STL

Bulletin
August 2015
The STL Bulletin provides a monthly overview of the latest developments, news and visits to the Special Tribunal
for Lebanon. It is not a judicial document with legal authority. It is one of a number of public information
documents produced by the Tribunal. You can view them all at http://www.stl-tsl.org/en/news-and-press.

Judicial developments
The Prosecutor v. Ayyash et al. (STL-11-01)1
On 18 August, in the first hearing after the summer
judicial recess, Mr John Edward Philips gave his testimony before the Trial Chamber. Mr Philips is an expert
witness on telecommunications and cell site analysis,
and is currently an independent cell site analyst in
the United Kingdom (UK) and analyses data generated by the Global System for Mobiles (GSM). He has
previous experience in mobile radio communications
and worked on a large number of judicial cases, for
both the Prosecution and the Defence, concerning
serious and organised crimes in the UK. He produced
a report for the Prosecution at the STL in September
2012 on the application of cell site analysis (CSA) to
GSM networks.
1

During the Prosecution examination from 18-21

August, Mr Philips divided his testimony into two
parts. The first part focused on the general concept of
CSA, how to make a telephone call over a GSM mobile

This section provides an overview of courtroom hearings in the Ayyash

et al. case only. All the public filings in this case are available on our
website: http://www.stl-tsl.org/en/the-cases/stl-11-01/filings

phone network, and how the call data generated from

that network is examined.
The witness explained to the Trial Chamber what is
meant by subscriber identity module (SIM) and international mobile equipment identity (IMEI). He said
the 14-digit IMEI helps identify the type of handset
used by the subscriber. He also spoke about how voice
calls and short message service texts (SMS) are made
and received over GSM networks using cell sites; the
components and structure of GSM; the sources of call
data records (CDRs); and how CDRs are reflected in
call sequence tables (CSTs).
All public transcripts in the Ayyash et al. case are available
on our website in Arabic, English and French.

On 19 August, Mr Philips continued to present

his evidence before the Trial Chamber. The witness
demonstrated CSTs that showed the activity of
particular telephones in specific areas that are relevant
to the Prosecutions case. Moreover, he testified about

www.stl-tsl.org
Dokter van der Stamstraat 1, 2265 BC Leidschendam, Netherlands PO Box 115, 2260 AC Leidschendam, Netherlands.
For more information please contact the Public Information and Communications Section: stl-pressoffice@un.org Tel : +31 (0) 70 800 3560 / 3828 and +961 4 538 100 (Beirut)
www.twitter.com/stlebanonwww.facebook.com/stlebanonwww.youtube.com/stlebanonwww.flickr.com/stlebanon

the possibility of locating a mobile phone from the

CDRs. Mr Philips said it is a pre-requisite for a mobile
phone to be within the coverage area of cell sites for it
to be reflected in CDRs. He also explained to the court
what a cell site is and the different types of it.

methods. Examples of basic methods were given,

such as a mobile phones photos, phone book, or the
SMS content. Additionally, he spoke about advanced
methods, such as co-location analysis, which consists
of looking at the locations of two or more mobile
phones to see if they could be together over a period
of time and also at the call patterns to confirm that
they are consistent with the phones being used by
the same person. He explained that if there are calls
which are close in time to one another then the phones
would be expected to be in the same area and potentially using the same adjacent or overlapping cells. The
witness continued to say that patterns observed over a
longer period of time help to confirm certain conclusions about the user rather than coincidental events.
He went on to explain other advanced methods such
as contact profiling and geographic profiling of mobile
phones. A combined analysis of the contact and the
geographical profiles of a particular phone, in addition to the call patterns observed, provide a signature
of the phone user: the users relations, lifestyle, habits
and specific behaviour at specific times which tends to
reveal his/her identity.

In the area of signals, the witness explained the difference between two types of signals: usable signals and
best server coverage signals. He also spoke about
some of the specificities and configuration of the cells
used by Lebanese service providers Alfa and MTC
Touch.
On 20 August, Mr Philips continued to give an overview of the best server coverage of the cells that
feature on the Alfa and MTC Touch networks. He
explained that the network supplies a series of cell sites
across the country, which are configured to provide
capacity and coverage.
The witness spoke about the normal operation and
allocation of a cell that is to be used in a call, as well as
exceptional events with which a network might need
to deal. Furthermore, he explained about the instances
where cells might be overloaded with an abundance of
calls, leading adjacent cells to take over the communications. He then stated that potential co-location
occurs when more than one phone uses the same cell
around the same time.

At the end of examination-in-chief, Mr Philips spoke

about the general concept of a criminal using multiple
mobile phones for different purposes and the types
of contact patterns while using the different phones.
The witness gave an outline of the behaviour of criminal phones and went on to identify a special type of
criminal phone called mission phones - very covert
phones that are used in a closed network, for the
execution and/or planning of a particular crime. The
purposes of such phones is to disassociate or insulate
their use in the crime from the identity of their users
as much as possible, and therefore operate under very
high anonymity, and are to be used only for contact
between members of a given group.

In the second part of his presentation, Mr. Philips

examined cell site analysis in a practical context,
including the methods and purposes for which CDRs
can be used. He discussed location and movement
of mobile phones, as well as phone attribution. The
witness emphasised that CSA does not identify the
exact location of the mobile; rather, it reflects the
vicinity in which the mobile was located when it was
in use.
On 21 August, Mr Philips moved on to give practical
examples of the cell site analysis. He demonstrated
the location and overall movement of a single mobile
phone, and the common movement of two mobile
phones and multiple mobile phones. The Prosecution
alleges that the telephones featured in the examples are
attributable to Mr Salim Jamil Ayyash and Mr Mustafa
Amine Badreddine, who are accused in the present case.
The witness showed a sequence of seven successive calls
to illustrate the movement and the corresponding cell
sites, their azimuth and the best coverage plots.

In this context, the witness told the Trial Chamber that

all three closed user group networks he has examined
(the red, green and blue groups) exhibited the characteristics of mission phones with varying degrees
of association with the crime, and types of usage. He
explained that the closer and more direct the association with the crime or the target of the crime, the
higher the degree of anonymity of the users must be.
The witness continued to explain that the red group,
which had an apparent and direct association with the
crime and was thereby easily discoverable from CDRs,
was necessarily used in very restricted geographical areas and time periods to enhance their users
anonymity. As for the blue and green groups, they did
not have the same type of association with the crime

Mr Philips then spoke about phone attribution, which

he explained as the different techniques that help identify the user of a phone at an appropriate time through
a variety of means, described as basic and advanced

Document provided by the Public Information and Communications Section of the Special Tribunal for Lebanon

or such discoverability and, therefore, whilst maintaining the anonymity of their users, they were used in
a less restricted way, including use in areas around the
apparent home of the users.

that during congestion, calls are directed to the next

best cell in terms of coverage when the ordinarily best
server cell is overloaded. Mr Philips was then asked
about the possibility of phones being congested as a
result of overloading immediately after the occurrence
of the crime on 14 February 2005, as well as about
the potential consequences of failed cells, overlapping
coverage by the cell sites, and co-channel interference.

The witness concluded his testimony by explaining

that such is the nature of mission phones and the high
degree of anonymity of their users, that the only way
to identify those users and therefore those involved
in committing the crime may be by making a sufficient geographical connection between the use of the
mission phones and the use of other personal mobile
phones used by the criminal over a similar period.

Mr Philips was then asked about the possible manipulation of the CDRs, a topic the witness was asked to
deal with in his 2012 OTP report. The witness referred
to a briefing paper by a former OTP employee, in
which the witness was asked to carry out specific work
in terms of possible manipulation of the CDRs. This
document was previously not disclosed to the Defence.
As a result, the Trial Chamber deferred the Defence
cross-examination on the issue of possible manipulation of CDRs to later stages.

The Defence Counsel cross-examined Mr Philips from

24 - 26 August. On 24 and 25 August, Counsel for
Mr Oneissi questioned Mr Philips. On the first day,
the Counsel started by asking the witness how he was
approached by the Office of the Prosecutor (OTP) to
be contracted to work with them, what he worked on,
specifically the areas that he was asked to cover in the
CSA, as well as the reports he produced.

On 27 August, the Prosecution read onto the record

a total of 14 witness statements admitted under Rule
155 of the STLs Rules of Procedure and Evidence.
The witness statements mainly deal with the telephone applications and identification documents used
in connection with the purchase of the handsets and
telephone networks the Prosecution claims were used
in the conspiracy to assassinate the former Lebanese
PM Hariri. In addition, the witness statements provide
evidence about the importation and sale of the handsets that the Prosecution alleges were used with the red
network telephones.

The witness was further asked about the various factors

that play a role in constructing a new network and the
propagation models or tools used by network operators in Lebanon to predict the required capacity prior
to setting up networks by Alfa and MTC Touch. Mr
Philips was then questioned about the predictive maps
that he worked on, and whether he received information from the telephone companies in Lebanon about
the methodology, software, and data on how they built
their predictive coverage maps. Additionally, he was
asked how telephone companies check the quality of
this predictive coverage, whether by physical measurements in situ or through field surveys. The witness was
then shown an extract of a witness statement given to
the OTP by an Alfa employee on 27 July 2010 regarding
the companys mapping information for 2005 and was
asked whether he was familiar with it.

On 31 August, Mr Saadeddine El-Ajouz appeared

before the Trial Chamber via video link. Mr El-Ajouz
is an engineer and the owner of Power Group, a wholesale company that has distributed Alfa (formerly Cellis)
telecommunications products in Lebanon since 1994.
He has been managing Power Group since 2004-2005.
The company sells scratch cards, pre-paid and postpaid mobile lines (SIM cards), and handsets.

On 25 August, Counsel for Mr Oneissi continued to

cross-examine Mr Philips. He was questioned on the
impact of the damage from the July 2006 Israeli attacks
on Lebanon and how the best server coverage plot
was affected. Questions on the positioning and maintenance of cell tower masts in the region of Beirut were
then put before the witness. Mr Philips was then asked
about the phenomenon of fading, which he explained
may result in a change in the predicted best coverage
cells at points where signals are of similar level.

The testimony of Mr El-Ajouz focused on the companys distribution practices and records kept with respect
to sales and purchases, including some specific business
records relevant to the Prosecutions case. In particular,
he was asked about business records for the sale of the
SIM cards for phones that the Prosecution has categorised as Red Network, Green Network, and the phone
lines allegedly used by the accused Mr Ayyash and Mr
Badreddine as part of the telephone networks implicated in the conspiracy to assassinate the former Lebanese PM Hariri.

On 26 August, Counsel for Mr Sabra cross-examined

Mr Philips. The cross-examination started by questions about congestion issues (referred to also as call
anomalies or directed retries). The witness explained

The witness told the Trial Chamber that in 1995

Power Group became an authorised distributor of Alfa

Document provided by the Public Information and Communications Section of the Special Tribunal for Lebanon

products, called Cellis at the time, and served hundreds

of dealers or points of sales in the period 2004-2005.
The witness also stated that his company deals exclusively with Alfa, one of the two mobile telephone
service providers in Lebanon. Mr El-Ajouz testified
about the precise procedure and the paperwork that
Power Group undertook in regards to a number of
phone lines that were allegedly attributed to some of
the Accused in this case.
Defence Counsel for Mr Sabra cross-examinaed of
Mr El-Ajouz the same day. The witness was questioned about the Islamic Association Project2, generally known in Lebanon as Al-Ahbash, of which he
is a member. He was then asked about people he
2 Other names of the organisation in English include the Islamic
Charitable Projects and Association of Islamic Philanthropic Projects.

knows who were interviewed by the Lebanese Investigative Judge Elias Eid in 2006 at the request of the
United Nations International Independent Investigation Commission. These individuals include Mr
Ahmad Abdel-Aal and Mr Mahmoud Abdel-Aal,
fellow members of the Islamic Association Project. In
particular, Mr El-Ajouz was questioned about his relationship with Mr Ahmad Abdel-Aal and Mr AbdelAals role in the public relations realm of the Islamic
Association Project. The witness was also questioned
about Mr Abdel-Aals relationship with contacts in the
Syrian military intelligence and the Lebanese security
apparatus.The cross-examination of Mr El-Ajouz will
continue until the 3rd of September. A summary of
the hearings from 1 to 3 September will be provided in
the STL Bulletin for September 2015.

News and Press

In August, the STL received visits from various institutions. The Tribunal accommodated an Indonesian
Delegation of 16 professors from Padjadjaran University. Several organs within the Tribunal provided the
delegation with briefings about the work of the STL.
Additionally, an NGO named the Unrepresented
Nations and Peoples Organization in the Netherlands
organised a visit for a group of 40 people to the STL.

Furthermore, the STL welcomed a group of participants that were enrolled in the Asser Institute Summer
Programme on Countering Terrorism.
You can book a visit for a group of at least 10 people by
filling in the online booking form no later than one month
prior to the proposed date of visit.

www.stl-tsl.org
Dokter van der Stamstraat 1, 2265 BC Leidschendam, Netherlands PO Box 115, 2260 AC Leidschendam, Netherlands.
For more information please contact the Public Information and Communications Section: stl-pressoffice@un.org Tel : +31 (0) 70 800 3560 / 3828 and +961 4 538 100 (Beirut)
www.twitter.com/stlebanonwww.facebook.com/stlebanonwww.youtube.com/stlebanonwww.flickr.com/stlebanon