STL Prosecution’s Final Brief Explains ‘Hizbullah Link’, Highlights Activities of Safa, Ghazaleh


The report says slain Hizbullah commander Mustafa Badreddine was “the leader of the three-man team that coordinated the Attack.”


“He was a senior military commander in Hizbullah with the necessary skills, expertise and access to resources. He used to communicate with (Accused Hizbullah operative Salim) Ayyash and (Accused Hizbullah operative Hassan) Merhi in order to coordinate the actions of separate teams carrying out the preparation and execution of the Attack. This is acknowledged (by Hizbullah chief Sayyed Hassan Nasrallah) to be a Hizbullah network, reported to be used by its security apparatus,” the Prosecution’s report says.

“Considered holistically, the exceptional activity of these inter-connected phone groups in areas relevant to Hariri, the crime scene and the false claim of responsibility, lead to the inexorable conclusion that the users of these phones were responsible for the preparation and execution of the Attack and the false claim of responsibility,” it adds.

Noting that it is “not necessary for a conviction,” the Prosecution says its evidence “demonstrates the links between the Accused and Hizbullah and explains the political context in which the Attack occurred.”

“Independent of their links through the mobile phones, the evidence establishes that each of the Accused and Badreddine were further connected through their common support for Hizbullah. Moreover, Hizbullah’s Secretary-General acknowledged that the covert Green Network was a Hizbullah network used by its security apparatus. He also referred to a number of the Accused and Badreddine as ‘honorable resistance men’ and previously asserted that an Indictment had been issued against ‘brothers in the resistance,’” the report points out.

It also noted that “the Accused’s actions alone demonstrate their participation in the conspiracy and their criminal responsibility.”

“The Chamber need not find that they were acting on the behalf or at the behest of any organization, leader, state or entity; nor is the Prosecution requesting this finding. However, the Accused’s political affiliations, coupled with the surrounding political context, assist in understanding the Accused’s common interests. The fact that those interests aligned with maintaining the status quo, which HARIRI threatened, is relevant in understanding the timing and motivations behind the Accused’s actions,” the Prosecution’s report adds, addressing the STL’s Trial Chamber.

The Prosecution’s report reveals that the telecom data used in the case is based on so-called “CDRs” (call data records) provided by the Alfa and MTC Touch mobile phone operators to the Prosecution and to the UNIIIC (U.N. International Independent Investigation Commission).

“CDRs are contemporaneous, automatically-generated records of mobile phone communications. Their main purpose is for billing customers, though they also serve other marketing or statistical business purposes. Given the CDRs’ primary purpose in billing and other business purposes, mobile service providers have an interest in ensuring their integrity,” the report notes.

The report sheds light on Badreddine’s private life and businesses under the aliases ‘Sami Issa’ and ‘Badr Safi’.

“Badreddine, using the alias Sami Issa, was the owner of three jewelery shops

named ‘Samino’, with branches in Mar Elias, Furn el-Shebbak and Bourj Hammoud,

where he employed managers, employees and bodyguards. Two of the three Samino

managers, or ‘insiders’, were in a position to know Badreddine and his real identity,” the report says.

“Badreddine’s death in Syria was announced by Hizbullah on 13 May 2016. Eight witnesses were interviewed after the announcement, all of whom recognized photographs of Badreddine as being the person they knew as Sami Issa and/or Safi,” it adds.

“Hey mr. ISSA, or is it badr;)”, the report quotes a Dec. 2004 SMS sent to one of Badreddine’s numbers as saying.

“Eight witnesses from Sami ISSA’ s university and Samino circles recognized photographs of Badreddine as being the person they knew as Sami Issa and/or Safi, and as the user of (phone numbers) PMP 354 and PMP 663,” the report says.

Turning to the Accused Salim Ayyash, the report notes that the man “did not travel to the KSA in January 2005.”

“There is evidence that suggests an individual using the name ‘Salim Jamil Ayyash’ traveled to the KSA during the period of 15 to 28 January 2005, to perform the Hajj pilgrimage (the ‘2005 Hajj Period’). Although Ayyash initially intended to travel to the KSA during the 2005 Hajj Period, he later canceled his travel plans and remained in Lebanon,” the report says.

It added: “Sometime between 11 January 2005, when he requested his leave, and 15 January 2005, his intended date of departure for Hajj, Ayyash canceled his leave to attend the Hajj. The reason provided by Ayyash for this cancellation was that he had not been granted a visa to KSA. This justification was untruthful, as a KSA visa had indeed been issued in Ayyash’s name.”

More importantly, the report highlights Ayyash’s presence in Haret Hreik “before and during” the famous 2004 meeting between Nasrallah and Hariri and how he allegedly monitored Hariri’s movements and followed him back to Qureitem.

“The fact of the meeting was known only to those in the tightest inner circles of the former Prime Minister and Hizbullah. The precise location of the meeting between Hariri and Nasralllah in Haret Hreik on the night of 21 December 2004 was unknown to Hariri, his security personnel and (his adviser) Mustafa NASSER. Despite this, Ayyash and other members of the Assassination Unit were able to position themselves in order to conduct surveillance and follow Hariri back to Quraitem Palace after the meeting,” the report reveals.

Explaining the link between the political tensions in Lebanon and the activities of the four alleged assassination phone networks, the report says “significant steps taken by the opposition coalition and ultimately by Hariri, their powerful ally, to resist, defy and challenge the Syrian regime’s hegemony corresponded with a reaction of the four phone networks.”

“When put in context with these events, the rationale and motivation behind the behavior of the networks become evident. This rationale, its intimate connection to the behavioral and contact patterns of senior Syrian and Hizbullah officials, such as (former Syrian security chief in Lebanon) Rustom Ghazaleh, (Hizbullah security chief) Wafiq Safa and Badreddine, and the corresponding reaction of the covert networks, reinforces the conclusion that the networks were operated by a single entity co-ordinated by Ayyash and overseen by Badreddine, which pursuant to a common political interest was dedicated to a common purpose: the assassination of Hariri,” the report concludes.

It reveals that the pattern of Ghazaleh’s visits to Haret Hreik after contact with Safa began immediately after the First Bristol Group Meeting of the Lebanese opposition.

“In the evening and over the week that followed the First Bristol Group meeting, Hariri met Nasrallah twice on 22 and 27 September 2004. These meetings were closely mirrored by the first of Ghazaleh’s visits to Haret Hreik after contact with Wafiq Safa on 22 and 28 September 2004,” the report explains.

It describes Safa as “a figure of significant seniority and influence within the Hizbullah security apparatus.”

“He was a regular but not frequent contact of Badreddine in the months preceding the assassination and, significantly, formed part of a call flow with Badreddine and Ayyash that immediately preceded the final preparatory activity in the early hours of the morning of the Attack,” the report reveals.

It also noted that these visits by Ghazaleh to Haret Hreik after contact with Safa formed part of a pattern of behavior that occurred immediately after key events that challenged ongoing Syrian control in Lebanon prior to the assassination:

“1) Second Bristol Group Meeting [13 December 2004];

2) Hariri’s refusal to accept Syrian deposits (pro-Syria MPs on his electoral lists) during a meeting with Ghazaleh [9 January 2005];

3) Hariri’s confirmation of that refusal during a meeting with (ex-MP Nasser) Kandil [ 4 February 2005].”

“This pattern had been absent during the previous 9 months of 2004,” the report notes.

“The second meeting on 16 December 2004 followed an almost identical dynamic: (1) Ghazaleh again traveled from Anjar to Haret Hreik, while in contact with SAFA; (2) he contacted the Syrian Presidential Palace for a three minute call, in the vicinity of

the Hizbullah General Secretariat; 1419 and (3) there, his phone was inactive for a period of time between one and two ours,” the report says.

Describing January 9, 2005 as “the day that Hariri told Rustom Ghazaleh he would no longer bow to the will and constraints imposed by the Syrian regime, and rejected the imposition of pro-Syrian deposits on his electoral lists,” the report says “this was an event of real significance that led to an immediate, sustained, and coordinated acceleration in Mission Phone activity.”

The report also reveals that on February 4, 2005 at the Qureitem Palace, Hariri personally informed Qandil of his decision to not include him on his electoral list.

“Immediately after he left the Palace, Qandil engaged in a close sequence of calls with Ghazaleh and then, unusually, Safa. Later that same evening, (Hizbullah secretary general’s aide Hussein) Khalil invited the journalist (Nassir) al-Assaad to a meeting in Dahyieh to convey an angry message warning Hariri to cooperate with Ghazaleh and accept the Syrian deposits,” the report says.

Turning to the eve of the assassination attack, the report says “Safa’s and Badreddine’s phones converged in the same area.”

“Badreddine left his personal phone (PMP 663) at home. His last call from the Ouzai area, at 01:57, was to the Great Prophet Hospital. Upon his return home, by 02:31, Badreddine sent a SMS text from his personal phone to a close female friend, saying: ‘If you know where I have been, you would be so sad’,” the report adds.

“This penultimate Green Network call to Ayyash on the eve of the Attack was the immediate precursor to unusual activity through the early hours of 14 February 2005 between Ayyash and his deputy, S6, and in turn others within the Assassination Unit,” the report concludes.

Below are the links to the full report as published on the STL’s website:



Notify of
Inline Feedbacks
View all comments
Would love your thoughts, please comment.x