli, [S9] was in contact with [S6] who was in south Beirut. By 12:21, when [S8] called [S6], Subject 8 was already south of Tripoli on his way back to Beirut.
C. Blue and Yellow Network Activity: Surveillance of Rafik Hariri's Return from Faraya
417. Between 12:19 and 20:56, Blue 585 [S5], Blue 610 [S6], Blue 324 [S7] and Blue 817 [S8] were located in various areas including Quraitem Palace, the coastal route in central Beirut near to the crime scene, and Faraya.
185 Exhibit P30 1, Visitor's Logbook for Quraitem Palace, ERN D0380523-D0380905, at 00380838. 186 Exhibit P465, Witness Statement of Nawwar Dona, ERN 302282-302287 A, para. 36.
149 R305370
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
418. At 14:19, [S7] who had been connecting to cells in the Faqra area since 12:19 called [S6] in south Beirut. This was the approximate time at which Rafik Hariri departed Faqra villa for Quriatem Palace.
419. Between 14:34 and 15:15, [S5] was in contact with [S7] (in the Faqra area), and [S6] and [S8] (both located ahead on or near the coastal route in Beirut not far from the crime scene) as it connected to cells providing predicted coverage along the route from Faraya to Beirut. As it did so, S5 co-located with phones used by Mr. Hariri's security convoy in the Dbayeh area.
420. By 15:35, shortly after Mr. Hariri's return to Quraitem Palace, S6 ( and ) and S8 ( ) were connecting to cells in the vicinity; from there S6 contacted Salim Ayyash, who was in Hadath, on his
421. After 15:44, [S5] returned to the area of Faraya and re-joined [S7]. At 19:08, [S5] was still in the Faraya/Faqra area. The last Blue phone activity of the day was at 20:56, when [S7], who had returned to south Beirut from Faraya, contacted [S6] who was connecting to a cell in the vicinity of the crime scene.
D. Purple Phone Activity: Second Day of 10 Day "COLA Phase" of Almost Daily Activity around Arab University Mosque
422. Between 18:05 and 18:11, [Oneissi] and [Sabra] both connected to the COLA3 cell which is located in very close proximity to the Arab University Mosque. At 18: 11, [Sabra] called [Oneissi]: both phones connected to this cell again. This was the only Purple Phone to Purple Phone contact.
423. This was the first day that Purple 018 [Sabra] had connected to one of the COLA cells in the immediate vicinity of the Arab University Mosque since the end of 2001. Hussein Oneissi's Purple 095 had connected to COLA2 on 22 December 2004 (and on only five other previous occasions since the end of 2002).
150 R305371
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
424. Both [Sabra] and [Oneissi] were in this area at the same time without prior telephone contact between them - the last contact between them had occurred on 26 December 2004.
425. Later that evening, [Oneissi], [Sabra], and [Merhi] all connected to the same cell (SFEIR3) in Hadath within an hour of each other, between 19:56 and 20:45. Hassan Merhi's receipt of two successive network SMS texts at 19:56, indicate that his had been switched off.
426. [Sabra] was in contact with a phone attributable to relatives of Assad Sabra's wife. All five of other calls on this day which were prior to using the COLA cells, including one from Mr. Oneissi's sister, also used SFEIR3.
151 R305372
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 31 December 2004
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace then Faqra Villa
427. Former Prime Minister Hariri travelled from Quraitem Palace to his Faqra residence for New Year's Eve in the afternoon arriving around 15:30. A number of visitors were registered at Quraitem Palace to meet with Mr. Hariri between 08:00 and 14:10 prior to his departure for Faqra. 187
B. Green, Blue and Yellow Phone Activity: Surveillance of Rafik Hariri's travel to Faqra
1. Blue andYell ow Surveillance of Quraitem Palace
428. Between 09:49 and 14:19, Yellow and Blue phones (S5, S6, S7, S8 and Salim Ayyash) were active and in contact with each other at various times around Quraitem Palace; this coincided with Mr. Hariri's presence there.
429. At 13:13, an hour after Mr. Ayyash's last call (with S6) in the area around Quraitem Palace, [Ayyash] called [Badreddine]: both connected to cells in south Beirut.
2. Blue and Yellow Surveillance ofMr. Hariri's Travel to Faqra
430. By 14:25, [S7] was connecting to cells in the vicinity of the Zouk Mosbeh tum-off to the Faraya/ Faqra area. It continued to do so untill4:48. By that time,
~~~ [S5], ~·~~ ~~v [S6], and~·~~ ~~. [S9] were also connecting to cells in that same general area.
431. Towards the latter part of the period between 14:40 and 14:52, Yahya Al-Arab, Mr. Hariri's Chief of Security, passed through that area on the way to Faqra. By 15:30, Mr. Hariri's convoy had reached the Faraya area. At 15:15, the Blue phones of S8 and
187 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380838-D0380839.
152 R305373
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
S9 were connecting to cells in Faraya. Between 15:21 and 15:26, S6 ( ), who by now was also connecting to cells in the Faraya area, exchanged calls with Mr. Ayyash ( ) who was connecting to SFEIR2, once again, in Dahyieh.
432. By the time of their next and final call 15 minutes later, the use of cells indicates that S6 (and S5) had begun to move back towards Zouk Mosbeh in the direction of Beirut. [S6]'s calls with Mr. Ayyash were interwoven with [S6]' s calls with other Blue phones travelling to Faraya.
433. After this activity, there was no further contact between these six phone users (S5-S9 and Mr. Ayyash) on either a Blue or a Yellow phone until 22:41 when [S7] called [S5]; both connected to cells in south Beirut for what was the last network call of the day.
C. Purple Phone Activity: Third Day of 10 Day "COLA Phase" of Almost Daily Activity around Arab University Mosque
434. 's [Sabra] first two calls of the day connected to a cell providing predicted coverage to his residence in Hadath. Shortly afterwards, at 10:39 and again at 11:34, it connected to COLA3 in the immediate vicinity of the Arab University Mosque. At 12:39, connected to cells a little away from this area when calls were exchanged with [ Oneissi], which was in the Hadath area, but again connected to COLA3 at 12:54 and 13:29.
435. [Sabra] and [Oneissi] were m contact five further times between 14:09 and 15:58 by which time Hussein Oneissi had also travelled north from Dahyieh to connect to an adjacent cell not far from the Mosque. Within this period, [Sabra] received a call from a phone associated with close relations of Assad Sabra's wife's family.
436. Purple 018 [Sabra] and Purple 095 [Oneissi] then travelled toward the Aramoun area, south of the airport, calling each other twice between 16:30 and 16:34 as they did so. Both connected to cells in the area around Aramoun between 16:55 and 18:18. While there, Purple 095 [Oneissi] called Purple 231 [Merhi] who was in Dahyieh (SFEIR3), twice. During this period, Purple 018 [Sabra] received further calls from the phone associated with Mr. Sabra's wife's family, and Purple 231 [Merhi]
153 R305374
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
received a call from his brother-in-law and frequent contact, Yahya Beydoun [Redacted].
437. By 18:33, when [Sabra] and [Oneissi] were again in contact, both connected to the same cell back in south Beirut. Not long after, [Oneissi] called [Merhi] for the final time that day. Later that evening [Sabra] had contact with phones attributable to Mr. Sabra's parents' and Mr. Sabra's brother-in-law.
438. [Sabra] and [Oneissi] had an unusually high number of calls with each other on this day. They were in contact on ten occasions. [Oneissi] and [Merhi] were in contact on three occasions.
439. This was the second consecutive day that both phones used cells in the area of the Arab University Mosque, and the third consecutive day that Mr. Oneissi's phone had connected to cells there.
440. This was also the first day that [Sabra] and [Oneissi] had connected to cells in the Aramoun area during the indictment period. From this day, one or both of these two phones was in this area every day for seven days until 6 January 2005. This coincides with the 10 day COLA phase when one or both these two phones were also connecting in the area of the Arab University Mosque.
441. The Aramoun area was a highly unusual area for the Purple phones. The last time [Oneissi] had connected to the cells in this area was in July 2003. After this seven day period, he connected to a cell in the area only one more time on 14 January 2005, two days before Mr. Abu Adass was abducted. In the whole period during which is attributed to Mr. Sabra, it too only connected cells in this area on just two days (31 December 2004 and 2 January 2005) over this period for five calls.
154 R305375
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 1 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Returned from Faqra, Visited Marwan Hamade and Travelled to Paris
442. Former Prime Minister Rafik Hariri was at his Faqra villa until mid-morning when he returned to Beirut. Between 12:39 and 13:19, the phone activity of his security detail is consistent with Mr. Hariri having visited Marwan Hamade (PRH038). Later in the afternoon, he travelled to Beirut Airport to fly to Paris at approximately 16:20. 188 He remained abroad until 7 January 2005.
B. Blue Network Activity: Surveillance of Rafik Hariri around Faraya, Quraitem Palace and Marwan Hamade's Residence
443. There was extensive Blue phone network activity involving [S5], [S6], [S7], [S8] and [S9]. There were 32 calls prior to Mr. Hariri's departure out of the country, and only one afterwards. In contrast, there was a combined total of only nine Blue calls for the following five days while Mr. Hariri remained abroad. Frequent Blue call activity resumed upon his return to Lebanon.
444. [S6] was the dominant Blue phone and was involved in 22 calls equally spread amongst the active Blue phones.
445. Salim Ayyash, who was yet to acquire his , used to exchange calls with [S6]: once in the late morning from the vicinity of his residence in Harouf, south Lebanon and once in the late evening in the vicinity of his residence in Hadath.
188 Exhibit P346, Logbook record of Rafik Hariri trips abroad 12 May 04 to 05 Feb 05, ERN 60003993- 60004136, at ERN 60004136T, (p.8); Exhibit P536, Rafik Hariri's passport of 2004, ERN 60242298- 60242323_D_EN, at ERN 60242318. (p. 21 and p. 38 of actual passport).
155 R305376
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
1. Blue Surveillance ofMr. Hariri's Return from Faqra to Quraitem Palace
446. [S7] was sited in Faqra all morning. At 09:46, around the time when it can be inferred that Mr. Hariri's convoy left Faqra villa, he called [S6] who was in south Beirut.
447. Between 10:04 and 10:06, [S7], who was in Faqra, was called by [S9] who then immediately called [S5], and [S8] m quick succession. At this stage, [S5] was located on the road from Faraya connecting to an adjacent cell to that of Mr. Hariri's security detail a minute later.
448. Around the same time, the movement of [S8] was also consistent with surveillance of Mr. Hariri's return to Beirut from the coastal road leading from the north. [S5] also continued its movement toward Beirut.
2. Blue Surveillance of Mr. Hariri at Mr. Hamade's Residence
449. Between 12:38 and 13:17, [S9] contacted [S6] and [S8] connecting to cells around Mr. Hamade's residence. Both [S6] and [S8] moved from south Beirut to also connect to cells in the same vicinity whilst Mr. Hariri's security detail was present. At 13:28, S9 made successive calls to S8 and S6 from the vicinity of Quraitem Palace shortly after Yayha Al-Arab (PRH289) had returned there from Mr. Hamade's residence.
C. Purple Phones: Fourth Day of 10 Day "COLA Phase" of Almost Daily Activity around the Arab University Mosque
450. Assad Sabra ( ) 's first call of the day was in the area of his Hadath residence. In the late morning, he made two calls at 11:12 and 12:38 connecting to COLA3, which provided immediate predicted coverage to the Arab University Mosque. Thereafter, he returned to south Beirut, for two hours. He was involved in 15 calls over a period of nearly five hours in the afternoon (14:24-19:06). All but one of those calls connected to COLA3. The last three of those calls were with Hassan Merhi (Purple 231), and two of the others were with Hussein Oneissi (Purple 095).
156 R305377
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
451. All three co-accused engaged in calls with phones attributable to their family during the day: Mr. Sabra with his wife's family's phone, Mr. Merhi with his brother-in-law, and Mr. Oneissi with his mother (twice), sister, and brother.
D. Selected Attribution Points for Salim Ayyash
452. Shortly after midnight, Mr. Ayyash's phones ( and PMP 935) co-located on his most connected to cell (SFEIR2) which provided immediate predicted coverage to his home in Hadath. Between 10:54 and 19:02, they co-located repeatedly on the same cell in south Lebanon providing coverage in and around Doueir not far from his Haroufresidence. By 22:29, he had returned to south Beirut.
157 R305378
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 2 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri in Paris
453. Former Prime Minister Rafik Hariri was abroad in Paris. 189
B. No Blue Network and Limited Green & Yellow Network Activity
454. This was an exceptionally quiet day, the first of five days in an unusually quiet period, corresponding with Mr. Hariri's absence from Lebanon.
455. There were two brief Green calls in the afternoon: first [Ayyash] called [Badreddine] and four hours later [Merhi] called [Badreddine].
456. There was no Blue activity at all, the only such day in the period from when the original closed user group of three expanded (23 December 2004) to the date of the crime (14 February 2005).
457. Salim Ayyash ( ) exchanged two short calls in the evening with [S6].
C. Purple Phones: Only Day Purple Phones Not in Arab University Mosque Area in 10 Day "COLA Phase"
458. In the afternoon, [Sabra] and [Oneissi] were in contact on two occasions and [Oneissi] and [Merhi] were in contact once. This was the only day between 30 December 2004 and 7 January 2005 that Assad Sabra did not connect to cells in the area of the Arab University Mosque.
459. On this day, all three Accused were in contact with phones attributable to their family: Mr. Sabra (parents), Hussein Oneissi (mother) and Hassan Merhi (brother-in-law).
189 Exhibit P346, Logbook record ofRafik Hariri's trips abroad, ERN 60004129-600004136, at 600004136.
158 R305379
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Mr. Merhi's call with his brother-in-law connected to a cell that provided immediate predicted coverage to his home in Dahyieh, the same cell connected to by his to call Mr. Badreddine six minutes later.
D. Selected Attribution Points for Mustafa Badreddine
460. Mr. Badreddine's phones ( , SMP 944, PMP 663, PMP 354) all co-located in the same area of Dahyieh, in and around his most dominant cells, throughout the afternoon. SMP 944 and PMP 663 were in contact with some of Mr. Badreddine' s [Redacted] associates [Redacted] (PRH089), [Redacted] (PRH264), Zeina [Redacted], and Mohammed Shukr.
159 R305380
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 3 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
461. Former Prime Minister Rafik Hariri was abroad in Paris. 190
B. Limited Blue Network Activity
462. This was the second of a quiet five day period when Mr. Hariri was abroad; there were only three Blue calls.
C. Purple Phone Activity: Sixth Day of 10 Day "COLA Phase" ofAlmost Daily Activity around Arab University Mosque
463. Shortly after 11:00, Assad Sabra ( ) was located moving up towards the immediate vicinity of the Arab University Mosque where his phone was sited connecting to COLA3 at 11:16. Over an hour later, as his phone was located moving away from the area of the Mosque to return to Dahyieh, he made a series of calls to Hussein Oneissi ( ) who was moving from the Aramoun area to ultimately converge on the same cell as Mr. Sabra in Dahyieh (MIKAEL2).
464. Mr. Oneissi and Mr. Sabra were in contact on 10 occasions over a period of two hours: eight of those calls took place over a period of 40 minutes (12:22-12:45; 14:08- 14:24).
465. Shortly after the last of those ten calls, Mr. Oneissi ( ) was then sited moving towards the vicinity of the Arab University Mosque; one of those calls was from his mother. Half an hour later, he had returned to the Sfeir area where his phone co-located with Hassan Merhi's Purple 231 when Mr. Merhi received a call from his brother-in-law (Yahya Beydoun [Redacted]).
190 Exhibit P346, Logbook record ofRafik Hariri's trips abroad, ERN 60004129-600004136, at 600004136.
160 R305381
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
466. Throughout this day, all three Accused had a series of telephone contacts with their family and associates: Mr. Sabra (father and brother-in-law); Mr. Oneissi (mother) and Mr. Merhi (brother-in-law).
161 R305382
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 4 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
467. Former Prime Minister Rafik Hariri was abroad in Paris. 191
B. Red Network Activity: Set-Up in Tripoli
468. This was the first day, following the purchase of the Red Handsets and SIMs in late December/early January in Tripoli, that the Red phones were used.
469. All eight of the Red phones were used only to contact the network and not to contact each other. This took place between 14:15 and 14:43 using one of two neighbouring cells in the general vicinity of Tripoli. The Red Network phones were all used in Tripoli on two days, this day and 2 February, when they were topped-up.
470. There were a total of 13 calls made to the network all made in succession to each other in a manner consistent with one user initiating the calls on each of the eight phones.
C. Blue & Yellow Network Activity: S6/S9 in Tripoli when Red Phones Activated and Limited Blue Activity
4 71. The Blue and Yell ow calls indicate that S9 ( ) and S6 ( I ) were in the Tripoli area immediately before and after the Red network calls.
472. S9 and S6 had returned to Dahyieh by 16:52 and 17:58, respectively. Their movement to Tripoli and back is consistent with them having made a special trip to Tripoli to set up the Red phones there.
4 73. In line with their previous behaviour while Mr. Hariri was absent from Lebanon, there were only three Blue calls.
191 Exhibit P346, Logbook record ofRafik Hariri's trips abroad, ERN 60004129-600004136, at 600004136.
162 R305383
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. Purple & Yellow Network Activity: Indirect Link between Salim Ayyash/ Assad Sabra
474. Mr. Ayyash received one call on his from had also called Mr. Sabra's two hours earlier for a minute and twenty seconds. This is the only time between September 2004 and February 2005 that a Yellow phone and Purple phone were in contact.
E. Purple Phone Activity: Seventh Day of 10 Day "COLA Phase" of Almost Daily Activity around Arab University Mosque
475. Between 15:08 and 18:50, Assad Sabra ( ) was once again sited connecting to cells in the immediate vicinity of the Arab University Mosque over a series of six calls. While he was there, he was in contact with Hussein Oneissi ( ) once, who was again in the Aramoun area, and exchanged three calls with Hassan Merhi ( ). Within the same period, Hussein Oneissi called Mr. Merhi twice.
476. In close proximity to their contact with each other all three Accused also had telephone contact with family members: Mr. Sabra received a call from his father, Mr. Oneissi from his mother, and Mr. Merhi from his brother-in-law (twice).
163 R305384
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 5 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
477. Former Prime Minister Rafik Hariri remained abroad in Paris. 192
B. Blue & Yellow Network Activity: Repair ofRed Handset in Tripoli (S8)
478. [S8] was located in Tripoli around midday in the vicinity of the Echo cell shop where on this day one of the Red phone handsets was returned for repair. 193 The owner of Echo cell put his SIM card into the Red phone handset to test it just before noon. S8 had returned to Beirut by the evening. S8 and S9 had also travelled to Tripoli on 30 December 2004 on the day that the Red phone handsets were purchased.
479. There was only one call between Blue phones.
C. Purple Phone Activity: Eighth Day of 10 Day "COLA Phase" of Almost Daily Activity around Arab University Mosque
480. Assad Sabra ( ) was located, once agam, connecting to COLA3 in the immediate vicinity of the Mosque (at 14:34 and 14:44). This followed contact with [Oneissi] around an hour before. Both Accused used their phones to contact family and/or associates throughout the afternoon including phones attributed to their father and mother, respectively.
D. Rustom Ghazaleh Visited Haret Hreik and Wafik Safa Contact with Mustafa Badreddine
481. Mr. Ghazaleh made two calls to Mr. Safa in the afternoon as he made his way to Dahyieh from Anjar. Upon his arrival in Dahyieh in the early evening, Mr. Ghazaleh connected to cells in the area of the Hezbollah General Secretariat and a little to the
192 Exhibit P346, Logbook record ofRafik Hariri's trips abroad, ERN 60004129-600004136, at 600004136. 193 Exhibit P465, Witness Statement of Nawwar Dona, ERN 302282-302287 A and 40005828-40005831.
164 R305385
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
east. His phone remained in the area for approximately one hour. For part of that period, Mr. Safa connected to cells which provided overlapping coverage with those connected to by Mr. Ghazaleh. During that time, Mr. Safa called both Mr. Khalil and Mr. Badreddine (SMP 944) in quick succession.
482. At 19:12, not long after Mr. Ghazaleh's departure, Mr. Safa agam called Mr. Badreddine (SMP 944) for over 11 minutes.
E. Selected Attribution Points forMustafa Badreddine
483. Mr. Badreddine's phones (SMP 944, PMP 663, and PMP 354) co-located around his Samino store in Borj Hammoud in the late afternoon/ early evening during the period that he received two calls from senior Hezbollah security official Wafik Safa on SMP 944. This also coincided with an exchange of calls with established associates such as [Redacted] (PRH089) (on PMP 663) and the registered owner of Samino Jewellery, Ali Fayez Harb (on SMP 944).
165 R305386
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 6 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
484. Former Prime Minister Rafik Hariri remained abroad: on this day he travelled from France to Switzerland. 194
B. Limited Blue Network Activity
485. There were two Blue calls during the day.
C. Purple Phone Activity: Ninth Day of 10 Day "COLA Phase" of Almost Daily Activity around Arab University Mosque
486. Assad Sabra ( ) once again was located in the immediate vicinity of the Arab University Mosque (connecting to COLA3) on several occasions throughout the day (11:41-18:48). At 16:48, he sent a SMS text to Hussein Oneissi ( ) from that location. Upon his return to south Beirut, Mr. Sabra connected to a cell providing predicted coverage to his residence in Hadath.
487. Hassan Merhi did not use his Purple phone on this day.
194 Exhibit P346, Logbook record ofRafik Hariri's trips abroad, ERN 60004129-600004136, at 600004136.
166 R305387
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 7 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Returned to Lebanon
488. Former Prime Minister Rafik Hariri returned to Lebanon from Switzerland. 195 The movements of his security detail indicate that he arrived at Beirut Airport around 16:00 and had returned to Quraitem Palace by 16:54.
B. Expansion of Blue Network from Principal Six and Increase in Activity Coincident with Rafik Hariri's Return
489. The arrival of Mr. Hariri in Lebanon coincided with the reactivation of frequent Blue call activity: there were 27 calls on this day whereas in the previous five days there had been only 12 calls.
490. This was also the day the Blue Network started to expand from the principal six users to the fulll5 Blue Network phones over the following days.
491. A newly acquired Blue phone ( ) was used for the first time (to contact the network). One of the "dormant" Blue phones ( ) that had made no contact with any other phone for five months exchanged calls with which itself had been passed to a new user (after Salim Ayyash stopped using it and having not been used for 10 days).
C. Final Day of Yellow Network: Mr. Ayyash Stopped Using Yellow 294 and Started Using Semi-Covert PMP 170
492. This was also the day that Mr. Ayyash ceased use of Yellow 294 and adopted what had been Yell ow 170 as a semi -covert phone for selected use with certain associates outside of the Network Phone Groups. This phone is labelled for convenience as PMP
195 Exhibit P346, Logbook Record of Rafik Hariri's Trips Abroad, ERN 60004129T-600004136T, at 600004136T; Exhibit P303, Press Release of07.01.05, Hariri returns from Paris, ERN D0004960-D0004960.
167 R305388
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
170 from hereon but it was used in the development of the conspiracy notably for contact with Subject 816.
493. This was also the last day of the Yellow Network. Although a number of the Yellow phones continued activity, they ceased to operate together as a network and changed users and handsets.
D. Blue and Yellow Network Surveillance of Rafik Hariri at Airport and Quraitem Palace
494. At various times during the morning and early afternoon, three of the principal six Network phones (S6, S8, and S9) were located in the vicinity of Quraitem Palace; S8 was at the airport shortly after 11:00 for at least 15 minutes, and possibly much longer. Between 14:46 and 15:21, S5 was in the vicinity of Mr. Hariri's Faqra Villa where he exchanged calls with S6 who appeared to be playing a co-ordinating role with the other active Blue phones from the immediate vicinity of Quraitem Palace.
495. At 15:39, S6, who had been using in the vicinity of Quraitem Palace just before, started to move south using in tandem with Mr. Hariri's security detail's movement toward the airport.
496. Immediately after Mr. Hariri's return to Quraitem Palace, at 16:55 [S9] who by now was also connecting to a cell in the immediate vicinity of the Palace called S7 who was on the road to Faraya not far from the Zouk Mosbeh slip road. The timing of the calls and S7's subsequent movement is consistent with him returning to Beirut following the establishment of Mr. Hariri' s destination.
E. Purple Phone Activity: Final Day of 10 Day "COLA Phase" of Almost Daily Activity around Arab University Mosque
497. From 09:52 to 16:47, Hussein Oneissi (Purple 095) and Assad Sabra (Purple 018) were in contact eight times. From 09:52, Mr. Oneissi's phone was in the area of the Arab University Mosque and Mr. Sabra's phone had arrived in that area by 12:54. For the remainder of their calls to each other during this period both were in the area of the Arab University Mosque; on some of those calls they connected to a common cell.
168 R305389
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
498. Mr. Oneissi's first call from the immediate vicinity of the Mosque at 11:30 was to Hassan Merhi ( ). This was followed, immediately afterwards, by a call with his mother.
499. Mr. Sabra and/or Mr. Oneissi had used their phones in the area of the Arab University Mosque for nine out of the 10 days since 29 December 2004. Aside from a very confined period around the time of "Mohammed's" last call to the home of Mr. Abu Adass on 17 January, this was the last ever call activity by [Oneissi] and [Sabra] in the immediate vicinity of the Mosque.
500. The "COLA Phase" of Purple call activity near the Arab University Mosque ended nine days prior to the abduction of Mr. Abu Adass on 16 January. According to Mr. Abu Adass's friend, Ziad Ramadan (PRH103), they had met two days before he disappeared 196 when Mr. Abu Adass told him about meeting someone called "Mohammed" who had disappeared for almost 10 days. 197
196 Exhibit P 1775, Witness statement of PRH103, ERN 205564-205600A, at 205571; Exhibit P1774, Witness statement ofpRH103, ERN 50008361-50008362, at 50008362. 197 Exhibit P1775, Witness statement ofpRH103, ERN 205564-205600A, at 205573.
169 R305390
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 8 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met with Two Syrian Deposits at Quraitem Palace
501. Former Prime Minister Rafik Hariri received visitors at Quraitem Palace during the day including Walid Jumblatt (PRH684) (18:00) and two of the "Syrian deposit" MPs: Adnan Araqji (13:00) and Bassam Yammout (20:00). 198
B. Blue Network Continued to Expand
502. There were 11 calls between Blue phones throughout the day. Like the previous day, another one of the "dormant" Blue phones ( ) became active when it made contact with another phone for the first time in five months. The Yell ow Network had ceased activity the previous day and, over the following days, the Blue Network incrementally reached its full and final formation of 15 phones.
C. Blue Network: Surveillance of Quraitem Palace
503. [S7], [S8] and [S9] were located in the immediate vicinity of Quraitem Palace around midday. [S5] was in the Faqra area in the late afternoon. On this day, prior to his acquisition of , Salim Ayyash did not have an operational Yell ow or Blue phone.
D. No Inter-Purple Phone Activity Following End of "COLA Phase"
504. There was no inter-Purple phone activity and this was the first day Hussein Oneissi and/or Assad Sabra ceased being active in the area of the Arab University Mosque after having been active there for nine of the previous ten days.
198 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN 00380523- 00380905 at 00380843; Exhibit P303, Press Release of08.01.05, Beirut, on 8 January 2005, ERN 00004946-00004946_0_EN.
170 R305391
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 9 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Had Final Meeting with Rustom Ghazaleh and Refused to Accept Any Syrian Deposits on his Electoral List
505. The final meeting between former Prime Minister Rafik Hariri and Brigadier General Rustom Ghazaleh took place at Quraitem Palace between 13:50 and 15:45. 199 During the meeting, Mr. Hariri conveyed his resistance to the electoral reform and alliances promoted by the Syrian regime. 200 He informed Mr. Ghazaleh that he was going to stand for elections in all the Lebanese regions and that he would not accept any of the Syrian deposits on his electoral list. 201
B. Before Meeting Rafik Hariri, Rustom Ghazaleh in Contact with Hezbollah and Syrian Presidential Palace
506. In the afternoon, shortly before his meeting with Mr. Hariri, Mr. Ghazaleh was called by Wafik Safa (twice), and the Syrian Presidential Palace all within an hour of each other (12:23-13:22).
507. Within the same time-frame and six minutes after his first call to Mr. Ghazaleh, Mr. Safa made a short call to the "Hassan Nasrallah" subscribed landline followed by another half an hour later.
C. After Meeting Rafik Hariri, Rustom Ghazaleh Went Directly to Haret Hreik
508. Immediately following his meeting with Mr. Hariri, Mr. Ghazaleh contacted Mr. Safa for a third time, this time for a very short call; Mr. Safa was located in Haret Hreik
199 Exhibit P301, Visitor Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380844; Exhibit P303, Press Release of09.01.05, Hariri Meets Ghazali, ERN D0004921-D0004921; Exhibit P532, UNIC Beirut Press Review 10 January 2005, ERN D0412331- D0412339. 200 Exhibit P395, Cassette Tapes from Wissam Al Hassan, ERN 40000843C and 40000843D; Ghazi El-Youssef Testimony, Transcript 11 March 2015 pp. 56 et seq. 201 Testimony ofGhattas Khoury, 16 January 2015, pp. 66-70.
171 R305392
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
and Mr. Ghazaleh had begun to move towards south Beirut. In turn, Mr. Safa immediately contacted the "Hassan Nasrallah" subscribed landline (at 15:50).
509. By the time of Mr. Ghazaleh's next call 40 minutes later, his phone connected to a cell in Haret Hreik near the Hezbollah General Secretariat whose predicted coverage overlapped with a cell that had been connected to by Mr. Safa shortly before.
510. These circumstances, and the fact that both men's phones were inactive between 15:58 and 16:18, are consistent with a meeting taking place in Haret Hreik with senior Hezbollah officials following on immediately from the meeting at Quraitem Palace.
511. Mr. Ghazaleh's visits to Haret Hreik also took place in September, December, January and February. They tended to follow important political meetings or events involving Mr. Hariri and/or the opposition which directly concerned Syrian interests in Lebanon (see also e.g. 22 September, 13 & 16 December, and 5 February 2005). This meeting location, near the Hezbollah General Secretariat, is in the same area as the late night meetings between Mr. Nasrallah and Mr. Hariri, and also the area in Dahyieh most familiar to Mr. Badreddine's phones.
D. After Rustom Ghazaleh 's Visit: Contact with Syrian Presidential Palace and Wafik Safa Contact with Mustafa Badreddine
512. Mr. Ghazaleh's first call after his call inactivity in Haret Hreik, and his final one from Haret Hreik before he left to return to Anjar, was at 16:33 to a number attributed to the Syrian Presidential Palace.
513. Minutes later, Mr. Safa called the "Hassan Nasrallah" subscribed landline once again and, within half an hour or so, he had made yet another short call to Mr. Ghazaleh.
514. Mr. Safa then received a lengthy call (almost 10 minutes) from Mustafa Badreddine (SMP 944). Aside from a text sent the following day, this was the third of only three days of telephone contact between Mr. Safa and Mr. Badreddine over the first 16 days of January. Calls between them were made sparingly, and calls of this length were unusual.
172 R305393
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
E. Rafik Hariri Met with Hassan Nasrallah
515. In the early evening, Hussein Khalil contacted Mustafa Nasser (PRH476) and the "Hassan Nasrallah" subscribed landline in advance of a meeting between Mr. Hariri and Mr. Nasrallah in Dahyieh which took place between 18:35 and 20:14 with Mr. Nasser in attendance. 202 This particular meeting occurred further east from where their earlier and subsequent meetings took place in Haret Hreik. Mr. Khalil called Mr. Nasser upon Mr. Nasser's return to Quraitem Palace with Mr. Hariri after the meeting.
F. Blue Network Continued to Expand
516. The Blue Network continued their expansion towards their final formation of fifteen phones (completed by the set-up of Salim Ayyash's and [S23] the next day and the static [Sl3] two days later). [Sl2] was used for the first time and made its first call to another phone (having been set-up two days before).
G. No Inter-Purple Phone Activity Following End of "COLA Phase"
517. There was no inter-Purple call activity.
H. Selected Attribution Points for Mustafa Badreddine
518. Mr. Badreddine's (SMP 944) lengthy call with Mr. Safa after his meeting with Mr. Ghazaleh took place in the vicinity of his Samino store at Fum el Chebbak. Later that night, SMP 944 received a call from Ali Fayez Harb, the registered owner of the Samino stores.
202 Testimony of Mustafa Nasser, Transcript of 9 April 2015, pp. 55-60; Exhibit P413, Aide memoire titled Selected Telephone Activity of Mustafa Nasser: 21-22 December 2004 and 9 January 2005.
173 R305394
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 10 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met with Ali Jaber and Hani Hammond (Warning of Threat from Syrian Regime)
519. Former Prime Minister Rafik Hariri received visitors at Quraitem Palace throughout the day including Ali Jaber, a journalist, and Hani Hammoud (13:40- 15:55). 203
520. Having met with Syrian officials, including Syrian Deputy Foreign Minister Walid Moallem and Ghazi Kanaan, Mr. Jaber warned Mr. Hariri that: "They're going mad. They're paranoid. They are completely scared and they're ready to do anything possible and they're insulting you together. They're putting the responsibility of 1559 on your back. They are accusing you of being a traitor to Syria."204
B. Rafik Hariri's Alliance with Walid Jumblatt
521. Following on from his meeting with Rustom Ghazaleh the day before, Mr. Hariri visited to Walid Jumblatt (PRH684) at his home in Clemenceau in the mornmg (09:00-10:00) where he reiterated their "strong and unshakeable" alliance. 205
C. Blue Network: First Use ofBlue 233
522. This was the first day that [Ayyash] was used. However, Salim Ayyash had no contact with any of the principal six users of the Blue Network phones for a further three days, the day before the final Blue phone joined the network.
523. Mr. Ayyash had been without a "Network" phone for the previous 2-3 days and had not been in contact with the principal six Network users for four days.
203 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380844-D0380847. 204 Testimony of Hani Hammoud, Transcript of 19 May 2015, p. 89. See also pp. 85-91. 205 Exhibit P444, Press Release of 10.01.04, Hariri Alliance with Jumblatt, ERN D0004948-D0004949.
174 R305395
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. Limited Purple Phone Activity following the End of the "COLA Phase"
524. This is the first day of inter-Purple contact since 7 January 2005. In the morning when Hussein Oneissi ( ) contacted Assad Sabra ( ), they were connecting to adjacent cells with Mr. Sabra's phone connecting to the cell providing predicted coverage to his residence. Mr. Sabra had contact with his brother shortly before and after. Mr. Oneissi had received a call from his sister an hour before.
525. Fifteen minutes after receiving the second call from his brother, Mr. Sabra received a call from Mr. Merhi ( ); both were in Dahyieh.
175 R305396
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 11 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met with Ahmad Nassir Al-Asaad (Warning from President of Hezhollah 's Political Committee)
526. Former Prime Minister Rafik Hariri received visitors at Quraitem Palace throughout the day including Hani Hammoud, and Nazih Hariri [Redacted].206 Between 20:45 and 21:10, Mr. Hammoud (PRH052) attended in the company of journalist Nassir Al Asaad [Redacted].
527. Mr. Al-Asaad met with Mr. Hariri at his own insistence to relay comments that had scared him, and which had been made to him, by the President of the Hezbollah Political Committee, Ibrahim Amin El-Sayyed.207
528. According to Mr. Al-Asaad, Mr. El-Sayyed said: "Has Rafik Hariri gone crazy? Doesn't he know that those people will kill him? What is he doing? He refuses their requests. He refuses the people they want on his electoral lists and he joins the Christian opposition."208 By "those people" he meant the Syrian regime. 209
B. First Day ofthe Primary Phase of Green Network Activity
529. This was the beginning of the primary phase of Green call activity when the Green phones were used more frequently and regularly extending until the date of their final use on the day of the assassination.
530. Whilst there had been no Green call activity for nine days, this was the first of 11 successive days of use which encompassed the abduction of Mr. Abu Adass (the false claim set-up), the integration of the nine Blue "mission set-up" phones with the "Principal Six" to form the final Blue Network, and the first part of that integrated and
206 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380847-D0380849. 207 Hani Hammoud Testimony, Transcript of20 May 2015, pp. 6-10. 208 Hani Hammoud Testimony, Transcript of20 May 2015, pp. 8-9. 209 Hani Hammoud Testimony, Transcript of20 May 2015, p.9.
176 R305397
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
increased Blue call activity that led to the purchase of the Cantor van (the attack set up).
531. This was the day that the preparation and the execution of the conspiracy evidently and finally began to accelerate apace.
532. Two days earlier shortly after his return to Lebanon, Mr. Hariri had met with Mr. Ghazaleh at Quraitem Palace and asserted his political position and alliance in direct defiance of the Syrian Regime.
C. Green Network Activity: Salim Ayyash Travelled to the Vicinity of the Tripoli Vehicle Dealership
533. There were four calls in total: all of them from Salim Ayyash ( ) to Mr. Badreddine ( ). For the first of these calls, at 11:22, [Ayyash] connected to a cell in Khaldeh, just south of the airport.
534. Between 14:30 and 14:55, Mr. Ayyash connected to two cells in the Tripoli area that provided predicted coverage to the Tripoli vehicle dealership from which the Mitsubishi Canter was sold on 25 January 2005. The use of cell towers in the Tripoli area (or indeed anywhere north of Mosbeh) by any of Mr. Ayyash's phones was extremely unusual: it had not occurred for at least 3 years.
535. By their last call of the day, Mr. Ayyash ( ) connected to a cell providing predicted coverage to his Hadath residence.
D. Salim Ayyash Applied to Travel to the Hajj before Unusually Travelling to Tripoli
536. On this day, Mr. Ayyash submitted a request for a ten-day leave from his place of employment at the Doueir Civil Defence to travel to Hajj from 16 to 25 January 2005, 210 which he ultimately did not take.
537. Mr. Ayyash's PMP 170 co-located with Green 300 at Khaldeh in the morning, just south of the airport, consistent with travel to Beirut from the south of Lebanon.
210 Exhibit P 1163, Letter (Nabatiyeh Regional Station) dated 12/01/2005 detailing 10 day leave request by Salim Jamil Ayyash starting on 16/01/2005, ERN 60243639-60243639_D_EN.
177 R305398
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Around an hour after his call with Mr. Badreddine, he (PMP 935) had returned to Dahyieh where he attempted to call the Nabatiyeh Civil Defence Station.
538. Within an hour, he had moved north to use a cell near the coastal road only 20 km south of Tripoli from where PMP 935 called his home in Hadath.
539. Between 16:20 and 18:12, following his final Green call, Mr. Ayyash's phones ( , PMP 170 and PMP 935) all co-located on cells providing immediate or nearby predicted coverage to his home in Hadath. By 18:34, he had moved west to connect to ROUEIS3 which provides overlapping predicted coverage to cells connected to by Mr. Badreddine's phones (PMP 354 and PMP 663).
E. Limited Blue Network Activity
540. This was a quiet day of Blue call activity: there were seven calls in total between phones, three of which involved Mr. Ayyash's
F. Selected Attribution Points forMustafa Badreddine
541. Between 14:49 and 15:19, at the time of Mr. Ayyash's second call from Tripoli, Mr. Badreddine' s phones ( , SMP 944, PMP 663) co-located on his most used cells in Haret Hreik including ROUEIS3. During that time he received a call on his SMP 944 from a Samino associate, Mohammed Nayef Shukr.
542. Following contact with [Redacted] (PRH089), his phones (PMP 663, SMP 944) co located in the immediate vicinity of [Redacted] from 19:51 until shortly before midnight.
178 R305399
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 12 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met with Mufti Qabbani
543. Former Prime Minister Rafik Hariri received a number of visitors at Quraitem Palace throughout the day. 211 Between approximately 13:00 and 15:00, he attended Dar El Fatwa for a lunch hosted by the Mufti Qabbani. 212
B. Beginning of Escalation in and Purple Call Activity in Lead-Up to Abduction ofAhmad Abu Adass (The "False Claim Set-Up Phase'')
544. This is the first day of a very significant five day period (12-16 January) which led to the abduction of Ahmad Abu Adass.
545. There was a marked escalation in Green call activity between Mustafa Badreddine ( ) and Hassan Merhi ( ): 11 of the 18 calls they made, since the Green Network had tightened into a 100% closed user group, took place during this peno. d .213
546. There was also a sustained clear, integral link between the Green and Purple call activity of Mr. Merhi. This type of hierarchical call flow also occurred between Green and other Networks (Yellow, Blue and Red) on other occasions in the indictment period and sign-posted events of significance to the conspiracy.
54 7. There was also a change in behaviour in contact pattern between Mr. Merhi and Mr. Badreddine' s phones. Only three of their calls over the 100% closed-user period from 13 October 2004 were initiated by Mr. Badreddine, two of them took place on this day. Their first call, at 13:27, was very short (11 seconds) and the second at 20:20 lasted over a minute and a half and was immediately followed by a call from Mr.
211 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380849-D0380851. 212 Exhibit P303, Press Release 12.01.05 - Hariri attended the lunch held by Mufti Kabani in honour of PM Karami, ERN D0004958-D0004958. 213 See e.g. Exhibit P1118, PowerPoint Presentation- PRH435- Common Mission Phones, slides 157-158: "The Green 071 (Merhi) Phase".
179 R305400
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Merhi to his brother, Abbas Merhi, using his . Mr. Merhi' s and co-located on the same cell.
C. Blue Network Activity: Final Blue Phone was Set Up
548. This was the day that was first used; it was a service call. However, it was not used to contact any of the principal six Network phones until 18 January and had only one other Network call before then.
D. Blue Network Activity: [S8] in Tripoli near Vehicle Dealership (Contact with [S6])
549. There were eleven calls throughout the day: six of them were calls between [S6] and [S8]. In the morning, S8 was in Tripoli and made three calls to S6 on cells that provided predicted coverage to the vicinity of the Tripoli vehicle dealership that sold the Canter van nearly two weeks later (following Mr. Ayyash's travel there the day before). This was the first of four days prior to the purchase of the Canter van in which [S8] travelled there. The second and third occasions took place soon afterwards on 14 and 15 January.
E. Selected Attribution Points for Salim Ayyash
550. Mr. Ayyash was active on his , PMP 935 and in the Doueir/ Nabatiyeh area for the entire day.
F. Selected Attribution Points for Mustafa Badreddine
551. When Mr. Badreddine called Salim Ayyash at 18:25, co-located with his PMP 663 as he called [Redacted] (PRH273) on the way to meet [Redacted] (PRH089) at [Redacted].
180 R305401
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 13 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Meeting with Nasser Kandil
552. Former Prime Minister Rafik Hariri undertook a return trip to Egypt to meet Egyptian President Mubarak between 10:30 and 15:00. 214
553. Mr. Hariri had visitors to Quraitem Palace prior to and after the trip to Egypt. 215 Prior to his trip, MP Nasser Kandil was recorded visiting Mr. Hariri at Quraitem Palace between 09:30 and 09:55.
554. Following his meeting with Mr. Hariri, Mr. Kandil made two calls to Rustom Ghazaleh later in the morning.
B. Green & Purple Networks: Longest Ever Green Call between Hassan Merhi and Mustafa Badreddine with Three Days until Ahmad Abu Adass's Abduction
555. At 19:50, Hassan Merhi ( ) made a call of exceptional length to Mustafa Badreddine ( ) for 19 minutes and 36 seconds. This was the longest ever call between the two and the longest single call within the lifespan of the Green Network and occurred only three days before Ahmad Abu Adass was abducted.
556. [Merhi] was co-locating with his connecting to SFEIR3 in Dahyieh. [Badreddine] was connecting to a cell in the vicinity of his Sahel Alma apartment in the Jounieh area and co-located with his PMP 663 (calling Zeina [Redacted]) and SMP 944.
C. Purple Call Inactivity Preceding Green Call
557. Three minutes before that Green call, Mr. Merhi's Purple 231 had received a succession of service texts consistent with him having just turned on his phone. His
214 Exhibit P346, Logbook Record of Rafik Hariri Trips Abroad, ERN 60004129T -600004136 T. 215 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380851-D0380852.
181 R305402
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
phone had been inactive for the preceding five hours. In fact, there had been no activity on either Assad Sabra's or Hussein Oneissi's phone for nearly two hours. Mr. Sabra ( ) had last been sited nearby in Dahyieh, and Mr. Oneissi's previous siting was at the same cell as Mr. Merhi.
558. It was the next day, exceptionally, that Mr. Merhi, his brother, Abbas Merhi, and Purple Associate 375 travelled to the vicinity of Anjar/ Belcaa valley area.
D. Salim Ayyash: 's First day of Contact with Other Principal Six Blue Network Users, First Use ofPMP 091 and Last Use ofPMP 935
559. On this day, Mr. Ayyash changed his personal mobile phones. At 14:42, he used PMP 935 for the final time ever and, at 16:43, he used PMP 091 for the first time. PMP 091 used the same handset as PMP 935 had used.
560. Mr. Ayyash's phones remained in Dahyieh throughout the day. In the afternoon/ evening, his phones ( , PMP 170, PMP 091) were sited connecting to the same or adjacent cells in the Hadath area near his home where he exchanged six calls with [S6].
561. This was the first day that [Ayyash] had contact with the principal six Blue Network users and the first day that it made regular calls as a whole.
E. Selected Attribution Points for Mustafa Badreddine
562. Mr. Badreddine's phones (SMP 944, PMP 663) were co-located for much of the day in south Beirut. In the evening, he travelled to the vicinity of his apartment in the Jounieh area for around an hour and a half where four of his phones co-located ( , SMP 944, PMP 663, PMP 354). He had received a text from his female friend Zeina [Redacted] just two minutes before answering Mr. Merhi's Green call. Before leaving Beirut, SMP 944 and PMP 663 had been sited in the immediate vicinity of the Samino Mar Elias branch and PMP 663 had contacted [Redacted] (PRH416) who was also in the immediate vicinity.
182 R305403
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 14 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
563. Former Prime Minister Hariri spent the day at Quraitem Palace. 216
B. First Day ofRed Network Contact
564. This was the first day that the Red Phones contacted another phone (each other) and their first use since they were set-up by S6 and S9 on 4 January 2005 in Tripoli. The Red Phones appear to have been switched off since 4 January because their first call activity was the receipt of pent-up SMS texts.
565. This was a day of initial trial use without any real cohesion in the group's activity. The use and allocation of handsets to the Red Phones was not settled. On this day, all six principal Red SIM cards were used in different Red Phone handsets from their previous use on 4 January. The association of SIM cards to handsets had been largely, but not complete Iy, set by the time of their next use on 20 January (except 2 February when they were topped up together in Tripoli).
566. Regular and sustained use of the Red phones did not begin until 28 January 2005 (the "Red Primary Phase").
567. On this day, the Red phones were used in all of the principal locations, and only those, where they would be used in the coming weeks. There was no Red phone presence at all in the base area of the users in Dahyieh.
568. Red 893 and Red 946 were used around the Zouk Mosbeh slip road to Faqra, Red 652 in Tripoli and Red 636 in Faraya. Red 678, Red 741 and Red 572 (as well
216 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380852-D0380854; Exhibit P303, Press Release of 14.01.05, Hariri receives Ambassadors of Italy and Netherlands, ERN D0004913-D0004913; Exhibit P303, Press Release 14.01.05 Hariri receives Dubai Tournament cup from Al Riyadi Club, ERN D0004961-D0004961; Exhibit P303, Press Release of 14.01.05, Qadi visits Hariri and Fadlallah, ERN D0004964-D0004964.
183 R305404
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
as and ) were used in Beirut, mainly the areas around Quraitem and the coastal road near the future crime scene.
C. Blue Network Activity: [S8] Travelled to Tripoli (Contact [S6])
569. The pattern of use of Blue phones held by the principal six users (Salim Ayyash, S5, S6, S7, SS and S9) when their corresponding Red phones were being used was set on this day too. This is illustrated by the behaviour of S6 ( I ) who, when in west Beirut, switched from his Red phone to use his Blue phone to call another member of the principal six users located in Dahyieh.
570. [SS], who was in Tripoli (the second time in a three day period), exchanged four calls with [S6]. This was a pattern of location and contact that had started on 12 January and would continue until 15 January.
D. Final Blue Phone Joins Network: Blue Base Phone
571. , set up on 12 January, made its first call to another Blue phone and received two service texts. This was the fifteenth and final phone to join the Blue Network.
572. However, this was its only call to another Blue phone until 18 January when it began contact with the "Principal Six" phones at the beginning of the "Attack Set-up" or "Mission Set-Up" phase.
573. appears to have been a static or base phone: always connecting to Sfeir B (or very occasionally Sfeir A), in the centre or base area of Blue call activity, throughout the indictment period. However, on this day only, it was sited using another cell (Bir Abed A) for its call activity. This cell was located in the centre of an area, Haret Hreik, heavily associated with Green call activity, Mustafa Badreddine, and senior Hezbollah officials.
E. Two Days until Ahmad Abu Adass's Abduction: Hassan Merhi and Purple Associates Unusually Travelled to Anjar Area
574. Friday, 14 January 2005 was two days before Ahmad Abu Adass went missing.
184 R305405
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
575. Call activity between 11:45 and 12:00 indicates that Hassan Merhi ( ), his brother Abbas Merhi ([Redacted]744), and Purple Associate 375 were located in and around the Anjar/Chtaura area, consistent with co-movement.
576. This was unusual for : call records indicate travel to this area at only two other times: 25 June 2003 and 27-29 August 2004. In fact, aside from travel to southern Lebanon where they had family, this was the only occasion that either of Mr. Merhi' s or his brother's phones were sited outside of the environs of Beirut during the indictment period.
577. Between 10:18 and 13:47, [Sabra] was inactive and thereafter connected to a cell in Dahyieh. [Oneissi] was inactive until 14:06 at which time he received a succession of service SMS consistent with his phone having been switched off.
578. Atl8:17, [Oneissi] received another service SMS and connected to a cell in the Aramoun area (CHMOUNl). This was the first time he connected there since the seven day period ending on 7 January when he had connected to cells in that area on a near daily basis. It was also the last ever time that connected to a cell in the Aramoun area.
F. Two Days until Ahmad Abu Adass 's Abduction: Green-Purple Hierarchical Call Flow
579. At 19:55, [Merhi] called [Badreddine]. Immediately after this call, Mr. Merhi ( ) called first his brother Abbas Merhi ([Redacted]744) and then Mr. Sabra ( ) who, in turn, immediately called Mr. Oneissi ( ) (and again two minutes after that).
580. A similar sequence of Green-Purple call activity involving Mr. Badreddine, Mr. Merhi and Abbas Merhi took place the following day on the evening before Ahmad Abu Adass' disappearance.
185 R305406
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 15 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
581. Former Prime Minister Rafik Hariri spent the day at Quraitem Palace. 217
B. Day before Abduction of Ahmad Abu Adass: Hierarchical Green & Purple Call Flow
582. This is the day prior to the disappearance of Ahmad Abu Adass.
1. Green - Purple Hierarchical Call Flow Prior to and After "Mohammed's" call to Mr. Abu Adass
583. There were two inter-Purple calls over the course of the day: both of them from Hassan Merhi to Assad Sabra.
584. The first was at 14:32 when Mr. Merhi ( ) connected with SFEIR3 and Mr. Sabra ( ) was sited in west Beirut, in the same area as Hussein Oneissi' s phone ( ). Mr. Merhi's call to Mr. Sabra immediately followed a call to his brother, Abbas Merhi ([Redacted]744): a repeat of the pattern the previous day (which on that occasion had immediately followed a call with Mustafa Badreddine).
585. The second call from Mr. Mehri to Mr. Sabra, at 18:52, immediately followed his contact on with Mr. Badreddine ( ). This had also occurred on the preceding day and is indicative of significant developments in the purpose of those engaged in Purple activity: the "False Claim of Responsibility".
586. The Green call was only 30 seconds and, unusually, Mr. Merhi was moving from an area north-east of Beirut southwards and close to the location of Mr. Badreddine's phone (PMP 663) in the vicinity of his Samino branch at Fum el Chebbak.
217 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380854-D0380855.
186 R305407
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
58 7. [Redacted].
588. Following the 21:00 call from "Mohammed" to Mr. Abu Adass, Mr. Merhi ( ) made a further call to Mr. Badreddine ( ) at 23 :40 lasting almost three minutes.
2. Last Calls before Simultaneous Purple Phone Inactivity on Day of Mr. Abu Adass's Abduction
589. Mr. Merhi's 18:52 call to Mr. Sabra is also significant because it was his last Purple call activity until the 17 January. Call records suggest that he had turned his telephone off in the interim. This coincided with similar periods of complete call inactivity throughout 16 January by:
• Mr. Sabra (last call 00:03 on 16 January until17 January); • Mr. Oneissi (last call at 20:26 on 15 January until17 January); • Abbas Merhi, Mr. Merhi's brother, ("Associate Purple 744") (last call at 20:01 on 15 January until18 January); and • "Associate Purple 375" (last call 21:17 15 January until18 January).
590. All five phones had been active on every other day from 1 September 2004 with the exception of [Sabra] which was inactive on two other days (5 September and 10 December), [Merhi] which was inactive on one other day (6 January), and Associate Purple 375 which was inactive on one other day (25 October).
C. Green & Blue Call Activity: [S8] in Tripoli near Vehicle Dealership (Contact [S6])
591. Blue 817 [S8] was in Tripoli for most of the day (11:41- 22:13). He exchanged seven calls with Blue 610 [S6] some of which connected to cells providing immediate predicted coverage to the vehicle dealership from which the Mitsubishi canter van was purchased on 25 January where Blue 610 [S6] was also active on that day. After their penultimate call while Blue 817 [S8] was still in Tripoli, Blue 610 [S6] immediately called Blue 233 [Ayyash].
187 R305408
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
592. A similar pattern of [S8] calling [S6] from Tripoli had occurred on 12 January and S8 visited Tripoli once more on 22 January before the Canter van was purchased.
593. At 20:03, Mr. Ayyash contacted [S6]. Twenty minutes after this contact with S6, Mr. Ayyash ( ) contacted Mr. Badreddine ( ).
594. At 21:32, [S8], who was still in Tripoli, contacted [S6] who immediately contacted Mr. Ayyash.
D. Selected Attribution Points for Salim Ayyash: Wife & Child fly to Saudi Arabia (Hajj)
595. From 19:12 to 20:03, Mr. Ayyash's phones (PMP 170, PMP 091, and ) co- located in the immediate vicinity of Beirut Airport. Flight records indicate that Mr. Ayyash's wife and daughter checked-in for a flight to Saudi Arabia between 19:10 and 19:37. They returned on 28 January 2005.
596. In the evening, Mr. Ayyash's phones (PMP 170 and ) connected to their most connected to cell (Sfeir A) which provided predicted coverage to the vicinity of his home in Hadath.
E. Selected Attribution Points forMustafa Badreddine
597. [Redacted].
598. By 17:12, three of Mr. Badreddine's phones (SMP 944, PMP 663, and PMP 354) were sited around the Samino Mar Elias branch. Between 18:16 and 19:03, SMP 944, PMP 663, and co-located in the immediate vicinity of the Samino Fum El Chebbak branch when Mr. Badreddine had his first Green call with Mr. Merhi. [Redacted] phone was also co-sited in the area over this period.
599. Following further calls with [Redacted], Mr. Badreddine travelled to the same area. On the coastal road there from Beirut, PMP 663 called [Redacted] (PRH264). Shortly after, PMP 663 co-located with Green 023 at the time of his call with Mr. Ayyash.
600. From 21:09 until 06:19, PMP 663 and Green 023 remained co-located on the same or overlapping cells in [Redacted] while Mr. Badreddine stayed [Redacted] with
188 R305409
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
[Redacted] (whose phone co-located throughout). While he was there, PMP 663 was in contact with his female friend, Zeina [Redacted]. His last call in that area was the first of his five Green calls that morning with Mr. Merhi at 06:19.
189 R305410
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 16 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Ahmad Abu Adass Abducted
601. Mr. Abu Adass left his home at around 07:00. 218 [Redacted] He did not return and was never seen again except in the false claim of responsibility video. 219
B. Purple Activity: Unusual Silence on All Purple Phones All Day
602. With the exception of Assad Sabra's call at 00:03, none of the Purple phones ( ) used by Hassan Merhi, Assad Sabra and Hussein Oneissi made any calls at all on 16 January. Mr. Merhi's brother, Abbas Merhi (Purple Associate 744), and Purple Associate 375 were also inactive for the entire day. The "pent-up" SMS texts received by most of their phones the following day suggest that they had all turned off their phones.
603. All five phones had been active on every other day from 1 September 2004 with the exception of [Sabra] which was inactive on two other days (5 September and 10 December), [Merhi] which was inactive on one other day (6 January), and Purple Associate 375 which was inactive on one other day (25 October).
C. Heavy Green 071 [Merhi] Activity around Time of Ahmad Abu Adass's Disappearance
604. There were five calls between Mr. Merhi ( ) and Mustafa Badreddine (Green 023), all ofthem occurred between 06:19 and 09:00.
218 Exhibit P461, Investigation report about the missing Ahmad Abu Addas, ERN 50008343-50008345; Exhibit P1775, Witness Statement ofpRH103, ERN 205564-205600A at 205571. 219 Exhibit P461, Interview record of Taysir Abu Adass, ERN 50003487-50003491.
190 R305411
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
605. The volume and intensity of calling between them was unique: almost a third of the 18 calls made between the two phones since the Green Network had become a fully closed user group (13 October 2004) took place in a little over two hours.
606. Their calls straddled the period of Ahmad Abu Adass' departure to meet with "Mohammed" at 07:00 and his subsequent abduction.
607. On the first call, Mr. Merhi' s connected to a cell (BRAJNE2) that provided predicted coverage to the vicinity of his home address in Dahyieh. The other four calls were sited in Dahyieh using other cells nearby.
608. On the first call, Mr. Badreddine's connected to a cell that provided predicted coverage to the vicinity of [Redacted] (PRH089) [Redacted]. His PMP 663 as well as his had been located throughout the early hours of the morning and the previous evening connecting to the same cell or the overlapping cell on the other (MTC Touch) network.
609. The subsequent four Green calls indicate that Mr. Badreddine soon moved back to his base area in Haret Hreik (ROUEIS3). He made a number of calls on both his PMP 663 and SMP 944 as he did so which portrayed a single pattern of movement consistent with common use of all three phones.
610. After this day, there were only three further calls between Mr. Badreddine and Mr. Merhi: on 20 January (2 calls) and 7 February (1 call). The call patterns in themselves tend to indicate that by far the most important part of their purpose of contacting each other had occurred on this day and had almost, but not entirely, been fulfilled.
611. While the phones of Mr. Merhi, Mr. Sabra, and Hussein Oneissi were all inactive from 09:00 for the entire day, Mr. Badreddine was also unusually inactive on any of his four attributed phones from the same time until 17:38. There was no call activity at all on Green 023, SMP 944 and PMP 354, while PMP 663 only received seven SMS texts all on the same cell in their usual area of Haret Hreik.
191 R305412
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. Rafik Hariri at Quraitem Palace
612. Former Prime Minister Rafik Hariri was at Quraitem Palace throughout most of the d ay. 220
E. Hassan Nasrallah Denounced UNSC Resolution 1559 and the Opposition
613. Hassan Nasrallah gave a speech in which he stated that UNSC Resolution 1559 was "a reflection of Israeli demands" and described some members of the opposition as "fanatics". 221
F. Blue Network Activity: Light Activity in Dahyieh
614. There were only 11 calls between Blue phones, seven of them between the principal six users who were also the principal Red phone users. Mr. Ayyash made only two of those calls. All of the phones were sited in and around Dahyieh except [S6] and [S 14] which were located in different parts of southern Lebanon during the afternoon and evening.
615. Despite having been set up on 12 January 2005, the static [S14] base phone remained an inactive member of the Blue Network in apparent suspension.
616. It was not until two days later (18 January) that it would begin to fully interact with the Blue Network and engage with the "Principal Six" phones heralding the commencement of an integrated, fully formed Blue Network and the start of the Mission or Attack Set-Up Phase.
G. Other Network Activity: No Red Network Calls and No Green Calls Involving Salim Ayyash
617. There was no Red call activity and no Green activity between Mr. Ayyash and Mr. Badreddine.
220 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380855- D0380856. 221 Exhibit P532, UNIC Beirut Press Review 17 January 2005, ERN D0410104-D0410111, at D0410107.
192 R305413
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 17 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Abduction of Ahmad Abu Adass & Continued Purple Inactivity: Ahmad Abu Adass Did Not Return as Expected and Purple Phones Activity Coincident with Calls to Ahmad Abu Adass's Family
1. Mr. Abu Adass's Family Received Two Calls Regarding his Whereabouts
618. [Redacted] The first call at around 07:30 indicated that their car had broken down and that Ahmad Abu Adass was in Tripoli and would return in the aftemoon.222 The second call, at around 21:00, stated that he was going to Iraq and would not retum. 223
2. Mr. Oneissi and Mr. Sabra's Phones Become Active Again around the Time ofthe First Call to Mr. Abu Adass' s Residence
619. [Oneissi], [Merhi], and [Sabra] all of which had been inactive on the previous day of Mr. Abu Adass's disappearance, became active a gam.
620. Hussein Oneissi ( ) received a quick succession of seven service SMS texts from 07:01 to 08:14 consistent with the phone having just been switched on (thereby triggering "pent-up" texts that had been waiting to be sent from the SMS centre). Those texts placed him in Sfeir, Dahyieh, and coincided with the time frame in which the first call from "Mohammed" was made.
621. Assad Sabra ( ) received three calls (08:18- 10:26) siting him in the same area. The first of those was a call of nearly 3 minutes from a phone attributable to his father, Hassan Sabra.
222 See Exhibit P461, Interview record ofTaysir Abu Adass, ERN 50003487-50003491, at 50003488; Exhibit P1775, Witness Statement of PRH1 03, ERN 205564-205600A, at 205571. 223 Exhibit P461, Interview record of Taysir Abu Adass, ERN 50003487-50003491 at 50003489.
193 R305414
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
3. Evening Purple Phone Activity Coincides with Second Call to Mr. Abu Adass's Residence
622. There was no other Purple call activity at all until 20:44, shortly before the second of the calls from "Mohammed" when both [Merhi] and [Oneissi] received a series of service SMS. The multiple and successive receipt of service texts at this time, indicate that both Hassan Merhi and Mr. Oneissi appear to have turned their phones on at this point (20:44-20:48).
623. Mr. Merhi connected with the same SFEIR3 cell that Mr. Oneissi and Mr. Sabra had connected to that morning. Mr. Oneissi was connecting to the adjacent cell.
624. A few minutes later, from 20:55 to 21:01, Mr. Oneissi's was connecting to COLA2, the cell in the immediate vicinity of the Arab University Mosque and Mr. Abu Adass' s residence.
625. At 21:02, shortly after the time that "Mohammed" made the final payphone call to the home of Ahmad Abu Adass, Mr. Oneissi sent an SMS text to Mr. Merhi' s connecting to the same COLA2 cell. Mr. Merhi immediately (21:04-21:05) made two voice calls back to Mr. Oneissi as the latter began to return to Dahyieh. By 21 :27, Mr. Oneissi was connecting to the Sfeir cells in the vicinity of his home.
626. Over this same period from 21:06 to 21:37, as Mr. Oneissi moved south back to the vicinity of his home, his was also in contact with phones attributable to his mother, Fatima Darwish, his wife's family, and his brother.
627. This was the last occasion that a Purple phone connected to any of the COLA cells.
B. Second Consecutive Day ofExtended Call Inactivity by Mustafa Badreddine
628. For the second consecutive day, all Mr. Badreddine's phones were inactive for much of the day until 19:17. SMP 944, PMP 354 and Green 023 all had no call activity whatsoever while PMP 663 only received SMS consistent with having left his phone in Haret Hreik (for all SMS, his phone connected to Hai_Kneisse_C, one of PMP 663's most frequently used cells).
194 R305415
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
629. This largely coincided with extended Purple inactivity. Between 10:26 and 20:44, there was no call activity amongst the Purple phones and Purple Associate 744 (Abbas Merhi); Purple Associate 375 was inactive all day.
C. Rafik Hariri at Quraitem Palace
630. Former Prime Minister Rafik Hariri remained at Quraitem Palace throughout the d ay. 224
D. Rustom Ghazaleh visited Haret Hreik and Contact between Wafik Safa and Mustafa Badreddine
631. Wafik Safa made two calls to Mustafa Badreddine (SMP 944) in the evening.
632. His first call, their first in seven days, took place around 20 minutes after Mr. Badreddine's phones became active again.
633. Shortly afterwards, Mr. Safa made a short call (10 seconds) to Mr. Ghazaleh who thereafter made his way from Chtaura to Beirut. On arrival in Beirut at 20:30, both Mr. Ghazaleh and Mr. Safa connected to cells in the vicinity of the Hezbollah General Secretariat; both their phones were inactive for just over half an hour.
634. An hour and a half later, at 23:02, after he had departed, Mr. Ghazaleh called Mr. Safa a gam.
E. Green Network Activity: Contact/Meeting between Salim Ayyash and Mustafa Badreddine
635. At 22.08, Salim Ayyash ( ) made his only Green call of the day, a very short one, to Mr. Badreddine ( ). They connected to the same cell consistent with them meeting. There was around 30 minutes of call inactivity on their multiple phones.
636. Both men resumed call activity at the same time (22.39):
224 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D038086-D0380857; Exhibit P303, Press Release of 17.01.05 - Hariri to meet with the "Economic Forum" and the Industrialists Association, ERN D0004939-D0004940.
195 R305416
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
• Mr. Badreddine was called by Wafik Safa for the second time (their second of four calls over this and the following day);
• Mr. Ayyash called who was engaging and co-locating with and in South Lebanon (see below).
F. Blue Network Activity in Dahyieh and South Lebanon
637. There are 36 calls throughout the day involving 12 of the Blue phones, many of them in Dahyieh starting in the early hours. [S 14] was the most active.
638. [S14] moved down to the area south of Saida twice: once in the afternoon, where it appears to have met up with [S6]; and once more in the last hour of the day (via the Harouf area of Nabatiyeh). It had six calls with Mr. Ayyash's : shortly before its first journey, and then from Nabatiyeh and Saida during the second journey.
639. At 23:04, following his contact with Mr. Ayyash (shortly after his contact with Mr. Badreddine ), [S 14] made a ten second call to [S19]. They co- located as the call was made in the Msaile area and appear to have met. [S14] also exchanged a further two calls with Mr. Ayyash from the same cell and with shortly thereafter. , like shortly before, co-located with on the same cell in the Msaile area.
G. Selected Attribution Points for Mr. Ayyash
640. Mr. Ayyash's phones (PMP 170, PMP 091 and ) were co-located on the same and neighbouring cells in Dahyieh throughout the day. Late in the afternoon, PMP 091 and briefly used the same cell site in central Beirut when PMP 091 received a call from Mr. Badreddine's brother, Mohammed Amine Badreddine.
196 R305417
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 18 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Announced Rejection ofElectoral Law Project and Met with Hussein Khalil
641. Former Prime Minister Rafik Hariri spent the day receiving visitors at Quraitem Palace, including meeting with Hassan Nasrallah's political Secretary Hussein Khalil for around half an hour at 21 :00. 225
642. An hour after his visit with Mr. Hariri ended, Mr. Khalil had a 15 minute call with W afik Safa in south Beirut.
643. Later in the evening, Mr. Hariri attended a dinner at the Riviera Hotel where he announced his rejection of the Electoral Law Project for Beirut stating that he would do so formally upon issuance of the legislation: "this time every vote determines the fate ofthe country, its future, independence and sovereignty."226
B. Beginning of "The Mission Set-Up Phase": Integrated Blue Network Activity Hierarchical Green & Blue Call Flow Linked to Exceptional Blue Call Activity
644. This was the first day of a narrow eight day period (18-26 January) when the nine phones that had been added to the "Principal Six" network users to form the full Blue network were most active. 227 From the 27 January until the time of the attack, when regular use of the Red Network phones also began, their call volumes dropped back s1gm. "fi 1cant 1y. 228
5. This was also the day in which the Blue Network as a whole could be said to have fully formed as the two sub-groups in the Blue network ("Principal Six" and "Balance
225 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380857-D0380859. 226 Exhibit P303, Press Releases from Quraitem Palace Press Office, 18 January 2005, ERN D0004941- D0004942 T EN. 227 Exhibit P1l18, PowerPoint Presentation - PRH435 -Common Mission Phones, slides 35, 36, 43, 112. 228 Exhibit P1118, PowerPoint Presentation- PRH435- Common Mission Phones, slides 36, 42, 43.
197 R305418
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
of Nine" phones) began to integrate as one group. It was the first day that as many as 13 Blue Network phones were used.
6. This was the first day the static Blue Base phone ( ), which also engaged in its busiest call activity over this eight day phase, began to have contact with the "Principal Six" network users: primarily Salim Ayyash ( ) and S9 ( ). Most of the calls between and Mr. Ayyash/ S9 took place in this eight day phase.
7. This all coincided with the beginning of a period of unusually high Green Network call volumes (18-20 January 2005),229 a close sequential association between Green and Blue call activity ("hierarchical call flow"), and exceptional Blue Network call patterns linked to that hierarchical call flow. 230 All of these features were confined to this same eight day phase in which the Mitsubishi Canter Van used to form the LBVIED was procured.
C. Green Network Activity: Second Consecutive Mustafa Badreddine & Salim Ayyash Meeting and Sequential Green-Blue call to Blue Base Phone
9. There were four calls between [Badreddine] and [Ayyash], all in the afternoon. For the three final Green calls, Mr. Ayyash was in the area of Parliament/the coast road. After receiving the third call at 16:49 from [Badreddine] on his , Mr. Ayyash's ( next call was to the base phone [S13]. had earlier engaged in unusual contact (and its first contact with a member of the "Principal Six") with S9 ( ) who was in the Baalbek/ Bekaa valley area.
10. Ten minutes later, at 17:07, [Badreddine] moved north from south Beirut to share the same cell as Green 300 [A yyash] in the vicinity of the Parliament/ coast road area (PORT2). The absence of calls on any of their phones for 45 minutes thereafter, and a series of 20 successive "service" SMS texts over an hour later suggests that Mr. Badreddine' s PMP 663 had been turned off over that period, and is
229 Exhibit P1118, PowerPoint Presentation- PRH435- Common Mission Phones, slide 34. 230 Exhibit P1118, PowerPoint Presentation- PRH435- Common Mission Phones, slides 119-121.
198 R305419
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
indicative of a meeting. Towards the end of the meeting (17:55), Mr. Ayyash (PMP 170) was cell sited in the vicinity of the tunnel leading to St George's Marina.
11. Their personal phones remained co-located for a further 30 minutes in the Coast Road area near Parliament until Mr. Badreddine phoned [Redacted] (PRH416), who was cell sited nearby. Thereafter, Mr. Badreddine's personal phones connected to cells consistent with movement up to the vicinity of his Sahel Alma/ Jounieh residence.
D. Blue Network Activity: Unusual Travel of [S9] to Baalbek/ Bekaa valley
12. [S9] travelled to the Baalbek area in the morning where it remained for at least 3-4 hours. While there, it received a call from the base phone [S13] for four minutes: the first contact between the Base phone and one of the "Principal Six" Network users. The length and direction of the call was unusual. This was the only time during the indictment period that one of the closed user Blue, Green or Red Network phones went to the Baalbek area.
13. [S9] returned to Dahyieh (ROUEIS3) by 16:20. [Badreddine] before moving up to central Beirut by 17:07 where it co-located with [Ayyash], consistent with them meeting.
14. , who was involved in nearly half of the 54 Blue calls on this day, had three (of 19 over the indictment period) calls with the base in the 90 minutes following his apparent meeting with Mr. Badreddine in the late afternoon.
E. First Call Activity between Salim Ayyash and Subject 816
15. At 22:10, PMP 170 [Ayyash] called Subject 816 (3151816). This was the first ever contact between the two phones.
16. There were a further 25 calls between PMP 170 [Ayyash] and Subject 816 on select days: 23-27 January, 10 February, the final hours before the attack (13-14 February) and the day after the attack before their contact immediately dropped off (until 14 May 2005).
199 R305420
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
17. The distinct timing, location and circumstances of their calls, particularly those on 13- 14 February, point to a central connection between Subject 816, salient [Ayyash]/ [S9] activity on the East of Airport cells, and the conspiracy itself.
18. This night was the eve of S9's ( ) first activity at the East of Airport cells. All ofS9's ( ) last four calls of the night were with Salim Ayyash ( ). The last one took place 50 minutes before Mr. Ayyash's first contact with Subject 816.
F. Hierarchical Green-Blue Call Flow Activity, Exceptional Travel of [S19] to Anjar & Unusual Green Call Activity
19. Shortly before midnight, [S 19] made its way from south Beirut to the vicinity of Anjar, near the Syrian border and the SMI Headquarters. This was the only time during the indictment period that a closed-user Network phone went to or near this area. 231
20. [S 19] was sited in the general Anjar area for little more than half an hour where it engaged in a series of three calls (00:09 - 00:26 on 19 January) with . The brevity of the visit and the late night hour suggests a very specific purpose. By 01:12, [S19] had returned to Dahyieh.
21. Aside from the time of day and the area it had travelled to, it was a particularly unusual event because, over the entire indictment period, this was its only call activity with the leader of the Blue group, [Ayyash] and, more or less, its only calls with a Blue phone other than [S 18]. It was also the only time, bar four calls in southern Lebanon, it was sited outside of Dahyieh.
22. The nature of the call patterns immediately prior to the journey to Anjar, between Mr. Ayyash (Blue 233), Blue 428 [S18], and Blue 742 [S19], and the contact in the Anjar area, suggests Mr. Ayyash had a direct and specific concern in the reason for travel.
23. Mr. Ayyash's next call at 00:59, around the time of Blue 742 [S19]'s return to Dahyieh, was an unusually long one (two minutes and 20 seconds), and the second
231 See Exhibit P 1118, PowerPoint Presentation - PRH435 -Common Mission Phones, slide 115.
200 R305421
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
longest call he ( ever made, to Mustafa Badreddine Furthermore, it was followed immediately after by their fourth longest Green call.
24. Green contact in the early hours was very unusual and so were the length of the calls.
G. No Inter-Purple Phone Activity but Purple Associates 744 and 375 Became Active Again
25. [Oneissi] and [Merhi] were active, but not in contact with each other. The next contact between the Purple Phones occurred on 21 January 2005.
26. Mr. Merhi's brother, Abass Merhi (Purple Associate 744) and Purple Associate 375 became active again for the first time since the evening of 15 January when their phones went silent during approximately the same period as the Accused users of the Purple phones, coinciding with when Mr. Abu Adass disappeared.
H. Selected Attribution Points for Salim Ayyash
27. Mr. Ayyash spent much of the day in Dahyieh, travelling to central Beirut to meet with Mr. Badreddine. There was co-location in both areas between PMP 091, PMP 170, and . Between 10:40 and 11:30, he travelled to the Sidon area where his and his PMP 170 were co-located.
L Selected Attribution Points forMustafa Badreddine
28. Mr. Badreddine spent the day in Dahyieh before meeting Mr. Ayyash in central Beirut and going to his residence in the Jounieh area. There was distinctive co-location and co-movement between locations by PMP 663, PMP 354, SMP 944 and There was further co-location in the early hours of the next day in the Jounieh area (where [Redacted] phone was also co-located).
201 R305422
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 19 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace and Discussed Election Law
645. A delegation visited former Prime Minister Rafik Hariri to discuss the Election Law in the evening at Quraitem Palace. 232 He had a scheduled dinner in west Beirut from 20:30 to 21 :30 before returning to Quraitem Palace. 233
B. Network Phone Activity: Second Day of Sequential Green & Blue Calls and Beginning of Network Activity at "East ofAirport Cells"
646. This was the second successive day, out of a total of three, in which there was a close, sequential connection between Green and Blue call activity signaling a significant period in preparatory activity. 234 It was also one of the busiest ever Green phone days.
647. This was the first day of a period (19-27 January 2005) of exceptional call patterns on three principal days in a concentrated area east of Beirut Airport (KARAME3, AIB2 and AIB3 cells only) often at unusual hours involving [S9] who was mainly calling [Ayyash ]. 235
648. It commenced (at 05:22) within hours of the return of [S 19] to south Beirut from the Anjar area, and the associated sequential calls in the early hours between [Ayyash] and [Badreddine] .
649. In turn, this activity at the "East of Airport cells" was closely associated with the call patterns between PMP 170 [Ayyash] and Subject 816.
232 Exhibit P303, Releases from Quraitem Palace Press Office, 19 January 2005, ERN D0004916- D0004916 T EN. 233 Exhibit P299, Rafik Hariri's 2005 Agenda Book, ERN 60142062-60142516, at 60142149, (p.13). 234 See Exhibit P1118, PowerPoint Presentation- PRH435- Common Mission Phones, slides 119-120. 235 See Exhibit P 1118, PowerPoint Presentation - PRH435 -Common Mission Phones, slides 117-118.
202 R305423
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
C. Hierarchical Green-Blue Call Flow Activity: Exceptional Travel of [S19] toAnjar
650. Shortly before midnight on 18 January, [S19] made its way from south Beirut to the vicinity of Anjar, near the Syrian border and the SMI Headquarters. This was the only time during the indictment period that a closed-user Network phone went to or near this area.
651. [S 19] was sited in the general Anjar area for little more than half an hour where it engaged in a series of three calls (00:09 - 00:26 on 19 January) with . The brevity of the visit and the late night hour suggests a very specific purpose. By 01:12, [S 19] had returned to Dahyieh.
652. Aside from the time of day and the area it had travelled to, it was a particularly unusual event because, over the entire indictment period, this was its only call activity with the leader of the Blue group, [Ayyash] and, more or less, its only calls with a Blue phone other than [S 18]. It was also the only time, bar four calls in southern Lebanon, it was sited outside of Dahyieh.
653. The nature of the call patterns immediately prior to the journey to Anjar, between [Ayyash], [S18] and [S19], and the contact in the Anjar area, suggests Mr. Ayyash had a direct and specific concern in the reason for travel.
654. Mr. Ayyash's next call at 00:59, around the time of 's return to Dahyieh, was an unusually long one (two minutes and 20 seconds) and the second longest call he ( ) ever made to Mustafa Badreddine ( ). It was followed immediately after by their fourth longest Green call.
655. Green contact in the early hours was also unusual and so were the length of the calls.
D. Blue Network Activity: First Day of Blue 864 [S9]'s Extended Activity at "East of Airport" Cells and Subject 816
656. Blue 864 [S9] made 13 successive calls over 16 hours from 05:22, all of them from one of three adjoining cells (KARAME3, AIB2, AIB3) east of Beirut Airport: nine of which were with Blue 233 [Ayyash] and four were with Blue 610 [S6].
203 R305424
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
657. It was one of three principal days in January 2005 (19, 24, and 26 January 2005), straddling the procurement of the Mitsubishi Canter van on 25 January, when [S9] had extended and concentrated activity on these three cells. Almost half of these calls were with [Ayyash], many of which were in the early hours.
658. On those same three days, Subject 816 was in Dahyieh (away from its most used cells in the Bekaa valley) and was inactive over the same extended periods as [S9] was connecting to the East of Airport cells. On this day, the first of the three days, Subject 816 was silent from 00:17 on 19 January to 00:39 on 20 January (24 hours) after which he received a series of "pent-up" SMS texts indicating that his phone had been switched off.
659. At 18:52, unusually, Mr. Ayyash's was in the vicinity. He called the base [Sl3] from an adjacent cell to the three East of Airport cells.
660. Mr. Ayyash ( ) was involved in over 60% of the 44 Blue calls on this day. His six calls to the base [Sl3] together with the five calls the previous day amounted to over 60% of all of their calls.
E. Hierarchical Green-Blue Sequential Call Flow: S9 & the East of Airport Activity and Heavy Green Network Activity
661. There were five calls between [Badreddine] and [Ayyash], and a further three just after midnight into the 20 January 2005. This was one of the heaviest days of Green call activity.
662. Seven of the eight Green calls over the day and early hours of 20 January were sequentially or closely linked to Blue call activity.
663. At 15:25, there were two short calls in close succession from Green 023 [Badreddine] to Green 300 [Ayyash]. These were followed closely by three calls involving Blue 233 [Ayyash]: a short call to the base phone Blue 501 [S13] followed by two much longer calls with Blue 864 [S9] who connected to the "East of Airport" cells. Blue 864 [S9] had been exchanging calls with Blue 233 [Ayyash] from that area since 05:22.
204 R305425
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
664. Shortly after midnight, [Badreddine] made three calls to [Ayyash]. This was the second consecutive day of early hours Green calls between them which, in itself, was very unusual. The first of those Green calls at 00:39- 00:41 on 20 January, took place only two minutes after [S9]'s tenth and final call of the day to [Ayyash].
F. No Inter-Purple Phone Activity
665. [Oneissi], [Sabra] and [Merhi] were active in Dahyieh but there was no inter-Purple contact. This was three days after the abduction of Mr. Abu Adass. The next contact between Purple phones occurred 21 January 2005.
666. While they were not in contact with each other, the Purple phones were in contact with family or regular associates of the Accused including: Mr. Merhi was in contact with his brother, Abbas Habib Merhi; Mr. Sabra was in contact with his brother, Nimr Sabra, and his father's landline; and Mr. Oneissi was in contact with his mother, Fatima Darwish.
G. Ahmad Abu Adass Reported Missing
667. Ahmad Abu Adass was reported missing to the police by his father, Tayssir Abou Adass (PRH636). 236
H. Selected Attribution Points for Salim Ayyash
668. Mr. Ayyash's phones (PMP 170, PMP 091, and ) co-located with each other in Dahyieh throughout the day from the early hours of 19 January into the early hours of20 January.
L Selected Attribution Points for Mustafa Badreddine
669. From late afternoon (16:23), SMP 944 and PMP 663 were cell sited with [Redacted] phone for 2 Y2 hours in the immediate vicinity of the Samino store in Fum el Chebbak before all of the phones moved to the Fadlallah area.
236 Exhibit P461, Investigation report about the missing Ahmad Abu Addas, ERN 50008343-50008345.
205 R305426
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
670. In the evening, following PMP 663 contact with [Redacted], Mr. Badreddine phones (PMP 663, SMP 944 and ) co-located in the Fadlallah/ Raouche area [Redacted]. During this period, Mr. Badreddine made a 29 second call to Mr. Ayyash using his Green phone and also used PMP 663 to call his close friend, Zeina [Redacted] and [Redacted].
206 R305427
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 20 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Attended Prayers at Al Imam Ali bin Abi Taleb Mosque Instead of the Al-Omari Mosque
671. This was first day of the Eid Al-Adha celebrations. Although former Prime Minister Rafik Hariri was scheduled to attend the Al-Omari Mosque for early mormng prayers, 237 he attended the Al Imam Ali bin Abi Taleb Mosque instead. 238
672. Mr. Hariri received large numbers of well-wishers at Quraitem Palace. 239 Wissam Al Hassan commented to Hani Hammoud "We're going to get beaten because of this" with reference to the "Damascus Protocol" from Mr. Hariri's meeting with Syrian President Bashar Al Assad in December 2003 during which he had prohibited Mr. Hariri from having public gatherings around Quraitem Palace and from attending Friday prayers in public places. 240 Mr. Hariri later visited Mufti Qabbani at Dar Al Fatwa.241
B. Red Network Activity: Intense Morning Activity Near Al-Omari Mosque/Parliament
673. This was a day of more focused Red operation than the first day of Red call activity (14 January), but Red call activity did not settle into a regular and sustained pattern of use until their next use on 28 January 2005.
674. A period of intense calling in the vicinity of the Parliament/ Al-Omari Mosque was aborted after only 45 minutes shortly after 08:00. Unusually, one of the "reserve"
237 Exhibit P299, Rafik Hariri's 2005 Agenda Book, ERN 60142137-60142180_0_EN, at 60142150. 238 Exhibit P303, Press Release of 21.01.05, Thousands wish Hariri a Happy Eid, ERN D0004934-D0004934 (date of Press Release incorrectly states 21 January); Testimony of Ghaleb El-Chamma, Transcript of 11 February 2015, pp. 10-15; Exhibit P091, Photographs [Eid 2005] from Hard Drive 60180748, ER D0003899- D0003940, at D0003920, D0003923, D0003927. 239 Testimony of Ghattas Khoury, Transcript of 16 January 2015, pp. 71-74; Testimony of Hani Hammoud, Transcript of20 May 2015, pp. 34, 35. 240 Testimony ofHani Hammoud, Transcript of20 May 2015, pp. 32-35. 241 Exhibit P303, Press Release of 21.01.05, Thousands wish Hariri a Happy Eid, ERN D0004934-D0004934 (date of Press Release incorrectly states 21 January).
207 R305428
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
phones , outside of the principal six Red Network users, was used and twice dialed the wrong last digit for [Ayyash].
C. Green Network Activity: Penultimate Green Contact for Hassan Merhi
675. Aside from the calls between [Ayyash] and [Badreddine] shortly after midnight (covered in the previous day's narrative), there was only one other call between them - a 41 second call made by from south of Saida, south Lebanon at 10:31.
676. Two short calls between [Merhi] and [Badreddine] in Dahyieh shortly after 06:00 was the last telephone contact between them until their final call on 7 February 2005, indicating that the role of Mr. Merhi [ ] was now largely though not wholly complete. There was no inter-Purple phone activity on this day.
D. Blue Network Activity: [S9] at "East ofAirport" Cells
677. This was one of the quietest blue days: only 14 calls were made. [S9] was located at the East of Airport cells for a call to [S6] at 17:41, its first call of the day. It made two calls to the base [S 13] in the very late evening from deep in south Lebanon, east of Tyre.
678. [Ayyash] made only three calls- two were in the afternoon/ evening made from Nabatiyeh, south Lebanon.
E. Selected Attribution Points for Salim Ayyash
679. After the short-lived flurry of Red activity around Al-Omari Mosque, by 11:02, PMP 091 [Ayyash] was connecting to cell Nabatiyeh_C. He connected to the same cell for a series of calls, including nine SMS texts with his brother Ali Ayyash in the late afternoon. Blue 233 also connected to the same cell (Nabatiyeh_C) during the afternoon and evening. At 23:52, Green 300 also connected to an Alfa cell (NABATII) to receive a service SMS text which provided overlapping coverage to Nabatiyeh_C and coverage in the vicinity of his residence.
208 R305429
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
F. Selected Attribution Points forMustafa Badreddine
680. Mr. Badreddine spent the day mainly in south Beirut where PMP 663, SMP 944 and were co-located. At 08:57, PMP 663 connected to a cell in the immediate vicinity of the Samino store at Borj Hammoud. It had contact with a number of Mr. Badreddine' s regular associates throughout the day.
681. By 20:22, PMP 663 and SMP 944 were in the vicinity of Mr. Badreddine's residence in the Jounieh area where PMP 663 received calls from [Redacted] (PRH089) and Zeina [Redacted].
209 R305430
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 21 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met with Hassan Nasrallah
682. Former Prime Minister Rafik Hariri spent most of the day receiving delegations and visitors at Quraitem Palace on, what was, the second day of Eid. 242
683. In the very late evening until shortly after midnight, Mr. Hariri met with Hassan Nasrallah in Haret Hreik for over an hour in the vicinity of the Hezbollah General Secretariat; a meeting apparently arranged during the afternoon through calls involving Mustafa Nasser (PRH476), Quraitem Palace, Hussein Khalil (while in the Syrian border area), and the "Hassan Nasrallah" subscribed landline.
B. Hussein Khalil and Wafik Safa Travelled to Anjar/Syria whilst Contacting Rustom Ghazaleh & Wafik Safa 's Subsequent, Lengthy Contact with Mustafa Badreddine
684. In the early afternoon, Hussein Khalil traveled to the Anjar/ Syrian border area from where he contacted Wafik Safa and Rustom Ghazaleh. Mr. Ghazaleh's phone was roaming in Syria and Mr. Safa's phone received the call but not on the Lebanese network (consistent with use in Syria).
685. A little earlier, Mr. Safa had also contacted Mr. Ghazaleh as he traveled east from Beirut towards the Syrian border; at that stage Mr. Ghazaleh's phone was already roaming in Syria.
686. Their cell use near the Syrian border and the absence of call activity on Mr. Khalil and Mr. Safa's phones on the Lebanese network for four hours from 14:43 is consistent with their travel to Syria where Mr. Ghazaleh was also roaming. His phone was inactive for two and a half hours over the same period.
242 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380867- D0380868; Exhibit P303, Press Release of 21.01.05 - Hariri stated that he has no objections about granting El-Ashrafieh a special status, ERN D0004917-D0004917.
210 R305431
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
687. Mr. Safa and Mr. Khalil returned to south Beirut in the evemng; Mr. Ghazaleh remained in Syria.
688. Mr. Safa's first call on his return to Beirut at 19:49 was to Mr. Badreddine's SMP 944 for over 17 minutes (one of the longest calls either phone made to any other in the indictment period).
C. Green Network Activity: One Call between Salim Ayyash and Mustafa Badreddine
689. Only one call took place when Salim Ayyash ( ) called Mr. Badreddine ( ) from near Nabatiyehjust after mid-day.
D. Blue Network Activity: [S9] at East ofAirport Cells
690. There was relatively light call activity. [Ayyash] was involved in only two calls during the entire day, the second of which was made by [S9] from the East of Airport cells - its only call of the day.
E. Selected Attribution Points for Salim Ayyash
691. Mr. Ayyash spent most of the day, as he had the previous, in the Nabatiyeh area returning to Beirut shortly before midnight. His phones ( , PMP 170, PMP 091) co-located on the same or overlapping cells throughout the day, almost exclusively on Nabatiyeh C, not far from his Haroufresidence.
F. Selected Attribution Points forMustafa Badreddine
692. Mr. Baddredine (PMP 663, SMP 944, ) spent much of the day in Dahyieh before moving (with his bodyguard "Jad") up to the Jounieh area, in the vicinity ofhis residence there, in the late afternoon. He moved back down to south Beirut to Haret Hreik after the call from Wafik Safa upon Mr. Safa's return from Syria. SMP 944 and PMP 663 co-located (Alfa/ Touch overlapping coverage) and connected to neighbouring cells in both Dahyieh and Jounieh. The use of PMP 354 was consistent with the common movement of those phones between the two locations.
211 R305432
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
G. One Inter-Purple Phone Call
693. There was only one short call from [Merhi] to [Oneissi] in Dahyieh. There was no further contact between the Purple phones until 24 January 2005. The Purple phones were active throughout the day contacting family and regular associates: Mr. Oneissi was in contact with his brother, Ahmad Oneissi; and Mr. Sabra was in contact with his brother-in-law, Hasan Makki.
212 R305433
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 22 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
694. Former Prime Minister Rafik Hariri spent the day at Quraitem Palace receiVmg visitors. 243
B. Blue Network Activity: [S8] travelled to Tripoli and Contacted [S6] on the return journey
695. Only the Blue network was active but this was one of the busier days of Blue call activity. [Ayyash] was involved in nearly half of the 57 calls.
696. In the early hours of the morning, [Ayyash] called [S8]. Later that mornmg, [S8] travelled to Tripoli and, while there, made only one call which was to the base phone [S 13]. On the return journey to Beirut, it made a call to [S6].
697. [S8] was the only Blue phone to travel to Tripoli after the Blue Network had fully formed (and did so a number of times). The exception was [S6] which travelled only once - on the day the Mitsubishi Canter van was acquired there. This was the last day that [S8] used cells in Tripoli before the van was acquired.
C. Blue Network Activity: Salim Ayyash, S6 & S9
698. Over five hours in the afternoon, [Ayyash] made and received calls from
two adjacent cells in Haret Hreik. During this period, ~·~~ -~~ [Ayyash] had five calls with Blue 864 [S9] and two with Blue 610 [S6], as well as other Blue phones. Those calls preceded a two hour period when no calls were made on any of Mr. Ayyash's phones. When Blue 233 resumed call activity, it had three further calls in quick succession with Blue 610 [S6].
243 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380868-D0380869.
213 R305434
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
699. At 22:02, [Ayyash] was the pivot in a series of calls again involving [S6] and [S9].
214 R305435
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 23 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met with Walid Jumblatt
700. Former Prime Minister Rafik Hariri visited the Mokhtara: a heavily Druze populated area south-east of Beirut in the region of Beit Al Dine. In the evening, he was visited at Quraitem Palace by Walid Jumblatt (PRH684) who subsequently gave a speech on the Electoral Division. 244
B. No Red or Green Network Activity
701. There was no Red or Green activity.
C. Blue Network Activity: Late Night Call from [S9] to Salim Ayyash from an East ofAirport Cell
702. Once again, there were a series of calls, mainly in the evening, exchanged between [Ayyash], [S6], [S9], and [S7]. In particular, over a period of around 10 minutes starting at 19:56, Salim Ayyash and S9 were in contact three times after which S9 called both S6 and S7 before Mr. Ayyash called S9 a gam.
703. [S9] was involved in almost all the Blue calls this day including five with [Ayyash] and three with [S6]. All of them connected with cells in Dahyieh, except the first.
704. At 01:38, ~·~~ ~~. [S9] called ~·~~ -~~ [Ayyash] from one of the East of Airport cells. The call lasted over two minutes, and was one of many such calls from that location in the early hours of the morning within the narrow period over which the "East of Airport" pattern subsisted.
244 Exhibit P303, Press Release of 23.01.05, Hariri visits Mokhtara and meets with large crowds, ERN D0004935-D0004935; P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380869- D0380870.
215 R305436
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. Salim Ayyash (PMP 170), Subject 816, and [S9] Sequential Contact
705. At 19:53, Mr. Ayyash (PMP 170) contacted Subject 816 for over two minutes. Subject 816 was located near the Syrian border in Riyak, just north of Anjar, its most usual location for call activity.
706. It was their only contact on this day, but its timing appears to be significant. It immediately preceded the aforementioned intense sequence of calls spanning a little more than 10 minutes between [Ayyash], [S9], [S6], and [S7]. In the middle of that sequence of calls, Mr. Ayyash (PMP 091) called Hassan Merhi ( ) for a minute and 22 seconds.
707. In fact, this contact with Subject 816 represents the start of the narrow period (23-27 January) during which there is a direct, close and sequential relationship between calls made between Mr. Ayyash and Subject 816, and calls between Mr. Ayyash ( ) and S9 ( ). The end of this striking pattern coincides with the end of 's pattern of use at the "East of Airport cells". These were the same "East of Airport cells" from where Subject 816 was in contact with Mr. Ayyash over the early hours on the day of the attack.
E. Salim Ayyash (PMP 091) and Hassan Merhi ( ) Unusually in Contact
708. The telephone contact between Mr. Ayyash and Mr. Merhi was very rare and never took place on their Green phones. There were a total of only eight such calls on this and three other days over the indictment period (13 November, 5-6 February 2005). Four of the calls took place on 6 February 2005.
709. On this day, there were two calls between them and both connected to cells with overlapping predicted coverage in Dahyieh. The first occurred as part of the Blue/Subject 816 sequence described above, the second occurred fifteen minutes after that.
216 R305437
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 24 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
710. Former Prime Minister Rafik Hariri was at Quraitem Palace all day and received a number of visitors. 245
B. Green Network Activity: One Call between Salim Ayyash and Mustafa Badreddine
711. At 17:45, [Ayyash] contacted [Badreddine] for just under two minutes. Both phones connected to their most dominant two Green cells, respectively (SFEIR2 and ROUEIS3), both in Dahyieh.
C. Blue Network Activity: Second Principal Day of "East ofAirport" Activity involving [S9], Salim Ayyash, and Sequential Contact with Subject 816
712. Three of the principal six Blue phones ( [S5], [S6] and [S8]) were not active at all.
713. [S9] was located at the East of Airport cells for a series of eight calls over eight hours (12: 17 - 20:45) throughout the day; six of them, including the last, were with Mr. Ayyash ( ), in accordance with previous patterns. The other calls were to the base [S13] and [S12].
714. [S9]'s activity at the East of Airport cells was largely concentrated over three days which had begun on 19 January 2005, continued on this day, and had the most extended pattern of activity on its last day on 26 January 2005 (the day after the acquisition of the Canter van). 246
245 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380870-D0380872; Exhibit P303, Press Release of 24.01105 - El-Attiyah visiting Lahoud, Hariri and Sahnaoui, ERN D0004914- D0004915; Exhibit P303, Press Release of 24.01.05 - Hariri meets Senator Merhej, ERN D0004963-00004963. 246 See Exhibit P 1118, PowerPoint Presentation - PRH435 - Common Mission Phones, slide 118.
217 R305438
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
715. This pattern in tum, married in closely and sequentially with the ongoing PMP 170 [Ayyash]/ Subject 816 call patterns, and continued to do so over the next 2-3 days.
716. Mr. Ayyash's first calls of the day on PMP 170 and (08:55 & 08:57) to Subject 816 and [S9], respectively, were immediately sequential, and thereby strongly suggestive of being directly related.
717. At the time, Subject 816 was situated in the Riyak area, north of Anjar, and within two hours had travelled to south Beirut (ROUEIS3) when he called Mr. Ayyash (PMP 170). His other five calls with Mr. Ayyash (PMP 170) throughout the day were cell sited in adjacent cells BRAJNE1, BRAJNE2 or SFEIR2.
718. A further series of immediately sequential calls between Mr. Ayyash (PMP 170)/Subject 816, and Mr. Ayyash ( )/ [S9] occurred over two minutes at 13:27 while [S9] used at the East of Airport cells. There was further and final contact for the day between Subject 816 and Mr. Ayyash (PMP 170) some 15 minutes later.
719. There followed an extended period of call inactivity on Subject 816 (13:49-22:41) which, like on 19 January and 26 January 2005, largely coincided with S9's repeated use of the East of Airport cells (12:17 to 20:45).
720. Subject 816 connected to those same East of Airport cells in the early hours of the assassination day in calls with Mr. Ayyash. He was the only contact of Mr. Ayyash (other than a Network phone) on 14 February prior to the explosion.
D. Purple Phone Activity
721. In the morning, [Merhi] called [Oneissi] and, in the afternoon, Purple 018 [Sabra] called Mr. Merhi's family phone (3686091). The calls were both sited within Dahyieh. Mr. Sabra's connected to a cell in the vicinity of his parents' and in-laws' homes. Mr. Merhi and Mr. Oneissi were also in contact with family members: Mr. Merhi with his brother, Abbas Merhi; and Mr. Oneissi with his mother, Fatima Darwish.
218 R305439
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
E. Selected Attribution Points for Salim Ayyash
722. On this day, the Chief ofNabatiyeh Regional Civil Defence formally confirmed to the Director General of the Civil Defence that Salim Ayyash had not taken his leave to perform the Hajj. 247
723. From midday, Mr. Ayyash's phones (PMP 170, PMP 091 and ) co-located in the same area of Nabatiyeh not far from his Harouf residence. Over this period, he used PMP 091 to make contact with a number of his regular associates, including his brother Ali Ayyash. He had returned to south Beirut by 15:30.
F. Selected Attribution Points for Mustafa Badreddine
724. Mr. Badreddine's phones (PMP 663, SMP 944 and ) all co-located on the same and overlapping cells, respectively, in Dahyieh all afternoon and evening. PMP 663 was in contact with "Jad" shortly before and after Mr. Badreddine's Green call with Mr. Ayyash, when PMP 663 co-located with [Badreddine] .
247 Exhibit P 1165, Note from Chief of Nabatiyeh Regional Station stating Ayyash did not take leave, ERN 60243637-60243637 D EN.
219 R305440
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 25 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Discussed Electoral Law
725. Former Prime Minister Rafik Hariri received a number of visitors at Quraitem Palace throughout the day, including MPs Marwan Hamade (PRH038) and Mohammed El Hajjar with whom he discussed the Electoral Law. 248 He hosted an "Election Lunch", and held discussions regarding the draft Electoral Law due to be presented to Cabinet two days later. 249 The draft Election Law had been presented by Interior Minister Suleiman Franjieh the night before and was published in newspapers this day. 250
B. Hierarchical Green & Blue Network Call Flows: Canter Van Purchased (S6 in Tripoli)
726. This was the fourth occasion and the final day on which there was a close, sequential association between Green and Blue call activity indicative of activity central to the conspiracy. 251 The related Blue call from [Ayyash] was to [S6] which was connected to the acquisition of the Mitsubishi Canter van.
727. [S6] made seven calls while in Tripoli over two hours during the afternoon: four of them with [Ayyash], two with [S9], and one with . This was the only time that any Blue phone, aside from [S8], visited Tripoli after the full formation of the Blue Network.
728. Shortly before 15:00, Mr. Ayyash ( ) exchanged three calls with [S6] who was in central Tripoli. Shortly thereafter, at 15:10, Mr. Ayyash used his Green 300 to contact Mustafa Badreddine (Green 023). This was around half an hour
248 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380872-D0380874; Exhibit P303, Press Release of 25.01.05, Hariri Receives Ambassadors and MPs at Quraitem Palace, ERN D0004944-D0004945. 249 Exhibit P299, Rafik Hariri's 2005 Agenda Book, 60142137-60142180, at 60142155; Testimony of Salim Diab, Transcript of22 January 2015, pp. 58-61. 250 Exhibit P446, UNIC Beirut Press Review, 25 January 2005, ERN D0412233-D0412238, at 00412234. 251 See Exhibit P 1118, PowerPoint Presentation - PRH435 - Common Mission Phones, slide 121.
220 R305441
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
before the time of the purchase of the Canter van. At 15:37, around the time of the purchase of the van, [S6] again contacted Mr. Ayyash ( ) connecting to a cell (BEDAOU2) which provided predicted best server coverage over the vehicle dealership from where the Canter van was purchased. It was at this time that the phone of the owner of the vehicle dealership from where the van was purchased had a number of calls with the owner of the Canter van. 252
C. Blue Network Activity Following Purchase of Van: Contact between S6 and S9 and Sequential Calls between Salim Ayyash, S9 and Subject 816
729. Following the acquisition of the van, the last two calls made in Tripoli by [S6] were to [S9]. As [S6] travelled back to Beirut, he was in contact with Mr. Ayyash again and also with [S5]. By 19:08, [S6] had returned to Dahyieh. Shortly thereafter, he again contacted [S9], this time both were connecting to the same cell (SFEIR2).
730. [S9] made a further call to [S6] late evening, after receiving a call from Mr. Ayyash ( ) who, in tum, had received a call on PMP 170 from Subject 816.
731. The pattern of contact between Mr. Ayyash, S6 and S9, and its association with the purchase and transportation of the Canter van, is significant because, having been cell sited over eight hours at the East of Airport cells on the preceding day, and over eighteen hours the subsequent day, [S9] was not sited there once for any call on this day. This is consistent with significant preparatory activity that could or would not continue until the acquisition of the Canter van had taken place.
D. Purple Phone Activity: Assad Sabra Unusually in Vicinity of Parliament and Al Jazeera's Offices and his First Inter-Purple Contact since Abduction ofAhmad Abu Adass
732. In the afternoon, Purple 018 [Sabra] and Purple 231 [Merhi] exchanged calls; Assad Sabra's phone was located in the vicinity of Parliament and Al-Jazeera's offices (ETOILE I). This cell is immediately adjacent to the cells connected to by Purple 018
252 Testimony of [Redacted], Transcript of 4 June 2015, pp. 82-91; Transcript of 5 June 2015, pp. 9-18; Testimony of [Redacted], Transcript of 15 June 2015, pp. 37-47.
221 R305442
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
[Sabra] around the time that the "false claim" video was collected from the Tree after the explosion. Later in the afternoon, [Sabra] then called [Oneissi] in Dahyieh.
733. These calls were Mr. Sabra's first contact with another Purple phone for ten days (since the time of Ahmad Abu Adass' disappearance).
734. Mr. Sabra was involved in only one other inter-Purple call before the "Claim of Responsibility" was made (on 4 February). That call was also from [Sabra] to [Merhi] and took place from an adjacent cell (AICHA1) to the one it connected to on 14 February, in the area of the payphone used to contact Al Jazeera shortly before the video was collected.
735. Call activity in 2005 involving [Sabra] being cell sited in central/ west Beirut was very unusual, and, except 14 February 2005, occurred on only three other days.
736. On this day, was also in contact with Assad Sabra's father, Hassan Sabra.
E. Selected Attribution Points for Salim Ayyash
737. Mr. Ayyash's phones ( , PMP 170 and PMP 091) used cells in the same areas of Dahyieh throughout the day and , and PMP 170 co-located on their respective Alfa and MTC cells. PMP 091 was in contact with Mr. Ayyash's business associate Hussein Zaarour, and his sister-in-law, Bassima Al- Hajj.
F. Selected Attribution Points forMustafa Badreddine
738. Mr. Badreddine's phones were cell sited for most of the day in Dahyieh. PMP 663 was in contact with his regular associates Zeina [Redacted], Jad, and Samino Mar Elias. PMP 663 and Green 023 co-located on closely adjoining cells for his only Green call of the day at 15: 10.
739. By the evening, Mr. Badreddine was cell sited in the area of his Jounieh residence when receiving a 10 minute call from [Redacted] (PRH089) on PMP 663.
222 R305443
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 26 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Attended Parliament and Threatened to Resign from Parliament if the Electoral Law Passed
740. Former Prime Minister Rafik Hariri attended a Parliamentary session from 11:00 to 13:00. He was at Quraitem Palace for the rest of the day holding a meeting, amongst others, with the Beirut Decision Bloc. 253
741. Mr. Hariri threatened to resign from Parliament along with his Parliamentary bloc if the Electoral Law was passed. 254
B. Network Phone Activity: End of the "Mission Set-Up Phase"q
742. This was the final day of the period in which integrated and high levels of call activity were maintained amongst the entire Blue Network. Thereafter, the call activity of the "Principal Six" Blue sub-group and their corresponding Red phones intensified as the call levels of the other "Balance of Nine" sub-group (the "Mission Set-Up" phones) discernibly dipped for the remainder of the period leading to the attack. 255
C. Blue Network Activity: Third and Final Principal Day of [S9] Activity at "East ofAirport" Cells and Related Salim Ayyash and Subject 816 Contact
7 43. In contrast to [S6] 's close interaction with [Ayyash] and [S9] over the preceding days, and following its involvement in call activity closely associated with the acquisition of the Canter van the day before, S6 was barely active today (one call with Blue 322 [S14]).
253 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380874-D0380876; Exhibit P303, Press Release of26.01.05 0 Hariri presiding a meeting for Beirut Decision Bloc and reviewing the general matters with Barsoum, ERN D0004959-D0004959. 254 Exhibit P532, UNIC Beirut Press Review, 27 January 2005, ERN D0412322-D0412327, at 00412324. 255 See Exhibit P 1118, PowerPoint Presentation - PRH435 -Common Mission Phones, slides 35, 36, 43, 112.
223 R305444
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
744. Conversely, after a marked pause in activity the day before, [S9] resumed and intensified its call patterns at the East of Airport cells, 256 his related contact with [Ayyash] in conjunction with the associated, closely-related call sequences between PMP 170 (Ayyash) and Subject 816, for the final time.
745. [S9] was involved in 13 calls over 18 hours from 12:33 on 26 January to 06:07 on 27 January, all ofthem made connecting to the East of Airport cells. Seven of those calls were with Mr. Ayyash ( ), the last three of which occurred, in line with previous patterns, at unusual times: 01:10, 05:44 and 06:07.
746. [S9] also made two calls to the base [S13], the first of which lasted 6 'ii minutes - a very unusual length of call and the second longest Network phone call of all. Its remaining calls were with [S7].
747. With the exception of two further calls to Mr. Ayyash ( ) from the "East of Airport cells", again in the early hours at 00:16 and 00:43 on 28 January, this pattern of concentrated (and extended) call activity of [S9] contained within those cells did not recur during the indictment period.
748. Earlier in the morning, Mr. Ayyash (PMP 170) had three calls with Subject 816. The third call, made from Subject 816 to PMP 170 [Ayyash], immediately preceded Mr. Ayyash's first call of the day to [S9] at the East of Airport cells. This mirrored the patterns of the 24 January, further cementing the link between the three phones and the unusual activity taking place at that particular location around the airport.
749. This association between the conduct of [S9] and Subject 816 was reinforced by the further extended period of call inactivity on Subject 816 over 21 hours from 12:54 to 09:56 which encompassed S9's period of successive calls connecting to the "East of Airport cells". This pattern had also occurred on 19 and 24 January 2005 (the other principal S9- East of Airport days).
256 See Exhibit P 1118, PowerPoint Presentation - PRH435 -Common Mission Phones, slide 118.
224 R305445
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
750. Aside from one call the next morning, and one call on 10 February, the next calls between Subject 816 and Mr. Ayyash (PMP 170) occurred over the night/ morning of 13/14 February 2005.
751. On that night, they exchanged six calls, the final two of which were made to Mr. Ayyash (PMP 170) from Subject 816 from the very same "East of Airport cells" at 23:54 and 03:33. There were two further calls with Subject 816 as Mr. Ayyash moved up towards the crime scene.
D. Purple Phone Activity: Final Calls between Hassan Merhi and Hussein Oneissi
752. There were two inter-Purple calls from [Merhi] to Hussein Oneissi ( ), both were cell sited in south Beirut.
753. These were the last two ever calls between [Merhi] and [Oneissi].
754. There were no other inter-Purple calls, bar one on 4 February, until the false "Claim of Responsibility" was made shortly after the explosion.
225 R305446
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 27 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace and Parliament
755. Former Prime Minister Rafik Hariri received visitors to Quraitem Palace throughout the day. 257 The movement of the phones of his security detail is consistent with him attending a Parliamentary session at 12:00 for almost an hour.
B. Electoral Law Passed
756. The government passed the draft Election Law with 23 ministers in favour and six opposed. 258
757. Qoumet Chehwan issued a statement criticizing the draft Election Law as extremely dangerous. 259 Maronite Patriarch Boutros Sfeir expressed his support for the implementation ofUNSC 1559. 260
C. Beginning of the "Execution Phase": Intensified "Principal Six" Blue Phone Activity & Resumption ofRegular Surveillance Up to the Attack
758. This was the beginning of the period extending to the date of the attack (but not beyond) when the call activity of the "Principal Six" Blue and Red phone users significantly intensified, 261 and their regular surveillance of Rafik Hariri resumed, following a two week period in which Ahmad Abu Adass' was abducted ("False Claim Set-Up") and the van used for the LBVIED was procured amongst other things ("Attack Set-Up").
257 Exhibit P301 Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380876-D0380878. 258 Exhibit P532, UNIC Beirut Press Review, 28 January 2005, ERN D0410119-D0410123, at D0410121. 259 Exhibit P532, UNIC Beirut Press Review, 28 January 2005, ERN D0410119-D0410123, at 00410121. 260 Exhibit P532, UNIC Beirut Press Review, 28 January 2005, ERN D0410119-D0410123, at 00410122. 261 See Exhibit P 1118, PowerPoint Presentation- PRH435- Common Mission Phones, slides 35, 36, 42, 43, 47.
226 R305447
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
759. Conversely, the activity of the remaining nine Blue Network users immediately and markedly decreased. 262
760. There was no Green or Red call activity on this day but the following day their call intensity also increased in a clear and sustained fashion until the explosion.
761. The call patterns involving Subject 9, Salim Ayyash, Subject 816 and the East of Airport cells did not recur beyond the early hours of this morning. The Canter van had been acquired, Ahmad Abu Adass had been abducted, and there was no further contact between the Purple phones (bar one call on 4 February) until the "Claim of Responsibility" after the explosion.
D. Blue Network Activity: Surveillance ofRafik Hariri at Parliament
762. Immediately after Mr. Hariri's security detail arrived near the Parliament at 11:56, [S5] called Mr. Ayyash ( ) from the Parliament area connecting to the same cell as that connected to by Yahya Al-Arab minutes later. For the remainder of the afternoon, [S5] and [S 7] connected with cells along the Coast Road in west Beirut, and also Gemmayzeh.
763. [S8] made three calls from the Zouk Mosbeh area (MOSBEH2) over half an hour. It was this specific area that became a focus of Red call activity over the following two weeks.
E. Salim Ayyash, Subject 816 & S9
764. Salim Ayyash received a short call on his PMP 170 from Subject 816 in the morning, the last call between them until the days leading into the attack. This coincided with the cessation of S9's activities at the East of Airport cells earlier in the morning. Between 01:10 and 06:07, S9 had made his last three calls ofthe final principal day of East of Airport activity (all with Salim Ayyash (Blue 233)).
262 See Exhibit P 1118, PowerPoint Presentation - PRH435 -Common Mission Phones, slide 36.
227 R305448
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 28 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
765. Former Prime Minister Rafik Hariri was at Quraitem Palace throughout the day. 263
B. Beginning of the Red Network Primary Phase: Hierarchical Green-Red Sequential Call Flow & Associated Surveillance ofRafik Hariri
766. From this day up to the day of the attack, the Red call activity was increasingly regular, sustained and frequent. This was the beginning of the Red primary phase. 264
767. The direct association, often involving closely sequential calls, between Red and Green activity began on this day and repeatedly recurred until both networks ceased shortly before the explosion. 265
768. On this day the six Red phones operated in two distinct areas: west/ central Beirut and Zouk Mosbeh/ Faraya. These two areas came to dominate the overall Red call activity in the coming days.
769. The first call was at 11:36 between [S6] and [S8]. These two phones were cell sited for the whole day until 16:57 m west/ central Beirut, predominantly using cells immediately surrounding Quraitem Palace. They exclusively called each other and Salim Ayyash.
770. The other four Red phones operated in the Zouk Mosbeh/ Faraya area from 13:30
until 17:54. ~~~~ ~~- [S9], ~~~~ J ·~ [S7] and ~w~ ~~~ [S5] mainly connected with cells in the general vicinity of Mr. Hariri's Faqra Villa.
263 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380878- D0380880; Exhibit P303, Press Release of28.01.05, Visitors to Quraitem Palace, ERN D0004937-D0004937. 264 See Exhibit P 1118, PowerPoint Presentation - PRH435 -Common Mission Phones, slides 42, 43. 265 See Exhibit P 1118, PowerPoint Presentation- PRH435- Common Mission Phones, slides 139.
228 R305449
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
771. Mr. Ayyash spent the entire time (three hours), involving 12 Red calls and four Green calls, connecting to the same adjacent cells (MOSBEH2, RIMAL1, and NDU2) at the Zouk Mosbeh slip road to Faraya.
772. Three of the four Green calls were in close and immediate sequence with his calls to the rest of the Red group illustrating his central, co-ordinating role amongst the Network Phones and the close relationship between the group used to execute the attack and the command element.
773. On the second Green call at 14:27, Mr. Badreddine's connected with the adjacent cell to Mr. Ayyash. Fourteen minutes later, PMP 663 [Badreddine] remained in the area connecting to a neighbouring cell also providing coverage to the slip road, consistent with the two men meeting in this area briefly as Mr. Badreddine traveled up to Jounieh.
774. That Mr. Badreddine took a very close and direct interest in key operational activity is a recurrent theme reflected in the hierarchical call flow relationship with Yellow, Blue, Purple & Red phones at significant times.
C. Blue Network Activity: Principal Six Blue Phones Used for Contact to(from Dahiyeh during Red Phone Operational Activity
775. The large majority of the 26 Blue calls involved the principal six users of the Blue phones and cell sites in Dahyieh.
776. The strict protocol governing Red and Blue use, so as to protect Dahyieh (and other covert areas) from association with the Red group and therefore the crime, was evident throughout the day. Once the Red phones had become operational for the day, the corresponding principal six Blue phones were, without exception, only used where one of the call participants was in that part of Dahyieh where they were based (e.g. see 17:48).
D. Selected Attribution Points for Salim Ayyash
777. Following the last of Mr. Ayyash's calls in the early hours with S9 at the East of Airport cells, from 09:28 Blue 233 co-located with PMP 091 and PMP 170 in the
229 R305450
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
general vicinity of Mr. Ayyash's Hadath residence connecting to his familiar Sfeir cells until 11:32.
778. Thereafter, PMP 170 and continued to co-locate in south Beirut, and as Mr. Ayyash moved north to spend the afternoon at the Zouk Mosbeh tum-off to Faraya PMP 170, and co-located there too.
E. Selected Attribution Points for Salim Ayyash: Wife Returns from Hajj
779. Mr. Ayyash's wife and child were scheduled to fly into Beirut from Medina (from the Hajj) on this day. The use of PMP 091 over this period is consistent with Mr. Ayyash, otherwise pre-occupied with significant (Red) operational activity, having provided his personal phone to a relative or close friend (as a means of contact with him, his wife and her sister) to collect his wife and child on their return from the Hajj.
780. From 12:24 to 15:06, PMP 091 (on this day only) in the hands of another user, was cell sited for two hours at a cell providing immediate predicted coverage to the Beirut Airport terminal. During this time it had four calls with Mr. A yyash' s PMP 170, calls with his sister-in-law (the sister of his wife) and also his home landline. By 19:26, the phone was once again connecting to cells in the vicinity of Mr. A yyash' s residence in the Sfeir area of Dahyieh, as was , and thereafter returned to his use.
F. Selected Attribution Points for Mustafa Badreddine
781. Between 14:07 to 14:14, Mr. Badreddine's phones (SMP 944, PMP 663, ) co-located as he began to make his way up to the area around his Jounieh residence. They demonstrated movement consistent with a single user and co-located on the same and overlapping cells respectively throughout the afternoon when PMP 663 had contact with Mr. Badreddine's close female friend, Zeina [Redacted].
782. By 22:56, Mr. Badreddine had returned to south Beirut, where he made contact with Mr. Safa, as his SMP 944 and PMP 663 continued to co-locate.
230 R305451
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 29 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met Ghattas El Khoury and Basel Fuleihan at his Naameh Villa and Later Informed the "Syrian Deposits" they would not be on his Electoral List
783. Former Prime Minister Rafik Hariri spent the morning at Quraitem Palace. 266 In the afternoon, he appears to have visited Marwan Hamade (PRH038) at his home (13:26- 14:23) before travelling to his Naameh residence (14:41-15:06) where he met with Ghattas El-Khoury (PRH242) and Bassel Fuleihan. They discussed the exclusion of the Syrian deposits from Mr. Hariri's electorallists.267 He returned to Quraitem Palace later that afternoon (16:40-16:52).
784. On his return to Quraitem, Mr. Hariri informed the "Syrian deposits" Bassem Yammout, Nasser Kandil, and Adnan Arakji that they would not appear on his electoral lists. 268 Rustom Ghazaleh was in Beirut in the evening where he had calls with Bassem Yammout (1 call) and Nasser Kandil (3 calls).
B. Network Phone Activity: No Red or Green Activity
785. There was no Green or Red call activity. However, this was a busy day of Blue activity dominated by the principal six users of the Blue phones.
C. Blue Network Activity: Surveillance ofRafik Hariri in the Early Afternoon
786. Between 12:30 and 14:30, [S5], [S7] and [S8] made a large number of co-ordinated calls to each other in west Beirut, mainly in the Quraitem area, in a manner consistent with the surveillance of Mr. Hariri.
787. The cell siting of S7 and S8 suggests that Mr. Hariri was also followed to Mr. Hamade's home. Towards the end of this period, they were joined by Blue 610 [S6]
266 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380880- D0380881. 267 Testimony ofGhattas Khoury, Transcript of 16 January 2015, pp. 77-82. 268 Testimony ofGhattas Khoury, Transcript of 16 January 2015, p. 80.
231 R305452
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
and [S9]. Salim Ayyash (Blue 233) was in regular contact with most of them from Dahyieh.
788. From 14:47 to 15:06, in the period that Mr. Hariri moved south to Naameh from Quraitem Palace, [S5], [S6] and [S9]'s movements were consistent with mobile surveillance only as far as the airport area, while [S7] and [S8] co-ordinated in and around the vicinity of Parliament and the Crime Scene. S6 continued movement south beyond Naameh to an area between it and Sidon, connecting to a cell that S9 had connected to much earlier in the afternoon.
D. Blue Network Activity: Co-ordinated Activity & Continued Surveillance at Quraitem Palace
789. Between 17:07 and 18:14, following Mr. Hariri's return to Quraitem Palace, there was further co-ordinated call activity between [S5], [S6], [S7], [S8] and [S9] in, around and between the Airport and Quraitem Palace in a manner suggestive of rehearsed movement and inter-contact. Mr. Ayyash was in contact with S6 from Dahyieh during this period. [S9] was sporadically located using one of the East of Airport cells it had frequented in previous days before it too co-located with [S5].
790. [S7], [S8] and [S9] continued to contact each other in the area around Quraitem Palace from 20:30 to 21 :30; S9 was cell sited there as late as 23:27.
E. Hassan Nasrallah Condemns UNSC Resolution 1559
791. Hassan Nasrallah stated that UNSC Resolution 1559 was an Israeli Resolution and that those who supported its implementation and the disarming of Hezbollah were determined to take the country back to the pre-Taef Accord regime, "when Lebanon was never protected by its own armed forces or by the international community."269
269 Exhibit P532, UNIC Beirut Press Review, 31 January 2005, ERN D0410124-D0410131, at 00410129.
232 R305453
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 30 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met with Marwan Hamade and Walid Jumblatt
792. Former Prime Minister Rafik Hariri received visitors at Quraitem Palace throughout the day until around 18:30 when phone activity is consistent with him having visited Marwan Hamade (PRH038) at his home. He returned to the Palace shortly after 19:00 for a meeting with MP Walid Jumblatt (PRH684). 270
B. Blue Network Activity: Surveillance of Rafik Hariri at Quraitem Palace and Marwan Hamade's Residence
793. This was a quiet day. Only eight of the fifteen phones were used: the lowest number since the Blue Network had formed. The principal six Blue Network users were all active, although [S5] was involved in only three calls.
794. [S7] and [S8] were located in west Beirut all day (10:28-17:59) before they returned to south Beirut. [S6] and [S9] travelled up to west Beirut mid-afternoon where they connected to cells around Quraitem Palace and, later on, the home of Mr. Hamade, consistent with their surveillance of Mr. Hariri while he was there. S6 provided regular updates to Salim Ayyash ( ), who was in the Nabatiyeh area, throughout.
C. Selected Attribution Points for Salim Ayyash
795. From midday until 19:07, Mr. Ayyash (PMP 091 and ) connected to cells in Nabatiyeh not far from his Harouf residence and PMP 091 was in contact with regular associates, including his brother Ali Ayyash. By 21:51, PMP 091 had returned to the vicinity of Mr. Ayyash's residence in Hadath.
270 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380881-D0380882; Exhibit P303, Press Release of30.01.05, Jumblatt visited Hariri, ERN D0004950-D0004950.
233 R305454
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 31 January 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Visited Higher Shiite Council and Announced He Would Run for the Elections
796. Former Prime Minister Rafik Hariri travelled from Quraitem Palace to the Higher Shiite Council in south Beirut to meet Sheikh Abd Al Amir Kabalan where he announced his plans to run for the elections. 271 He arrived at the Higher Shiite Council shortly before 11:00 and left to return to the Palace shortly after 11:45.
797. In the evening, sometime after 20:30 until almost 23:00, Mr. Hariri attended a dinner at the residence of Mahmoud Mamish in Ain El Tineh, west Beirut. 272
B. Red, Green & Blue Network Activity: Hierarchical Red/Green Sequential Call Flow and Surveillance ofRafik Hariri 's Convoy to Higher Shiite Council
798. This was, by far, the busiest day of Green call activity, involving exclusively Mustafa Badreddine ( ) and Salim Ayyash ( ). The close, sequential connection with the most intense part of the Red call activit/73 shows a very close interest in its focus: the movements of Mr. Hariri and his convoy.
799. While Red Network activity started the day in west Beirut and moved down to south Beirut when Mr. Hariri visited the Higher Shiite Council, [S8] was already located in the vicinity of the Higher Shiite Council during this initial Red activity.
800. From 09:54, [S6] and [S8] was cell sited in the vicinity of Quraitem Palace, whereas Blue 817 [S8] was already nearby the Higher Shiite Council, and Red 946 [S7] and Red 652 [S9] were stationed in the close vicinity of the Parliament.
271 Exhibit P303, Press Release of 31.01.05, Hariri announces running for elections from Beirut, ERN D0004951-D0004955; Exhibit P303, Press Release of 31.01.05, Hariri after visiting Kabalan, ERN D0004956- D0004957. 272 Exhibit P299, Rafik Hariri's 2005 Agenda Book, ERN 60142137-60142180, at 60142161; Exhibit 2D00081, Witness Statement of Mneimneh Mohammed Abdallah, ERN 60142051-60142062. 273 Exhibit P1118, PowerPoint Presentation- PRH435- Common Mission Phones, slide 140.
234 R305455
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
By 10:15, S7 and S9 were joined in that same vicinity by Mr. Ayyash ( ) and [S5].
801. It appears that they anticipated that Mr. Hariri might visit Parliament before travelling to Higher Shiite Council, because it was not until shortly after [S8] called Mr. Ayyash ( ) from the vicinity of the Higher Shiite Council after the Prime Minister arrived there at 10:54, that either S7 or Mr. Ayyash moved south.
802. Shortly before Mr. Hariri's convoy moved to the Higher Shiite Council, [S6] and Mr. Badreddine ( ) were positioned on a cell providing coverage to the route south from Quraitem Palace. They too appear to have missed the convoy as it took a route east of Quraitem before moving south.
803. Within seconds of receiving [S8]'s call from the Higher Shiite Council, Mr. Ayyash ( ) called Mr. Badreddine ( ) who moved to the vicinity of the crime scene a short while later. S6 only began to move down to the Higher Shiite Council at 10:56 after a call to [S7] who was, by then, in the immediate vicinity of that location.
804. By 11:07, S6 and Mr. Ayyash had joined S8 and S7 at the area surrounding the Higher Shiite Council all using their Red phones (S8 apparently being reunited with his following S6's arrival). There were no Green or Red calls at all for half an hour (11:17 -11:44) until the end ofthe meeting, when 23 Red and Green calls were made within the following 20 minutes thereby tending to confirm the focus of their presence and movement.
805. S5 and S9 remained cell sited around the Parliament until, at 11:49, [S9] moved marginally south to connect to SODEC03 where it had repeated contact with Mr. Ayyash (Red 741) until Mr. Hariri's convoy passed and, like Mr. Ayyash, S6, S7 and S8, thereafter moved in a manner consistent with surveillance to Quraitem Palace.
806. The Red phones operated around the west Beirut, Parliament, crime scene area (where S5 had remained) for a further half an hour or so until 12:42 when their calls ended for the day.
235 R305456
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
C. Green Network Activity: Heavy Contact During Surveillance & Subsequent Meeting between Mustafa Badreddine and Salim Ayyash
807. There were 11 calls in total between Mr. Badreddine ( ) and Mr. Ayyash ( ) over little more than an hour. This was exceptional behaviour on Network phones that were otherwise used on a sparing basis throughout their lifespan.
808. For seven of those calls (five of them from Mr. Badreddine) Mr. Badreddine connected to cells in the crime scene area (ZOUKAK1, PHENMB 1, MRAICI2) whilst Mr. Ayyash was conducting direct surveillance of Mr. Hariri's security detail. The cessation of his interest in the area around the crime scene, after 40 minutes spent there, coincided with a call to Mr. Ayyash (11 :55) as the Hariri convoy moved west away from that location on its way back to Quraitem.
809. Mr. Badreddine' s last call of the day on at 12:07 connected to OUZAI2. Mr. Ayyash ( ), who had stopped using his Red phone somewhat prematurely compared to the other five Red phones, was close by moving south towards the same location. The call between them lasted only 11 seconds. Mr. Badreddine' s SMP 944 was still connecting to the same cell a few minutes later indicating very limited or no movement on his part. At 12:23, Mr. Ayyash ( ) connected to a cell that overlapped with OUZAI2 to call S6 as he moved away.
D. Blue Network Activity: Afternoon and Evening Surveillance of Rafik Hariri at Quraitem Palace and his Dinner in Ain El Tineh
810. From late in the afternoon, [S5], [S7] and [S8] were all located in the vicinity of Quraitem Palace. As [S6] moved up to join them at 18:39, an hour later, S8 moved back down to Dahyieh for the remainder of the evenmg.
811. By 20:58, when Mr. Hariri's security detail waited in Ain El Tineh during his dinner engagement, Blue 864 [S9] had joined Blue 610 [S6] and Blue 324 [S7] in connecting to cells in the same immediate vicinity, consistent with their combined surveillance of his movements until he had returned to Quraitem Palace shortly after 23:00. Blue 610 [S6] had returned to Dahyieh by 21:48. Blue 585 [S5] and Blue 324 [S7] remained in west Beirut until at least 23:25.
236 R305457
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
812. Mr.Ayyash( ) was involved in only one call following those he had made in Ouzai shortly after midday: a ten second call to [S8] at 22:10.
E. Selected Attribution Points for Salim Ayyash
813. Mr. Ayyash's multiple Network Phones ( ) co-located repeatedly during the day while their activity was static around the Parliament and the Higher Shiite Council areas (see 10:49- 10:56, 11.13-11.48). They also conveyed co movement between the Higher Shiite Council and Quraitem (see 11 :48-12:04) reflective of them having a single user. There was no call activity at all on Mr. Ayyash's personal phones whilst his Network phones were in use.
814. Mr. Ayyash's PMP 170, PMP 091 and were cell sited at Sfeir A, in the vicinity of his Hadath residence in Dahyieh, in the afternoon and the evening.
F. Selected Attribution Points for Mustafa Badreddine
815. SMP 944 was used within minutes of both the first and last calls: the phones co-located on the same cell on both occasions. Mr. Badreddine's other phones were all inactive during the period of heavy use of his Green phone.
816. Thereafter Mr. Badreddine's phones (PMP 663, SMP 944) repeatedly co-located in Dahyieh. PMP 663 called "Jad" a number of times before their phones converged. The cell siting is consistent with him having been driven to the Samino store at Fum el Chebbak shortly after 14:37.
817. PMP 663 and SMP 944 continued to co-locate on a cell providing close predicted coverage to the Fum el Chebbak store until 16:32. While in the area, SMP 944 received a call from Mr. Badreddine's Samino Associate, Mohammed Shukr.
818. From 17:25 until midnight, both PMP 663 and SMP 944 were co-located in the vicinity of his Sahel Alma residence in the Jounieh area.
237 R305458
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 1 February 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met with Syrian Vice President Khaddam and Syrian Deputy Foreign Minister El-Moallem
819. Former Prime Minister Rafik Hariri received a number of visitors at Quraitem Palace throughout the afternoon and evening, including Vice President of Syria, Abdel Halim Khaddam and the Syrian Deputy Minister of Foreign Affairs, Walid El-Moallem.274
820. Mr. El Moallem cautioned Mr. Hariri not to defy Syria's will with regard to the elections and also his dealings with President Lahoud. 275
B. Final Meeting between Rafik Hariri & Hassan Nasrallah
821. Mr. Hariri's convoy's movement, and prior calls between Mustafa Nasser and Hussein Khalil (via Khalil Farhat), are consistent with him having travelled to meet Hassan Nasrallah in the area of the Hezbollah General Secretariat at around 22:30 for at least an hour.
822. Their previous meeting had been on 21 January 2005. This meeting would prove to be their last.
C. Network Phone Activity: No Red Phone Activity
823. This was a quiet day overall. There was no Red phone activity and only one Green call.
274 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380885, D0380887; Exhibit P324, Press Release of 01.02.05, Syrian Deputy Minister visited Rafik Hariri, ERN D0004987- D0004988; Exhibit P532, UNIC Beirut Press Review, 1 February 2005, ERN D0410132-D0410138; Exhibit P409, Tape recordings of the meeting between Hariri and Moallem, ERN 40000843; Testimony of Walid Jumblatt, Transcript of6 May 2015, pp. 35-77; Testimony of AtefMajdalani, 1 May 2015, p. 15; Testimony of Marwan Hamade, Transcript of 19 November 2014, pp. 71-73; Testimony ofGhaleb El-Chamma, Transcript of 11 February 2015, pp. 15-18; Testimony ofHani Hammoud, Transcript of20 May 2015, pp. 21-22. 275 Testimony ofGhattas El-Khoury, Transcript of20 January 2015 pp. 11-12.
238 R305459
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. Blue Network Activity: Surveillance ofRafik Hariri at Quraitem Palace
824. A combination of Blue phones ( [S5], [S7], [S6], [S8] and [S9]) were used throughout the afternoon and evening (13:00- 21:05) in the area surrounding Quraitem Palace consistent with surveillance.
825. Salim Ayyash ( ) received and made only two calls throughout that period connecting to Sfeir A, in the vicinity of his Hadath residence.
E. Green Network Activity: Only One Call between Salim Ayyash and Mustafa Badreddine
826. The only call of the day was made from Mr. Ayyash ( ) to Mr. Badreddine ( ) in south Beirut at 17:57 and lasted 27 seconds.
F. Selected Attribution Points for Salim Ayyash
827. Mr. Ayyash's phones (PMP 170, PMP 091, ) were relatively quiet but co-located at the "Sfeir" cells in the vicinity of his Hadath residence throughout the day. PMP 091 received calls from Mr. Ayyash's brother Mohammed, and also from [Redacted] (PRH 050).
239 R305460
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 2 February 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met with Walid Jumblatt
828. Former Prime Minister Rafik Hariri received several visitors at Quraitem Palace, amongst them was Mustafa Nasser (PRH476) (13:00) and Walid Jumblatt (PRH684) (17:50). 276
829. The final meeting between Mr. Hariri and Hassan Nasrallah had taken place late the previous night. Shortly before Mustafa Nasser's visit to Quraitem Palace, he received a lengthy call from Hussein Khalil. There was further contact between Mr. Nasser and the Palace later into the afternoon and evening.
B. Third Bristol Group Meeting
830. This was the day of the third Bristol Group meeting at which all those involved agreed that there should be total withdrawal of Syrian forces from Lebanese territory.. 277
C. Network Phone Activity: No Red or Green Phones in Contact with Each Other
831. This was another quiet day when the Red and Green phones were not used to contact each other.
D. Red Network Activity: Topping Up in Tripoli
832. In the evening, the six principal Red phones (and the two "reserve" Reds) were topped up with credit in the Tripoli area for the first and final time. Blue 817 [S8] called from that area to Blue 610 [S6] in Dahyieh shortly after the task had been
276 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380887-D0380888; Exhibit P303, Press Release, 02.02.05, Rafik Hariri reviews the situation with Jumblat, ERN D0004981- D0004981. 277 Testimony ofGhattas El-Khoury, Transcript of 16 January 2015, p. 37.
240 R305461
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
completed. The other four principal users of the Red phones also appear to have remained in Beirut.
833. The credit top-up of the Red phones in the same general area of Tripoli as their purchase and first use, as the purchase of the Red handsets, in the same area it was claimed Ahmad Abu Adass had travelled to on the day of his disappearance, and also where the Canter van was purchased, is inexplicable on the basis of coincidence.
834. The administration of the Red phones could have taken place, far more conveniently, in or near to their main area of use, in central or west Beirut (as was the case for the Green and Blue phones). This is consistent with Tripoli having been chosen as part of a calculated attempt to create a false impression of their users' (the co-conspirators') origin, far away from the focused area ofDahyieh in which they were actually based.
E. Blue Network Activity: Surveillance of Quraitem Palace
835. All of the Blue phones, except [S6] and [Ayyash], used cells in and around the vicinity of Quraitem Palace at least once over the course of the afternoon (11 :30-16:07). S6] appeared to play a co-ordinating role making contact with all but one of the principal six Blue Network users and other Blue phones as well.
836. Aside from its use in west Beirut and Tripoli, [S8] made a number of calls from the area of the crime scene to the base area in south Beirut. These took place early in the morning (to S6) and also in the evening (to Mr. Ayyash) at the end of the return journey from the north of Lebanon.
837. The last Blue calls of the day from [S8] to Mr. Ayyash ( ) took place between 20:34 and 20:44, with S8 connecting to a cell which had exceptionally small and specific predicted coverage in the immediate vicinity of the St. George's Marina where Mr. Hariri was due for a lunch engagement with Issam Fares the following day. In fact, over an extended period the next day prior to and during that engagement, both Red 946 [S7] and the Prime Minister's bodyguards made several calls connecting to that same small cell and a closely adjacent cell, respectively.
241 R305462
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
838. Mr. Ayyash's two other calls using in the afternoon were both with the base [S13].
242 R305463
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 3 February 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Visited Mufti Qabbani and Lunched with Deputy Prime Minister Fares at St. Georges Marina
839. Former Prime Minister Rafik Hariri visited Mufti Mohammed Qabbani (13:18-13:51) prior to having lunch with Deputy Prime Minister Issam Fares at 14:00 on his yacht in the StGeorge's Marina.278
B. Green Network Activity: Mustafa Badreddine and Salim Ayyash in Vicinity of Crime Scene/St George's Marina and Hierarchical Red/Green Phone Call Flow
840. In line with the recurrent pattern, the Green phones were used within the core of the Red call activity demonstrating the close involvement of Mr. Badreddine ( ) in the final surveillance and execution of the attack.
841. Like the previous day of Red Network operation (31 January) when Mr. Hariri had been followed back from the Higher Shiite Council, Mr. Badreddine ( ) was active not far from the crime scene.
842. Mr. Badreddine's first of four calls with Salim Ayyash ( ) took place shortly before Mr. Hariri was due to arrive at StGeorge's Marina.
843. Mr. Ayyash was connecting to MRAICI2 which provided coverage in and around the coastal road not far from the Marina and the crime scene. By the time of their last two calls, Mr. Badreddine had moved from south Beirut to use that same cell (MRAICI2) via the vicinity of the Parliament. Mr. Ayyash (Green 300, Red 741) had already spent 1 'iS hours connecting to that same cell.
278 Exhibit P303, Press Release of 03.02.05, Rafik Hariri visit to Mufti Qabbani, ERN D0004989-D0004990; Exhibit P471, Press Release of 03 February 2005, Fares receives Rafik Hariri, Tabbrah, El Sanyoura and Al Aridi, ERN D0004976-D0004976.
243 R305464
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
844. Their call on MRAICI2 took place within the currency of a call made from Salim Ayyash ( ) to S5 ( ) reflecting the close connection of Mr. Badreddine to the Red network's surveillance ofRafik Hariri.
845. Following this call near the Marina, which was around the time of Mr. Hariri's departure from his luncheon appointment, Mr. Badreddine's (SMP 944) next call (at 16: 15) connected to a cell in the vicinity of Quraitem Palace at around the same time that Mr. Hariri's security detail returned there (16:18).
846. There was no call activity at all on SMP 944 and PMP 663 between 14.42 and 17.44. The "pent up" SMS texts received on PMP 663 from 17:44 onwards indicate that at least one of Mr. Badreddine's other phones had been switched off over the period that he had travelled to meet Mr. Ayyash and then onto the Quraitem Palace area.
C. Red Network Activity: Surveillance ofRafik Hariri at St. George's Marina
847. All of the Red phones received network texts throughout the day, prior to or around the time of their first use, indicating that they had been turned off overnight. This was a consistent feature, and tends to explain how inadvertent incoming telephone contact associating them with Dahyieh was avoided.
848. [S7] and [S8] appear to have stationed themselves at the Marina over an hour before Mr. Hariri was due to arrive there. This was the same location that [S8] had visited the evening before when he had called [Ayyash].
849. [S5], [S6] and [S9] connected to cells in west Beirut, while Mr. Ayyash moved from there to connect to cells close to the Marina at around the same time as Mr. Hariri's convoy. He remained located close by at MRAICI2 while the lunch took place on the yacht. Red 946 [S7] and Red 893 [S8] connected to cells in the immediate vicinity of the Marina.
850. A flurry of five calls in a minute (15:36-15:37), initiated by S7 and S8, signposted that Mr. Hariri's convoy were preparing to leave the Marina. Three of those five calls were made to S5 positioned in the coastal road area near Quraitem Palace.
244 R305465
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
851. In the event, Mr. Hariri's convoy travelled back through the centre of Beirut. Three further Red calls (15:41-15:43) mainly involving Mr. Ayyash and S8 (still at the Marina) are consistent with communications regarding Mr. Hariri's return route. Within 10-15 minutes, by 15:58, the Red network had been shut down for the day, thereby tending to confirm that their principal focus was on the convoy and its return to Quraitem Palace.
852. Mr. Hariri's convoy remained in central Beirut for some time thereafter, returning to Quraitem by 16:18, by which time S5 and S9 were located in the vicinity of Dahyieh using their Blue phones.
D. Selected Attribution Points for Salim Ayyash
853. PMP 091 [Ayyash] was located on the familiar Sfeir cells around his Hadath residence, contacting Ghaleb Jaber (a business associate of Mr. Ayyash), until shortly before became active to the north of Dahyieh at 11 :42.
854. and co-located at MRAICI2 throughout the afternoon. During that period, neither nor his other phones were used.
855. Later in the afternoon, , PMP 091 and PMP 170 all co-located at Sfeir B in the vicinity of Mr. Ayyash's home. During that period, PMP 091 received a number of calls from a relative of Salim Ayyash's wife and subsequently made a call to his home landline.
E. Selected Attribution Points for Mustafa Badreddine
856. Mr. Badreddine's phones (SMP 944, PMP 663, ) co-located in Dahyieh until he moved up to meet Mr. A yyash during Mr. Hariri' s lunch at the Marina. PMP 663 was in contact more than once with [Redacted] (PRH089).
857. By the evening, PMP 663 and SMP 944 returned to co-locating in and around Mr. Badreddine's phones' most familiar area in Haret Hreik. SMP 944 received several calls from Mohammed Shukr (Samino) while PMP 663 was in contact with Zeina [Redacted].
245 R305466
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
858. Following the second of those calls, PMP 091 used the same cell site as not far from the airport road to contact the landline of Salim Ayyash's home in Hadath.
246 R305467
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 4 February 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met with Nasser Kandil to Discuss his Non-Inclusion in his Electoral List, then Travelled to Bahrain
859. Former Prime Minister Rafik Hariri received visitors at Quraitem Palace in the morning including, in close proximity, MP Nasser Kandil and Mustafa Nasser (PRH476). Mr. Kandil was logged as attending between 09:25 and 10:40.279 Mr. Kandil was very upset at not being included on Mr. Hariri' s electoral list and met with Mr. Hariri to discuss it. 280
860. The phone activity of Mr. Hariri's security detail is consistent with Mr. Hariri having later visited Marwan Hamade (PRH038) at his home (12:16-12:49) before returning to the Palace.
861. Mr. Hariri arrived at Beirut Airport around 17:05 to fly to Bahrain for a meeting with Bahrain's Prime Minister Sheik Khalifa Bin Salman Al-Khalifa before proceeding to Paris. 281 He remained out of the country until 7 February 2005.
B. Rustom Ghazaleh and Wafik Safa Took a Close Interest in Nasser Kandil's Meeting with Rafik Hariri
862. Rustom Ghazaleh and Wafik Safa appear to have taken a very close interest in the outcome of the meeting between Mr. Hariri and the rejected Syrian deposit, MP Nasser Kandil.
863. Immediately after Mr. Kandil was registered as leaving Quraitem Palace, he made a lengthy call to Rustom Ghazaleh (over 12 minutes), who was in Syria at the time. Within minutes of that call finishing, Mr. Kandil also contacted Mr. Safa. He had a
279 Exhibit P301, Visitor's Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380890. 280 Transcript of AtefMajdalani, Transcript of28 April2015, pp. 46-51. 281 Exhibit P346, Logbook Record ofRafik Hariri's Trips Abroad, ERN 60004129-600004136, at 600004136; Exhibit 303, Press Release of 04.02.05, Hariri meets with Prime Minister of Bahrain, ERN D0004970- D0004970.
247 R305468
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
further three calls with Mr. Safa over the course of the afternoon. This was exceptional behaviour: there had been no previous contact between Mr. Kandil and Mr. Safa in the previous five months. However after this day, they were in contact 11 more times over four more days prior to the attack.
864. Wafik Safa also had a lengthy call with Hussein Khalil in the afternoon. [Redacted].
C. Hussein Khalil Told Ahmad Nassir Al-Assaad to Convey Threat to Rafik Hariri That he would be forced to Include "Syrian Deposits" in his Electoral List
865. In the evening, [Redacted] Ahmad Nassir Al-Assaad [Redacted] met with Hussein Khalil in Dahyieh [Redacted]. 282
866. Mr. Khalil angrily directed him to tell the former Prime Minister that he would be forced to accept the Syrian deposits with a "foot over his neck" if he refused to do so voluntarily. 283 He stated that even Hassan Nasrallah could not refuse such a demand from the Syrians and, if Rafik Hariri thought he could hand over the country to Qomet Shehwan "we'll not allow it and we'll tum the country upside down ... [we have] not fought for 25 years to see" that happen. 284
867. [Redacted] .285
868. Later in the evening, Mr. Khalil had another lengthy call with Wafik Safa.
D. Blue Network Activity: Surveillance of Rajik Hariri at Marwan Hamade's Residence, Quraitem Palace and the Airport
869. This was another day on which surveillance was undertaken of Mr. Hariri' s travel on the airport road (see also 29 January and 7 February).
870. The movement of Blue 324 [S7] was consistent with following Mr. Hariri to his apparent meeting with Marwan Hamade, and reporting back to Blue 610 [S6] in Dahyieh. During this time, Blue 585 [S5] was also in the general area of Quraitem
282 [Redacted]. 283 [Redacted]. 284 [Redacted]. 285 [Redacted].
248 R305469
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Palace. Later in the afternoon, [S5], [S6] and [S9] were located in the immediate vicinity of the crime scene.
871. Shortly before 17:00, [S5] and S7] were engaged in surveillance of Mr. Hariri's travel to the airport, apparently updating S6] in Dahyieh, while [S8] remained in the vicinity of the Palace. S6] joined [S5] and S7] to use cells in the immediate surrounds of the airport after the former Prime Minister's arrival there. They subsequently made a brief return to west Beirut before going back to Dahyieh.
872. In the last of only two calls on this day, [Ayyash] contacted S6] on S6's return journey back to Dahyieh.
E. Purple Phone Activity: Final Inter-Purple Call before 14 February
873. At 14:53, Assad Sabra ( ) called Hassan Merhi ( ) from a cell (AICHA1) in central Beirut not far from the third of four payphones used in the false claim of responsibility in the hours after the explosion.
874. Call activity in 2005 involving [Sabra] being cell sited in central/west Beirut was very unusual and occurred only on three other days. One of those was 25 January when he was also in contact with [Merhi] from ETOILEl in the vicinity of Al Jazeera's offices and the tree from which the false claim of responsibility video was collected.
875. This was the first inter-Purple call since 26 January, and the final one before those made in the hours after the explosion.
249 R305470
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 5 February 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
876. Former Prime Minister Rafik Hariri was in Manama, Bahrain attending the "Eleventh Forum of the Private Sector Meeting for the Promotion of Trade and Joint Projects among Islamic Countries". 286
B. Network Phone Activity: Quiet Day Coinciding with Rafik Hariri's Absence
877. This was a very quiet day coinciding Mr. Hariri's absence from Lebanon. With the plot at an advanced stage, and Mr. Hariri absent, there was no Red or Green call activity at all and very limited Blue activity in and around Dahyieh.
C. Hassan Merhi ( ) & Salim Ayyash (PMP 091) in Rare Contact
878. At 12:17, Hassan Merhi ( ) contacted Salim Ayyash (PMP 091), who was in the Nabatiyeh area. This was the first of two consecutive days that they were in contact.
879. Telephone contact between them was rare during the indictment period (eight calls in total), and never using their Green phones. It was only the third day of four in the indictment period that they were in contact, and the first since 23 January 2005. Therefore, it was even more unusual that there was also a further four calls exchanged between them the following day.
880. On the previous day to this one, Mr. Merhi had received his final inter-Purple call before the false claim was put into motion following the attack; that call was from Assad Sabra (Purple 018). His last ever Green call with Mustafa Badreddine was only two days away thereby tending to indicate that the preparatory elements
286 Exhibit P346, Logbook Record ofRafik Hariri's Trips Abroad, ERN 60004129-600004136, at 600004136; Exhibit P303, Press Release of 05.02.05 - Hariri addressed the Private Sector Forum in Islamic Countries Held in Bahrain, ERN D0004966-D0004969.
250 R305471
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
necessary to discharge his role m enacting the false claim were neanng or at completion.
D. Rustom Ghazaleh 's Final Visit to Haret Hreik
881. Rustom Ghazaleh again travelled to Haret Hreik (in or around the Hezbollah General Secretariat) following contact with Wafik Safa. This was his final visit before the assassination.
882. Mr. Safa made initial telephone contact with Mr. Ghazaleh early in the afternoon. A few hours later he made another call to Mr. Ghazaleh, a short one, which appears to have prompted them to meet.
883. Within an hour, by 19:20, Mr. Ghazaleh's phone had moved from Chtaura and was co-locating with Mr. Safa's phone using cells in the immediate vicinity of the Hezbollah General Secretariat. Both phones remained in the area for around an hour during which neither phone was active from 19:29 to 19:57.
884. Before travelling to Dahyieh, Mr. Ghazaleh had been in Syria in the morning and then Chtaura and Anjar where he had made a lengthy call to the rejected Syrian deposit MP Nasser Kandil.
885. After Rustom Ghazaleh's visit to Haret Hreik, Hussein Khalil made a seven minute call to Mr. Safa.
E. Selected Attribution Points for Salim Ayyash
886. Mr. Ayyash's phones (PMP 091, PMP 170, ) spent the day co-locating on cells in the Nabatiyeh area, in and around his Harouf residence and workplace, principally Nabatiyeh C and Kfarsir A. PMP 091 contacted, among others, his brother Ali Ayyash (shortly before its contact with Hassan Merhi). By 22:44, Blue 233 was using a cell in Sfeir in the immediate vicinity of Mr. Ayyash's residence in Hadath.
251 R305472
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 6 February 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Abroad
887. Former Prime Minister Rafik Hariri was in Paris on a private visit. 287
B. Contact ofRustom Ghazaleh & Wafik Safa with Nasser Kandil
888. There were further calls between Rustom Ghazaleh and Nasser Kandil, the rejected "Syrian deposit". The last of those calls, at 23:03, was lengthy.
889. Shortly afterwards, Mr. Kandil called Wafik Safa for over six minutes continuing the unusual contact between these two men which had started two days before, after Mr. Kandil had met Mr. Hariri at Quraitem Palace. Immediately thereafter, Mr. Safa made a short call in Haret Hreik to the "Hassan N asrallah" subscribed landline.
C. Network Phone Activity: Quiet Day Coinciding with Rafik Hariri's Absence
890. The lull in Network call activity continued in line with Mr. Hariri's absence from Lebanon. There was no Green or Red activity, only seven Blue calls and only one between the principal six Network phone users who had previously been exceptionally active. Salim Ayyash ( ) made only one call, to the base [S13].
891. On Rafik Hariri' s return the following day the contrast was equally striking: it was the second busiest day of Blue call activity in the indictment period.
287 Exhibit P346, Logbook Record ofRafik Hariri's Trips Abroad, ERN 60004129-600004136, at 600004136.
252 R305473
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. Hassan Merhi ( ) & Salim Ayyash (PMP 091): Second Consecutive Day & Last of their Unusual Contact before Attack
892. Shortly after Mr. Ayyash's call to the base [S13], Hassan Merhi ( ) and Mr. Ayyash (PMP 091) exchanged a series of four calls (16:51 - 18:59).
893. After the fourth and final call, which was extremely brief, lasting only seven seconds, neither man made or received calls for more than three hours.
894. These were the final four calls of only eight that had been made between them over the indictment period. This was the day preceding Mr. Merhi's final call to Mr. Badreddine, and two days before the date of the final rehearsal. Ahmad Abu Adass had been missing for almost three weeks.
895. It is also notable that both (Merhi) and PMP 091 (Mr. Ayyash), during their series of calls with each other, made contact with a number attributable to the Great Prophet Hospital; all of them very short calls.
896. The same number was also used for short calls by the Yellow phones of the "Principal Six" (assassination unit), the Blue base phone ( ), Salim Ayyash's PMP 170, and Mustafa Badreddine (SMP 944) during the indictment period.
253 R305474
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 7 February 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Returned to Lebanon and Ahmad Nassir Al-Assaad Informed him of Hussein Khalil's Threat
897. Former Prime Minister Rafik Hariri returned to Beirut Airport from Paris at around 17:00, arriving back at Quraitem Palace shortly after 17:30.
898. Mr. Hani Hammoud [Redacted], Mr. George Bekassini, and Mr. Ahmad Nassir Al Assaad [Redacted] visited Mr. Hariri at Quraitem Palace.288 Mr. Al-Assaad informed him about the meeting he had had on 4 February with Hussein Khalil during which Mr. Khalil had angrily directed Mr. Al-Assaad to pass on to the former Prime Minister that he would be forced to accept the Syrian deposits if he refused to do so voluntarily. 289
B. Hussein Khalil Visited Rafik Hariri to Reiterate that Mr. Hariri Should Include the Syrian Deposits on his Electoral List
899. Hussein Khalil travelled from Beirut to the Anjar/ Syrian border area amvmg at around 11:30. At 12:28, he contacted the "Hassan Nasrallah" subscribed landline while connecting to a cell providing coverage to the Syrian border. Thereafter, he had no telephone contact on a Lebanese network for over six hours until his phone connected to a cell in Chtaura at 18:35 to phone Khalil Farhat.
900. Mr. Khalil had returned to Beirut by 19:43 where, according to Hani Hammoud, he met with Mr. Hariri at Quraitem Palace and reiterated, this time directly, that the former Prime Minister should comply with Syrian demands to accept their deposits. 290
288 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380892. 289 Testimony ofHani Hammoud, Transcript of20 May 2015, pp. 26-27. 290 Testimony ofHani Hammoud, Transcript of20 May 2015, pp. 26-30.
254 R305475
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
901. The cell siting ofMr. Khalil's call to the "Hassan Nasrallah" subscribed landline, and the extensive period of his call inactivity on the Lebanese network, points to him having travelled into Syria.
C. Final Call between Wafik Safa & Rustom Ghazaleh
902. In the evening, at 20.53, Wafik Safa called Rustom Ghazaleh. This was their last telephone contact before the assassination. The next contact between their phones was on 16 February 2005.
D. Green Network Activity: Final Green Call ofHassan Merhi
903. This was the last day that Hassan Merhi was active on his Green phone.
904. Salim Ayyash ( ) made two calls to Mustafa Badreddine ( ): the first shortly after midnight, and a short call later in the morning.
905. Hassan Merhi ( ) made his final Green call to Mr. Badreddine only 15 minutes after Mr. Ayyash's second call.
906. Closely proximate Green calls received by Mustafa Badreddine ( ), from each side of the triangle operating hierarchically below him, was a pervading theme. The recurrent nature of it suggests that it was not coincidental.
E. Blue Network Activity: Surveillance of Rarfik Hariri at Airport and Quraitem Palace
907. Mr. Hariri's return to Lebanon coincided with a marked increase in Blue call activity. This was the second highest day of Blue call activity in the indictment period which was dominated by the "Principal Six" Network phone users.
908. In the morning, all the "Principal Six" Blue phones were active in Dahyieh. Blue 610 [S6] made a call to base Blue 501 [S13] from the immediate vicinity of the airport, and later spent four hours in the afternoon in the Saksakiye area maintaining contact with the Blue Network.
909. Three of the Blue Network phones (S5, S8 and S9) were active around the airport and the airport road at a number of points throughout the afternoon. Blue 817 [S8] and
255 R305476
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
[S9] were stationed using cells between Quraitem and the airport shortly before Mr. Hariri's security detail passed on its way to the Airport.
910. By 17:00, [S5], [S8] and [Ayyash] were sited in the immediate vicinity of the airport consistent with awaiting Mr. Hariri' s arrival at the airport and departure back to Quraitem. [S9] was positioned on the airport road half way back to the Palace while [S8] appears to have moved to a location covering the route back to the Palace prior to the convoy leaving the airport. The phones moved up to Quraitem Palace in a manner consistent with the surveillance of Mr. Hariri and his convoy.
911. Surveillance around Quraitem Palace appears to have been sustained throughout the evening until 22:26 by which time only [S6] and [S7] remained. [S6] had earlier in the evening been located making calls from the area surrounding the StGeorge's tunnel.
F. Hassan Nasrallah, Syria & UNSC Resolution 1559
912. On the eve of Rafik Hariri's meeting with Terje Roed-Larsen, the UN Special Envoy for the Implementation of UNSCR 1559, a large gathering of Pro-Syrian loyalists met at Ain-El-Tineh to demonstrate their support for Syria and condemn foreign interference in Lebanese affairs.291 Among the attendees were Prime Minister Omar Karami, Deputy Prime Minister Issam Fares, and Hassan Nasrallah.
913. Hassan N asrallah addressed the gathering and, amongst other things, condemned UNSCR 1559 as "an attempt to politically invade" Lebanon and "achieve what previous military invasions had failed to achieve". 292
G. Selected Attribution Points for Salim Ayyash
914. In the morning and early afternoon, when not undertaking surveillance duties, and again in the late evening, Mr. Ayyash's phones (Green 300, Blue 233, PMP 091,
291 Exhibit P532, UNIC Press Review of8 February 2005, ERN D0410891-D0410898, at D0410893. 292 Exhibit P532, UNIC Press Review of8 February 2005, ERN D0410891-D0410898, at D0410894.
256 R305477
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
PMP 170) were used in the area around his Hadath residence. They co-located and demonstrated singular movement (see 16:30-17:45) throughout the day.
257 R305478
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Tuesday, 8 February 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Went to Parliament, Met with UN Special Envoy Roed-Larssen & Marwan Hamade
915. Former Prime Minister Rafik Hariri attended a Parliamentary session, travelling from Quraitem Palace to arrive there at or shortly after midday. 293 He left the Parliament area around 13:25, arriving back at the Palace by 13:39.
916. In the evening, between 20:25 and 21:25, Mr. Hariri met with Terje Roed-Larsen, the UN Secretary General's Special Envoy for the Implementation of Security Council Resolution 1559. 294
917. The phone activity of Mr. Hariri' s security detail is consistent with him having visited Marwan Hamade's (PRH038) residence immediately afterwards for about one and a half hours.
B. Red, Green & Blue Network Activity: Rehearsal for the Attack
918. All three networks were highly active for what appeared to be a "Rehearsal" for the assassination. The behaviour of the Red and Blue phones bore a strong similarity to their activity on the day of the attack, six days later, which was the next occasion that Mr. Hariri attended the Parliament. The significant exception was the absence of S6, Salim Ayyash's deputy, who was in south Lebanon for the first part of the surveillance period.
293 Exhibit P303, Press Release of 08.02.05, Hariri's information office explains his meeting with Berri, ERN D0004991-D0004991; Exhibit P540, Minutes of Parliamentary Joint Committee Session of 8 February 2005, ERN 10012110-10012113 (including announcement of 3 February 2005 that the session would be held). 294 Exhibit P303, Press Release of 08.02.05, UN Secretary General's Envoy Terje Toed Larsen meets with Lebanese Officials, ERN D0004985-D0004986; Exhibit P532, UNIC Beirut Press Review, 09 February 2005, ERN D0410996-D0411006; Exhibit P301, Visitors Logbook for Quraitem palace, ERN D0380523-D0380905, at D0380894.
258 R305479
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Blue Surveillance of Rafik Hariri: Quraitem Palace to Parliament
919. [S5], [S8] and [S9] were all located around Quraitem Palace before Mr. Hariri's convoy left for Parliament. Salim Ayyash ( ), as he did on the day of the attack, made his way directly to the Parliament area. Around the time the convoy departed, S8 and S9 called ahead to his phone.
920. S5, S8 and S9 followed the convoy to Parliament and continued to use their Blue phones in the vicinity. It was not until aproximately 30 minutes later that S5, S8 and Mr. Ayyash switched on their Red phones there: a clear indication in addition to S6's absence that this was indeed a rehearsal and not the intended day of the attack.
Movement in Concert from Dahiyeh to Crime Scene
921. S9 moved down to south Beirut and then moved back up to central Beirut in concert with S7, contacting each other as they travelled, first using their Blue phones and then their Red phones. This movement up occurred five minutes before 13:00, and is strikingly similar to the timing and movement of S7 and S5 (who also moved up in concert) in the moments before Mr. Hariri emerged from Parliament on 14 February.
Mraijeh A: Originating Location of the Movement to the Crime Scene Area
922. A further remarkable similarity was the use of an unusual cell, Mraijeh, A by S5 or S7 (on this occasion by [S7] for five calls) around an hour before their movement in concert up to central Beirut and switching to the Red phones.
923. S5 and S7 only connected to Mraijeh A on very limited days, principally in early February. The following day they did so again, significantly, leaving a period of Red surveillance to do so.
924. On 14 February, the same cell was used twice by S5 (Blue 324) around an hour before he moved up in concert with S7 and they turned on their Red phones. In short, it appears to have been a designated originating location for the movement from south Beirut that led to the components of the suicide LVBIED (the bomb and the suicide bomber) arriving at the Crime Scene.
259 R305480
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
RASNAB 1: The Switch from Blue to Red
925. The first cell connected to by [S7] as it was turned on, upon entering central Beirut, was RASNAB 1 to call [S9] which connected to SODEC03, an adjoining cell. [Ayyash] also connected to RASNAB1 less than a minute later. By the time of S7's next call, again with S9, they were both cell sited at ZOUKAKl, not far from the Marina tunnel exit, between the Parliament and the Crime Scene. This cell was where Mr. Ayyash was also sited at the time.
926. On 14 February, this pattern was replicated precisely except it was S5 (and not S9) who moved in concert with S7 from Dahyieh into central Beirut switching from using their Blue to Red phones in the Ras Nabeh area.
927. On this, the "rehearsal" day, Mr. Ayyash took time to actually move down away from the Parliament area, to connect to RASNAB1 as S7 arrived at it thereby tending to reinforce the designated significance of the area in the movement to the crime scene.
Red & Green Surveillance of Rafik Hariri: Parliament to Quraitem Palace
928. Around the time that Mr. Hariri emerged from Parliament and returned to the Palace, the entire Red Network were cell sited in the areas surrounding the Parliament, and there followed extremely intense, co-ordinated call patterns: 20 calls in 32 minutes (13:07-13:39). Of these, 12 calls took place within 14 minutes when Mr. Hariri left Parliament. Mr. Ayyash ( ) was involved in half of them. Only Mr. Ayyash appears to have followed the convoy back to Quraitem Palace.
929. On the convoy's arrival back at Quraitem Palace, Mr. Ayyash ( ) immediately called Mustafa Badreddine ( ).
930. The Red phones continued to be located between the Parliament, Crime Scene and Quraitem Palace making bursts of frequent calls for a further five hours, before the users switched to their Blue phones and returned to their base area. During this period, another call took place between Mr. Ayyash and Mr. Badreddine on their Green phones. Mr. Ayyash and S8 returned to Dahyieh before the rest of the group.
260 R305481
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
C. Blue Surveillance ofRafik Hariri: Visit to Marwan Hamade
931. [S8], [S7], [S5] and [S6] returned to west Beirut later in the evening where S5 and S6 were located in the vicinity of Marwan Hamade's home during the Prime Minister's visit. From this location, S6 received two calls from Mr. Ayyash who was in Dahyieh.
D. Subject 6 Travelled to South Lebanon During Rehearsal
932. S6 was located around Saksakiye when the Red phones began to operate around Parliament at 12:24. By the time S7 had arrived at the Ras Nabeh staging post preparing for entry to central Beirut, S6 had travelled to Beirut but was still in Haret Hreik.
933. By the time S6 switched on his Red phone at 13:25, Mr. Hariri had left Parliament.
934. The principal six conspirators responsible executing a very complex task had an important opportunity to practice the coordination of the attack because Mr. Hariri was at Parliament as he was on the day of the attack. That S6, evidently a senior figure amongst them, was mostly preoccupied elsewhere underlines (along with other features e.g. use of Blue phones en-route from Quraitem Palace and around Parliament) that this day was a rehearsal rather than the intended day of the attack.
E. Selected Attribution Points for Salim Ayyash
19. Mr. Ayyash was in south Beirut until he moved up to the Parliament area just before noon. PMP 170/PMP 091 and I co-located in each location, respectively.
20. After following Mr. Hariri back to Quraitem Palace, «.eu t'+l co-located with \Jreen 300 in that area, and a short while later also with PMP 091, also in west Beirut, when it received a call from Mr. Ayyash's business associate Ghaleb Jaber.
21. After his first call with Mr. Badreddine, Mr. Ayyash did not remain long in central/ west Beirut with the other Red phones. He moved down to the same area of Dahyieh as Mr. Badreddine: they connected to adjacent cells for their second Green call. Mr.
261 R305482
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Ayyash (PMP 091) then returned back to the vicinity of the Coastal Road near the Crime Scene.
935. PMP 091 and , at this time of the day the only two of Mr. Ayyash's phones involved in call activity, returned to Dahyieh by 16:32 where they remained for the day. PMP 091 had contact with two relatives of Salim Ayyash and his wife in the morning and the afternoon.
F. Selected Attribution Points for Mustafa Badreddine
22. Mr. Badreddine remained in Dahyieh until around 18:00 where his phones ( , SMP 944, PMP 663) co-located around their dominant cell, ROUEIS3. PMP 663 was in contact with Zeina [Redacted] five minutes before the second call from an immediately adjacent cell to ROUEIS3. By 18:38, SMP 944 (call with Samino associate Mohammed Shukr) and PMP 663 (call with [Redacted] (PRH089)) were travelling to his Sahel Alma apartment in Jounieh staying in that area until after midnight.
262 R305483
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Wednesday, 9 February 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace
936. Former Prime Minister Rafik Hariri received several visitors at Quraitem Palace throughout the day. 295
B. Green, Red & Blue Network Activity: Surveillance of Rafik Hariri at Quraitem Palace
937. This was a day on which Green, Red and Blue Network phones were all used. It was the first of only two days on which Red (rather than Blue) phones were used to undertake static surveillance around Quraitem Palace consistent with the pre determined imminence of the attack.
938. Between 8 and 14 February, the Red phones were used with greater regularity than ever before (every day bar one) regardless of Mr. Hariri' s movements. This is entirely consistent with their apparent purpose: to execute the attack anonymously; leave a clear forensic footprint or trail over a limited period prior to the attack that would ultimately point towards Tripoli and conceal any link to their users' true base in the heart of Dahyieh.
939. The Blue Network phones were used in south Beirut in the morning, prior to [S8], [S9], and [Ayyash] moving up to the area around Quraitem Palace.
940. Between 13:16 and 18:13, all of the Red phones were used in the area around Quraitem Palace. Those calls were interspersed by a call to Mustafa Badreddine (Green 023) from Salim Ayyash (Green 300).
295 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380894-D0380895.
263 R305484
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
941. For a short period in the evening (21:01-21:45), S5, S6, S7 and S9 also used their Red phones in the same area; S8 and Mr. Ayyash had returned to south Beirut.
C. Subject 5 & Subject 7 Leave Red Surveillance to Visit Mraijeh_A
942. At 14:41, during Red phone surveillance around Quraitem Palace, [S5] called [Ayyash]. Shortly after this call, Mr. Ayyash made his last call for six hours until21 :04, and S5 and S7 also left the other "Principal Six" Red Network users and headed to an unusual part of Dahyieh.
943. Between 15:28 and 16:31, and although the Red network remained active around Quraitem Palace, S5 and S 7 switched from their Red to Blue phones and returned to Dahyieh. They co-located on the same, unusual cell (MraijehA) that S5 would use an hour before their movement to the crime scene on the day of the attack, and that S7 had also used more than once an hour before the convoy reached central Beirut on the day of the rehearsal (8 February- when it was S7 and S9 in convoy).
944. S5 and S7 did not make another call for almost two hours until 18:11, by which time they had returned to west Beirut (where the other Red phones had remained active) and resumed using their Red phones.
D. Selected Attribution Points for Salim Ayyash
945. and PMP 091 co-located in south Beirut around midday, around which time PMP 091 called Mr. Ayyash's home landline three times. That phone also had contact during the day with business associates/ relatives of Mr. Ayyash: Ghaleb Jaber and Hussein Zaarour. Thereafter, and all connected to cells in west Beirut, before PMP 170 moved south at about 14:50.
946. Exceptionally, there was no call activity at all on any of his phones for over six hours until 21:04, by which time he was located around his home and Blue 233, PMP 091 and PMP 170 co-located on the same and adjacent cells over the following hour.
E. Selected Attribution Points forMustafa Badreddine
947. Mr. Badreddine's phones (Green 023, PMP 663, PMP 354, and SMP 944) co located in and around his most dominant cell (ROUEIS3) during the afternoon where,
264 R305485
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
amongst others, PMP 663 contacted [Redacted] (PRH089). After 20:00, SMP 944 and PMP 663 co-located in the vicinity of his Sahel Alma apartment in the Jounieh area before he returned to south Beirut where SMP 944 was contacted by Ali Fayez Harb, the registered owner of his Samino stores.
265 R305486
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Thursday, 10 February 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri at Quraitem Palace and Visited Maronite Archbishop in Achrafiyeh
948. Former Prime Minister Rafik Hariri received several visitors at Quraitem Palace between 08:00 and 21:00. 296 He visited the Maronite Archbishop of Beirut in Achrafiyeh between 09:19 and 10:55. 297
B. UN Special Envoy Roed-Larsen Visited President Al-Assad in Damascus
949. Terje Roed-Larsen, the UN Special Envoy, visited President Al-Assad in Damascus to discuss the implementation of Security Council Resolution 1559. 298
C. Red & Blue Network Activity: Surveillance ofRafik Hariri at Quraitem Palace
950. All of the Red phones (except Mr. Ayyash's ) were used around Quraitem Palace for approximately three and a half hours in the early afternoon (12:09-15:46). [S6] 's first call of the day was in the area of the crime scene. It was a light day of Blue activity, the phones were used mainly in the morning and evening in south Beirut and to communicate with the base area in south Beirut from west Beirut.
951. Mr. Ayyash's two calls with [S6] around 01:00 were short. For the second of these calls, S6 connected to the unusual cell, LA YLAK1 that provided virtually co-terminous predicted coverage to the MTC Touch cell Mraijeh A.
D. Salim Ayyash Unusually Inactive on his Network Phones
952. Aside from two calls with Blue 610 [S6] in the hour after midnight, Mr. Ayyash did not make one telephone call on any of his three Network Phones besides a call to a
296 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380895-D0380897. 297 Exhibit P303, Press Release of 10 February 2005, Hariri Visited the Archbishop Matar in Ashrafieh, ERN D0004977-D0004979; Exhibit P299, Rafik Hariri's 2005 Agenda Book, ERN 60142137-60142180, at 60142171. 298 Exhibit P532, UNIC Beirut Press Review, 11 February 2005, ERN D0411160-D0411170.
266 R305487
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
service number using . This was despite the Blue and Red network phones being otherwise operational.
953. Accordingly, it was also the only day when a Green call was not made during a day when the Red phones were inter-active.
E. Last Contact between Salim Ayyash & Subject 816 Before Night of 13 February
954. PMP 170 [Salim Ayyash] called Subject 816 (3151816) in the evening.
955. This was their first call since the morning of 27 January when Mr. Ayyash's closely related pattern of calls with Subject 816 and [S9], and the related concentrated call activity of [S9] at the East of Airport cells, had both ended.
956. This was also their last contact before their series of calls that extended from the night of 13 February 2005 through the early hours of 14 February 2005 and into the period when Salim Ayyash travelled to the Parliament area/ crime scene shortly before the assassination.
957. Half an hour after the call to Subject 816, Mr. Ayyash received the first of six calls that he exchanged with an unattributed Syrian number until shortly before midnight. None of his five phones had previously had contact with this number.
958. PMP 091 [Ayyash] received the first of those calls, but Mr. Ayyash's covert phone (PMP 170) was used to immediately call back (from the same area of Dahyieh in the vicinity of Mr. Ayyash's home in Hadath) and was also used for the four other calls. PMP 091 had contact throughout this day with Salim Ayyash's brother, Ali Ayyash.
F. "False Claim ofResponsibility" Activity: Telecarte Purchased
959. The Telecarte used to make the "false claim" calls to Reuters and Al Jazeera was sold on this day from the Ministry of Telecommunications Office in Nahr near Sukleen. 299
299 Exhibit P563, R155 Witness statement of PRH048, ERN 60294370-60294400.
267 R305488
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Friday, 11 February 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met with UN Special Envoy Roed-Larsen who Warned Rafik Hariri ofPresident Al-Assad's Threats
960. Former Prime Minister Rafik Hariri received visitors at Quraitem Palace throughout the day?00
961. On the previous day, Terje Roed-Larsen, the UN Special Envoy, had visited Syrian President Bashar Al-Assad in Damascus to discuss the implementation of Security Council Resolution 1559. 301
962. On this day, Mr. Roed-Larsen insisted on visiting Quraitem Palace before returning to Europe (even keeping his flight waiting at the airport) so as to inform Rafik Hariri of President Al-Assad's "very angry" threats and to warn him to leave Lebanon for his own safety. 302
B. Green Network Activity: Salim Ayyash and Mustafa Badreddine in Multiple Contact
963. There were three calls in the afternoon. In the first, Mr. Ayyash ( ) called Mr. Badreddine ( ) from the Crime Scene area, during the heart of the core Red activity as part of the typical Red/ Green pattern.
964. The other two calls were initiated by Mr. Badreddine. The first of those two calls occurred half an hour after Mr. Badreddine had connected to the unusual Mraijeh A cell which featured on the day of the rehearsal and the assassination itself.
300 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380897- D0380899. 301 Exhibit P532, UNIC Beirut Press Review, 11 February 2005, ERN D0411160-D0411170. 302 Testimony of Marwan Hamade, Transcript of 8 December 2014, p. 63. See also Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380898.
268 R305489
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
C. Red Network Activity: Surveillance of Rafik Hariri at Quraitem Palace; Salim Ayyash at Crime Scene/ Parliament area
965. In line with previous days, the Red phones were used in and around Quraitem Palace throughout the day (11 :46- 17:45). This activity was confined to [S7], [S8], [S9] and [A yyash]. Mr. Ayyash also spent time around the crime scene and Parliament and then left the group to move down towards the north of the Airport at 13:28.
D. Red Phones Travelled to Tripoli
966. [S6] was sited in the area of Tripoli and towards the northern border of Lebanon for six calls over a period of an hour and a half until 13:41. [S5] was also located in the area for one call from S6, both were connecting to the same cell north of Tripoli. This was the only call S5 was involved in all day.
E. Mustafa Badreddine at Unusual Mraijeh_A Cell
967. For the second successive and final day before the attack, PMP 663 [Badreddine] connected to Mraijeh_A which, aside from the previous day, it had not otherwise previously used in the indictment period.
968. Mraijeh A was the same cell at which either S5 or S7 or both of them had been sited for three consecutive days up to 9 February, and the same one that featured at the very origin of their movement to the Crime Scene during the rehearsal on 8 February and again during the assassination on 14 February.
969. At 14:18, following a half an hour period of call inactivity, PMP 663 [Badreddine] was sited there for two calls, one of which was with Zeina [Redacted], before moving away.
F. Selected Attribution Points for Salim Ayyash
970. Shortly after midday, Red 741 and PMP 091 co-located near the crime scene and then Green 300 and Red 741 co-located near to Parliament. Later in the afternoon, Green 300, Blue 233 and PMP 091 also co-located at an unusual area north of the
269 R305490
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Airport. Whilst in that area, at 14:58, PMP 091 was called by Salim Ayyash's business associate and relative Hussein Zaarour.
971. From the late afternoon through to midnight, , PMP 091 and PMP 170 were all co-located at Mr. Ayyash's familiar cells (SfeirA and Hadath C). He had calls on PMP 091 with both Hussein and Ali Zaarour over this period, and another of his business associates, Ghaleb Jaber.
G. Selected Attribution Points for Mustafa Badreddine
972. In the early hours, SMP 944 and PMP 663 were located at Mr. Badreddine's most dominant cells (ROUEIS3 and Hai Kneisse C). Throughout the afternoon, SMP 944 and PMP 663 remained in the same area co-locating with and PMP 354. Over this period, SMP 944 was in contact with his Samino associate, Mohammed Shukr, and PMP 663 with his friends Zeina [Redacted] and [Redacted] (PRH089).
973. By 16:15, SMP 944, PMP 663, and were co-locating in another part of Dahyieh, a little further east, when PMP 663 was contacting, amongst others, "Jad". By 18:31, PMP 663 had begun to move up to use cells in the area of his Sahel Alma apartment, where it was sited until 01 :20, reflecting the familiar pattern of Mr. Badreddine's phones.
270 R305491
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Saturday, 12 February 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Attended Funerals at Sacre Coeur and Mar Michael Churches then Visited the Beirut Association for Social Development
974. Former Prime Minister Rafik Hariri attended a funeral at Sacre Coeur Church, Badaro in the morning, arriving by 10:48. 303 He left there around 11 :00 to attend the funeral of Atef Majdalani's (PRH491) aunt at Mar Michael Church. 304 He had returned to Quraitem Palace by 11 :24.
975. In the afternoon, Mr. Hariri visited the Beirut Association for Social Development in Verdun for around two hours from 14:00, after it was raided following allegations of electoral misconduct. 305 The Prime Minister had returned to Quraitem Palace by 16:11.
B. Green & Red Network Activity: Last Day of Red Activity before Attack and Hierarchical Red/Green Call Activity during Surveillance ofRafik Hariri
976. This was the last day of Red call activity before the attack, and one of the busiest Green days. There was a strong presence of Red call activity in the Faraya/ Zouk Mosbeh area throughout the day.
977. The period of Red operation stretched over 8 'iS hours (10:08-18:48) and was divided between the Network's presence in Faraya, and morning surveillance in Beirut.
978. The movements of [S6] and [S9] were consistent with surveillance of Mr. Hariri's convoy from Quraitem Palace to both funerals. Salim Ayyash arrived at Sacre Coeur Church from south Beirut rather than from Quraitem Palace after a call
303 Testimony of Ghazi El-Youssef, Transcript of 12 March 2015, pp. 109-111; Exhibit P299, Rafik Hariri's 2005 Agenda Book, ERN 60142137-60142180, at 60142173. 304 Testimony of Ghazi El-Youssef, Transcript of 12 March 2015, p. Ill; Testimony of Atef Majdalani, Transcript of28 April2015, pp. 54-55. 305 Testimony of Atef Majdalani, Transcript of 28 April 2015 pp. 55-56; Testimony of Ghatas Khoury, Transcript of 20 January 2015, p. 33; Exhibit P089, Photo of Hariri at Tenmiya, 12 February 2005, ERN D0004529-D0004533; Exhibit P303, Press Release of 12 February 2005, ERN D0004992-D0005002.
271 R305492
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
from [S6]. Mr. Ayyash used his in that vicinity for the first time after Mr. Hariri' s security detail had left and remained there a short while.
979. [S9] was co-located with the phones of the security detail at both churches, while S6 appeared to circle south before moving back up to follow the convoy back to Quraitem Palace from Mar Michael Church.
980. All three Red phones returned to west Beirut and were joined there by [S7] from Faraya, while maintaining contact with S5 and S8 in the Faraya/ Faqra villa area. Just after 12:30, Mr. Ayyash ( ) was located on the coastal road near to the crime scene when he was first called by Mustafa Badreddine, remaining in that area for at least 20 minutes using his
981. Later in the afternoon, Mr. Ayyash ( ) moved up to be sited in the immediate vicinity of the Zouk Mosbeh slip road (where he was joined by [S7]) and remained there for over three hours where he had three further calls with Mr. Badreddine, as Mr. Badreddine moved up from Dahyieh to Jounieh.
982. [S6] remained in contact with Mr. Ayyash throughout this period from the vicinity of Quraitem Palace, and it was after a call with him at 17:07 (that took place simultaneously with a Green call to Mr. Badreddine) that Mr. Ayyash called the other Red users consistent with instructing the others to stand down and return to Beirut. Shortly after Mr. Ayyash's calls, the Red phones ceased activity for the day.
C. Selected Attribution Points for Salim Ayyash
983. In the morning, was sited at Sfeir B in the area of Mr. Ayyash's Hadath home. As Mr. Ayyash moved towards (and then past) Sacre Coeur Church,
and ~· ~~ .. ~vv connected to neighbouring cells demonstrating singular movement as he made his first Green call of the day with Mr. Badreddine.
984. After Mr. Ayyash had followed Mr. Hariri back to Quraitem Palace, Blue 233 and Red 741 co-located within its vicinity. Red 741 also co-located with Green 300 on the coastal route near the Crime Scene for the second Green call of the day.
985. Over the course of the mid-afternoon at the Zouk Mosbeh tum-off, Red 741 [Ayyash] repeatedly co-located with Green 300 on the same and adjacent cells as he updated
272 R305493
STL-11-01/T/TC Version 1.2: 20/11/20 17 - Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Mr. Badreddine. By 19:00, and PMP 091 were using familiar and adjacent cells around his home in Hadath; one of those calls was made to his home landline.
D. Selected Attribution Points for Mustafa Badreddine
986. In the morning, Mr. Badreddine's phones ( , PMP 663, SMP 944) co- located on his most dominant cells (ROUEIS3 and Hai Kneisse C) at the time of the first Green call. Those phones remained sited in Dahyieh continuing to co-locate in the same area by the time of the second and third Green calls in the early afternoon.
987. PMP 663 had contact with Mr. Badreddine's University associate, Malak El-Baba (who knew him as "Safi Badr"), eight minutes before the third Green call when and PMP 663 co-located on cells immediately adjacent to each other.
988. PMP 663 and SMP 944 continued to co-locate in the mid-afternoon before PMP 663 moved up to the vicinity of the Samino store in Fum el Chebbak. PMP 663 and SMP 944 had contact with Mr. Badreddine's bodyguard Jad, the Samino store in Mar Elias, and his Samino associate Mohamed Shukr respectively.
989. Between 16:21 and 19:24, , SMP 944, and PMP 663 were all sited in the Jounieh area in the vicinity of his Sahel Alma apartment where PMP 663 received two calls from [Redacted] (PRH089) and had further contact with "Jad", his close female friend Zeina [Redacted], and his [Redacted].
273 R305494
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Sunday, 13 February 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
A. Rafik Hariri Met with Basel Fuleihan who Warned him of Threats from the Syrian Regime
990. Former Prime Minister Rafik Hariri received visitors at Quraitem Palace throughout the day, including Walid Jumblatt (PRH684), Marwan Hamade (PRH038), Ghazi Al Aridi, Ghattas El-Khoury (PRH242), Basel Fuleihan, and Hani Hammoud (PRH052). 306
991. During a meeting with Mr. Fuleihan and Dr. El-Khoury, Mr. Fuleihan warned the former Prime Minister of threats against his life and other senior Lebanese politicians from the Syrian regime. 307
B. Yahya Al-Arab Made an Exceptional Additional Payment to Rustom Ghazaleh and Became Very Concerned for Rafik Hariri's Life
992. In the morning, at around 10:00, Yahya Al-Arab visited Rustom Ghazaleh in Anjar at his request. Mr. Ghazaleh had made an unusual request that he receive an additional payment in February from Mr. Hariri. 308 During the meeting Mr. Ghazaleh was very insulting and threatening towards Mr. Hariri causing Mr. Al Arab to fear an attempt on the former Prime Minister's life. 309 Mr. Hariri, Dr. El-Khoury, and Mr. Al Arab had a meeting about the visit following Mr. Al Arab's return. 310
C. Blue and Red Network Activity: No Red Activity and Limited Blue Activity
993. There was no Red phone activity on this day. This was also a very quiet day for the Blue phones, even in the absence of Red call activity.
306 Exhibit P301, Visitors Logbook for Quraitem Palace, ERN D0380523-D0380905, at D0380903-D0380904. 307 Testimony ofGhattas Khoury, Transcript of20 January 2015, pp. 40-42 308 Testimony ofGhaleb El-Chammaa, Transcript of 11 February 2015, pp. 46-59. 309 Testimony ofGhattas Khoury, Transcript of20 January 2015, pp. 46-50. 310 Testimony ofGhattas Khoury, Transcript of21 January 20015, p. 8.
274 R305495
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
D. Subject 816 contacted Salim Ayyashfrom the "East ofAirport Cells" on the Eve of the Attack
994. Around 20:00-20:30, Mr. Ayyash (PMP 170) made two calls to Subject 816 who was sited using his familiar cells in the Bekaa valley. On the first of those calls, PMP 170 used a cell in the vicinity of the crime scene.
995. Within an hour of their second call, Subject 816 was using a cell on the outskirts of Beirut. At 22: 19, he used a cell in Haret Hreik to receive another call from Mr. Ayyash. Half an hour after that, Subject 816's cell use had moved slightly east to the vicinity of Mr. Ayyash's home in the Blue phones' base area.
996. These were the first of a series of eight calls between them ending shortly before the Red phones began to be used immediately before the attack.
997. In fact, from the evening of 13 February 2005 to his arrival in central Beirut prior to the attack, Mr. Ayyash's telephone contact was confined to Mustafa Badreddine (once), S5 (once), S6 (six times) and Subject 816 (eight times).
998. Prior to this night, there had been very select contact between Mr. Ayyash (PMP 170) and Subject 816. However, the contact they did have was closely linked with contact between Mr. Ayyash and [S9] and, particularly, S9's unusual call activity using two or three specific cells located east of Beirut Airport on the days before and after the purchase of the Mitsubishi Canter van.
999. Despite the proximity of their association, Subject 816 had not previously made calls using one of those three unusual "East of Airport cells". It did so, significantly, for the first time on this night, on the eve of the attack: nine hours before the attack.
1000. At 23:54 and again at 03:33, Subject 816 called Mr. Ayyash (PMP 170). On both occasions he was using two of those three adjacent cells: KARAME3 and AIB3.
1001. The calls, like much of S9's activity in that area, took place in the early hours of the morning; S9's calls from those cells in the early hours were also exclusively with Salim Ayyash (Blue 233).
275 R305496
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
1002. Salim Ayyash's (PMP 170) final two calls with Subject 816 prior to the attack took place on his way to the Parliament/ crime scene area from Dahyieh. After the first of those calls, Mr. Ayyash ( ) immediately contacted S5 ( ) who shortly thereafter, together with S7, formed part of the convoy that moved the suicide L VB lED to the crime scene.
E. Sequential Call Flow between Wafik Safa, Mustafa Badreddine and Salim Ayyash on the Eve ofAttack (the Penultimate Green call)
1003. At 23:01 and 23:05, senior Hezbollah security official, Wafik Safa called Mustafa Badreddine (SMP 944) twice. These were their last calls before the attack. The second call was very short (11 seconds). SMP 944 used OUZAI2, the contiguous cell to that being connected to by Mr. Safa (OUZAI3).
1004. Immediately after, at 23:07, Mr. Badreddine ( ) called Mr. Ayyash ( ). It was another short call (16 seconds). This was the penultimate Green call before the Green phones were discarded shortly before the attack.
1005. From thereon, Mr. Badreddine's phones did not engage in call activity until 01:22 when Mr. Badreddine's SMP 944 was again sited at OUZAI2. Mr. Badreddine's (SMP 944) next and last call in the area, 35 minutes later, was to the Great Prophet Hospital (a common contact of the principal conspirators' phones).
1006. The behaviour of Mr. Badreddine' s PMP 663 (only receiving SMS texts in his home area on the same cell) over this period is consistent with him having left his personal phone at home in Haret Hreik before leaving for the meeting. The first activity of PMP 663 following Mr. Badreddine's return there was a SMS text sent at 02:31 to his close female friend, Zeina [Redacted]: "If you know where I have been, you would be so sad". 311
F. Purple Network Activity: No Inter-Purple Activity
1007. There was no inter-Purple call activity.
311 Exhibit P1294, ECT-SMS-0047 Complete SMS Content for Phone Number 3966663 (BADREDDINE PMP 663) from 01.02.2004 to 16.06.2009, ERN 60259745-60263521, at 60260793_D_EN.
276 R305497
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
1008. Hassan Merhi, Hussein Oneissi, and Assad Sabra were all active on their Purple phones in the vicinity of their respective residences, among other places. Each of them was in contact with family members including: Mr. Merhi, with his brother-in law, Mr. Oneissi, with his sister, and Mr. Sabra, with his brother, Ali, respectively.
G. Selected Attribution Points for Salim Ayyash
1009. Mr. Ayyash's (PMP 091) first call of the day was at 12:32 in the Hadath area on one of the cells most frequently used by his MTC phones ( , PMP 170 & PMP 091). There was no call activity for over five hours from 12:32 until 17:40 when he received a call on his PMP 170 near Saida. The cell he used provided predicted coverage to the Aaaqbiye area and [Redacted]. 312
H. Selected Attribution Points for Mustafa Badreddine
1010. PMP 663 had calls with some of Mr. Badreddine's most frequent contacts during the afternoon and evening including Zeina [Redacted] and [Redacted] (PRH089). During that period, it co-located with SMP 944 in and around Dahyieh. SMP 944 received a call from Ali Fayez Harb, a Samino associate of Mustafa Badreddine.
1011. Shortly before Mr. Badreddine's penultimate Green call with Salim Ayyash, SMP 944 used an adjacent cell in the same Ouzai area to receive his call from Wafik Safa.
312 Exhibit P707 .1 [Redacted]
277 R305498
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Monday, 14 February 2005
OVERVIEW OF TELEPHONE ACTIVITY AND EVENTS RELEVANT TO THE CASE FOR THE PROSECUTION
I. THE ATTACK
A. The Period Preceding Rafik Hariri's Arrival at Parliament at 10:54
Mustafa Badreddine
1012. Following his late night calls with Wafik Safa, and his closely related Green call with Salim Ayyash, Mustafa Badreddine continued to make calls into the early hours until 03:33.
1013. Mr. Badreddine's first call the next morning, at 08:49, located him at ROUEIS3 -his most connected to cell in Dahyieh. Aside from three calls (11:58-12:02), which also connected to that cell, including the last ever Green call, there was no other voice or outbound call activity at all on any of Mr. Badreddine's phones until after the attack (at 14:34).
Salim Ayyash & the Principal Six Network Users
1014. Between midnight and 08:35, certain phones in the Blue Network were unusually active. The two most senior members, Salim Ayyash ( ) and [S6] exchanged five calls (00:56-01:05; 04:55-05:01) in the Dahyieh area. After the last of those calls, [S6] immediately contacted [S7] who, in tum, attempted to contact [S5] twice in quick succession. This is significant because it was S5 and S 7 who, it can be inferred, were tasked with transporting and positioning the suicide L VB JED to the Crime Scene.
1015. Exceptionally, from 19:59 on 13 February until 18:50 on 14 February, Mr. Ayyash's call activity was exclusively with Subject 816, Mr. Badreddine, and members of the principal six Red and Blue Network users (the assassination unit).
1016. Mr. Ayyash (PMP 170) received two late night calls from Subject 816 at 23:54 and 03:33. On both occasions, Subject 816 (who had arrived from the Bekaa valley area
278 R305499
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
on the evening of 13 February) was sited at the same "East of Airport cells" as those that had become heavily associated with S9 in the "attack set-up" phase.
1017. Between 08:35 and 10:05, and excepting Mr. Badreddine's short call at 08:49 and receipt of an SMS at 8:55, there was a marked absence of call activity amongst the Accused and co-conspirators.
1018. At 10:50, shortly before Mr. Hariri arrived at Parliament, Subject 816 made his third call of the day to PMP 170 [Ayyash]. This was Mr. Ayyash's first call activity for almost six hours and he was sited using a cell in the Ouzai area.
1019. Mr. Ayyash's immediate response was to call [S5]: their first contact of the day. S5 was sited using the unusual cell: Mraijeh A. [S5] had also connected to that cell for his previous call almost an hour earlier at 10:05 to [S7]. S5 subsequently moved from this location to the vicinity of the Crime Scene (with S7). Mraijeh A had also featured as the originating location for the same type of movement on the "rehearsal" day (8 February).
B. The Period Preceding Rafik Hariri's Exit from the Parliament Building
Mr. Hariri in Parliament between 10:54 and 11:54
1020. Mr. Hariri's convoy had arrived in the area of Parliament by 10:54 where he attended a session of Parliament. He left parliament at approximately 11:54. 313
S6, S8 and S9 in the Parliament Area
1021. At 11.00, shortly after Mr. Hariri's convoy had arrived at Parliament, the first Red call activity took place around Quraitem Palace involving [S6], [S8],
and K~u o;,~ [S9].
1022. It was not until11:33 when Mr. Ayyash (Red 741) arrived in the immediate vicinity of Parliament and called Red 678 [S6] there, that the three Red phones moved swiftly to the vicinity of Place de l'Etoile where, it is inferred, they were tasked to conduct surveillance on the exit routes from that area.
313 Exhibit P090, Photographs (Parliament) from Hard drive 60180748 [Redacted], ERN D0003451-D0003855.
279 R305500
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
1023. By the time of Mr. Hariri' s exit from Parliament at 11:54 and his entry into the Cafe Place de l'Etoile shortly after noon, [S6] and particularly [S8] and [S9] were well placed to update Mr. Ayyash (who had by then moved to the area of the crime scene) as to Mr. Hariri' s movements.
Mr. Ayyash, Mr. Badreddine, S5, S7 and the Suicide VBIED movement to the Crime Scene
1024. By11:18, [S5] had moved north from Mraijeh to be sited at Sfeir_A in the heart of the Blue Network "base" area. [S7] received a call at the same cell three minutes later. Both phones connected to the same cell at 11:31. Until that point, [S7] had been out of contact despite attempts by both [S5] and the base [S 13] to contact him.
1025. Between 11:35 and 11:4 7, call activity shows that [S5] and [S7] moved up in convoy to the Ras N abah area in the south part of central Beirut calling each other as they travelled. Mr. Ayyash also called [S5] twice from the Parliament area. These were the last Blue calls made between the principal six Blue phone users before the explosion.
1026. It was also at Ras Nabah, at 11:50, that both S5 and S7 turned on their Red phones ( and ) and contacted each other. It appears that they may have paused in this area (or en route) because 15 minutes before [S7] had been located only 2-3 km south.
1027. Ras Nabah had also featured in the movement up from Mraijeh on the "rehearsal" day: on that day, Mr. Ayyash had moved from central Beirut to meet S7 (and S9) there on his route from Dahyieh.
1028. At 11:57, ~w~ ~~~ [S5] called~~~~ , ·~ [Ayyash] from the vicinity of the StGeorge's tunnel while heading towards Mr. A yyash' s location (PHENMB 1) a short distance away in the area of the crime scene. It was around this time that a white truck strongly resembling a Mitsubishi Canter van was recorded on CCTV at the exit from that tunnel.
1029. By the end of his call with Mr. Ayyash, Red 636 [S5] was also using PHENMBl in the immediate vicinity of the crime scene.
280 R305501
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
1030. Forty seconds later, Mr. Ayyash ( ) made a short call to Mr. Badreddine ( ), who was back in his "base" area (ROUEIS3). This was the last ever Green Network Phone call. Mr. Badreddine's SMP 944 co-located with his Green phone one minute later.
1031. From 12:00 to 12:16, as Mr. Hariri spent time in Cafe de l'Etoile,314 Mr. Ayyash ( ) made two calls to [S 7]: both connected to the same cell located just east of the crime scene. Both S8 and S9 made contact with Mr. Ayyash from the Place de l'Etoile area.
1032. By 12:12, [S5] had moved back to the vicinity of Place de l'Etoile to join S6, S8 and S9 in the surveillance of the exit routes therefrom; he would not return to the crime scene before the explosion.
1033. While Mr. Hariri remained at Cafe de l'Etoile between 12:17 and 12:49, there were only two Red calls in 32 minutes: one of them, to [S8], in the Place de l'Etoile area, was from Mr. Ayyash who remained in the vicinity of the crime scene. By contrast, in the previous half an hour, there had been 19 Red phone calls.
C. The Period from Rafik Hariri's Departure to the Time of the Explosion
1034. Mr. Hariri departed from Place de l'Etoile at around 12:50. As he did so, and started his travel in the direction of the coastal road, there followed a sequence of tightly co ordinated, choreographed Red phone calls. There were six calls made within three minutes, mainly radiating from [S8], in the immediate vicinity of Place de l'Etoile to the other members of the Red Network. These were the last ever Red calls. These occurred only 4-5 minutes before the explosion.
1035. The order of the calls, telegraphing Mr. Hariri's direction of travel, was evidently not coincidental: Red 946 [S7], by this time connecting to a cell providing immediate predicted coverage to the crime scene, was called first at 12:50. The called lasted 5 seconds.
314 Testimony ofFaisal Salman (PRH521), Transcript of8 January 2015, pp. 22 et seq.
281 R305502
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
1036. Within a minute, the white truck resembling the Mitsubishi Canter van was recorded moving past the Phoenicia Hotel along Fakhreddine towards the Crime Scene just around the comer. A minute later, and only 3 minutes before the explosion, it could be seen moving slowly past the HSBC building towards its final destination.
1037. In the second call, sixteen seconds later, Mr. Ayyash ( ) was contacted for 10 seconds; he was connecting to the adjacent cell to [S7] and, doubtless, had begun to move away from the area once S 7 had departed to position the LVBIED carrying the "suicide bomber".
1038. The other calls, from 12:51-12:52, from [S8] to [S9] and [S6] and, in tum, from [S9] to [S5], located the remaining members of the Network connecting to cells providing coverage to the south and to the west of the Parliament. This is consistent with them being placed to observe those routes back to Quraitem Palace that were alternatives to the coastal route.
1039. While necessary to the successful execution of the attack, the timing and respective locations of these final Red Network Phone calls left an unavoidably clear forensic impression of their direct involvement in the attack. This explains the extreme care taken over when and where the Red phones were used throughout their lifespan from their original acquisition.
1040. At approximately 12:55, the suicide LVBIED exploded as Mr. Hariri's convoy passed on his return to Quraitem Palace.
D. The Period following the Explosion
Network Phone Activity
1041. The Green and Red Network phones were never used again.
1042. The principal six Network phone users, which had engaged in exceptionally high levels of call frequency in the preceding weeks, were only concerned in five inter Blue calls for the remainder of the day after the explosion.
282 R305503
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
Mustafa Badreddine
1043. From midday, five minutes after the final Green call made by Mr. Ayyash from the Crime Scene, there was no outbound or voice call activity on any of Mr. Badreddine's phones until 14:34 by which time he was sited in his most familiar area of Dahyieh: Haret Hreik. [Redacted].
Salim Ayyash
1044. After his final Red call at 12:50, Mr. Ayyash did not make or receive another call until 18:50 when connected to the cell that provided predicted coverage to the vicinity of his Hadath address. PMP 091 connected to the same cell twelve minutes later. At 20:24, his called [S6] from a cell in Haret Hreik.
1045. Mr. Ayyash was involved in 28 calls throughout the day; however, there were only four calls after 12:55.
1046. All of Mr. Ayyash's calls on 14 February, except three from 18:50-19:02, were to Mr. Badreddine, Subject 816, and the principal six Network users.
1047. Mr. Ayyash (PMP 170) also made one call to Subject 816 on 15, 17 and 18 February 2005. There was no subsequent contact between them at all until mid-May 2005. However, from mid-May to mid-August, regular contact between them resumed once again almost in parallel with the resumption in higher levels of call frequency amongst the Blue Network phones.
II. THE FALSE CLAIM OF RESPONSIBILITY
1048. There was no inter-Purple call activity until after the explosion at 14:03. After the explosion, between 14:03 and 17:24, there were 12 inter-Purple calls.
1049. Before 14:03 on 14 February 2005, there had only been one inter-Purple call (on 4 February 2005) in the preceding nineteen days since 26 January 2005.
1050. The coincidence between the sudden escalation of inter-Purple calls and the timing (from around 14:00) of the Claim of Responsibility made to Reuters and AI Jazeera, and also the stark contrast with the preceding period oflengthy inter-Purple inactivity, is striking.
283 R305504
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
1051. Similarly distinctive call patterns had previously emerged when:
• the isolated escalation of Green Network (Mr. Merhi/Mr. Badreddine) calls and Hierarchical Green-Purple call flows had coincided with the disappearance of Ahmad Abu Adass; and
• the sustained use of the COLA cells over a ten day period ["The COLA phase"] had coincided with the appearance of "Mohammed" at the Arab University Mosque.
1052. The inter-Purple call at 17:24 was the last ever such call. All three of the Purple phones attributable to Mr. Merhi ( ), Mr. Oneissi ( ) and Mr. Sabra ( ) were never used again after the 15 and 16 February respectively.
A. The Period Preceding the Explosion
Hassan Merhi
1053. Mr. Merhi did not engage in any call activity on his until after the explosion. His previous call, at 23:12 the previous night, had connected to the cell in the immediate vicinity of his home in Dahyieh.
Assad Sabra & Hussein Oneissi
1054. Mr. Oneissi's had been sited, late the previous evening, connecting to SFEIR2, the cell that provided predicted coverage to his home. Throughout 13 February, Mr. Sabra had been involved in calls on connecting to the same cell that also provided predicted coverage to his home address.
1055. Between the first Purple call activity on 14 February at 10:39 until 13:46, Mr. Sabra and Mr. Oneissi were both sited at SFEIR3 for two calls each (Mr. Sabra also connected once to the nearby cell BACHA2). SFEIR3 was Mr. Merhi's most dominant day-time cell by far over the relevant period.
1056. There were periods of Purple call inactivity between 10:40 and 12:16 and between 12:16 and 13:33.
284 R305505
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
B. The Period Following the Explosion (at 12:55)
Hassan Merhi
1057. Mr. Merhi's first call of the day was at 14:03 to Mr. Sabra. He was involved in 10 calls throughout the day; all of them connected to SFEIR3, his most dominant cell throughout the indictment period and the cell which the other "False Claim" conspirators had connected to earlier.
1058. Of Mr. Merhi's 10 calls that day, nine fell within a period closely aligned with the "False Claim" activity (between 14:03 and 17:24). Of these nine calls, seven were with Assad Sabra. Those seven calls were consistent with a supervisory role of their activity. This is particularly illustrated by the call flow between Mr. Merhi, Mr. Sabra and Mr. Oneissi between 15:53 and 15:55.
14:11 and 14:19: The First Two Calls to Reuters & Al-Jazeera
1059. From 13:59 to 14:03, the cell use of Mr. Sabra and Mr. Oneissi's phones is consistent with northerly movement from their base area towards the vicinity of the two payphones used to make the first calls to Reuters and AI Jazeera: CBOURJ3- SABRA3-GHOBAI3-CHATIL1 (CHATIL1 is an end cell).
1060. Mr. Sabra's was used to make a 30 second call to his father at 14:01, and to receive a call from Mr. Merhi at 14:03, as he travelled up.
1061. At 14:11, Reuters received a call made from the first payphone from a man stating he was with the El-Nusra-wal-Jihad group in Greater Syria and claiming responsibility for the assassination of Mr. Hariri? 15
1062. Eight minutes later, at 14:19, Al Jazeera received the first of three phone calls. 316 The caller using the second payphone made a similar claim ofresponsibility.317
315 Testimony of [Redacted] (PRH012), Transcript of 14 July 2015, pp. 16-17; Exhibit P546, Extract ofOPMS Card Call History for Telecard Serial Number 6162569 from CD ERN 60143653 (ERN D0004025-D0004025). 316 Exhibit P546, Extract of OPMS - Card Call History for Telecard Serial Number 6162569 from CD ERN 60143653 (ERN D0004025-D0004025). 317 Testimony of Ghassan Ben-Jeddo (PRH020), Transcript of 8 July 2015, pp. 75-77, 81-85.
285 R305506
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
1063. By 14:37-14:38, 18 minutes after the second payphone call (to Al-Jazeera), when Mr. Sabra received his second call from Mr. Merhi, his phone was co-located with Mr. Oneissi' s around 1 Yz km south of the payphones in the Ghobeiry area.
15:27- 15:53: The Third Payphone Call & the Collection of the Video from the Tree
1064. At 14:49, Mr. Oneissi's received a call from a landline attributable to his brother's family (Mounir Oneissi). For this call he connected to a cell in the Ouzaii area (near to the main artery leading directly to the center of Hamra), which suggests that he was in a position to travel north again to the vicinity of the third payphone and the tree. This was Mr. Oneissi' s last call for over an hour after which he received a series of service SMS consistent with his phone having been switched off.
1065. The second call to Al Jazeera (from the third payphone) was made less than 40 minutes later at 15:27. 318 The caller asked Al Jazeera to collect a tape from the tree close to the ESCWA building within 15 minutes. 319
1066. At 15.53, twenty six minutes after that third payphone call, Mr. Sabra's phone connected to a cell in its vicinity when he received a call from Mr. Merhi lasting only 6 seconds. Mr. Sabra made an immediate call to Mr. Oneissi who, by now, was connecting to a cell in the vicinity of the Tree from where the videotape was to be collected.
1067. As those two calls were happening, [Redacted] (PRH115), who had been sent by Al Jazeera to collect the videotape, sent an SMS text to his colleague ([Redacted] (PRH006)) stating: "I got it, a VHS tape. Ai".
1068. A minute and half after that SMS and a minute after his call with Mr. Oneissi, Mr. Sabra called Mr. Merhi for nearly three minutes. This is consistent with Mr. Sabra updating his superior that the videotape had been successfully retrieved from the tree by Al-Jazeera.
318 Exhibit P546, Extract of OPMS - Card Call History for Telecard Serial Number 6162569 from CD ERN 60143653 (ERN D0004025-D0004025). 319 Testimony ofGhassan Ben Jeddo (PRH020), Transcript of9 July 2015, pp. 27,31-34.
286 R305507
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
1069. From 15:58 to 16:02, Mr. Oneissi and Mr. Sabra exchanged four calls with each other in which the nature of the cell use demonstrated a clear movement by Mr. Sabra to co locate with Mr. Oneissi in the vicinity of the Tree. By 16:32, Mr. Oneissi's phone had returned to his "base" area (SFEIR3).
17:04: The Final Payphone Call
1070. By 16:53-16:55, Mr. Sabra's and Mr. Oneissi' s were on the move again westwards towards the main route into the UNESCO area of west Beirut.
1071. At 17:04, the third call to Al Jazeera was made (from the fourth and final payphone) during which the caller asked Mr. Ben Jeddo (PRH020) why the tape had not been broadcast. 320
1072. At 17:15, approximately eight minutes after the final payphone call had finished, Mr. Sabra called Mr. Merhi for 60 seconds. The end cell (CELTEC2) connected to by his for this call was in the immediate vicinity of the fourth payphone.
1073. By the final inter-Purple call ever made at 17:24, from Mr. Merhi to Mr. Sabra, Mr. Sabra's phone had moved down to the Ouzaii area, consistent with a movement back to the area where Mr. Merhi' s phone had been consistently located throughout. At 21:01, Mr. Sabra's phone was sited at SFEIR3 once again.
1074. The call activity, location and movement of Mr. Sabra and Mr. Oneissi's phones throughout the afternoon is consistent with their presence at and involvement in the execution of the "Claim of Responsibility", directed and overseen from the "base" area by their superior: Hassan Merhi.
320 Testimony ofGhassan Ben-Jeddo, (PRH020), Transcript of9 July 2015, pp. 51-53; Exhibit P546, Extract of OPMS - Card Call History for Telecard Serial Number 6162569 from CD ERN 60143653 (ERN D0004025- D0004025).
287 R305508
STL-11-01/T/TC Version 1.2: 20/11/2017- Public Redacted Version F3490/AO 1120 171218/R305220-R305509/EN/dm
III. 15-17 FEBRUARY 2005
A. Final Purple Phone Calls
1075. Following the final inter-Purple call on 14 February, Mr. Merhi's last ever call on his was on the morning of 15 February with Yahya Beydoun.
1076. Mr. Oneissi was in contact with family members including his mother on 15 February and received his last ever call on on the morning of 16 February.
1077. Mr. Sabra's last ever call was on 16 February with Associate Purple 375, the phone which was co-sited with Hassan Merhi ( ) and Abass Merhi (Associate Purple 744) on 14 January along the road to Anjar and which was also inactive for around 36 hours encompassing the date of Mr. Abu Adass's abduction on 16 January.
B. Principal Six Network Users: Significant Drop in Call Activity
1078. Salim Ayyash, who had been involved in 23 Network (Green, Red & Blue) calls on 14 February 2005, did not use his remaining Network phone ( ) at all the next day (15 February). His had been used every day since first use. Although he resumed use on 16 February, there were only three calls with other Blue network phones.
1079. Similarly the Principal Six Network users (including Mr. Ayyash), who had engaged in exceptionally high levels of call frequency in the preceding weeks, and had exchanged 55 calls (22 Blue & 33 Red) between them on 14 February, were only concerned in two such calls on 15 February and four on 16 February.
1080. Of those six calls over the two days following the attack, unusually, four of them featured the use of Mraijeh A (the cell featuring S7 & S5 on the rehearsal and day of the attack) or LA YLAKI (its co-terminous Alfa cell). The calls at those cells were received by S5, S7 & S8 from the two most senior Blue phone users: Salim Ayyash and S6.
288 289