Qifa Nabki | A Lebanese Political Blog

I spent an hour or so this morning going through previous reports by the United Nations International Independent Investigation Commission (UNIIIC), in order to see how the historical record tallies with Neil Macdonald’s report about the Hariri investigation for CBC.

As you’ll recall, Macdonald makes the following basic points in his piece:

• The UNIIIC did not begin analyzing telecommunications data until late 2007, because Serge Brammertz (the successor to Detlev Mehlis) refused to authorize this kind of work.
• When they finally got around to looking at phone records, the investigators happened upon the “earth-shattering” discovery of the so-called “red network”: the group of phones carried by Hariri’s hit squad.
• As they soon discovered, however, a young Lebanese police captain named Wissam Eid had already discovered this network and the networks behind it as early as the spring of 2006, and submitted a report to the UNIIIC that detailed his findings. Eid’s work pointed to Hizbullah’s complicity in the crime.
• This report was put into a drawer and did not resurface until the end of 2007, at which point the UNIIIC established contact with Eid. A month later, Eid was dead.

So far so good?

Now, let’s go back to the reports that were issued by the UNIIIC between 2005 and 2007 (a period during which, according to Macdonald’s sources, no telecommunications analysis was carried out by the investigating commission). What we find is a drastically different account of the work that was taking place, and not just under Detlev Mehlis (generally portrayed as an effective investigator) but also under his successor Serge Brammertz (who comes off as timid and incompetent in Macdonald’s account).

The following excerpts are taken from the first eight UNIIIC reports, which cover the tenures of Mehlis and Brammertz. Have a look and let me know what you think:

UNIIIC Report #1 (Mehlis, 22 Oct 2005)

144. Investigations by both the ISF and Military Intelligence have led to six pre-paid calling cards, which telephone records demonstrate were instrumental in the planning of the assassination. Beginning at approximately 1100 hrs on 14 February 2005, cell site records show that cellular telephones utilizing these six calling cards were located in the area stretching from the Nejmeh Square to the St. George Hotel, within a few-block radius and made numerous calls with each other and only with each other. The phones were situated so that they covered every route linking the Parliament to Kuraytem Palace: that is, cellsite records demonstrate that these telephones were placed to cover any route that Hariri would have taken that day. One of the cellphones located near the Parliament made four calls with the other telephone lines at 1253 hrs — the time that Mr. Hariri’s convoy left the Nejmeh Square . The calls — and all usage on the cards — terminated at 1253 hrs on 14 February, a few minutes before the blast. The lines have all been inactive since.

145. Further investigation has revealed that these six lines — along with two others — were put into circulation on the 4 January 2005, after calling number 1456 activated them. They were all activated at the same location in northern Lebanon between Terbol and Menyeh. Since they were first purchased in early January 2005, until the time of the explosion, the lines only had calls with each other. In that time period, until the assassination, there appears to be a correlation between their location and Hariri’s movements, suggesting that they might have been used to follow Hariri’s movements in that time period.

UNIIIC Report #2 (Mehlis, 12 Dec 2005)

65. As previously noted (see S/2005/662, para. 192), telephone analysis has been a central aspect of the present investigation. Since October 2005, the Commission has concentrated on organizing the telephone data received into manageable databases so that it can be more easily accessible for future analysis. That process has involved compiling over 400,000 records from 195 different files (based on requests for telecommunications data) into one central database. Another database contains over 97 million telecommunications records of all the calls in Lebanon between 7 and 21 February 2005. Those two databases will permit a standardized search of any relevant telephone number and its contacts in an efficient manner which will facilitate future telephone analysis projects.

73. The Commission has not had time, in the short period available since the end of October 2005, to investigate meaningfully the following issues that were raised in the previous report: … Identification, location and further contacts related to the ring of prepaid telephone cards, including eight significant telephone numbers and 10 mobile telephones, which are believed to have been used to organize surveillance of Mr. Hariri and carry out the assassination (see S/2005/662, paras. 121 and 148-152).

UNIIIC Report #4 (Brammertz, 10 June 2006)

51. Communications analysis is a major task, with the collection of up to 5 billion records by the Commission currently under way. All must be sifted, sorted, collated and analysed. This work is painstaking in its depth, with any linkage established almost exponentially generating further linkages. The Commission has devoted a project team of analysts and investigators to this task and is acquiring specialized software and hardware to accommodate the project requirements. Such traffic analysis work requires focus. Hence, the Commission is concentrating on the immediacy of the Hariri case and closely associated links with the operation and other relevant issues, and the results of this work are continuously integrated into the broader case components.

52. The traffic and intercept analysis has expanded beyond the immediate utilization of the six subscriber identity module (SIM) cards, referred to in the Commission’s previous reports, on the day of the attack. Complex linkages, associated calls and geographic locations of a broader time period are being scrutinized and added to the overall investigation findings. The communications currently under analysis also have an international dimension, although the Commission is not in a position to make final conclusions about the significance of such calls at this stage.

UNIIIC Report #5: (Brammertz, 25 Sept 2006)

39. The Commission has devoted considerable resources to the analysis and investigation of the communications traffic aspects of the case. This topic has yielded important results, and enables the Commission to establish links that otherwise would not be evident. Much of the work is reactive in nature. However, some of the analytical work is also proactive and speculative, and builds upon known facts and develops investigation themes. It has elicited a number of leads and continues to provide the Commission with better understanding of the communications linkages relevant to the crimes.

40. The links that are being established through the communications work demonstrate a complex network of telecommunications traffic between a large number of relevant individuals, sometimes through intermediary telephone numbers or locations and sometimes directly. A series of investigation leads has been developed as a result of these analyses, which the Commission regards as a priority. Much painstaking work is required to track down each individual connection or link and exempt it from the enquiries or continue with it as a working lead. Similarly, the Commission understands better the preparatory aspects of the attack through its communications analysis; this work remains ongoing in conjunction with timeline analyses, and is one of a number of areas where comparative analysis with the 14 other cases is being pursued. For example, knowledge of the activities of the six subscriber identity module (SIM) card holders who are alleged to have been part of the bombing team, both geographically and in communications terms, has become clearer and more detailed.

41. The Commission has also developed direct and indirect linkages between significant individuals in disparate groups that are relevant from an investigative perspective. Explanations for these linkages are in some cases not immediately apparent, and the Commission is working to understand their relevance to the crime itself, to those potentially linked to it and to other individuals.

42. The international dimension of the communications analysis continues to provide investigative leads, as the Commission develops its knowledge of the complexities of international call routing and receives responses to its requests from States where telephone call traffic has been traced. To date the Commission has engaged 17 States in this aspect of its work, and has received considerable assistance and responses from a number of them.

43. The relevant communications links emanating from within Lebanon or outside the country of those individuals whom the Commission wishes to interview and/or continues to investigate are being systematically reviewed, and the results are providing further investigative leads.

UNIIIC Report #6 (Brammertz, 12 Dec 2006)

43. The Commission has conducted seven interviews in connection with the alleged bombing team and their use of six telephones to communicate on the day of the attack and in the days leading up to it. These interviews have provided new leads that are currently being pursued and will lead to more interviews in the next reporting period. Analysis of the use of other associated subscriber identity module (SIM) cards is also ongoing.

44. The location of the telephones when used and the purposes for which some of the linking numbers were used have revealed the high degree of security-aware behaviour exhibited by the individuals under investigation. Some persons used multiple mobile cellular telephones during a short period of time or registered telephones using aliases. While such compartmentalization of telephone usage makes analysis more complex, it helps to provide an understanding of the modus operandi of the perpetrators.

45. During the reporting period, communications traffic analysis has continued in support of the other investigative projects. This work consists of preparation for interviews of key persons and preparing specific reports on communications between selected individuals. For the purpose of preparation of interviews, data relating to the different telephones used by the interviewee during a certain period of interest are gathered and organized into an exploitable electronic format. The analysis then focuses on the personal contacts and communications links of the interviewee, the use of intermediaries and the frequency, timing, type, duration and location of the calls, as well as international call activity.

UNIIIC Report #7 (Brammertz, 15 Mar 2007)

34. The Commission’s analysis of communications traffic continues in order to support and validate different points arising from the investigations. Much work has been done to support the interviews conducted, in order that respective communications contact with other persons of interest to the case can be discussed with witnesses. Patterns of communications traffic, including frequencies and timings of calls, and linkages and clear associations to others, are all developed and elicit investigation leads.

35. In relation to the six mobile cellular telephone SIM cards allegedly used by the team that executed the operation on the day of 14 February 2005, the Commission has developed further information of interest relating to associated earlier operations, including possible surveillance and reconnaissance activity, possible practice-runs or earlier attempts to kill Rafik Hariri, and other actions undertaken by the team. New areas of interest have emerged from this analysis and are currently being examined.

36. The Commission has also undertaken an investigative project examining the role of the persons using the six SIM cards and activities that can be inferred from their use. This exercise is supported by the Commission’s existing communications traffic analysis projects in relation to the cards. The objective is fourfold: first, to reaffirm the validity of the hypothesis that the cards could indeed have been used by the bomb team to execute its task; second, to establish whether other modes of communication must have been used between the members of the team, and also perhaps with other individuals, in order for the attack to take place; third, to allow the Commission to establish a better understanding of how the crime was committed on 14 February; and finally, to understand further what other activity the bomb team undertook, and what locations it travelled to and why, in the days leading up to the attack.

37. Such extensive analysis enables the Commission to reach a better understanding of the bomb team, its role in the crime and its other activities. This in turn creates further investigative leads geographically and temporally, and pointing to the activities of individuals outside the immediate bombing team the Commission believes were using the six SIM cards.

38. This detailed examination of the activities of the six SIM cards has resulted in a number of significant elements for ongoing investigation. These include, but are not limited to: potential identification of the role of each participant in the preparation, planning, surveillance and actual attack; the bombing team’s anticipation of Hariri’s activities and movements; and possible earlier attempts on Hariri’s life.

39. One working hypothesis is that the bomb team had to ensure that Hariri was indeed dead after the explosion in order for the video claim of responsibility to be delivered and to have resonance with its intended audience. It is possible that the team, and those commissioning the crime, could not afford to deliver a claim of responsibility to the global media if Hariri had survived the attack. Thus, the Commission is exploring the hypothesis that one member of the team, or an associate, was tasked with confirming the death of the principal target as soon as possible and may have contacted someone waiting for the news. Based on existing information, the time frame for this activity would have been within approximately 45 minutes of the explosion.

40. This in turn led to the series of events related to the taped claim of responsibility and the subsequent telephone calls made to media outlets. The Commission is examining the hypothesis that one or more members of the bomb team was responsible for delivering the tape and making the subsequent telephone calls to the media. Other variations on this hypothesis are being explored to establish the numbers of perpetrators who may have been involved on the day of the attack.

UNIIIC Report #8 (Brammertz, 12 Jul 2007)

41. The Commission has consolidated its sizeable holdings of call records, communications data and analyses related to specific time periods, institutions and individuals of relevance to the Hariri investigation. Since its inception, the Commission has acquired more than 5 billion records of telephone calls and text messages sent through cellular phones in Lebanon, as well as communications data from a number of other countries. The Commission has also acquired a very large number of detailed subscriber call records. Since 2005, the Commission has issued more than 300 requests for assistance to support its communications analysis related to the Hariri investigation.

42. The Commission’s communications analysis provides valuable input to the investigations in establishing links between individuals, analysing the behaviour and activity of a number of persons of interest to the investigations and analysing call patterns for specific numbers, times and locations. It is also a very valuable resource in preparing for witness interviews. Given the proven investigative value and potential of communications analysis, the Commission has recently sought outside expertise to help exploit its communications data holdings and analysis. The Commission has also recently acquired new hardware and software, which will allow it to conduct more comprehensive data searches.

43. On the basis of the consolidation exercise, the Commission has confirmed and advanced its earlier conclusions that individuals using six mobile cellular telephone SIM cards acted in a coordinated manner to conduct surveillance on Rafik Hariri in the weeks prior to his assassination. A detailed analysis of the use of these cards on the day of the assassination indicates that these individuals played a critical role in the planning and execution of the attack itself, as demonstrated by their movements and call patterns. The Commission has established the origins of the SIM cards and is finalizing its understanding of the circumstances around the sale of the cards and a number of handsets to the individuals who made use of them in the surveillance of Rafik Hariri. A number of interviews were held during the reporting period to advance this line of inquiry.

46. The Commission has also been focusing on establishing horizontal and vertical links between individuals linked to the crime scene and those who may have been involved in the preparation of the attack or may have had prior knowledge of the attack through the analysis of telephone communications. Several telephone numbers have been identified and scrutinized as a result of this line of inquiry.

**

So, what do you think? Does this look like the work of an investigating commission that was not engaged in telecommunications analysis? When I asked Mr. Macdonald about the discrepancies between the statements of his sources and the first Mehlis report, he insisted that all of the telecommunications work done before late 2007 was performed by the Lebanese police and not by the UN Commission. He added that the UNIIIC was “generally aware” of the work being done by the Lebanese, but that “actual telecomms analysis by the commission itself, as I reported, was not authorized until late 2007.”

As others have already noted, this simply does not add up, and the above survey of the UNIIIC reports confirms the contradictions in the CBC account. Even if we accept the testimony of Mr. Macdonald’s sources and assume for a moment that all of the discussions in the UNIIIC reports about communications analysis prior to late 2007 were just made up, how does this explain the suggestion that the discovery of the red network by the UNIIIC was “earth-shattering”? After all, they had already discussed this network in eight different reports from 2005-2007! And the network was not just discussed under Mehlis. Brammertz devotes pages to the discussion of how the UNIIIC was trying to develop its lead vis-à-vis the red network.

But let’s also assume, just to give Mr. Macdonald’s sources the benefit of the doubt, that it was not the UNIIIC that was investigating the communications traffic, but rather the Lebanese police. How does one then explain how the UNIIIC became privy to the work that the Lebanese were doing (so as to be able to mention it in the eight reports between 2005-07), unless of course the UN was working in close cooperation with the Lebanese and not, as Mr. Macdonald’s sources suggest, in isolation from them?

I will endeavor to get a response from CBC about these questions. Stay tuned.

**

Update 1: Buried in the comment section of the last post is this gem from RedLeb, who basically says exactly what I said in this post (and much more), but more succinctly. I reproduce his comment in full below:

“It is not enough for Macdonald to say that ‘Mehlis was aware of the ISF’s early telecomms work’. Macdonald’s report, especially the video, emphatically makes the claim that the commission only identified the Red team late in Brammertz’s tenure, and only after much prodding.

However, the commission’s reports are clear that the Red team was identified at the initial stages of the investigation and that signal analysis was a key technique used by the commission.

This contradiction with the documented historical record undercuts the report’s credibility. It is obviously trying to sell you something. And what I think what it is selling is the linkage between the Red team and HA.

The Red team stands out in any signal analysis. It is a closed network, located at the scene of the crime, and ceased to exist immediately after the assassination. By focusing on the slam dunk part of the Eid’s analysis, we are asked to adopt the further linkage of the Red Team to HA.

What is that linkage? Did someone on the Yellow team call the Hospital and then someone at the Hospital call a government issued HA phone line?

How about if an Israeli agent calls someone at AUH, and then someone at AUH calls AUB? Can I then claim the Dean of AUB is an Israeli spy?

And this whole ‘mathematical genius’ spin. It just sounds like a way to cater to the Leb ego so as to distract our suspicions. Tell me Eid used some special software. Tell me he set up a database. Hell, tell me wrote a computer algorithm to do signal analysis. I will believe you. But a super-mathematical genius who could ‘intuit mathematical patterns’? No. Just… no.

I speculate that the attack on Wissam Hassan is to undermine the ISF’s work on Israeli spies and Israel’s penetration of the Lebanese telecom network. At Nahass’s conference this week, Wissam Hassan was specifically named as helping out in the investigation of Israel compromising HA phone lines. By labelling him an HA accomplice, the whole Israel angle can be explained away.

The attack on Bellemare and Brammertz are interesting. Whoever fed Macdonald his information must have felt the indictments are not going to come out, or will fail to name HA members. Thus the report serves to indict HA in the media, regardless of the path the STL takes. The whole ‘Getting Away with Murder’ angle is that HA did it, we know they did it, but here’s why the STL won’t indict them. Is someone nervous?

I think the only factual we get out of the whole report was from Bellemare’s press release in which he stated he is working on the draft of the indictment. So we know that’s coming sooner than later.”