Hariri Bombing Indictment Based on Flawed Premise

Washington – The indictment of four men linked to Hezbollah in the 2005 assassination of Lebanese Prime Minister Rafik Hariri made public by the Special Tribunal on Lebanon Aug. 17 is questionable not because it is based on “circumstantial evidence”, but because that evidence is based on a flawed premise.

The evidence depends on a convoluted theory involving what the indictment calls “co-location” of personal mobile phones associated with five distinct networks said to be somehow connected with the plot to murder Hariri.

The indictment, originally filed Jun. 10, says that, if there are “many instances” in which a phone is “active at the same location, on the same date, and within the same time frame as other phones”, but the phones do not contact each other, then it is “reasonable to conclude from these instances that one person is using multiple phones together”.

Based on that assumption the indictment asserts that “a person can ultimately be identified by co-location to be the user of a network phone.”

On that reasoning, one of the four accused, Salim Jamil Ayyash, is said to have participated in a “red” network of phones that was activated on Jan. 5, 2005, only contacted each other, and ceased operations two minutes before the blast that killed Hariri. The “red” network is presumed to have been used by those who carried out surveillance as well as prepared the logistics for the bombing.

But Ayyash is also linked by “co-location” to a “green” network that had been initiated in October 2004 and ceased to operate one hour before the attack, and a “blue” network that was active between September 2004 and September 2005. The only basis for linking either of those two sets of mobile phones to the assassination appears to be the claim of frequent “co-location” of Ayyash's personal cell phone with one of the phones in those networks and one red phone.

But the idea that “co-location” of phones is evidence of a single owner is a logical fallacy. It ignores the statistical reality that a multitude of mobile phones would have been frequently co-located with any given phone carrying out surveillance on Hariri in Beirut over an hour or more on the same day during the weeks before the assassination.

In the area of Beirut from the parliament to the St. George Hotel, known as Beirut Central District, where the “red” network is said to have been active in carrying out its surveillance of Hariri, there are 11 base stations for mobile phones, each of which had a range varying from 300 metres to 1,250 metres, according to Riad Bahsoun, a prominent expert on Lebanon's telecom system. Bahsoun estimates that, within the range of each of those cell towers, between 20,000 and 50,000 cell phones were operating during a typical working day.

Given that number of mobile phones operating within a relatively small area, a large number of phones would obviously have registered in the cell tower area and in the same general time frame – especially if defined as an hour or more, as appears to be the case – as at least one of the red network phones on many occasions.

The indictment does not state how many times one of Ayyash's personal phones was allegedly “co-located” with a “red” network phone.

To prove that Ayyash was in charge of the team using the red phones, the indictment provides an extraordinarily detailed account of Ayyash's alleged use of red, green and blue phones on seven days during the period between Jan. 11 and Feb. 14, the day of the assassination.

But according to that information, during the final nine days on which the red network was active in surveillance of Hariri, including the day of the bombing itself, Ayyash was in phone contact with the red and blue networks on only three days – a pattern that appears inconsistent with the role of coordinating the entire plot attributed to him.

The most senior Hezbollah figure indicted, Mustafa Amine Badreddine, is accused of involvement only because he is said to have had 59 phone contacts with Ayyash during the Jan. 5-Feb. 14 period. But those phone contacts are attributed to the two Hezbollah figures solely on the basis of co-location of their personal mobile phones with two phones in the “green” network on an unspecified number of occasions – not from direct evidence that they talked on those occasions.

Evidence from the U.N. commission investigating the Hariri assassination suggests that investigators did not stumble upon the alleged connections between the four Hezbollah figures and the different phone networks but used the link analysis software to find indirect links between phones identified as belonging to Hezbollah and the “red phones”.

In his third report, dated Sep. 26, 2006, then Commissioner Serge Brammertz said his team was using communications traffic analysis for “proactive and speculative” studies.

Brammertz referred in his next report in December 2006 to the pursuit of an “alternative hypothesis” that the motive for killing Hariri was a “combination of political and sectarian factors”. That language indicates that the “proactive and speculative” use of link analysis was to test the hypothesis that Shi'a Hezbollah was behind the bombing.

This is not the first time that communications link analysis has been used to link telephones associated with a specific group or entity to other phones presumed to be part of a major bombing plot.

In the investigation of the Buenos Aires terror bombing of a Jewish community centre in 1994, the Argentine intelligence service SIDE used analysis of phone records to link the Iranian cultural attaché, Mohsen Rabbani, to the bombing, according to the former head of the U.S. Federal Bureau of Investigation's Office on Hezbollah, James Bernazzani.

Bernazzani, who was sent by the White House in early 1997 to assist SIDE in the bombing investigation, told this reporter in a November 2006 interview that SIDE had argued that a series of telephone calls made between Jul. 1 and Jul. 18, 1994 to a mobile phone in the Brazilian border city of Foz de Iguazu must have been made by the “operational group” for the bombing.

SIDE had further argued that a call allegedly made on a mobile phone belonging to Rabbani to the same number showed that he was linked the bombing plot.

Bernazzani called that use of link analysis by SIDE “speculative” – the same word that Brammertz used to describe the U.N. investigation's employment of the same tool. Such speculative use of link analysis “can be very dangerous”, Bernazzani said. “Using that kind of analysis, you could link my telephone to [Osama] bin Laden's.”