The Special Tribunal for Lebanon (STL) has unsealed its indictment of Mustafa Badreddine, Salim Ayyash, Hussein Oneissi, and Assad Sabra for the murder of former Lebanese Prime Minister Rafik Hariri. You can download a copy of the indictment here (PDF, 12.9 megabytes).
I’ve read the document once through and there’s a great deal to mull over, but here are some preliminary thoughts.
The case against the four men accused of plotting and carrying out the Hariri murder rests almost entirely on telecommunications analysis. As was leaked by a Lebanese security official as early as 2006, the investigation discovered the cell phone networks allegedly used to surveil Hariri and coordinate his assassination.
The central methodological tool of the investigation is “co-location”, which determines on the basis of cell-tower data when and where certain cell phones were used to call each other and other off-network phones. Here’s a basic illustration of the principle:
- Phones A, B, C, D, E, F, G, and H are activated together on the same day, several weeks before the crime. They only ever make calls to each other, and those calls are made from locations in the vicinity of Hariri’s convoy or along his various routes. In the two hours before the assassination, 33 calls were made between these phones with the last one coming just five minutes before the bomb went off. This is the red network, carried by the hit squad.
- When the hit squad members need to communicate with people who are not part of the immediate assassination team, they use other phones. Cell-tower data shows that these phones are always active in the same locations and at the same times as the red network phones, and they were used to do things like purchasing the vehicle used to carry the bomb.
- The hit squad also have their own personal mobile phones (PMP’s) which they use to contact family members and friends, and are ultimately used by the investigation team to determine the identities of their owners. (Note to self: beware of co-locating with PMPs. Always a bad idea.)
Using this method, the investigation team was able to put together a very detailed chronology for the operation build-up and execution, as well as its aftermath (when the Abu Adass claim of responsibility was made).
The first question that comes to mind is: is this it? After nearly six years of investigation, does the case truly rest solely on telecommunications data? What about witness testimony? Forensics? DNA analysis? Magnifying glasses and trench coats?
Secondly, if signals intelligence does comprise the bulk of it, then what did the UN International Independent Investigation Commission (UNIIIC) do between 2006 and 2010? The first Mehlis report had already identified the hit squad’s cell phone network in late 2005, and the 2006 article by Georges Malbrunot in Le Figaro revealed that the investigation had used cell phone data to discover new evidence “leading to Hezbollah”. I understand that piecing all of this together must have been a complicated task, but surely it would not have taken five years to do so.
(Let me reiterate that I don’t buy Neil Macdonald’s claim that the UNIIIC only began analyzing telecoms data in late 2007, which was when they supposedly discovered the hit team. As I’ve previously shown, that simply does not add up.)
The last big question is whether the STL has other indictments up its sleeve. Did Badreddine or Ayyash ever communicate with off-network phones tied to political figures? The CBC report claimed to produce documents from the investigation showing networks connected to Hezbollah political figures, but the indictment makes no mention of these.
As I said, there will be much more to comment on the next few days as Lebanon’s professional and amateur pundits pore over the indictment. In the meantime, the floor is open for thoughts and critiques.