SUMMARY OF FINDINGS

3. Just before 13:00 on Monday 14 February 2005, the former prime minister of Lebanon, Mr Rafik Hariri, was travelling in his convoy in Beirut between the Lebanese Parliament and his home, Quraitem Palace. As it approached the St Georges Hotel, near the coast, a massive explosion was detonated. Mr Hariri was killed in the blast. Twenty-one others, including eight members of Mr Hariri's convoy, and innocent bystanders, also died. Three of the victims died after the explosion, two on the following day, and the third, the Lebanese MP, Mr Bassel Fuleihan, succumbed after lying in a coma for two months.Footnote ³

4. Another 226 people were injured, some very seriously. People passing in the street and working in nearby buildings sustained terrible injuries. Many buildings were badly damaged.

5. The explosion was triggered by a suicide bomber in a Mitsubishi Canter—a light tarpaulin covered truck, loaded with more than two tonnes of RDX high-grade explosives—that detonated as Mr Hariri's heavily protected six vehicle convoy passed the St Georges Hotel. The explosives had the equivalent of 2,500 to 3,000 kilograms of TNT. The explosion left a crater in the road that, based on the cone shape, had a diameter of around 11.4 metres with a depth of around 1.9 metres, within a margin of error of several per cent.

6. Mr Hariri and his convoy had been under surveillance for some months before his assassination. Those engaged in the surveillance were communicating in the field using three sets of mobile telephone networks. To distinguish the three networks, the Prosecution labelled them as the Yellow, Blue and Red networks.

7. The Red network was the assassination team. The users of the Blue and Red network mobiles communicated only with each other. Another network, labelled as the Green network, of three mobiles, was alleged to have coordinated and monitored all aspects of the operation targeting Mr Hariri which eventually resulted in his death.

8. In the months before the attack, network mobiles had followed Mr Hariri as he travelled around Lebanon. This included his trips to Beirut Airport, to his villa in Faqra north of Beirut, to his villa at Naameh, south of Beirut, when he visited mosques and churches, when he met Hezbollah's Secretary-General in south Beirut, when he went to the Parliament, and when he had lunch and dinner engagements. The network mobiles were also engaged in static surveillance near Quraitem Palace and along some of the routes he travelled.

9. The aim of this surveillance was to obtain information about Mr Hariri's movements, his security detail, his level of protection and eventually to determine a suitable method to murder him, including finding an appropriate location for the intended attack. Mr Hariri's convoy was equipped with electronic jammers that would have blocked the remote detonation of any explosive. Thus, a vehicular improvised explosive device—in the form of a suicide bomber driving a light truck loaded with explosives that he could safely self-detonate―was chosen for the attack.

10. Shortly after the explosion on the afternoon of Monday 14 February, the Al-Jazeera news network in Beirut received calls claiming responsibility for the attack, and saying that a video with a letter attached was in a nearby tree. Three calls were made, with one menacing call exhorting the immediate broadcast of the video. The callers had also first contacted Reuters. Two of the Accused, Hussein Hassan Oneissi and Assad Hassan Sabra, were alleged to have made these calls and to have observed the collection of the video from the tree.

11. In the video, which Al-Jazeera broadcast later that afternoon, a young Palestinian man, Mr Ahmad Abu Adass, claimed to represent a fundamentalist group called ‘Victory and Jihad in Greater Syria’ and to have executed a ‘resounding martyrdom operation’ against Mr Hariri as an agent of the ‘infidel Saudi regime’. The attached letter claimed that the suicide operation was carried out by ‘the Mujahid, Ahmad Abu-Adass’. The Prosecution termed this as a ‘false claim of responsibility’ for the attack on Mr Hariri. And indeed it was. The group is fictional and Mr Abu Adass did not kill himself in the explosion; he was not the suicide bomber.

12. Mr Abu Adass, a religious 22 year old, disappeared from his home in Beirut on the morning of Sunday 16 January 2005 and his family has not seen him since. Presumably he is no longer alive. Mr Oneissi and Mr Sabra were alleged to have arranged this by recruiting him at a mosque in Beirut.

13. The successful attack on Mr Hariri was carefully planned and implemented. The six core Red network mobile users were responsible for Mr Hariri's murder on 14 February 2005. The Yellow, Blue and Red network mobile users observed Mr Hariri and his convoy's movements in the weeks and months before the attack. Some members of the Red network also used Blue and or Yellow network mobiles. On the day of the attack, the Red mobile users observed Mr Hariri's movements at the Parliament and were present there and near the crime scene shortly before the explosion. They also coordinated the Canter's movement towards the convoy. The Red network users made their final calls in the minutes before the attack and these anonymous mobiles were never used again.

14. The false claim of responsibility video was aimed at diverting attention away from the true perpetrators, namely, Mr Salim Jamil Ayyash and his co-conspirators.

15. The four Accused are Salim Jamil Ayyash, who was born on 10 November 1963 in Harouf, Lebanon, Hassan Habib Merhi, born on 12 December 1965 in Beirut, Hussein Hassan Oneissi, who was born in Beirut on 11 February 1974, and Assad Hassan Sabra, also born in Beirut and whose date of birth is 15 October 1976. A fifth and former Accused, Mustafa Amine Badreddine, who was also known as ‘Sami Issa’—and is alleged to have been a co-conspirator—was born in Beirut on 6 April 1961. All five, the Prosecutor alleged, are supporters of Hezbollah, a Lebanese political and military organisation.

16. The amended consolidated indictment contains nine counts, alleging crimes committed contrary to the Lebanese Criminal Code. The crimes are of conspiracy to commit a terrorist act by means of an explosive device, committing a terrorist act by means of an explosive device, the intentional homicide of Mr Hariri and of the 21 others, the attempted intentional homicide of the 226 people injured in the blast and of being accomplices to these crimes.

17. The Prosecutor alleged that each of the four Accused and Mr Badreddine participated in the conspiracy. They had the following roles in the attack:

1. i Mustafa Amine Badreddine monitored, and together with Salim Jamil Ayyash, coordinated the surveillance of Mr Hariri in preparation of the attack, including the purchase of the Canter. He also monitored the physical perpetration of the attack, and monitored with Hassan Habib Merhi the coordination of the preparation of the false claim of responsibility;

2. ii Salim Jamil Ayyash, with Mustafa Amine Badreddine, coordinated the surveillance of Mr Hariri in preparation of the attack, including the purchase of the Canter. He communicated with Hassan Habib Merhi in relation to preparations for the attack, including the false claim of responsibility. He coordinated the physical perpetration of the attack and participated in carrying out the surveillance and assassination;

3. iii Hussein Hassan Oneissi and Assad Hassan Sabra, under Mr Merhi's coordination, participated in identifying a suitable person to use in a video-taped false claim of responsibility for the attack, namely, Mr Abu Adass. Immediately after the attack, they disseminated statements falsely attributing responsibility for the attack, ensured the delivery of the video and attached letter to Al-Jazeera, and ensured its broadcast. This too was under Mr Merhi's coordination. Mr Oneissi, additionally and again under Mr Merhi's coordination, participated in Mr Abu Adass's disappearance for the purpose of creating a false claim of responsibility; and

4. iv Hassan Habib Merhi, with Mustafa Badreddine, coordinated the false claim of responsibility and at times was in communication with Assad Sabra for this purpose. He coordinated Mr Oneissi's and Mr Sabra's activities in identifying and effecting the disappearance of a suitable person, Mr Abu Adass, who would be used in the video. Immediately after the attack, he coordinated their activities in disseminating statements falsely attributing responsibility for the attack, ensuring the delivery of the video and attached letter to Al-Jazeera and ensuring its broadcast.

18. Mr Oneissi and Mr Sabra, according to the Prosecutor, used their personal mobiles to communicate with each other and Mr Merhi in relation to the false claim of responsibility. These three mobiles were termed the ‘Purple group’ of mobiles. Mr Badreddine, Mr Ayyash and Mr Merhi were alleged to have communicated in a closed three-mobile Green network, in which Mr Ayyash and Mr Merhi used their Green mobiles only to communicate with Mr Badreddine.

19. The Prosecution attempted to prove that they were using their network mobiles based upon the co-location of the network mobiles with their own personal mobiles. In other words, that the personal and network mobiles made calls and travelled in a manner suggesting that they had a single user.

20. The Prosecution presented a vast quantity of documents and telecommunications evidence, including the call data records of the calls made, and cell site evidence of the cell towers activated, in attempting to prove first, that the Accused and Mr Badreddine were using the personal mobiles alleged. Second, that these were co-locating with the network mobiles and, third, that the network mobiles were engaged in Mr Hariri's surveillance and assassination.

21. The Prosecution proved some but not all of these allegations and mobile telephone attributions to the Accused and Mr Badreddine.

22. The evidence has established that Mr Ayyash conspired with unidentified people to commit a terrorist act by means of an explosive device in order to murder Mr Hariri. Mr Ayyash led the assassination team on Monday 14 February 2005. The Prosecution proved that he was using Yellow, Blue, Red and Green network mobiles and that the first three were engaged in surveillance of Mr Hariri between October 2004 and 14 February 2005. It also proved that he was actively involved in the assassination on the day of the attack.

23. There was insufficient evidence to find what role if any Mr Badreddine had in the conspiracy.Footnote ⁴ The evidence consisted solely of the records of activations of his Green network mobile in calls to the other two Green network mobiles. One was used by Mr Ayyash. The other the Prosecution attributed to Mr Merhi.

24. The evidence established that much of the surveillance was directed at targeting Mr Hariri for his possible assassination. However, how much was difficult to discern, given that Mr Hariri was under surveillance by more than one group, including the Lebanese Internal Security Forces. The Trial Chamber has found that the final decision to proceed with the plan and hence to murder Mr Hariri was made only sometime in early February 2005 in the weeks before the attack. The surveillance in the weeks preceding the decision was preliminary to a possible attack.

25. Regarding Mr Merhi's, Mr Oneissi's and Mr Sabra's role in the conspiracy and the false claim of responsibility, the Prosecution did not prove its case beyond reasonable doubt.

26. The Prosecution alleged that Mr Oneissi, posing as someone called ‘Mohammed’, approached Mr Abu Adass in a mosque for the purpose of finding someone to use in the false claim video. Mr Oneissi and Mr Sabra were also alleged to have been present around the mosque in Beirut over ten days, in late December 2004 and early January 2005, for this purpose. In court, the Prosecution claimed that Mr Oneissi and Mr Sabra participated in abducting Mr Abu Adass from his home on Sunday 16 January 2005. The Prosecution case on each of these allegations, based almost solely on the cell activations of two personal mobiles around the mosque, failed.

27. The evidence that Mr Oneissi was ‘Mohammed’ was unreliable. It was not probative. There was also, ultimately, no reliable evidence connecting the activations of the two personal Purple mobiles around the mosque with Mr Abu Adass or anything that he did.

28. Similarly, there was no evidence connecting either Accused person with Mr Abu Adass's disappearance and there was no reliable evidence that he was even abducted. Further, the Prosecution did not prove beyond reasonable doubt that Mr Sabra was using his attributed personal Purple mobile. The mobile was jointly used by Mr Sabra and his wife, and there was no reliable evidence establishing that Mr Sabra was the person using it at all relevant pleaded times.

29. In relation to the calls to Reuters and Al-Jazeera on the afternoon of Monday 14 February 2005, the evidence was too weak to connect either Mr Oneissi or Mr Sabra to the calls or the collection of the video from the tree. The cell site evidence was insufficiently reliable in the aftermath of the attack to prove that their attributed mobiles were where they were alleged to be when the calls were made. The Trial Chamber was satisfied beyond reasonable doubt that Mr Oneissi was using his personal Purple mobile, but as noted, could not make the same finding regarding Mr Sabra.

30. Additionally, the evidence did not prove that either Accused joined the conspiracy before the explosion. Nor that even had they made the telephone calls to Reuters and Al-Jazeera as alleged, they knew of the explosion in advance, and that their alleged actions were connected to the attack. Proving their knowledge of this was legally required under the Lebanese Criminal Code.

31. Regarding Mr Merhi, the Prosecution also failed to prove beyond reasonable doubt that he was using his attributed Green mobile, and hence communicating with Mr Badreddine on the false claim of responsibility. There was also no evidence of his communicating with Mr Ayyash in relation to the false claim of responsibility.

32. Mr Merhi was charged with coordinating the activities of Mr Oneissi and Mr Sabra in preparing the false claim of responsibility. However, as the case against them has failed, the case against Mr Merhi also failed, including his participation in the conspiracy. The Trial Chamber was not satisfied beyond reasonable doubt of their guilt.

33. The evidence against all four Accused was circumstantial. The only direct piece of evidence―and one that the Trial Chamber found too unreliable to use against Mr Oneissi―was evidence that the Prosecutor pleaded identified him as the ‘Mohammed’ who met Mr Abu Adass in the mosque, in attempting to find someone to use in the false claim video.

34. The remainder of the evidence against the four Accused, and of Mr Badreddine's pleaded role, came from the cell activations of their attributed personal and network mobiles. The Prosecution led evidence connecting these to Mr Hariri's provable movements and, additionally, in the case of Mr Oneissi and Mr Sabra, to Mr Abu Adass. Ultimately, however, the evidence relating to Mr Abu Adass was insufficiently reliable to use against the Accused.

35. There was no evidence of any of the four Accused or Mr Badreddine meeting, or of the content of any of their mobile telephone conversations. There were no telephone intercepts, relevant text messages or voice mails. There was no reliable evidence of Mr Oneissi or Mr Sabra meeting Mr Abu Adass.

36. To find Mr Ayyash guilty, the Trial Chamber had to connect the activations of his personal and network mobiles with Mr Hariri's movements and other relevant incidents. It did this by analysing the use of a Red mobile, number 741, on the day of the attack and then working backwards to find that he was using it on that and other relevant days when surveillance occurred. Red 741 co-located with Mr Ayyash's personal and other network mobiles in such a manner that the only conclusion reasonably available on the totality of the evidence was that he was its user and its user was heavily involved in the attack.

37. The Trial Chamber, as it must in a case based on circumstantial evidence, has exercised any evidentiary doubt in favour of an Accused person. For these reasons, it has acquitted Mr Merhi, Mr Oneissi and Mr Sabra of all counts charged on the amended consolidated indictment. In Mr Ayyash's case, it has been satisfied that the only inference reasonably available on the evidence is of his guilt beyond reasonable doubt on all counts charged.

WITNESSES AND PUBLICITY OF THE PROCEEDINGSFootnote ⁵

38. During the Prosecution's case, the Trial Chamber heard evidence from 269 witnesses, 119 of whom gave live testimony in the courtroom or through video-conference link, and it received the evidence of 150 witnesses through their written statements.Footnote ⁶

39. The Trial Chamber ordered measures to protect the identity of many witnesses— including 46 witnesses who testified in court—due to concerns for their personal safety or that of their families. For these reasons, some witnesses are referred to by a pseudonym rather than by their names. Details that might reveal their identities have been omitted. To ensure the effectiveness of the protective measures ordered by the Trial Chamber, several portions of the hearings in court were exceptionally conducted in ‘private’ or ‘closed’ session, which the public could not follow. The Trial Chamber endeavoured to minimise these sessions.Footnote ⁷

ASSESSMENT OF EVIDENCE—SOME PRINCIPLESFootnote ⁸

40. The Prosecution must rebut the presumption of innocence and prove the guilt of the Accused ‘beyond reasonable doubt’. As the Accused are presumed innocent, the Defence need not establish their innocence. The Trial Chamber cannot impose on the Accused a reversal of the burden of proof or an onus to rebut evidence called by the Prosecution.Footnote ⁹

41. The presumption of innocence is a fundamental principle of international human rights law and international criminal law. It obliges the Trial Chamber to treat the Accused as innocent of the crimes charged until entering a verdict of guilty in a judgment. The Trial Chamber does not—as is sometimes erroneously said—determine whether the Accused are ‘guilty or innocent’, but rather, and consistent with the principles of international human rights law, is only required to determine guilt beyond reasonable doubt.Footnote ¹⁰

42. The Trial Chamber has found that the Prosecution must prove beyond reasonable doubt that the alleged accomplices, namely, Mr Merhi, Mr Oneissi and Mr Sabra, knew that Mr Hariri was the target of the crimes charged.Footnote ¹¹

43. The Trial Chamber has considered every crime and charge against each Accused individually, determining for each whether the evidence establishes beyond reasonable doubt all facts indispensable to a conviction. This is consistent with the Trial Chamber's obligation under Rule 148 (B) of the Special Tribunal's Rules of Procedure and Evidence to vote separately on each charge contained in an indictment and to make separate findings as to each Accused.Footnote ¹²

44. The Trial Chamber has assessed each piece of evidence in the context of all related evidence. Taking this approach is particularly important in evaluating the Prosecution's telecommunications evidence. The evidence against the four Accused is almost completely circumstantial. It is only from reviewing the relevant facts in their entirety that a chamber can see patterns that could potentially emerge from which conclusions could be drawn that they are so striking as to be beyond coincidence. And hence provide proof beyond reasonable doubt of facts indispensable to a conviction.Footnote ¹³

45. The Trial Chamber has therefore assessed each piece of underlying circumstantial evidence both individually and in its totality with all other pieces of relevant evidence to determine whether the Prosecution has proved each material fact beyond reasonable doubt. Where they appear to lack strength the Trial Chamber has scrutinised them with extra caution, both individually and in their totality.Footnote ¹⁴

46. The Trial Chamber is acutely aware of the difficulties inherent in attempting to assess the reliability and credibility of witness testimony—especially in an international setting, through interpretation and many years after the attack on Mr Hariri—and has borne these factors in mind in evaluating the evidence of each witness. A chamber may accept parts of a witness's testimony and reject others, so long as the two are not inextricably linked. In this case, for the most part, there were few explicit challenges to the credibility of Prosecution witnesses; more challenges were made to the reliability of witness recollections and some conclusions or opinions. The Trial Chamber, however, carefully considered the credibility of each witness in determining the weight of their evidence.Footnote ¹⁵

47. A witness's association with a party, both actual and apparent, should be considered in finally evaluating their evidence; this is one of a number of potential considerations in that final holistic evaluation, and it is not necessarily determinative.Footnote ¹⁶

48. Expert witnesses are those who, by virtue of some specialised knowledge, skill or training, can assist the trier of fact to understand or determine an issue in dispute. During the trial itself, the Prosecution moved to admit into evidence the reports of 20 expert witnesses. The Oneissi Defence also successfully moved to call the evidence of one expert.Footnote ¹⁷

CELL SITE EVIDENCEFootnote ¹⁸

49. Of central importance to the case is telecommunications evidence, comprising cell site evidence, call data records and call sequence tables. Cell site data includes: the date of the production of the data; name of the person producing the data; a record reference; the cell ID; the name of the cell site; full address of the cell site, including postal code; grid co-ordinates of the cell site; sector number or code; number of sectors and azimuths of all sectors; orientation, azimuth and bearing in degrees from north of all sectors; antenna height; and the date on which a particular cell site was first brought into service.Footnote ¹⁹

50. The Trial Chamber admitted cell site evidence, based on information obtained from the Lebanese telecommunications providers, Alfa and Touch, on the locations and names of the cell sites, also called cell towers, comprising their mobile telecommunication networks, and various features of the antennae mounted on these cell towers, such as the direction of the antenna—known as the ‘azimuth’—and its tilt.Footnote ²⁰

51. Call data records provide information about communications, such as the source and destination telephone numbers, the type of communication (voice call or text message), the date and time of the communication, the duration of the voice call, the IMEI number of the handset relevant to the communications, and the cell towers to which the mobiles connected. Call data records are the business records of telecommunication companies generated and retained automatically and legally in the normal course of their business.Footnote ²¹

52. Instead of receiving billions of incomprehensible call data records in evidence, the Trial Chamber admitted into evidence numerous call sequence tables; this was on theapplication of both Prosecution and the Defence of all four Accused and Mr Badreddine.Footnote ²² These are tables that present chronological sequences of calls relating to a particular, or target, telephone number—mobile or landline—over a specified period. They are extracted from the records of telecommunication operators and combine call data records and cell site information. The tables make these records accessible and capable of presentation and analysis without altering the data.Footnote ²³

Excerpt from a combined call sequence table with cell detail removed, extracted from Mr Philips's report ‘An introduction to cell site analysis as applied to GSM networks’ Footnote ²⁴

AGREED FACTS OR ‘AGREEMENTS AS TO EVIDENCE’ AND JUDICIAL NOTICEFootnote ²⁵

53. During the trial, the Trial Chamber recorded a number of facts as being agreed between the Parties, or between some of the Parties. The Trial Chamber took judicial notice of several facts of common knowledge.Footnote ²⁶ The agreements as to evidence included that:

1. • In addition to killing Mr Rafik Hariri, the explosion killed 21 other persons listed in Schedule A of the Indictment;

2. • The explosion injured 226 persons listed in Schedule B of the Indictment;

3. • The video of the claim of responsibility was later broadcast on television; and

4. • Mr Rafik Hariri was born on 1 November 1944 in the city of Sidon, Lebanon.

THE HISTORICAL AND POLITICAL BACKGROUND TO THE ATTACKFootnote ²⁷

54. The Trial Chamber heard extensive evidence from the Prosecution and the Defence of Mr Oneissi concerning the political and historical background to the attack.Footnote ²⁸ It heard evidence from Mr Marwan Hamade and other politicians and officials about the events leading to Mr Hariri's assassination. These included Mr Walid Jumblatt, Mr Fouad Siniora and Mr Jamil El- Sayyed.Footnote ²⁹

55. The Trial Chamber's role as a first instance trial court is neither to write nor correct any version of history that witnesses or parties may have urged upon it. Its role is confined to adjudicating whether any of the four Accused are guilty beyond reasonable doubt of any of the charges against them. The attack on Mr Hariri, however, did not occur in a political or historical vacuum and the Trial Chamber cannot ignore the background to the attack as providing a possible motive for it. It does this while noting that motive is not an element of any of the crimes charged in the amended consolidated indictment.Footnote ³⁰

56. The assassination by car bombing of a prominent politician—who had recently resigned as the prime minister and was preparing to contest the next parliamentary elections—was undoubtedly a political act. The Trial Chamber should therefore consider whether political motives may be attributed to any of the Accused, or the former accused and named co-conspirator, Mr Mustafa Amine Badreddine. Another important consideration is that of context. Understanding the political background to the attack is necessary to form an understanding of why Mr Hariri was targeted in this manner, but only insofar as it relates to whether or not any of the Accused on trial are guilty of any of the counts charged. Similarly, completeness requires placing the attack within a wider historical setting.Footnote ³¹

57. The Trial Chamber is satisfied from the evidence that:Footnote ³²

1. • From the end of the civil war Syria had an overwhelming political, military and economic dominance in Lebanon;

2. • From the Israeli withdrawal from southern Lebanon in 2000, internal Lebanese opposition grew to the continuing presence of Syrian soldiers in Lebanon and to Hezbollah maintaining an armed militia, contrary to the Taif Agreement;

3. • The opposition was expressed through political allegiances including of Mr Jumblatt's Druze political faction, Christians and members of Mr Hariri's Future Movement;

4. • Mr Hariri's political allies vocally supported UN Security Council resolution 1559;

5. • The Syrian government wanted the mandate of President Lahoud—who was a strong supporter of Syria—to be extended by the Lebanese Parliament;

6. • Mr Hariri and his allies were opposed to this;

7. • The Syrian Government imposed certain electoral candidates on Mr Hariri, which were known as ‘Syrian deposits’;

8. • In August 2004, President Al-Assad effectively ordered Mr Hariri to support the extension of President Lahoud's mandate, stating that Syria alone would choose the President of Lebanon;

9. • Mr Hariri did not publicly support UN Security Council resolution 1559, passed on 2 September 2004, which called for the withdrawal of foreign troops from Lebanon and the disbanding of armed militias. The foreign troops in question were Syrian and the militia was Hezbollah's;

10. • On 3 September 2004, Mr Hariri and his bloc voted in Parliament to extend the mandate and on 12 September 2004 he announced that his government would resign;

11. • In the months before his assassination, Mr Hariri's allies were publicly calling for an end to the Syrian political, military and economic dominance over Lebanon;

12. • Their efforts increased after the passage of resolution 1559, including in the three Bristol meetings, 22 September 2004, 13 December 2004 and 2 February 2005, in which Mr Hariri was represented by his political supporters;

13. • According to many witnesses, the attempted assassination of Mr Marwan Hamade on 1 October 2004 could be construed as a warning to Mr Hariri and Mr Jumblatt not to cross the line;

14. • Mr Hariri resigned on 20 October 2004 and was planning to run in the May 2005 elections. He would have been proposing the loosening of Syrian dominance over Lebanon and supporting the immediate withdrawal of Syrian troops;

15. • A proposed electoral law for the 2005 elections—supported by the Syrian government—was designed to diminish Mr Hariri's chances of having members of his bloc elected to Parliament and hence his prospects of a new term as prime minister;

16. • The Syrian government was insisting that Mr Hariri accept so-called Syrian ‘deposits’ in his electoral list, and Mr Hariri was opposed to this;

17. • The Chief of Syrian Military Intelligence in Lebanon, Mr Rustom Ghazaleh received regular monthly cash payments from Mr Hariri through intermediaries from 1993 onwards, including a ‘double’ payment on Sunday 13 February 2005;

18. • Mr Hariri and Hezbollah's Secretary-General, Mr Hassan Nasrallah had good relations in the years immediately before his death and were meeting regularly;

19. • Mr Hariri believed that Hezbollah's militia should be disarmed, at the very least, when peace with Israel was achieved;

20. • Mr Badreddine, Mr Ayyash, Mr Oneissi and Mr Sabra were Hezbollah supporters;

21. • Mr Mustafa Badreddine was a senior Hezbollah military official;

22. • The growing opposition to the Syrian presence in Lebanon threatened Syria's interests;

23. • Syria and Hezbollah may have had motives to eliminate Mr Hariri, and some of his political allies;

24. • There is no evidence that the Hezbollah leadership had any involvement in Mr Hariri's murder and there is no direct evidence of Syrian involvement in it;

25. • There is no evidence that either Mr Ayyash or Mr Badreddine were directed by the Hezbollah leadership to arrange logistical support for Mr Hariri's assassination; and

26. • The attack involved an RDX-based explosive. Some witnesses observed that ‘RDX is so powerful that it is most suitable for military purposes’. From this, it may be concluded that those responsible for co-ordinating the attack had access to what could be described as ‘military-grade explosives’.

THE PARTICIPATING VICTIMS' CASEFootnote ³³

58. On the application of the Legal Representatives of Victims, the Trial Chamber heard evidence from six participating victims and a victimologist, Professor Rianne Letschert, and received into evidence 24 witness statements and their associated exhibits, namely documents related to their statements; a total of 45 exhibits. This evidence mainly relates to injuries and deaths of victims relevant to the (attempted) homicide charges.Footnote ³⁴

59. At the request of the Legal Representatives of Victims, the Trial Chamber also admitted into evidence documents—22 exhibits—under Rule 154. One of them was a compilation of 181 documents—the Trial Chamber admitted 175 of them into evidence. They consist of medical records, identification documents, family or individual status extracts, death certificates of people who died in or as a result of the explosion, documents relating to financial expenses and employment, photographs, press clippings and Lebanese court decisions.Footnote ³⁵

60. The Trial Chamber was satisfied that the victims' case, as proposed by the Legal Representatives of Victims, was contained and proportionate. It was also generally unopposed.Footnote ³⁶

61. Seven participating victims who provided written statements were injured in the explosion. The other 17 witnesses are relatives of people who died in, or as a result of, the explosion. These witnesses' evidence provides information on their last contacts with the deceased relatives, their relationship with them, how they learned about the explosion and, in several cases, who identified the bodies. The evidence is also of the material, physical or mental harm they and their family members suffered as a result of their relatives' deaths.Footnote ³⁷

62. The testimony and material presented either by or for the participating victims does not provide direct evidence of the individual criminal responsibility of any Accused. Collectively, however, it goes to proving the elements of the offences charged to the extent that harm to the named victims of the attack, or death, is an element of proof in relation to the charges—for example, intentional homicide with premeditation by using explosive material. The Trial Chamber however was mindful to ensure that the participating victims did not ‘double-up’ on the Prosecution evidence or act as a second Prosecutor.Footnote ³⁸

63. The Trial Chamber cannot order reparations but may identify victims, which may assist them in claiming compensation before a national court or another competent body. The Trial Chamber is satisfied beyond reasonable doubt that direct and indirect victims suffered harm.Footnote ³⁹

64. There is no doubt that terrorism is one of the most serious and heinous crimes and that the attack on 14 February 2005 was very grave.Footnote ⁴⁰ The gravity of the offence includes the inherent gravity of the crime and the Accused's criminal conduct—their form and degree of participation—and also encompasses the impact of the crimes on the victims.Footnote ⁴¹

65. The Legal Representatives of Victims invited the Trial Chamber to remind the Lebanese Government of the terms of the UN Declaration of Basic Principles of Justice for Victims of Crime and Abuse of Power on the matter of ‘compensation’ and the importance of the availability of an adequate compensation scheme for the victims or, alternatively, to recommend the establishment of a voluntary trust fund to compensate the victims in the cases ‘within the Tribunal's jurisdiction’—‘possibly even the HRC itself’ [namely, the Lebanese High Relief Commission]. The Special Tribunal cannot grant compensation or order reparations. Article 25 of the Statute, ‘Compensation to victims’, provides that a victim may bring an action to obtain compensation in a national court or other competent body.Footnote ⁴²

66. The harm suffered by the victims of the attack on 14 February 2005—lost lives, personal injuries or the loss of a family member—cannot be restituted, as restoration of the original situation of the victim, before the violation, is impossible. Nevertheless, the Trial Chamber does not interpret Article 25 as limiting the type of reparations a victim of the attack may seek before a national court or competent body, by narrowing it to ‘compensation’ in its strict sense, as defined in international criminal case law. Victims will be able to seek, pursuant to the relevant legislation, the type of reparations they consider more appropriate, including those with a symbolic value.Footnote ⁴³

67. The Trial Chamber heard about a dramatic disparity in treatment among the participating victims as to ‘compensation’—meaning the pecuniary remedy, for the loss or damage suffered, not depending on prosecutorial charges or judicial accountability, that participating victims received, or not, or applied for after the attack. The Trial Chamber underlines that compensation should be appropriate and proportional to the gravity of the harm suffered. The Trial Chamber notes the sense of injustice perceived by some victims because some were compensated while most, it appears, were not. Compensation should not depend on the circumstances of the victims, their connections, employment relationship or insurance scheme. As a general proposition, the Trial Chamber agrees that victims of crimes should be entitled to receive a form of statutory compensation, such as those mandated by the European Union.Footnote ⁴⁴

68. As to the Legal Representatives of Victims' request that the Trial Chamber make recommendations on the need for professional psychological support in Beirut in future proceedings, the Trial Chamber endorses any improvement in supporting the participating victims' needs. It refers the matter of Professor Letschert's recommendation—based on the participating victims' views—to the Registrar and the Victims' Participation Unit, for their consideration. This is an ancillary matter, as it is not a formal finding for the purpose of determining whether the Accused are guilty, or for any other purpose accepted by the Trial Chamber to be within its mandate.Footnote ⁴⁵

THE EXPLOSIONFootnote ⁴⁶

69. On the morning of Monday 14 February 2005, Mr Hariri left Quraitem Palace to attend a morning session of the Lebanese Parliament. Shortly before 12:00, he left Parliament and went to café Place de l'Étoile, where he stayed for around 45 minutes. At around 12:45, he left the café and asked his security detail to prepare his convoy to go back to the palace to attend a lunch appointment. At around 12:49, he entered his armoured vehicle, accompanied by MP Mr Bassel Fuleihan. At approximately 12:55, as the convoy passed a Mitsubishi Canter on Rue Minet el Hosn outside the St Georges Hotel, the suicide bomber detonated the explosives.Footnote ⁴⁷

Exhibit P90, p. 397 (Photograph of Mr Hariri after leaving the café Place de l'Étoile) Footnote ⁴⁸

70. The composition of Mr Hariri's convoy was decided on each occasion by his close protection officers Mr Yahya Al-Arab and Mr Talal Nasser for the civilian side, and his chief of security, Mr Wissam Al-Hassan, for the ISF side (Lebanese Internal Security Force). It usually consisted of six or seven cars. An ISF black or navy blue Toyota Land Cruiser VX-R four wheel drive, with four ISF members, and equipped with a siren and lights, would be in the lead. Its role was to clear the road before the convoy.Footnote ⁴⁹

71. Behind Mr Hariri's car—fourth and fifth in the convoy—were the other two close protection vehicles. Mr Mohamed Darwiche—one of Mr Hariri's personal bodyguards—was driving the fourth car, and with him were Mr Nasser and Mr Al-Arab, the supervisor of the close protection team. Mr Ziad Tarraf, a bodyguard, was driving the fifth car. Mr Mohammed Ghalayini and Mr Omar Al-Masri were in that vehicle with him. The ambulance was last, with a driver and two paramedics, Mr Rachid Hammoud and Mr Mazen Al-Zahabi.Footnote ⁵⁰

72. The explosion occurred around 40 or 50 metres behind the lead vehicle in Mr Hariri's convoy. Witnesses described two deep sounds a second apart, a ‘huge roaring sound’ and ‘a wave of hot pressure’, a ‘huge explosion’, ‘the sound of an aircraft going through the sound barrier’ or ‘a missile thrown by a large artillery gun’, and described it as ‘like an earthquake.’ The explosion was heard throughout the city, up to 25 kilometres away. While some could barely remember the ordeal due to the injuries and shock, and described it as ‘dream-like’, many gave a vivid account of the explosion and immediate aftermath.Footnote ⁵¹

73. The HSBC Bank is on Minet el Hosn Street, between the Phoenicia Hotel and the attack site.Footnote ⁵² The HSBC building was a scene of ‘chaos and destruction’. People were screaming. There were ‘fire and flames everywhere,’ dust and smoke, and it was dark. The moment of the explosion was described as ‘hell … like the whole building was collapsing’. The upper floors had no doors, windows or ceiling left. It was described as total chaos.Footnote ⁵³

Exhibit P65 (Photograph of the scene of the explosion) Footnote ⁵⁴

74. Firefighters arrived and tried to put out the fire. A total of 70 to 80 firefighters were called to assist at the explosion site, in addition to military officers both in plain clothes and in uniform who directed the operations.Footnote ⁵⁵

75. Mr Fuleihan survived the immediate impact of the explosion. He was transferred from the American University of Beirut Medical Center to France for treatment, where he succumbed to his injuries two months later on 18 April 2005.Footnote ⁵⁶

Exhibit P18, p. 4 Footnote ⁵⁷

THE INVESTIGATION AND FORENSIC EVIDENCEFootnote ⁵⁸

76. The Lebanese Military Intelligence and ISF conducted their own investigation and analyses of the explosion in February and March2005. Following a request from the Lebanese prime minister, the UN Secretary-General dispatched a fact-finding mission to Beirut to inquire into the causes, the circumstances and the consequences of this assassination.Footnote ⁵⁹

77. Members of the Lebanese security, military, judicial and Civil Defence services, and of the Red Cross, participated in the rescue, evacuation and body recovery operations at the crime scene immediately after the explosion. This included fire stations from different sectors of Beirut, the ISF Central Accidents Bureau, falling under the ISF judicial police, the ISF Explosives Bureau and the ISF Counter-terrorism and Major Crimes Unit.Footnote ⁶⁰

Aerial photograph of the crime scene with the crater in the middle and the two hotels (exhibit P244) Footnote ⁶¹

78. Six vehicles, including five from Mr Hariri's convoy, were removed by the ISF from the inner crime scene to the police headquarters at Helou Barracks during the evening on 14 February 2005.Footnote ⁶² Critical evidence was removed from the crime scene when the six convoy vehicles were removed and taken to the Helou Barracks ‘under the pretext of preserving them’. Tow trucks and other heavy duty vehicles used to remove the vehicles drove into the crime scene within hours of the explosion to remove the convoy vehicles.Footnote ⁶³

79. The area of the explosion stretched along the main road, Rue Minet el Hosn, for around 250 metres in between the St Georges Hotel to the north, north-east, and Hotel Byblos to the south, south-west.Footnote ⁶⁴

80. About four days after the explosion, Mr Samir Yazbek, the Head of the Lebanese Civil Defence's Marine Rescue Team, was assigned by the Directorate General to conduct a diving mission in the St Georges area to look for Mr Mohammed Ghalayini who was missing. During the mission, Mr Yazbek recognised vehicle parts and filmed them.Footnote ⁶⁵

81. A Swiss forensic team arrived in Beirut in March 2005.Footnote ⁶⁶ A Dutch forensic team started its investigation of the crime scene on 13 August 2005, assisted by other experts and Lebanese officers.Footnote ⁶⁷ The Dutch forensic team received assistance: from Lebanese ISF officers in searching the crime scene; a team of six British divers and divers from the Lebanese fire brigade in searching underwater in the St Georges marina.Footnote ⁶⁸ The Spanish government sent a team of experts to Beirut in May 2006 to assist in the investigation.Footnote ⁶⁹

Exhibit P101 (Photograph of crater and crime scene) Footnote ⁷⁰

FINDINGS ON THE MANAGEMENT OF THE CRIME SCENE AND INVESTIGATIONFootnote ⁷¹

82. The evidence reveals a mismanaged, disorganised and chaotic approach to the crime scene investigation, particularly in the initial period after the explosion. Extensive evidence was received from which the Trial Chamber can conclude that there was little to no coordination between the various responsible Lebanese authorities during this period.Footnote ⁷²

83. While acknowledging the ease of hindsight criticism, it is also evident that many elementary crime scene procedures were either ignored or not followed. The Trial Chamber recognises the inevitability of turmoil in the immediate aftermath of such a terrorist attack—including of course the uncertainty of whether another may follow—and especially where someone as prominent as Mr Hariri was its target. On top of this was the natural concern of friends and family of those who may have been victims of the explosion, who rushed to the scene and were allowed onto it. And into this mix must be added the distrust—that some Lebanese people had towards their state institutions—that some victims testified about. The evidence revealed the frustration that some victims felt in relation to the competence of the investigation, with some even taking investigatory matters into their own hands.Footnote ⁷³

84. The Trial Chamber also recognises that the priority immediately after the explosion was rescue and recovery—with an emphasis on the wounded—and safety in, for example, putting out the fire. This would inevitably contaminate any crime scene. Securing the crime scene was, it appears, very much a secondary issue.Footnote ⁷⁴

85. But what is perhaps more incomprehensible was the removal of the convoy vehicles from the crime scene immediately after the explosion—by mechanical means, and in some instances not very carefully. Bulldozers and heavy machinery also were used at the crime scene. The removal process allowed for potential damage to the vehicles and the heavy machinery disturbed the crime scene at a crucial time before any forensic experts could search for or analyse evidence. The video of the removal shows a reckless destruction of a crime scene which may have resulted in the loss of crucial forensic evidence. This was completely avoidable. It was done on the evening of Monday 14 February when there was no reason, much less any urgency, in suddenly—and during the night—clearing a live crime scene in this rough and insensitive manner. Although it is possible that the Lebanese authorities, including Judge Mezher,Footnote ⁷⁵ instructed the immediate removal of the convoy vehicles to preserve them from any interference at the crime scene, the Trial Chamber is not satisfied that this was justified or prudent, at least not in the manner it occurred.Footnote ⁷⁶

86. Furthermore, the authorities had no coordinated procedure to search for missing persons in the days following the explosion, and some victims' bodies were found weeks after the explosion. This cannot be attributed to the initial panic and chaos at the crime scene immediately after the explosion. As an example, Mr Mohammed Ghalayini's body was found only after repeated attempts by his family to search for him at the crime scene, on their own and on one occasion with search dogs they brought onsite and paid for themselves.Footnote ⁷⁷

87. In light of the above, the Trial Chamber finds that the mismanagement of the initial investigation could have affected the reliability of some evidence recovered at the crime scene, including aspects of the collection of human remains. This is further considered below in relation to the findings on the human remains recovery and their DNA analysis, and in particular as it relates to an unidentified male.Footnote ⁷⁸

88. Despite all this, the Trial Chamber is satisfied that Lebanese officers and experts, assisted by multiple international forensic teams, conducted thorough and successful investigations into various aspects of the explosion in very difficult circumstances. This included explosives, ballistics and forensic crime scene investigation—including Lebanese volunteers and international underwater diving teams and experts in identifying vehicle parts— and forensic science and human identification.Footnote ⁷⁹

89. The Trial Chamber is satisfied that the various investigations resulted in the reliable collection of key evidence at the crime scene, such as the vehicle parts and some of the human remains. The Trial Chamber is not convinced that the gross deficiencies in the initial investigation affected in any material manner the evidence underlying the issues that require deliberation on the guilt of the Accused.Footnote ⁸⁰

FINDINGS ON THE EXPLOSIVES USEDFootnote ⁸¹

90. The Trial Chamber finds beyond a reasonable doubt that the attack consisted of a detonation reaction of high explosives. The damage and destruction to the St Georges and Byblos Hotels demonstrate the nature of the explosion, most notably the bent column and canopy at the St Georges Hotel and the large portion of the Byblos Hotel front wall that slid 60 centimetres. The mangled metal fragments found at the scene of the explosion, and the presence of washout on several of them, further confirms that high explosives were used during the attack.Footnote ⁸² The fact that a three-and-a-half metre section of the front wall of the Byblos Hotel that was 20 centimetres thick had been pushed back 60 centimetres and severely demolished meant that an ‘enormous explosion’ had taken place.Footnote ⁸³

91. The evidence as to the quantity, height and shape of the explosives is extensive, technical and complex. Nevertheless, the conclusions from this evidence are straightforward. Relying on Professors Ambrosini and Luccioni's analysis,Footnote ⁸⁴ the Trial Chamber finds that the quantity of explosives used in the attack was in the range of 2,500 to 3,000 kilograms of TNT equivalent, the explosion took place approximately 50 to 80 centimetres above ground level and the explosive charge was rectangular in shape.Footnote ⁸⁵

92. Professors Ambrosini and Luccioni first estimated the quantity of explosives from the crater size. Accordingly, the Trial Chamber has examined the general evidence regarding craters produced by explosions, the evidence as to the size of the crater resulting from the explosion and finally the two experts' analysis of the quantity of explosives needed to create such a crater.Footnote ⁸⁶ The size of a crater depends on three factors: the quantity of explosives, the shape of the explosive and the height of the explosive above or below ground. As the quantity of explosives increases, so too does the diameter of the crater. Ground reflection also impacts the size of the crater.Footnote ⁸⁷

93. Indeed, an explosion in a narrow street with tall buildings with few openings will create higher peak pressure and peak impulse values because of reflections from the nearby walls. Professor Luccioni said that this is known as the canyon effect.Footnote ⁸⁸

94. The Trial Chamber accepts Mr Bart Hoogeboom's measurement as to the size of the crater.Footnote ⁸⁹ He is an expert forensic image analyst.Footnote ⁹⁰ Professors Ambrosini and Luccioni relied upon these measurements. The Trial Chamber therefore finds that the explosion created a crater that, based on the cone shape, had a diameter of around 11.4 metres with a depth of around 1.9 metres, within a margin of error of several per cent.Footnote ⁹¹

95. A white truck first appeared in CCTV footage from the Suleiman Frangieh tunnel, around 11:56:57.Footnote ⁹² The Trial Chamber is unable to find that the white truck seen in CCTV footage exiting from the Suleiman Frangieh tunnel and passing the Phoenicia Hotel and HSBC Bank was a Mitsubishi Canter.Footnote ⁹³

96. A white truck was captured in CCTV footage from the HSBC Bank. This video showed a white truck traveling along Minet el Hosn Street towards the location of the attack from 12:52:36 until 12:53:17. The truck travelled slowly, approximately ten times slower than normal traffic.Footnote ⁹⁴ Two minutes later, the same HSBC Bank CCTV camera captured Mr Hariri's convoy as it sped towards the St Georges Hotel. The CCTV system recorded the convoy at 12:54:57.Footnote ⁹⁵

97. The Trial Chamber finds that 41 vehicle parts recovered by the Lebanese and international investigation teams after the explosion came from a Mitsubishi Canter. One part was an engine block, number 4D33-J01926, from a Mitsubishi vehicle with vehicle registration number FE52 CE-0560619.Footnote ⁹⁶ The Trial Chamber is thus satisfied beyond reasonable doubt that the explosives were situated in the rear of a Mitsubishi Canter with the identifying engine block number 4D33-J01926.Footnote ⁹⁷

98. The Trial Chamber heard evidence on the functioning of jamming devices, the presence of such devices in Mr Hariri's convoy and the likelihood that the devices were activated when the explosion took place.Footnote ⁹⁸ The Trial Chamber finds that the jamming device systems were activated at the time of the attack.Footnote ⁹⁹ The Trial Chamber is satisfied that the convoy witnesses who saw the jammers were functioning were credible and reliable. They had an independent recollection of the events which corroborated each other's accounts.Footnote ¹⁰⁰

SUICIDE BOMBERFootnote ¹⁰¹

99. The consensus of the various Lebanese and international investigation teams was that a suicide bomber triggered the explosion.Footnote ¹⁰² The Trial Chamber has no reason to disagree with the consensus of the forensic teams that a suicide bomber triggered the explosion. Each team eliminated the other possible means of detonation as inappropriate for targeting a moving convoy of vehicles. This leaves only the possibilities of a remote control device or a suicide bomber.Footnote ¹⁰³ The Trial Chamber therefore finds beyond a reasonable doubt that a suicide bomber triggered the attack.Footnote ¹⁰⁴

100. Based on the DNA evidence found at the scene and the analysis of DNA samples from Mr Abu Adass's family members, the Trial Chamber is satisfied beyond a reasonable doubt that Mr Abu Adass was not the suicide bomber.Footnote ¹⁰⁵

101. The Trial Chamber further finds that the attack involved an explosion of high explosives material, specifically RDX, in the quantity of 2,500 to 3,000 kilograms of TNT equivalent, laid out in a rectangular shape, located 50 to 80 centimetres above the ground in the rear of a Mitsubishi Canter truck, and triggered by a suicide bomber. Finally, the Trial Chamber finds that the attack killed 22 people, including Mr Hariri, and injured 226 others and that the unknown suicide bomber died in the explosion.Footnote ¹⁰⁶

RECOVERY OF HUMAN REMAINSFootnote ¹⁰⁷

102. The Trial Chamber received evidence from members of the ISF police and Lebanese and international experts in forensic science about the recovery of bodies, human remains and the identification of victims following the explosion.Footnote ¹⁰⁸ Twenty-three people died in the explosion or in the aftermath of the blast, including the suicide bomber. However, only 20 complete bodies were recovered from the crime scene.Footnote ¹⁰⁹

103. Immediately after the explosion, the ISF requested Dr Fouad Ayoub, who the Trial Chamber declared an expert in forensic science specialised in human identification, to assist in identifying the bodies found at the crime scene and which were later transported to several hospitals in Beirut.Footnote ¹¹⁰ Human remains from three members of Mr Hariri's convoy were recovered from the crime scene: Mr Darwiche's mutilated body and smaller body parts from Mr Nasser and Mr Al-Arab. Two bags of unknown human remains were given to Mr Al-Arab's family for burial before any DNA analysis was done on them.Footnote ¹¹¹ Smaller pieces of tissue and bones belonging to a third unidentified person, the ‘unidentified man’, were also recovered.Footnote ¹¹²

104. In total, the experts and investigators recovered and identified 92 human parts belonging to the unidentified man. The total quantity of remains was small, with a combined weight of less than one kilogram.Footnote ¹¹³ Dr Issam MansourFootnote ¹¹⁴ identified four samples, including a partially burned tooth, as belonging to the unidentified man. However, none of the samples retrieved at the crime scene matched Mr Abu Adass's DNA profile.Footnote ¹¹⁵

105. The Trial Chamber has considered that Dr Ayoub and the Dutch forensic team reached the same conclusion based on the distribution of the remains at the crime scene—that the unidentified man was very close, within one to two metres to the explosive device when it detonated. The Spanish forensic team's findings on where the remains were found are also consistent with this conclusion. In light of this, the Trial Chamber is satisfied that based on the remains of the unidentified male recovered at the crime scene, he was the closest in proximity—within one to two metres—to the explosive device when it detonated. He was most likely the suicide bomber.Footnote ¹¹⁶

106. Beyond the evidence that the tooth belonged to a young male in his early 20s, there is no further identifying evidence in the human remains analysed by the forensic experts on his identity. The Trial Chamber therefore cannot make a finding on the identity of the ‘unidentified male’.Footnote ¹¹⁷

RELIABILITY OF THE TELECOMMUNICATIONS EVIDENCEFootnote ¹¹⁸

107. The Prosecution's case relies upon expert cell site analysis of the call data records of mobiles it attributed to the four Accused, and Mr Badreddine. Mr John Edward Philips, an expert in cell site analysis and telecommunications, gave extensive opinion evidence on the telecommunications data provided by the two Lebanese telecommunications providers, Alfa and Touch, relating to particular mobiles. This was to identify their approximate geographic location and to track their movements.Footnote ¹¹⁹

108. Mr Philips used the call data records of these mobiles, and the cell site data relating to the cell masts to which they connected. He also used the networks' coverage maps which show where cell sectors provide the predicted best coverage and plotted them onto Google Earth. The Prosecution used its own software, the ‘electronic presentation of evidence’, to illustrate the relevant mobile call and movement patterns by plotting the coverage maps onto it.Footnote ¹²⁰

109. The Trial Chamber was satisfied that Mr Philips's cell site analysis was sufficiently reliable to use to assess the general locations and movements of these mobiles. The Trial Chamber was also satisfied that Alfa's and Touch's call data records and cell site data were business records created in the normal course of their business. Much of the evidence of the Alfa and Touch representatives, respectively Witnesses 705 and 707, was based on business records mainly produced in the normal course ofbusiness.Footnote ¹²¹

110. The Trial Chamber was also satisfied of the reliability of their evidence as suitably qualified corporate witnesses who used a range of data from relevant sources, including information from outside of their own personal knowledge. The Trial Chamber was thus satisfied that the telecommunications data had the necessary probative value to use to determine that specified mobiles were communicating with each other in the four pleaded Red, Yellow, Blue and Green networks, and the Purple group of mobiles, and to approximately locate the mobiles.Footnote ¹²²

111. The evidence is also sufficiently reliable and probative to use to determine whether the four Accused and Mr Badreddine were using the personal mobiles allegedly attributed to each. Hence, the cell site evidence had the probative value needed to determine whether the personal mobiles of Mr Ayyash, Mr Badreddine and Mr Merhi were co-locating with the relevant pleaded Red, Yellow, Blue, and Green network mobiles, and thus whether these mobiles had a single user. In making these findings the Trial Chamber carefully considered the inherent margin of error in Alfa's and Touch's predicted coverage maps, the non-contemporaneous nature of some of the basic cell data the Prosecution was using and the approximation method used to produce the data. Footnote ¹²³

112. In the Trial Chamber's view, Witnesses 705's and 707's accounts as a whole were credible, reliable and internally consistent, despite their lack of contemporaneous personal knowledge relating to discrete parts of Alfa's and Touch's record making practices. The Trial Chamber assessed the quality of their evidence, including the accuracy of their memory, in order to assess its reliability and credibility. The Trial Chamber finds that Witnesses 705 and 707 had sufficient personal knowledge, and consulted suitably qualified personnel at Alfa and Touch as to matters outside of their personal knowledge, such as to allow it to assess and give appropriate weight to the specific telecommunications evidence on which the Prosecution relied to determine mobile users' approximate locations or movements.Footnote ¹²⁴

113. After carefully considering the totality of the relevant evidence, the Trial Chamber finds that cell site analysis, which also takes into consideration the enlarged range of a mobile's approximate location, is a technique capable of providing sufficiently reliable assessments and results on which the Trial Chamber can rely in reaching a conclusion regarding the relevant mobiles' general locations and movements. Any limitations in the evidence of relevant mobiles' general location and movement are factors that the Trial Chamber must carefully consider in assessing the evidence and determining its weight.Footnote ¹²⁵

ELECTRONIC PRESENTATION OF EVIDENCEFootnote ¹²⁶

114. The Prosecution used its own software the ‘electronic presentation of evidence’ to present parts of its case in court.

115. It significantly enhanced the Trial Chamber's understanding of the lengthy and complex evidence, thus ensuring a fair trial. Without it, the Trial Chamber would have had difficulties to understand the masses of technical detail without visual context; this includes the presentation of both Prosecution and Defence cases. And in this respect, the visual aids used by Defence counsel in court, were as useful as the Prosecution's. The Trial Chamber remained the trier of fact, assessing every piece of analysis and conclusion.Footnote ¹²⁷

NATURE AND PURPOSE OF COLOUR-CODED MOBILE NETWORKS AND PURPLE GROUP OF MOBILESFootnote ¹²⁸

116. The Prosecutor alleges that the Accused carried out Mr Hariri's assassination by using groups of mobiles that operated as networks, namely mobile groups with a high frequency of contacts within the group.Footnote ¹²⁹

117. The Green network of three mobiles, allegedly monitored and coordinated the attack and the false claim of responsibility. The Red network of eight mobiles, carried out the assassination of Mr Hariri. The Blue network of 15 mobiles and the Yellow network of 13 mobiles, were used to prepare for the attack, including the surveillance of Mr Hariri. The three mobiles in the fifth group, the Purple mobiles, were used to communicate with each other and others outside the group to coordinate the false claim ofresponsibility.Footnote ¹³⁰

118. The Trial Chamber also received extensive and detailed evidence from two Prosecution expert witnesses: Mr Philips and Mr Gary Platt.Footnote ¹³¹ Mr Philips has more than 30 years of experience as a chartered engineer and many years of experience with cell site analysis.Footnote ¹³² Mr Platt is a Prosecution investigator who the Trial Chamber declared qualified to give an expert opinion on the identification and organisation of covert communication networks.Footnote ¹³³

119. A mobile network is a group of mobiles that form a communication network. A ‘mission phone’ is a special type of mobile network. Mr Philips defined a ‘mission phone’ as a mobile obtained and dedicated to a specific objective or mission, which is covert and almost always ‘nefarious’. Those involved in the mission do not want to be associated with it, so anonymity in all areas is key and an essential characteristic. These mobiles differ from personal mobiles, which are non-covert mobiles used to call family and friends and are for everyday usage.Footnote ¹³⁴

120. The chart below is from paragraph 18 of the amended consolidated indictment showing the Prosecutor's pleading of who is alleged to have been using various network and personal mobiles.

GREEN NETWORKFootnote ¹³⁵

121. The Prosecutor alleges that the Green network mobiles—Green 023, Green 071 and Green 300—were used to monitor and coordinate the preparations for the attack, including the preparation of the false claim of responsibility. Further, the Green network was used to monitor the physical perpetration of the attack. The Green network mobiles were used from at least 30 September 2004 to 14 February 2005. From 13 October 2004 until they ceased all activity on 14 February 2005 about one hour before the attack on Mr Hariri, the Green network mobiles communicated exclusively with each other and had no outgoing text messages.Footnote ¹³⁶

Figure 1 from John Edward Philips's Green Mission Phones report—exhibit P1116, p. 32 Footnote ¹³⁷

122. Mr Badreddine is alleged to have been using Green 023, Mr Ayyash using Green 300 and Mr Merhi, Green 071.

123. They were operational on 41 days in total, which includes two days—9 November and 29 December 2004—when Green 071, Green 300 and Green 023 did not make or receive calls, but each received a service text message.Footnote ¹³⁸ During this period, Green 071, Green 023 and Green 300 operated within an absolute closed user group. They communicated only within this closed user group, with no contact with any other mobile. There were no misdials and no calls to third parties.Footnote ¹³⁹

124. Green 071 ceased activity on 7 February 2005, after which its handset and SIM card were not used again.Footnote ¹⁴⁰ On 14 February 2005, at 11:58, just about one hour before the explosion that killed Mr Hariri, Green 300 called Green 023 from near the marina area in Beirut. This marked the final Green call. According to Mr Platt, this final call is consistent with a coordination and command structure and with the fact that the operation succeeded.Footnote ¹⁴¹

125. The Trial Chamber finds that there was a covert Green network composed of the three Green mobiles—Green 023, Green 300 and Green 071—operating from 13 October 2004 until 14 February 2005. The exclusive communication within the Green network was intentional. The Trial Chamber also relies on the organised setup and financing of the Green mobiles to find that they were part of a network. The SIM cards for Green 023 and Green 300 were purchased from the same dealer on the same date, they were both activated on the same date, and they were first used within a day of each other. All three mobiles were activated in the same location, along with the other mobiles from the larger group of 18 Green mobiles. The monthly invoices for all three mobiles, as well as the larger group of 18 Green mobiles, were all paid in cash at the same time and place.Footnote ¹⁴²

126. The Trial Chamber finds that the Green network was a covert network due to the anonymity of its users. The evidence shows that the three Green mobiles were purchased using fake identification documents, and the bills were simultaneously paid in cash every month. They avoided sending any text messages and did not use voice mail or call forwarding.Footnote ¹⁴³

RED NETWORKFootnote ¹⁴⁴

127. The Red network is pleaded to be the ‘assassination team’. The Prosecutor alleges that the Red network of eight mobiles was used to observe Mr Hariri and locations connected to him and to carry out his assassination. The mobiles communicated almost exclusively with each other and had no outgoing text messages. They were all pre-paid, purchased without supplying subscriber information and all activated within 30 minutes of each other on 4 January 2005. They were all topped up during a 45-minute period on 2 February 2005. The final call within the network took place at 12:53 on 14 February 2005. After that, the Red mobiles were never used again.Footnote ¹⁴⁵

128. The mobiles were: Red 572, Red 636, Red 652, Red 662, Red 678, Red 741, Red 893 and Red 946. Mr Ayyash is alleged to have been using Red 741.

129. Two Red mobiles—Red 572 and Red 662, the ‘spare mobiles’—were shut down on Thursday 3 February 2005. The remaining six mobiles all ceased activity between 12:50 and 12:54 on Monday 14 February 2005, immediately before the attack. Their final calls activated cells close to the crime scene and Parliament.Footnote ¹⁴⁶

130. Based on Mr Philips's and Mr Platt's evidence, the Trial Chamber finds that the Red mobiles formed a covert network from Tuesday 4 January 2005 to Monday 14 February 2005.Footnote ¹⁴⁷

131. The evidence that all eight Red mobiles operated in a highly organised manner. Ninety- nine percent of communications by the Red mobiles—excluding service numbers—were with each other is compelling. They called one another on only 11 days between Friday 14 January and Monday 14 February 2005. Their periods of inactivity coincided, such as between Tuesday 4 and Friday 14 January 2005. Their primary areas of use were West and Central Beirut. Five handsets used by Red mobiles were purchased from the same store on the same date, 30 December 2004. All their SIM cards were close in sequence and likely bought in the same area. Users swapped handsets within the group of mobiles regularly and multiple times.Footnote ¹⁴⁸

132. The Red mobiles were all initialised on the provider network at the same time and place, in the Tripoli area on Tuesday 4 January 2005, within minutes of each other. Similarly, all the mobiles were topped up with additional credit in the Tripoli area on Wednesday 2 February 2005, within a 45-minute period. The principal six Red mobiles all made their last calls at the same time, on Monday 14 February 2005, just before Mr Hariri's assassination. All the Red mobiles were deactivated from operation on the Alfa network on 17 March 2005. Their handsets and SIM cards were never used again.Footnote ¹⁴⁹

133. The Trial Chamber notes further evidence—that some Red mobiles displayed sequential patterns for their IMEI numbers, their handsets were basic models, the voice calls between Red mobiles were of short duration and they all operated on the Alfa network—that may be less compelling but nevertheless provides additional support that the Red mobiles were part of a network.Footnote ¹⁵⁰

134. Further, the Red mobile users consistently acted in ways designed to preserve their anonymity. The SIM card subscribers for the Red mobiles did not provide their actual identities. The SIM card subscriptions were pre-paid, and only cash was used for transactions where the payment methods could be identified. The Red mobiles sent no text messages to each other and did not use voice mail or call forwarding. Users engaged in various transactions—purchasing handsets and SIM cards, initialising and topping up the mobiles—in the Tripoli area, far from their regular area of use in Beirut. Users also avoided night-time calls that could reveal where they lived. The total remaining credit of approximately USD 500 when the Red mobiles were deactivated is of lesser weight in comparison, but nevertheless provides some additional evidence of covertness.Footnote ¹⁵¹ The Trial Chamber therefore concludes that the eight Red mobiles operated together as a covert network.Footnote ¹⁵²

Slide 21 of John Edward Philips's PowerPoint presentation – exhibit P1118 Footnote ¹⁵³

BLUE NETWORKFootnote ¹⁵⁴

135. The Prosecutor pleaded that the Blue network of 15 mobiles was used to prepare for the attack, including surveillance of Mr Hariri between 18 October 2004 and Monday 14 February 2005. These Blue mobiles communicated almost exclusively with each other and sent almost no text messages.Footnote ¹⁵⁵

136. Seventeen different handsets were used for the 15 Blue mobiles: 16 Nokias and one Motorola. All handsets were basic models. Several handsets were swapped among eight Blue mobiles. Mr Platt noted that, in addition, four Yellow mobiles shared handsets with the Blue ones.Footnote ¹⁵⁶ According to Mr Philips, all 15 Blue mobiles formed part of a closed-user group over the period between Wednesday 12 January 2005 and Tuesday 15 February 2005. After Monday 14 February 2005, the level of activity of Blue-to-Blue calls dropped extensively. The Blue mobiles stayed in operation until October 2005, when all except two—Blue 813 and Blue 742—were deactivated by the provider networks.Footnote ¹⁵⁷

137. The Trial Chamber finds that at least the six ‘core’ Blue mobiles formed a network and that they operated covertly from some time in December 2004 until Monday 14 February 2005.Footnote ¹⁵⁸ The percentages of Blue-to-Blue contacts reflect near exclusive communications among the Blue mobiles.Footnote ¹⁵⁹ The recharging process for the seven Alfa Blue mobiles between January 2004 and January 2005—involving the mobiles being topped up together at the same time and location, using sequential charge cards—also weighs in favour of an organisational process. So too does the handset swapping among eight Blue mobiles and the fact that the Blue mobiles were almost always used in Beirut.Footnote ¹⁶⁰ In conclusion, the Trial Chamber finds that the virtually exclusive communications within the mobile group, the coordinated activities of the six ‘core’ mobiles and the lack of subscriber details all point to the existence of a covert Blue network of 15 mobiles, or, at the very least, six ‘core’ mobiles.Footnote ¹⁶¹

YELLOW NETWORKFootnote ¹⁶²

138. The Prosecutor pleads in the amended consolidated indictment that the Yellow network consisted of 13 mobiles used between 1 September 2004 and Friday 7 January 2005. Four of these mobiles were used by members of the assassination team for preparation of the attack, including for surveillance of Mr Hariri. The call activity of these four mobiles involved contact almost exclusively with other Yellow mobiles.Footnote ¹⁶³

139. The Yellow network ceased operations in a staggered period from 30 December 2004 to Wednesday 12 January 2005.Footnote ¹⁶⁴

140. The Trial Chamber finds that at least four Yellow mobiles—Yellow 024, Yellow 294, Yellow 457 and Yellow 933—operated as a network and that they did so in a covert manner from October 2004 until Friday 7 January 2005.Footnote ¹⁶⁵

141. During the period considered by Mr Platt—18 October 2004 to Wednesday 12 January 2005—Yellow-to-Yellow mobile contact represented 63 per cent of the communications. This is a relatively high percentage that shows an organisational process behind the mobiles. The call activity of four Yellow mobiles in particular—Yellow 294, Yellow 457, Yellow 933 and Yellow 024—involved nearly exclusive contact with other Yellow mobiles, further demonstrating their coordination.Footnote ¹⁶⁶

142. The Yellow network therefore presents the weakest case as a covert network among the four networks, as the Prosecution acknowledges. Nevertheless, given the large percentage of Yellow-to-Yellow calls, the similarity in the locations where they were used, the avoidance of text messages and the lack of subscriber details for some mobiles, the Trial Chamber concludes that at least the four ‘core’ Yellow mobiles operated as a form of covert network between October 2004 and Friday 7 January 2005.Footnote ¹⁶⁷

NETWORKS' COMMON MISSIONFootnote ¹⁶⁸

143. The Prosecutor pleaded in the amended consolidated indictment that the mobile groups were interconnected. The assassination team used six Blue and Red mobiles, including on the day of the attack. Further, the networks were all operated by the same entity.Footnote ¹⁶⁹

144. Mr Philips concluded that the purpose of the Red mobiles was to insulate the mission from their users' area of residence and therefore the identity of the users. Given their high forensic profile, the discovery of the Red mobiles by investigators was inevitable. They were used in the area of the crime scene at the time immediately preceding the crime and ceased use after the crime. Hence, the users of the Red mobiles took extreme care to limit their traceability, which meant that the anonymity of the users of the Red mobiles was protected the most.Footnote ¹⁷⁰

145. The limitations on the use of the Red mobiles created a need for the Blue mobiles, which could be used more generally. The characteristics of the Blue mobiles suggest that they were at the bottom of the hierarchy. They provided general support, particularly during the mission set-up phase between 18 and 26 January 2005, and their use may have extended to more than one mission.Footnote ¹⁷¹

146. According to Mr Philips, the Green mobiles were ‘the mission command group’, in particular, Green 023 and Green 300. These two members of the Green group were part of the mission command with a single link, that is, a ‘hotline’ or a dedicated communications link between them.Footnote ¹⁷²

147. The Trial Chamber finds that the Green, Red, Blue and Yellow networks were interconnected and coordinated with each other.Footnote ¹⁷³ The Trial Chamber finds that:

1. • three Green mobiles—Green 023, Green 071 and Green 300—operated as a covert network from 13 October 2004 until Monday 14 February 2005;

2. • eight Red mobiles—Red 572, Red 636, Red 652, Red 662, Red 678, Red 741, Red 893 and Red 946—operated as a covert network from Tuesday 4 January 2005 until Monday 14 February 2005;

3. • At least six ‘core’ Blue mobiles—Blue 233, Blue 324, Blue 585, Blue 610, Blue 817 and Blue 864—operated as a covert network from December 2004 until Monday 14 February 2005; and

4. • At least four ‘core’ Yellow mobiles—Yellow 024, Yellow 294, Yellow 457 and Yellow 933—operated as a type of covert network from October 2004 until Friday 7 January 2005.Footnote ¹⁷⁴

Map 23A with top cells from 14 January to 14 February 2005 for Green, Red and Blue networks from Expert report of John Edward Philips—Common Mission Phones – exhibit P1117, p. 47 Footnote ¹⁷⁵

PURPLE GROUP OF MOBILESFootnote ¹⁷⁶

148. The three Accused, Mr Merhi, Mr Oneissi and Mr Sabra are alleged to have prepared and carried out the false claim of responsibility for the attack on Mr Hariri. They are alleged to have communicated for this purpose via their personal mobiles. The Prosecution termed the three mobiles as the ‘Purple Phones’. This group of three mobiles is additional to the four colour-coded closed networks—the Blue, Red, Yellow and Green networks—that were allegedly involved in different ways in the attack.Footnote ¹⁷⁷

149. In the amended consolidated indictment, the Prosecutor pleads that ‘from at least 1 January 2003 until 16 February 2005’ these mobiles ‘were used to communicate amongst each other and to communicate with others outside the group. Purple Phones were used to coordinate the false claim of responsibility’.Footnote ¹⁷⁸ It pleads that Mr Oneissi, calling himself ‘Mohammed’, met Mr Abu Adass—the individual selected as suitable for the video-taped false claim of responsibility—at the Arab University Mosque in Beirut in either December 2004 or January 2005.Footnote ¹⁷⁹

150. His and Mr Sabra's Purple mobiles were allegedly connecting to Alfa cells around the mosque, named the ‘COLA’ cells. The Prosecution termed this period the ‘COLA phase’.

151. The Trial Chamber received extensive evidence that the Purple mobiles were everyday non-covert mobilesFootnote ¹⁸⁰ used for personal purposes such as to call family and friends and for ‘normal’ non-covert communications. They did not have the characteristics of ‘mission phones’ and were not used covertly.Footnote ¹⁸¹

152. The evidence establishes that the users of the three Purple mobiles knew each other. The call data records, as extracted into call sequence tables, show 397 contacts between the three Purple mobiles between 26 December 2002 and 22 December 2004. The latter date is that pleaded for the entry of Mr Merhi, Mr Oneissi and Mr Sabra into the conspiracy charged in count one of the amended consolidated indictment and from which their pleaded role in counts six to nine commences.Footnote ¹⁸² In the overall period, there were 170 contacts between Mr Oneissi's Purple 095 and Mr Merhi's Purple 231, 190 between Mr Sabra's attributed Purple 018 and Mr Merhi's Purple 231 and 36 between Mr Oneissi's Purple 095 and Mr Sabra's attributed Purple 018.Footnote ¹⁸³

153. The cell site and call data records show Purple 018's and Purple 095's areas of usage during the so-called ‘COLA phase’, namely, between 29 December 2004 and 7 January 2005 and the seven preceding days.Footnote ¹⁸⁴

154. In this period, Purple 018 connected to one of the sixteen cells near the Arab University Mosque, including the three COLA cells, for about 38.5 per cent of its calls. For Purple 095 this ratio was less, around 14.7 per cent. The connections to the cells near the mosque coincided with an increased frequency in the contacts between the three mobiles.Footnote ¹⁸⁵

155. The Trial Chamber, however, underlines that the call data records before August 2004 are incomplete. Until that date there were no records of where Alfa mobiles were when they received calls, meaning that it is impossible to know if or how many times these mobiles connected to the COLA and adjacent cells before then.Footnote ¹⁸⁶

156. There were also no end cell records available until 1 October 2004, which signifies that only the cells to which a mobile connected at the start of a call was recorded.Footnote ¹⁸⁷

157. The Trial Chamber finds that the users of Purple 018, Purple 095 and Purple 231 knew each other and communicated regularly between 26 December 2002 and 14 February 2005. The 397 contacts between the three mobiles between 26 December 2002 and 21 December 2004, and the 93 in the relevant indictment period, namely, from 22 December 2004 to 14 February 2005, demonstrate this. Twelve of these were on Monday 14 February 2005.Footnote ¹⁸⁸

158. To interpret the raw data showing an increase in activations of the COLA and adjacent cells in the relevant indictment period, the calls must be seen in the overall context and connected to provable events.Footnote ¹⁸⁹

ATTRIBUTION OF MOBILE TELEPHONES TO THE FOUR ACCUSED AND MUSTAFA AMINE BADREDDINEFootnote ¹⁹⁰

159. The case against the four Accused―and proving Mr Badreddine's pleaded role in the conspiracy charged―depends upon the Prosecution successfully proving that they were using specified mobiles. The result of this is termed ‘attribution’. Proving this attribution of specified personal mobiles is the first step towards cell site co-location analysis, which attempts to determine whether they were also simultaneously using certain colour-coded network mobiles and their attributed personal mobiles. If they were, the next step is determining whether they participated in committing the crimes charged.Footnote ¹⁹¹

160. This part of the Prosecution case is factually very complicated. Neither the Accused nor Mr Badreddine had mobile subscriptions in their own names, which could have made the attribution analysis easier. It appears that the Lebanese investigating authorities, and then the UNIIIC and the Prosecution, worked ‘backwards’―as they had to―by first identifying the patterns of mobile use in suspected closed networks that appeared to be connected with the surveillance, and or assassination of Mr Hariri, and then attempting to find mobiles that were co-locating with these identified network mobiles. They then had to identify who was using the mobiles that appeared to be co-locating with the network mobiles.Footnote ¹⁹²

161. From there, as none of the co-locating non-network mobiles were registered in either Mr Badreddine's or an Accused person's name, the investigators closely examined the circumstances surrounding their use to attempt to find their users. The UNIIIC and the Prosecution engaged in a complex and time-consuming inquiry checking for everything that could be gleaned from the ‘associations’ of a targeted mobile, attempting to determine who was using it, to connect it with a suspect, or to identify a potential new suspect.Footnote ¹⁹³ This inquiry included analysing each mobile's pattern of use―such as where it was used, who it was in contact with and how often and who its contacts contacted.Footnote ¹⁹⁴

162. The Trial Chamber has considered and recognised the general limitations of the telecommunications evidence as set out in chapter VII ‘Reliability of telecommunications evidence’. As single user analysis and co-location analysis depend on its reliability, underlying deficiencies might affect the results of the analysis. The Trial Chamber has been conscious of this in its co-location and single user analysis.Footnote ¹⁹⁵

163. The Parties do not disagree that co-location analysis provides only a possibility that multiple mobiles were together or that they had a single user, and hence their attribution to someone. Determining the possibility of co-location is only the first step towards concluding that multiple mobiles had a single user (or, alternatively, not).Footnote ¹⁹⁶

164. In this case, the Prosecution's case against the four Accused and its allegations against Mr Badreddine rely solely on circumstantial telecommunications evidence, and connecting these to other provable pleaded events, such as Mr Hariri's movements.Footnote ¹⁹⁷ The only evidence of where a mobile may have been comes from the cell site and call data records, as there was no evidence, such as reliable GPS information, placing their pleaded mobiles in any specific location.Footnote ¹⁹⁸

165. Since the exact location of a mobile cannot be determined from cell site evidence alone, conclusions as to whether a mobile user can travel the necessary distance between cell coverage areas will be based on approximations. How reliable these approximations are is unknowable in the absence of information of the starting and end point of the travel. But this of course depends upon the time between the calls of interest; a lengthy period over which this occurs can make co-location more likely. Another factor is that mobiles may connect to the same cell mast if they are not both within its best predicted server coverage area. An additional consideration is that determining whether mobiles are co-locating is only possible when they are used, namely, when they make or receive a call or send or receive a text message.Footnote ¹⁹⁹

166. The ultimate issue is whether, from examining the patterns of call use of target mobiles over a period, conclusions may be drawn as to co-location. Whether this has been established beyond reasonable doubt in the case of specific mobiles and Accused persons must be assessed on a call-by-call basis but only when the calls—and viewed in the totality of all calls and texts to and from relevant mobiles—are assessed in the light of the totality of the evidence. This includes linking the calls and the location of the mobile to any pleaded and provable events.Footnote ²⁰⁰

167. The Trial Chamber has largely accepted Mr Philips's methodology, while factoring in the limitations of the underlying data. In its view, he carefully and as neutrally as he could set out the factors weighing in favour and against two mobiles having a single user. The Trial Chamber has accepted Mr Philips's cell site expertise and relied on him for certain technical explanations but has made its own decisions in relation to what could in the specific circumstances be inferred from instances of possible co-location.Footnote ²⁰¹

SALIM JAMIL AYYASH—NETWORK MOBILES YELLOW 294, BLUE 233, RED 741, GREEN 300Footnote ²⁰²

168. Salim Jamil Ayyash was born on 10 November 1963 in Nabatiyeh, Lebanon. He married Ms Fatimah Hajj, who was born in 1966, and they had three children. He bought an apartment in Hadath, Beirut in March 2002. He also used a family residence in Harouf in southern Lebanon, near Nabatiyeh. He worked for the Lebanese Civil Defence at the Al-Doueir station, near Harouf, until February 2002, and then until November 2004, was the Head of the Markaba station, before transferring back to Al-Doueir.Footnote ²⁰³

169. The Prosecution endeavoured to prove Mr Ayyash's participation in the conspiracy, and in the other four counts charged—including committing a terrorist act by means of an explosive device—through his use of network mobiles and linking their location to Mr Hariri's movements.Footnote ²⁰⁴

170. The Prosecution relies on Mr Ayyash's personal mobiles and the landlines of his two residences to prove that he was using the pleaded network mobiles. The Prosecution led evidence of Mr Ayyash and his family using landlines at an apartment in Hadath in Beirut and at a residence near Nabatiyeh in south Lebanon. The Prosecution has used the contacts of these landlines to argue that they were used by Mr Ayyash.Footnote ²⁰⁵

The 2005 Hajj—whether Mr Ayyash travelled to Saudi Arabia

218. The presence or absence of Mr Ayyash in Lebanon during the Hajj in January 2005 (year 1425 in the Hijri calendar) is central to the attribution of relevant mobile numbers to him.Footnote ²⁷⁰ Had he travelled to the Kingdom of Saudi Arabia, it would exclude him as the single user of mobiles attributed to him at least during that period. The Prosecution concedes this by stating that Mr Ayyash ‘could not have continued normal use in Lebanon of the mobiles’ had he travelled to Mecca in January 2005. In addition, that period—the second half of January 2005—is a significant period in relation to the preparation of the attack on Mr Hariri.Footnote ²⁷¹

219. The Prosecution alleges that he remained in Lebanon, while the Ayyash Defence argues that he travelled to Saudi Arabia between 15 and 28 January 2005.

220. The Trial Chamber's findings on this include:Footnote ²⁷²

1. • Mr Ayyash and his wife, Ms Fatima Hajj, received Hajj passports to perform the pilgrimage in two consecutive years, 2004 and 2005;

2. • Bar for the stamp print of the Sûreté Générale running over Mr Ayyash's and Ms Hajj's photographs on their 2005 Hajj passports, these documents were insufficiently safeguarded from falsification. Most commonly, the date of birth was manipulated to meet the age requirement, but photographs were also replaced;

3. • However, the deficiencies of the Hajj travel document raise doubts with respect to the rigour of the identification process at the Lebanese and Saudi Arabian airports during the 2004 and 2005 Hajj seasons when this was the sole document required for a pilgrim to pass through immigration;

4. • Additionally, it was common practice that the Sûreté Générale checked and stamped the Hajj passports collectively and merely made a head count. In 2005, 17,000 pilgrims may have travelled from Lebanon to Saudi Arabia within a period of weeks via the direct flights of two approved airlines, MEA and the Saudi Arabian Airlines. This caused a considerable increase in traffic at the Beirut Airport, which meant that the pilgrims were not properly identified by the Sûreté Générale;

5. • Further, it diminished the reliability of the Lebanese entry and exit records that showed that Mr Ayyash, Ms Fatima Hajj and Ms Zeinab Ayyash left Beirut on 15 January and returned on 28 January 2005;

6. • The practice in 2004 and 2005 was that the security at the entrance of the Beirut Airport, check-in attendants and the passport check at the boarding gate did not check the pilgrim's identity;

7. • In 2004 and 2005, check-in attendants commonly checked the pilgrims in as a group for their flights and handed the Hajj passports and the boarding passes back to the moarref as a group;

8. • Pilgrims' names were therefore entered in the flight manifests on the basis of a collective check-in, as opposed to a thorough passenger-by-passenger review;

9. • Although the flight manifest of checked-in passengers for the flight on 15 January 2005 from Beirut to Jeddah included the names of Mr Ayyash, Ms Hajj and their daughter, the practice of checking in pilgrims diminishes the reliability of the record to the point that it loses its probative value;

10. • Saudi Arabian entry and exit records show Mr Ayyash arriving with his wife in Jeddah on 15 January and departing on 28 January 2005. However, the records do not include their daughter, whose name appeared on the Lebanese entry and exit records leaving for Saudi Arabia, and on the flight records of passengers arriving in Jeddah and leaving from Medina on those days;

11. • The absence of any rigorous identification process at Beirut Airport in the 2004 and 2005 Hajj seasons, the collective check-in procedure, the lack of fingerprinting system for those entering Saudi Arabia and the inconsistencies of the Saudi entry and exit records with Lebanese records diminish their reliability. They are thus insufficient to prove that Mr Ayyash, his wife and daughter travelled to Saudi Arabia from 15 to 28 January 2005;

12. • On 11 January 2005, Mr Ayyash submitted a leave application, and on 14 January 2005 the Director General of the Civil Defence granted him ten days paid leave starting on 16 January 2005;

13. • Because he worked—at the Doueir Civil Defence station at that time—for 48 hours and had 96 hours off, rest days also counted when his leave time was calculated and for this period he was not entitled to emergency allowance and commute compensation;

14. • On 24 January 2005, the Chief of the Nabatiyeh Regional Station informed the General Director of the Civil Defence in writing that Mr Ayyash had not benefited from the authorised leave and had been in service. In a decision, dated 12 February 2005, the General Director cancelled Mr Ayyash's leave;

15. • The Trial Chamber regards the cancellation of Mr Ayyash's leave and the reimbursement of his commute compensation as evidence which supports the conclusion that Mr Ayyash did not leave Lebanon to perform the Hajj in January 2005;

16. • Mr Ayyash's name is signed on the attendance sheets of the Doueir station on 18, 24 and 25 January 2005. Volunteers also signed in on these and other days. The Trial Chamber did not find this evidence reliable;

17. • Lebanese entry and exit records show Mr Ayyash leaving at 16:50 on 28 January 2004 and returning to Lebanon at 08:38 on 8 February 2004, but there are no records for Ms Hajj.

18. • However, on 29 and 31 January 2004, there were two cash withdrawals at automatic teller machines in Mecca from Mr Ayyash's USD account. This is probative of Mr Ayyash's presence in Mecca, on these two days;

19. • On 18 January 2004, the Director General of the Civil Defence granted Mr Ayyash 15 days fully paid leave. He resumed work on 10 February 2004. The Trial Chamber finds this evidence reliable;

20. • Mr Ayyash's personal mobile 165 was used in a different handset from 29 January to 7 February 2004, and with its old handset from 8 February 2004. In this period, mobile 165 had three new contacts, and one unusual cell activation using Jabal Safi_B. These factors are indicative of the mobile having a different user between 29 January and 8 February 2004;

21. • Contacts with mobile 617, which may have belonged to Mr Ghaleb Jaber's car mechanic shop, and with an unattributed Saudi number in this period do not assist the Trial Chamber's determination as to who was using these mobiles in these 11 days;

22. • Mr Ayyash's network mobiles, Blue 233 and Green 300 remained active during the 2005 Hajj, and Red 741 started its network activities;

23. • The mobiles continued to co-locate and move in tandem in the period analysed by Mr Philips, including the 2005 Hajj;

24. • In contrast with personal mobile 165's handset change during the 2004 Hajj, personal mobiles 170 and 091 continued to use the same handset before and after the 2005 Hajj; and

25. • These are the factors that satisfied the Trial Chamber that mobiles 091, 170, Blue 233, Green 300 and Red 741 did not have a user other than Mr Ayyash in the period of the 2005 Hajj, except for the duration of mobile 091's separation from the other mobiles on 28 January 2005.

221. The Trial Chamber consequently finds that Mr Ayyash did not leave Lebanon between Saturday 15 and Friday 28 January 2005.Footnote ²⁷³

Mr Ayyash's 2005 Hajj passport photograph — extract from exhibit 1D293 Footnote ²⁷⁴

HASSAN HABIB MERHI—PURPLE 231 AND GREEN 071Footnote ²⁷⁵

222. Hassan Habib Merhi was born on 12 December 1965 in Beirut. He married Ms Rima Toufaili on 23 March 1984. They have four sons, Mohamad Merhi, born in 1987, Ali Merhi, in 1991, Hussein Merhi, in 1995, and Habib Al Mahdi Merhi, in 2000.Footnote ²⁷⁶

223. In relation to the Purple mobiles, the Prosecutor, in the amended consolidated indictment, pleads that Mr Merhi was the user of Purple 231, one of the three ‘Purple phones’, ‘used from at least 1 January 2003 until 16 February 2005’. Mr Merhi, and the other two Accused, Mr Oneissi and Mr Sabra used their personal mobiles, respectively Purple 095 and Purple 018, ‘colour-coded “Purple Phones”’, in relation to preparations for the attack'. The three mobiles ‘were used to coordinate the false claim of responsibility’.Footnote ²⁷⁷

224. The Prosecutor alleges that Mr Merhi and Mr Badreddine used their Green network mobiles, respectively Green 071 and Green 023, exclusively to ‘exchange information’ and ‘to coordinate the acts done in furtherance of the conspiracy’.Footnote ²⁷⁸

225. The case that Mr Merhi was using either Purple 231 or Green 071 is circumstantial. The Prosecution at first sought to establish that he was using Purple 231 by adducing evidence that Mr Merhi and his family were using the personal mobile 6091, and then comparing the geographical and contact profiles of the two mobiles. From this, it then sought to demonstrate that Purple 231 and Green 071 were co-locating in a manner proving that the two mobiles had a single user, namely Mr Merhi.Footnote ²⁷⁹

HUSSEIN HASSAN ONEISSI—PURPLE 095Footnote ³⁰⁴

244. Hussein Hassan Oneissi, formerly known as Hussein Hassan Issa, was born on 11 February 1974, and married to Hala Bachir, whose date of birth is 30 November 1976. They entered into a marital contract in June 1999 in Baabda, and as of June 2012 had three children.Footnote ³⁰⁵ The Prosecutor, in the amended consolidated indictment, pleads that Mr Oneissi used one of three ‘Purple phones’, which ‘were used from at least 1 January 2003 until 16 February 2005’.Footnote ³⁰⁶

245. Purple 095 is the SIM used in at least four consecutive handsets between 31 July 2004 and 16 February 2005. It was a pre-paid Alfa Active mobile subscription. It was activated on 28 December 2002 and deactivated on 17 March 2005, after its last use on Wednesday 16 February 2005.Footnote ³⁰⁷

246. Numerous documents, such as applications to open bank accounts and to purchase a Mitsubishi Lancer, listing Purple 095 as Mr Issa's contact, provide consistent and mutually corroborating evidence that Mr Issa/Oneissi was Purple 095's actual user.Footnote ³⁰⁸ Purple 095's contact profile provides strong evidence that he was its user. The call data records demonstrate that a significant number of the top 30 contacts are with numbers attributed to Mr Oneissi's family, in-laws and acquaintances. Most notably, the highest-ranking contact is with a number attributable to his mother, Ms Fatima Darwish, with which Purple 095 had 747 contacts.Footnote ³⁰⁹

247. The Trial Chamber cannot positively find that Mr Oneissi was the only person who ever used Purple 095, but the totality of the evidence points to him as its principal user. The Trial Chamber has carefully considered the underlying evidence that Mr Donaldson relied upon. Its assessment of the evidence leads it to the only conclusion reasonably available from the totality of the evidence, namely that Mr Oneissi was the principal user of Purple 095 from at least 9 January 2003 until 16 February 2005. It is satisfied of this beyond reasonable doubt.Footnote ³¹⁰

248. However, no call pattern emerges—on any of the days when Mr Oneissi was alleged to have been near the Arab University Mosque, namely 22, 28, 29 and 31 December 2004, and 3 and 7 January 2005—suggesting that someone else was using the mobile. Similarly, on Monday 14 February 2005, Purple 095 made only four calls; three were to Purple 018, between 15:58 and 16:02, and one was to an unknown number, mobile 516, at 12:16, for 104 seconds.Footnote ³¹¹ The Trial Chamber is therefore satisfied that nothing points to anyone else using the mobile on those particular days.Footnote ³¹²

ASSAD HASSAN SABRA—PURPLE 018Footnote ³¹³

249. Assad Hassan Sabra was born on 15 October 1976 in Beirut. He married Hala Salloum, in Baabda on 11 November 2000. They lived in Beirut. Between 22 November 2001 and 16 February 2005 a mobile, number 3419018, had numerous contacts with family members of both. That mobile is alleged to be Purple 018 that was used in the false claim of responsibility made after the attack on Mr Hariri's life on Monday 14 February 2005.Footnote ³¹⁴

250. The Prosecutor pleads that Mr Sabra had one of three ‘Purple phones’, which ‘were used from at least 1 January 2003 until 16 February 2005’. The amended consolidated indictment specifies that Mr Merhi, Mr Oneissi and Mr Sabra used their personal mobiles, ‘colour-coded “Purple Phones”’, in relation to preparations for the attack.Footnote ³¹⁵

251. The Prosecution also used two other mobiles, numbers 546 and 657 that were used from 24 February and 20 July 2005 respectively, to attribute Purple 018 to Mr Sabra.Footnote ³¹⁶

252. There is no direct evidence of who Purple 018 ‘belonged’ to. It had no subscriber details and no evidence was presented of it being used as a contact number for anything. The Prosecution relies on its contact profile, the content of six SMS messages, the cells to which it connected and the contact and geographical similarities, including text message content, with two mobiles that were used after this one.Footnote ³¹⁷

253. The Prosecution evidence seeking to attribute Purple 018 to Mr Sabra is the weakest of any of the attribution evidence led against the four Accused and Mr Badreddine. No conclusive evidence was presented about exactly where Mr Sabra lived during the indictment period, namely from late 2004 to early 2005, nor with whom, nor where he worked, nor what he did. Mr Sabra, on the Prosecution's case, was using Purple 018 until Wednesday 16 February 2005, when it was discarded.Footnote ³¹⁸

254. The Prosecution, furthermore, presented no evidence of a geographical footprint that could be traced to Mr Sabra by virtue of his home address, place of work and his leisure and social activities including those with his family. Nor was one presented for his wife, who was another potential user of Purple 018. Over the attribution period there were 8,739 contacts, as in calls made and received and texts, for which there are records, over 1,183 days. This is an average of just under 7.4 per day.Footnote ³¹⁹

255. The evidence attributing Purple 018 to Mr Sabra is weak; without examining mobiles 546 and 657 the Trial Chamber does not believe that it can be attributed to him. Nor that it could conclude that he was its user during the relevant period. Thus, in the Trial Chamber's view, the most logical way of analysing the evidence is to start with mobile 657 and work backwards.Footnote ³²⁰ There is clear evidence that mobiles 546 and 657 had the same users. The two SIMs sequentially used the same handset. The SIM for mobile 657 was used in the handset used by mobile SIM 546 until 21 July 2005.Footnote ³²¹

256. The Trial Chamber is satisfied that Mr Sabra and Ms Salloum used both mobiles 546 and 657 although it appears that they were more often used by Ms Salloum. There is clear evidence from the use of this mobile as a business contact number that both members of this couple were using mobile 657. And texts contain their and their daughter's names.Footnote ³²²

257. The Trial Chamber is satisfied beyond reasonable doubt that Mr Sabra and Ms Salloum were using Purple 018 from 22 November 2001 until 16 February 2005, and then used mobile 546 from 24 February 2005 until 21 July 2005 and mobile 657 from 20 July 2005 until at least 31 December 2006.Footnote ³²³

258. Based on the striking similarity between the contact and geographic profiles and the content of the several text messages mentioning ‘Hala’ and ‘Assad’ by name, the Trial Chamber is also satisfied that Purple 018 was also used by both Mr Sabra and Ms Salloum during the extended attribution period.Footnote ³²⁴

259. The Trial Chamber, however, has been unable to find calling patterns for the user(s) of Purple 018 from which it could discern that it had a single user either in the attribution period or the relevant indictment period. On some days, assuming that Mr Sabra was more likely to contact his relatives than his wife's, and vice versa, either could have been using the mobile and at different times.Footnote ³²⁵

260. Most crucially, during the pleaded indictment period of 22 December 2004 to 14 February 2005, the Trial Chamber cannot conclude that Mr Sabra was the sole, main or principal user of Purple 018. The evidence points to shared usership in that period. But even more critically, the Trial Chamber cannot positively conclude from the only evidence it has— namely, that of the mobile's geographic and contact profiles, for there is no relevant text message content—that Mr Sabra was the sole user of the mobile on the days on which it is pleaded that he was using the mobile for false claim of responsibility related activities.Footnote ³²⁶

261. The Trial Chamber is therefore unable to conclude beyond reasonable doubt that the only inference reasonably available from the evidence is that Mr Sabra was the single user of the mobile between 22 December 2004 and 14 February 2005.Footnote ³²⁷

MUSTAFA AMINE BADREDDINE—GREEN 023Footnote ³²⁸

262. Mustafa Amine Badreddine was born on 6 April 1961 in El-Ghobeiri in Beirut. He was twice married, with six children. His late brother in law was Imad Mughniyeh, who was married to Mr Badreddine's sister, Saada. Mr Badreddine was one of the four original accused in this case.Footnote ³²⁹

263. In May 2016, Hezbollah announced Mr Badreddine's death in Syria. On 11 July 2016, the Trial Chamber, acting according to a three to two majority Appeals Chamber decision, terminated the case against him. His name, however, remained in the amended consolidated indictment that the Prosecutor filed following this order.Footnote ³³⁰

264. The Prosecutor, in the amended consolidated indictment, pleads that Mr Badreddine, who was allegedly also known under the alias ‘Sami Issa’, participated in a conspiracy with the four Accused aimed at committing a terrorist act to assassinate Mr Hariri. Specifically, Mr Badreddine is alleged to have monitored, and, with Mr Ayyash, coordinated the surveillance of Mr Hariri in preparation for the attack and the purchase of the Canter used in the attack. Additionally, he monitored the physical perpetration of the attack. Further, he monitored, and, with Mr Merhi, coordinated the preparation of the false claim of responsibility for the attack.Footnote ³³¹

265. His involvement in the attack, according to the Prosecutor, is shown by his use of a mobile in the Green network of three mobiles that were used for this purpose. Mr Badreddine is alleged to have used his Green network mobile 023 to communicate with Mr Ayyash, who was using his Green mobile 300, and with Mr Merhi who was using Green mobile 071, ‘to exchange information regarding all aspects of the conspiracy and coordinate the acts done in furtherance of the conspiracy’. It was a coordination network used exclusively by these three co-conspirators. Mr Badreddine is also alleged to have been a supporter of Hezbollah, as are the four Accused.Footnote ³³²

266. To prove that he was using Green 023, the Prosecution led evidence that Mr Badreddine was also using two personal mobiles, numbers 663 and 354, that co-located with Green 023. It led extensive evidence of the use of these two mobiles. Mr Badreddine was alleged to have used mobile 354 from 1 September 1997 to 31 December 2005, and mobile 663 from 26 February 2001 to 31 December 2005.Footnote ³³³

267. The Prosecutor also pleaded that Mr Badreddine was using five ‘sequential mobile phones’, with numbers ending in 683, 944, 195, 486 and 593. These were ‘used in sequential order, meaning that each phone was used for a period of weeks or months and then replaced by another’.Footnote ³³⁴

268. A number of witnesses knew Mr Badreddine under his alias of Sami Issa. Mr Badreddine had attended the Lebanese American University (LAU) as a student between 1997 and 2004. He graduated in 2005 with a Bachelor of Arts in Political Science. Mobile 354 was Mr Badreddine's contact number at the university. From about 2002 to 2005, calling himself Sami Issa, he befriended students at the university and socialised with them. Sami Issa had bodyguards, one or more apartments in Jounieh, which is about 20 or so kilometres north of Beirut, and or Sahel Alma, a boat ‘Samino’ that he moored north of Beirut and owned a jewellery business, Samino Jewellery, that had three branches in Beirut.Footnote ³³⁵

269. Three witnesses identified mobile 354, and seven identified mobile 663, as Sami Issa's. Text messages from mobile 663 used the names ‘Sami’ and ‘Samino’. Sami Issa, like Mustafa Badreddine, had a leg injury and walked with a limp. Text messages to both personal mobiles refer to his leg and foot injuries. The two also shared the same birthday, 6 April.Footnote ³³⁶

270. Sami Issa travelled with armed bodyguards, used multiple mobiles and took precautionary measures to avoid being photographed, or leaving his fingerprints on objects.Footnote ³³⁷

271. Mobile 354 had 855 contacts with one of Mr Badreddine's girlfriends and 128 with another. It also had 2,056 contacts with his sister's mobile and hundreds of contacts with the Samino outlets. Mobile 663 had 21,372 contacts with one girlfriend and 3,151 with another. It had thousands of contacts with the Samino stores and its associates, as well as 1,895 with an employee.Footnote ³³⁸

272. The two mobiles had an overlapping geographical profile and use pattern and numerous common contacts.Footnote ³³⁹

273. The third mobile, number 944, had hundreds of contacts with the mobiles of Sami Issa's business partner at Samino and its registered owner. It had a smaller circle of contacts—including what were described as Samino ‘insiders’, Hezbollah officials and several Badreddine family members—and a lower volume of traffic.Footnote ³⁴⁰

274. In May 2016, Hezbollah announced Mr Badreddine's death in combat in Syria and released biographical details including photographs and video footage, and stated that he was a senior Hezbollah military commander. Eight witnesses recognised Mr Badreddine as the person they knew as Sami Issa. The evidence that Mr Badreddine was Sami Issa, and was using the three personal mobiles, is overwhelming.Footnote ³⁴¹

275. The cell site evidence establishes that mobiles 354 and 944 co-located, and that mobiles 944 and 663 co-located. Both had a single user. Green 023 was used on 57 days between 28 September 2004 and 12 February 2005. It moved consistently with the other three mobiles.Footnote ³⁴²

276. The evidence establishes that that Mr Badreddine was using personal mobiles 354, 663 and sequential mobile 944 in the periods alleged, either under his own name or his alias Sami Issa. These mobiles co-located with Green 023 in such a manner that the only reasonable conclusion from the evidence is that Mr Badreddine was also using that mobile, as its single user.Footnote ³⁴³

CHRONOLOGY OF NETWORK MOBILE ACTIVITY BEFORE MR HARIRI'S ASSASSINATION ON MONDAY 14 FEBRUARY 2005Footnote ³⁴⁴

277. In the months before Mr Hariri's assassination, the Blue, Red and Yellow networks—and specifically the six core Red mobiles, the six core Blue mobiles and the four core Yellow mobiles—conducted observations and surveillance of Mr Hariri and his movements. On 39 days between Wednesday 20 October 2004 and Monday 14 February 2005, there was significant network activity in the area of his home, Quraitem Palace.Footnote ³⁴⁵

278. On fourteen days between Thursday 11 November 2004 and Monday 14 February 2005, network mobiles ‘followed’ Mr Hariri's security detail. This showed an unequivocal pattern of the network mobiles shadowing Mr Hariri. On some of these days, and on others in the same period, network mobiles connected to cells providing coverage to locations relevant to Mr Hariri, such as Quraitem Palace. Some of the surveillance, especially in the weeks before Mr Hariri's death, was clearly connected with the assassination. These network mobiles generally activated cells near Quraitem Palace when Mr Hariri was present there.Footnote ³⁴⁶

279. The Red network, apart from its surveillance activities, also had a crucial role in executing the attack on 14 February 2005. It was, as the Prosecution alleged, the assassination team or network.Footnote ³⁴⁷

280. The Red mobiles were active in the area of Quraitem Palace in the morning and then in the Parliament and crime scene area. In the last two hours before the attack, 33 calls were made between the six Red mobiles. Significantly, between 12:49 and 12:53:42, Mr Ayyash's Red 741, Subject 5's Red 636, Subject 6's Red 678, Subject 7's Red 946, Subject 8's Red 893 and Subject 9's Red 652 were involved in the final seven calls of this network. The explosion that killed Mr Hariri and others occurred at 12:55:05. After the explosion, none of the mobiles in the Red network were ever used again.Footnote ³⁴⁸

281. Some calls between the mobiles in the different networks were ‘sequential’ in the sense that they appeared to follow each other, but whether they can be deemed hierarchical—and if so in which direction—was not established. In addition, there were insufficient Green network calls to allow the Trial Chamber to link them to pleaded events, which would have provided the necessary factual context. The Green network had the appearance of a triangular framework with Mr Merhi's attributed Green 071 and Mr Ayyash's Green 300 never calling each other but only communicating with Green 023, which the Prosecution attributes to Mr Badreddine.Footnote ³⁴⁹

282. Some of the core users of the Red, Yellow, Green and Blue networks had a common mission, namely the assassination of Mr Hariri. The evidence is insufficient to establish that all surveillance by network mobile users in the months preceding Mr Hariri's death was a preparatory act for the assassination and hence connected with it. However, the only conclusion available from the totality of the evidence is that the network mobiles were engaged in surveillance of Mr Hariri in the months prior to the attack, and that a portion of it was preparatory work for his assassination.Footnote ³⁵⁰

283. The Trial Chamber received extensive evidence of four colour-coded mobile networks, Red, Blue, Yellow and Green, that communicated almost exclusively in the networks.Footnote ³⁵¹

284. There is no direct evidence that the users of the network mobiles were engaged in surveillance of Mr Hariri. The evidence is circumstantial, consisting only of call data and cell site records showing the cell activations—that reveal the calling and cell siting patterns of the network mobiles—and matching these with Mr Hariri's provable known movements. When the two correspond, patterns emerge from which it can be concluded the locations of network mobiles and Mr Hariri coincided in a manner meaning either that they were following or observing him or his security detail.Footnote ³⁵²

285. The Red, Blue and Green networks operated completely covertly. Yellow network mobiles swapped handsets between the SIM cards, including between three Blue network mobiles and on Mr Ayyash's personal mobiles 165 and 170. The Blue mobiles operated as a covert network and a core of six operated covertly from some time in December 2004 until Monday 14 February 2005. They communicated almost exclusively with each other.Footnote ³⁵³

286. The six Red network mobiles were indisputably involved in Mr Hariri's assassination on Monday 14 February 2005. They were present activating cells that corresponded with Mr Hariri's movements from Quraitem Palace to the Parliament, the crime scene area and the area between it and the Parliament. Significantly, between 12:50:34 and 12:53:42, Mr Ayyash's Red 741, Red 636, Red 678, Red 946, Red 893 and Red 652 were involved in the final seven calls of the Red network. The explosion that killed Mr Hariri and others occurred at 12:55:05. After the explosion, the Red network was never used again. During the last two hours before the attack, 33 calls were made between the six Red mobiles.Footnote ³⁵⁴

287. While clear direct evidence that they were in contact with the Mitsubishi Canter or the suicide bomber is lacking, they were active in the area of Quraitem Palace in the morning and then moved to the Parliament and crime scene area. Their high forensic visibility—meaning that they were easily discoverable in an investigatory cell dump looking for mobiles near to the crime scene, Parliament and Quraitem Palace on the day of the attack—and especially with their closure just before the assassination, made their discovery inevitable. And this indeed occurred. This leaves no room for doubt that the Red mobiles had a significant role in the attack. It is the only reasonable inference available from the totality of the evidence.Footnote ³⁵⁵

288. The days of use of the Green, Blue and Red networks largely overlapped, and between Friday 14 January and Monday 14 February 2005, the Red mobiles were active on 11 days, the Green mobiles on 21 days and the Blue mobiles on all 31 days. It is clear from the patterns of cell activations and the sequences of some calls between network users that the four networks were interconnected and coordinated with each other.Footnote ³⁵⁶

289. The role of the Red network mobiles in the assassination is obvious. To ascertain the role of the other networks, and whether they were engaged in surveillance of Mr Hariri, the Trial Chamber has had to work backwards from Monday 14 February. To do this, it had to examine the Red network's cell activations and calls on the other days in January and February 2005 and any correlation with that of the other networks and Mr Hariri's known movements.Footnote ³⁵⁷

290. The Prosecution alleged both static and mobile surveillance of Mr Hariri. The limitations of the Prosecution's telecommunications evidence are evident in analysing the static surveillance alleged, and specifically in matching cell activations with the other evidence of Mr Hariri's movements. For example, the presence of Blue mobiles in the general area of Quraitem Palace—even the repeated presence—may be difficult to connect to a deliberate surveillance operation, either static or mobile.Footnote ³⁵⁸

291. The cell mast activations of the mobiles used by Mr Hariri's security detail prove his movements; his detail was always with him. Other evidence such as photographs and media reporting also corroborates Mr Hariri's visits to various locations. Additionally, the Trial Chamber received ample evidence from his staff, and palace documents such as its visitor's logbook, and of media releases, of his presence at Quraitem Palace and his absences from Beirut and Lebanon, to prove where Mr Hariri was at all relevant times. This evidence effectively proves Mr Hariri's movements between Wednesday 20 October 2004 and Monday 14 February 2005.Footnote ³⁵⁹

292. The Trial Chamber has also found that the cell site evidence of mobiles connecting to cells is probative of the general area where the mobile was at the time. In this regard, the Trial Chamber emphasises that relying only on the telecommunications evidence—and without any more specific evidence about a mobile's location, such as GPS—can only lead to the conclusion that a mobile connected to a cell which places it in a predicted best server coverage area.Footnote ³⁶⁰

293. The Trial Chamber has accordingly factored in the limitations of cell site evidence in determining where a mobile actually was when connecting to a cell. This includes that cell coverage can overlap, meaning that a mobile could be physically located in the coverage area of a cell neighbouring that to which it is connecting. As an example, and as a further complication in relation to the surveillance evidence, some relevant locations in Beirut are fairly close, such as Quraitem Palace and Mr Marwan Hamade's residence, and the crime scene and the Parliament. This means that a mobile that is ostensibly connecting to a cell providing predicted best server coverage to one of these locations, was actually in a neighbouring cell when it made the call. The networks maps show areas of scattered coverage outside the main cell coverage areas that further complicate this analysis.Footnote ³⁶¹

294. Generally, however, the cell site evidence is sufficiently probative for the Trial Chamber to discern patterns of cell connections from which it can conclude that surveillance was occurring. The patterns are all important here, for it is the patterns of cell activations, calls, and mobile movements in combination with Mr Hariri's own movements that can determine whether these are beyond coincidence.Footnote ³⁶²

295. The Trial Chamber has analysed both the static and mobile surveillance alleged. It has examined the evidence of each alleged incidence and in the light of the evidence of the networks and their connections.Footnote ³⁶³

General conclusions on network surveillance of Mr HaririFootnote ³⁶⁴

296. The ultimate issue is whether the various network cell activations and calls, in combination with Mr Hariri's movements, lead to only one inevitable conclusion, namely, that they were engaged in the surveillance, or ‘observations’ of him. The Trial Chamber's conclusion is that this is what occurred.Footnote ³⁶⁵

297. The evidence establishes that on 39 days between Wednesday 20 October 2004 and Monday 14 February 2005 there was significant network activity in the area of Quraitem Palace. This occurred in 2004 on 20 October; 3, 4, 5, 8, 10, 11, 23, 25 and 26 November; and on 21, 22, 23, 24, 27, 28, 30 and 31 December; and, in 2005 on 1, 7, 8, 14, 22, 27, 28, 29, 30, 31 January 2005; and on 1, 2, 3, 4, 7, 8, 9, 10, 11, 12 and 14 February. But it was only at least three days when these activations occurred, namely, Wednesday 3 and Tuesday 23 November 2004 and Friday 7 January 2005, that Mr Hariri was not in Beirut.Footnote ³⁶⁶

298. The Trial Chamber observed an unequivocal pattern of the networks shadowing Mr Hariri. On a number of occasions between Thursday 11 November 2004 and Monday 14 February 2005, it is obvious from the presence of network mobiles connecting to cells near where Mr Hariri's security detail was, that they had ‘followed’ him to where he was. One striking feature is that during Mr Hariri's absences from Lebanon, network activity significantly scaled down, and most ceased around Quraitem Palace. Examples of this are during Mr Hariri's trips abroad between 12 and 22 November 2004, 27 November to 16 December 2004, 17 to 20 December 2004 and 2 to 7 January 2005.Footnote ³⁶⁷

299. The patterns of calls between network mobiles, their presence connecting to cells around Quraitem Palace, the airport, in the Faraya area and in other places where Mr Hariri was such as his visits to churches, his dinners and lunches, is beyond coincidence. There are too many calls and too many instances of network mobiles sharing a locality with Mr Hariri, and over an extended period, for this to be accidental. This happened too often and in too many different places to be spontaneous. The mobile users were communicating in closed networks, and on different days, their users operated in locations where Mr Hariri was.Footnote ³⁶⁸

300. While the static surveillance alleged, based only on cell activations, is more difficult to ascertain, again, clear patterns have emerged of network presence near Quraitem Palace and along the route to Mr Hariri's Faqra Villa, near Faraya. Significantly, there was very little network activity around Quraitem Palace when Mr Hariri was not there. Considering the evidence of the network activity in its totality leads to the inevitable conclusion that much of this must have been connected with surveillance of Mr Hariri. There is no other conclusion reasonably available from the evidence.Footnote ³⁶⁹

301. The Trial Chamber therefore finds that the users the Blue, Red and Yellow networks— and more specifically the six core Red mobiles, the six core Blue mobiles and the four core Yellow mobiles—conducted observations or surveillance of Mr Hariri and his movements on different days from Wednesday 20 October 2004 to Monday 14 February 2005.Footnote ³⁷⁰

302. As examples, maps below represent the surveillance on the electronic presentation of evidence. These are first, on Saturday 25 December 2004, depicting Blue and Yellow network activity near Mr Hariri's Faqra Villa 2004, when he was there. Second, on Friday 31 December 2004, when Mr Hariri travelled there from Quraitem Palace. Third, on Monday 31 January 2005, when he attended the Higher Shiite Council. Fourth, when Mr Hariri visited the Sacré Cœur Church on Saturday 12 February 2005.

Exhibit P1783 (Expert report of Gary Platt – Chronology), p. 101 Footnote ³⁷¹

Exhibit P1783 (Expert report of Gary Platt – Chronology), p. 134 Footnote ³⁷²

Exhibit P1783 (Expert report of Gary Platt – Chronology), p. 254

Ayyash calls ‘S9’ in vicinity of Sacré Cœur Church: 10:49 (prior to Security Detail departure) Footnote ³⁷³

303. The Trial Chamber has identified the following fourteen specific instances of network activity that coincided with Mr Hariri's proven movements. These are bullet-pointed as:Footnote ³⁷⁴

1. • Thursday 11 November 2004: trip to the airport from Quraitem Palace;

2. • Tuesday 21 December 2004: evening meeting with Mr Hassan Nasrallah, in Haret Hreik, Dahyieh;

3. • Monday 27, Thursday 30, Friday 31 December 2004 and Saturday 1 January 2005: trips to or from Mr Hariri's Faqra Villa

4. • 29 January 2005: trip to Mr Marwan Hamade's residence;

5. • 29 January 2005: trip to villa at Al-Naameh villa;

6. • Monday 31 January 2005: trip to the Higher Shiite Council from Quraitem Palace and back to Quraitem Palace;

7. • Saturday 3 February 2005: trip from St Georges Marina to Quraitem Palace;

8. • Sunday 4 February 2005: trips to Mr Hamade's residence and to the airport;

9. • Monday 7 February 2005: trip from airport to Quraitem Palace;

10. • Tuesday 8 February 2005: trip from Quraitem Palace to Parliament;

11. • Saturday 12 February 2005: trips to two churches in Badaro and Mazraa; and

12. • Monday 14 February 2005: trip from Quraitem Palace to Parliament and back.

304. The Trial Chamber is therefore satisfied that the only reasonable conclusion available from the evidence is that Mr Hariri was under surveillance from Wednesday 20 October 2004 to Monday 14 February 2005, with the surveillance in the latter period connected with his possible assassination. The Trial Chamber cannot find that all of it was connected with the plan to assassinate Mr Hariri. In its totality—as is set out in analysing the dates of the conspiracy— the evidence only suffices to establish that the final decision to assassinate Mr Hariri was most probably made sometime in early February 2005. The Trial Chamber, however, cannot positively conclude that the surveillance in October, November and December 2004 and in January 2005 was solely for the purpose of planning his assassination.Footnote ³⁷⁵

305. Undoubtedly, some of it in the latter part of January 2005 was directed at obtaining information about Mr Hariri's movements and convoy if needed to continue with a plan to assassinate him, which had hatched by then. The Trial Chamber is satisfied that at least some of the users of the Red, Yellow, Green and Blue networks had a common mission, namely the assassination of Mr Hariri. However, the fact that these networks were connected and that their existence was linked to Mr Hariri's movements and eventually his assassination, does not mean that every user of every network mobile knew about the mission to assassinate him, either in detail or at all.Footnote ³⁷⁶

IMPORTATION AND SALE OF MITSUBISHI CANTERFootnote ³⁸⁵

313. In December 2004, Witness PRH075 imported into Lebanon from the United Arab Emirates the white 2002 Mitsubishi Canter right-hand-drive light truck that was used in the explosion on Monday 14 February 2005. He sometimes displayed his imported vehicles for sale at a ‘dealership’ in Tripoli that Witness PRH063 operated with a partner. Its records were inaccurate and or incomplete.Footnote ³⁸⁶

314. The Canter was displayed at Witness 63's ‘showroom’ for a short period before its sale in January 2005 to two men who paid in cash for it and drove it away. During their visit, Witness 63 called Witness 75, regarding price negotiations, twice within five to 15 minutes. No witness could independently recall the sale date, although Witnesses 63, 75 and an office manager, Witness PRH459, concluded that it had been Tuesday 25 January 2005.Footnote ³⁸⁷

315. Neither call data records nor the dealership's records can confirm the sale date. The Prosecution argues that the truck was sold on 25 January 2005 and Mr Ayyash coordinated its purchase. The preponderance of witness evidence supports that date, which is confirmed by the network activity. The Ayyash Defence submits that 17 January 2005 is more likely—indeed that cell coverage records prove it could not have been 25 January 2005—and that the witnesses' conclusion about that date was unpersuasive, given the methods by which they reached it. Furthermore, according to the Ayyash Defence, Mr Ayyash was in Saudi Arabia, not Lebanon, from 15 to 28 January 2005.Footnote ³⁸⁸

316. The Trial Chamber has concluded that the dealership witnesses' evidence on its own cannot establish the date of the sale, but that there is no reason to disbelieve that evidence. Based on the combination of the witnesses' evidence, the call data records for Witnesses 63's and 75's mobiles, the date of Eid and the dealership's receipt stubs, 25 January 2005 is the more likely date.Footnote ³⁸⁹

317. Obtaining the Canter was part of the plot to commit the attack and kill Mr Hariri. It is plausible that the network mobile activity in Tripoli on 11, 12, 14, 15, 22 and 25 January 2005 concerned—and evidenced—this aspect of the plot. However, there is insufficient evidence to determine beyond reasonable doubt either any particular network mobile user's role in the Canter's purchase, or what any of them did afterwards to prepare it for use in the attack.Footnote ³⁹⁰

CLAIM OF RESPONSIBILITY FOR THE ATTACKFootnote ³⁹¹

318. On the afternoon of Monday 14 February 2005, some hours after the successful attack on Mr Hariri's life, international media outlets broadcast a claim of responsibility for the attack in which a twenty-two year old Palestinian, Mr Ahmad Abu Adass, claimed responsibility for the attack on behalf of an unknown fundamentalist group called El-Nusra-wal-Jihad-fi-Bilad- El-Sham ‘Victory and Jihad in Greater Syria’. His family had reported him missing a month earlier.Footnote ³⁹²

319. The Prosecutor's case is that the claim of responsibility was false and that the fundamentalist group is fictional. Rather, Mr Badreddine, Mr Merhi, Mr Oneissi and Mr Sabra were responsible for manufacturing a false claim of responsibility to deflect attention away from the true perpetrators of the attack.Footnote ³⁹³

320. Mr Badreddine is alleged to have monitored, and together with Mr Merhi, coordinated the preparation of the false claim of responsibility. Mr Oneissi and Mr Sabra, under Mr Merhi's coordination, are alleged to have participated in Mr Abu Adass's disappearance for the purpose of creating a false claim of responsibility. Before the attack, Mr Merhi is alleged to have coordinated their activities ‘in order to identify and effect the disappearance of a suitable individual’, Mr Abu Adass, ‘who would be used to make the video-taped false claim of responsibility’.Footnote ³⁹⁴

321. Immediately after the attack, and under Mr Merhi's coordination, Mr Oneissi and Mr Sabra are alleged to have participated in disseminating statements falsely attributing responsibility for the attack, ensuring the delivery of the video and a letter to Al-Jazeera, and that the video would be broadcast.Footnote ³⁹⁵

322. Their role in the claim of responsibility is the sole basis for Mr Merhi's, Mr Oneissi's and Mr Sabra's alleged criminal responsibility. The core events of the false claim plot were:

1. • the conspirators identifying a suitable person to make the false claim—namely Mr Abu Adass, who was a young introverted person with strong religious leanings—in the Arab University Mosque in Beirut. Mr Oneissi befriended Mr Abu Adass by pretending to be ‘Mohammed’, who needed assistance in learning how to pray;

2. • effecting the disappearance of Mr Abu Adass from his home on Sunday 16 January 2005: ‘Mohammed’ also participated in this;

3. • creating a video in which Mr Abu Adass falsely claimed responsibility for the attack on Mr Hariri; and

4. • disseminating and publishing the false claim via media outlets immediately after the assassination on Monday 14 February 2005.Footnote ³⁹⁶

323. The Prosecutor alleges that Mr Merhi and Mr Badreddine used their Green network mobiles, respectively Green 071 and Green 023, exclusively to ‘exchange information’ and ‘to coordinate the acts done in furtherance of the conspiracy’. Mr Merhi coordinated the false claim, and he, Mr Oneissi and Mr Sabra communicated for this purpose on their three personal mobiles. The Prosecution termed these the ‘Purple phones’. These, according to the amended consolidated indictment, were ‘a group of three phones, which were used from at least 1 January 2003 until 16 February 2005’ and ‘were used to communicate amongst each other and to communicate with others outside the group’. Further, they ‘were used to coordinate the false claim of responsibility’.Footnote ³⁹⁷

324. To prove this aspect of its case, the Prosecution led telecommunications and cell site evidence of the movements of the Purple mobiles, namely Mr Merhi's Purple 231, Mr Oneissi's Purple 095 and Mr Sabra's attributed Purple 018; and of communications between Mr Badreddine's Green 023 and Mr Merhi's attributed Green 071. The Prosecution alleges that behavioural patterns of their mobiles show that Mr Oneissi and Mr Sabra coordinated the false claim, and that Mr Merhi coordinated it.Footnote ³⁹⁸

325. It also called evidence of what occurred in the mosque in January 2005, and from Mr Abu Adass's family, friends and associates. Finally, it presented evidence from those who received and broadcast the video on the afternoon of Monday 14 February 2005.Footnote ³⁹⁹

326. The evidence, however, was insufficient to establish that Mr Merhi was using Green 071. For the purposes of analysis here, and to do justice to the Prosecution's case—and even though the Trial Chamber cannot positively find that Mr Sabra was the user of Purple 018—the analysis below proceeds on the assumption that Mr Sabra was Purple 018's single user.Footnote ⁴⁰⁰

327. The Trial Chamber finds that four telephone calls were made on the afternoon of 14 February 2005 regarding the claim of responsibility for the attack using telecard 6162569. The call data records for this telecard, as for the Reuters and Al-Jazeera landlines, reveal that four calls were made—one to Reuters at 14:11, and three to Al-Jazeera, at 14:19, 15:27 and 17:04.Footnote ⁴⁰¹

MAKING THE CLAIM OF RESPONSIBILITY FOR THE ATTACKFootnote ⁴⁰⁶

331. In the immediate aftermath of the explosion on 14 February 2005, Beirut was in a state of chaos and crisis. The Trial Chamber received evidence of an atmosphere of turmoil that included the overloading of the mobile networks and a breakdown in communications.Footnote ⁴⁰⁷

332. People were desperately trying to obtain information about family and friends. The crime scene was swamped with emergency and security personnel, journalists and many others who should not have been there, including people looking for their loved ones. It was at first unclear whether Mr Hariri had survived the attack. When his death was announced, the obvious question was of ‘who was responsible’. It was in this setting, but before Mr Hariri was officially confirmed dead, that the Beirut offices of Reuters and Al-Jazeera received calls claiming responsibility for the attack.Footnote ⁴⁰⁸

333. The Beirut Al-Jazeera bureau chief, Mr Ghassan Ben-Jeddo, took three calls relating to this. At around 14:19 someone then called Al-Jazeera's Beirut office. Mr Ben-Jeddo testified that the caller said something very similar to the written text containing the claim of responsibility for the assassination, which the Al-Jazeera office received later.Footnote ⁴⁰⁹

334. The second call was at 15:39. The caller told Mr Ben-Jeddo that there was a video tape on a tree near the Al-Jazeera building, next to a pink building. He said that it must be retrieved within fifteen minutes or it would not be found.Footnote ⁴¹⁰

335. Witness PRH115, a technician working at Al-Jazeera, then volunteered to go and get the tape. He walked around the tree two or three times before he noticed a white box on one of the branches. He climbed about a metre or a metre and a half up the tree and collected the box.Footnote ⁴¹¹

Exhibit 4D161 (Photograph marked by Witness PRH115 showing where on the tree he saw the white box) Footnote ⁴¹²

336. A third call was made to Al-Jazeera at 17:04. The caller became threatening, and in a sharp voice said that Al-Jazeera would hear a lot in the future about the group claiming responsibility for the attack, and that it was in the company's interest to cooperate.Footnote ⁴¹³

337. The video was broadcast on Al-Jazeera at 17:30. The video tape contained a footage of Mr Abu Adass, who was seated under a banner purportedly to be that of the group El-Nusra-wal-Jihad-fi-Bilad-El-Sham (Society for Support and Jihad in Greater Syria), reading out the following claim of responsibility: Footnote ⁴¹⁴

Exhibit P766 (Still image from video-recorded claim of responsibility featuring Mr Abu Adass aired on Al-Jazeera) Footnote ⁴¹⁵

338. The letter accompanying the video tape stated:Footnote ⁴¹⁶

The letter was signed El-Nusra-wal-Jihad-fi-Bilad-El-Sham, Abou Hafass El-Chami.Footnote ⁴¹⁷

339. The Trial Chamber finds that four telephone calls were made on the afternoon of 14 February 2005 regarding the claim of responsibility for the attack using telecard 6162569. The call data records for this telecard, as for the Reuters and Al-Jazeera landlines, reveal that four calls were made—one to Reuters at 14:11, and three to Al-Jazeera, at 14:19, 15:27 and 17:04.Footnote ⁴¹⁸

340. The four calls were made from four payphones. The two maps from the electronic presentation of evidence below show, in the first one, the location of the four payphones, the tree, Al-Jazeera and Reuters. The second shows the cells to which mobiles Purple 018 and Purple 095 connected around the time that the call was made from the fourth payphone to Al- Jazeera, at 17:04 on the afternoon of Monday 14 February.Footnote ⁴¹⁹

Exhibit P1923, slide 146 Footnote ⁴²⁰

Exhibit P1783 (Expert report of Gary Platt – Chronology), p. 416

341. The Trial Chamber cannot make any findings from this evidence about who made the calls, nor how many callers there were. Mr Ben-Jeddo testified that three different people called Al-Jazeera regarding the claim of responsibility. It is also possible that another, different person called Reuters. Although it is most likely that the same people made the calls, there is no way of comparing whether the same person(s) called both Reuters and Al-Jazeera.Footnote ⁴²¹

342. The Trial Chamber also finds that members of Al-Jazeera's Beirut office obtained the false claim video and letter at 15:53 from the tree near their office. The call data records support this finding.Footnote ⁴²²

343. However, it cannot determine when the package was placed in the tree; there is no evidence from which the Trial Chamber can make a finding as to whether it was placed there before or after the attack.Footnote ⁴²³

AHMAD ABU ADASSFootnote ⁴²⁴

344. The entire false claim plot centres on its subject, Mr Ahmad Abu Adass. The Trial Chamber received evidence about Mr Abu Adass from family and friends who knew him. The evidence goes to proving the Prosecutor's pleading that the claim of responsibility for the attack was false. The gist of the Prosecution case is that because of his personal profile he was deliberately targeted and chosen by those who were responsible for this attack.Footnote ⁴²⁵

345. The Trial Chamber is satisfied that the evidence establishes that Mr Abu Adass was a young man, perhaps with an introverted personality, who in the period before his disappearance was becoming increasingly religious. This included growing a beard and wearing religious clothing. His Lebanese identity card, dated 15 April 2002, shows him with a beard. He was attending the mosque near his home daily and had developed an interest in Islamic literature. Mr Abu Adass also appears to have been disinterested in politics. These factors, in the Trial Chamber's assessment, could have made him susceptible to approaches from groups wishing to recruit young vulnerable people to their religious causes.Footnote ⁴²⁶

346. The Trial Chamber is also satisfied from the uncontested evidence that Mr Abu Adass could not drive. He was interested in computers and had briefly worked in the information technology sector. At the time of his disappearance, like many other young people, he was probably contemplating a married future.Footnote ⁴²⁷

GENERAL FINDINGS ON THE FALSE CLAIM OF RESPONSIBILITYFootnote ⁵¹⁷

427. In summary, the Trial Chamber has found that:Footnote ⁵¹⁸

1. • Mr Abu Adass was not the suicide bomber;

2. • The claim of responsibility for the attack was false;

3. • Contact occurred on Wednesday 22, Tuesday 28 and Friday 31 December 2004 and Friday 7 January 2005—the period in which Mr Abu Adass was allegedly being identified—between Mr Oneissi on Purple 095 and Mr Merhi on Purple 231. These were calls around the time when Mr Oneissi's mobile was connecting to cells covering an area near the Arab University Mosque in Beirut, where Mr Abu Adass prayed;

4. • Similarly, on two out of eight days when Mr Sabra's attributed mobile was also connecting to the cell covering the mosque, namely Saturday 1 and Tuesday 4 January 2005, Mr Sabra's attributed Purple 018 was in contact with Mr Merhi on Purple 231;

5. • Mr Merhi's attributed Green 071 contacted Mr Badreddine on Green 023, on Thursday 23 and Monday 27 December 2004, and Sunday 2 January 2005;

6. • There were also calls between Mr Badreddine's Green 023 and Mr Merhi's attributed Green 071 between Wednesday 12 and Sunday 16 January 2005, and most particularly five times on the morning of 16 January 2005—the day of Mr Abu Adass's disappearance;

7. • On Friday 14 and Saturday 15 January 2005, Mr Merhi on Purple 231 called Mr Sabra's attributed Purple 018 three times;

8. • Mr Abu Adass left his home on Sunday 16 January 2005 and never returned and is most likely deceased;

9. • On Monday 17 January 2005, Mr Oneissi on Purple 095 called Mr Merhi on Purple 231;

10. • At an unknown date between Monday 17 January 2005 and Monday 14 February 2005, a video tape was made in which Mr Abu Adass falsely claimed responsibility for the attack;

11. • Four telephone calls were made on Monday 14 February 2005, to Reuters and Al- Jazeera from those involved in making the false claim, ensuring that the false claim was received and then disseminated to the public;

12. • A video tape and accompanying letter had been placed in a tree near the Al-Jazeera office at some point before it was collected at 15:53 on Monday 14 February 2005; and

13. • There were a series of calls between Mr Merhi's Purple 231, Mr Oneissi's Purple 095 and Mr Sabra's attributed Purple 018 on the afternoon of 14 February 2005 from locations near the four payphones and the tree.

428. The Trial Chamber has been unable, however, to find that:Footnote ⁵¹⁹

1. • Mr Abu Adass met a person named ‘Mohammed’ in the Arab University Mosque in late December or early January 2005;

2. • Mr Oneissi posed as ‘Mohammed’;

3. • The activity of Mr Merhi's Purple 231, Mr Oneissi's Purple 095 and Mr Sabra's attributed Purple 018 showed that they were involved in the ‘Mohammed deceit’ around the Arab University Mosque in late December 2004 or early January 2005;

4. • Mr Oneissi called the Abu Adass family home on Saturday 15 January 2005;

5. • Mr Abu Adass left with ‘Mohammed’ on Sunday 16 January 2005;

6. • Mr Oneissi called the Abu Adass family home on Monday 17 January 2005;

7. • The activity of Mr Merhi's Purple 231, Mr Oneissi's Purple 095 and Mr Sabra's attributed Purple 018 showed their participation in the disappearance of Mr Abu Adass;

8. • The video tape claiming responsibility was placed in the tree before the assassination;

9. • Either Mr Oneissi or Mr Sabra made the telephone calls to Reuters or Al-Jazeera;

10. • The Purple mobiles' activity otherwise connected Mr Oneissi, Mr Sabra or Mr Merhi to the attack on 14 February 2005; and

11. • The cell site evidence, especially given the state of network congestion after the attack on 14 February 2005, was sufficiently reliable to make findings as to precise locations of mobile users as pleaded.

429. The Prosecution has therefore not proved its case beyond reasonable doubt of Mr Merhi's, Mr Oneissi's and Mr Sabra's participation in the false claim of responsibility for the attack on Mr Hariri.Footnote ⁵²⁰

APPLICABLE LAWFootnote ⁵²¹

430. As a hybrid international criminal tribunal with the presence of international and Lebanese judges, created pursuant to a resolution of the UN Security Council following a request from the Lebanese Government, the Special Tribunal applies mixed sources of law. For what may be termed substantive crimes, namely those charged in an indictment against Accused persons—and except for offences of contempt and obstruction of justice created by the Rules and listed in Rule 60 bis—the Special Tribunal applies the Lebanese Criminal Code.Footnote ⁵²²

LEGAL FINDINGS ON ELEMENTS OF THE CRIMES AND INDIVIDUAL CRIMINAL RESPONSIBILITYFootnote ⁵³⁰

SALIM JAMIL AYYASHFootnote ⁶⁴⁰

543. The evidence connecting Mr Ayyash with the attack on Mr Hariri stems from his use of mobile Red 741. Without this there would be no evidence linking him with the explosion on 14 February 2005.Footnote ⁶⁴¹

544. The Red network undoubtedly was used in the assassination. It functioned as a closed network that ceased operation immediately before the attack, after having been used in the previous month in the surveillance of Mr Hariri and his convoy's movements.Footnote ⁶⁴²

545. It operated extensively on the day of the attack. Red network mobile users were near or in the area of Quraitem Palace just after Mr Hariri had left for the Parliament and they were active in monitoring him at the Parliament, when he was in the Parliament area. They must also have assisted in preparing the Canter for the attack at the crime scene. The Trial Chamber agrees with the Prosecution's description of the Red network in the amended consolidated indictment and its final trial brief as the ‘assassination team’.Footnote ⁶⁴³

546. The question here is not whether Mr Ayyash detonated the explosive with his own hands—which he did not—but whether his actions directly contributed to the execution of the crime, thereby satisfying the actus reus for co-perpetration of a terrorist act.Footnote ⁶⁴⁴

547. The Trial Chamber has analysed the evidence proving Mr Ayyash's actions and intention, namely, his mens rea and actus reus, in its findings above concerning count two, with committing a terrorist act by means of an explosive device.Footnote ⁶⁴⁵

548. The evidence supporting all counts is the same. The terrorist act was aimed at killing Mr Hariri in a public place with an explosive device. The only real difference in the legal elements required to satisfy the crimes charged in counts two (the terrorist act) and three and four (intentional homicide) is that for count two the Prosecution must prove a specific intention in relation to the terrorist act. Count five (attempted intentional homicide) has a separate legal element of dolus eventualis, or an acceptance of a probable outcome, here being the likely death of people other than Mr Hariri. In the circumstances of this case, the same evidence establishes the legal mens rea for counts two to five. That is, detonating a large explosion—aimed at a motor convoy—in a public place that was crowded withpeople.Footnote ⁶⁴⁶

549. Mr Ayyash was the user of Green 300, Red 741, Blue 233 and Yellow 294 during the relevant periods. The Red, Yellow, Green and Blue networks were connected and at least some of the users of the Red, Yellow, Green and Blue networks had a common mission, namely the assassination of Mr Hariri. The Red network played a crucial role in executing the attack on 14 February 2005.Footnote ⁶⁴⁷

550. The only reasonable conclusion available from the evidence is that, on Monday 14 February 2005, the Red mobiles tracked the movement of Mr Hariri and his convoy, alerted the others involved of his location and prepared for surveillance and for the execution of the attack along the route that he was expected to take. This must have also aimed at ensuring that the explosive detonated at the exact time the convoy would pass. The users of the Red mobiles had prepared the attack through repeated operations of surveillance and reconnaissance in previous days.Footnote ⁶⁴⁸

551. The Trial Chamber can infer from Mr Ayyash's actions that he must have been aware of what he was doing. This is the only conclusion reasonably available on the evidence. The evidence establishes that Mr Ayyash had a central role in the execution of the attack. The mission was to assassinate Mr Hariri. Mr Ayyash participated in the preparations for the attack from at least early February 2005 until four minutes before its completion. His last call occurred at 12:50:55 and lasted ten seconds.Footnote ⁶⁴⁹

552. By these actions, the conduct of the Red mobiles' users directly contributed to the execution of the crime and therefore establishes the actus reus for co-perpetration of intentional homicide. The Trial Chamber is therefore satisfied that Mr Ayyash, on his Red 741, directly contributed to the execution of the intentional homicide of Mr Hariri by directly participating in it from the Parliament and the crime scene areas on 14 February 2005 and by contributing to its preparation in previous days.Footnote ⁶⁵⁰

553. Accordingly, the Trial Chamber also finds that Mr Ayyash's actions directly contributed to the execution of the crime of intentional homicide of Mr Rafik Hariri through his central and leading role in the execution of the attack. Again, the legal issue is whether he knowingly did so and with the requisite intention to commit premeditated intentional homicide with explosive materials.Footnote ⁶⁵¹

554. The Trial Chamber is therefore satisfied beyond reasonable doubt that Mr Ayyash possessed the requisite knowledge that the explosive device was liable to create a public danger. That is the only conclusion that is reasonably available from the evidence. The Trial Chamber therefore concludes that Mr Ayyash possessed the mens rea to commit a terrorist act.Footnote ⁶⁵²

555. For the same reasons set out above in analysing Mr Ayyash's mens rea for count two, the same evidence establishes beyond reasonable doubt his knowledge and his intention to murder Mr Hariri with explosive materials.Footnote ⁶⁵³

556. In light of the findings above, the Trial Chamber finds Mr Ayyash guilty beyond reasonable doubt, as a co-perpetrator, of the intentional homicide of Mr Rafik Hariri (count three) under Articles 188, 212, 213 and 547 of the Lebanese Criminal Code and Article 3 (1) (a) of the Statute of the Special Tribunal.Footnote ⁶⁵⁴

557. A perpetrator of attempted intentional homicide must have the mens rea to commit the crime of intentional homicide. Based on the same reasoning applied in relation to count four above, the Trial Chamber is satisfied beyond reasonable doubt that Mr Ayyash intended to kill the members of Mr Hariri's convoy and the members of the public who were injured in the attack. Or, alternatively, he at least foresaw that deaths would occur and accepted that risk.Footnote ⁶⁵⁵

558. There is no other conclusion reasonably available from the evidence. Detonating a truckload of explosives in a busy street near occupied buildings will inevitably kill many people. Some may not die but instead sustain injury. Some injuries will be severe. However, whether or not these people died from their injuries the act of participating in the detonation of the explosion was an act likely to cause death. In this respect the conduct amounted to an attempted intentional homicide with premeditation by using explosive materials. Mr Ayyash did not act alone; he had an important role in the operation against Mr Hariri.Footnote ⁶⁵⁶

559. Accordingly, the Trial Chamber finds Mr Ayyash guilty, as a co-perpetrator, of the attempted intentional homicide of the 226 people listed in schedule B of the amended consolidated indictment (count five) under Articles 188, 189, 201, 212, 213 and 547 of the Lebanese Criminal Code and Article 3 (1) (a) of the Statute of the Special Tribunal.Footnote ⁶⁵⁷

560. Mr Ayyash had a central role in the execution of the attack and directly contributed to it. Mr Ayyash intended to kill Mr Hariri and had the required knowledge about the circumstances of the assassination mission, including that explosives were the ‘means’ to be used.Footnote ⁶⁵⁸

561. The Trial Chamber is satisfied beyond reasonable doubt that the Prosecution has proved the guilt of Salim Jamil Ayyash on all counts charged in the amended consolidated indictment.Footnote ⁶⁵⁹

HUSSEIN HASSAN ONEISSI AND ASSAD HASSAN SABRAFootnote ⁶⁶⁰

562. During the amended consolidated indictment period—as noted above—Mr Sabra's attributed mobile Purple 018 and Mr Oneissi using his personal mobile Purple 095 called each other, and Mr Merhi on Purple 231. Their mobiles were present in the area of locations where false claim-related activities took place, such as the Arab University Mosque in late December 2004 and early January 2005. The two personal mobiles were used near relevant payphones on 14 February 2005, and the tree from which the video was collected. Their personal mobiles stopped use shortly after the attack.Footnote ⁶⁶¹

563. This conduct is insufficient either to prove conduct that assisted the perpetrators' preparation for the attack or that helped to shield the perpetrators or accomplices from justice. Their actions, in Mr Oneissi being in these locations and Mr Sabra's attributed mobile Purple 018 also being there therefore do not satisfy the actus reus for accomplice liability.Footnote ⁶⁶²

564. Similarly, the Prosecution has failed to establish the mental element, or mens rea, of accomplice liability for either Accused. Using or not using a mobile, calling each other and being somewhere in the area of locations where false claim-related activities took place is likewise insufficient to demonstrate beyond a reasonable doubt that Mr Oneissi or Mr Sabra knew and accepted that the perpetrators would carry out an attack using an explosive device that was likely to kill people and spread terror. This is assuming that Mr Sabra was using his attributed mobile at all relevant times.Footnote ⁶⁶³

565. Moreover, there is no evidence from which the Trial Chamber could conclude beyond reasonable doubt—even if it was found proved that they did participate in calling the news agencies after the attack on 14 February 2005—that they were aware in advance of the attack, which occurred at around 12:55, that calling Al-Jazeera and Reuters later that afternoon was connected with the attack. This is an essential requirement under Articles 219 (4) and (5).Footnote ⁶⁶⁴

566. The Trial Chamber accepts that if they indeed participated in making the calls to either news outlet—by virtue of the content of the letter that was read during the call—they would have known then that their actions were connected with the attack. However, this would not of itself prove their knowledge of this before the attack, as is required by Article 219 of the Lebanese Criminal Code, to incur criminal liability as an accomplice.Footnote ⁶⁶⁵

567. The Trial Chamber's conclusion as to the lack of evidence that Mr Oneissi or Mr Sabra participated in the ‘Mohammed deceit’, the abduction of Mr Abu Adass or the dissemination of the false claim therefore precludes their liability as accomplices.Footnote ⁶⁶⁶

568. Accordingly, the Trial Chamber finds that Mr Oneissi's and Mr Sabra's liability as accomplices for the crimes of committing a terrorist act (count six), the intentional homicide of Mr Hariri (count seven), the intentional homicide of 21 other persons (count eight) and the attempted intentional homicide of 226 persons (count nine) has not been proven beyond a reasonable doubt.Footnote ⁶⁶⁷

569. The same underlying facts and conduct are used to prove Mr Oneissi's and Mr Sabra's alleged participation in the conspiracy to commit a terrorist act by means of an explosive device in order to assassinate Mr Hariri. To find them guilty of participating in the conspiracy charged in count one, the Trial Chamber must be satisfied beyond reasonable doubt of the same facts that would have proved their criminal liability as accomplices as charged in counts six to nine of the amended consolidated indictment.Footnote ⁶⁶⁸

570. The Trial Chamber's determination that the Prosecution failed to prove the two Accused did take part in the false claim is fatal to the charge of conspiracy. Accordingly, the Trial Chamber finds that Mr Oneissi and Mr Sabra cannot be found responsible for conspiracy to commit a terrorist act as charged in count one.Footnote ⁶⁶⁹

HASSAN HABIB MERHIFootnote ⁶⁷⁰

571. According to the amended consolidated indictment, Mr Merhi, together with Mr Badreddine, coordinated the preparation of the false claim of responsibility. He specifically co-ordinated the activities of Mr Oneissi and Mr Sabra in the lead-up and aftermath of the attack.Footnote ⁶⁷¹

572. Mr Merhi's alleged contributions to the crimes are solely related to the false claim of responsibility. For the Trial Chamber to assess whether his actions amount to criminally relevant contributions to crimes, it must be established factually what exactly he did. Evidence of Mr Merhi's actions is generally lacking. Mr Merhi's call activity on Purple 231 may link him to Mr Oneissi and Mr Sabra. However, even if the Trial Chamber were to be satisfied that Mr Merhi—on Purple 231—supervised Mr Oneissi and Mr Sabra, the Trial Chamber found that it was unable to link Mr Oneissi and Mr Sabra to the false claim of responsibility. Accordingly, the link between Mr Merhi and the false claim of responsibility is missing.Footnote ⁶⁷²

DISPOSITIONFootnote ⁶⁷³

FOR THE REASONS ABOVE and having considered the Parties' submissions, and pursuant to Article 23 of the Statute of the Special Tribunal for Lebanon and Rule 168 of the Rules of Procedure and Evidence, the Trial Chamber finds the Accused:

SALIM JAMIL AYYASH

GUILTY, pursuant to Articles 2 and 3 (1) (a) of the Statute of the Special Tribunal for Lebanon, and Article 212 of the Lebanese Criminal Code, of the following counts charged on the amended consolidated indictment, as a co-perpetrator of:

COUNT 1—Conspiracy aimed at committing a terrorist act (Articles 270 and 314 of the Lebanese Criminal Code);

COUNT 2—Committing a terrorist act by means of an explosive device (Article 314 of the Lebanese Criminal Code);

COUNT 3—Intentional homicide of Rafik Hariri with premeditation by using explosive materials (Articles 547 and 549 (1) and (7) of the Lebanese Criminal Code);

COUNT 4—Intentional homicide (of 21 persons in addition to the intentional homicide of Rafik Hariri) with premeditation by using explosive materials (Articles 547 and 549 (1) and (7) of the Lebanese Criminal Code); and

COUNT 5—Attempted intentional homicide (of 226 persons in addition to the intentional homicide of Rafik Hariri) with premeditation by using explosive materials (Articles 200, 547 and 549 (1) and (7) of the Lebanese Criminal Code).

AND

HASSAN HABIB MERHI

HUSSEIN HASSAN ONEISSI

ASSAD HASSAN SABRA

NOT GUILTY of all counts charged in the amended consolidated indictment, namely counts one, six, seven, eight and nine.

Done in Arabic, English, and French, the English version being authoritative.

Leidschendam,

The Netherlands

18 August 2020