During the last few months of 2015 the Prosecution
called many of its own team members to give evidence, an unusual practice
in (international) criminal proceedings (with the exception of investigators and actual experts working for the Prosecution, who appear more often in court). Some of these witnesses were primarily questioned
by the judges and seem to be called to provide information on technical aspects
of the Prosecution’s case, including the creation of call data
records and databases. Other members of the Prosecution are extensively questioned
by the defence, whilst especially the investigators hardly received any questions. Below a summary of the evidence given by these Prosecution members (and one expert), divided into three main topics.
1. CALL DATA RECORDS (DATABASE AND ANALYSIS)
Mr Spartak
Mkrtchyan (14-15 September)
Mr Mkrtchyan is the Prosecution computer information systems
officer and the database administrator. He and his team are responsible for
the Prosecution's call data record structured query language (or SQL) database.
This includes the design of the database, the upload of the call data records,
and the design of the database's built-in analytical functions or stored
procedures. The Chamber has ordered the Prosecution to call witnesses to
provide further evidence about the production of the call sequence tables and
the underlying data (see decision of 5 May 2015, para. 115). Mr Mkrtchyan provides evidence on
the format in which the raw call data and SMS content was received by the
Prosecution, the database he created and filled with the raw data, and the
stored procedures he wrote to search the database, which enabled the creation
of some of the call sequence tables.
Professor
Peter Sommer (15 September)
Although not a member of the
Prosecution, Professor Sommer was hired by the Prosecution to audit the work of
Mr Mrktchyan and therefore his testimony is included in this blog. Professor
Sommer appeared as an expert witness on
computer and information systems and the storage and security of data,
including digital evidence. He wrote a report called “STL-OTP: Audit of
Telephone Database Administration Processes” dated 17 July 2012. Professor
Sommer visited the STL three times, and during two of these visits he met with witness
Mr Mkrtchyan. He did an audit of the database system as set up by Mr Mkrtchyan,
that is how the data received from the mobile phone companies was converted
into a database, and to “get a clear overview of what the system is supposed to
do, and constantly ask oneself: What could possibly go wrong, what is being done
to prevent those things from going wrong, and what tests can one apply
afterwards to establish that nothing has gone wrong.”
Professor Sommer concluded in his
report that the system in relation to the handling and storage of the call data
and SMS records was very thorough, and included a detailed manual, records of
particular activities, and a unique number for each entry (making it easy to
track back to the material provided by the phone companies). Professor Sommer
further concluded that because of the processes employed, significant errors in
the upload of data or data corruption are manifest or immediately apparent. Further,
the fact that separate and matching records for calls between Alfa and MTC phones
can be seen, provides some confidence in the accuracy and completeness of the
records produced by the two mobile phone companies.
During cross-examination by Defence
Counsel Mr Roberts, Professor Sommer explained that he thought he was asked to
the audit, because the work was considered something of a novelty and there was
a need to reassure the Tribunal that the work was done properly. Further
Professor Sommer agreed that the errors he analyses in his report will not
reveal data manipulation by the mobile phone companies. The witness does not
have any knowledge about the data provided by two additional Lebanese phone
companies to the Prosecution, and did not review the hard disks with data
received by the Prosecution from the mobile phone companies.
Mr Elvis Stana (28 October)
Mr Stana is an analyst with the Prosecution, who did a statistical analysis of the call data records to determine the extent of synchronisation between the clock recordings in the call data records of the providers Alfa and MTC Touch. He explained that the mobile switching centres in Lebanon - that are recording and routing the call - were not centrally synchronised. This means that there could be a slight variation in the time recorded in the call data records for the incoming and outgoing side of a call. Some difference are only a few seconds, but especially in relation to one specific switching centre, the witness recorded a time difference of around 75 seconds. The Prosecution expects that the telephone companies will provide evidence to explain these large differences.
[Screenshot of Mr Stana testifying in court on 28 October 2015]
Ms Kei Kamei (16-19
November 2015 - cross-examination only)
Ms Kamei, an analyst working for the
Prosecution, appeared in court in July and has already
been cross-examined about the creation of the call sequence tables (see our blog on the five witnesses responsible for the creation of CSTs). This cross-examination is about additional topics. Defence Counsel Mr Mettraux for the accused Mr Sabra questioned the witness about information
she received whilst interviewing witnesses, especially in relation to the person who claimed
responsibility for the attack, Mr Abu Adass. The questions cover Mr Abu Adass’s visits to the mosques, the persons who accompanied him and his
relation to certain organisations (including Al-Ahbash), the information found
at his place and on his computer (including material on jihadist sites, a list
on Hariri’s properties and foundations in Lebanon, and a series of maps), and
phone calls made with the landline of the family Abu Adass. This results in a
lot of hearsay evidence from Ms Kamei, of which the value seems questionable. She also does not remember many of the details put to her and explained that her role at that time was to focus on communication analysis. Mr
Mettraux explains that he will seek to tender the actual statements of the
witnesses in the future, mostly to establish the truth of their contents.
[Screenshot of Ms Kamei testifying in court]
The
witness is also asked to comment on the video with the claim of responsibility, and on an alternative scenario on whom bought the phone card that was used to
call Reuters and Al-Jazeera. This alternative scenario is to challenge the Prosecution’s
scenario that it was the accused Sabra that was involved in this. Mr Mettraux
further explains that they are not actually putting a positive case, but just an
alternative possibility for the person who called the media about the claim of responsibility. The
Chamber requests Mr Metttraux to further explain their
defence position on this matter, and Mr Mettraux gives a lengthy explanation in court (see transcript of 19 November, p.101 and further). The Defence for the accused Sabra agree with the Prosecution that Mr Abu Adass was not the suicide bomber and that the video and letter were used to shield the identity of the real perpetrators. The information in their possession suggests that Hariri has been killed by a very sophisticated group of high-ranking state officials who used associates to commit the crimes. This includes members of Al-Ahbash and the Syrian and Lebanese security apparatus. Mr Mettraux also presents their very detailed views on how Abu Adass was lured into this. The Defence for Sabra thus does seem to present a positive case, at least on this topic, which is an interesting position to take in a trial in absentia.
Defence Counsel Mr Larochelle questions Ms Kamei about
the investigations into the links and contacts between Abu Adass and members of
a group called Al-Qaeda 13, including her analysis of the calls made through
the landline of the family Abu Adass. He also questions the witness about the
methods she used in attributing phone numbers to certain persons.
2. ELECTRONIC PRESENTATION SYSTEM
Andrew Fahey
(16-17 September, 27 October)
Mr Fahey is an analyst with the
Prosecution, and since November 2012 the project
manager of the development of the electronic presentation of evidence software.
The evidence of Mr Fahey can be divided into three parts: (i) the electronic
presentation of evidence system; (ii) the associated area of what choices he
made in respect of the cell site data that he used; and (iii) the various
locations that have been plotted into the presentation system. His testimony on
16-17 September 2015 only dealt with the first subject.
Mr Fahey was taken
through a presentation of this system, that the Prosecution intends to use to
present its telecommunication evidence. The system has a database that holds
evidence that the Prosecution is tendering, and creates the ability to search
that database and display and record selected aspects of evidence. During his
testimony the following matters were discussed:
- the five types of evidence that can be displayed in the system: a) the map of Lebanon; b) relevant locations, including routes taken by Hariri; c) cell site information (mast location, orientation and coverage); d) telephone call information (taken from the CSTs); and e) attribution (assigning of short names) of telephone numbers to users (including the accused) or networks;
- how these types of evidence are shown together;
- record keeping (creating pdfs with screenshots and log tables); and
- quality assurance.
The evidence of Mr Fahey on 27
October dealt with the map coordinates established by the witness of eight
residences associated with the accused.
On the basis of his analysis of documents, Mr Fahey has created a number of
maps. Mr Fahey also established the map coordinates for 144 places and
landmarks relevant to the Prosecution case, both for the movement of Hariri and
the phone networks allegedly used by the accused in undertaking surveillance of Hariri in
preparation of the attack.
Bastiaan van der Laken (9-11 November)
Mr Van der Laken works within the Prosecution and explained the functionality of the electronic presentation of evidence system, including the data management tasks associated with uploading data to the software. Like witness Fahey he explained the type of evidence stored in the system, and that this data is uploaded using an excel workbook. The witness also explained how two sides of a phone call are paired using the differences in the time records as established by Mr Stana (see above). The Defence has located mistakes and/or differences in comparing the evidence presentation system and the call sequence tables, and confronted the witness with these mistakes. The witness explained that the software is functioning as intended, but that there always has to be a manual check of the underlying (call) data before presenting anything in court. The data set is still in progress. The Defence also attacks the underlying data, but that seems an issue to be raised with the telecommunication providers.
[Screenshot of Mr Van der Laken testifying in court]
3. INVESTIGATORS
Toby Smith (27 October)
Mr Smith is an investigator working for the Prosecution. He explained some documentary evidence he reviewed to establish the location of property allegedly belonging to the accused Merhi or his family, one of which was subsequently confirmed by witness PRH647 (see our previous blog on evidence and phones owned by the accused). The witness also reviewed documents in relation to a property for which the accused Sabra had an electricity prescription. The witness provides comments on various documents. A less time-consuming approach would be to put these comment in a bar table motion, as this is the Prosecution's view and the Defence does not cross-examine the witness. The Prosecution explains that the location of the residences of the accused are relevant to establish which phones belonged to the accused.
Timothy Holford (28 October)
Mr Holford is an investigations coordinator in the STL Beirut office. He went into the field to establish the GPS coordinates of a number of landmarks in the Prosecution's case and explained the methodology used. The locations include the Mitsubishi canter van dealer in Tripoli, branches of Samino jewellery owned by the accused Badreddine, the office of witness PRH078, residences of Hariri and other places Hariri visited, cell shops were network phones were purchased, and the Al-Jazeera and Reuters offices.
Erich Karnberger (28 October)
Mr Karnberger is an investigator in the STL Beirut office who photographed a number of locations which were plotted by the previous witness Mr Holford.
No comments:
Post a Comment